1 /*

     2 *  Copyright (C) 1999-2002 Harri Porten (porten@kde.org)

     3 *  Copyright (C) 2001 Peter Kelly (pmk@post.com)

     4 *  Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.

     5 *  Copyright (C) 2007 Cameron Zwarich (cwzwarich@uwaterloo.ca)

     6 *  Copyright (C) 2007 Maks Orlovich

     7 *  Copyright (C) 2007 Eric Seidel <eric@webkit.org>

     8 *

     9 *  This library is free software; you can redistribute it and/or

    10 *  modify it under the terms of the GNU Library General Public

    11 *  License as published by the Free Software Foundation; either

    12 *  version 2 of the License, or (at your option) any later version.

    13 *

    14 *  This library is distributed in the hope that it will be useful,

    15 *  but WITHOUT ANY WARRANTY; without even the implied warranty of

    16 *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU

    17 *  Library General Public License for more details.

    18 *

    19 *  You should have received a copy of the GNU Library General Public License

    20 *  along with this library; see the file COPYING.LIB.  If not, write to

    21 *  the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,

    22 *  Boston, MA 02110-1301, USA.

    23 *

    24 */

    25 

    26 #include "config.h"

    27 #include "Nodes.h"

    28 #include "NodeConstructors.h"

    29 

    30 #include "BytecodeGenerator.h"

    31 #include "CallFrame.h"

    32 #include "Debugger.h"

    33 #include "JIT.h"

    34 #include "JSFunction.h"

    35 #include "JSGlobalObject.h"

    36 #include "JSStaticScopeObject.h"

    37 #include "LabelScope.h"

    38 #include "Lexer.h"

    39 #include "Operations.h"

    40 #include "Parser.h"

    41 #include "PropertyNameArray.h"

    42 #include "RegExpCache.h"

    43 #include "RegExpObject.h"

    44 #include "SamplingTool.h"

    45 #include <wtf/Assertions.h>

    46 #include <wtf/RefCountedLeakCounter.h>

    47 #include <wtf/Threading.h>

    48 

    49 using namespace WTF;

    50 

    51 namespace JSC {

    52 

    53 /*

    54     Details of the emitBytecode function.

    55 

    56     Return value: The register holding the production's value.

    57              dst: An optional parameter specifying the most efficient destination at

    58                   which to store the production's value. The callee must honor dst.

    59 

    60     The dst argument provides for a crude form of copy propagation. For example,

    61 

    62         x = 1

    63 

    64     becomes

    65     

    66         load r[x], 1

    67     

    68     instead of 

    69 

    70         load r0, 1

    71         mov r[x], r0

    72     

    73     because the assignment node, "x =", passes r[x] as dst to the number node, "1".

    74 */

    75 

    76 // ------------------------------ ThrowableExpressionData --------------------------------

    77 

    78 static void substitute(UString& string, const UString& substring)

    79 {

    80     unsigned position = string.find("%s");

    81     ASSERT(position != UString::NotFound);

    82     string = makeString(string.substr(0, position), substring, string.substr(position + 2));

    83 }

    84 

    85 RegisterID* ThrowableExpressionData::emitThrowError(BytecodeGenerator& generator, bool isReferenceError, const char* message)

    86 {

    87     generator.emitExpressionInfo(divot(), startOffset(), endOffset());

    88     RegisterID* exception = generator.emitNewError(generator.newTemporary(), isReferenceError, jsString(generator.globalData(), message));

    89     generator.emitThrow(exception);

    90     return exception;

    91 }

    92 

    93 RegisterID* ThrowableExpressionData::emitThrowError(BytecodeGenerator& generator, bool isReferenceError, const char* messageTemplate, const UString& label)

    94 {

    95     UString message = messageTemplate;

    96     substitute(message, label);

    97     generator.emitExpressionInfo(divot(), startOffset(), endOffset());

    98     RegisterID* exception = generator.emitNewError(generator.newTemporary(), isReferenceError, jsString(generator.globalData(), message));

    99     generator.emitThrow(exception);

   100     return exception;

   101 }

   102 

   103 inline RegisterID* ThrowableExpressionData::emitThrowError(BytecodeGenerator& generator, bool isReferenceError, const char* messageTemplate, const Identifier& label)

   104 {

   105     return emitThrowError(generator, isReferenceError, messageTemplate, label.ustring());

   106 }

   107 

   108 // ------------------------------ NullNode -------------------------------------

   109 

   110 RegisterID* NullNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)

   111 {

   112     if (dst == generator.ignoredResult())

   113         return 0;

   114     return generator.emitLoad(dst, jsNull());

   115 }

   116 

   117 // ------------------------------ BooleanNode ----------------------------------

   118 

   119 RegisterID* BooleanNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)

   120 {

   121     if (dst == generator.ignoredResult())

   122         return 0;

   123     return generator.emitLoad(dst, m_value);

   124 }

   125 

   126 // ------------------------------ NumberNode -----------------------------------

   127 

   128 RegisterID* NumberNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)

   129 {

   130     if (dst == generator.ignoredResult())

   131         return 0;

   132     return generator.emitLoad(dst, m_value);

   133 }

   134 

   135 // ------------------------------ StringNode -----------------------------------

   136 

   137 RegisterID* StringNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)

   138 {

   139     if (dst == generator.ignoredResult())

   140         return 0;

   141     return generator.emitLoad(dst, m_value);

   142 }

   143 

   144 // ------------------------------ RegExpNode -----------------------------------

   145 

   146 RegisterID* RegExpNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)

   147 {

   148     RefPtr<RegExp> regExp = generator.globalData()->regExpCache()->lookupOrCreate(m_pattern.ustring(), m_flags.ustring());

   149     if (!regExp->isValid())

   150         return emitThrowError(generator, false, "Invalid regular expression: %s", regExp->errorMessage());

   151     if (dst == generator.ignoredResult())

   152         return 0;

   153     return generator.emitNewRegExp(generator.finalDestination(dst), regExp.get());

   154 }

   155 

   156 // ------------------------------ ThisNode -------------------------------------

   157 

   158 RegisterID* ThisNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)

   159 {

   160     if (dst == generator.ignoredResult())

   161         return 0;

   162     return generator.moveToDestinationIfNeeded(dst, generator.thisRegister());

   163 }

   164 

   165 // ------------------------------ ResolveNode ----------------------------------

   166 

   167 bool ResolveNode::isPure(BytecodeGenerator& generator) const

   168 {

   169     return generator.isLocal(m_ident);

   170 }

   171 

   172 RegisterID* ResolveNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)

   173 {

   174     if (RegisterID* local = generator.registerFor(m_ident)) {

   175         if (dst == generator.ignoredResult())

   176             return 0;

   177         return generator.moveToDestinationIfNeeded(dst, local);

   178     }

   179     

   180     generator.emitExpressionInfo(m_startOffset + m_ident.size(), m_ident.size(), 0);

   181     return generator.emitResolve(generator.finalDestination(dst), m_ident);

   182 }

   183 

   184 // ------------------------------ ArrayNode ------------------------------------

   185 

   186 RegisterID* ArrayNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)

   187 {

   188     // FIXME: Should we put all of this code into emitNewArray?

