ConstantFoldingPhase(Graph& graph)

: Phase(graph, "constant folding"_s)

, m_state(graph)

, m_interpreter(graph, m_state)

, m_insertionSet(graph)

{

}

bool run()

{

bool changed = false;

for (BasicBlock* block : m_graph.blocksInNaturalOrder())

changed |= foldConstants(block);

if (changed && m_graph.m_form == SSA) {

// It's now possible that we have Upsilons pointed at JSConstants. Fix that.

for (BasicBlock* block : m_graph.blocksInNaturalOrder())

fixUpsilons(block);

}

if (m_graph.m_form == SSA) {

// It's now possible to simplify basic blocks by placing an Unreachable terminator right

// after anything that invalidates AI.

bool didClipBlock = false;

Vector<Node*> nodesToDelete;

for (BasicBlock* block : m_graph.blocksInNaturalOrder()) {

m_state.beginBasicBlock(block);

for (unsigned nodeIndex = 0; nodeIndex < block->size(); ++nodeIndex) {

if (block->at(nodeIndex)->isTerminal()) {

// It's possible that we have something after the terminal. It could be a

// no-op Check node, for example. We don't want the logic below to turn that

// node into Unreachable, since then we'd have two terminators.

break;

}

if (!m_state.isValid()) {

NodeOrigin origin = block->at(nodeIndex)->origin;

for (unsigned killIndex = nodeIndex; killIndex < block->size(); ++killIndex)

nodesToDelete.append(block->at(killIndex));

block->resize(nodeIndex);

block->appendNode(m_graph, SpecNone, Unreachable, origin);

didClipBlock = true;

break;

}

m_interpreter.execute(nodeIndex);

}

m_state.reset();

}

if (didClipBlock) {

changed = true;

m_graph.invalidateNodeLiveness();

for (Node* node : nodesToDelete)

m_graph.deleteNode(node);

m_graph.invalidateCFG();

m_graph.resetReachability();

m_graph.killUnreachableBlocks();

}

}

return changed;

}

bool foldConstants(BasicBlock* block)

{

// CFAUnreachable, skip

if (!block->cfaHasVisited)

return false;

bool changed = false;

m_state.beginBasicBlock(block);

for (unsigned indexInBlock = 0; indexInBlock < block->size(); ++indexInBlock) {

if (!m_state.isValid())

break;

Node* node = block->at(indexInBlock);

bool alreadyHandled = false;

bool eliminated = false;

switch (node->op()) {

case BooleanToNumber: {

if (node->child1().useKind() == UntypedUse

&& !m_interpreter.needsTypeCheck(node->child1(), SpecBoolean))

node->child1().setUseKind(BooleanUse);

break;

}

case CompareLess:

case CompareLessEq:

case CompareGreater:

case CompareGreaterEq:

case CompareEq: {

// FIXME: We should add back the broken folding phase here for comparisions where we prove at least one side has type SpecOther.

// See: https://bugs.webkit.org/show_bug.cgi?id=174844

if (node->isBinaryUseKind(DoubleRepUse)) {

auto isInt32ConvertedToDouble = [&](Edge& edge) {

if (edge->op() == DoubleConstant)

return edge->constant()->value().isInt32AsAnyInt();

if (edge->op() == DoubleRep)

return edge->child1().useKind() == Int32Use;

return false;

};

auto convertToInt32 = [&](Edge& edge) -> Node* {

if (edge->op() == DoubleConstant)

return m_insertionSet.insertConstant(indexInBlock, node->origin, jsNumber(edge->constant()->value().asInt32AsAnyInt()));

ASSERT(edge->op() == DoubleRep);

return edge->child1().node();

};

if (isInt32ConvertedToDouble(node->child1()) && isInt32ConvertedToDouble(node->child2())) {

m_interpreter.execute(indexInBlock); // Push CFA over this node after we get the state before.

alreadyHandled = true; // Don't allow the default constant folder to do things to this.

node->child1() = Edge(convertToInt32(node->child1()), Int32Use);

node->child2() = Edge(convertToInt32(node->child2()), Int32Use);

changed = true;

break;

