{

// Some notes:

//

// - The canonical way of clobbering the world is to read world and write

// heap. This is because World subsumes Heap and Stack, and Stack can be

// read by anyone but only written to by explicit stack writing operations.

// Of course, claiming to also write World is not wrong; it'll just

// pessimise some important optimizations.

//

// - We cannot hoist, or sink, anything that has effects. This means that the

// easiest way of indicating that something cannot be hoisted is to claim

// that it side-effects some miscellaneous thing.

//

// - We cannot hoist forward-exiting nodes without some additional effort. I

// believe that what it comes down to is that forward-exiting generally have

// their NodeExitsForward cleared upon hoist, except for forward-exiting

// nodes that take bogus state as their input. Those are substantially

// harder. We disable it for now. In the future we could enable it by having

// versions of those nodes that backward-exit instead, but I'm not convinced

// of the soundness.

//

// - Some nodes lie, and claim that they do not read the JSCell_structureID,

// JSCell_typeInfoFlags, etc. These are nodes that use the structure in a way

// that does not depend on things that change under structure transitions.

//

// - It's implicitly understood that OSR exits read the world. This is why we

// generally don't move or eliminate stores. Every node can exit, so the

// read set does not reflect things that would be read if we exited.

// Instead, the read set reflects what the node will have to read if it

// *doesn't* exit.

//

// - Broadly, we don't say that we're reading something if that something is

// immutable.

//

// - This must be sound even prior to type inference. We use this as early as

// bytecode parsing to determine at which points in the program it's legal to

// OSR exit.

//

// - If you do read(Stack) or read(World), then make sure that readTop() in

// PreciseLocalClobberize is correct.

// While read() and write() are fairly self-explanatory - they track what sorts of things the

// node may read or write - the def() functor is more tricky. It tells you the heap locations

// (not just abstract heaps) that are defined by a node. A heap location comprises an abstract

// heap, some nodes, and a LocationKind. Briefly, a location defined by a node is a location

// whose value can be deduced from looking at the node itself. The locations returned must obey

// the following properties:

//

// - If someone wants to CSE a load from the heap, then a HeapLocation object should be

// sufficient to find a single matching node.

//

// - The abstract heap is the only abstract heap that could be clobbered to invalidate any such

// CSE attempt. I.e. if clobberize() reports that on every path between some node and a node

// that defines a HeapLocation that it wanted, there were no writes to any abstract heap that

// overlap the location's heap, then we have a sound match. Effectively, the semantics of

// write() and def() are intertwined such that for them to be sound they must agree on what

// is CSEable.

//

// read(), write(), and def() for heap locations is enough to do GCSE on effectful things. To

// keep things simple, this code will also def() pure things. def() must be overloaded to also

// accept PureValue. This way, a client of clobberize() can implement GCSE entirely using the

// information that clobberize() passes to write() and def(). Other clients of clobberize() can

// just ignore def() by using a NoOpClobberize functor.

// We allow the runtime to perform a stack scan at any time. We don't model which nodes get implemented

// by calls into the runtime. For debugging we might replace the implementation of any node with a call

// to the runtime, and that call may walk stack. Therefore, each node must read() anything that a stack

// scan would read. That's what this does.

for (InlineCallFrame* inlineCallFrame = node->origin.semantic.inlineCallFrame(); inlineCallFrame; inlineCallFrame = inlineCallFrame->directCaller.inlineCallFrame()) {

if (inlineCallFrame->isClosureCall)

read(AbstractHeap(Stack, VirtualRegister(inlineCallFrame->stackOffset + CallFrameSlot::callee)));

if (inlineCallFrame->isVarargs())

read(AbstractHeap(Stack, VirtualRegister(inlineCallFrame->stackOffset + CallFrameSlot::argumentCountIncludingThis)));

}

// We don't want to specifically account which nodes can read from the scope

// when the debugger is enabled. It's helpful to just claim all nodes do.