   189 

   190     unsigned length = 0;

   191     ElementNode* firstPutElement;

   192     for (firstPutElement = m_element; firstPutElement; firstPutElement = firstPutElement->next()) {

   193         if (firstPutElement->elision())

   194             break;

   195         ++length;

   196     }

   197 

   198     if (!firstPutElement && !m_elision)

   199         return generator.emitNewArray(generator.finalDestination(dst), m_element);

   200 

   201     RefPtr<RegisterID> array = generator.emitNewArray(generator.tempDestination(dst), m_element);

   202 

   203     for (ElementNode* n = firstPutElement; n; n = n->next()) {

   204         RegisterID* value = generator.emitNode(n->value());

   205         length += n->elision();

   206         generator.emitPutByIndex(array.get(), length++, value);

   207     }

   208 

   209     if (m_elision) {

   210         RegisterID* value = generator.emitLoad(0, jsNumber(generator.globalData(), m_elision + length));

   211         generator.emitPutById(array.get(), generator.propertyNames().length, value);

   212     }

   213 

   214     return generator.moveToDestinationIfNeeded(dst, array.get());

   215 }

   216 

   217 bool ArrayNode::isSimpleArray() const

   218 {

   219     if (m_elision || m_optional)

   220         return false;

   221     for (ElementNode* ptr = m_element; ptr; ptr = ptr->next()) {

   222         if (ptr->elision())

   223             return false;

   224     }

   225     return true;

   226 }

   227 

   228 ArgumentListNode* ArrayNode::toArgumentList(JSGlobalData* globalData) const

   229 {

   230     ASSERT(!m_elision && !m_optional);

   231     ElementNode* ptr = m_element;

   232     if (!ptr)

   233         return 0;

   234     ArgumentListNode* head = new (globalData) ArgumentListNode(globalData, ptr->value());

   235     ArgumentListNode* tail = head;

   236     ptr = ptr->next();

   237     for (; ptr; ptr = ptr->next()) {

   238         ASSERT(!ptr->elision());

   239         tail = new (globalData) ArgumentListNode(globalData, tail, ptr->value());

   240     }

   241     return head;

   242 }

   243 

   244 // ------------------------------ ObjectLiteralNode ----------------------------

   245 

   246 RegisterID* ObjectLiteralNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)

   247 {

   248      if (!m_list) {

   249          if (dst == generator.ignoredResult())

   250              return 0;

   251          return generator.emitNewObject(generator.finalDestination(dst));

   252      }

   253      return generator.emitNode(dst, m_list);

   254 }

   255 

   256 // ------------------------------ PropertyListNode -----------------------------

   257 

   258 RegisterID* PropertyListNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)

   259 {

   260     RefPtr<RegisterID> newObj = generator.tempDestination(dst);

   261     

   262     generator.emitNewObject(newObj.get());

   263     

   264     for (PropertyListNode* p = this; p; p = p->m_next) {

   265         RegisterID* value = generator.emitNode(p->m_node->m_assign);

   266         

   267         switch (p->m_node->m_type) {

   268             case PropertyNode::Constant: {

   269                 generator.emitDirectPutById(newObj.get(), p->m_node->name(), value);

   270                 break;

   271             }

   272             case PropertyNode::Getter: {

   273                 generator.emitPutGetter(newObj.get(), p->m_node->name(), value);

   274                 break;

   275             }

   276             case PropertyNode::Setter: {

   277                 generator.emitPutSetter(newObj.get(), p->m_node->name(), value);

   278                 break;

   279             }

   280             default:

   281                 ASSERT_NOT_REACHED();

   282         }

   283     }

   284     

   285     return generator.moveToDestinationIfNeeded(dst, newObj.get());

   286 }

   287 

   288 // ------------------------------ BracketAccessorNode --------------------------------

   289 

   290 RegisterID* BracketAccessorNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)

   291 {

   292     RefPtr<RegisterID> base = generator.emitNodeForLeftHandSide(m_base, m_subscriptHasAssignments, m_subscript->isPure(generator));

   293     RegisterID* property = generator.emitNode(m_subscript);

   294     generator.emitExpressionInfo(divot(), startOffset(), endOffset());

   295     return generator.emitGetByVal(generator.finalDestination(dst), base.get(), property);

   296 }

   297 

   298 // ------------------------------ DotAccessorNode --------------------------------

   299 

   300 RegisterID* DotAccessorNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)

   301 {

   302     RegisterID* base = generator.emitNode(m_base);

   303     generator.emitExpressionInfo(divot(), startOffset(), endOffset());

   304     return generator.emitGetById(generator.finalDestination(dst), base, m_ident);

   305 }

   306 

   307 // ------------------------------ ArgumentListNode -----------------------------

   308 

   309 RegisterID* ArgumentListNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)

   310 {

   311     ASSERT(m_expr);

   312     return generator.emitNode(dst, m_expr);

   313 }

   314 

   315 // ------------------------------ NewExprNode ----------------------------------

   316 

   317 RegisterID* NewExprNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)

   318 {

   319     RefPtr<RegisterID> func = generator.emitNode(m_expr);

   320     CallArguments callArguments(generator, m_args);

   321     return generator.emitConstruct(generator.finalDestinationOrIgnored(dst), func.get(), callArguments, divot(), startOffset(), endOffset());

   322 }

   323 

   324 CallArguments::CallArguments(BytecodeGenerator& generator, ArgumentsNode* argumentsNode)

   325     : m_argumentsNode(argumentsNode)

   326 {

   327     if (generator.shouldEmitProfileHooks())

   328         m_profileHookRegister = generator.newTemporary();

   329     m_argv.append(generator.newTemporary());

   330     if (argumentsNode) {

   331         for (ArgumentListNode* n = argumentsNode->m_listNode; n; n = n->m_next) {

   332             m_argv.append(generator.newTemporary());

   333             // op_call requires the arguments to be a sequential range of registers

   334             ASSERT(m_argv[m_argv.size() - 1]->index() == m_argv[m_argv.size() - 2]->index() + 1);

   335         }

   336     }

   337 }

   338 

   339 // ------------------------------ EvalFunctionCallNode ----------------------------------

   340 

   341 RegisterID* EvalFunctionCallNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)

   342 {

   343     RefPtr<RegisterID> func = generator.tempDestination(dst);

   344     CallArguments callArguments(generator, m_args);

   345     generator.emitExpressionInfo(divot() - startOffset() + 4, 4, 0);

   346     generator.emitResolveWithBase(callArguments.thisRegister(), func.get(), generator.propertyNames().eval);

   347     return generator.emitCallEval(generator.finalDestination(dst, func.get()), func.get(), callArguments, divot(), startOffset(), endOffset());

   348 }

   349 

   350 // ------------------------------ FunctionCallValueNode ----------------------------------

   351 

   352 RegisterID* FunctionCallValueNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)

   353 {

   354     RefPtr<RegisterID> func = generator.emitNode(m_expr);

   355     CallArguments callArguments(generator, m_args);

   356     generator.emitLoad(callArguments.thisRegister(), jsNull());