}

}

if (node->isBinaryUseKind(Int52RepUse)) {

auto isInt32ConvertedToInt52 = [&](Edge& edge) {

if (edge->op() == Int52Constant)

return edge->constant()->value().isInt32AsAnyInt();

if (edge->op() == Int52Rep)

return edge->child1().useKind() == Int32Use;

return false;

};

auto convertToInt32 = [&](Edge& edge) -> Node* {

if (edge->op() == Int52Constant)

return m_insertionSet.insertConstant(indexInBlock, node->origin, jsNumber(edge->constant()->value().asInt32AsAnyInt()));

ASSERT(edge->op() == Int52Rep);

return edge->child1().node();

};

if (isInt32ConvertedToInt52(node->child1()) && isInt32ConvertedToInt52(node->child2())) {

m_interpreter.execute(indexInBlock); // Push CFA over this node after we get the state before.

alreadyHandled = true; // Don't allow the default constant folder to do things to this.

node->child1() = Edge(convertToInt32(node->child1()), Int32Use);

node->child2() = Edge(convertToInt32(node->child2()), Int32Use);

changed = true;

break;

}

}

break;

}

case CompareStrictEq:

case SameValue: {

if (node->isBinaryUseKind(UntypedUse)) {

JSValue child1Constant = m_state.forNode(node->child1().node()).value();

JSValue child2Constant = m_state.forNode(node->child2().node()).value();

auto isNonStringAndNonBigIntCellConstant = [] (JSValue value) {

return value && value.isCell() && !value.isString() && !value.isHeapBigInt();

};

if (isNonStringAndNonBigIntCellConstant(child1Constant)) {

node->convertToCompareEqPtr(m_graph.freezeStrong(child1Constant.asCell()), node->child2());

changed = true;

} else if (isNonStringAndNonBigIntCellConstant(child2Constant)) {

node->convertToCompareEqPtr(m_graph.freezeStrong(child2Constant.asCell()), node->child1());

changed = true;

}

}

break;

}

case CheckStructureOrEmpty: {

const AbstractValue& value = m_state.forNode(node->child1());

if (value.m_type & SpecEmpty)

break;

node->convertCheckStructureOrEmptyToCheckStructure();

changed = true;

[[fallthrough]];

}

case CheckStructure:

case ArrayifyToStructure: {

AbstractValue& value = m_state.forNode(node->child1());

RegisteredStructureSet set;

if (node->op() == ArrayifyToStructure) {

set = node->structure();

ASSERT(!isCopyOnWrite(node->structure()->indexingMode()));

} else {

set = node->structureSet();

if ((SpecCellCheck & SpecEmpty) && node->child1().useKind() == CellUse && m_state.forNode(node->child1()).m_type & SpecEmpty) {

m_insertionSet.insertNode(

indexInBlock, SpecNone, AssertNotEmpty, node->origin, Edge(node->child1().node(), UntypedUse));

}

}

if (value.m_structure.isSubsetOf(set)) {

m_interpreter.execute(indexInBlock); // Catch the fact that we may filter on cell.

node->remove(m_graph);

eliminated = true;

break;

}

if (node->op() == CheckStructure) {

Edge incoming = node->child1();

if (set.onlyStructure().get() == m_graph.m_vm.stringStructure.get()) {

m_interpreter.execute(indexInBlock); // Catch the fact that we may filter on cell.

node->remove(m_graph);

m_insertionSet.insertCheck(indexInBlock + 1, node->origin, Edge(incoming.node(), StringUse));

eliminated = true;

break;

}

if (set.onlyStructure().get() == m_graph.m_vm.symbolStructure.get()) {

m_interpreter.execute(indexInBlock); // Catch the fact that we may filter on cell.

node->remove(m_graph);

m_insertionSet.insertCheck(indexInBlock + 1, node->origin, Edge(incoming.node(), SymbolUse));

eliminated = true;

break;

}

if (set.onlyStructure().get() == m_graph.m_vm.bigIntStructure.get()) {

m_interpreter.execute(indexInBlock); // Catch the fact that we may filter on cell.

node->remove(m_graph);

m_insertionSet.insertCheck(indexInBlock + 1, node->origin, Edge(incoming.node(), HeapBigIntUse));

eliminated = true;

break;