// Specifically, if a node allocates, this may call into the debugger's machinery.

// The debugger's machinery is free to take a stack trace and try to read from

// a scope which is expected to be flushed to the stack.

if (graph.hasDebuggerEnabled()) {

ASSERT(!node->origin.semantic.inlineCallFrame());

read(AbstractHeap(Stack, graph.m_codeBlock->scopeRegister()));

}

auto clobberTop = [&] {

if (Options::validateDFGClobberize())

clobberTopFunctor();

read(World);

write(Heap);

};

// Since Fixup can widen our ArrayModes based on profiling from other nodes we pessimistically assume

// all nodes with an ArrayMode can clobber top. We allow some nodes like CheckArray because they can

// only exit.

if (graph.m_planStage < PlanStage::AfterFixup && node->hasArrayMode()) {

switch (node->op()) {

case CheckArray:

case CheckArrayOrEmpty:

break;

case GetIndexedPropertyStorage:

case GetArrayLength:

case GetVectorLength:

case InByVal:

case PutByValDirect:

case PutByVal:

case PutByValAlias:

case GetByVal:

case StringCharAt:

case StringCharCodeAt:

case StringCodePointAt:

case Arrayify:

case ArrayifyToStructure:

case ArrayPush:

case ArrayPop:

case ArrayIndexOf:

case HasIndexedProperty:

case AtomicsAdd:

case AtomicsAnd:

case AtomicsCompareExchange:

case AtomicsExchange:

case AtomicsLoad:

case AtomicsOr:

case AtomicsStore:

case AtomicsSub:

case AtomicsXor:

return clobberTop();

default:

DFG_CRASH(graph, node, "Unhandled ArrayMode opcode.");

}

}

switch (node->op()) {

case JSConstant:

case DoubleConstant:

case Int52Constant:

def(PureValue(node, node->constant()));

return;

case Identity:

case IdentityWithProfile:

case Phantom:

case Check:

case CheckVarargs:

case ExtractOSREntryLocal:

case CheckStructureImmediate:

return;

case ExtractCatchLocal:

read(AbstractHeap(CatchLocals, node->catchOSREntryIndex()));

return;

case ClearCatchLocals:

write(CatchLocals);

return;

case LazyJSConstant:

// We should enable CSE of LazyJSConstant. It's a little annoying since LazyJSValue has

// more bits than we currently have in PureValue.

return;

case CompareEqPtr:

def(PureValue(node, node->cellOperand()->cell()));

return;

case ArithIMul:

case ArithMin:

case ArithMax:

case ArithPow:

case GetScope:

case SkipScope:

case GetGlobalObject:

case StringCharCodeAt:

case StringCodePointAt:

case CompareStrictEq:

case SameValue:

case IsEmpty:

case TypeOfIsUndefined:

case IsUndefinedOrNull:

case IsBoolean:

case IsNumber:

case IsBigInt:

case NumberIsInteger:

case IsObject:

case IsTypedArrayView:

case LogicalNot:

case CheckInBounds:

case DoubleRep:

case ValueRep:

case Int52Rep:

case BooleanToNumber:

case FiatInt52:

case MakeRope:

case StrCat:

case ValueToInt32:

case GetExecutable:

case BottomValue:

case TypeOf:

def(PureValue(node));

return;

case GetGlobalThis:

read(World);

return;

case AtomicsIsLockFree:

if (node->child1().useKind() == Int32Use)

def(PureValue(node));

else

clobberTop();

return;

case ArithUnary:

if (node->child1().useKind() == DoubleRepUse)

def(PureValue(node, static_cast<std::underlying_type<Arith::UnaryType>::type>(node->arithUnaryType())));

else

clobberTop();

return;

case ArithFRound:

case ArithSqrt:

if (node->child1().useKind() == DoubleRepUse)

def(PureValue(node));

else

clobberTop();

return;

case ArithAbs:

if (node->child1().useKind() == Int32Use || node->child1().useKind() == DoubleRepUse)