   357     return generator.emitCall(generator.finalDestinationOrIgnored(dst, func.get()), func.get(), callArguments, divot(), startOffset(), endOffset());

   358 }

   359 

   360 // ------------------------------ FunctionCallResolveNode ----------------------------------

   361 

   362 RegisterID* FunctionCallResolveNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)

   363 {

   364     if (RefPtr<RegisterID> local = generator.registerFor(m_ident)) {

   365         CallArguments callArguments(generator, m_args);

   366         generator.emitLoad(callArguments.thisRegister(), jsNull());

   367         return generator.emitCall(generator.finalDestinationOrIgnored(dst, callArguments.thisRegister()), local.get(), callArguments, divot(), startOffset(), endOffset());

   368     }

   369 

   370     int index = 0;

   371     size_t depth = 0;

   372     JSObject* globalObject = 0;

   373     bool requiresDynamicChecks = false;

   374     if (generator.findScopedProperty(m_ident, index, depth, false, requiresDynamicChecks, globalObject) && index != missingSymbolMarker() && !requiresDynamicChecks) {

   375         RefPtr<RegisterID> func = generator.emitGetScopedVar(generator.newTemporary(), depth, index, globalObject);

   376         CallArguments callArguments(generator, m_args);

   377         generator.emitLoad(callArguments.thisRegister(), jsNull());

   378         return generator.emitCall(generator.finalDestinationOrIgnored(dst, func.get()), func.get(), callArguments, divot(), startOffset(), endOffset());

   379     }

   380 

   381     RefPtr<RegisterID> func = generator.newTemporary();

   382     CallArguments callArguments(generator, m_args);

   383     int identifierStart = divot() - startOffset();

   384     generator.emitExpressionInfo(identifierStart + m_ident.size(), m_ident.size(), 0);

   385     generator.emitResolveWithBase(callArguments.thisRegister(), func.get(), m_ident);

   386     return generator.emitCall(generator.finalDestinationOrIgnored(dst, func.get()), func.get(), callArguments, divot(), startOffset(), endOffset());

   387 }

   388 

   389 // ------------------------------ FunctionCallBracketNode ----------------------------------

   390 

   391 RegisterID* FunctionCallBracketNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)

   392 {

   393     RefPtr<RegisterID> base = generator.emitNode(m_base);

   394     RegisterID* property = generator.emitNode(m_subscript);

   395     generator.emitExpressionInfo(divot() - m_subexpressionDivotOffset, startOffset() - m_subexpressionDivotOffset, m_subexpressionEndOffset);

   396     RefPtr<RegisterID> function = generator.emitGetByVal(generator.tempDestination(dst), base.get(), property);

   397     CallArguments callArguments(generator, m_args);

   398     generator.emitMove(callArguments.thisRegister(), base.get());

   399     return generator.emitCall(generator.finalDestinationOrIgnored(dst, function.get()), function.get(), callArguments, divot(), startOffset(), endOffset());

   400 }

   401 

   402 // ------------------------------ FunctionCallDotNode ----------------------------------

   403 

   404 RegisterID* FunctionCallDotNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)

   405 {

   406     RefPtr<RegisterID> function = generator.tempDestination(dst);

   407     CallArguments callArguments(generator, m_args);

   408     generator.emitNode(callArguments.thisRegister(), m_base);

   409     generator.emitExpressionInfo(divot() - m_subexpressionDivotOffset, startOffset() - m_subexpressionDivotOffset, m_subexpressionEndOffset);

   410     generator.emitMethodCheck();

   411     generator.emitGetById(function.get(), callArguments.thisRegister(), m_ident);

   412     return generator.emitCall(generator.finalDestinationOrIgnored(dst, function.get()), function.get(), callArguments, divot(), startOffset(), endOffset());

   413 }

   414 

   415 RegisterID* CallFunctionCallDotNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)

   416 {

   417     RefPtr<Label> realCall = generator.newLabel();

   418     RefPtr<Label> end = generator.newLabel();

   419     RefPtr<RegisterID> base = generator.emitNode(m_base);

   420     generator.emitExpressionInfo(divot() - m_subexpressionDivotOffset, startOffset() - m_subexpressionDivotOffset, m_subexpressionEndOffset);

   421     RefPtr<RegisterID> function = generator.emitGetById(generator.tempDestination(dst), base.get(), m_ident);

   422     RefPtr<RegisterID> finalDestinationOrIgnored = generator.finalDestinationOrIgnored(dst, function.get());

   423     generator.emitJumpIfNotFunctionCall(function.get(), realCall.get());

   424     {

   425         if (m_args->m_listNode && m_args->m_listNode->m_expr) {

   426             ArgumentListNode* oldList = m_args->m_listNode;

   427             m_args->m_listNode = m_args->m_listNode->m_next;

   428 

   429             RefPtr<RegisterID> realFunction = generator.emitMove(generator.tempDestination(dst), base.get());

   430             CallArguments callArguments(generator, m_args);

   431             generator.emitNode(callArguments.thisRegister(), oldList->m_expr);

   432             generator.emitCall(finalDestinationOrIgnored.get(), realFunction.get(), callArguments, divot(), startOffset(), endOffset());

   433             generator.emitJump(end.get());

   434 

   435             m_args->m_listNode = oldList;

   436 

   437         } else {

   438             RefPtr<RegisterID> realFunction = generator.emitMove(generator.tempDestination(dst), base.get());

   439             CallArguments callArguments(generator, m_args);

   440             generator.emitLoad(callArguments.thisRegister(), jsNull());

   441             generator.emitCall(finalDestinationOrIgnored.get(), realFunction.get(), callArguments, divot(), startOffset(), endOffset());

   442             generator.emitJump(end.get());

   443         }

   444     }

   445     generator.emitLabel(realCall.get());

   446     {

   447         CallArguments callArguments(generator, m_args);

   448         generator.emitMove(callArguments.thisRegister(), base.get());

   449         generator.emitCall(finalDestinationOrIgnored.get(), function.get(), callArguments, divot(), startOffset(), endOffset());

   450     }

   451     generator.emitLabel(end.get());

   452     return finalDestinationOrIgnored.get();

   453 }

   454 

   455 static bool areTrivialApplyArguments(ArgumentsNode* args)

   456 {

   457     return !args->m_listNode || !args->m_listNode->m_expr || !args->m_listNode->m_next

   458         || (!args->m_listNode->m_next->m_next && args->m_listNode->m_next->m_expr->isSimpleArray());

   459 }

   460 

   461 RegisterID* ApplyFunctionCallDotNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)

   462 {

   463     // A few simple cases can be trivially handled as ordinary function calls.