}

}

break;

}

case CheckJSCast: {

JSValue constant = m_state.forNode(node->child1()).value();

if (constant) {

if (constant.isCell() && constant.asCell()->inherits(node->classInfo())) {

m_interpreter.execute(indexInBlock);

node->remove(m_graph);

eliminated = true;

break;

}

}

AbstractValue& value = m_state.forNode(node->child1());

if (value.m_structure.isSubClassOf(node->classInfo())) {

m_interpreter.execute(indexInBlock);

node->remove(m_graph);

eliminated = true;

break;

}

break;

}

case CheckNotJSCast: {

JSValue constant = m_state.forNode(node->child1()).value();

if (constant) {

if (constant.isCell() && !constant.asCell()->inherits(node->classInfo())) {

m_interpreter.execute(indexInBlock);

node->remove(m_graph);

eliminated = true;

break;

}

}

AbstractValue& value = m_state.forNode(node->child1());

if (value.m_structure.isNotSubClassOf(node->classInfo())) {

m_interpreter.execute(indexInBlock);

node->remove(m_graph);

eliminated = true;

break;

}

break;

}

case GetIndexedPropertyStorage: {

JSArrayBufferView* view = m_graph.tryGetFoldableView(

m_state.forNode(node->child1()).m_value, node->arrayMode());

if (!view)

break;

if (view->mode() == FastTypedArray) {

// FIXME: It would be awesome to be able to fold the property storage for

// these GC-allocated typed arrays. For now it doesn't matter because the

// most common use-cases for constant typed arrays involve large arrays with

// aliased buffer views.

// https://bugs.webkit.org/show_bug.cgi?id=125425

break;

}

m_interpreter.execute(indexInBlock);

eliminated = true;

m_insertionSet.insertCheck(indexInBlock, node->origin, node->children);

node->convertToConstantStoragePointer(view->vector());

break;

}

case CheckStructureImmediate: {

AbstractValue& value = m_state.forNode(node->child1());

const RegisteredStructureSet& set = node->structureSet();

if (value.value()) {

if (Structure* structure = jsDynamicCast<Structure*>(value.value())) {

if (set.contains(m_graph.registerStructure(structure))) {

m_interpreter.execute(indexInBlock);

node->remove(m_graph);

eliminated = true;

break;

}

}

}

if (PhiChildren* phiChildren = m_interpreter.phiChildren()) {

bool allGood = true;

phiChildren->forAllTransitiveIncomingValues(

node,

[&] (Node* incoming) {

if (Structure* structure = incoming->dynamicCastConstant<Structure*>()) {

if (set.contains(m_graph.registerStructure(structure)))

return;

}

allGood = false;

});

if (allGood) {

m_interpreter.execute(indexInBlock);

node->remove(m_graph);

eliminated = true;

break;

}

}

break;

}

case CheckArrayOrEmpty: {

const AbstractValue& value = m_state.forNode(node->child1());

if (!(value.m_type & SpecEmpty)) {

node->convertCheckArrayOrEmptyToCheckArray();

changed = true;

}

// Even if the input includes SpecEmpty, we can fall through to CheckArray and remove the node.

// CheckArrayOrEmpty can be removed when arrayMode meets the requirement. In that case, CellUse's

// check just remains, and it works as CheckArrayOrEmpty without ArrayMode checking.

ASSERT(typeFilterFor(node->child1().useKind()) & SpecEmpty);

[[fallthrough]];

}

case CheckArray:

case Arrayify: {

if (!node->arrayMode().alreadyChecked(m_graph, node, m_state.forNode(node->child1())))

break;

node->remove(m_graph);

eliminated = true;

break;

}

case PutStructure: {

if (m_state.forNode(node->child1()).m_structure.onlyStructure() != node->transition()->next)

break;

node->remove(m_graph);

eliminated = true;

break;

}

case CheckIsConstant: {

if (m_state.forNode(node->child1()).value() != node->constant()->value())

break;

node->remove(m_graph);

eliminated = true;

break;

}

case AssertNotEmpty:

case CheckNotEmpty: {

if (m_state.forNode(node->child1()).m_type & SpecEmpty)

break;

node->remove(m_graph);

eliminated = true;

break;

}

case CheckIdent: {

UniquedStringImpl* uid = node->uidOperand();

const UniquedStringImpl* constantUid = nullptr;

JSValue childConstant = m_state.forNode(node->child1()).value();

if (childConstant) {

if (childConstant.isString()) {

if (const auto* impl = asString(childConstant)->tryGetValueImpl()) {

// Edge filtering requires that a value here should be StringIdent.