def(PureValue(node, node->arithMode()));

else

clobberTop();

return;

case ArithClz32:

if (node->child1().useKind() == Int32Use || node->child1().useKind() == KnownInt32Use)

def(PureValue(node));

else

clobberTop();

return;

case ArithNegate:

if (node->child1().useKind() == Int32Use

|| node->child1().useKind() == DoubleRepUse

|| node->child1().useKind() == Int52RepUse)

def(PureValue(node, node->arithMode()));

else

clobberTop();

return;

case IsCellWithType:

def(PureValue(node, node->queriedType()));

return;

case ValueBitNot:

if (node->child1().useKind() == AnyBigIntUse || node->child1().useKind() == BigInt32Use || node->child1().useKind() == HeapBigIntUse) {

def(PureValue(node));

return;

}

clobberTop();

return;

case ArithBitNot:

if (node->child1().useKind() == UntypedUse) {

clobberTop();

return;

}

def(PureValue(node));

return;

case ArithBitAnd:

case ArithBitOr:

case ArithBitXor:

case ArithBitLShift:

case ArithBitRShift:

case BitURShift:

if (node->child1().useKind() == UntypedUse || node->child2().useKind() == UntypedUse) {

clobberTop();

return;

}

def(PureValue(node));

return;

case ArithRandom:

read(MathDotRandomState);

write(MathDotRandomState);

return;

case GetEnumerableLength: {

read(Heap);

write(SideState);

return;

}

case ToIndexString:

case GetEnumeratorStructurePname:

case GetEnumeratorGenericPname: {

def(PureValue(node));

return;

}

case HasIndexedProperty: {

read(JSObject_butterfly);

ArrayMode mode = node->arrayMode();

switch (mode.type()) {

case Array::ForceExit: {

write(SideState);

return;

}

case Array::Int32: {

if (mode.isInBounds()) {

read(Butterfly_publicLength);

read(IndexedInt32Properties);

def(HeapLocation(HasIndexedPropertyLoc, IndexedInt32Properties, graph.varArgChild(node, 0), graph.varArgChild(node, 1)), LazyNode(node));

return;

}

break;

}

case Array::Double: {

if (mode.isInBounds()) {

read(Butterfly_publicLength);

read(IndexedDoubleProperties);

def(HeapLocation(HasIndexedPropertyLoc, IndexedDoubleProperties, graph.varArgChild(node, 0), graph.varArgChild(node, 1)), LazyNode(node));

return;

}

break;

}

case Array::Contiguous: {

if (mode.isInBounds()) {

read(Butterfly_publicLength);

read(IndexedContiguousProperties);

def(HeapLocation(HasIndexedPropertyLoc, IndexedContiguousProperties, graph.varArgChild(node, 0), graph.varArgChild(node, 1)), LazyNode(node));

return;

}

break;

}

case Array::ArrayStorage: {

if (mode.isInBounds()) {

read(Butterfly_vectorLength);

read(IndexedArrayStorageProperties);

return;

}

break;

}

default:

break;

}

clobberTop();

return;

}

case StringFromCharCode:

switch (node->child1().useKind()) {

case Int32Use:

def(PureValue(node));

return;

case UntypedUse:

clobberTop();

return;

default:

DFG_CRASH(graph, node, "Bad use kind");

}

return;

case ArithAdd:

case ArithMod:

case DoubleAsInt32:

case UInt32ToNumber:

def(PureValue(node, node->arithMode()));

return;

case ArithDiv:

case ArithMul:

case ArithSub:

switch (node->binaryUseKind()) {

case Int32Use:

case Int52RepUse:

case DoubleRepUse:

def(PureValue(node, node->arithMode()));

return;

case UntypedUse:

clobberTop();

return;

default:

DFG_CRASH(graph, node, "Bad use kind");