   464     // function.apply(), function.apply(arg) -> identical to function.call

   465     // function.apply(thisArg, [arg0, arg1, ...]) -> can be trivially coerced into function.call(thisArg, arg0, arg1, ...) and saves object allocation

   466     bool mayBeCall = areTrivialApplyArguments(m_args);

   467 

   468     RefPtr<Label> realCall = generator.newLabel();

   469     RefPtr<Label> end = generator.newLabel();

   470     RefPtr<RegisterID> base = generator.emitNode(m_base);

   471     generator.emitExpressionInfo(divot() - m_subexpressionDivotOffset, startOffset() - m_subexpressionDivotOffset, m_subexpressionEndOffset);

   472     RefPtr<RegisterID> function = generator.emitGetById(generator.tempDestination(dst), base.get(), m_ident);

   473     RefPtr<RegisterID> finalDestinationOrIgnored = generator.finalDestinationOrIgnored(dst, function.get());

   474     generator.emitJumpIfNotFunctionApply(function.get(), realCall.get());

   475     {

   476         if (mayBeCall) {

   477             if (m_args->m_listNode && m_args->m_listNode->m_expr) {

   478                 ArgumentListNode* oldList = m_args->m_listNode;

   479                 if (m_args->m_listNode->m_next) {

   480                     ASSERT(m_args->m_listNode->m_next->m_expr->isSimpleArray());

   481                     ASSERT(!m_args->m_listNode->m_next->m_next);

   482                     m_args->m_listNode = static_cast<ArrayNode*>(m_args->m_listNode->m_next->m_expr)->toArgumentList(generator.globalData());

   483                     RefPtr<RegisterID> realFunction = generator.emitMove(generator.tempDestination(dst), base.get());

   484                     CallArguments callArguments(generator, m_args);

   485                     generator.emitNode(callArguments.thisRegister(), oldList->m_expr);

   486                     generator.emitCall(finalDestinationOrIgnored.get(), realFunction.get(), callArguments, divot(), startOffset(), endOffset());

   487                 } else {

   488                     m_args->m_listNode = m_args->m_listNode->m_next;

   489                     RefPtr<RegisterID> realFunction = generator.emitMove(generator.tempDestination(dst), base.get());

   490                     CallArguments callArguments(generator, m_args);

   491                     generator.emitNode(callArguments.thisRegister(), oldList->m_expr);

   492                     generator.emitCall(finalDestinationOrIgnored.get(), realFunction.get(), callArguments, divot(), startOffset(), endOffset());

   493                 }

   494                 m_args->m_listNode = oldList;

   495             } else {

   496                 RefPtr<RegisterID> realFunction = generator.emitMove(generator.tempDestination(dst), base.get());

   497                 CallArguments callArguments(generator, m_args);

   498                 generator.emitLoad(callArguments.thisRegister(), jsNull());

   499                 generator.emitCall(finalDestinationOrIgnored.get(), realFunction.get(), callArguments, divot(), startOffset(), endOffset());

   500             }

   501         } else {

   502             ASSERT(m_args->m_listNode && m_args->m_listNode->m_next);

   503             RefPtr<RegisterID> realFunction = generator.emitMove(generator.newTemporary(), base.get());

   504             RefPtr<RegisterID> argsCountRegister = generator.newTemporary();

   505             RefPtr<RegisterID> thisRegister = generator.newTemporary();

   506             RefPtr<RegisterID> argsRegister = generator.newTemporary();

   507             generator.emitNode(thisRegister.get(), m_args->m_listNode->m_expr);

   508             ArgumentListNode* args = m_args->m_listNode->m_next;

   509             bool isArgumentsApply = false;

   510             if (args->m_expr->isResolveNode()) {

   511                 ResolveNode* resolveNode = static_cast<ResolveNode*>(args->m_expr);

   512                 isArgumentsApply = generator.willResolveToArguments(resolveNode->identifier());

   513                 if (isArgumentsApply)

   514                     generator.emitMove(argsRegister.get(), generator.uncheckedRegisterForArguments());

   515             }

   516             if (!isArgumentsApply)

   517                 generator.emitNode(argsRegister.get(), args->m_expr);

   518             while ((args = args->m_next))

   519                 generator.emitNode(args->m_expr);

   520 

   521             generator.emitLoadVarargs(argsCountRegister.get(), argsRegister.get());

   522             generator.emitCallVarargs(finalDestinationOrIgnored.get(), realFunction.get(), thisRegister.get(), argsCountRegister.get(), divot(), startOffset(), endOffset());

   523         }

   524         generator.emitJump(end.get());

   525     }

   526     generator.emitLabel(realCall.get());

   527     {

   528         CallArguments callArguments(generator, m_args);

   529         generator.emitMove(callArguments.thisRegister(), base.get());

   530         generator.emitCall(finalDestinationOrIgnored.get(), function.get(), callArguments, divot(), startOffset(), endOffset());

   531     }

   532     generator.emitLabel(end.get());

   533     return finalDestinationOrIgnored.get();

   534 }

   535 

   536 // ------------------------------ PostfixResolveNode ----------------------------------

   537 

   538 static RegisterID* emitPreIncOrDec(BytecodeGenerator& generator, RegisterID* srcDst, Operator oper)

   539 {

   540     return (oper == OpPlusPlus) ? generator.emitPreInc(srcDst) : generator.emitPreDec(srcDst);

   541 }

   542 

   543 static RegisterID* emitPostIncOrDec(BytecodeGenerator& generator, RegisterID* dst, RegisterID* srcDst, Operator oper)

   544 {

   545     if (srcDst == dst)

   546         return generator.emitToJSNumber(dst, srcDst);

   547     return (oper == OpPlusPlus) ? generator.emitPostInc(dst, srcDst) : generator.emitPostDec(dst, srcDst);

   548 }

   549 

   550 RegisterID* PostfixResolveNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)

   551 {

   552     if (RegisterID* local = generator.registerFor(m_ident)) {

   553         if (generator.isLocalConstant(m_ident)) {

   554             if (dst == generator.ignoredResult())

   555                 return 0;

   556             return generator.emitToJSNumber(generator.finalDestination(dst), local);

   557         }

   558 

   559         if (dst == generator.ignoredResult())

   560             return emitPreIncOrDec(generator, local, m_operator);

   561         return emitPostIncOrDec(generator, generator.finalDestination(dst), local, m_operator);

   562     }

   563 

   564     int index = 0;

   565     size_t depth = 0;

   566     JSObject* globalObject = 0;

   567     bool requiresDynamicChecks = false;

   568     if (generator.findScopedProperty(m_ident, index, depth, true, requiresDynamicChecks, globalObject) && index != missingSymbolMarker() && !requiresDynamicChecks) {

   569         RefPtr<RegisterID> value = generator.emitGetScopedVar(generator.newTemporary(), depth, index, globalObject);

   570         RegisterID* oldValue;

   571         if (dst == generator.ignoredResult()) {

   572             oldValue = 0;

   573             emitPreIncOrDec(generator, value.get(), m_operator);

   574         } else {

   575             oldValue = emitPostIncOrDec(generator, generator.finalDestination(dst), value.get(), m_operator);

   576         }

   577         generator.emitPutScopedVar(depth, index, value.get(), globalObject);

   578         return oldValue;

   579     }

   580 

   581     generator.emitExpressionInfo(divot(), startOffset(), endOffset());

   582     RefPtr<RegisterID> value = generator.newTemporary();

   583     RefPtr<RegisterID> base = generator.emitResolveWithBase(generator.newTemporary(), value.get(), m_ident);

   584     RegisterID* oldValue;

   585     if (dst == generator.ignoredResult()) {

   586         oldValue = 0;