// However, a constant value propagated in DFG is not filtered.

// So here, we check the propagated value is actually an atomic string.

// And if it's not, we just ignore.

if (impl->isAtom())

constantUid = static_cast<const UniquedStringImpl*>(impl);

}

} else if (childConstant.isSymbol()) {

Symbol* symbol = jsCast<Symbol*>(childConstant);

constantUid = &symbol->uid();

}

}

if (constantUid == uid) {

node->remove(m_graph);

eliminated = true;

}

break;

}

case CheckInBounds: {

JSValue left = m_state.forNode(node->child1()).value();

JSValue right = m_state.forNode(node->child2()).value();

if (left && right && left.isInt32() && right.isInt32()

&& static_cast<uint32_t>(left.asInt32()) < static_cast<uint32_t>(right.asInt32())) {

Node* zero = m_insertionSet.insertConstant(indexInBlock, node->origin, jsNumber(0));

node->convertToIdentityOn(zero);

eliminated = true;

break;

}

break;

}

case CheckInBoundsInt52:

break;

case GetArrayLength: {

ArrayMode arrayMode = node->arrayMode();

AbstractValue& abstractValue = m_state.forNode(node->child1());

if (arrayMode.type() != Array::AnyTypedArray && arrayMode.isSomeTypedArrayView() && !arrayMode.mayBeResizableOrGrowableSharedTypedArray()) {

if (abstractValue.m_type && abstractValue.isType(SpecObject) && abstractValue.m_structure.isFinite()) {

bool canFold = !abstractValue.m_structure.isClear();

JSGlobalObject* globalObject = m_graph.globalObjectFor(node->origin.semantic);

abstractValue.m_structure.forEach([&](RegisteredStructure structure) {

if (!arrayMode.structureWouldPassArrayModeFiltering(structure.get())) {

canFold = false;

return;

}

if (structure->realm() != globalObject) {

canFold = false;

return;

}

});

if (canFold) {

if (m_graph.isWatchingArrayBufferDetachWatchpoint(node)) {

node->setOp(GetUndetachedTypeArrayLength);

node->setArrayMode(arrayMode.withArrayClass(Array::NonArray));

changed = true;

break;

}

}

}

}

break;

}

case CheckDetached: {

AbstractValue& abstractValue = m_state.forNode(node->child1());

if (abstractValue.m_type && abstractValue.isType(SpecObject) && abstractValue.m_structure.isFinite()) {

bool canFold = !abstractValue.m_structure.isClear();

JSGlobalObject* globalObject = m_graph.globalObjectFor(node->origin.semantic);

abstractValue.m_structure.forEach([&](RegisteredStructure structure) {

if (structure->realm() != globalObject) {

canFold = false;

return;

}

});

if (canFold) {

if (m_graph.isWatchingArrayBufferDetachWatchpoint(node)) {

m_interpreter.execute(indexInBlock); // Catch the fact that we may filter on cell.

node->remove(m_graph);

eliminated = true;

break;

}

}

}

break;

}

case GetMyArgumentByVal:

case GetMyArgumentByValOutOfBounds: {

JSValue indexValue = m_state.forNode(node->child2()).value();

if (!indexValue || !indexValue.isUInt32())

break;

CheckedUint32 checkedIndex = indexValue.asUInt32();

checkedIndex += node->numberOfArgumentsToSkip();

if (checkedIndex.hasOverflowed())

break;

unsigned index = checkedIndex;

Node* arguments = node->child1().node();

InlineCallFrame* inlineCallFrame = arguments->origin.semantic.inlineCallFrame();

// Don't try to do anything if the index is known to be outside our static bounds. Note