}

case ArithRound:

case ArithFloor:

case ArithCeil:

case ArithTrunc:

if (node->child1().useKind() == DoubleRepUse)

def(PureValue(node, static_cast<uintptr_t>(node->arithRoundingMode())));

else

clobberTop();

return;

case CheckIsConstant:

def(PureValue(CheckIsConstant, AdjacencyList(AdjacencyList::Fixed, node->child1()), node->constant()));

return;

case CheckNotEmpty:

def(PureValue(CheckNotEmpty, AdjacencyList(AdjacencyList::Fixed, node->child1())));

return;

case AssertInBounds:

case AssertNotEmpty:

write(SideState);

return;

case CheckIdent:

def(PureValue(CheckIdent, AdjacencyList(AdjacencyList::Fixed, node->child1()), node->uidOperand()));

return;

case ConstantStoragePointer:

def(PureValue(node, node->storagePointer()));

return;

case KillStack:

write(AbstractHeap(Stack, node->unlinkedOperand()));

return;

case MovHint:

case ExitOK:

case Upsilon:

case Phi:

case PhantomLocal:

case SetArgumentDefinitely:

case SetArgumentMaybe:

case Jump:

case Branch:

case Switch:

case EntrySwitch:

case ForceOSRExit:

case CPUIntrinsic:

case CheckBadValue:

case Return:

case Unreachable:

case CheckTierUpInLoop:

case CheckTierUpAtReturn:

case CheckTierUpAndOSREnter:

case LoopHint:

case ProfileType:

case ProfileControlFlow:

case PutHint:

case InitializeEntrypointArguments:

case FilterCallLinkStatus:

case FilterGetByStatus:

case FilterPutByIdStatus:

case FilterInByIdStatus:

case FilterDeleteByStatus:

write(SideState);

return;

case StoreBarrier:

read(JSCell_cellState);

write(JSCell_cellState);

return;

case FencedStoreBarrier:

read(Heap);

write(JSCell_cellState);

return;

case CheckTraps:

read(InternalState);

write(InternalState);

return;

case InvalidationPoint:

write(SideState);

def(HeapLocation(InvalidationPointLoc, Watchpoint_fire), LazyNode(node));

return;

case Flush:

read(AbstractHeap(Stack, node->operand()));

write(SideState);

return;

case NotifyWrite:

write(Watchpoint_fire);

write(SideState);

return;

case PushWithScope: {

read(World);

write(HeapObjectCount);

return;

}

case CreateActivation: {

SymbolTable* table = node->castOperand<SymbolTable*>();

if (table->singleton().isStillValid())

write(Watchpoint_fire);

read(HeapObjectCount);

write(HeapObjectCount);

return;

}

case CreateDirectArguments:

case CreateScopedArguments:

case CreateClonedArguments:

case CreateArgumentsButterfly:

read(Stack);

read(HeapObjectCount);

write(HeapObjectCount);

return;

case PhantomDirectArguments:

case PhantomClonedArguments:

// DFG backend requires that the locals that this reads are flushed. FTL backend can handle those

// locals being promoted.

if (!graph.m_plan.isFTL())

read(Stack);

// Even though it's phantom, it still has the property that one can't be replaced with another.

read(HeapObjectCount);

write(HeapObjectCount);

return;

case PhantomSpread:

case PhantomNewArrayWithSpread:

case PhantomNewArrayBuffer:

case PhantomCreateRest:

// Even though it's phantom, it still has the property that one can't be replaced with another.

read(HeapObjectCount);

write(HeapObjectCount);

return;

case CallObjectConstructor:

read(HeapObjectCount);

write(HeapObjectCount);

return;

case ToThis:

read(MiscFields);

read(HeapObjectCount);

write(HeapObjectCount);

return;

case TypeOfIsObject:

read(MiscFields);

def(HeapLocation(TypeOfIsObjectLoc, MiscFields, node->child1()), LazyNode(node));

return;

case TypeOfIsFunction:

read(MiscFields);

def(HeapLocation(TypeOfIsFunctionLoc, MiscFields, node->child1()), LazyNode(node));

return;