   587         emitPreIncOrDec(generator, value.get(), m_operator);

   588     } else {

   589         oldValue = emitPostIncOrDec(generator, generator.finalDestination(dst), value.get(), m_operator);

   590     }

   591     generator.emitPutById(base.get(), m_ident, value.get());

   592     return oldValue;

   593 }

   594 

   595 // ------------------------------ PostfixBracketNode ----------------------------------

   596 

   597 RegisterID* PostfixBracketNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)

   598 {

   599     RefPtr<RegisterID> base = generator.emitNode(m_base);

   600     RefPtr<RegisterID> property = generator.emitNode(m_subscript);

   601 

   602     generator.emitExpressionInfo(divot() - m_subexpressionDivotOffset, startOffset() - m_subexpressionDivotOffset, m_subexpressionEndOffset);

   603     RefPtr<RegisterID> value = generator.emitGetByVal(generator.newTemporary(), base.get(), property.get());

   604     RegisterID* oldValue;

   605     if (dst == generator.ignoredResult()) {

   606         oldValue = 0;

   607         if (m_operator == OpPlusPlus)

   608             generator.emitPreInc(value.get());

   609         else

   610             generator.emitPreDec(value.get());

   611     } else {

   612         oldValue = (m_operator == OpPlusPlus) ? generator.emitPostInc(generator.finalDestination(dst), value.get()) : generator.emitPostDec(generator.finalDestination(dst), value.get());

   613     }

   614     generator.emitExpressionInfo(divot(), startOffset(), endOffset());

   615     generator.emitPutByVal(base.get(), property.get(), value.get());

   616     return oldValue;

   617 }

   618 

   619 // ------------------------------ PostfixDotNode ----------------------------------

   620 

   621 RegisterID* PostfixDotNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)

   622 {

   623     RefPtr<RegisterID> base = generator.emitNode(m_base);

   624 

   625     generator.emitExpressionInfo(divot() - m_subexpressionDivotOffset, startOffset() - m_subexpressionDivotOffset, m_subexpressionEndOffset);

   626     RefPtr<RegisterID> value = generator.emitGetById(generator.newTemporary(), base.get(), m_ident);

   627     RegisterID* oldValue;

   628     if (dst == generator.ignoredResult()) {

   629         oldValue = 0;

   630         if (m_operator == OpPlusPlus)

   631             generator.emitPreInc(value.get());

   632         else

   633             generator.emitPreDec(value.get());

   634     } else {

   635         oldValue = (m_operator == OpPlusPlus) ? generator.emitPostInc(generator.finalDestination(dst), value.get()) : generator.emitPostDec(generator.finalDestination(dst), value.get());

   636     }

   637     generator.emitExpressionInfo(divot(), startOffset(), endOffset());

   638     generator.emitPutById(base.get(), m_ident, value.get());

   639     return oldValue;

   640 }

   641 

   642 // ------------------------------ PostfixErrorNode -----------------------------------

   643 

   644 RegisterID* PostfixErrorNode::emitBytecode(BytecodeGenerator& generator, RegisterID*)

   645 {

   646     return emitThrowError(generator, true, m_operator == OpPlusPlus

   647         ? "Postfix ++ operator applied to value that is not a reference."

   648         : "Postfix -- operator applied to value that is not a reference.");

   649 }

   650 

   651 // ------------------------------ DeleteResolveNode -----------------------------------

   652 

   653 RegisterID* DeleteResolveNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)

   654 {

   655     if (generator.registerFor(m_ident))

   656         return generator.emitLoad(generator.finalDestination(dst), false);

   657 

   658     generator.emitExpressionInfo(divot(), startOffset(), endOffset());

   659     RegisterID* base = generator.emitResolveBase(generator.tempDestination(dst), m_ident);

   660     return generator.emitDeleteById(generator.finalDestination(dst, base), base, m_ident);

   661 }

   662 

   663 // ------------------------------ DeleteBracketNode -----------------------------------

   664 

   665 RegisterID* DeleteBracketNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)

   666 {

   667     RefPtr<RegisterID> r0 = generator.emitNode(m_base);

   668     RegisterID* r1 = generator.emitNode(m_subscript);

   669 

   670     generator.emitExpressionInfo(divot(), startOffset(), endOffset());

   671     return generator.emitDeleteByVal(generator.finalDestination(dst), r0.get(), r1);

   672 }

   673 

   674 // ------------------------------ DeleteDotNode -----------------------------------

   675 

   676 RegisterID* DeleteDotNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)

   677 {

   678     RegisterID* r0 = generator.emitNode(m_base);

   679 

   680     generator.emitExpressionInfo(divot(), startOffset(), endOffset());

   681     return generator.emitDeleteById(generator.finalDestination(dst), r0, m_ident);

   682 }

   683 

   684 // ------------------------------ DeleteValueNode -----------------------------------

   685 

   686 RegisterID* DeleteValueNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)

   687 {

   688     generator.emitNode(generator.ignoredResult(), m_expr);

   689 

   690     // delete on a non-location expression ignores the value and returns true

   691     return generator.emitLoad(generator.finalDestination(dst), true);

   692 }

   693 

   694 // ------------------------------ VoidNode -------------------------------------

   695 

   696 RegisterID* VoidNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)

   697 {

   698     if (dst == generator.ignoredResult()) {

   699         generator.emitNode(generator.ignoredResult(), m_expr);

   700         return 0;

   701     }

   702     RefPtr<RegisterID> r0 = generator.emitNode(m_expr);

   703     return generator.emitLoad(dst, jsUndefined());

   704 }

   705 

   706 // ------------------------------ TypeOfValueNode -----------------------------------

   707 

   708 RegisterID* TypeOfResolveNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)

   709 {

   710     if (RegisterID* local = generator.registerFor(m_ident)) {

   711         if (dst == generator.ignoredResult())

   712             return 0;

   713         return generator.emitTypeOf(generator.finalDestination(dst), local);

   714     }

   715 

   716     RefPtr<RegisterID> scratch = generator.emitResolveBase(generator.tempDestination(dst), m_ident);

   717     generator.emitGetById(scratch.get(), scratch.get(), m_ident);

   718     if (dst == generator.ignoredResult())

   719         return 0;

   720     return generator.emitTypeOf(generator.finalDestination(dst, scratch.get()), scratch.get());

   721 }

   722 

   723 // ------------------------------ TypeOfValueNode -----------------------------------

   724 

   725 RegisterID* TypeOfValueNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)

   726 {

   727     if (dst == generator.ignoredResult()) {

   728         generator.emitNode(generator.ignoredResult(), m_expr);

   729         return 0;

   730     }

   731     RefPtr<RegisterID> src = generator.emitNode(m_expr);

   732     return generator.emitTypeOf(generator.finalDestination(dst), src.get());

   733 }

   734 

   735 // ------------------------------ PrefixResolveNode ----------------------------------