// that our static bounds are usually strictly larger than the dynamic bounds. The

// exception is something like this, assuming foo() is not inlined:

//

// function foo() { return arguments[5]; }

//

// Here the static bound on number of arguments is 0, and we're accessing index 5. We

// will not strength-reduce this to GetStack because GetStack is otherwise assumed by the

// compiler to access those variables that are statically accounted for; for example if

// we emitted a GetStack on arg6 we would have out-of-bounds access crashes anywhere that

// uses an Operands<> map. There is not much cost to continuing to use a

// GetMyArgumentByVal in such statically-out-of-bounds accesses; we just lose CFA unless

// GCSE removes the access entirely.

if (inlineCallFrame) {

if (index >= static_cast<unsigned>(inlineCallFrame->argumentCountIncludingThis - 1))

break;

} else {

if (index >= m_state.numberOfArguments() - 1)

break;

}

m_interpreter.execute(indexInBlock); // Push CFA over this node after we get the state before.

StackAccessData* data;

if (inlineCallFrame) {

data = m_graph.m_stackAccessData.add(

VirtualRegister(

inlineCallFrame->stackOffset +

CallFrame::argumentOffset(index)),

FlushedJSValue);

} else {

data = m_graph.m_stackAccessData.add(

virtualRegisterForArgumentIncludingThis(index + 1), FlushedJSValue);

}

if (inlineCallFrame && !inlineCallFrame->isVarargs() && index < static_cast<unsigned>(inlineCallFrame->argumentCountIncludingThis - 1)) {

node->convertToGetStack(data);

eliminated = true;

break;

}

if (node->op() == GetMyArgumentByValOutOfBounds)

break;

Node* length = emitCodeToGetArgumentsArrayLength(

m_insertionSet, arguments, indexInBlock, node->origin);

Node* check = m_insertionSet.insertNode(

indexInBlock, SpecNone, CheckInBounds, node->origin,

node->child2(), Edge(length, Int32Use));

node->convertToGetStack(data);

node->child1() = Edge(check, UntypedUse);

eliminated = true;

break;

}

case MultiGetByOffset: {

Edge baseEdge = node->child1();

Node* base = baseEdge.node();

MultiGetByOffsetData& data = node->multiGetByOffsetData();

// First prune the variants, then check if the MultiGetByOffset can be

// strength-reduced to a GetByOffset.

AbstractValue baseValue = m_state.forNode(base);

m_interpreter.execute(indexInBlock); // Push CFA over this node after we get the state before.

alreadyHandled = true; // Don't allow the default constant folder to do things to this.

for (unsigned i = 0; i < data.cases.size(); ++i) {

MultiGetByOffsetCase& getCase = data.cases[i];

getCase.set().filter(baseValue);

if (getCase.set().isEmpty()) {

data.cases[i--] = data.cases.last();

data.cases.removeLast();

changed = true;

}

}

if (data.cases.size() != 1)

break;

emitGetByOffset(indexInBlock, node, baseValue, data.cases[0], data.identifierNumber);

changed = true;

break;

}

case MultiPutByOffset: {

Edge baseEdge = node->child1();

Node* base = baseEdge.node();

MultiPutByOffsetData& data = node->multiPutByOffsetData();

AbstractValue baseValue = m_state.forNode(base);

m_interpreter.execute(indexInBlock); // Push CFA over this node after we get the state before.

alreadyHandled = true; // Don't allow the default constant folder to do things to this.

for (unsigned i = 0; i < data.variants.size(); ++i) {

PutByVariant& variant = data.variants[i];

variant.oldStructure().genericFilter([&] (Structure* structure) -> bool {

return baseValue.contains(m_graph.registerStructure(structure));

});

if (variant.oldStructure().isEmpty()) {

data.variants[i--] = data.variants.last();

data.variants.removeLast();

changed = true;

continue;

}

if (variant.kind() == PutByVariant::Transition

&& variant.oldStructure().onlyStructure() == variant.newStructure()) {

variant = PutByVariant::replace(variant.identifier(), variant.oldStructure(), variant.offset(), variant.viaGlobalProxy());

changed = true;