case IsCallable:

read(MiscFields);

def(HeapLocation(IsCallableLoc, MiscFields, node->child1()), LazyNode(node));

return;

case IsConstructor:

read(MiscFields);

def(HeapLocation(IsConstructorLoc, MiscFields, node->child1()), LazyNode(node));

return;

case MatchStructure:

read(JSCell_structureID);

return;

case ArraySlice:

read(MiscFields);

read(JSCell_indexingType);

read(JSCell_structureID);

read(JSObject_butterfly);

read(Butterfly_publicLength);

read(IndexedDoubleProperties);

read(IndexedInt32Properties);

read(IndexedContiguousProperties);

read(HeapObjectCount);

write(HeapObjectCount);

return;

case ArrayIndexOf: {

// FIXME: Should support a CSE rule.

// https://bugs.webkit.org/show_bug.cgi?id=173173

read(MiscFields);

read(JSCell_indexingType);

read(JSCell_structureID);

read(JSObject_butterfly);

read(Butterfly_publicLength);

switch (node->arrayMode().type()) {

case Array::Double:

read(IndexedDoubleProperties);

return;

case Array::Int32:

read(IndexedInt32Properties);

return;

case Array::Contiguous:

read(IndexedContiguousProperties);

return;

default:

RELEASE_ASSERT_NOT_REACHED();

return;

}

return;

}

case GetById:

case GetByIdFlush:

case GetByIdWithThis:

case GetByIdDirect:

case GetByIdDirectFlush:

case GetByValWithThis:

case TryGetById:

case PutById:

case PutByIdWithThis:

case PutByValWithThis:

case PutByIdFlush:

case PutByIdDirect:

case PutGetterById:

case PutSetterById:

case PutGetterSetterById:

case PutGetterByVal:

case PutSetterByVal:

case PutPrivateName:

case PutPrivateNameById:

case GetPrivateName:

case GetPrivateNameById:

case DefineDataProperty:

case DefineAccessorProperty:

case DeleteById:

case DeleteByVal:

case ArrayPush:

case ArrayPop:

case Call:

case DirectCall:

case TailCallInlinedCaller:

case DirectTailCallInlinedCaller:

case Construct:

case DirectConstruct:

case CallVarargs:

case CallForwardVarargs:

case TailCallVarargsInlinedCaller:

case TailCallForwardVarargsInlinedCaller:

case ConstructVarargs:

case ConstructForwardVarargs:

case ToPrimitive:

case ToPropertyKey:

case InByVal:

case InById:

case HasOwnProperty:

case ValueNegate:

case SetFunctionName:

case GetDynamicVar:

case PutDynamicVar:

case ResolveScopeForHoistingFuncDeclInEval:

case ResolveScope:

case ToObject:

case HasGenericProperty:

case HasStructureProperty:

case HasOwnStructureProperty:

case InStructureProperty:

case GetPropertyEnumerator:

case GetDirectPname:

case InstanceOfCustom:

case ToNumber:

case ToNumeric:

case NumberToStringWithRadix:

case CreateThis:

case CreatePromise:

case CreateGenerator:

case CreateAsyncGenerator:

case InstanceOf:

case StringValueOf:

case ObjectKeys:

case ObjectGetOwnPropertyNames:

clobberTop();

return;

case CallNumberConstructor:

switch (node->child1().useKind()) {

case BigInt32Use:

def(PureValue(node));

return;

case UntypedUse:

clobberTop();

return;

default:

DFG_CRASH(graph, node, "Bad use kind");

}

case Inc:

case Dec:

switch (node->child1().useKind()) {

case Int32Use:

case Int52RepUse:

case DoubleRepUse:

case BigInt32Use:

case HeapBigIntUse:

case AnyBigIntUse:

def(PureValue(node));

return;

case UntypedUse:

clobberTop();

return;

default:

DFG_CRASH(graph, node, "Bad use kind");