   736 

   737 RegisterID* PrefixResolveNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)

   738 {

   739     if (RegisterID* local = generator.registerFor(m_ident)) {

   740         if (generator.isLocalConstant(m_ident)) {

   741             if (dst == generator.ignoredResult())

   742                 return 0;

   743             RefPtr<RegisterID> r0 = generator.emitLoad(generator.finalDestination(dst), (m_operator == OpPlusPlus) ? 1.0 : -1.0);

   744             return generator.emitBinaryOp(op_add, r0.get(), local, r0.get(), OperandTypes());

   745         }

   746 

   747         emitPreIncOrDec(generator, local, m_operator);

   748         return generator.moveToDestinationIfNeeded(dst, local);

   749     }

   750 

   751     int index = 0;

   752     size_t depth = 0;

   753     JSObject* globalObject = 0;

   754     bool requiresDynamicChecks = false;

   755     if (generator.findScopedProperty(m_ident, index, depth, false, requiresDynamicChecks, globalObject) && index != missingSymbolMarker() && !requiresDynamicChecks) {

   756         RefPtr<RegisterID> propDst = generator.emitGetScopedVar(generator.tempDestination(dst), depth, index, globalObject);

   757         emitPreIncOrDec(generator, propDst.get(), m_operator);

   758         generator.emitPutScopedVar(depth, index, propDst.get(), globalObject);

   759         return generator.moveToDestinationIfNeeded(dst, propDst.get());

   760     }

   761 

   762     generator.emitExpressionInfo(divot(), startOffset(), endOffset());

   763     RefPtr<RegisterID> propDst = generator.tempDestination(dst);

   764     RefPtr<RegisterID> base = generator.emitResolveWithBase(generator.newTemporary(), propDst.get(), m_ident);

   765     emitPreIncOrDec(generator, propDst.get(), m_operator);

   766     generator.emitPutById(base.get(), m_ident, propDst.get());

   767     return generator.moveToDestinationIfNeeded(dst, propDst.get());

   768 }

   769 

   770 // ------------------------------ PrefixBracketNode ----------------------------------

   771 

   772 RegisterID* PrefixBracketNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)

   773 {

   774     RefPtr<RegisterID> base = generator.emitNode(m_base);

   775     RefPtr<RegisterID> property = generator.emitNode(m_subscript);

   776     RefPtr<RegisterID> propDst = generator.tempDestination(dst);

   777 

   778     generator.emitExpressionInfo(divot() + m_subexpressionDivotOffset, m_subexpressionStartOffset, endOffset() - m_subexpressionDivotOffset);

   779     RegisterID* value = generator.emitGetByVal(propDst.get(), base.get(), property.get());

   780     if (m_operator == OpPlusPlus)

   781         generator.emitPreInc(value);

   782     else

   783         generator.emitPreDec(value);

   784     generator.emitExpressionInfo(divot(), startOffset(), endOffset());

   785     generator.emitPutByVal(base.get(), property.get(), value);

   786     return generator.moveToDestinationIfNeeded(dst, propDst.get());

   787 }

   788 

   789 // ------------------------------ PrefixDotNode ----------------------------------

   790 

   791 RegisterID* PrefixDotNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)

   792 {

   793     RefPtr<RegisterID> base = generator.emitNode(m_base);

   794     RefPtr<RegisterID> propDst = generator.tempDestination(dst);

   795 

   796     generator.emitExpressionInfo(divot() + m_subexpressionDivotOffset, m_subexpressionStartOffset, endOffset() - m_subexpressionDivotOffset);

   797     RegisterID* value = generator.emitGetById(propDst.get(), base.get(), m_ident);

   798     if (m_operator == OpPlusPlus)

   799         generator.emitPreInc(value);

   800     else

   801         generator.emitPreDec(value);

   802     generator.emitExpressionInfo(divot(), startOffset(), endOffset());

   803     generator.emitPutById(base.get(), m_ident, value);

   804     return generator.moveToDestinationIfNeeded(dst, propDst.get());

   805 }

   806 

   807 // ------------------------------ PrefixErrorNode -----------------------------------

   808 

   809 RegisterID* PrefixErrorNode::emitBytecode(BytecodeGenerator& generator, RegisterID*)

   810 {

   811     return emitThrowError(generator, true, m_operator == OpPlusPlus

   812         ? "Prefix ++ operator applied to value that is not a reference."

   813         : "Prefix -- operator applied to value that is not a reference.");

   814 }

   815 

   816 // ------------------------------ Unary Operation Nodes -----------------------------------

   817 

   818 RegisterID* UnaryOpNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)

   819 {

   820     RegisterID* src = generator.emitNode(m_expr);

   821     return generator.emitUnaryOp(opcodeID(), generator.finalDestination(dst), src);

   822 }

   823 

   824 

   825 // ------------------------------ LogicalNotNode -----------------------------------

   826 

   827 void LogicalNotNode::emitBytecodeInConditionContext(BytecodeGenerator& generator, Label* trueTarget, Label* falseTarget, bool fallThroughMeansTrue)

   828 {

   829     ASSERT(expr()->hasConditionContextCodegen());

   830 

   831     // reverse the true and false targets

   832     generator.emitNodeInConditionContext(expr(), falseTarget, trueTarget, !fallThroughMeansTrue);

   833 }

   834 

   835 

   836 // ------------------------------ Binary Operation Nodes -----------------------------------

   837 

   838 // BinaryOpNode::emitStrcat:

   839 //

   840 // This node generates an op_strcat operation.  This opcode can handle concatenation of three or

   841 // more values, where we can determine a set of separate op_add operations would be operating on

   842 // string values.

   843 //

   844 // This function expects to be operating on a graph of AST nodes looking something like this:

   845 //

   846 //     (a)...     (b)

   847 //          \   /

   848 //           (+)     (c)

   849 //              \   /

   850 //      [d]     ((+))

   851 //         \    /

   852 //          [+=]

   853 //

   854 // The assignment operation is optional, if it exists the register holding the value on the

   855 // lefthand side of the assignment should be passing as the optional 'lhs' argument.

   856 //

   857 // The method should be called on the node at the root of the tree of regular binary add

   858 // operations (marked in the diagram with a double set of parentheses).  This node must

   859 // be performing a string concatenation (determined by statically detecting that at least

   860 // one child must be a string).  

   861 //

   862 // Since the minimum number of values being concatenated together is expected to be 3, if

   863 // a lhs to a concatenating assignment is not provided then the  root add should have at

   864 // least one left child that is also an add that can be determined to be operating on strings.

   865 //

   866 RegisterID* BinaryOpNode::emitStrcat(BytecodeGenerator& generator, RegisterID* dst, RegisterID* lhs, ReadModifyResolveNode* emitExpressionInfoForMe)

   867 {

   868     ASSERT(isAdd());

   869     ASSERT(resultDescriptor().definitelyIsString());

   870 

   871     // Create a list of expressions for all the adds in the tree of nodes we can convert into

   872     // a string concatenation.  The rightmost node (c) is added first.  The rightmost node is

   873     // added first, and the leftmost child is never added, so the vector produced for the

   874     // example above will be [ c, b ].