}

}

if (data.variants.size() != 1)

break;

emitPutByOffset(

indexInBlock, node, baseValue, data.variants[0], data.identifierNumber);

changed = true;

break;

}

case MultiDeleteByOffset: {

Edge baseEdge = node->child1();

Node* base = baseEdge.node();

MultiDeleteByOffsetData& data = node->multiDeleteByOffsetData();

AbstractValue baseValue = m_state.forNode(base);

m_interpreter.execute(indexInBlock); // Push CFA over this node after we get the state before.

alreadyHandled = true; // Don't allow the default constant folder to do things to this.

for (unsigned i = 0; i < data.variants.size(); ++i) {

DeleteByVariant& variant = data.variants[i];

if (!baseValue.contains(m_graph.registerStructure(variant.oldStructure()))) {

data.variants[i--] = data.variants.last();

data.variants.removeLast();

changed = true;

continue;

}

}

if (data.variants.size() != 1)

break;

emitDeleteByOffset(

indexInBlock, node, baseValue, data.variants[0], data.identifierNumber);

changed = true;

break;

}

case MatchStructure: {

Edge baseEdge = node->child1();

Node* base = baseEdge.node();

MatchStructureData& data = node->matchStructureData();

AbstractValue baseValue = m_state.forNode(base);

m_interpreter.execute(indexInBlock); // Push CFA over this node after we get the state before.

alreadyHandled = true; // Don't allow the default constant folder to do things to this.

BooleanLattice result = BooleanLattice::Bottom;

for (unsigned i = 0; i < data.variants.size(); ++i) {

if (!baseValue.contains(data.variants[i].structure)) {

data.variants[i--] = data.variants.last();

data.variants.removeLast();

changed = true;

continue;

}

result = leastUpperBoundOfBooleanLattices(

result,

data.variants[i].result ? BooleanLattice::True : BooleanLattice::False);

}

if (result == BooleanLattice::False || result == BooleanLattice::True) {

RegisteredStructureSet structureSet;

for (MatchStructureVariant& variant : data.variants)

structureSet.add(variant.structure);

addBaseCheck(indexInBlock, node, baseValue, structureSet);

m_graph.convertToConstant(

node, m_graph.freeze(jsBoolean(result == BooleanLattice::True)));

changed = true;

}

break;

}

case GetByIdDirect:

case GetByIdDirectFlush:

case GetById:

case GetByIdFlush:

case GetByIdMegamorphic:

case GetPrivateNameById: {

Edge childEdge = node->child1();

Node* child = childEdge.node();

CacheableIdentifier identifier = node->cacheableIdentifier();

AbstractValue baseValue = m_state.forNode(child);

m_interpreter.execute(indexInBlock); // Push CFA over this node after we get the state before.

alreadyHandled = true; // Don't allow the default constant folder to do things to this.

if (!Options::useAccessInlining())

break;

if (!baseValue.m_structure.isFinite()

|| (node->child1().useKind() == UntypedUse || (baseValue.m_type & ~SpecCell)))

break;

GetByStatus status = GetByStatus::computeFor(m_graph.globalObjectFor(node->origin.semantic), baseValue.m_structure.toStructureSet(), identifier);

if (!status.isSimple())

break;

auto addFilterStatus = [&] () {

m_insertionSet.insertNode(

indexInBlock, SpecNone, FilterGetByStatus, node->origin,

OpInfo(m_graph.m_plan.recordedStatuses().addGetByStatus(node->origin.semantic, status)),

Edge(child));

};

// AI already concluded this was a constant so we're safe to do so as well.

if (AbstractValue constantResult = m_state.forNode(node); constantResult.value()) {

addFilterStatus();

m_graph.convertToConstant(node, constantResult.value());

changed = true;

break;

}

if (status.numVariants() == 1) {

auto variant = status[0];

if (!variant.conditionSet().isEmpty())

break;

}

for (unsigned i = status.numVariants(); i--;) {

if (!status[i].conditionSet().isEmpty())

break;

}

if (status.numVariants() == 1) {

unsigned identifierNumber = m_graph.identifiers().ensure(identifier.uid());

addFilterStatus();

emitGetByOffset(indexInBlock, node, baseValue, status[0], identifierNumber);

changed = true;

break;