}

case ValueBitAnd:

case ValueBitXor:

case ValueBitOr:

case ValueAdd:

case ValueSub:

case ValueMul:

case ValueDiv:

case ValueMod:

case ValuePow:

case ValueBitLShift:

case ValueBitRShift:

// FIXME: this use of single-argument isBinaryUseKind would prevent us from specializing (for example) for a HeapBigInt left-operand and a BigInt32 right-operand.

if (node->isBinaryUseKind(AnyBigIntUse) || node->isBinaryUseKind(BigInt32Use) || node->isBinaryUseKind(HeapBigIntUse)) {

def(PureValue(node));

return;

}

clobberTop();

return;

case AtomicsAdd:

case AtomicsAnd:

case AtomicsCompareExchange:

case AtomicsExchange:

case AtomicsLoad:

case AtomicsOr:

case AtomicsStore:

case AtomicsSub:

case AtomicsXor: {

unsigned numExtraArgs = numExtraAtomicsArgs(node->op());

Edge storageEdge = graph.child(node, 2 + numExtraArgs);

if (!storageEdge) {

clobberTop();

return;

}

read(TypedArrayProperties);

read(MiscFields);

write(TypedArrayProperties);

return;

}

case CallEval:

ASSERT(!node->origin.semantic.inlineCallFrame());

read(AbstractHeap(Stack, graph.m_codeBlock->scopeRegister()));

read(AbstractHeap(Stack, virtualRegisterForArgumentIncludingThis(0)));

clobberTop();

return;

case Throw:

case ThrowStaticError:

case TailCall:

case DirectTailCall:

case TailCallVarargs:

case TailCallForwardVarargs:

read(World);

write(SideState);

return;

case GetGetter:

read(GetterSetter_getter);

def(HeapLocation(GetterLoc, GetterSetter_getter, node->child1()), LazyNode(node));

return;

case GetSetter:

read(GetterSetter_setter);

def(HeapLocation(SetterLoc, GetterSetter_setter, node->child1()), LazyNode(node));

return;

case GetCallee:

read(AbstractHeap(Stack, VirtualRegister(CallFrameSlot::callee)));

def(HeapLocation(StackLoc, AbstractHeap(Stack, VirtualRegister(CallFrameSlot::callee))), LazyNode(node));

return;

case SetCallee:

write(AbstractHeap(Stack, VirtualRegister(CallFrameSlot::callee)));

return;

case GetArgumentCountIncludingThis: {

auto heap = AbstractHeap(Stack, remapOperand(node->argumentsInlineCallFrame(), VirtualRegister(CallFrameSlot::argumentCountIncludingThis)));

read(heap);

def(HeapLocation(StackPayloadLoc, heap), LazyNode(node));

return;

}

case SetArgumentCountIncludingThis:

write(AbstractHeap(Stack, VirtualRegister(CallFrameSlot::argumentCountIncludingThis)));

return;

case GetRestLength:

read(Stack);

return;

case GetLocal:

read(AbstractHeap(Stack, node->operand()));

def(HeapLocation(StackLoc, AbstractHeap(Stack, node->operand())), LazyNode(node));

return;

case SetLocal:

write(AbstractHeap(Stack, node->operand()));

def(HeapLocation(StackLoc, AbstractHeap(Stack, node->operand())), LazyNode(node->child1().node()));

return;

case GetStack: {

AbstractHeap heap(Stack, node->stackAccessData()->operand);

read(heap);

def(HeapLocation(StackLoc, heap), LazyNode(node));

return;

}

case PutStack: {

AbstractHeap heap(Stack, node->stackAccessData()->operand);

write(heap);

def(HeapLocation(StackLoc, heap), LazyNode(node->child1().node()));

return;

}

case VarargsLength: {

clobberTop();

return;

}

case LoadVarargs: {

clobberTop();

LoadVarargsData* data = node->loadVarargsData();

write(AbstractHeap(Stack, data->count));

for (unsigned i = data->limit; i--;)

write(AbstractHeap(Stack, data->start + static_cast<int>(i)));

return;