   875     Vector<ExpressionNode*, 16> reverseExpressionList;

   876     reverseExpressionList.append(m_expr2);

   877 

   878     // Examine the left child of the add.  So long as this is a string add, add its right-child

   879     // to the list, and keep processing along the left fork.

   880     ExpressionNode* leftMostAddChild = m_expr1;

   881     while (leftMostAddChild->isAdd() && leftMostAddChild->resultDescriptor().definitelyIsString()) {

   882         reverseExpressionList.append(static_cast<AddNode*>(leftMostAddChild)->m_expr2);

   883         leftMostAddChild = static_cast<AddNode*>(leftMostAddChild)->m_expr1;

   884     }

   885 

   886     Vector<RefPtr<RegisterID>, 16> temporaryRegisters;

   887 

   888     // If there is an assignment, allocate a temporary to hold the lhs after conversion.

   889     // We could possibly avoid this (the lhs is converted last anyway, we could let the

   890     // op_strcat node handle its conversion if required).

   891     if (lhs)

   892         temporaryRegisters.append(generator.newTemporary());

   893 

   894     // Emit code for the leftmost node ((a) in the example).

   895     temporaryRegisters.append(generator.newTemporary());

   896     RegisterID* leftMostAddChildTempRegister = temporaryRegisters.last().get();

   897     generator.emitNode(leftMostAddChildTempRegister, leftMostAddChild);

   898 

   899     // Note on ordering of conversions:

   900     //

   901     // We maintain the same ordering of conversions as we would see if the concatenations

   902     // was performed as a sequence of adds (otherwise this optimization could change

   903     // behaviour should an object have been provided a valueOf or toString method).

   904     //

   905     // Considering the above example, the sequnce of execution is:

   906     //     * evaluate operand (a)

   907     //     * evaluate operand (b)

   908     //     * convert (a) to primitive   <-  (this would be triggered by the first add)

   909     //     * convert (b) to primitive   <-  (ditto)

   910     //     * evaluate operand (c)

   911     //     * convert (c) to primitive   <-  (this would be triggered by the second add)

   912     // And optionally, if there is an assignment:

   913     //     * convert (d) to primitive   <-  (this would be triggered by the assigning addition)

   914     //

   915     // As such we do not plant an op to convert the leftmost child now.  Instead, use

   916     // 'leftMostAddChildTempRegister' as a flag to trigger generation of the conversion

   917     // once the second node has been generated.  However, if the leftmost child is an

   918     // immediate we can trivially determine that no conversion will be required.

   919     // If this is the case

   920     if (leftMostAddChild->isString())

   921         leftMostAddChildTempRegister = 0;

   922 

   923     while (reverseExpressionList.size()) {

   924         ExpressionNode* node = reverseExpressionList.last();

   925         reverseExpressionList.removeLast();

   926 

   927         // Emit the code for the current node.

   928         temporaryRegisters.append(generator.newTemporary());

   929         generator.emitNode(temporaryRegisters.last().get(), node);

   930 

   931         // On the first iteration of this loop, when we first reach this point we have just

   932         // generated the second node, which means it is time to convert the leftmost operand.

   933         if (leftMostAddChildTempRegister) {

   934             generator.emitToPrimitive(leftMostAddChildTempRegister, leftMostAddChildTempRegister);

   935             leftMostAddChildTempRegister = 0; // Only do this once.

   936         }

   937         // Plant a conversion for this node, if necessary.

   938         if (!node->isString())

   939             generator.emitToPrimitive(temporaryRegisters.last().get(), temporaryRegisters.last().get());

   940     }

   941     ASSERT(temporaryRegisters.size() >= 3);

   942 

   943     // Certain read-modify nodes require expression info to be emitted *after* m_right has been generated.

   944     // If this is required the node is passed as 'emitExpressionInfoForMe'; do so now.

   945     if (emitExpressionInfoForMe)

   946         generator.emitExpressionInfo(emitExpressionInfoForMe->divot(), emitExpressionInfoForMe->startOffset(), emitExpressionInfoForMe->endOffset());

   947 

   948     // If there is an assignment convert the lhs now.  This will also copy lhs to

   949     // the temporary register we allocated for it.

   950     if (lhs)

   951         generator.emitToPrimitive(temporaryRegisters[0].get(), lhs);

   952 

   953     return generator.emitStrcat(generator.finalDestination(dst, temporaryRegisters[0].get()), temporaryRegisters[0].get(), temporaryRegisters.size());

   954 }

   955 

   956 RegisterID* BinaryOpNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)

   957 {

   958     OpcodeID opcodeID = this->opcodeID();

   959 

   960     if (opcodeID == op_add && m_expr1->isAdd() && m_expr1->resultDescriptor().definitelyIsString())

   961         return emitStrcat(generator, dst);

   962 

   963     if (opcodeID == op_neq) {

   964         if (m_expr1->isNull() || m_expr2->isNull()) {

   965             RefPtr<RegisterID> src = generator.tempDestination(dst);

   966             generator.emitNode(src.get(), m_expr1->isNull() ? m_expr2 : m_expr1);

   967             return generator.emitUnaryOp(op_neq_null, generator.finalDestination(dst, src.get()), src.get());

   968         }

   969     }

   970 

   971     RefPtr<RegisterID> src1 = generator.emitNodeForLeftHandSide(m_expr1, m_rightHasAssignments, m_expr2->isPure(generator));

   972     RegisterID* src2 = generator.emitNode(m_expr2);

   973     return generator.emitBinaryOp(opcodeID, generator.finalDestination(dst, src1.get()), src1.get(), src2, OperandTypes(m_expr1->resultDescriptor(), m_expr2->resultDescriptor()));

   974 }

   975 

   976 RegisterID* EqualNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)

   977 {

   978     if (m_expr1->isNull() || m_expr2->isNull()) {

   979         RefPtr<RegisterID> src = generator.tempDestination(dst);

   980         generator.emitNode(src.get(), m_expr1->isNull() ? m_expr2 : m_expr1);

   981         return generator.emitUnaryOp(op_eq_null, generator.finalDestination(dst, src.get()), src.get());

   982     }

   983 

   984     RefPtr<RegisterID> src1 = generator.emitNodeForLeftHandSide(m_expr1, m_rightHasAssignments, m_expr2->isPure(generator));

   985     RegisterID* src2 = generator.emitNode(m_expr2);

   986     return generator.emitEqualityOp(op_eq, generator.finalDestination(dst, src1.get()), src1.get(), src2);

   987 }

   988 

   989 RegisterID* StrictEqualNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)

   990 {

   991     RefPtr<RegisterID> src1 = generator.emitNodeForLeftHandSide(m_expr1, m_rightHasAssignments, m_expr2->isPure(generator));

   992     RegisterID* src2 = generator.emitNode(m_expr2);

   993     return generator.emitEqualityOp(op_stricteq, generator.finalDestination(dst, src1.get()), src1.get(), src2);

   994 }

   995 

   996 RegisterID* ReverseBinaryOpNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)

   997 {

   998     RefPtr<RegisterID> src1 = generator.emitNodeForLeftHandSide(m_expr1, m_rightHasAssignments, m_expr2->isPure(generator));

   999     RegisterID* src2 = generator.emitNode(m_expr2);

  1000     return generator.emitBinaryOp(opcodeID(), generator.finalDestination(dst, src1.get()), src2, src1.get(), OperandTypes(m_expr2->resultDescriptor(), m_expr1->resultDescriptor()));

  1001 }

  1002 

  1003 RegisterID* ThrowableBinaryOpNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)

  1004 {

  1005     RefPtr<RegisterID> src1 = generator.emitNodeForLeftHandSide(m_expr1, m_rightHasAssignments, m_expr2->isPure(generator));

  1006     RegisterID* src2 = generator.emitNode(m_expr2);

  1007     generator.emitExpressionInfo(divot(), startOffset(), endOffset());

  1008     return generator.emitBinaryOp(opcodeID(), generator.finalDestination(dst, src1.get()), src1.get(), src2, OperandTypes(m_expr1->resultDescriptor(), m_expr2->resultDescriptor()));

  1009 }

  1010 

  1011 RegisterID* InstanceOfNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)

  1012 {

  1013     RefPtr<RegisterID> src1 = generator.emitNodeForLeftHandSide(m_expr1, m_rightHasAssignments, m_expr2->isPure(generator));

  1014     RefPtr<RegisterID> src2 = generator.emitNode(m_expr2);

  1015 

  1016     generator.emitExpressionInfo(divot(), startOffset(), endOffset());

  1017     generator.emitGetByIdExceptionInfo(op_instanceof);

  1018     RegisterID* src2Prototype = generator.emitGetById(generator.newTemporary(), src2.get(), generator.globalData()->propertyNames->prototype);

  1019 

  1020     generator.emitExpressionInfo(divot(), startOffset(), endOffset());

  1021     return generator.emitInstanceOf(generator.finalDestination(dst, src1.get()), src1.get(), src2.get(), src2Prototype);

  1022 }

  1023 

  1024 // ------------------------------ LogicalOpNode ----------------------------

  1025 

  1026 RegisterID* LogicalOpNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)

  1027 {

  1028     RefPtr<RegisterID> temp = generator.tempDestination(dst);

  1029     RefPtr<Label> target = generator.newLabel();

  1030     

  1031     generator.emitNode(temp.get(), m_expr1);

  1032     if (m_operator == OpLogicalAnd)

  1033         generator.emitJumpIfFalse(temp.get(), target.get());

  1034     else

  1035         generator.emitJumpIfTrue(temp.get(), target.get());

  1036     generator.emitNode(temp.get(), m_expr2);

  1037     generator.emitLabel(target.get());

  1038 

  1039     return generator.moveToDestinationIfNeeded(dst, temp.get());

  1040 }

  1041 

  1042 void LogicalOpNode::emitBytecodeInConditionContext(BytecodeGenerator& generator, Label* trueTarget, Label* falseTarget, bool fallThroughMeansTrue)

  1043 {

  1044     if (m_expr1->hasConditionContextCodegen()) {

  1045         RefPtr<Label> afterExpr1 = generator.newLabel();

  1046         if (m_operator == OpLogicalAnd)

  1047             generator.emitNodeInConditionContext(m_expr1, afterExpr1.get(), falseTarget, true);

  1048         else 

  1049             generator.emitNodeInConditionContext(m_expr1, trueTarget, afterExpr1.get(), false);

  1050         generator.emitLabel(afterExpr1.get());

  1051     } else {

  1052         RegisterID* temp = generator.emitNode(m_expr1);

  1053         if (m_operator == OpLogicalAnd)

  1054             generator.emitJumpIfFalse(temp, falseTarget);

  1055         else

  1056             generator.emitJumpIfTrue(temp, trueTarget);

  1057     }

  1058 

  1059     if (m_expr2->hasConditionContextCodegen())

  1060         generator.emitNodeInConditionContext(m_expr2, trueTarget, falseTarget, fallThroughMeansTrue);

  1061     else {

  1062         RegisterID* temp = generator.emitNode(m_expr2);

  1063         if (fallThroughMeansTrue)

  1064             generator.emitJumpIfFalse(temp, falseTarget);

  1065         else

  1066             generator.emitJumpIfTrue(temp, trueTarget);

  1067     }

  1068 }

  1069 

  1070 // ------------------------------ ConditionalNode ------------------------------

  1071 

  1072 RegisterID* ConditionalNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)

  1073 {

  1074     RefPtr<RegisterID> newDst = generator.finalDestination(dst);

  1075     RefPtr<Label> beforeElse = generator.newLabel();

  1076     RefPtr<Label> afterElse = generator.newLabel();

  1077 

  1078     if (m_logical->hasConditionContextCodegen()) {

  1079         RefPtr<Label> beforeThen = generator.newLabel();

  1080         generator.emitNodeInConditionContext(m_logical, beforeThen.get(), beforeElse.get(), true);

  1081         generator.emitLabel(beforeThen.get());

  1082     } else {

  1083         RegisterID* cond = generator.emitNode(m_logical);

  1084         generator.emitJumpIfFalse(cond, beforeElse.get());

  1085     }

  1086 

  1087     generator.emitNode(newDst.get(), m_expr1);

  1088     generator.emitJump(afterElse.get());

  1089 

  1090     generator.emitLabel(beforeElse.get());

  1091     generator.emitNode(newDst.get(), m_expr2);

  1092 

  1093     generator.emitLabel(afterElse.get());

  1094 

  1095     return newDst.get();

  1096 }

  1097 

  1098 // ------------------------------ ReadModifyResolveNode -----------------------------------

  1099 

  1100 // FIXME: should this be moved to be a method on BytecodeGenerator?

  1101 static ALWAYS_INLINE RegisterID* emitReadModifyAssignment(BytecodeGenerator& generator, RegisterID* dst, RegisterID* src1, ExpressionNode* m_right, Operator oper, OperandTypes types, ReadModifyResolveNode* emitExpressionInfoForMe = 0)

  1102 {

  1103     OpcodeID opcodeID;

  1104     switch (oper) {

  1105         case OpMultEq:

  1106             opcodeID = op_mul;

  1107             break;

  1108         case OpDivEq:

  1109             opcodeID = op_div;

  1110             break;

  1111         case OpPlusEq:

  1112             if (m_right->isAdd() && m_right->resultDescriptor().definitelyIsString())

  1113                 return static_cast<AddNode*>(m_right)->emitStrcat(generator, dst, src1, emitExpressionInfoForMe);

  1114             opcodeID = op_add;

  1115             break;

  1116         case OpMinusEq:

  1117             opcodeID = op_sub;

  1118             break;

  1119         case OpLShift:

  1120             opcodeID = op_lshift;

  1121             break;

  1122         case OpRShift:

  1123             opcodeID = op_rshift;

  1124             break;

  1125         case OpURShift:

  1126             opcodeID = op_urshift;

  1127             break;

  1128         case OpAndEq:

  1129             opcodeID = op_bitand;

  1130             break;

  1131         case OpXOrEq:

  1132             opcodeID = op_bitxor;

  1133             break;

  1134         case OpOrEq:

  1135             opcodeID = op_bitor;