}

if (!m_graph.m_plan.isFTL())

break;

unsigned identifierNumber = m_graph.identifiers().ensure(identifier.uid());

addFilterStatus();

MultiGetByOffsetData* data = m_graph.m_multiGetByOffsetData.add();

for (const GetByVariant& variant : status.variants()) {

data->cases.append(

MultiGetByOffsetCase(

*m_graph.addStructureSet(variant.structureSet()),

GetByOffsetMethod::load(variant.offset())));

}

data->identifierNumber = identifierNumber;

node->convertToMultiGetByOffset(data);

changed = true;

break;

}

case PutPrivateNameById: {

bool isDirect = true;

tryFoldAsPutByOffset(node, indexInBlock, node->child1(), node->child2(), isDirect, node->privateFieldPutKind(), changed, alreadyHandled);

break;

}

case PutById:

case PutByIdDirect:

case PutByIdFlush:

case PutByIdMegamorphic: {

bool isDirect = node->op() == PutByIdDirect;

tryFoldAsPutByOffset(node, indexInBlock, node->child1(), node->child2(), isDirect, PrivateFieldPutKind::none(), changed, alreadyHandled);

break;

}

case InByVal:

case InByValMegamorphic: {

AbstractValue& property = m_state.forNode(node->child2());

if (JSValue constant = property.value()) {

if (constant.isString()) {

JSString* string = asString(constant);

if (CacheableIdentifier::isCacheableIdentifierCell(string) && !parseIndex(CacheableIdentifier::createFromCell(string).uid())) {

const StringImpl* impl = string->tryGetValueImpl();

RELEASE_ASSERT(impl);

m_graph.freezeStrong(string);

m_graph.identifiers().ensure(const_cast<UniquedStringImpl*>(static_cast<const UniquedStringImpl*>(impl)));

m_insertionSet.insertCheck(indexInBlock, node->origin, m_graph.child(node, 0));

node->convertToInByIdMaybeMegamorphic(m_graph, CacheableIdentifier::createFromCell(string));

changed = true;

break;

}

}

}

break;

}

case GetByVal:

case GetByValMegamorphic: {

if (m_graph.child(node, 0).useKind() == ObjectUse && node->arrayMode().type() == Array::Generic) {

AbstractValue& property = m_state.forNode(m_graph.child(node, 1));

if (JSValue constant = property.value()) {

if (constant.isString()) {

JSString* string = asString(constant);

if (CacheableIdentifier::isCacheableIdentifierCell(string) && !parseIndex(CacheableIdentifier::createFromCell(string).uid())) {

const StringImpl* impl = string->tryGetValueImpl();

RELEASE_ASSERT(impl);

m_graph.freezeStrong(string);

m_graph.identifiers().ensure(const_cast<UniquedStringImpl*>(static_cast<const UniquedStringImpl*>(impl)));

m_insertionSet.insertCheck(indexInBlock, node->origin, m_graph.child(node, 0));

node->convertToGetByIdMaybeMegamorphic(m_graph, CacheableIdentifier::createFromCell(string));

changed = true;

break;

}

}

}

}

break;

}

case PutByVal:

case PutByValMegamorphic: {

if ((m_graph.child(node, 0).useKind() == CellUse && m_graph.child(node, 1).useKind() == StringUse) && node->arrayMode().modeForPut().type() == Array::Generic) {

AbstractValue& property = m_state.forNode(m_graph.child(node, 1));

if (JSValue constant = property.value()) {

if (constant.isString()) {

JSString* string = asString(constant);

if (CacheableIdentifier::isCacheableIdentifierCell(string) && !parseIndex(CacheableIdentifier::createFromCell(string).uid())) {

const StringImpl* impl = string->tryGetValueImpl();

RELEASE_ASSERT(impl);

m_graph.freezeStrong(string);

m_graph.identifiers().ensure(const_cast<UniquedStringImpl*>(static_cast<const UniquedStringImpl*>(impl)));

m_insertionSet.insertCheck(indexInBlock, node->origin, m_graph.child(node, 0));

m_insertionSet.insertCheck(indexInBlock, node->origin, m_graph.child(node, 1));

node->convertToPutByIdMaybeMegamorphic(m_graph, CacheableIdentifier::createFromCell(string));

changed = true;

break;

}

}

}

}

break;

}

case ToPrimitive: {

if (m_state.forNode(node->child1()).m_type & ~(SpecFullNumber | SpecBoolean | SpecString | SpecSymbol | SpecBigInt))

break;

node->convertToIdentity();

changed = true;

break;

}

case ToPropertyKey: {

if (m_state.forNode(node->child1()).m_type & ~(SpecString | SpecSymbol))

break;

node->convertToIdentity();

changed = true;

break;

}

case ToPropertyKeyOrNumber: {

if (m_state.forNode(node->child1()).m_type & ~(SpecFullNumber | SpecString | SpecSymbol))

break;

node->convertToIdentity();

changed = true;

break;

}

case ToThis: {

ToThisResult result = isToThisAnIdentity(node->ecmaMode(), m_state.forNode(node->child1()));

if (result == ToThisResult::Identity) {

node->convertToIdentity();

changed = true;

break;

}

if (result == ToThisResult::GlobalThis) {

node->convertToGetGlobalThis();

changed = true;

break;

}

break;

}

case CreateThis: {

if (JSValue base = m_state.forNode(node->child1()).m_value) {

if (auto* function = jsDynamicCast<JSFunction*>(base)) {

if (FunctionRareData* rareData = function->rareData()) {

if (rareData->allocationProfileWatchpointSet().isStillValid() && m_graph.isWatchingStructureCacheClearedWatchpoint(node)) {

Structure* structure = rareData->objectAllocationStructure();

JSObject* prototype = rareData->objectAllocationPrototype();

if (structure

&& (structure->hasMonoProto() || prototype)) {

m_graph.freeze(rareData);

m_graph.watchpoints().addLazily(rareData->allocationProfileWatchpointSet());

node->convertToNewObject(m_graph.registerStructure(structure));

if (structure->hasPolyProto()) {

StorageAccessData* data = m_graph.m_storageAccessData.add();

data->offset = knownPolyProtoOffset;

data->identifierNumber = m_graph.identifiers().ensure(m_graph.m_vm.propertyNames->builtinNames().polyProtoName().impl());

NodeOrigin origin = node->origin.withInvalidExit();

Node* prototypeNode = m_insertionSet.insertConstant(

indexInBlock + 1, origin, m_graph.freeze(prototype));

ASSERT(isInlineOffset(knownPolyProtoOffset));

m_insertionSet.insertNode(

indexInBlock + 1, SpecNone, PutByOffset, origin, OpInfo(data),

Edge(node, KnownStorageUse), Edge(node, KnownCellUse), Edge(prototypeNode, UntypedUse));

}

changed = true;

break;

}

}

}

}

}

break;

}

case CreatePromise: {

JSGlobalObject* globalObject = m_graph.globalObjectFor(node->origin.semantic);

if (JSValue base = m_state.forNode(node->child1()).m_value) {

if (base == (node->isInternalPromise() ? globalObject->internalPromiseConstructor() : globalObject->promiseConstructor())) {

node->convertToNewInternalFieldObject(m_graph.registerStructure(node->isInternalPromise() ? globalObject->internalPromiseStructure() : globalObject->promiseStructure()));

changed = true;

break;

}

if (auto* function = jsDynamicCast<JSFunction*>(base)) {

if (FunctionRareData* rareData = function->rareData()) {

if (rareData->allocationProfileWatchpointSet().isStillValid() && m_graph.isWatchingStructureCacheClearedWatchpoint(node)) {

Structure* structure = rareData->internalFunctionAllocationStructure();

if (structure

&& structure->classInfoForCells() == (node->isInternalPromise() ? JSInternalPromise::info() : JSPromise::info())

&& structure->realm() == globalObject) {

m_graph.freeze(rareData);

m_graph.watchpoints().addLazily(rareData->allocationProfileWatchpointSet());

node->convertToNewInternalFieldObject(m_graph.registerStructure(structure));

changed = true;

break;

}