}

case ForwardVarargs: {

// We could be way more precise here.

read(Stack);

LoadVarargsData* data = node->loadVarargsData();

write(AbstractHeap(Stack, data->count));

for (unsigned i = data->limit; i--;)

write(AbstractHeap(Stack, data->start + static_cast<int>(i)));

return;

}

case GetByVal: {

ArrayMode mode = node->arrayMode();

LocationKind indexedPropertyLoc = indexedPropertyLocForResultType(node->result());

switch (mode.type()) {

case Array::SelectUsingPredictions:

case Array::Unprofiled:

case Array::SelectUsingArguments:

// Assume the worst since we don't have profiling yet.

clobberTop();

return;

case Array::ForceExit:

write(SideState);

return;

case Array::Generic:

clobberTop();

return;

case Array::String:

if (mode.isOutOfBounds()) {

clobberTop();

return;

}

// This appears to read nothing because it's only reading immutable data.

def(PureValue(graph, node, mode.asWord()));

return;

case Array::DirectArguments:

if (mode.isInBounds()) {

read(DirectArgumentsProperties);

def(HeapLocation(indexedPropertyLoc, DirectArgumentsProperties, graph.varArgChild(node, 0), graph.varArgChild(node, 1)), LazyNode(node));

return;

}

clobberTop();

return;

case Array::ScopedArguments:

read(ScopeProperties);

def(HeapLocation(indexedPropertyLoc, ScopeProperties, graph.varArgChild(node, 0), graph.varArgChild(node, 1)), LazyNode(node));

return;

case Array::Int32:

if (mode.isInBounds() || mode.isOutOfBoundsSaneChain()) {

read(Butterfly_publicLength);

read(IndexedInt32Properties);

LocationKind kind = mode.isOutOfBoundsSaneChain() ? IndexedPropertyInt32OutOfBoundsSaneChainLoc : indexedPropertyLoc;

def(HeapLocation(kind, IndexedInt32Properties, graph.varArgChild(node, 0), graph.varArgChild(node, 1)), LazyNode(node));

return;

}

clobberTop();

return;

case Array::Double:

if (mode.isInBounds() || mode.isOutOfBoundsSaneChain()) {

read(Butterfly_publicLength);

read(IndexedDoubleProperties);

LocationKind kind;

if (node->hasDoubleResult()) {

if (mode.isInBoundsSaneChain())

kind = IndexedPropertyDoubleSaneChainLoc;

else if (mode.isOutOfBoundsSaneChain())

kind = IndexedPropertyDoubleOutOfBoundsSaneChainLoc;

else

kind = IndexedPropertyDoubleLoc;

} else {

ASSERT(mode.isOutOfBoundsSaneChain());

kind = IndexedPropertyDoubleOrOtherOutOfBoundsSaneChainLoc;

}

def(HeapLocation(kind, IndexedDoubleProperties, graph.varArgChild(node, 0), graph.varArgChild(node, 1)), LazyNode(node));

return;

}

clobberTop();

return;

case Array::Contiguous:

if (mode.isInBounds() || mode.isOutOfBoundsSaneChain()) {

read(Butterfly_publicLength);

read(IndexedContiguousProperties);

def(HeapLocation(mode.isOutOfBoundsSaneChain() ? IndexedPropertyJSOutOfBoundsSaneChainLoc : indexedPropertyLoc, IndexedContiguousProperties, graph.varArgChild(node, 0), graph.varArgChild(node, 1)), LazyNode(node));

return;

}

clobberTop();

return;

case Array::Undecided:

def(PureValue(graph, node));

return;

case Array::ArrayStorage:

case Array::SlowPutArrayStorage:

if (mode.isInBounds()) {

read(Butterfly_vectorLength);

read(IndexedArrayStorageProperties);

return;

}

clobberTop();

return;

case Array::Int8Array:

case Array::Int16Array:

case Array::Int32Array: