CodeGenerator.java revision 1072:4dfa462ee93f
1/*
2 * Copyright (c) 2010, 2013, Oracle and/or its affiliates. All rights reserved.
3 * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
4 *
5 * This code is free software; you can redistribute it and/or modify it
6 * under the terms of the GNU General Public License version 2 only, as
7 * published by the Free Software Foundation.  Oracle designates this
8 * particular file as subject to the "Classpath" exception as provided
9 * by Oracle in the LICENSE file that accompanied this code.
10 *
11 * This code is distributed in the hope that it will be useful, but WITHOUT
12 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
13 * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
14 * version 2 for more details (a copy is included in the LICENSE file that
15 * accompanied this code).
16 *
17 * You should have received a copy of the GNU General Public License version
18 * 2 along with this work; if not, write to the Free Software Foundation,
19 * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
20 *
21 * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
22 * or visit www.oracle.com if you need additional information or have any
23 * questions.
24 */
25
26package jdk.nashorn.internal.codegen;
27
28import static jdk.nashorn.internal.codegen.ClassEmitter.Flag.PRIVATE;
29import static jdk.nashorn.internal.codegen.ClassEmitter.Flag.STATIC;
30import static jdk.nashorn.internal.codegen.CompilerConstants.ARGUMENTS;
31import static jdk.nashorn.internal.codegen.CompilerConstants.CALLEE;
32import static jdk.nashorn.internal.codegen.CompilerConstants.CREATE_PROGRAM_FUNCTION;
33import static jdk.nashorn.internal.codegen.CompilerConstants.GET_MAP;
34import static jdk.nashorn.internal.codegen.CompilerConstants.GET_STRING;
35import static jdk.nashorn.internal.codegen.CompilerConstants.QUICK_PREFIX;
36import static jdk.nashorn.internal.codegen.CompilerConstants.REGEX_PREFIX;
37import static jdk.nashorn.internal.codegen.CompilerConstants.SCOPE;
38import static jdk.nashorn.internal.codegen.CompilerConstants.SPLIT_PREFIX;
39import static jdk.nashorn.internal.codegen.CompilerConstants.THIS;
40import static jdk.nashorn.internal.codegen.CompilerConstants.VARARGS;
41import static jdk.nashorn.internal.codegen.CompilerConstants.constructorNoLookup;
42import static jdk.nashorn.internal.codegen.CompilerConstants.interfaceCallNoLookup;
43import static jdk.nashorn.internal.codegen.CompilerConstants.methodDescriptor;
44import static jdk.nashorn.internal.codegen.CompilerConstants.staticCallNoLookup;
45import static jdk.nashorn.internal.codegen.CompilerConstants.typeDescriptor;
46import static jdk.nashorn.internal.codegen.CompilerConstants.virtualCallNoLookup;
47import static jdk.nashorn.internal.codegen.ObjectClassGenerator.OBJECT_FIELDS_ONLY;
48import static jdk.nashorn.internal.ir.Symbol.HAS_SLOT;
49import static jdk.nashorn.internal.ir.Symbol.IS_INTERNAL;
50import static jdk.nashorn.internal.runtime.UnwarrantedOptimismException.INVALID_PROGRAM_POINT;
51import static jdk.nashorn.internal.runtime.UnwarrantedOptimismException.isValid;
52import static jdk.nashorn.internal.runtime.linker.NashornCallSiteDescriptor.CALLSITE_APPLY_TO_CALL;
53import static jdk.nashorn.internal.runtime.linker.NashornCallSiteDescriptor.CALLSITE_DECLARE;
54import static jdk.nashorn.internal.runtime.linker.NashornCallSiteDescriptor.CALLSITE_FAST_SCOPE;
55import static jdk.nashorn.internal.runtime.linker.NashornCallSiteDescriptor.CALLSITE_OPTIMISTIC;
56import static jdk.nashorn.internal.runtime.linker.NashornCallSiteDescriptor.CALLSITE_PROGRAM_POINT_SHIFT;
57import static jdk.nashorn.internal.runtime.linker.NashornCallSiteDescriptor.CALLSITE_SCOPE;
58
59import java.io.PrintWriter;
60import java.util.ArrayDeque;
61import java.util.ArrayList;
62import java.util.Arrays;
63import java.util.BitSet;
64import java.util.Collection;
65import java.util.Collections;
66import java.util.Deque;
67import java.util.EnumSet;
68import java.util.HashMap;
69import java.util.HashSet;
70import java.util.Iterator;
71import java.util.LinkedList;
72import java.util.List;
73import java.util.Map;
74import java.util.Set;
75import java.util.TreeMap;
76import java.util.function.Supplier;
77import jdk.nashorn.internal.AssertsEnabled;
78import jdk.nashorn.internal.IntDeque;
79import jdk.nashorn.internal.codegen.ClassEmitter.Flag;
80import jdk.nashorn.internal.codegen.CompilerConstants.Call;
81import jdk.nashorn.internal.codegen.types.ArrayType;
82import jdk.nashorn.internal.codegen.types.Type;
83import jdk.nashorn.internal.ir.AccessNode;
84import jdk.nashorn.internal.ir.BaseNode;
85import jdk.nashorn.internal.ir.BinaryNode;
86import jdk.nashorn.internal.ir.Block;
87import jdk.nashorn.internal.ir.BlockStatement;
88import jdk.nashorn.internal.ir.BreakNode;
89import jdk.nashorn.internal.ir.BreakableNode;
90import jdk.nashorn.internal.ir.CallNode;
91import jdk.nashorn.internal.ir.CaseNode;
92import jdk.nashorn.internal.ir.CatchNode;
93import jdk.nashorn.internal.ir.ContinueNode;
94import jdk.nashorn.internal.ir.EmptyNode;
95import jdk.nashorn.internal.ir.Expression;
96import jdk.nashorn.internal.ir.ExpressionStatement;
97import jdk.nashorn.internal.ir.ForNode;
98import jdk.nashorn.internal.ir.FunctionNode;
99import jdk.nashorn.internal.ir.FunctionNode.CompilationState;
100import jdk.nashorn.internal.ir.GetSplitState;
101import jdk.nashorn.internal.ir.IdentNode;
102import jdk.nashorn.internal.ir.IfNode;
103import jdk.nashorn.internal.ir.IndexNode;
104import jdk.nashorn.internal.ir.JoinPredecessorExpression;
105import jdk.nashorn.internal.ir.JumpStatement;
106import jdk.nashorn.internal.ir.LabelNode;
107import jdk.nashorn.internal.ir.LexicalContext;
108import jdk.nashorn.internal.ir.LexicalContextNode;
109import jdk.nashorn.internal.ir.LiteralNode;
110import jdk.nashorn.internal.ir.LiteralNode.ArrayLiteralNode;
111import jdk.nashorn.internal.ir.LiteralNode.ArrayLiteralNode.ArrayUnit;
112import jdk.nashorn.internal.ir.LiteralNode.PrimitiveLiteralNode;
113import jdk.nashorn.internal.ir.LocalVariableConversion;
114import jdk.nashorn.internal.ir.LoopNode;
115import jdk.nashorn.internal.ir.Node;
116import jdk.nashorn.internal.ir.ObjectNode;
117import jdk.nashorn.internal.ir.Optimistic;
118import jdk.nashorn.internal.ir.PropertyNode;
119import jdk.nashorn.internal.ir.ReturnNode;
120import jdk.nashorn.internal.ir.RuntimeNode;
121import jdk.nashorn.internal.ir.RuntimeNode.Request;
122import jdk.nashorn.internal.ir.SetSplitState;
123import jdk.nashorn.internal.ir.SplitReturn;
124import jdk.nashorn.internal.ir.Statement;
125import jdk.nashorn.internal.ir.SwitchNode;
126import jdk.nashorn.internal.ir.Symbol;
127import jdk.nashorn.internal.ir.TernaryNode;
128import jdk.nashorn.internal.ir.ThrowNode;
129import jdk.nashorn.internal.ir.TryNode;
130import jdk.nashorn.internal.ir.UnaryNode;
131import jdk.nashorn.internal.ir.VarNode;
132import jdk.nashorn.internal.ir.WhileNode;
133import jdk.nashorn.internal.ir.WithNode;
134import jdk.nashorn.internal.ir.visitor.NodeOperatorVisitor;
135import jdk.nashorn.internal.ir.visitor.NodeVisitor;
136import jdk.nashorn.internal.objects.Global;
137import jdk.nashorn.internal.objects.ScriptFunctionImpl;
138import jdk.nashorn.internal.parser.Lexer.RegexToken;
139import jdk.nashorn.internal.parser.TokenType;
140import jdk.nashorn.internal.runtime.Context;
141import jdk.nashorn.internal.runtime.Debug;
142import jdk.nashorn.internal.runtime.ECMAException;
143import jdk.nashorn.internal.runtime.JSType;
144import jdk.nashorn.internal.runtime.OptimisticReturnFilters;
145import jdk.nashorn.internal.runtime.PropertyMap;
146import jdk.nashorn.internal.runtime.RecompilableScriptFunctionData;
147import jdk.nashorn.internal.runtime.RewriteException;
148import jdk.nashorn.internal.runtime.Scope;
149import jdk.nashorn.internal.runtime.ScriptEnvironment;
150import jdk.nashorn.internal.runtime.ScriptFunction;
151import jdk.nashorn.internal.runtime.ScriptObject;
152import jdk.nashorn.internal.runtime.ScriptRuntime;
153import jdk.nashorn.internal.runtime.Source;
154import jdk.nashorn.internal.runtime.Undefined;
155import jdk.nashorn.internal.runtime.UnwarrantedOptimismException;
156import jdk.nashorn.internal.runtime.arrays.ArrayData;
157import jdk.nashorn.internal.runtime.linker.LinkerCallSite;
158import jdk.nashorn.internal.runtime.logging.DebugLogger;
159import jdk.nashorn.internal.runtime.logging.Loggable;
160import jdk.nashorn.internal.runtime.logging.Logger;
161import jdk.nashorn.internal.runtime.options.Options;
162
163/**
164 * This is the lowest tier of the code generator. It takes lowered ASTs emitted
165 * from Lower and emits Java byte code. The byte code emission logic is broken
166 * out into MethodEmitter. MethodEmitter works internally with a type stack, and
167 * keeps track of the contents of the byte code stack. This way we avoid a large
168 * number of special cases on the form
169 * <pre>
170 * if (type == INT) {
171 *     visitInsn(ILOAD, slot);
172 * } else if (type == DOUBLE) {
173 *     visitInsn(DOUBLE, slot);
174 * }
175 * </pre>
176 * This quickly became apparent when the code generator was generalized to work
177 * with all types, and not just numbers or objects.
178 * <p>
179 * The CodeGenerator visits nodes only once, tags them as resolved and emits
180 * bytecode for them.
181 */
182@Logger(name="codegen")
183final class CodeGenerator extends NodeOperatorVisitor<CodeGeneratorLexicalContext> implements Loggable {
184
185    private static final Type SCOPE_TYPE = Type.typeFor(ScriptObject.class);
186
187    private static final String GLOBAL_OBJECT = Type.getInternalName(Global.class);
188
189    private static final String SCRIPTFUNCTION_IMPL_NAME = Type.getInternalName(ScriptFunctionImpl.class);
190    private static final Type   SCRIPTFUNCTION_IMPL_TYPE   = Type.typeFor(ScriptFunction.class);
191
192    private static final Call CREATE_REWRITE_EXCEPTION = CompilerConstants.staticCallNoLookup(RewriteException.class,
193            "create", RewriteException.class, UnwarrantedOptimismException.class, Object[].class, String[].class);
194    private static final Call CREATE_REWRITE_EXCEPTION_REST_OF = CompilerConstants.staticCallNoLookup(RewriteException.class,
195            "create", RewriteException.class, UnwarrantedOptimismException.class, Object[].class, String[].class, int[].class);
196
197    private static final Call ENSURE_INT = CompilerConstants.staticCallNoLookup(OptimisticReturnFilters.class,
198            "ensureInt", int.class, Object.class, int.class);
199    private static final Call ENSURE_LONG = CompilerConstants.staticCallNoLookup(OptimisticReturnFilters.class,
200            "ensureLong", long.class, Object.class, int.class);
201    private static final Call ENSURE_NUMBER = CompilerConstants.staticCallNoLookup(OptimisticReturnFilters.class,
202            "ensureNumber", double.class, Object.class, int.class);
203
204    private static final Class<?> ITERATOR_CLASS = Iterator.class;
205    static {
206        assert ITERATOR_CLASS == CompilerConstants.ITERATOR_PREFIX.type();
207    }
208    private static final Type ITERATOR_TYPE = Type.typeFor(ITERATOR_CLASS);
209    private static final Type EXCEPTION_TYPE = Type.typeFor(CompilerConstants.EXCEPTION_PREFIX.type());
210
211    /** Constant data & installation. The only reason the compiler keeps this is because it is assigned
212     *  by reflection in class installation */
213    private final Compiler compiler;
214
215    /** Is the current code submitted by 'eval' call? */
216    private final boolean evalCode;
217
218    /** Call site flags given to the code generator to be used for all generated call sites */
219    private final int callSiteFlags;
220
221    /** How many regexp fields have been emitted */
222    private int regexFieldCount;
223
224    /** Line number for last statement. If we encounter a new line number, line number bytecode information
225     *  needs to be generated */
226    private int lastLineNumber = -1;
227
228    /** When should we stop caching regexp expressions in fields to limit bytecode size? */
229    private static final int MAX_REGEX_FIELDS = 2 * 1024;
230
231    /** Current method emitter */
232    private MethodEmitter method;
233
234    /** Current compile unit */
235    private CompileUnit unit;
236
237    private final DebugLogger log;
238
239    /** From what size should we use spill instead of fields for JavaScript objects? */
240    private static final int OBJECT_SPILL_THRESHOLD = Options.getIntProperty("nashorn.spill.threshold", 256);
241
242    private final Set<String> emittedMethods = new HashSet<>();
243
244    // Function Id -> ContinuationInfo. Used by compilation of rest-of function only.
245    private final Map<Integer, ContinuationInfo> fnIdToContinuationInfo = new HashMap<>();
246
247    private final Deque<Label> scopeEntryLabels = new ArrayDeque<>();
248
249    private static final Label METHOD_BOUNDARY = new Label("");
250    private final Deque<Label> catchLabels = new ArrayDeque<>();
251    // Number of live locals on entry to (and thus also break from) labeled blocks.
252    private final IntDeque labeledBlockBreakLiveLocals = new IntDeque();
253
254    //is this a rest of compilation
255    private final int[] continuationEntryPoints;
256
257    /**
258     * Constructor.
259     *
260     * @param compiler
261     */
262    CodeGenerator(final Compiler compiler, final int[] continuationEntryPoints) {
263        super(new CodeGeneratorLexicalContext());
264        this.compiler                = compiler;
265        this.evalCode                = compiler.getSource().isEvalCode();
266        this.continuationEntryPoints = continuationEntryPoints;
267        this.callSiteFlags           = compiler.getScriptEnvironment()._callsite_flags;
268        this.log                     = initLogger(compiler.getContext());
269    }
270
271    @Override
272    public DebugLogger getLogger() {
273        return log;
274    }
275
276    @Override
277    public DebugLogger initLogger(final Context context) {
278        return context.getLogger(this.getClass());
279    }
280
281    /**
282     * Gets the call site flags, adding the strict flag if the current function
283     * being generated is in strict mode
284     *
285     * @return the correct flags for a call site in the current function
286     */
287    int getCallSiteFlags() {
288        return lc.getCurrentFunction().getCallSiteFlags() | callSiteFlags;
289    }
290
291    /**
292     * Are we generating code for 'eval' code?
293     * @return true if currently compiled code is 'eval' code.
294     */
295    boolean isEvalCode() {
296        return evalCode;
297    }
298
299    /**
300     * Load an identity node
301     *
302     * @param identNode an identity node to load
303     * @return the method generator used
304     */
305    private MethodEmitter loadIdent(final IdentNode identNode, final TypeBounds resultBounds) {
306        checkTemporalDeadZone(identNode);
307        final Symbol symbol = identNode.getSymbol();
308
309        if (!symbol.isScope()) {
310            final Type type = identNode.getType();
311            if(type == Type.UNDEFINED) {
312                return method.loadUndefined(resultBounds.widest);
313            }
314
315            assert symbol.hasSlot() || symbol.isParam();
316            return method.load(identNode);
317        }
318
319        assert identNode.getSymbol().isScope() : identNode + " is not in scope!";
320        final int flags = CALLSITE_SCOPE | getCallSiteFlags();
321        if (isFastScope(symbol)) {
322            // Only generate shared scope getter for fast-scope symbols so we know we can dial in correct scope.
323            if (symbol.getUseCount() > SharedScopeCall.FAST_SCOPE_GET_THRESHOLD && !isOptimisticOrRestOf()) {
324                method.loadCompilerConstant(SCOPE);
325                // As shared scope vars are only used in non-optimistic compilation, we switch from using TypeBounds to
326                // just a single definitive type, resultBounds.widest.
327                loadSharedScopeVar(resultBounds.widest, symbol, flags);
328            } else {
329                new LoadFastScopeVar(identNode, resultBounds, flags).emit();
330            }
331        } else {
332            //slow scope load, we have no proto depth
333            new LoadScopeVar(identNode, resultBounds, flags).emit();
334        }
335
336        return method;
337    }
338
339    // Any access to LET and CONST variables before their declaration must throw ReferenceError.
340    // This is called the temporal dead zone (TDZ). See https://gist.github.com/rwaldron/f0807a758aa03bcdd58a
341    private void checkTemporalDeadZone(final IdentNode identNode) {
342        if (identNode.isDead()) {
343            method.load(identNode.getSymbol().getName());
344            method.invoke(ScriptRuntime.THROW_REFERENCE_ERROR);
345        }
346    }
347
348    private boolean isRestOf() {
349        return continuationEntryPoints != null;
350    }
351
352    private boolean isOptimisticOrRestOf() {
353        return useOptimisticTypes() || isRestOf();
354    }
355
356    private boolean isCurrentContinuationEntryPoint(final int programPoint) {
357        return isRestOf() && getCurrentContinuationEntryPoint() == programPoint;
358    }
359
360    private int[] getContinuationEntryPoints() {
361        return isRestOf() ? continuationEntryPoints : null;
362    }
363
364    private int getCurrentContinuationEntryPoint() {
365        return isRestOf() ? continuationEntryPoints[0] : INVALID_PROGRAM_POINT;
366    }
367
368    private boolean isContinuationEntryPoint(final int programPoint) {
369        if (isRestOf()) {
370            assert continuationEntryPoints != null;
371            for (final int cep : continuationEntryPoints) {
372                if (cep == programPoint) {
373                    return true;
374                }
375            }
376        }
377        return false;
378    }
379
380    /**
381     * Check if this symbol can be accessed directly with a putfield or getfield or dynamic load
382     *
383     * @param symbol symbol to check for fast scope
384     * @return true if fast scope
385     */
386    private boolean isFastScope(final Symbol symbol) {
387        if (!symbol.isScope()) {
388            return false;
389        }
390
391        if (!lc.inDynamicScope()) {
392            // If there's no with or eval in context, and the symbol is marked as scoped, it is fast scoped. Such a
393            // symbol must either be global, or its defining block must need scope.
394            assert symbol.isGlobal() || lc.getDefiningBlock(symbol).needsScope() : symbol.getName();
395            return true;
396        }
397
398        if (symbol.isGlobal()) {
399            // Shortcut: if there's a with or eval in context, globals can't be fast scoped
400            return false;
401        }
402
403        // Otherwise, check if there's a dynamic scope between use of the symbol and its definition
404        final String name = symbol.getName();
405        boolean previousWasBlock = false;
406        for (final Iterator<LexicalContextNode> it = lc.getAllNodes(); it.hasNext();) {
407            final LexicalContextNode node = it.next();
408            if (node instanceof Block) {
409                // If this block defines the symbol, then we can fast scope the symbol.
410                final Block block = (Block)node;
411                if (block.getExistingSymbol(name) == symbol) {
412                    assert block.needsScope();
413                    return true;
414                }
415                previousWasBlock = true;
416            } else {
417                if (node instanceof WithNode && previousWasBlock || node instanceof FunctionNode && ((FunctionNode)node).needsDynamicScope()) {
418                    // If we hit a scope that can have symbols introduced into it at run time before finding the defining
419                    // block, the symbol can't be fast scoped. A WithNode only counts if we've immediately seen a block
420                    // before - its block. Otherwise, we are currently processing the WithNode's expression, and that's
421                    // obviously not subjected to introducing new symbols.
422                    return false;
423                }
424                previousWasBlock = false;
425            }
426        }
427        // Should've found the symbol defined in a block
428        throw new AssertionError();
429    }
430
431    private MethodEmitter loadSharedScopeVar(final Type valueType, final Symbol symbol, final int flags) {
432        assert !isOptimisticOrRestOf();
433        if (isFastScope(symbol)) {
434            method.load(getScopeProtoDepth(lc.getCurrentBlock(), symbol));
435        } else {
436            method.load(-1);
437        }
438        return lc.getScopeGet(unit, symbol, valueType, flags | CALLSITE_FAST_SCOPE).generateInvoke(method);
439    }
440
441    private class LoadScopeVar extends OptimisticOperation {
442        final IdentNode identNode;
443        private final int flags;
444
445        LoadScopeVar(final IdentNode identNode, final TypeBounds resultBounds, final int flags) {
446            super(identNode, resultBounds);
447            this.identNode = identNode;
448            this.flags = flags;
449        }
450
451        @Override
452        void loadStack() {
453            method.loadCompilerConstant(SCOPE);
454            getProto();
455        }
456
457        void getProto() {
458            //empty
459        }
460
461        @Override
462        void consumeStack() {
463            // If this is either __FILE__, __DIR__, or __LINE__ then load the property initially as Object as we'd convert
464            // it anyway for replaceLocationPropertyPlaceholder.
465            if(identNode.isCompileTimePropertyName()) {
466                method.dynamicGet(Type.OBJECT, identNode.getSymbol().getName(), flags, identNode.isFunction());
467                replaceCompileTimeProperty();
468            } else {
469                dynamicGet(identNode.getSymbol().getName(), flags, identNode.isFunction());
470            }
471        }
472    }
473
474    private class LoadFastScopeVar extends LoadScopeVar {
475        LoadFastScopeVar(final IdentNode identNode, final TypeBounds resultBounds, final int flags) {
476            super(identNode, resultBounds, flags | CALLSITE_FAST_SCOPE);
477        }
478
479        @Override
480        void getProto() {
481            loadFastScopeProto(identNode.getSymbol(), false);
482        }
483    }
484
485    private MethodEmitter storeFastScopeVar(final Symbol symbol, final int flags) {
486        loadFastScopeProto(symbol, true);
487        method.dynamicSet(symbol.getName(), flags | CALLSITE_FAST_SCOPE);
488        return method;
489    }
490
491    private int getScopeProtoDepth(final Block startingBlock, final Symbol symbol) {
492        //walk up the chain from starting block and when we bump into the current function boundary, add the external
493        //information.
494        final FunctionNode fn   = lc.getCurrentFunction();
495        final int externalDepth = compiler.getScriptFunctionData(fn.getId()).getExternalSymbolDepth(symbol.getName());
496
497        //count the number of scopes from this place to the start of the function
498
499        final int internalDepth = FindScopeDepths.findInternalDepth(lc, fn, startingBlock, symbol);
500        final int scopesToStart = FindScopeDepths.findScopesToStart(lc, fn, startingBlock);
501        int depth = 0;
502        if (internalDepth == -1) {
503            depth = scopesToStart + externalDepth;
504        } else {
505            assert internalDepth <= scopesToStart;
506            depth = internalDepth;
507        }
508
509        return depth;
510    }
511
512    private void loadFastScopeProto(final Symbol symbol, final boolean swap) {
513        final int depth = getScopeProtoDepth(lc.getCurrentBlock(), symbol);
514        assert depth != -1 : "Couldn't find scope depth for symbol " + symbol.getName() + " in " + lc.getCurrentFunction();
515        if (depth > 0) {
516            if (swap) {
517                method.swap();
518            }
519            for (int i = 0; i < depth; i++) {
520                method.invoke(ScriptObject.GET_PROTO);
521            }
522            if (swap) {
523                method.swap();
524            }
525        }
526    }
527
528    /**
529     * Generate code that loads this node to the stack, not constraining its type
530     *
531     * @param expr node to load
532     *
533     * @return the method emitter used
534     */
535    private MethodEmitter loadExpressionUnbounded(final Expression expr) {
536        return loadExpression(expr, TypeBounds.UNBOUNDED);
537    }
538
539    private MethodEmitter loadExpressionAsObject(final Expression expr) {
540        return loadExpression(expr, TypeBounds.OBJECT);
541    }
542
543    MethodEmitter loadExpressionAsBoolean(final Expression expr) {
544        return loadExpression(expr, TypeBounds.BOOLEAN);
545    }
546
547    // Test whether conversion from source to target involves a call of ES 9.1 ToPrimitive
548    // with possible side effects from calling an object's toString or valueOf methods.
549    private static boolean noToPrimitiveConversion(final Type source, final Type target) {
550        // Object to boolean conversion does not cause ToPrimitive call
551        return source.isJSPrimitive() || !target.isJSPrimitive() || target.isBoolean();
552    }
553
554    MethodEmitter loadBinaryOperands(final BinaryNode binaryNode) {
555        return loadBinaryOperands(binaryNode.lhs(), binaryNode.rhs(), TypeBounds.UNBOUNDED.notWiderThan(binaryNode.getWidestOperandType()), false, false);
556    }
557
558    private MethodEmitter loadBinaryOperands(final Expression lhs, final Expression rhs, final TypeBounds explicitOperandBounds, final boolean baseAlreadyOnStack, final boolean forceConversionSeparation) {
559        // ECMAScript 5.1 specification (sections 11.5-11.11 and 11.13) prescribes that when evaluating a binary
560        // expression "LEFT op RIGHT", the order of operations must be: LOAD LEFT, LOAD RIGHT, CONVERT LEFT, CONVERT
561        // RIGHT, EXECUTE OP. Unfortunately, doing it in this order defeats potential optimizations that arise when we
562        // can combine a LOAD with a CONVERT operation (e.g. use a dynamic getter with the conversion target type as its
563        // return value). What we do here is reorder LOAD RIGHT and CONVERT LEFT when possible; it is possible only when
564        // we can prove that executing CONVERT LEFT can't have a side effect that changes the value of LOAD RIGHT.
565        // Basically, if we know that either LEFT already is a primitive value, or does not have to be converted to
566        // a primitive value, or RIGHT is an expression that loads without side effects, then we can do the
567        // reordering and collapse LOAD/CONVERT into a single operation; otherwise we need to do the more costly
568        // separate operations to preserve specification semantics.
569
570        // Operands' load type should not be narrower than the narrowest of the individual operand types, nor narrower
571        // than the lower explicit bound, but it should also not be wider than
572        final Type narrowestOperandType = Type.narrowest(Type.widest(lhs.getType(), rhs.getType()), explicitOperandBounds.widest);
573        final TypeBounds operandBounds = explicitOperandBounds.notNarrowerThan(narrowestOperandType);
574        if (noToPrimitiveConversion(lhs.getType(), explicitOperandBounds.widest) || rhs.isLocal()) {
575            // Can reorder. We might still need to separate conversion, but at least we can do it with reordering
576            if (forceConversionSeparation) {
577                // Can reorder, but can't move conversion into the operand as the operation depends on operands
578                // exact types for its overflow guarantees. E.g. with {L}{%I}expr1 {L}* {L}{%I}expr2 we are not allowed
579                // to merge {L}{%I} into {%L}, as that can cause subsequent overflows; test for JDK-8058610 contains
580                // concrete cases where this could happen.
581                final TypeBounds safeConvertBounds = TypeBounds.UNBOUNDED.notNarrowerThan(narrowestOperandType);
582                loadExpression(lhs, safeConvertBounds, baseAlreadyOnStack);
583                method.convert(operandBounds.within(method.peekType()));
584                loadExpression(rhs, safeConvertBounds, false);
585                method.convert(operandBounds.within(method.peekType()));
586            } else {
587                // Can reorder and move conversion into the operand. Combine load and convert into single operations.
588                loadExpression(lhs, operandBounds, baseAlreadyOnStack);
589                loadExpression(rhs, operandBounds, false);
590            }
591        } else {
592            // Can't reorder. Load and convert separately.
593            final TypeBounds safeConvertBounds = TypeBounds.UNBOUNDED.notNarrowerThan(narrowestOperandType);
594            loadExpression(lhs, safeConvertBounds, baseAlreadyOnStack);
595            final Type lhsType = method.peekType();
596            loadExpression(rhs, safeConvertBounds, false);
597            final Type convertedLhsType = operandBounds.within(method.peekType());
598            if (convertedLhsType != lhsType) {
599                // Do it conditionally, so that if conversion is a no-op we don't introduce a SWAP, SWAP.
600                method.swap().convert(convertedLhsType).swap();
601            }
602            method.convert(operandBounds.within(method.peekType()));
603        }
604        assert Type.generic(method.peekType()) == operandBounds.narrowest;
605        assert Type.generic(method.peekType(1)) == operandBounds.narrowest;
606
607        return method;
608    }
609
610    private static final class TypeBounds {
611        final Type narrowest;
612        final Type widest;
613
614        static final TypeBounds UNBOUNDED = new TypeBounds(Type.UNKNOWN, Type.OBJECT);
615        static final TypeBounds INT = exact(Type.INT);
616        static final TypeBounds NUMBER = exact(Type.NUMBER);
617        static final TypeBounds OBJECT = exact(Type.OBJECT);
618        static final TypeBounds BOOLEAN = exact(Type.BOOLEAN);
619
620        static TypeBounds exact(final Type type) {
621            return new TypeBounds(type, type);
622        }
623
624        TypeBounds(final Type narrowest, final Type widest) {
625            assert widest    != null && widest    != Type.UNDEFINED && widest != Type.UNKNOWN : widest;
626            assert narrowest != null && narrowest != Type.UNDEFINED : narrowest;
627            assert !narrowest.widerThan(widest) : narrowest + " wider than " + widest;
628            assert !widest.narrowerThan(narrowest);
629            this.narrowest = Type.generic(narrowest);
630            this.widest = Type.generic(widest);
631        }
632
633        TypeBounds notNarrowerThan(final Type type) {
634            return maybeNew(Type.narrowest(Type.widest(narrowest, type), widest), widest);
635        }
636
637        TypeBounds notWiderThan(final Type type) {
638            return maybeNew(Type.narrowest(narrowest, type), Type.narrowest(widest, type));
639        }
640
641        boolean canBeNarrowerThan(final Type type) {
642            return narrowest.narrowerThan(type);
643        }
644
645        TypeBounds maybeNew(final Type newNarrowest, final Type newWidest) {
646            if(newNarrowest == narrowest && newWidest == widest) {
647                return this;
648            }
649            return new TypeBounds(newNarrowest, newWidest);
650        }
651
652        TypeBounds booleanToInt() {
653            return maybeNew(CodeGenerator.booleanToInt(narrowest), CodeGenerator.booleanToInt(widest));
654        }
655
656        TypeBounds objectToNumber() {
657            return maybeNew(CodeGenerator.objectToNumber(narrowest), CodeGenerator.objectToNumber(widest));
658        }
659
660        Type within(final Type type) {
661            if(type.narrowerThan(narrowest)) {
662                return narrowest;
663            }
664            if(type.widerThan(widest)) {
665                return widest;
666            }
667            return type;
668        }
669
670        @Override
671        public String toString() {
672            return "[" + narrowest + ", " + widest + "]";
673        }
674    }
675
676    private static Type booleanToInt(final Type t) {
677        return t == Type.BOOLEAN ? Type.INT : t;
678    }
679
680    private static Type objectToNumber(final Type t) {
681        return t.isObject() ? Type.NUMBER : t;
682    }
683
684    MethodEmitter loadExpressionAsType(final Expression expr, final Type type) {
685        if(type == Type.BOOLEAN) {
686            return loadExpressionAsBoolean(expr);
687        } else if(type == Type.UNDEFINED) {
688            assert expr.getType() == Type.UNDEFINED;
689            return loadExpressionAsObject(expr);
690        }
691        // having no upper bound preserves semantics of optimistic operations in the expression (by not having them
692        // converted early) and then applies explicit conversion afterwards.
693        return loadExpression(expr, TypeBounds.UNBOUNDED.notNarrowerThan(type)).convert(type);
694    }
695
696    private MethodEmitter loadExpression(final Expression expr, final TypeBounds resultBounds) {
697        return loadExpression(expr, resultBounds, false);
698    }
699
700    /**
701     * Emits code for evaluating an expression and leaving its value on top of the stack, narrowing or widening it if
702     * necessary.
703     * @param expr the expression to load
704     * @param resultBounds the incoming type bounds. The value on the top of the stack is guaranteed to not be of narrower
705     * type than the narrowest bound, or wider type than the widest bound after it is loaded.
706     * @param baseAlreadyOnStack true if the base of an access or index node is already on the stack. Used to avoid
707     * double evaluation of bases in self-assignment expressions to access and index nodes. {@code Type.OBJECT} is used
708     * to indicate the widest possible type.
709     * @return the method emitter
710     */
711    private MethodEmitter loadExpression(final Expression expr, final TypeBounds resultBounds, final boolean baseAlreadyOnStack) {
712
713        /*
714         * The load may be of type IdentNode, e.g. "x", AccessNode, e.g. "x.y"
715         * or IndexNode e.g. "x[y]". Both AccessNodes and IndexNodes are
716         * BaseNodes and the logic for loading the base object is reused
717         */
718        final CodeGenerator codegen = this;
719
720        final Node currentDiscard = codegen.lc.getCurrentDiscard();
721        expr.accept(new NodeOperatorVisitor<LexicalContext>(new LexicalContext()) {
722            @Override
723            public boolean enterIdentNode(final IdentNode identNode) {
724                loadIdent(identNode, resultBounds);
725                return false;
726            }
727
728            @Override
729            public boolean enterAccessNode(final AccessNode accessNode) {
730                new OptimisticOperation(accessNode, resultBounds) {
731                    @Override
732                    void loadStack() {
733                        if (!baseAlreadyOnStack) {
734                            loadExpressionAsObject(accessNode.getBase());
735                        }
736                        assert method.peekType().isObject();
737                    }
738                    @Override
739                    void consumeStack() {
740                        final int flags = getCallSiteFlags();
741                        dynamicGet(accessNode.getProperty(), flags, accessNode.isFunction());
742                    }
743                }.emit(baseAlreadyOnStack ? 1 : 0);
744                return false;
745            }
746
747            @Override
748            public boolean enterIndexNode(final IndexNode indexNode) {
749                new OptimisticOperation(indexNode, resultBounds) {
750                    @Override
751                    void loadStack() {
752                        if (!baseAlreadyOnStack) {
753                            loadExpressionAsObject(indexNode.getBase());
754                            loadExpressionUnbounded(indexNode.getIndex());
755                        }
756                    }
757                    @Override
758                    void consumeStack() {
759                        final int flags = getCallSiteFlags();
760                        dynamicGetIndex(flags, indexNode.isFunction());
761                    }
762                }.emit(baseAlreadyOnStack ? 2 : 0);
763                return false;
764            }
765
766            @Override
767            public boolean enterFunctionNode(final FunctionNode functionNode) {
768                // function nodes will always leave a constructed function object on stack, no need to load the symbol
769                // separately as in enterDefault()
770                lc.pop(functionNode);
771                functionNode.accept(codegen);
772                // NOTE: functionNode.accept() will produce a different FunctionNode that we discard. This incidentally
773                // doesn't cause problems as we're never touching FunctionNode again after it's visited here - codegen
774                // is the last element in the compilation pipeline, the AST it produces is not used externally. So, we
775                // re-push the original functionNode.
776                lc.push(functionNode);
777                return false;
778            }
779
780            @Override
781            public boolean enterASSIGN(final BinaryNode binaryNode) {
782                loadASSIGN(binaryNode);
783                return false;
784            }
785
786            @Override
787            public boolean enterASSIGN_ADD(final BinaryNode binaryNode) {
788                loadASSIGN_ADD(binaryNode);
789                return false;
790            }
791
792            @Override
793            public boolean enterASSIGN_BIT_AND(final BinaryNode binaryNode) {
794                loadASSIGN_BIT_AND(binaryNode);
795                return false;
796            }
797
798            @Override
799            public boolean enterASSIGN_BIT_OR(final BinaryNode binaryNode) {
800                loadASSIGN_BIT_OR(binaryNode);
801                return false;
802            }
803
804            @Override
805            public boolean enterASSIGN_BIT_XOR(final BinaryNode binaryNode) {
806                loadASSIGN_BIT_XOR(binaryNode);
807                return false;
808            }
809
810            @Override
811            public boolean enterASSIGN_DIV(final BinaryNode binaryNode) {
812                loadASSIGN_DIV(binaryNode);
813                return false;
814            }
815
816            @Override
817            public boolean enterASSIGN_MOD(final BinaryNode binaryNode) {
818                loadASSIGN_MOD(binaryNode);
819                return false;
820            }
821
822            @Override
823            public boolean enterASSIGN_MUL(final BinaryNode binaryNode) {
824                loadASSIGN_MUL(binaryNode);
825                return false;
826            }
827
828            @Override
829            public boolean enterASSIGN_SAR(final BinaryNode binaryNode) {
830                loadASSIGN_SAR(binaryNode);
831                return false;
832            }
833
834            @Override
835            public boolean enterASSIGN_SHL(final BinaryNode binaryNode) {
836                loadASSIGN_SHL(binaryNode);
837                return false;
838            }
839
840            @Override
841            public boolean enterASSIGN_SHR(final BinaryNode binaryNode) {
842                loadASSIGN_SHR(binaryNode);
843                return false;
844            }
845
846            @Override
847            public boolean enterASSIGN_SUB(final BinaryNode binaryNode) {
848                loadASSIGN_SUB(binaryNode);
849                return false;
850            }
851
852            @Override
853            public boolean enterCallNode(final CallNode callNode) {
854                return loadCallNode(callNode, resultBounds);
855            }
856
857            @Override
858            public boolean enterLiteralNode(final LiteralNode<?> literalNode) {
859                loadLiteral(literalNode, resultBounds);
860                return false;
861            }
862
863            @Override
864            public boolean enterTernaryNode(final TernaryNode ternaryNode) {
865                loadTernaryNode(ternaryNode, resultBounds);
866                return false;
867            }
868
869            @Override
870            public boolean enterADD(final BinaryNode binaryNode) {
871                loadADD(binaryNode, resultBounds);
872                return false;
873            }
874
875            @Override
876            public boolean enterSUB(final UnaryNode unaryNode) {
877                loadSUB(unaryNode, resultBounds);
878                return false;
879            }
880
881            @Override
882            public boolean enterSUB(final BinaryNode binaryNode) {
883                loadSUB(binaryNode, resultBounds);
884                return false;
885            }
886
887            @Override
888            public boolean enterMUL(final BinaryNode binaryNode) {
889                loadMUL(binaryNode, resultBounds);
890                return false;
891            }
892
893            @Override
894            public boolean enterDIV(final BinaryNode binaryNode) {
895                loadDIV(binaryNode, resultBounds);
896                return false;
897            }
898
899            @Override
900            public boolean enterMOD(final BinaryNode binaryNode) {
901                loadMOD(binaryNode, resultBounds);
902                return false;
903            }
904
905            @Override
906            public boolean enterSAR(final BinaryNode binaryNode) {
907                loadSAR(binaryNode);
908                return false;
909            }
910
911            @Override
912            public boolean enterSHL(final BinaryNode binaryNode) {
913                loadSHL(binaryNode);
914                return false;
915            }
916
917            @Override
918            public boolean enterSHR(final BinaryNode binaryNode) {
919                loadSHR(binaryNode);
920                return false;
921            }
922
923            @Override
924            public boolean enterCOMMALEFT(final BinaryNode binaryNode) {
925                loadCOMMALEFT(binaryNode, resultBounds);
926                return false;
927            }
928
929            @Override
930            public boolean enterCOMMARIGHT(final BinaryNode binaryNode) {
931                loadCOMMARIGHT(binaryNode, resultBounds);
932                return false;
933            }
934
935            @Override
936            public boolean enterAND(final BinaryNode binaryNode) {
937                loadAND_OR(binaryNode, resultBounds, true);
938                return false;
939            }
940
941            @Override
942            public boolean enterOR(final BinaryNode binaryNode) {
943                loadAND_OR(binaryNode, resultBounds, false);
944                return false;
945            }
946
947            @Override
948            public boolean enterNOT(final UnaryNode unaryNode) {
949                loadNOT(unaryNode);
950                return false;
951            }
952
953            @Override
954            public boolean enterADD(final UnaryNode unaryNode) {
955                loadADD(unaryNode, resultBounds);
956                return false;
957            }
958
959            @Override
960            public boolean enterBIT_NOT(final UnaryNode unaryNode) {
961                loadBIT_NOT(unaryNode);
962                return false;
963            }
964
965            @Override
966            public boolean enterBIT_AND(final BinaryNode binaryNode) {
967                loadBIT_AND(binaryNode);
968                return false;
969            }
970
971            @Override
972            public boolean enterBIT_OR(final BinaryNode binaryNode) {
973                loadBIT_OR(binaryNode);
974                return false;
975            }
976
977            @Override
978            public boolean enterBIT_XOR(final BinaryNode binaryNode) {
979                loadBIT_XOR(binaryNode);
980                return false;
981            }
982
983            @Override
984            public boolean enterVOID(final UnaryNode unaryNode) {
985                loadVOID(unaryNode, resultBounds);
986                return false;
987            }
988
989            @Override
990            public boolean enterEQ(final BinaryNode binaryNode) {
991                loadCmp(binaryNode, Condition.EQ);
992                return false;
993            }
994
995            @Override
996            public boolean enterEQ_STRICT(final BinaryNode binaryNode) {
997                loadCmp(binaryNode, Condition.EQ);
998                return false;
999            }
1000
1001            @Override
1002            public boolean enterGE(final BinaryNode binaryNode) {
1003                loadCmp(binaryNode, Condition.GE);
1004                return false;
1005            }
1006
1007            @Override
1008            public boolean enterGT(final BinaryNode binaryNode) {
1009                loadCmp(binaryNode, Condition.GT);
1010                return false;
1011            }
1012
1013            @Override
1014            public boolean enterLE(final BinaryNode binaryNode) {
1015                loadCmp(binaryNode, Condition.LE);
1016                return false;
1017            }
1018
1019            @Override
1020            public boolean enterLT(final BinaryNode binaryNode) {
1021                loadCmp(binaryNode, Condition.LT);
1022                return false;
1023            }
1024
1025            @Override
1026            public boolean enterNE(final BinaryNode binaryNode) {
1027                loadCmp(binaryNode, Condition.NE);
1028                return false;
1029            }
1030
1031            @Override
1032            public boolean enterNE_STRICT(final BinaryNode binaryNode) {
1033                loadCmp(binaryNode, Condition.NE);
1034                return false;
1035            }
1036
1037            @Override
1038            public boolean enterObjectNode(final ObjectNode objectNode) {
1039                loadObjectNode(objectNode);
1040                return false;
1041            }
1042
1043            @Override
1044            public boolean enterRuntimeNode(final RuntimeNode runtimeNode) {
1045                loadRuntimeNode(runtimeNode);
1046                return false;
1047            }
1048
1049            @Override
1050            public boolean enterNEW(final UnaryNode unaryNode) {
1051                loadNEW(unaryNode);
1052                return false;
1053            }
1054
1055            @Override
1056            public boolean enterDECINC(final UnaryNode unaryNode) {
1057                loadDECINC(unaryNode);
1058                return false;
1059            }
1060
1061            @Override
1062            public boolean enterJoinPredecessorExpression(final JoinPredecessorExpression joinExpr) {
1063                loadExpression(joinExpr.getExpression(), resultBounds);
1064                return false;
1065            }
1066
1067            @Override
1068            public boolean enterGetSplitState(final GetSplitState getSplitState) {
1069                method.loadScope();
1070                method.invoke(Scope.GET_SPLIT_STATE);
1071                return false;
1072            }
1073
1074            @Override
1075            public boolean enterDefault(final Node otherNode) {
1076                // Must have handled all expressions that can legally be encountered.
1077                throw new AssertionError(otherNode.getClass().getName());
1078            }
1079        });
1080        if(currentDiscard != expr) {
1081            coerceStackTop(resultBounds);
1082        }
1083        return method;
1084    }
1085
1086    private MethodEmitter coerceStackTop(final TypeBounds typeBounds) {
1087        return method.convert(typeBounds.within(method.peekType()));
1088    }
1089
1090    /**
1091     * Closes any still open entries for this block's local variables in the bytecode local variable table.
1092     *
1093     * @param block block containing symbols.
1094     */
1095    private void closeBlockVariables(final Block block) {
1096        for (final Symbol symbol : block.getSymbols()) {
1097            if (symbol.isBytecodeLocal()) {
1098                method.closeLocalVariable(symbol, block.getBreakLabel());
1099            }
1100        }
1101    }
1102
1103    @Override
1104    public boolean enterBlock(final Block block) {
1105        method.label(block.getEntryLabel());
1106        if(!method.isReachable()) {
1107            return false;
1108        }
1109        if(lc.isFunctionBody() && emittedMethods.contains(lc.getCurrentFunction().getName())) {
1110            return false;
1111        }
1112        initLocals(block);
1113
1114        assert lc.getUsedSlotCount() == method.getFirstTemp();
1115        return true;
1116    }
1117
1118    private boolean useOptimisticTypes() {
1119        return !lc.inSplitNode() && compiler.useOptimisticTypes();
1120    }
1121
1122    @Override
1123    public Node leaveBlock(final Block block) {
1124        popBlockScope(block);
1125        method.beforeJoinPoint(block);
1126
1127        closeBlockVariables(block);
1128        lc.releaseSlots();
1129        assert !method.isReachable() || (lc.isFunctionBody() ? 0 : lc.getUsedSlotCount()) == method.getFirstTemp() :
1130            "reachable="+method.isReachable() +
1131            " isFunctionBody=" + lc.isFunctionBody() +
1132            " usedSlotCount=" + lc.getUsedSlotCount() +
1133            " firstTemp=" + method.getFirstTemp();
1134
1135        return block;
1136    }
1137
1138    private void popBlockScope(final Block block) {
1139        final Label breakLabel = block.getBreakLabel();
1140
1141        if(!block.needsScope() || lc.isFunctionBody()) {
1142            emitBlockBreakLabel(breakLabel);
1143            return;
1144        }
1145
1146        final Label beginTryLabel = scopeEntryLabels.pop();
1147        final Label recoveryLabel = new Label("block_popscope_catch");
1148        emitBlockBreakLabel(breakLabel);
1149        final boolean bodyCanThrow = breakLabel.isAfter(beginTryLabel);
1150        if(bodyCanThrow) {
1151            method._try(beginTryLabel, breakLabel, recoveryLabel);
1152        }
1153
1154        Label afterCatchLabel = null;
1155
1156        if(method.isReachable()) {
1157            popScope();
1158            if(bodyCanThrow) {
1159                afterCatchLabel = new Label("block_after_catch");
1160                method._goto(afterCatchLabel);
1161            }
1162        }
1163
1164        if(bodyCanThrow) {
1165            assert !method.isReachable();
1166            method._catch(recoveryLabel);
1167            popScopeException();
1168            method.athrow();
1169        }
1170        if(afterCatchLabel != null) {
1171            method.label(afterCatchLabel);
1172        }
1173    }
1174
1175    private void emitBlockBreakLabel(final Label breakLabel) {
1176        // TODO: this is totally backwards. Block should not be breakable, LabelNode should be breakable.
1177        final LabelNode labelNode = lc.getCurrentBlockLabelNode();
1178        if(labelNode != null) {
1179            // Only have conversions if we're reachable
1180            assert labelNode.getLocalVariableConversion() == null || method.isReachable();
1181            method.beforeJoinPoint(labelNode);
1182            method.breakLabel(breakLabel, labeledBlockBreakLiveLocals.pop());
1183        } else {
1184            method.label(breakLabel);
1185        }
1186    }
1187
1188    private void popScope() {
1189        popScopes(1);
1190    }
1191
1192    /**
1193     * Pop scope as part of an exception handler. Similar to {@code popScope()} but also takes care of adjusting the
1194     * number of scopes that needs to be popped in case a rest-of continuation handler encounters an exception while
1195     * performing a ToPrimitive conversion.
1196     */
1197    private void popScopeException() {
1198        popScope();
1199        final ContinuationInfo ci = getContinuationInfo();
1200        if(ci != null) {
1201            final Label catchLabel = ci.catchLabel;
1202            if(catchLabel != METHOD_BOUNDARY && catchLabel == catchLabels.peek()) {
1203                ++ci.exceptionScopePops;
1204            }
1205        }
1206    }
1207
1208    private void popScopesUntil(final LexicalContextNode until) {
1209        popScopes(lc.getScopeNestingLevelTo(until));
1210    }
1211
1212    private void popScopes(final int count) {
1213        if(count == 0) {
1214            return;
1215        }
1216        assert count > 0; // together with count == 0 check, asserts nonnegative count
1217        if (!method.hasScope()) {
1218            // We can sometimes invoke this method even if the method has no slot for the scope object. Typical example:
1219            // for(;;) { with({}) { break; } }. WithNode normally creates a scope, but if it uses no identifiers and
1220            // nothing else forces creation of a scope in the method, we just won't have the :scope local variable.
1221            return;
1222        }
1223        method.loadCompilerConstant(SCOPE);
1224        for(int i = 0; i < count; ++i) {
1225            method.invoke(ScriptObject.GET_PROTO);
1226        }
1227        method.storeCompilerConstant(SCOPE);
1228    }
1229
1230    @Override
1231    public boolean enterBreakNode(final BreakNode breakNode) {
1232        return enterJumpStatement(breakNode);
1233    }
1234
1235    private boolean enterJumpStatement(final JumpStatement jump) {
1236        if(!method.isReachable()) {
1237            return false;
1238        }
1239        enterStatement(jump);
1240
1241        method.beforeJoinPoint(jump);
1242        final BreakableNode target = jump.getTarget(lc);
1243        popScopesUntil(target);
1244        final Label targetLabel = jump.getTargetLabel(target);
1245        targetLabel.markAsBreakTarget();
1246        method._goto(targetLabel);
1247
1248        return false;
1249    }
1250
1251    private int loadArgs(final List<Expression> args) {
1252        final int argCount = args.size();
1253        // arg have already been converted to objects here.
1254        if (argCount > LinkerCallSite.ARGLIMIT) {
1255            loadArgsArray(args);
1256            return 1;
1257        }
1258
1259        for (final Expression arg : args) {
1260            assert arg != null;
1261            loadExpressionUnbounded(arg);
1262        }
1263        return argCount;
1264    }
1265
1266    private boolean loadCallNode(final CallNode callNode, final TypeBounds resultBounds) {
1267        lineNumber(callNode.getLineNumber());
1268
1269        final List<Expression> args = callNode.getArgs();
1270        final Expression function = callNode.getFunction();
1271        final Block currentBlock = lc.getCurrentBlock();
1272        final CodeGeneratorLexicalContext codegenLexicalContext = lc;
1273
1274        function.accept(new NodeVisitor<LexicalContext>(new LexicalContext()) {
1275
1276            private MethodEmitter sharedScopeCall(final IdentNode identNode, final int flags) {
1277                final Symbol symbol = identNode.getSymbol();
1278                final boolean isFastScope = isFastScope(symbol);
1279                final int scopeCallFlags = flags | (isFastScope ? CALLSITE_FAST_SCOPE : 0);
1280                new OptimisticOperation(callNode, resultBounds) {
1281                    @Override
1282                    void loadStack() {
1283                        method.loadCompilerConstant(SCOPE);
1284                        if (isFastScope) {
1285                            method.load(getScopeProtoDepth(currentBlock, symbol));
1286                        } else {
1287                            method.load(-1); // Bypass fast-scope code in shared callsite
1288                        }
1289                        loadArgs(args);
1290                    }
1291                    @Override
1292                    void consumeStack() {
1293                        final Type[] paramTypes = method.getTypesFromStack(args.size());
1294                        // We have trouble finding e.g. in Type.typeFor(asm.Type) because it can't see the Context class
1295                        // loader, so we need to weaken reference signatures to Object.
1296                        for(int i = 0; i < paramTypes.length; ++i) {
1297                            paramTypes[i] = Type.generic(paramTypes[i]);
1298                        }
1299                        // As shared scope calls are only used in non-optimistic compilation, we switch from using
1300                        // TypeBounds to just a single definitive type, resultBounds.widest.
1301                        final SharedScopeCall scopeCall = codegenLexicalContext.getScopeCall(unit, symbol,
1302                                identNode.getType(), resultBounds.widest, paramTypes, scopeCallFlags);
1303                        scopeCall.generateInvoke(method);
1304                    }
1305                }.emit();
1306                return method;
1307            }
1308
1309            private void scopeCall(final IdentNode ident, final int flags) {
1310                new OptimisticOperation(callNode, resultBounds) {
1311                    int argsCount;
1312                    @Override
1313                    void loadStack() {
1314                        loadExpressionAsObject(ident); // foo() makes no sense if foo == 3
1315                        // ScriptFunction will see CALLSITE_SCOPE and will bind scope accordingly.
1316                        method.loadUndefined(Type.OBJECT); //the 'this'
1317                        argsCount = loadArgs(args);
1318                    }
1319                    @Override
1320                    void consumeStack() {
1321                        dynamicCall(2 + argsCount, flags);
1322                    }
1323                }.emit();
1324            }
1325
1326            private void evalCall(final IdentNode ident, final int flags) {
1327                final Label invoke_direct_eval  = new Label("invoke_direct_eval");
1328                final Label is_not_eval  = new Label("is_not_eval");
1329                final Label eval_done = new Label("eval_done");
1330
1331                new OptimisticOperation(callNode, resultBounds) {
1332                    int argsCount;
1333                    @Override
1334                    void loadStack() {
1335                        /**
1336                         * We want to load 'eval' to check if it is indeed global builtin eval.
1337                         * If this eval call is inside a 'with' statement, dyn:getMethod|getProp|getElem
1338                         * would be generated if ident is a "isFunction". But, that would result in a
1339                         * bound function from WithObject. We don't want that as bound function as that
1340                         * won't be detected as builtin eval. So, we make ident as "not a function" which
1341                         * results in "dyn:getProp|getElem|getMethod" being generated and so WithObject
1342                         * would return unbounded eval function.
1343                         *
1344                         * Example:
1345                         *
1346                         *  var global = this;
1347                         *  function func() {
1348                         *      with({ eval: global.eval) { eval("var x = 10;") }
1349                         *  }
1350                         */
1351                        loadExpressionAsObject(ident.setIsNotFunction()); // Type.OBJECT as foo() makes no sense if foo == 3
1352                        globalIsEval();
1353                        method.ifeq(is_not_eval);
1354
1355                        // Load up self (scope).
1356                        method.loadCompilerConstant(SCOPE);
1357                        final List<Expression> evalArgs = callNode.getEvalArgs().getArgs();
1358                        // load evaluated code
1359                        loadExpressionAsObject(evalArgs.get(0));
1360                        // load second and subsequent args for side-effect
1361                        final int numArgs = evalArgs.size();
1362                        for (int i = 1; i < numArgs; i++) {
1363                            loadAndDiscard(evalArgs.get(i));
1364                        }
1365                        method._goto(invoke_direct_eval);
1366
1367                        method.label(is_not_eval);
1368                        // load this time but with dyn:getMethod|getProp|getElem
1369                        loadExpressionAsObject(ident); // Type.OBJECT as foo() makes no sense if foo == 3
1370                        // This is some scope 'eval' or global eval replaced by user
1371                        // but not the built-in ECMAScript 'eval' function call
1372                        method.loadNull();
1373                        argsCount = loadArgs(callNode.getArgs());
1374                    }
1375
1376                    @Override
1377                    void consumeStack() {
1378                        // Ordinary call
1379                        dynamicCall(2 + argsCount, flags);
1380                        method._goto(eval_done);
1381
1382                        method.label(invoke_direct_eval);
1383                        // Special/extra 'eval' arguments. These can be loaded late (in consumeStack) as we know none of
1384                        // them can ever be optimistic.
1385                        method.loadCompilerConstant(THIS);
1386                        method.load(callNode.getEvalArgs().getLocation());
1387                        method.load(CodeGenerator.this.lc.getCurrentFunction().isStrict());
1388                        // direct call to Global.directEval
1389                        globalDirectEval();
1390                        convertOptimisticReturnValue();
1391                        coerceStackTop(resultBounds);
1392                    }
1393                }.emit();
1394
1395                method.label(eval_done);
1396            }
1397
1398            @Override
1399            public boolean enterIdentNode(final IdentNode node) {
1400                final Symbol symbol = node.getSymbol();
1401
1402                if (symbol.isScope()) {
1403                    final int flags = getCallSiteFlags() | CALLSITE_SCOPE;
1404                    final int useCount = symbol.getUseCount();
1405
1406                    // Threshold for generating shared scope callsite is lower for fast scope symbols because we know
1407                    // we can dial in the correct scope. However, we also need to enable it for non-fast scopes to
1408                    // support huge scripts like mandreel.js.
1409                    if (callNode.isEval()) {
1410                        evalCall(node, flags);
1411                    } else if (useCount <= SharedScopeCall.FAST_SCOPE_CALL_THRESHOLD
1412                            || !isFastScope(symbol) && useCount <= SharedScopeCall.SLOW_SCOPE_CALL_THRESHOLD
1413                            || CodeGenerator.this.lc.inDynamicScope()
1414                            || isOptimisticOrRestOf()) {
1415                        scopeCall(node, flags);
1416                    } else {
1417                        sharedScopeCall(node, flags);
1418                    }
1419                    assert method.peekType().equals(resultBounds.within(callNode.getType())) : method.peekType() + " != " + resultBounds + "(" + callNode.getType() + ")";
1420                } else {
1421                    enterDefault(node);
1422                }
1423
1424                return false;
1425            }
1426
1427            @Override
1428            public boolean enterAccessNode(final AccessNode node) {
1429                //check if this is an apply to call node. only real applies, that haven't been
1430                //shadowed from their way to the global scope counts
1431
1432                //call nodes have program points.
1433
1434                final int flags = getCallSiteFlags() | (callNode.isApplyToCall() ? CALLSITE_APPLY_TO_CALL : 0);
1435
1436                new OptimisticOperation(callNode, resultBounds) {
1437                    int argCount;
1438                    @Override
1439                    void loadStack() {
1440                        loadExpressionAsObject(node.getBase());
1441                        method.dup();
1442                        // NOTE: not using a nested OptimisticOperation on this dynamicGet, as we expect to get back
1443                        // a callable object. Nobody in their right mind would optimistically type this call site.
1444                        assert !node.isOptimistic();
1445                        method.dynamicGet(node.getType(), node.getProperty(), flags, true);
1446                        method.swap();
1447                        argCount = loadArgs(args);
1448                    }
1449                    @Override
1450                    void consumeStack() {
1451                        dynamicCall(2 + argCount, flags);
1452                    }
1453                }.emit();
1454
1455                return false;
1456            }
1457
1458            @Override
1459            public boolean enterFunctionNode(final FunctionNode origCallee) {
1460                new OptimisticOperation(callNode, resultBounds) {
1461                    FunctionNode callee;
1462                    int argsCount;
1463                    @Override
1464                    void loadStack() {
1465                        callee = (FunctionNode)origCallee.accept(CodeGenerator.this);
1466                        if (callee.isStrict()) { // "this" is undefined
1467                            method.loadUndefined(Type.OBJECT);
1468                        } else { // get global from scope (which is the self)
1469                            globalInstance();
1470                        }
1471                        argsCount = loadArgs(args);
1472                    }
1473
1474                    @Override
1475                    void consumeStack() {
1476                        final int flags = getCallSiteFlags();
1477                        //assert callNodeType.equals(callee.getReturnType()) : callNodeType + " != " + callee.getReturnType();
1478                        dynamicCall(2 + argsCount, flags);
1479                    }
1480                }.emit();
1481                return false;
1482            }
1483
1484            @Override
1485            public boolean enterIndexNode(final IndexNode node) {
1486                new OptimisticOperation(callNode, resultBounds) {
1487                    int argsCount;
1488                    @Override
1489                    void loadStack() {
1490                        loadExpressionAsObject(node.getBase());
1491                        method.dup();
1492                        final Type indexType = node.getIndex().getType();
1493                        if (indexType.isObject() || indexType.isBoolean()) {
1494                            loadExpressionAsObject(node.getIndex()); //TODO boolean
1495                        } else {
1496                            loadExpressionUnbounded(node.getIndex());
1497                        }
1498                        // NOTE: not using a nested OptimisticOperation on this dynamicGetIndex, as we expect to get
1499                        // back a callable object. Nobody in their right mind would optimistically type this call site.
1500                        assert !node.isOptimistic();
1501                        method.dynamicGetIndex(node.getType(), getCallSiteFlags(), true);
1502                        method.swap();
1503                        argsCount = loadArgs(args);
1504                    }
1505                    @Override
1506                    void consumeStack() {
1507                        final int flags = getCallSiteFlags();
1508                        dynamicCall(2 + argsCount, flags);
1509                    }
1510                }.emit();
1511                return false;
1512            }
1513
1514            @Override
1515            protected boolean enterDefault(final Node node) {
1516                new OptimisticOperation(callNode, resultBounds) {
1517                    int argsCount;
1518                    @Override
1519                    void loadStack() {
1520                        // Load up function.
1521                        loadExpressionAsObject(function); //TODO, e.g. booleans can be used as functions
1522                        method.loadUndefined(Type.OBJECT); // ScriptFunction will figure out the correct this when it sees CALLSITE_SCOPE
1523                        argsCount = loadArgs(args);
1524                        }
1525                        @Override
1526                        void consumeStack() {
1527                            final int flags = getCallSiteFlags() | CALLSITE_SCOPE;
1528                            dynamicCall(2 + argsCount, flags);
1529                        }
1530                }.emit();
1531                return false;
1532            }
1533        });
1534
1535        return false;
1536    }
1537
1538    /**
1539     * Returns the flags with optimistic flag and program point removed.
1540     * @param flags the flags that need optimism stripped from them.
1541     * @return flags without optimism
1542     */
1543    static int nonOptimisticFlags(final int flags) {
1544        return flags & ~(CALLSITE_OPTIMISTIC | -1 << CALLSITE_PROGRAM_POINT_SHIFT);
1545    }
1546
1547    @Override
1548    public boolean enterContinueNode(final ContinueNode continueNode) {
1549        return enterJumpStatement(continueNode);
1550    }
1551
1552    @Override
1553    public boolean enterEmptyNode(final EmptyNode emptyNode) {
1554        if(!method.isReachable()) {
1555            return false;
1556        }
1557        enterStatement(emptyNode);
1558
1559        return false;
1560    }
1561
1562    @Override
1563    public boolean enterExpressionStatement(final ExpressionStatement expressionStatement) {
1564        if(!method.isReachable()) {
1565            return false;
1566        }
1567        enterStatement(expressionStatement);
1568
1569        loadAndDiscard(expressionStatement.getExpression());
1570        assert method.getStackSize() == 0;
1571
1572        return false;
1573    }
1574
1575    @Override
1576    public boolean enterBlockStatement(final BlockStatement blockStatement) {
1577        if(!method.isReachable()) {
1578            return false;
1579        }
1580        enterStatement(blockStatement);
1581
1582        blockStatement.getBlock().accept(this);
1583
1584        return false;
1585    }
1586
1587    @Override
1588    public boolean enterForNode(final ForNode forNode) {
1589        if(!method.isReachable()) {
1590            return false;
1591        }
1592        enterStatement(forNode);
1593        if (forNode.isForIn()) {
1594            enterForIn(forNode);
1595        } else {
1596            final Expression init = forNode.getInit();
1597            if (init != null) {
1598                loadAndDiscard(init);
1599            }
1600            enterForOrWhile(forNode, forNode.getModify());
1601        }
1602
1603        return false;
1604    }
1605
1606    private void enterForIn(final ForNode forNode) {
1607        loadExpression(forNode.getModify(), TypeBounds.OBJECT);
1608        method.invoke(forNode.isForEach() ? ScriptRuntime.TO_VALUE_ITERATOR : ScriptRuntime.TO_PROPERTY_ITERATOR);
1609        final Symbol iterSymbol = forNode.getIterator();
1610        final int iterSlot = iterSymbol.getSlot(Type.OBJECT);
1611        method.store(iterSymbol, ITERATOR_TYPE);
1612
1613        method.beforeJoinPoint(forNode);
1614
1615        final Label continueLabel = forNode.getContinueLabel();
1616        final Label breakLabel    = forNode.getBreakLabel();
1617
1618        method.label(continueLabel);
1619        method.load(ITERATOR_TYPE, iterSlot);
1620        method.invoke(interfaceCallNoLookup(ITERATOR_CLASS, "hasNext", boolean.class));
1621        final JoinPredecessorExpression test = forNode.getTest();
1622        final Block body = forNode.getBody();
1623        if(LocalVariableConversion.hasLiveConversion(test)) {
1624            final Label afterConversion = new Label("for_in_after_test_conv");
1625            method.ifne(afterConversion);
1626            method.beforeJoinPoint(test);
1627            method._goto(breakLabel);
1628            method.label(afterConversion);
1629        } else {
1630            method.ifeq(breakLabel);
1631        }
1632
1633        new Store<Expression>(forNode.getInit()) {
1634            @Override
1635            protected void storeNonDiscard() {
1636                // This expression is neither part of a discard, nor needs to be left on the stack after it was
1637                // stored, so we override storeNonDiscard to be a no-op.
1638            }
1639
1640            @Override
1641            protected void evaluate() {
1642                new OptimisticOperation((Optimistic)forNode.getInit(), TypeBounds.UNBOUNDED) {
1643                    @Override
1644                    void loadStack() {
1645                        method.load(ITERATOR_TYPE, iterSlot);
1646                    }
1647
1648                    @Override
1649                    void consumeStack() {
1650                        method.invoke(interfaceCallNoLookup(ITERATOR_CLASS, "next", Object.class));
1651                        convertOptimisticReturnValue();
1652                    }
1653                }.emit();
1654            }
1655        }.store();
1656        body.accept(this);
1657
1658        if(method.isReachable()) {
1659            method._goto(continueLabel);
1660        }
1661        method.label(breakLabel);
1662    }
1663
1664    /**
1665     * Initialize the slots in a frame to undefined.
1666     *
1667     * @param block block with local vars.
1668     */
1669    private void initLocals(final Block block) {
1670        lc.onEnterBlock(block);
1671
1672        final boolean isFunctionBody = lc.isFunctionBody();
1673        final FunctionNode function = lc.getCurrentFunction();
1674        if (isFunctionBody) {
1675            initializeMethodParameters(function);
1676            if(!function.isVarArg()) {
1677                expandParameterSlots(function);
1678            }
1679            if (method.hasScope()) {
1680                if (function.needsParentScope()) {
1681                    method.loadCompilerConstant(CALLEE);
1682                    method.invoke(ScriptFunction.GET_SCOPE);
1683                } else {
1684                    assert function.hasScopeBlock();
1685                    method.loadNull();
1686                }
1687                method.storeCompilerConstant(SCOPE);
1688            }
1689            if (function.needsArguments()) {
1690                initArguments(function);
1691            }
1692        }
1693
1694        /*
1695         * Determine if block needs scope, if not, just do initSymbols for this block.
1696         */
1697        if (block.needsScope()) {
1698            /*
1699             * Determine if function is varargs and consequently variables have to
1700             * be in the scope.
1701             */
1702            final boolean varsInScope = function.allVarsInScope();
1703
1704            // TODO for LET we can do better: if *block* does not contain any eval/with, we don't need its vars in scope.
1705
1706            final boolean hasArguments = function.needsArguments();
1707            final List<MapTuple<Symbol>> tuples = new ArrayList<>();
1708            final Iterator<IdentNode> paramIter = function.getParameters().iterator();
1709            for (final Symbol symbol : block.getSymbols()) {
1710                if (symbol.isInternal() || symbol.isThis()) {
1711                    continue;
1712                }
1713
1714                if (symbol.isVar()) {
1715                    assert !varsInScope || symbol.isScope();
1716                    if (varsInScope || symbol.isScope()) {
1717                        assert symbol.isScope()   : "scope for " + symbol + " should have been set in Lower already " + function.getName();
1718                        assert !symbol.hasSlot()  : "slot for " + symbol + " should have been removed in Lower already" + function.getName();
1719
1720                        //this tuple will not be put fielded, as it has no value, just a symbol
1721                        tuples.add(new MapTuple<Symbol>(symbol.getName(), symbol, null));
1722                    } else {
1723                        assert symbol.hasSlot() || symbol.slotCount() == 0 : symbol + " should have a slot only, no scope";
1724                    }
1725                } else if (symbol.isParam() && (varsInScope || hasArguments || symbol.isScope())) {
1726                    assert symbol.isScope()   : "scope for " + symbol + " should have been set in AssignSymbols already " + function.getName() + " varsInScope="+varsInScope+" hasArguments="+hasArguments+" symbol.isScope()=" + symbol.isScope();
1727                    assert !(hasArguments && symbol.hasSlot())  : "slot for " + symbol + " should have been removed in Lower already " + function.getName();
1728
1729                    final Type   paramType;
1730                    final Symbol paramSymbol;
1731
1732                    if (hasArguments) {
1733                        assert !symbol.hasSlot()  : "slot for " + symbol + " should have been removed in Lower already ";
1734                        paramSymbol = null;
1735                        paramType   = null;
1736                    } else {
1737                        paramSymbol = symbol;
1738                        // NOTE: We're relying on the fact here that Block.symbols is a LinkedHashMap, hence it will
1739                        // return symbols in the order they were defined, and parameters are defined in the same order
1740                        // they appear in the function. That's why we can have a single pass over the parameter list
1741                        // with an iterator, always just scanning forward for the next parameter that matches the symbol
1742                        // name.
1743                        for(;;) {
1744                            final IdentNode nextParam = paramIter.next();
1745                            if(nextParam.getName().equals(symbol.getName())) {
1746                                paramType = nextParam.getType();
1747                                break;
1748                            }
1749                        }
1750                    }
1751
1752                    tuples.add(new MapTuple<Symbol>(symbol.getName(), symbol, paramType, paramSymbol) {
1753                        //this symbol will be put fielded, we can't initialize it as undefined with a known type
1754                        @Override
1755                        public Class<?> getValueType() {
1756                            if (OBJECT_FIELDS_ONLY || value == null || paramType == null) {
1757                                return Object.class;
1758                            }
1759                            return paramType.isBoolean() ? Object.class : paramType.getTypeClass();
1760                        }
1761                    });
1762                }
1763            }
1764
1765            /*
1766             * Create a new object based on the symbols and values, generate
1767             * bootstrap code for object
1768             */
1769            new FieldObjectCreator<Symbol>(this, tuples, true, hasArguments) {
1770                @Override
1771                protected void loadValue(final Symbol value, final Type type) {
1772                    method.load(value, type);
1773                }
1774            }.makeObject(method);
1775            // program function: merge scope into global
1776            if (isFunctionBody && function.isProgram()) {
1777                method.invoke(ScriptRuntime.MERGE_SCOPE);
1778            }
1779
1780            method.storeCompilerConstant(SCOPE);
1781            if(!isFunctionBody) {
1782                // Function body doesn't need a try/catch to restore scope, as it'd be a dead store anyway. Allowing it
1783                // actually causes issues with UnwarrantedOptimismException handlers as ASM will sort this handler to
1784                // the top of the exception handler table, so it'll be triggered instead of the UOE handlers.
1785                final Label scopeEntryLabel = new Label("scope_entry");
1786                scopeEntryLabels.push(scopeEntryLabel);
1787                method.label(scopeEntryLabel);
1788            }
1789        } else if (isFunctionBody && function.isVarArg()) {
1790            // Since we don't have a scope, parameters didn't get assigned array indices by the FieldObjectCreator, so
1791            // we need to assign them separately here.
1792            int nextParam = 0;
1793            for (final IdentNode param : function.getParameters()) {
1794                param.getSymbol().setFieldIndex(nextParam++);
1795            }
1796        }
1797
1798        // Debugging: print symbols? @see --print-symbols flag
1799        printSymbols(block, function, (isFunctionBody ? "Function " : "Block in ") + (function.getIdent() == null ? "<anonymous>" : function.getIdent().getName()));
1800    }
1801
1802    /**
1803     * Incoming method parameters are always declared on method entry; declare them in the local variable table.
1804     * @param function function for which code is being generated.
1805     */
1806    private void initializeMethodParameters(final FunctionNode function) {
1807        final Label functionStart = new Label("fn_start");
1808        method.label(functionStart);
1809        int nextSlot = 0;
1810        if(function.needsCallee()) {
1811            initializeInternalFunctionParameter(CALLEE, function, functionStart, nextSlot++);
1812        }
1813        initializeInternalFunctionParameter(THIS, function, functionStart, nextSlot++);
1814        if(function.isVarArg()) {
1815            initializeInternalFunctionParameter(VARARGS, function, functionStart, nextSlot++);
1816        } else {
1817            for(final IdentNode param: function.getParameters()) {
1818                final Symbol symbol = param.getSymbol();
1819                if(symbol.isBytecodeLocal()) {
1820                    method.initializeMethodParameter(symbol, param.getType(), functionStart);
1821                }
1822            }
1823        }
1824    }
1825
1826    private void initializeInternalFunctionParameter(final CompilerConstants cc, final FunctionNode fn, final Label functionStart, final int slot) {
1827        final Symbol symbol = initializeInternalFunctionOrSplitParameter(cc, fn, functionStart, slot);
1828        // Internal function params (:callee, this, and :varargs) are never expanded to multiple slots
1829        assert symbol.getFirstSlot() == slot;
1830    }
1831
1832    private Symbol initializeInternalFunctionOrSplitParameter(final CompilerConstants cc, final FunctionNode fn, final Label functionStart, final int slot) {
1833        final Symbol symbol = fn.getBody().getExistingSymbol(cc.symbolName());
1834        final Type type = Type.typeFor(cc.type());
1835        method.initializeMethodParameter(symbol, type, functionStart);
1836        method.onLocalStore(type, slot);
1837        return symbol;
1838    }
1839
1840    /**
1841     * Parameters come into the method packed into local variable slots next to each other. Nashorn on the other hand
1842     * can use 1-6 slots for a local variable depending on all the types it needs to store. When this method is invoked,
1843     * the symbols are already allocated such wider slots, but the values are still in tightly packed incoming slots,
1844     * and we need to spread them into their new locations.
1845     * @param function the function for which parameter-spreading code needs to be emitted
1846     */
1847    private void expandParameterSlots(final FunctionNode function) {
1848        final List<IdentNode> parameters = function.getParameters();
1849        // Calculate the total number of incoming parameter slots
1850        int currentIncomingSlot = function.needsCallee() ? 2 : 1;
1851        for(final IdentNode parameter: parameters) {
1852            currentIncomingSlot += parameter.getType().getSlots();
1853        }
1854        // Starting from last parameter going backwards, move the parameter values into their new slots.
1855        for(int i = parameters.size(); i-- > 0;) {
1856            final IdentNode parameter = parameters.get(i);
1857            final Type parameterType = parameter.getType();
1858            final int typeWidth = parameterType.getSlots();
1859            currentIncomingSlot -= typeWidth;
1860            final Symbol symbol = parameter.getSymbol();
1861            final int slotCount = symbol.slotCount();
1862            assert slotCount > 0;
1863            // Scoped parameters must not hold more than one value
1864            assert symbol.isBytecodeLocal() || slotCount == typeWidth;
1865
1866            // Mark it as having its value stored into it by the method invocation.
1867            method.onLocalStore(parameterType, currentIncomingSlot);
1868            if(currentIncomingSlot != symbol.getSlot(parameterType)) {
1869                method.load(parameterType, currentIncomingSlot);
1870                method.store(symbol, parameterType);
1871            }
1872        }
1873    }
1874
1875    private void initArguments(final FunctionNode function) {
1876        method.loadCompilerConstant(VARARGS);
1877        if (function.needsCallee()) {
1878            method.loadCompilerConstant(CALLEE);
1879        } else {
1880            // If function is strict mode, "arguments.callee" is not populated, so we don't necessarily need the
1881            // caller.
1882            assert function.isStrict();
1883            method.loadNull();
1884        }
1885        method.load(function.getParameters().size());
1886        globalAllocateArguments();
1887        method.storeCompilerConstant(ARGUMENTS);
1888    }
1889
1890    private boolean skipFunction(final FunctionNode functionNode) {
1891        final ScriptEnvironment env = compiler.getScriptEnvironment();
1892        final boolean lazy = env._lazy_compilation;
1893        final boolean onDemand = compiler.isOnDemandCompilation();
1894
1895        // If this is on-demand or lazy compilation, don't compile a nested (not topmost) function.
1896        if((onDemand || lazy) && lc.getOutermostFunction() != functionNode) {
1897            return true;
1898        }
1899
1900        // If lazy compiling with optimistic types, don't compile the program eagerly either. It will soon be
1901        // invalidated anyway. In presence of a class cache, this further means that an obsoleted program version
1902        // lingers around. Also, currently loading previously persisted optimistic types information only works if
1903        // we're on-demand compiling a function, so with this strategy the :program method can also have the warmup
1904        // benefit of using previously persisted types.
1905        //
1906        // NOTE that this means the first compiled class will effectively just have a :createProgramFunction method, and
1907        // the RecompilableScriptFunctionData (RSFD) object in its constants array. It won't even have the :program
1908        // method. This is by design. It does mean that we're wasting one compiler execution (and we could minimize this
1909        // by just running it up to scope depth calculation, which creates the RSFDs and then this limited codegen).
1910        // We could emit an initial separate compile unit with the initial version of :program in it to better utilize
1911        // the compilation pipeline, but that would need more invasive changes, as currently the assumption that
1912        // :program is emitted into the first compilation unit of the function lives in many places.
1913        return !onDemand && lazy && env._optimistic_types && functionNode.isProgram();
1914    }
1915
1916    @Override
1917    public boolean enterFunctionNode(final FunctionNode functionNode) {
1918        final int fnId = functionNode.getId();
1919
1920        if (skipFunction(functionNode)) {
1921            // In case we are not generating code for the function, we must create or retrieve the function object and
1922            // load it on the stack here.
1923            newFunctionObject(functionNode, false);
1924            return false;
1925        }
1926
1927        final String fnName = functionNode.getName();
1928
1929        // NOTE: we only emit the method for a function with the given name once. We can have multiple functions with
1930        // the same name as a result of inlining finally blocks. However, in the future -- with type specialization,
1931        // notably -- we might need to check for both name *and* signature. Of course, even that might not be
1932        // sufficient; the function might have a code dependency on the type of the variables in its enclosing scopes,
1933        // and the type of such a variable can be different in catch and finally blocks. So, in the future we will have
1934        // to decide to either generate a unique method for each inlined copy of the function, maybe figure out its
1935        // exact type closure and deduplicate based on that, or just decide that functions in finally blocks aren't
1936        // worth it, and generate one method with most generic type closure.
1937        if (!emittedMethods.contains(fnName)) {
1938            log.info("=== BEGIN ", fnName);
1939
1940            assert functionNode.getCompileUnit() != null : "no compile unit for " + fnName + " " + Debug.id(functionNode);
1941            unit = lc.pushCompileUnit(functionNode.getCompileUnit());
1942            assert lc.hasCompileUnits();
1943
1944            final ClassEmitter classEmitter = unit.getClassEmitter();
1945            pushMethodEmitter(isRestOf() ? classEmitter.restOfMethod(functionNode) : classEmitter.method(functionNode));
1946            method.setPreventUndefinedLoad();
1947            if(useOptimisticTypes()) {
1948                lc.pushUnwarrantedOptimismHandlers();
1949            }
1950
1951            // new method - reset last line number
1952            lastLineNumber = -1;
1953
1954            method.begin();
1955
1956            if (isRestOf()) {
1957                final ContinuationInfo ci = new ContinuationInfo();
1958                fnIdToContinuationInfo.put(fnId, ci);
1959                method.gotoLoopStart(ci.getHandlerLabel());
1960            }
1961        }
1962
1963        return true;
1964    }
1965
1966    private void pushMethodEmitter(final MethodEmitter newMethod) {
1967        method = lc.pushMethodEmitter(newMethod);
1968        catchLabels.push(METHOD_BOUNDARY);
1969    }
1970
1971    private void popMethodEmitter() {
1972        method = lc.popMethodEmitter(method);
1973        assert catchLabels.peek() == METHOD_BOUNDARY;
1974        catchLabels.pop();
1975    }
1976
1977    @Override
1978    public Node leaveFunctionNode(final FunctionNode functionNode) {
1979        try {
1980            final boolean markOptimistic;
1981            if (emittedMethods.add(functionNode.getName())) {
1982                markOptimistic = generateUnwarrantedOptimismExceptionHandlers(functionNode);
1983                generateContinuationHandler();
1984                method.end(); // wrap up this method
1985                unit   = lc.popCompileUnit(functionNode.getCompileUnit());
1986                popMethodEmitter();
1987                log.info("=== END ", functionNode.getName());
1988            } else {
1989                markOptimistic = false;
1990            }
1991
1992            FunctionNode newFunctionNode = functionNode.setState(lc, CompilationState.BYTECODE_GENERATED);
1993            if (markOptimistic) {
1994                newFunctionNode = newFunctionNode.setFlag(lc, FunctionNode.IS_DEOPTIMIZABLE);
1995            }
1996
1997            newFunctionObject(newFunctionNode, true);
1998            return newFunctionNode;
1999        } catch (final Throwable t) {
2000            Context.printStackTrace(t);
2001            final VerifyError e = new VerifyError("Code generation bug in \"" + functionNode.getName() + "\": likely stack misaligned: " + t + " " + functionNode.getSource().getName());
2002            e.initCause(t);
2003            throw e;
2004        }
2005    }
2006
2007    @Override
2008    public boolean enterIfNode(final IfNode ifNode) {
2009        if(!method.isReachable()) {
2010            return false;
2011        }
2012        enterStatement(ifNode);
2013
2014        final Expression test = ifNode.getTest();
2015        final Block pass = ifNode.getPass();
2016        final Block fail = ifNode.getFail();
2017        final boolean hasFailConversion = LocalVariableConversion.hasLiveConversion(ifNode);
2018
2019        final Label failLabel  = new Label("if_fail");
2020        final Label afterLabel = (fail == null && !hasFailConversion) ? null : new Label("if_done");
2021
2022        emitBranch(test, failLabel, false);
2023
2024        pass.accept(this);
2025        if(method.isReachable() && afterLabel != null) {
2026            method._goto(afterLabel); //don't fallthru to fail block
2027        }
2028        method.label(failLabel);
2029
2030        if (fail != null) {
2031            fail.accept(this);
2032        } else if(hasFailConversion) {
2033            method.beforeJoinPoint(ifNode);
2034        }
2035
2036        if(afterLabel != null) {
2037            method.label(afterLabel);
2038        }
2039
2040        return false;
2041    }
2042
2043    private void emitBranch(final Expression test, final Label label, final boolean jumpWhenTrue) {
2044        new BranchOptimizer(this, method).execute(test, label, jumpWhenTrue);
2045    }
2046
2047    private void enterStatement(final Statement statement) {
2048        lineNumber(statement);
2049    }
2050
2051    private void lineNumber(final Statement statement) {
2052        lineNumber(statement.getLineNumber());
2053    }
2054
2055    private void lineNumber(final int lineNumber) {
2056        if (lineNumber != lastLineNumber && lineNumber != Node.NO_LINE_NUMBER) {
2057            method.lineNumber(lineNumber);
2058            lastLineNumber = lineNumber;
2059        }
2060    }
2061
2062    int getLastLineNumber() {
2063        return lastLineNumber;
2064    }
2065
2066    /**
2067     * Load a list of nodes as an array of a specific type
2068     * The array will contain the visited nodes.
2069     *
2070     * @param arrayLiteralNode the array of contents
2071     * @param arrayType        the type of the array, e.g. ARRAY_NUMBER or ARRAY_OBJECT
2072     *
2073     * @return the method generator that was used
2074     */
2075    private MethodEmitter loadArray(final ArrayLiteralNode arrayLiteralNode, final ArrayType arrayType) {
2076        assert arrayType == Type.INT_ARRAY || arrayType == Type.LONG_ARRAY || arrayType == Type.NUMBER_ARRAY || arrayType == Type.OBJECT_ARRAY;
2077
2078        final Expression[]    nodes    = arrayLiteralNode.getValue();
2079        final Object          presets  = arrayLiteralNode.getPresets();
2080        final int[]           postsets = arrayLiteralNode.getPostsets();
2081        final Class<?>        type     = arrayType.getTypeClass();
2082        final List<ArrayUnit> units    = arrayLiteralNode.getUnits();
2083
2084        loadConstant(presets);
2085
2086        final Type elementType = arrayType.getElementType();
2087
2088        if (units != null) {
2089            final MethodEmitter savedMethod     = method;
2090            final FunctionNode  currentFunction = lc.getCurrentFunction();
2091
2092            for (final ArrayUnit arrayUnit : units) {
2093                unit = lc.pushCompileUnit(arrayUnit.getCompileUnit());
2094
2095                final String className = unit.getUnitClassName();
2096                assert unit != null;
2097                final String name      = currentFunction.uniqueName(SPLIT_PREFIX.symbolName());
2098                final String signature = methodDescriptor(type, ScriptFunction.class, Object.class, ScriptObject.class, type);
2099
2100                pushMethodEmitter(unit.getClassEmitter().method(EnumSet.of(Flag.PUBLIC, Flag.STATIC), name, signature));
2101
2102                method.setFunctionNode(currentFunction);
2103                method.begin();
2104
2105                defineCommonSplitMethodParameters();
2106                defineSplitMethodParameter(CompilerConstants.SPLIT_ARRAY_ARG.slot(), arrayType);
2107
2108                // NOTE: when this is no longer needed, SplitIntoFunctions will no longer have to add IS_SPLIT
2109                // to synthetic functions, and FunctionNode.needsCallee() will no longer need to test for isSplit().
2110                final int arraySlot = fixScopeSlot(currentFunction, 3);
2111
2112                lc.enterSplitNode();
2113
2114                for (int i = arrayUnit.getLo(); i < arrayUnit.getHi(); i++) {
2115                    method.load(arrayType, arraySlot);
2116                    storeElement(nodes, elementType, postsets[i]);
2117                }
2118
2119                method.load(arrayType, arraySlot);
2120                method._return();
2121                lc.exitSplitNode();
2122                method.end();
2123                lc.releaseSlots();
2124                popMethodEmitter();
2125
2126                assert method == savedMethod;
2127                method.loadCompilerConstant(CALLEE);
2128                method.swap();
2129                method.loadCompilerConstant(THIS);
2130                method.swap();
2131                method.loadCompilerConstant(SCOPE);
2132                method.swap();
2133                method.invokestatic(className, name, signature);
2134
2135                unit = lc.popCompileUnit(unit);
2136            }
2137
2138            return method;
2139        }
2140
2141        if(postsets.length > 0) {
2142            final int arraySlot = method.getUsedSlotsWithLiveTemporaries();
2143            method.storeTemp(arrayType, arraySlot);
2144            for (final int postset : postsets) {
2145                method.load(arrayType, arraySlot);
2146                storeElement(nodes, elementType, postset);
2147            }
2148            method.load(arrayType, arraySlot);
2149        }
2150        return method;
2151    }
2152
2153    private void storeElement(final Expression[] nodes, final Type elementType, final int index) {
2154        method.load(index);
2155
2156        final Expression element = nodes[index];
2157
2158        if (element == null) {
2159            method.loadEmpty(elementType);
2160        } else {
2161            loadExpressionAsType(element, elementType);
2162        }
2163
2164        method.arraystore();
2165    }
2166
2167    private MethodEmitter loadArgsArray(final List<Expression> args) {
2168        final Object[] array = new Object[args.size()];
2169        loadConstant(array);
2170
2171        for (int i = 0; i < args.size(); i++) {
2172            method.dup();
2173            method.load(i);
2174            loadExpression(args.get(i), TypeBounds.OBJECT); // variable arity methods always take objects
2175            method.arraystore();
2176        }
2177
2178        return method;
2179    }
2180
2181    /**
2182     * Load a constant from the constant array. This is only public to be callable from the objects
2183     * subpackage. Do not call directly.
2184     *
2185     * @param string string to load
2186     */
2187    void loadConstant(final String string) {
2188        final String       unitClassName = unit.getUnitClassName();
2189        final ClassEmitter classEmitter  = unit.getClassEmitter();
2190        final int          index         = compiler.getConstantData().add(string);
2191
2192        method.load(index);
2193        method.invokestatic(unitClassName, GET_STRING.symbolName(), methodDescriptor(String.class, int.class));
2194        classEmitter.needGetConstantMethod(String.class);
2195    }
2196
2197    /**
2198     * Load a constant from the constant array. This is only public to be callable from the objects
2199     * subpackage. Do not call directly.
2200     *
2201     * @param object object to load
2202     */
2203    void loadConstant(final Object object) {
2204        loadConstant(object, unit, method);
2205    }
2206
2207    private void loadConstant(final Object object, final CompileUnit compileUnit, final MethodEmitter methodEmitter) {
2208        final String       unitClassName = compileUnit.getUnitClassName();
2209        final ClassEmitter classEmitter  = compileUnit.getClassEmitter();
2210        final int          index         = compiler.getConstantData().add(object);
2211        final Class<?>     cls           = object.getClass();
2212
2213        if (cls == PropertyMap.class) {
2214            methodEmitter.load(index);
2215            methodEmitter.invokestatic(unitClassName, GET_MAP.symbolName(), methodDescriptor(PropertyMap.class, int.class));
2216            classEmitter.needGetConstantMethod(PropertyMap.class);
2217        } else if (cls.isArray()) {
2218            methodEmitter.load(index);
2219            final String methodName = ClassEmitter.getArrayMethodName(cls);
2220            methodEmitter.invokestatic(unitClassName, methodName, methodDescriptor(cls, int.class));
2221            classEmitter.needGetConstantMethod(cls);
2222        } else {
2223            methodEmitter.loadConstants().load(index).arrayload();
2224            if (object instanceof ArrayData) {
2225                // avoid cast to non-public ArrayData subclass
2226                methodEmitter.checkcast(ArrayData.class);
2227                methodEmitter.invoke(virtualCallNoLookup(ArrayData.class, "copy", ArrayData.class));
2228            } else if (cls != Object.class) {
2229                methodEmitter.checkcast(cls);
2230            }
2231        }
2232    }
2233
2234    // literal values
2235    private void loadLiteral(final LiteralNode<?> node, final TypeBounds resultBounds) {
2236        final Object value = node.getValue();
2237
2238        if (value == null) {
2239            method.loadNull();
2240        } else if (value instanceof Undefined) {
2241            method.loadUndefined(resultBounds.within(Type.OBJECT));
2242        } else if (value instanceof String) {
2243            final String string = (String)value;
2244
2245            if (string.length() > MethodEmitter.LARGE_STRING_THRESHOLD / 3) { // 3 == max bytes per encoded char
2246                loadConstant(string);
2247            } else {
2248                method.load(string);
2249            }
2250        } else if (value instanceof RegexToken) {
2251            loadRegex((RegexToken)value);
2252        } else if (value instanceof Boolean) {
2253            method.load((Boolean)value);
2254        } else if (value instanceof Integer) {
2255            if(!resultBounds.canBeNarrowerThan(Type.OBJECT)) {
2256                method.load((Integer)value);
2257                method.convert(Type.OBJECT);
2258            } else if(!resultBounds.canBeNarrowerThan(Type.NUMBER)) {
2259                method.load(((Integer)value).doubleValue());
2260            } else if(!resultBounds.canBeNarrowerThan(Type.LONG)) {
2261                method.load(((Integer)value).longValue());
2262            } else {
2263                method.load((Integer)value);
2264            }
2265        } else if (value instanceof Long) {
2266            if(!resultBounds.canBeNarrowerThan(Type.OBJECT)) {
2267                method.load((Long)value);
2268                method.convert(Type.OBJECT);
2269            } else if(!resultBounds.canBeNarrowerThan(Type.NUMBER)) {
2270                method.load(((Long)value).doubleValue());
2271            } else {
2272                method.load((Long)value);
2273            }
2274        } else if (value instanceof Double) {
2275            if(!resultBounds.canBeNarrowerThan(Type.OBJECT)) {
2276                method.load((Double)value);
2277                method.convert(Type.OBJECT);
2278            } else {
2279                method.load((Double)value);
2280            }
2281        } else if (node instanceof ArrayLiteralNode) {
2282            final ArrayLiteralNode arrayLiteral = (ArrayLiteralNode)node;
2283            final ArrayType atype = arrayLiteral.getArrayType();
2284            loadArray(arrayLiteral, atype);
2285            globalAllocateArray(atype);
2286        } else {
2287            throw new UnsupportedOperationException("Unknown literal for " + node.getClass() + " " + value.getClass() + " " + value);
2288        }
2289    }
2290
2291    private MethodEmitter loadRegexToken(final RegexToken value) {
2292        method.load(value.getExpression());
2293        method.load(value.getOptions());
2294        return globalNewRegExp();
2295    }
2296
2297    private MethodEmitter loadRegex(final RegexToken regexToken) {
2298        if (regexFieldCount > MAX_REGEX_FIELDS) {
2299            return loadRegexToken(regexToken);
2300        }
2301        // emit field
2302        final String       regexName    = lc.getCurrentFunction().uniqueName(REGEX_PREFIX.symbolName());
2303        final ClassEmitter classEmitter = unit.getClassEmitter();
2304
2305        classEmitter.field(EnumSet.of(PRIVATE, STATIC), regexName, Object.class);
2306        regexFieldCount++;
2307
2308        // get field, if null create new regex, finally clone regex object
2309        method.getStatic(unit.getUnitClassName(), regexName, typeDescriptor(Object.class));
2310        method.dup();
2311        final Label cachedLabel = new Label("cached");
2312        method.ifnonnull(cachedLabel);
2313
2314        method.pop();
2315        loadRegexToken(regexToken);
2316        method.dup();
2317        method.putStatic(unit.getUnitClassName(), regexName, typeDescriptor(Object.class));
2318
2319        method.label(cachedLabel);
2320        globalRegExpCopy();
2321
2322        return method;
2323    }
2324
2325    /**
2326     * Check if a property value contains a particular program point
2327     * @param value value
2328     * @param pp    program point
2329     * @return true if it's there.
2330     */
2331    private static boolean propertyValueContains(final Expression value, final int pp) {
2332        return new Supplier<Boolean>() {
2333            boolean contains;
2334
2335            @Override
2336            public Boolean get() {
2337                value.accept(new NodeVisitor<LexicalContext>(new LexicalContext()) {
2338                    @Override
2339                    public boolean enterFunctionNode(final FunctionNode functionNode) {
2340                        return false;
2341                    }
2342
2343                    @Override
2344                    public boolean enterObjectNode(final ObjectNode objectNode) {
2345                        return false;
2346                    }
2347
2348                    @Override
2349                    public boolean enterDefault(final Node node) {
2350                        if (contains) {
2351                            return false;
2352                        }
2353                        if (node instanceof Optimistic && ((Optimistic)node).getProgramPoint() == pp) {
2354                            contains = true;
2355                            return false;
2356                        }
2357                        return true;
2358                    }
2359                });
2360
2361                return contains;
2362            }
2363        }.get();
2364    }
2365
2366    private void loadObjectNode(final ObjectNode objectNode) {
2367        final List<PropertyNode> elements = objectNode.getElements();
2368
2369        final List<MapTuple<Expression>> tuples = new ArrayList<>();
2370        final List<PropertyNode> gettersSetters = new ArrayList<>();
2371        final int ccp = getCurrentContinuationEntryPoint();
2372
2373        Expression protoNode = null;
2374        boolean restOfProperty = false;
2375
2376        for (final PropertyNode propertyNode : elements) {
2377            final Expression value = propertyNode.getValue();
2378            final String key = propertyNode.getKeyName();
2379            // Just use a pseudo-symbol. We just need something non null; use the name and zero flags.
2380            final Symbol symbol = value == null ? null : new Symbol(key, 0);
2381
2382            if (value == null) {
2383                gettersSetters.add(propertyNode);
2384            } else if (propertyNode.getKey() instanceof IdentNode &&
2385                       key.equals(ScriptObject.PROTO_PROPERTY_NAME)) {
2386                // ES6 draft compliant __proto__ inside object literal
2387                // Identifier key and name is __proto__
2388                protoNode = value;
2389                continue;
2390            }
2391
2392            restOfProperty |=
2393                value != null &&
2394                isValid(ccp) &&
2395                propertyValueContains(value, ccp);
2396
2397            //for literals, a value of null means object type, i.e. the value null or getter setter function
2398            //(I think)
2399            final Class<?> valueType = (OBJECT_FIELDS_ONLY || value == null || value.getType().isBoolean()) ? Object.class : value.getType().getTypeClass();
2400            tuples.add(new MapTuple<Expression>(key, symbol, Type.typeFor(valueType), value) {
2401                @Override
2402                public Class<?> getValueType() {
2403                    return type.getTypeClass();
2404                }
2405            });
2406        }
2407
2408        final ObjectCreator<?> oc;
2409        if (elements.size() > OBJECT_SPILL_THRESHOLD) {
2410            oc = new SpillObjectCreator(this, tuples);
2411        } else {
2412            oc = new FieldObjectCreator<Expression>(this, tuples) {
2413                @Override
2414                protected void loadValue(final Expression node, final Type type) {
2415                    loadExpressionAsType(node, type);
2416                }};
2417        }
2418        oc.makeObject(method);
2419
2420        //if this is a rest of method and our continuation point was found as one of the values
2421        //in the properties above, we need to reset the map to oc.getMap() in the continuation
2422        //handler
2423        if (restOfProperty) {
2424            final ContinuationInfo ci = getContinuationInfo();
2425            // Can be set at most once for a single rest-of method
2426            assert ci.getObjectLiteralMap() == null;
2427            ci.setObjectLiteralMap(oc.getMap());
2428            ci.setObjectLiteralStackDepth(method.getStackSize());
2429        }
2430
2431        method.dup();
2432        if (protoNode != null) {
2433            loadExpressionAsObject(protoNode);
2434            // take care of { __proto__: 34 } or some such!
2435            method.convert(Type.OBJECT);
2436            method.invoke(ScriptObject.SET_PROTO_FROM_LITERAL);
2437        } else {
2438            method.invoke(ScriptObject.SET_GLOBAL_OBJECT_PROTO);
2439        }
2440
2441        for (final PropertyNode propertyNode : gettersSetters) {
2442            final FunctionNode getter = propertyNode.getGetter();
2443            final FunctionNode setter = propertyNode.getSetter();
2444
2445            assert getter != null || setter != null;
2446
2447            method.dup().loadKey(propertyNode.getKey());
2448            if (getter == null) {
2449                method.loadNull();
2450            } else {
2451                getter.accept(this);
2452            }
2453
2454            if (setter == null) {
2455                method.loadNull();
2456            } else {
2457                setter.accept(this);
2458            }
2459
2460            method.invoke(ScriptObject.SET_USER_ACCESSORS);
2461        }
2462    }
2463
2464    @Override
2465    public boolean enterReturnNode(final ReturnNode returnNode) {
2466        if(!method.isReachable()) {
2467            return false;
2468        }
2469        enterStatement(returnNode);
2470
2471        method.registerReturn();
2472
2473        final Type returnType = lc.getCurrentFunction().getReturnType();
2474
2475        final Expression expression = returnNode.getExpression();
2476        if (expression != null) {
2477            loadExpressionUnbounded(expression);
2478        } else {
2479            method.loadUndefined(returnType);
2480        }
2481
2482        method._return(returnType);
2483
2484        return false;
2485    }
2486
2487    private boolean undefinedCheck(final RuntimeNode runtimeNode, final List<Expression> args) {
2488        final Request request = runtimeNode.getRequest();
2489
2490        if (!Request.isUndefinedCheck(request)) {
2491            return false;
2492        }
2493
2494        final Expression lhs = args.get(0);
2495        final Expression rhs = args.get(1);
2496
2497        final Symbol lhsSymbol = lhs instanceof IdentNode ? ((IdentNode)lhs).getSymbol() : null;
2498        final Symbol rhsSymbol = rhs instanceof IdentNode ? ((IdentNode)rhs).getSymbol() : null;
2499        // One must be a "undefined" identifier, otherwise we can't get here
2500        assert lhsSymbol != null || rhsSymbol != null;
2501
2502        final Symbol undefinedSymbol;
2503        if (isUndefinedSymbol(lhsSymbol)) {
2504            undefinedSymbol = lhsSymbol;
2505        } else {
2506            assert isUndefinedSymbol(rhsSymbol);
2507            undefinedSymbol = rhsSymbol;
2508        }
2509
2510        assert undefinedSymbol != null; //remove warning
2511        if (!undefinedSymbol.isScope()) {
2512            return false; //disallow undefined as local var or parameter
2513        }
2514
2515        if (lhsSymbol == undefinedSymbol && lhs.getType().isPrimitive()) {
2516            //we load the undefined first. never mind, because this will deoptimize anyway
2517            return false;
2518        }
2519
2520        if(isDeoptimizedExpression(lhs)) {
2521            // This is actually related to "lhs.getType().isPrimitive()" above: any expression being deoptimized in
2522            // the current chain of rest-of compilations used to have a type narrower than Object (so it was primitive).
2523            // We must not perform undefined check specialization for them, as then we'd violate the basic rule of
2524            // "Thou shalt not alter the stack shape between a deoptimized method and any of its (transitive) rest-ofs."
2525            return false;
2526        }
2527
2528        //make sure that undefined has not been overridden or scoped as a local var
2529        //between us and global
2530        if (!compiler.isGlobalSymbol(lc.getCurrentFunction(), "undefined")) {
2531            return false;
2532        }
2533
2534        final boolean isUndefinedCheck = request == Request.IS_UNDEFINED;
2535        final Expression expr = undefinedSymbol == lhsSymbol ? rhs : lhs;
2536        if (expr.getType().isPrimitive()) {
2537            loadAndDiscard(expr); //throw away lhs, but it still needs to be evaluated for side effects, even if not in scope, as it can be optimistic
2538            method.load(!isUndefinedCheck);
2539        } else {
2540            final Label checkTrue  = new Label("ud_check_true");
2541            final Label end        = new Label("end");
2542            loadExpressionAsObject(expr);
2543            method.loadUndefined(Type.OBJECT);
2544            method.if_acmpeq(checkTrue);
2545            method.load(!isUndefinedCheck);
2546            method._goto(end);
2547            method.label(checkTrue);
2548            method.load(isUndefinedCheck);
2549            method.label(end);
2550        }
2551
2552        return true;
2553    }
2554
2555    private static boolean isUndefinedSymbol(final Symbol symbol) {
2556        return symbol != null && "undefined".equals(symbol.getName());
2557    }
2558
2559    private static boolean isNullLiteral(final Node node) {
2560        return node instanceof LiteralNode<?> && ((LiteralNode<?>) node).isNull();
2561    }
2562
2563    private boolean nullCheck(final RuntimeNode runtimeNode, final List<Expression> args) {
2564        final Request request = runtimeNode.getRequest();
2565
2566        if (!Request.isEQ(request) && !Request.isNE(request)) {
2567            return false;
2568        }
2569
2570        assert args.size() == 2 : "EQ or NE or TYPEOF need two args";
2571
2572        Expression lhs = args.get(0);
2573        Expression rhs = args.get(1);
2574
2575        if (isNullLiteral(lhs)) {
2576            final Expression tmp = lhs;
2577            lhs = rhs;
2578            rhs = tmp;
2579        }
2580
2581        if (!isNullLiteral(rhs)) {
2582            return false;
2583        }
2584
2585        if (!lhs.getType().isObject()) {
2586            return false;
2587        }
2588
2589        if(isDeoptimizedExpression(lhs)) {
2590            // This is actually related to "!lhs.getType().isObject()" above: any expression being deoptimized in
2591            // the current chain of rest-of compilations used to have a type narrower than Object. We must not
2592            // perform null check specialization for them, as then we'd no longer be loading aconst_null on stack
2593            // and thus violate the basic rule of "Thou shalt not alter the stack shape between a deoptimized
2594            // method and any of its (transitive) rest-ofs."
2595            // NOTE also that if we had a representation for well-known constants (e.g. null, 0, 1, -1, etc.) in
2596            // Label$Stack.localLoads then this wouldn't be an issue, as we would never (somewhat ridiculously)
2597            // allocate a temporary local to hold the result of aconst_null before attempting an optimistic
2598            // operation.
2599            return false;
2600        }
2601
2602        // this is a null literal check, so if there is implicit coercion
2603        // involved like {D}x=null, we will fail - this is very rare
2604        final Label trueLabel  = new Label("trueLabel");
2605        final Label falseLabel = new Label("falseLabel");
2606        final Label endLabel   = new Label("end");
2607
2608        loadExpressionUnbounded(lhs);    //lhs
2609        final Label popLabel;
2610        if (!Request.isStrict(request)) {
2611            method.dup(); //lhs lhs
2612            popLabel = new Label("pop");
2613        } else {
2614            popLabel = null;
2615        }
2616
2617        if (Request.isEQ(request)) {
2618            method.ifnull(!Request.isStrict(request) ? popLabel : trueLabel);
2619            if (!Request.isStrict(request)) {
2620                method.loadUndefined(Type.OBJECT);
2621                method.if_acmpeq(trueLabel);
2622            }
2623            method.label(falseLabel);
2624            method.load(false);
2625            method._goto(endLabel);
2626            if (!Request.isStrict(request)) {
2627                method.label(popLabel);
2628                method.pop();
2629            }
2630            method.label(trueLabel);
2631            method.load(true);
2632            method.label(endLabel);
2633        } else if (Request.isNE(request)) {
2634            method.ifnull(!Request.isStrict(request) ? popLabel : falseLabel);
2635            if (!Request.isStrict(request)) {
2636                method.loadUndefined(Type.OBJECT);
2637                method.if_acmpeq(falseLabel);
2638            }
2639            method.label(trueLabel);
2640            method.load(true);
2641            method._goto(endLabel);
2642            if (!Request.isStrict(request)) {
2643                method.label(popLabel);
2644                method.pop();
2645            }
2646            method.label(falseLabel);
2647            method.load(false);
2648            method.label(endLabel);
2649        }
2650
2651        assert runtimeNode.getType().isBoolean();
2652        method.convert(runtimeNode.getType());
2653
2654        return true;
2655    }
2656
2657    /**
2658     * Was this expression or any of its subexpressions deoptimized in the current recompilation chain of rest-of methods?
2659     * @param rootExpr the expression being tested
2660     * @return true if the expression or any of its subexpressions was deoptimized in the current recompilation chain.
2661     */
2662    private boolean isDeoptimizedExpression(final Expression rootExpr) {
2663        if(!isRestOf()) {
2664            return false;
2665        }
2666        return new Supplier<Boolean>() {
2667            boolean contains;
2668            @Override
2669            public Boolean get() {
2670                rootExpr.accept(new NodeVisitor<LexicalContext>(new LexicalContext()) {
2671                    @Override
2672                    public boolean enterFunctionNode(final FunctionNode functionNode) {
2673                        return false;
2674                    }
2675                    @Override
2676                    public boolean enterDefault(final Node node) {
2677                        if(!contains && node instanceof Optimistic) {
2678                            final int pp = ((Optimistic)node).getProgramPoint();
2679                            contains = isValid(pp) && isContinuationEntryPoint(pp);
2680                        }
2681                        return !contains;
2682                    }
2683                });
2684                return contains;
2685            }
2686        }.get();
2687    }
2688
2689    private void loadRuntimeNode(final RuntimeNode runtimeNode) {
2690        final List<Expression> args = new ArrayList<>(runtimeNode.getArgs());
2691        if (nullCheck(runtimeNode, args)) {
2692           return;
2693        } else if(undefinedCheck(runtimeNode, args)) {
2694            return;
2695        }
2696        // Revert a false undefined check to a strict equality check
2697        final RuntimeNode newRuntimeNode;
2698        final Request request = runtimeNode.getRequest();
2699        if (Request.isUndefinedCheck(request)) {
2700            newRuntimeNode = runtimeNode.setRequest(request == Request.IS_UNDEFINED ? Request.EQ_STRICT : Request.NE_STRICT);
2701        } else {
2702            newRuntimeNode = runtimeNode;
2703        }
2704
2705        new OptimisticOperation(newRuntimeNode, TypeBounds.UNBOUNDED) {
2706            @Override
2707            void loadStack() {
2708                for (final Expression arg : args) {
2709                    loadExpression(arg, TypeBounds.OBJECT);
2710                }
2711            }
2712            @Override
2713            void consumeStack() {
2714                method.invokestatic(
2715                        CompilerConstants.className(ScriptRuntime.class),
2716                        newRuntimeNode.getRequest().toString(),
2717                        new FunctionSignature(
2718                            false,
2719                            false,
2720                            newRuntimeNode.getType(),
2721                            args.size()).toString());
2722            }
2723        }.emit();
2724
2725        method.convert(newRuntimeNode.getType());
2726    }
2727
2728    private void defineCommonSplitMethodParameters() {
2729        defineSplitMethodParameter(0, CALLEE);
2730        defineSplitMethodParameter(1, THIS);
2731        defineSplitMethodParameter(2, SCOPE);
2732    }
2733
2734    private void defineSplitMethodParameter(final int slot, final CompilerConstants cc) {
2735        defineSplitMethodParameter(slot, Type.typeFor(cc.type()));
2736    }
2737
2738    private void defineSplitMethodParameter(final int slot, final Type type) {
2739        method.defineBlockLocalVariable(slot, slot + type.getSlots());
2740        method.onLocalStore(type, slot);
2741    }
2742
2743    private int fixScopeSlot(final FunctionNode functionNode, final int extraSlot) {
2744        // TODO hack to move the scope to the expected slot (needed because split methods reuse the same slots as the root method)
2745        final int actualScopeSlot = functionNode.compilerConstant(SCOPE).getSlot(SCOPE_TYPE);
2746        final int defaultScopeSlot = SCOPE.slot();
2747        int newExtraSlot = extraSlot;
2748        if (actualScopeSlot != defaultScopeSlot) {
2749            if (actualScopeSlot == extraSlot) {
2750                newExtraSlot = extraSlot + 1;
2751                method.defineBlockLocalVariable(newExtraSlot, newExtraSlot + 1);
2752                method.load(Type.OBJECT, extraSlot);
2753                method.storeHidden(Type.OBJECT, newExtraSlot);
2754            } else {
2755                method.defineBlockLocalVariable(actualScopeSlot, actualScopeSlot + 1);
2756            }
2757            method.load(SCOPE_TYPE, defaultScopeSlot);
2758            method.storeCompilerConstant(SCOPE);
2759        }
2760        return newExtraSlot;
2761    }
2762
2763    @Override
2764    public boolean enterSplitReturn(final SplitReturn splitReturn) {
2765        if (method.isReachable()) {
2766            method.loadUndefined(lc.getCurrentFunction().getReturnType())._return();
2767        }
2768        return false;
2769    }
2770
2771    @Override
2772    public boolean enterSetSplitState(final SetSplitState setSplitState) {
2773        if (method.isReachable()) {
2774            method.setSplitState(setSplitState.getState());
2775        }
2776        return false;
2777    }
2778
2779    @Override
2780    public boolean enterSwitchNode(final SwitchNode switchNode) {
2781        if(!method.isReachable()) {
2782            return false;
2783        }
2784        enterStatement(switchNode);
2785
2786        final Expression     expression  = switchNode.getExpression();
2787        final List<CaseNode> cases       = switchNode.getCases();
2788
2789        if (cases.isEmpty()) {
2790            // still evaluate expression for side-effects.
2791            loadAndDiscard(expression);
2792            return false;
2793        }
2794
2795        final CaseNode defaultCase       = switchNode.getDefaultCase();
2796        final Label    breakLabel        = switchNode.getBreakLabel();
2797        final int      liveLocalsOnBreak = method.getUsedSlotsWithLiveTemporaries();
2798
2799        if (defaultCase != null && cases.size() == 1) {
2800            // default case only
2801            assert cases.get(0) == defaultCase;
2802            loadAndDiscard(expression);
2803            defaultCase.getBody().accept(this);
2804            method.breakLabel(breakLabel, liveLocalsOnBreak);
2805            return false;
2806        }
2807
2808        // NOTE: it can still change in the tableswitch/lookupswitch case if there's no default case
2809        // but we need to add a synthetic default case for local variable conversions
2810        Label defaultLabel = defaultCase != null ? defaultCase.getEntry() : breakLabel;
2811        final boolean hasSkipConversion = LocalVariableConversion.hasLiveConversion(switchNode);
2812
2813        if (switchNode.isInteger()) {
2814            // Tree for sorting values.
2815            final TreeMap<Integer, Label> tree = new TreeMap<>();
2816
2817            // Build up sorted tree.
2818            for (final CaseNode caseNode : cases) {
2819                final Node test = caseNode.getTest();
2820
2821                if (test != null) {
2822                    final Integer value = (Integer)((LiteralNode<?>)test).getValue();
2823                    final Label   entry = caseNode.getEntry();
2824
2825                    // Take first duplicate.
2826                    if (!tree.containsKey(value)) {
2827                        tree.put(value, entry);
2828                    }
2829                }
2830            }
2831
2832            // Copy values and labels to arrays.
2833            final int       size   = tree.size();
2834            final Integer[] values = tree.keySet().toArray(new Integer[size]);
2835            final Label[]   labels = tree.values().toArray(new Label[size]);
2836
2837            // Discern low, high and range.
2838            final int lo    = values[0];
2839            final int hi    = values[size - 1];
2840            final long range = (long)hi - (long)lo + 1;
2841
2842            // Find an unused value for default.
2843            int deflt = Integer.MIN_VALUE;
2844            for (final int value : values) {
2845                if (deflt == value) {
2846                    deflt++;
2847                } else if (deflt < value) {
2848                    break;
2849                }
2850            }
2851
2852            // Load switch expression.
2853            loadExpressionUnbounded(expression);
2854            final Type type = expression.getType();
2855
2856            // If expression not int see if we can convert, if not use deflt to trigger default.
2857            if (!type.isInteger()) {
2858                method.load(deflt);
2859                final Class<?> exprClass = type.getTypeClass();
2860                method.invoke(staticCallNoLookup(ScriptRuntime.class, "switchTagAsInt", int.class, exprClass.isPrimitive()? exprClass : Object.class, int.class));
2861            }
2862
2863            if(hasSkipConversion) {
2864                assert defaultLabel == breakLabel;
2865                defaultLabel = new Label("switch_skip");
2866            }
2867            // TABLESWITCH needs (range + 3) 32-bit values; LOOKUPSWITCH needs ((size * 2) + 2). Choose the one with
2868            // smaller representation, favor TABLESWITCH when they're equal size.
2869            if (range + 1 <= (size * 2) && range <= Integer.MAX_VALUE) {
2870                final Label[] table = new Label[(int)range];
2871                Arrays.fill(table, defaultLabel);
2872                for (int i = 0; i < size; i++) {
2873                    final int value = values[i];
2874                    table[value - lo] = labels[i];
2875                }
2876
2877                method.tableswitch(lo, hi, defaultLabel, table);
2878            } else {
2879                final int[] ints = new int[size];
2880                for (int i = 0; i < size; i++) {
2881                    ints[i] = values[i];
2882                }
2883
2884                method.lookupswitch(defaultLabel, ints, labels);
2885            }
2886            // This is a synthetic "default case" used in absence of actual default case, created if we need to apply
2887            // local variable conversions if neither case is taken.
2888            if(hasSkipConversion) {
2889                method.label(defaultLabel);
2890                method.beforeJoinPoint(switchNode);
2891                method._goto(breakLabel);
2892            }
2893        } else {
2894            final Symbol tagSymbol = switchNode.getTag();
2895            // TODO: we could have non-object tag
2896            final int tagSlot = tagSymbol.getSlot(Type.OBJECT);
2897            loadExpressionAsObject(expression);
2898            method.store(tagSymbol, Type.OBJECT);
2899
2900            for (final CaseNode caseNode : cases) {
2901                final Expression test = caseNode.getTest();
2902
2903                if (test != null) {
2904                    method.load(Type.OBJECT, tagSlot);
2905                    loadExpressionAsObject(test);
2906                    method.invoke(ScriptRuntime.EQ_STRICT);
2907                    method.ifne(caseNode.getEntry());
2908                }
2909            }
2910
2911            if (defaultCase != null) {
2912                method._goto(defaultLabel);
2913            } else {
2914                method.beforeJoinPoint(switchNode);
2915                method._goto(breakLabel);
2916            }
2917        }
2918
2919        // First case is only reachable through jump
2920        assert !method.isReachable();
2921
2922        for (final CaseNode caseNode : cases) {
2923            final Label fallThroughLabel;
2924            if(caseNode.getLocalVariableConversion() != null && method.isReachable()) {
2925                fallThroughLabel = new Label("fallthrough");
2926                method._goto(fallThroughLabel);
2927            } else {
2928                fallThroughLabel = null;
2929            }
2930            method.label(caseNode.getEntry());
2931            method.beforeJoinPoint(caseNode);
2932            if(fallThroughLabel != null) {
2933                method.label(fallThroughLabel);
2934            }
2935            caseNode.getBody().accept(this);
2936        }
2937
2938        method.breakLabel(breakLabel, liveLocalsOnBreak);
2939
2940        return false;
2941    }
2942
2943    @Override
2944    public boolean enterThrowNode(final ThrowNode throwNode) {
2945        if(!method.isReachable()) {
2946            return false;
2947        }
2948        enterStatement(throwNode);
2949
2950        if (throwNode.isSyntheticRethrow()) {
2951            method.beforeJoinPoint(throwNode);
2952
2953            //do not wrap whatever this is in an ecma exception, just rethrow it
2954            final IdentNode exceptionExpr = (IdentNode)throwNode.getExpression();
2955            final Symbol exceptionSymbol = exceptionExpr.getSymbol();
2956            method.load(exceptionSymbol, EXCEPTION_TYPE);
2957            method.checkcast(EXCEPTION_TYPE.getTypeClass());
2958            method.athrow();
2959            return false;
2960        }
2961
2962        final Source     source     = getCurrentSource();
2963        final Expression expression = throwNode.getExpression();
2964        final int        position   = throwNode.position();
2965        final int        line       = throwNode.getLineNumber();
2966        final int        column     = source.getColumn(position);
2967
2968        // NOTE: we first evaluate the expression, and only after it was evaluated do we create the new ECMAException
2969        // object and then somewhat cumbersomely move it beneath the evaluated expression on the stack. The reason for
2970        // this is that if expression is optimistic (or contains an optimistic subexpression), we'd potentially access
2971        // the not-yet-<init>ialized object on the stack from the UnwarrantedOptimismException handler, and bytecode
2972        // verifier forbids that.
2973        loadExpressionAsObject(expression);
2974
2975        method.load(source.getName());
2976        method.load(line);
2977        method.load(column);
2978        method.invoke(ECMAException.CREATE);
2979
2980        method.beforeJoinPoint(throwNode);
2981        method.athrow();
2982
2983        return false;
2984    }
2985
2986    private Source getCurrentSource() {
2987        return lc.getCurrentFunction().getSource();
2988    }
2989
2990    @Override
2991    public boolean enterTryNode(final TryNode tryNode) {
2992        if(!method.isReachable()) {
2993            return false;
2994        }
2995        enterStatement(tryNode);
2996
2997        final Block       body        = tryNode.getBody();
2998        final List<Block> catchBlocks = tryNode.getCatchBlocks();
2999        final Symbol      vmException = tryNode.getException();
3000        final Label       entry       = new Label("try");
3001        final Label       recovery    = new Label("catch");
3002        final Label       exit        = new Label("end_try");
3003        final Label       skip        = new Label("skip");
3004
3005        method.canThrow(recovery);
3006        // Effect any conversions that might be observed at the entry of the catch node before entering the try node.
3007        // This is because even the first instruction in the try block must be presumed to be able to transfer control
3008        // to the catch block. Note that this doesn't kill the original values; in this regard it works a lot like
3009        // conversions of assignments within the try block.
3010        method.beforeTry(tryNode, recovery);
3011        method.label(entry);
3012        catchLabels.push(recovery);
3013        try {
3014            body.accept(this);
3015        } finally {
3016            assert catchLabels.peek() == recovery;
3017            catchLabels.pop();
3018        }
3019
3020        method.label(exit);
3021        final boolean bodyCanThrow = exit.isAfter(entry);
3022        if(!bodyCanThrow) {
3023            // The body can't throw an exception; don't even bother emitting the catch handlers, they're all dead code.
3024            return false;
3025        }
3026
3027        method._try(entry, exit, recovery, Throwable.class);
3028
3029        if (method.isReachable()) {
3030            method._goto(skip);
3031        }
3032        method._catch(recovery);
3033        method.store(vmException, EXCEPTION_TYPE);
3034
3035        final int catchBlockCount = catchBlocks.size();
3036        final Label afterCatch = new Label("after_catch");
3037        for (int i = 0; i < catchBlockCount; i++) {
3038            assert method.isReachable();
3039            final Block catchBlock = catchBlocks.get(i);
3040
3041            // Because of the peculiarities of the flow control, we need to use an explicit push/enterBlock/leaveBlock
3042            // here.
3043            lc.push(catchBlock);
3044            enterBlock(catchBlock);
3045
3046            final CatchNode  catchNode          = (CatchNode)catchBlocks.get(i).getStatements().get(0);
3047            final IdentNode  exception          = catchNode.getException();
3048            final Expression exceptionCondition = catchNode.getExceptionCondition();
3049            final Block      catchBody          = catchNode.getBody();
3050
3051            new Store<IdentNode>(exception) {
3052                @Override
3053                protected void storeNonDiscard() {
3054                    // This expression is neither part of a discard, nor needs to be left on the stack after it was
3055                    // stored, so we override storeNonDiscard to be a no-op.
3056                }
3057
3058                @Override
3059                protected void evaluate() {
3060                    if (catchNode.isSyntheticRethrow()) {
3061                        method.load(vmException, EXCEPTION_TYPE);
3062                        return;
3063                    }
3064                    /*
3065                     * If caught object is an instance of ECMAException, then
3066                     * bind obj.thrown to the script catch var. Or else bind the
3067                     * caught object itself to the script catch var.
3068                     */
3069                    final Label notEcmaException = new Label("no_ecma_exception");
3070                    method.load(vmException, EXCEPTION_TYPE).dup()._instanceof(ECMAException.class).ifeq(notEcmaException);
3071                    method.checkcast(ECMAException.class); //TODO is this necessary?
3072                    method.getField(ECMAException.THROWN);
3073                    method.label(notEcmaException);
3074                }
3075            }.store();
3076
3077            final boolean isConditionalCatch = exceptionCondition != null;
3078            final Label nextCatch;
3079            if (isConditionalCatch) {
3080                loadExpressionAsBoolean(exceptionCondition);
3081                nextCatch = new Label("next_catch");
3082                method.ifeq(nextCatch);
3083            } else {
3084                nextCatch = null;
3085            }
3086
3087            catchBody.accept(this);
3088            leaveBlock(catchBlock);
3089            lc.pop(catchBlock);
3090            if(method.isReachable()) {
3091                method._goto(afterCatch);
3092            }
3093            if(nextCatch != null) {
3094                method.label(nextCatch);
3095            }
3096        }
3097
3098        assert !method.isReachable();
3099        // afterCatch could be the same as skip, except that we need to establish that the vmException is dead.
3100        method.label(afterCatch);
3101        if(method.isReachable()) {
3102            method.markDeadLocalVariable(vmException);
3103        }
3104        method.label(skip);
3105
3106        // Finally body is always inlined elsewhere so it doesn't need to be emitted
3107        return false;
3108    }
3109
3110    @Override
3111    public boolean enterVarNode(final VarNode varNode) {
3112        if(!method.isReachable()) {
3113            return false;
3114        }
3115        final Expression init = varNode.getInit();
3116        final IdentNode identNode = varNode.getName();
3117        final Symbol identSymbol = identNode.getSymbol();
3118        assert identSymbol != null : "variable node " + varNode + " requires a name with a symbol";
3119        final boolean needsScope = identSymbol.isScope();
3120
3121        if (init == null) {
3122            if (needsScope && varNode.isBlockScoped()) {
3123                // block scoped variables need a DECLARE flag to signal end of temporal dead zone (TDZ)
3124                method.loadCompilerConstant(SCOPE);
3125                method.loadUndefined(Type.OBJECT);
3126                final int flags = CALLSITE_SCOPE | getCallSiteFlags() | (varNode.isBlockScoped() ? CALLSITE_DECLARE : 0);
3127                assert isFastScope(identSymbol);
3128                storeFastScopeVar(identSymbol, flags);
3129            }
3130            return false;
3131        }
3132
3133        enterStatement(varNode);
3134        assert method != null;
3135
3136        if (needsScope) {
3137            method.loadCompilerConstant(SCOPE);
3138        }
3139
3140        if (needsScope) {
3141            loadExpressionUnbounded(init);
3142            // block scoped variables need a DECLARE flag to signal end of temporal dead zone (TDZ)
3143            final int flags = CALLSITE_SCOPE | getCallSiteFlags() | (varNode.isBlockScoped() ? CALLSITE_DECLARE : 0);
3144            if (isFastScope(identSymbol)) {
3145                storeFastScopeVar(identSymbol, flags);
3146            } else {
3147                method.dynamicSet(identNode.getName(), flags);
3148            }
3149        } else {
3150            final Type identType = identNode.getType();
3151            if(identType == Type.UNDEFINED) {
3152                // The symbol must not be slotted; the initializer is either itself undefined (explicit assignment of
3153                // undefined to undefined), or the left hand side is a dead variable.
3154                assert !identNode.getSymbol().isScope();
3155                assert init.getType() == Type.UNDEFINED || identNode.getSymbol().slotCount() == 0;
3156                loadAndDiscard(init);
3157                return false;
3158            }
3159            loadExpressionAsType(init, identType);
3160            storeIdentWithCatchConversion(identNode, identType);
3161        }
3162
3163        return false;
3164    }
3165
3166    private void storeIdentWithCatchConversion(final IdentNode identNode, final Type type) {
3167        // Assignments happening in try/catch blocks need to ensure that they also store a possibly wider typed value
3168        // that will be live at the exit from the try block
3169        final LocalVariableConversion conversion = identNode.getLocalVariableConversion();
3170        final Symbol symbol = identNode.getSymbol();
3171        if(conversion != null && conversion.isLive()) {
3172            assert symbol == conversion.getSymbol();
3173            assert symbol.isBytecodeLocal();
3174            // Only a single conversion from the target type to the join type is expected.
3175            assert conversion.getNext() == null;
3176            assert conversion.getFrom() == type;
3177            // We must propagate potential type change to the catch block
3178            final Label catchLabel = catchLabels.peek();
3179            assert catchLabel != METHOD_BOUNDARY; // ident conversion only exists in try blocks
3180            assert catchLabel.isReachable();
3181            final Type joinType = conversion.getTo();
3182            final Label.Stack catchStack = catchLabel.getStack();
3183            final int joinSlot = symbol.getSlot(joinType);
3184            // With nested try/catch blocks (incl. synthetic ones for finally), we can have a supposed conversion for
3185            // the exception symbol in the nested catch, but it isn't live in the outer catch block, so prevent doing
3186            // conversions for it. E.g. in "try { try { ... } catch(e) { e = 1; } } catch(e2) { ... }", we must not
3187            // introduce an I->O conversion on "e = 1" assignment as "e" is not live in "catch(e2)".
3188            if(catchStack.getUsedSlotsWithLiveTemporaries() > joinSlot) {
3189                method.dup();
3190                method.convert(joinType);
3191                method.store(symbol, joinType);
3192                catchLabel.getStack().onLocalStore(joinType, joinSlot, true);
3193                method.canThrow(catchLabel);
3194                // Store but keep the previous store live too.
3195                method.store(symbol, type, false);
3196                return;
3197            }
3198        }
3199
3200        method.store(symbol, type, true);
3201    }
3202
3203    @Override
3204    public boolean enterWhileNode(final WhileNode whileNode) {
3205        if(!method.isReachable()) {
3206            return false;
3207        }
3208        if(whileNode.isDoWhile()) {
3209            enterDoWhile(whileNode);
3210        } else {
3211            enterStatement(whileNode);
3212            enterForOrWhile(whileNode, null);
3213        }
3214        return false;
3215    }
3216
3217    private void enterForOrWhile(final LoopNode loopNode, final JoinPredecessorExpression modify) {
3218        // NOTE: the usual pattern for compiling test-first loops is "GOTO test; body; test; IFNE body". We use the less
3219        // conventional "test; IFEQ break; body; GOTO test; break;". It has one extra unconditional GOTO in each repeat
3220        // of the loop, but it's not a problem for modern JIT compilers. We do this because our local variable type
3221        // tracking is unfortunately not really prepared for out-of-order execution, e.g. compiling the following
3222        // contrived but legal JavaScript code snippet would fail because the test changes the type of "i" from object
3223        // to double: var i = {valueOf: function() { return 1} }; while(--i >= 0) { ... }
3224        // Instead of adding more complexity to the local variable type tracking, we instead choose to emit this
3225        // different code shape.
3226        final int liveLocalsOnBreak = method.getUsedSlotsWithLiveTemporaries();
3227        final JoinPredecessorExpression test = loopNode.getTest();
3228        if(Expression.isAlwaysFalse(test)) {
3229            loadAndDiscard(test);
3230            return;
3231        }
3232
3233        method.beforeJoinPoint(loopNode);
3234
3235        final Label continueLabel = loopNode.getContinueLabel();
3236        final Label repeatLabel = modify != null ? new Label("for_repeat") : continueLabel;
3237        method.label(repeatLabel);
3238        final int liveLocalsOnContinue = method.getUsedSlotsWithLiveTemporaries();
3239
3240        final Block   body                  = loopNode.getBody();
3241        final Label   breakLabel            = loopNode.getBreakLabel();
3242        final boolean testHasLiveConversion = test != null && LocalVariableConversion.hasLiveConversion(test);
3243
3244        if(Expression.isAlwaysTrue(test)) {
3245            if(test != null) {
3246                loadAndDiscard(test);
3247                if(testHasLiveConversion) {
3248                    method.beforeJoinPoint(test);
3249                }
3250            }
3251        } else if (test != null) {
3252            if (testHasLiveConversion) {
3253                emitBranch(test.getExpression(), body.getEntryLabel(), true);
3254                method.beforeJoinPoint(test);
3255                method._goto(breakLabel);
3256            } else {
3257                emitBranch(test.getExpression(), breakLabel, false);
3258            }
3259        }
3260
3261        body.accept(this);
3262        if(repeatLabel != continueLabel) {
3263            emitContinueLabel(continueLabel, liveLocalsOnContinue);
3264        }
3265
3266        if(method.isReachable()) {
3267            if(modify != null) {
3268                lineNumber(loopNode);
3269                loadAndDiscard(modify);
3270                method.beforeJoinPoint(modify);
3271            }
3272            method._goto(repeatLabel);
3273        }
3274
3275        method.breakLabel(breakLabel, liveLocalsOnBreak);
3276    }
3277
3278    private void emitContinueLabel(final Label continueLabel, final int liveLocals) {
3279        final boolean reachable = method.isReachable();
3280        method.breakLabel(continueLabel, liveLocals);
3281        // If we reach here only through a continue statement (e.g. body does not exit normally) then the
3282        // continueLabel can have extra non-temp symbols (e.g. exception from a try/catch contained in the body). We
3283        // must make sure those are thrown away.
3284        if(!reachable) {
3285            method.undefineLocalVariables(lc.getUsedSlotCount(), false);
3286        }
3287    }
3288
3289    private void enterDoWhile(final WhileNode whileNode) {
3290        final int liveLocalsOnContinueOrBreak = method.getUsedSlotsWithLiveTemporaries();
3291        method.beforeJoinPoint(whileNode);
3292
3293        final Block body = whileNode.getBody();
3294        body.accept(this);
3295
3296        emitContinueLabel(whileNode.getContinueLabel(), liveLocalsOnContinueOrBreak);
3297        if(method.isReachable()) {
3298            lineNumber(whileNode);
3299            final JoinPredecessorExpression test = whileNode.getTest();
3300            final Label bodyEntryLabel = body.getEntryLabel();
3301            final boolean testHasLiveConversion = LocalVariableConversion.hasLiveConversion(test);
3302            if(Expression.isAlwaysFalse(test)) {
3303                loadAndDiscard(test);
3304                if(testHasLiveConversion) {
3305                    method.beforeJoinPoint(test);
3306                }
3307            } else if(testHasLiveConversion) {
3308                // If we have conversions after the test in do-while, they need to be effected on both branches.
3309                final Label beforeExit = new Label("do_while_preexit");
3310                emitBranch(test.getExpression(), beforeExit, false);
3311                method.beforeJoinPoint(test);
3312                method._goto(bodyEntryLabel);
3313                method.label(beforeExit);
3314                method.beforeJoinPoint(test);
3315            } else {
3316                emitBranch(test.getExpression(), bodyEntryLabel, true);
3317            }
3318        }
3319        method.breakLabel(whileNode.getBreakLabel(), liveLocalsOnContinueOrBreak);
3320    }
3321
3322
3323    @Override
3324    public boolean enterWithNode(final WithNode withNode) {
3325        if(!method.isReachable()) {
3326            return false;
3327        }
3328        enterStatement(withNode);
3329        final Expression expression = withNode.getExpression();
3330        final Block      body       = withNode.getBody();
3331
3332        // It is possible to have a "pathological" case where the with block does not reference *any* identifiers. It's
3333        // pointless, but legal. In that case, if nothing else in the method forced the assignment of a slot to the
3334        // scope object, its' possible that it won't have a slot assigned. In this case we'll only evaluate expression
3335        // for its side effect and visit the body, and not bother opening and closing a WithObject.
3336        final boolean hasScope = method.hasScope();
3337
3338        if (hasScope) {
3339            method.loadCompilerConstant(SCOPE);
3340        }
3341
3342        loadExpressionAsObject(expression);
3343
3344        final Label tryLabel;
3345        if (hasScope) {
3346            // Construct a WithObject if we have a scope
3347            method.invoke(ScriptRuntime.OPEN_WITH);
3348            method.storeCompilerConstant(SCOPE);
3349            tryLabel = new Label("with_try");
3350            method.label(tryLabel);
3351        } else {
3352            // We just loaded the expression for its side effect and to check
3353            // for null or undefined value.
3354            globalCheckObjectCoercible();
3355            tryLabel = null;
3356        }
3357
3358        // Always process body
3359        body.accept(this);
3360
3361        if (hasScope) {
3362            // Ensure we always close the WithObject
3363            final Label endLabel   = new Label("with_end");
3364            final Label catchLabel = new Label("with_catch");
3365            final Label exitLabel  = new Label("with_exit");
3366
3367            method.label(endLabel);
3368            // Somewhat conservatively presume that if the body is not empty, it can throw an exception. In any case,
3369            // we must prevent trying to emit a try-catch for empty range, as it causes a verification error.
3370            final boolean bodyCanThrow = endLabel.isAfter(tryLabel);
3371            if(bodyCanThrow) {
3372                method._try(tryLabel, endLabel, catchLabel);
3373            }
3374
3375            final boolean reachable = method.isReachable();
3376            if(reachable) {
3377                popScope();
3378                if(bodyCanThrow) {
3379                    method._goto(exitLabel);
3380                }
3381            }
3382
3383            if(bodyCanThrow) {
3384                method._catch(catchLabel);
3385                popScopeException();
3386                method.athrow();
3387                if(reachable) {
3388                    method.label(exitLabel);
3389                }
3390            }
3391        }
3392        return false;
3393    }
3394
3395    private void loadADD(final UnaryNode unaryNode, final TypeBounds resultBounds) {
3396        loadExpression(unaryNode.getExpression(), resultBounds.booleanToInt().notWiderThan(Type.NUMBER));
3397        if(method.peekType() == Type.BOOLEAN) {
3398            // It's a no-op in bytecode, but we must make sure it is treated as an int for purposes of type signatures
3399            method.convert(Type.INT);
3400        }
3401    }
3402
3403    private void loadBIT_NOT(final UnaryNode unaryNode) {
3404        loadExpression(unaryNode.getExpression(), TypeBounds.INT).load(-1).xor();
3405    }
3406
3407    private void loadDECINC(final UnaryNode unaryNode) {
3408        final Expression operand     = unaryNode.getExpression();
3409        final Type       type        = unaryNode.getType();
3410        final TypeBounds typeBounds  = new TypeBounds(type, Type.NUMBER);
3411        final TokenType  tokenType   = unaryNode.tokenType();
3412        final boolean    isPostfix   = tokenType == TokenType.DECPOSTFIX || tokenType == TokenType.INCPOSTFIX;
3413        final boolean    isIncrement = tokenType == TokenType.INCPREFIX || tokenType == TokenType.INCPOSTFIX;
3414
3415        assert !type.isObject();
3416
3417        new SelfModifyingStore<UnaryNode>(unaryNode, operand) {
3418
3419            private void loadRhs() {
3420                loadExpression(operand, typeBounds, true);
3421            }
3422
3423            @Override
3424            protected void evaluate() {
3425                if(isPostfix) {
3426                    loadRhs();
3427                } else {
3428                    new OptimisticOperation(unaryNode, typeBounds) {
3429                        @Override
3430                        void loadStack() {
3431                            loadRhs();
3432                            loadMinusOne();
3433                        }
3434                        @Override
3435                        void consumeStack() {
3436                            doDecInc(getProgramPoint());
3437                        }
3438                    }.emit(getOptimisticIgnoreCountForSelfModifyingExpression(operand));
3439                }
3440            }
3441
3442            @Override
3443            protected void storeNonDiscard() {
3444                super.storeNonDiscard();
3445                if (isPostfix) {
3446                    new OptimisticOperation(unaryNode, typeBounds) {
3447                        @Override
3448                        void loadStack() {
3449                            loadMinusOne();
3450                        }
3451                        @Override
3452                        void consumeStack() {
3453                            doDecInc(getProgramPoint());
3454                        }
3455                    }.emit(1); // 1 for non-incremented result on the top of the stack pushed in evaluate()
3456                }
3457            }
3458
3459            private void loadMinusOne() {
3460                if (type.isInteger()) {
3461                    method.load(isIncrement ? 1 : -1);
3462                } else if (type.isLong()) {
3463                    method.load(isIncrement ? 1L : -1L);
3464                } else {
3465                    method.load(isIncrement ? 1.0 : -1.0);
3466                }
3467            }
3468
3469            private void doDecInc(final int programPoint) {
3470                method.add(programPoint);
3471            }
3472        }.store();
3473    }
3474
3475    private static int getOptimisticIgnoreCountForSelfModifyingExpression(final Expression target) {
3476        return target instanceof AccessNode ? 1 : target instanceof IndexNode ? 2 : 0;
3477    }
3478
3479    private void loadAndDiscard(final Expression expr) {
3480        // TODO: move checks for discarding to actual expression load code (e.g. as we do with void). That way we might
3481        // be able to eliminate even more checks.
3482        if(expr instanceof PrimitiveLiteralNode | isLocalVariable(expr)) {
3483            assert lc.getCurrentDiscard() != expr;
3484            // Don't bother evaluating expressions without side effects. Typical usage is "void 0" for reliably generating
3485            // undefined.
3486            return;
3487        }
3488
3489        lc.pushDiscard(expr);
3490        loadExpression(expr, TypeBounds.UNBOUNDED);
3491        if (lc.getCurrentDiscard() == expr) {
3492            assert !expr.isAssignment();
3493            // NOTE: if we had a way to load with type void, we could avoid popping
3494            method.pop();
3495            lc.popDiscard();
3496        }
3497    }
3498
3499    private void loadNEW(final UnaryNode unaryNode) {
3500        final CallNode callNode = (CallNode)unaryNode.getExpression();
3501        final List<Expression> args   = callNode.getArgs();
3502
3503        // Load function reference.
3504        loadExpressionAsObject(callNode.getFunction()); // must detect type error
3505
3506        method.dynamicNew(1 + loadArgs(args), getCallSiteFlags());
3507    }
3508
3509    private void loadNOT(final UnaryNode unaryNode) {
3510        final Expression expr = unaryNode.getExpression();
3511        if(expr instanceof UnaryNode && expr.isTokenType(TokenType.NOT)) {
3512            // !!x is idiomatic boolean cast in JavaScript
3513            loadExpressionAsBoolean(((UnaryNode)expr).getExpression());
3514        } else {
3515            final Label trueLabel  = new Label("true");
3516            final Label afterLabel = new Label("after");
3517
3518            emitBranch(expr, trueLabel, true);
3519            method.load(true);
3520            method._goto(afterLabel);
3521            method.label(trueLabel);
3522            method.load(false);
3523            method.label(afterLabel);
3524        }
3525    }
3526
3527    private void loadSUB(final UnaryNode unaryNode, final TypeBounds resultBounds) {
3528        final Type type = unaryNode.getType();
3529        assert type.isNumeric();
3530        final TypeBounds numericBounds = resultBounds.booleanToInt();
3531        new OptimisticOperation(unaryNode, numericBounds) {
3532            @Override
3533            void loadStack() {
3534                final Expression expr = unaryNode.getExpression();
3535                loadExpression(expr, numericBounds.notWiderThan(Type.NUMBER));
3536            }
3537            @Override
3538            void consumeStack() {
3539                // Must do an explicit conversion to the operation's type when it's double so that we correctly handle
3540                // negation of an int 0 to a double -0. With this, we get the correct negation of a local variable after
3541                // it deoptimized, e.g. "iload_2; i2d; dneg". Without this, we get "iload_2; ineg; i2d".
3542                if(type.isNumber()) {
3543                    method.convert(type);
3544                }
3545                method.neg(getProgramPoint());
3546            }
3547        }.emit();
3548    }
3549
3550    public void loadVOID(final UnaryNode unaryNode, final TypeBounds resultBounds) {
3551        loadAndDiscard(unaryNode.getExpression());
3552        if(lc.getCurrentDiscard() == unaryNode) {
3553            lc.popDiscard();
3554        } else {
3555            method.loadUndefined(resultBounds.widest);
3556        }
3557    }
3558
3559    public void loadADD(final BinaryNode binaryNode, final TypeBounds resultBounds) {
3560        new OptimisticOperation(binaryNode, resultBounds) {
3561            @Override
3562            void loadStack() {
3563                final TypeBounds operandBounds;
3564                final boolean isOptimistic = isValid(getProgramPoint());
3565                boolean forceConversionSeparation = false;
3566                if(isOptimistic) {
3567                    operandBounds = new TypeBounds(binaryNode.getType(), Type.OBJECT);
3568                } else {
3569                    // Non-optimistic, non-FP +. Allow it to overflow.
3570                    operandBounds = new TypeBounds(binaryNode.getWidestOperandType(), Type.OBJECT);
3571                    forceConversionSeparation = binaryNode.getWidestOperationType().narrowerThan(resultBounds.widest);
3572                }
3573                loadBinaryOperands(binaryNode.lhs(), binaryNode.rhs(), operandBounds, false, forceConversionSeparation);
3574            }
3575
3576            @Override
3577            void consumeStack() {
3578                method.add(getProgramPoint());
3579            }
3580        }.emit();
3581    }
3582
3583    private void loadAND_OR(final BinaryNode binaryNode, final TypeBounds resultBounds, final boolean isAnd) {
3584        final Type narrowestOperandType = Type.widestReturnType(binaryNode.lhs().getType(), binaryNode.rhs().getType());
3585
3586        final Label skip = new Label("skip");
3587        if(narrowestOperandType == Type.BOOLEAN) {
3588            // optimize all-boolean logical expressions
3589            final Label onTrue = new Label("andor_true");
3590            emitBranch(binaryNode, onTrue, true);
3591            method.load(false);
3592            method._goto(skip);
3593            method.label(onTrue);
3594            method.load(true);
3595            method.label(skip);
3596            return;
3597        }
3598
3599        final TypeBounds outBounds = resultBounds.notNarrowerThan(narrowestOperandType);
3600        final JoinPredecessorExpression lhs = (JoinPredecessorExpression)binaryNode.lhs();
3601        final boolean lhsConvert = LocalVariableConversion.hasLiveConversion(lhs);
3602        final Label evalRhs = lhsConvert ? new Label("eval_rhs") : null;
3603
3604        loadExpression(lhs, outBounds).dup().convert(Type.BOOLEAN);
3605        if (isAnd) {
3606            if(lhsConvert) {
3607                method.ifne(evalRhs);
3608            } else {
3609                method.ifeq(skip);
3610            }
3611        } else if(lhsConvert) {
3612            method.ifeq(evalRhs);
3613        } else {
3614            method.ifne(skip);
3615        }
3616
3617        if(lhsConvert) {
3618            method.beforeJoinPoint(lhs);
3619            method._goto(skip);
3620            method.label(evalRhs);
3621        }
3622
3623        method.pop();
3624        final JoinPredecessorExpression rhs = (JoinPredecessorExpression)binaryNode.rhs();
3625        loadExpression(rhs, outBounds);
3626        method.beforeJoinPoint(rhs);
3627        method.label(skip);
3628    }
3629
3630    private static boolean isLocalVariable(final Expression lhs) {
3631        return lhs instanceof IdentNode && isLocalVariable((IdentNode)lhs);
3632    }
3633
3634    private static boolean isLocalVariable(final IdentNode lhs) {
3635        return lhs.getSymbol().isBytecodeLocal();
3636    }
3637
3638    // NOTE: does not use resultBounds as the assignment is driven by the type of the RHS
3639    private void loadASSIGN(final BinaryNode binaryNode) {
3640        final Expression lhs = binaryNode.lhs();
3641        final Expression rhs = binaryNode.rhs();
3642
3643        final Type rhsType = rhs.getType();
3644        // Detect dead assignments
3645        if(lhs instanceof IdentNode) {
3646            final Symbol symbol = ((IdentNode)lhs).getSymbol();
3647            if(!symbol.isScope() && !symbol.hasSlotFor(rhsType) && lc.getCurrentDiscard() == binaryNode) {
3648                loadAndDiscard(rhs);
3649                lc.popDiscard();
3650                method.markDeadLocalVariable(symbol);
3651                return;
3652            }
3653        }
3654
3655        new Store<BinaryNode>(binaryNode, lhs) {
3656            @Override
3657            protected void evaluate() {
3658                // NOTE: we're loading with "at least as wide as" so optimistic operations on the right hand side
3659                // remain optimistic, and then explicitly convert to the required type if needed.
3660                loadExpressionAsType(rhs, rhsType);
3661            }
3662        }.store();
3663    }
3664
3665    /**
3666     * Binary self-assignment that can be optimistic: +=, -=, *=, and /=.
3667     */
3668    private abstract class BinaryOptimisticSelfAssignment extends SelfModifyingStore<BinaryNode> {
3669
3670        /**
3671         * Constructor
3672         *
3673         * @param node the assign op node
3674         */
3675        BinaryOptimisticSelfAssignment(final BinaryNode node) {
3676            super(node, node.lhs());
3677        }
3678
3679        protected abstract void op(OptimisticOperation oo);
3680
3681        @Override
3682        protected void evaluate() {
3683            final Expression lhs = assignNode.lhs();
3684            final Expression rhs = assignNode.rhs();
3685            final Type widestOperationType = assignNode.getWidestOperationType();
3686            final Type widest = assignNode.isTokenType(TokenType.ASSIGN_ADD) ? Type.OBJECT : widestOperationType;
3687            final TypeBounds bounds = new TypeBounds(assignNode.getType(), widest);
3688            new OptimisticOperation(assignNode, bounds) {
3689                @Override
3690                void loadStack() {
3691                    final boolean forceConversionSeparation;
3692                    if (isValid(getProgramPoint()) || widestOperationType == Type.NUMBER) {
3693                        forceConversionSeparation = false;
3694                    } else {
3695                        final Type operandType = Type.widest(booleanToInt(objectToNumber(lhs.getType())), booleanToInt(objectToNumber(rhs.getType())));
3696                        forceConversionSeparation = operandType.narrowerThan(widestOperationType);
3697                    }
3698                    loadBinaryOperands(lhs, rhs, bounds, true, forceConversionSeparation);
3699                }
3700                @Override
3701                void consumeStack() {
3702                    op(this);
3703                }
3704            }.emit(getOptimisticIgnoreCountForSelfModifyingExpression(lhs));
3705            method.convert(assignNode.getType());
3706        }
3707    }
3708
3709    /**
3710     * Non-optimistic binary self-assignment operation. Basically, everything except +=, -=, *=, and /=.
3711     */
3712    private abstract class BinarySelfAssignment extends SelfModifyingStore<BinaryNode> {
3713        BinarySelfAssignment(final BinaryNode node) {
3714            super(node, node.lhs());
3715        }
3716
3717        protected abstract void op();
3718
3719        @Override
3720        protected void evaluate() {
3721            loadBinaryOperands(assignNode.lhs(), assignNode.rhs(), TypeBounds.UNBOUNDED.notWiderThan(assignNode.getWidestOperandType()), true, false);
3722            op();
3723        }
3724    }
3725
3726    private void loadASSIGN_ADD(final BinaryNode binaryNode) {
3727        new BinaryOptimisticSelfAssignment(binaryNode) {
3728            @Override
3729            protected void op(final OptimisticOperation oo) {
3730                assert !(binaryNode.getType().isObject() && oo.isOptimistic);
3731                method.add(oo.getProgramPoint());
3732            }
3733        }.store();
3734    }
3735
3736    private void loadASSIGN_BIT_AND(final BinaryNode binaryNode) {
3737        new BinarySelfAssignment(binaryNode) {
3738            @Override
3739            protected void op() {
3740                method.and();
3741            }
3742        }.store();
3743    }
3744
3745    private void loadASSIGN_BIT_OR(final BinaryNode binaryNode) {
3746        new BinarySelfAssignment(binaryNode) {
3747            @Override
3748            protected void op() {
3749                method.or();
3750            }
3751        }.store();
3752    }
3753
3754    private void loadASSIGN_BIT_XOR(final BinaryNode binaryNode) {
3755        new BinarySelfAssignment(binaryNode) {
3756            @Override
3757            protected void op() {
3758                method.xor();
3759            }
3760        }.store();
3761    }
3762
3763    private void loadASSIGN_DIV(final BinaryNode binaryNode) {
3764        new BinaryOptimisticSelfAssignment(binaryNode) {
3765            @Override
3766            protected void op(final OptimisticOperation oo) {
3767                method.div(oo.getProgramPoint());
3768            }
3769        }.store();
3770    }
3771
3772    private void loadASSIGN_MOD(final BinaryNode binaryNode) {
3773        new BinaryOptimisticSelfAssignment(binaryNode) {
3774            @Override
3775            protected void op(final OptimisticOperation oo) {
3776                method.rem(oo.getProgramPoint());
3777            }
3778        }.store();
3779    }
3780
3781    private void loadASSIGN_MUL(final BinaryNode binaryNode) {
3782        new BinaryOptimisticSelfAssignment(binaryNode) {
3783            @Override
3784            protected void op(final OptimisticOperation oo) {
3785                method.mul(oo.getProgramPoint());
3786            }
3787        }.store();
3788    }
3789
3790    private void loadASSIGN_SAR(final BinaryNode binaryNode) {
3791        new BinarySelfAssignment(binaryNode) {
3792            @Override
3793            protected void op() {
3794                method.sar();
3795            }
3796        }.store();
3797    }
3798
3799    private void loadASSIGN_SHL(final BinaryNode binaryNode) {
3800        new BinarySelfAssignment(binaryNode) {
3801            @Override
3802            protected void op() {
3803                method.shl();
3804            }
3805        }.store();
3806    }
3807
3808    private void loadASSIGN_SHR(final BinaryNode binaryNode) {
3809        new BinarySelfAssignment(binaryNode) {
3810            @Override
3811            protected void op() {
3812                doSHR();
3813            }
3814
3815        }.store();
3816    }
3817
3818    private void doSHR() {
3819        // TODO: make SHR optimistic
3820        method.shr().convert(Type.LONG).load(JSType.MAX_UINT).and();
3821    }
3822
3823    private void loadASSIGN_SUB(final BinaryNode binaryNode) {
3824        new BinaryOptimisticSelfAssignment(binaryNode) {
3825            @Override
3826            protected void op(final OptimisticOperation oo) {
3827                method.sub(oo.getProgramPoint());
3828            }
3829        }.store();
3830    }
3831
3832    /**
3833     * Helper class for binary arithmetic ops
3834     */
3835    private abstract class BinaryArith {
3836        protected abstract void op(int programPoint);
3837
3838        protected void evaluate(final BinaryNode node, final TypeBounds resultBounds) {
3839            final TypeBounds numericBounds = resultBounds.booleanToInt().objectToNumber();
3840            new OptimisticOperation(node, numericBounds) {
3841                @Override
3842                void loadStack() {
3843                    final TypeBounds operandBounds;
3844                    boolean forceConversionSeparation = false;
3845                    if(numericBounds.narrowest == Type.NUMBER) {
3846                        // Result should be double always. Propagate it into the operands so we don't have lots of I2D
3847                        // and L2D after operand evaluation.
3848                        assert numericBounds.widest == Type.NUMBER;
3849                        operandBounds = numericBounds;
3850                    } else {
3851                        final boolean isOptimistic = isValid(getProgramPoint());
3852                        if(isOptimistic) {
3853                            operandBounds = new TypeBounds(node.getType(), Type.NUMBER);
3854                        } else if(node.isTokenType(TokenType.DIV) || node.isTokenType(TokenType.MOD)) {
3855                            // Non-optimistic division must always take double arguments as its result must also be
3856                            // double.
3857                            operandBounds = TypeBounds.NUMBER;
3858                        } else {
3859                            // Non-optimistic, non-FP subtraction or multiplication. Allow them to overflow.
3860                            operandBounds = new TypeBounds(Type.narrowest(node.getWidestOperandType(),
3861                                    numericBounds.widest), Type.NUMBER);
3862                            forceConversionSeparation = node.getWidestOperationType().narrowerThan(numericBounds.widest);
3863                        }
3864                    }
3865                    loadBinaryOperands(node.lhs(), node.rhs(), operandBounds, false, forceConversionSeparation);
3866                }
3867
3868                @Override
3869                void consumeStack() {
3870                    op(getProgramPoint());
3871                }
3872            }.emit();
3873        }
3874    }
3875
3876    private void loadBIT_AND(final BinaryNode binaryNode) {
3877        loadBinaryOperands(binaryNode);
3878        method.and();
3879    }
3880
3881    private void loadBIT_OR(final BinaryNode binaryNode) {
3882        loadBinaryOperands(binaryNode);
3883        method.or();
3884    }
3885
3886    private void loadBIT_XOR(final BinaryNode binaryNode) {
3887        loadBinaryOperands(binaryNode);
3888        method.xor();
3889    }
3890
3891    private void loadCOMMARIGHT(final BinaryNode binaryNode, final TypeBounds resultBounds) {
3892        loadAndDiscard(binaryNode.lhs());
3893        loadExpression(binaryNode.rhs(), resultBounds);
3894    }
3895
3896    private void loadCOMMALEFT(final BinaryNode binaryNode, final TypeBounds resultBounds) {
3897        loadExpression(binaryNode.lhs(), resultBounds);
3898        loadAndDiscard(binaryNode.rhs());
3899    }
3900
3901    private void loadDIV(final BinaryNode binaryNode, final TypeBounds resultBounds) {
3902        new BinaryArith() {
3903            @Override
3904            protected void op(final int programPoint) {
3905                method.div(programPoint);
3906            }
3907        }.evaluate(binaryNode, resultBounds);
3908    }
3909
3910    private void loadCmp(final BinaryNode binaryNode, final Condition cond) {
3911        assert comparisonOperandsArePrimitive(binaryNode) : binaryNode;
3912        loadBinaryOperands(binaryNode);
3913
3914        final Label trueLabel  = new Label("trueLabel");
3915        final Label afterLabel = new Label("skip");
3916
3917        method.conditionalJump(cond, trueLabel);
3918
3919        method.load(Boolean.FALSE);
3920        method._goto(afterLabel);
3921        method.label(trueLabel);
3922        method.load(Boolean.TRUE);
3923        method.label(afterLabel);
3924    }
3925
3926    private static boolean comparisonOperandsArePrimitive(final BinaryNode binaryNode) {
3927        final Type widest = Type.widest(binaryNode.lhs().getType(), binaryNode.rhs().getType());
3928        return widest.isNumeric() || widest.isBoolean();
3929    }
3930
3931    private void loadMOD(final BinaryNode binaryNode, final TypeBounds resultBounds) {
3932        new BinaryArith() {
3933            @Override
3934            protected void op(final int programPoint) {
3935                method.rem(programPoint);
3936            }
3937        }.evaluate(binaryNode, resultBounds);
3938    }
3939
3940    private void loadMUL(final BinaryNode binaryNode, final TypeBounds resultBounds) {
3941        new BinaryArith() {
3942            @Override
3943            protected void op(final int programPoint) {
3944                method.mul(programPoint);
3945            }
3946        }.evaluate(binaryNode, resultBounds);
3947    }
3948
3949    private void loadSAR(final BinaryNode binaryNode) {
3950        loadBinaryOperands(binaryNode);
3951        method.sar();
3952    }
3953
3954    private void loadSHL(final BinaryNode binaryNode) {
3955        loadBinaryOperands(binaryNode);
3956        method.shl();
3957    }
3958
3959    private void loadSHR(final BinaryNode binaryNode) {
3960        loadBinaryOperands(binaryNode);
3961        doSHR();
3962    }
3963
3964    private void loadSUB(final BinaryNode binaryNode, final TypeBounds resultBounds) {
3965        new BinaryArith() {
3966            @Override
3967            protected void op(final int programPoint) {
3968                method.sub(programPoint);
3969            }
3970        }.evaluate(binaryNode, resultBounds);
3971    }
3972
3973    @Override
3974    public boolean enterLabelNode(final LabelNode labelNode) {
3975        labeledBlockBreakLiveLocals.push(lc.getUsedSlotCount());
3976        return true;
3977    }
3978
3979    @Override
3980    protected boolean enterDefault(final Node node) {
3981        throw new AssertionError("Code generator entered node of type " + node.getClass().getName());
3982    }
3983
3984    private void loadTernaryNode(final TernaryNode ternaryNode, final TypeBounds resultBounds) {
3985        final Expression test = ternaryNode.getTest();
3986        final JoinPredecessorExpression trueExpr  = ternaryNode.getTrueExpression();
3987        final JoinPredecessorExpression falseExpr = ternaryNode.getFalseExpression();
3988
3989        final Label falseLabel = new Label("ternary_false");
3990        final Label exitLabel  = new Label("ternary_exit");
3991
3992        final Type outNarrowest = Type.narrowest(resultBounds.widest, Type.generic(Type.widestReturnType(trueExpr.getType(), falseExpr.getType())));
3993        final TypeBounds outBounds = resultBounds.notNarrowerThan(outNarrowest);
3994
3995        emitBranch(test, falseLabel, false);
3996
3997        loadExpression(trueExpr.getExpression(), outBounds);
3998        assert Type.generic(method.peekType()) == outBounds.narrowest;
3999        method.beforeJoinPoint(trueExpr);
4000        method._goto(exitLabel);
4001        method.label(falseLabel);
4002        loadExpression(falseExpr.getExpression(), outBounds);
4003        assert Type.generic(method.peekType()) == outBounds.narrowest;
4004        method.beforeJoinPoint(falseExpr);
4005        method.label(exitLabel);
4006    }
4007
4008    /**
4009     * Generate all shared scope calls generated during codegen.
4010     */
4011    void generateScopeCalls() {
4012        for (final SharedScopeCall scopeAccess : lc.getScopeCalls()) {
4013            scopeAccess.generateScopeCall();
4014        }
4015    }
4016
4017    /**
4018     * Debug code used to print symbols
4019     *
4020     * @param block the block we are in
4021     * @param function the function we are in
4022     * @param ident identifier for block or function where applicable
4023     */
4024    private void printSymbols(final Block block, final FunctionNode function, final String ident) {
4025        if (compiler.getScriptEnvironment()._print_symbols || function.getFlag(FunctionNode.IS_PRINT_SYMBOLS)) {
4026            final PrintWriter out = compiler.getScriptEnvironment().getErr();
4027            out.println("[BLOCK in '" + ident + "']");
4028            if (!block.printSymbols(out)) {
4029                out.println("<no symbols>");
4030            }
4031            out.println();
4032        }
4033    }
4034
4035
4036    /**
4037     * The difference between a store and a self modifying store is that
4038     * the latter may load part of the target on the stack, e.g. the base
4039     * of an AccessNode or the base and index of an IndexNode. These are used
4040     * both as target and as an extra source. Previously it was problematic
4041     * for self modifying stores if the target/lhs didn't belong to one
4042     * of three trivial categories: IdentNode, AcessNodes, IndexNodes. In that
4043     * case it was evaluated and tagged as "resolved", which meant at the second
4044     * time the lhs of this store was read (e.g. in a = a (second) + b for a += b,
4045     * it would be evaluated to a nop in the scope and cause stack underflow
4046     *
4047     * see NASHORN-703
4048     *
4049     * @param <T>
4050     */
4051    private abstract class SelfModifyingStore<T extends Expression> extends Store<T> {
4052        protected SelfModifyingStore(final T assignNode, final Expression target) {
4053            super(assignNode, target);
4054        }
4055
4056        @Override
4057        protected boolean isSelfModifying() {
4058            return true;
4059        }
4060    }
4061
4062    /**
4063     * Helper class to generate stores
4064     */
4065    private abstract class Store<T extends Expression> {
4066
4067        /** An assignment node, e.g. x += y */
4068        protected final T assignNode;
4069
4070        /** The target node to store to, e.g. x */
4071        private final Expression target;
4072
4073        /** How deep on the stack do the arguments go if this generates an indy call */
4074        private int depth;
4075
4076        /** If we have too many arguments, we need temporary storage, this is stored in 'quick' */
4077        private IdentNode quick;
4078
4079        /**
4080         * Constructor
4081         *
4082         * @param assignNode the node representing the whole assignment
4083         * @param target     the target node of the assignment (destination)
4084         */
4085        protected Store(final T assignNode, final Expression target) {
4086            this.assignNode = assignNode;
4087            this.target = target;
4088        }
4089
4090        /**
4091         * Constructor
4092         *
4093         * @param assignNode the node representing the whole assignment
4094         */
4095        protected Store(final T assignNode) {
4096            this(assignNode, assignNode);
4097        }
4098
4099        /**
4100         * Is this a self modifying store operation, e.g. *= or ++
4101         * @return true if self modifying store
4102         */
4103        protected boolean isSelfModifying() {
4104            return false;
4105        }
4106
4107        private void prologue() {
4108            /**
4109             * This loads the parts of the target, e.g base and index. they are kept
4110             * on the stack throughout the store and used at the end to execute it
4111             */
4112
4113            target.accept(new NodeVisitor<LexicalContext>(new LexicalContext()) {
4114                @Override
4115                public boolean enterIdentNode(final IdentNode node) {
4116                    if (node.getSymbol().isScope()) {
4117                        method.loadCompilerConstant(SCOPE);
4118                        depth += Type.SCOPE.getSlots();
4119                        assert depth == 1;
4120                    }
4121                    return false;
4122                }
4123
4124                private void enterBaseNode() {
4125                    assert target instanceof BaseNode : "error - base node " + target + " must be instanceof BaseNode";
4126                    final BaseNode   baseNode = (BaseNode)target;
4127                    final Expression base     = baseNode.getBase();
4128
4129                    loadExpressionAsObject(base);
4130                    depth += Type.OBJECT.getSlots();
4131                    assert depth == 1;
4132
4133                    if (isSelfModifying()) {
4134                        method.dup();
4135                    }
4136                }
4137
4138                @Override
4139                public boolean enterAccessNode(final AccessNode node) {
4140                    enterBaseNode();
4141                    return false;
4142                }
4143
4144                @Override
4145                public boolean enterIndexNode(final IndexNode node) {
4146                    enterBaseNode();
4147
4148                    final Expression index = node.getIndex();
4149                    if (!index.getType().isNumeric()) {
4150                        // could be boolean here as well
4151                        loadExpressionAsObject(index);
4152                    } else {
4153                        loadExpressionUnbounded(index);
4154                    }
4155                    depth += index.getType().getSlots();
4156
4157                    if (isSelfModifying()) {
4158                        //convert "base base index" to "base index base index"
4159                        method.dup(1);
4160                    }
4161
4162                    return false;
4163                }
4164
4165            });
4166        }
4167
4168        /**
4169         * Generates an extra local variable, always using the same slot, one that is available after the end of the
4170         * frame.
4171         *
4172         * @param type the type of the variable
4173         *
4174         * @return the quick variable
4175         */
4176        private IdentNode quickLocalVariable(final Type type) {
4177            final String name = lc.getCurrentFunction().uniqueName(QUICK_PREFIX.symbolName());
4178            final Symbol symbol = new Symbol(name, IS_INTERNAL | HAS_SLOT);
4179            symbol.setHasSlotFor(type);
4180            symbol.setFirstSlot(lc.quickSlot(type));
4181
4182            final IdentNode quickIdent = IdentNode.createInternalIdentifier(symbol).setType(type);
4183
4184            return quickIdent;
4185        }
4186
4187        // store the result that "lives on" after the op, e.g. "i" in i++ postfix.
4188        protected void storeNonDiscard() {
4189            if (lc.getCurrentDiscard() == assignNode) {
4190                assert assignNode.isAssignment();
4191                lc.popDiscard();
4192                return;
4193            }
4194
4195            if (method.dup(depth) == null) {
4196                method.dup();
4197                final Type quickType = method.peekType();
4198                this.quick = quickLocalVariable(quickType);
4199                final Symbol quickSymbol = quick.getSymbol();
4200                method.storeTemp(quickType, quickSymbol.getFirstSlot());
4201            }
4202        }
4203
4204        private void epilogue() {
4205            /**
4206             * Take the original target args from the stack and use them
4207             * together with the value to be stored to emit the store code
4208             *
4209             * The case that targetSymbol is in scope (!hasSlot) and we actually
4210             * need to do a conversion on non-equivalent types exists, but is
4211             * very rare. See for example test/script/basic/access-specializer.js
4212             */
4213            target.accept(new NodeVisitor<LexicalContext>(new LexicalContext()) {
4214                @Override
4215                protected boolean enterDefault(final Node node) {
4216                    throw new AssertionError("Unexpected node " + node + " in store epilogue");
4217                }
4218
4219                @Override
4220                public boolean enterIdentNode(final IdentNode node) {
4221                    final Symbol symbol = node.getSymbol();
4222                    assert symbol != null;
4223                    if (symbol.isScope()) {
4224                        final int flags = CALLSITE_SCOPE | getCallSiteFlags();
4225                        if (isFastScope(symbol)) {
4226                            storeFastScopeVar(symbol, flags);
4227                        } else {
4228                            method.dynamicSet(node.getName(), flags);
4229                        }
4230                    } else {
4231                        final Type storeType = assignNode.getType();
4232                        if (symbol.hasSlotFor(storeType)) {
4233                            // Only emit a convert for a store known to be live; converts for dead stores can
4234                            // give us an unnecessary ClassCastException.
4235                            method.convert(storeType);
4236                        }
4237                        storeIdentWithCatchConversion(node, storeType);
4238                    }
4239                    return false;
4240
4241                }
4242
4243                @Override
4244                public boolean enterAccessNode(final AccessNode node) {
4245                    method.dynamicSet(node.getProperty(), getCallSiteFlags());
4246                    return false;
4247                }
4248
4249                @Override
4250                public boolean enterIndexNode(final IndexNode node) {
4251                    method.dynamicSetIndex(getCallSiteFlags());
4252                    return false;
4253                }
4254            });
4255
4256
4257            // whatever is on the stack now is the final answer
4258        }
4259
4260        protected abstract void evaluate();
4261
4262        void store() {
4263            if (target instanceof IdentNode) {
4264                checkTemporalDeadZone((IdentNode)target);
4265            }
4266            prologue();
4267            evaluate(); // leaves an operation of whatever the operationType was on the stack
4268            storeNonDiscard();
4269            epilogue();
4270            if (quick != null) {
4271                method.load(quick);
4272            }
4273        }
4274    }
4275
4276    private void newFunctionObject(final FunctionNode functionNode, final boolean addInitializer) {
4277        assert lc.peek() == functionNode;
4278
4279        final RecompilableScriptFunctionData data = compiler.getScriptFunctionData(functionNode.getId());
4280
4281        if (functionNode.isProgram() && !compiler.isOnDemandCompilation()) {
4282            final CompileUnit fnUnit = functionNode.getCompileUnit();
4283            final MethodEmitter createFunction = fnUnit.getClassEmitter().method(
4284                    EnumSet.of(Flag.PUBLIC, Flag.STATIC), CREATE_PROGRAM_FUNCTION.symbolName(),
4285                    ScriptFunction.class, ScriptObject.class);
4286            createFunction.begin();
4287            createFunction._new(SCRIPTFUNCTION_IMPL_NAME, SCRIPTFUNCTION_IMPL_TYPE).dup();
4288            loadConstant(data, fnUnit, createFunction);
4289            createFunction.load(SCOPE_TYPE, 0);
4290            createFunction.invoke(constructorNoLookup(SCRIPTFUNCTION_IMPL_NAME, RecompilableScriptFunctionData.class, ScriptObject.class));
4291            createFunction._return();
4292            createFunction.end();
4293        }
4294
4295        if (addInitializer && !compiler.isOnDemandCompilation()) {
4296            compiler.addFunctionInitializer(data, functionNode);
4297        }
4298
4299        // We don't emit a ScriptFunction on stack for the outermost compiled function (as there's no code being
4300        // generated in its outer context that'd need it as a callee).
4301        if (lc.getOutermostFunction() == functionNode) {
4302            return;
4303        }
4304
4305        method._new(SCRIPTFUNCTION_IMPL_NAME, SCRIPTFUNCTION_IMPL_TYPE).dup();
4306        loadConstant(data);
4307
4308        if (functionNode.needsParentScope()) {
4309            method.loadCompilerConstant(SCOPE);
4310        } else {
4311            method.loadNull();
4312        }
4313        method.invoke(constructorNoLookup(SCRIPTFUNCTION_IMPL_NAME, RecompilableScriptFunctionData.class, ScriptObject.class));
4314    }
4315
4316    // calls on Global class.
4317    private MethodEmitter globalInstance() {
4318        return method.invokestatic(GLOBAL_OBJECT, "instance", "()L" + GLOBAL_OBJECT + ';');
4319    }
4320
4321    private MethodEmitter globalAllocateArguments() {
4322        return method.invokestatic(GLOBAL_OBJECT, "allocateArguments", methodDescriptor(ScriptObject.class, Object[].class, Object.class, int.class));
4323    }
4324
4325    private MethodEmitter globalNewRegExp() {
4326        return method.invokestatic(GLOBAL_OBJECT, "newRegExp", methodDescriptor(Object.class, String.class, String.class));
4327    }
4328
4329    private MethodEmitter globalRegExpCopy() {
4330        return method.invokestatic(GLOBAL_OBJECT, "regExpCopy", methodDescriptor(Object.class, Object.class));
4331    }
4332
4333    private MethodEmitter globalAllocateArray(final ArrayType type) {
4334        //make sure the native array is treated as an array type
4335        return method.invokestatic(GLOBAL_OBJECT, "allocate", "(" + type.getDescriptor() + ")Ljdk/nashorn/internal/objects/NativeArray;");
4336    }
4337
4338    private MethodEmitter globalIsEval() {
4339        return method.invokestatic(GLOBAL_OBJECT, "isEval", methodDescriptor(boolean.class, Object.class));
4340    }
4341
4342    private MethodEmitter globalReplaceLocationPropertyPlaceholder() {
4343        return method.invokestatic(GLOBAL_OBJECT, "replaceLocationPropertyPlaceholder", methodDescriptor(Object.class, Object.class, Object.class));
4344    }
4345
4346    private MethodEmitter globalCheckObjectCoercible() {
4347        return method.invokestatic(GLOBAL_OBJECT, "checkObjectCoercible", methodDescriptor(void.class, Object.class));
4348    }
4349
4350    private MethodEmitter globalDirectEval() {
4351        return method.invokestatic(GLOBAL_OBJECT, "directEval",
4352                methodDescriptor(Object.class, Object.class, Object.class, Object.class, Object.class, boolean.class));
4353    }
4354
4355    private abstract class OptimisticOperation {
4356        private final boolean isOptimistic;
4357        // expression and optimistic are the same reference
4358        private final Expression expression;
4359        private final Optimistic optimistic;
4360        private final TypeBounds resultBounds;
4361
4362        OptimisticOperation(final Optimistic optimistic, final TypeBounds resultBounds) {
4363            this.optimistic = optimistic;
4364            this.expression = (Expression)optimistic;
4365            this.resultBounds = resultBounds;
4366            this.isOptimistic = isOptimistic(optimistic) && useOptimisticTypes() &&
4367                    // Operation is only effectively optimistic if its type, after being coerced into the result bounds
4368                    // is narrower than the upper bound.
4369                    resultBounds.within(Type.generic(((Expression)optimistic).getType())).narrowerThan(resultBounds.widest);
4370        }
4371
4372        MethodEmitter emit() {
4373            return emit(0);
4374        }
4375
4376        MethodEmitter emit(final int ignoredArgCount) {
4377            final int     programPoint                  = optimistic.getProgramPoint();
4378            final boolean optimisticOrContinuation      = isOptimistic || isContinuationEntryPoint(programPoint);
4379            final boolean currentContinuationEntryPoint = isCurrentContinuationEntryPoint(programPoint);
4380            final int     stackSizeOnEntry              = method.getStackSize() - ignoredArgCount;
4381
4382            // First store the values on the stack opportunistically into local variables. Doing it before loadStack()
4383            // allows us to not have to pop/load any arguments that are pushed onto it by loadStack() in the second
4384            // storeStack().
4385            storeStack(ignoredArgCount, optimisticOrContinuation);
4386
4387            // Now, load the stack
4388            loadStack();
4389
4390            // Now store the values on the stack ultimately into local variables. In vast majority of cases, this is
4391            // (aside from creating the local types map) a no-op, as the first opportunistic stack store will already
4392            // store all variables. However, there can be operations in the loadStack() that invalidate some of the
4393            // stack stores, e.g. in "x[i] = x[++i]", "++i" will invalidate the already stored value for "i". In such
4394            // unfortunate cases this second storeStack() will restore the invariant that everything on the stack is
4395            // stored into a local variable, although at the cost of doing a store/load on the loaded arguments as well.
4396            final int liveLocalsCount = storeStack(method.getStackSize() - stackSizeOnEntry, optimisticOrContinuation);
4397            assert optimisticOrContinuation == (liveLocalsCount != -1);
4398
4399            final Label beginTry;
4400            final Label catchLabel;
4401            final Label afterConsumeStack = isOptimistic || currentContinuationEntryPoint ? new Label("after_consume_stack") : null;
4402            if(isOptimistic) {
4403                beginTry = new Label("try_optimistic");
4404                final String catchLabelName = (afterConsumeStack == null ? "" : afterConsumeStack.toString()) + "_handler";
4405                catchLabel = new Label(catchLabelName);
4406                method.label(beginTry);
4407            } else {
4408                beginTry = catchLabel = null;
4409            }
4410
4411            consumeStack();
4412
4413            if(isOptimistic) {
4414                method._try(beginTry, afterConsumeStack, catchLabel, UnwarrantedOptimismException.class);
4415            }
4416
4417            if(isOptimistic || currentContinuationEntryPoint) {
4418                method.label(afterConsumeStack);
4419
4420                final int[] localLoads = method.getLocalLoadsOnStack(0, stackSizeOnEntry);
4421                assert everyStackValueIsLocalLoad(localLoads) : Arrays.toString(localLoads) + ", " + stackSizeOnEntry + ", " + ignoredArgCount;
4422                final List<Type> localTypesList = method.getLocalVariableTypes();
4423                final int usedLocals = method.getUsedSlotsWithLiveTemporaries();
4424                final List<Type> localTypes = method.getWidestLiveLocals(localTypesList.subList(0, usedLocals));
4425                assert everyLocalLoadIsValid(localLoads, usedLocals) : Arrays.toString(localLoads) + " ~ " + localTypes;
4426
4427                if(isOptimistic) {
4428                    addUnwarrantedOptimismHandlerLabel(localTypes, catchLabel);
4429                }
4430                if(currentContinuationEntryPoint) {
4431                    final ContinuationInfo ci = getContinuationInfo();
4432                    assert ci != null : "no continuation info found for " + lc.getCurrentFunction();
4433                    assert !ci.hasTargetLabel(); // No duplicate program points
4434                    ci.setTargetLabel(afterConsumeStack);
4435                    ci.getHandlerLabel().markAsOptimisticContinuationHandlerFor(afterConsumeStack);
4436                    // Can't rely on targetLabel.stack.localVariableTypes.length, as it can be higher due to effectively
4437                    // dead local variables.
4438                    ci.lvarCount = localTypes.size();
4439                    ci.setStackStoreSpec(localLoads);
4440                    ci.setStackTypes(Arrays.copyOf(method.getTypesFromStack(method.getStackSize()), stackSizeOnEntry));
4441                    assert ci.getStackStoreSpec().length == ci.getStackTypes().length;
4442                    ci.setReturnValueType(method.peekType());
4443                    ci.lineNumber = getLastLineNumber();
4444                    ci.catchLabel = catchLabels.peek();
4445                }
4446            }
4447            return method;
4448        }
4449
4450        /**
4451         * Stores the current contents of the stack into local variables so they are not lost before invoking something that
4452         * can result in an {@code UnwarantedOptimizationException}.
4453         * @param ignoreArgCount the number of topmost arguments on stack to ignore when deciding on the shape of the catch
4454         * block. Those are used in the situations when we could not place the call to {@code storeStack} early enough
4455         * (before emitting code for pushing the arguments that the optimistic call will pop). This is admittedly a
4456         * deficiency in the design of the code generator when it deals with self-assignments and we should probably look
4457         * into fixing it.
4458         * @return types of the significant local variables after the stack was stored (types for local variables used
4459         * for temporary storage of ignored arguments are not returned).
4460         * @param optimisticOrContinuation if false, this method should not execute
4461         * a label for a catch block for the {@code UnwarantedOptimizationException}, suitable for capturing the
4462         * currently live local variables, tailored to their types.
4463         */
4464        private int storeStack(final int ignoreArgCount, final boolean optimisticOrContinuation) {
4465            if(!optimisticOrContinuation) {
4466                return -1; // NOTE: correct value to return is lc.getUsedSlotCount(), but it wouldn't be used anyway
4467            }
4468
4469            final int stackSize = method.getStackSize();
4470            final Type[] stackTypes = method.getTypesFromStack(stackSize);
4471            final int[] localLoadsOnStack = method.getLocalLoadsOnStack(0, stackSize);
4472            final int usedSlots = method.getUsedSlotsWithLiveTemporaries();
4473
4474            final int firstIgnored = stackSize - ignoreArgCount;
4475            // Find the first value on the stack (from the bottom) that is not a load from a local variable.
4476            int firstNonLoad = 0;
4477            while(firstNonLoad < firstIgnored && localLoadsOnStack[firstNonLoad] != Label.Stack.NON_LOAD) {
4478                firstNonLoad++;
4479            }
4480
4481            // Only do the store/load if first non-load is not an ignored argument. Otherwise, do nothing and return
4482            // the number of used slots as the number of live local variables.
4483            if(firstNonLoad >= firstIgnored) {
4484                return usedSlots;
4485            }
4486
4487            // Find the number of new temporary local variables that we need; it's the number of values on the stack that
4488            // are not direct loads of existing local variables.
4489            int tempSlotsNeeded = 0;
4490            for(int i = firstNonLoad; i < stackSize; ++i) {
4491                if(localLoadsOnStack[i] == Label.Stack.NON_LOAD) {
4492                    tempSlotsNeeded += stackTypes[i].getSlots();
4493                }
4494            }
4495
4496            // Ensure all values on the stack that weren't directly loaded from a local variable are stored in a local
4497            // variable. We're starting from highest local variable index, so that in case ignoreArgCount > 0 the ignored
4498            // ones end up at the end of the local variable table.
4499            int lastTempSlot = usedSlots + tempSlotsNeeded;
4500            int ignoreSlotCount = 0;
4501            for(int i = stackSize; i -- > firstNonLoad;) {
4502                final int loadSlot = localLoadsOnStack[i];
4503                if(loadSlot == Label.Stack.NON_LOAD) {
4504                    final Type type = stackTypes[i];
4505                    final int slots = type.getSlots();
4506                    lastTempSlot -= slots;
4507                    if(i >= firstIgnored) {
4508                        ignoreSlotCount += slots;
4509                    }
4510                    method.storeTemp(type, lastTempSlot);
4511                } else {
4512                    method.pop();
4513                }
4514            }
4515            assert lastTempSlot == usedSlots; // used all temporary locals
4516
4517            final List<Type> localTypesList = method.getLocalVariableTypes();
4518
4519            // Load values back on stack.
4520            for(int i = firstNonLoad; i < stackSize; ++i) {
4521                final int loadSlot = localLoadsOnStack[i];
4522                final Type stackType = stackTypes[i];
4523                final boolean isLoad = loadSlot != Label.Stack.NON_LOAD;
4524                final int lvarSlot = isLoad ? loadSlot : lastTempSlot;
4525                final Type lvarType = localTypesList.get(lvarSlot);
4526                method.load(lvarType, lvarSlot);
4527                if(isLoad) {
4528                    // Conversion operators (I2L etc.) preserve "load"-ness of the value despite the fact that, in the
4529                    // strict sense they are creating a derived value from the loaded value. This special behavior of
4530                    // on-stack conversion operators is necessary to accommodate for differences in local variable types
4531                    // after deoptimization; having a conversion operator throw away "load"-ness would create different
4532                    // local variable table shapes between optimism-failed code and its deoptimized rest-of method).
4533                    // After we load the value back, we need to redo the conversion to the stack type if stack type is
4534                    // different.
4535                    // NOTE: this would only strictly be necessary for widening conversions (I2L, L2D, I2D), and not for
4536                    // narrowing ones (L2I, D2L, D2I) as only widening conversions are the ones that can get eliminated
4537                    // in a deoptimized method, as their original input argument got widened. Maybe experiment with
4538                    // throwing away "load"-ness for narrowing conversions in MethodEmitter.convert()?
4539                    method.convert(stackType);
4540                } else {
4541                    // temporary stores never needs a convert, as their type is always the same as the stack type.
4542                    assert lvarType == stackType;
4543                    lastTempSlot += lvarType.getSlots();
4544                }
4545            }
4546            // used all temporaries
4547            assert lastTempSlot == usedSlots + tempSlotsNeeded;
4548
4549            return lastTempSlot - ignoreSlotCount;
4550        }
4551
4552        private void addUnwarrantedOptimismHandlerLabel(final List<Type> localTypes, final Label label) {
4553            final String lvarTypesDescriptor = getLvarTypesDescriptor(localTypes);
4554            final Map<String, Collection<Label>> unwarrantedOptimismHandlers = lc.getUnwarrantedOptimismHandlers();
4555            Collection<Label> labels = unwarrantedOptimismHandlers.get(lvarTypesDescriptor);
4556            if(labels == null) {
4557                labels = new LinkedList<>();
4558                unwarrantedOptimismHandlers.put(lvarTypesDescriptor, labels);
4559            }
4560            method.markLabelAsOptimisticCatchHandler(label, localTypes.size());
4561            labels.add(label);
4562        }
4563
4564        abstract void loadStack();
4565
4566        // Make sure that whatever indy call site you emit from this method uses {@code getCallSiteFlagsOptimistic(node)}
4567        // or otherwise ensure optimistic flag is correctly set in the call site, otherwise it doesn't make much sense
4568        // to use OptimisticExpression for emitting it.
4569        abstract void consumeStack();
4570
4571        /**
4572         * Emits the correct dynamic getter code. Normally just delegates to method emitter, except when the target
4573         * expression is optimistic, and the desired type is narrower than the optimistic type. In that case, it'll emit a
4574         * dynamic getter with its original optimistic type, and explicitly insert a narrowing conversion. This way we can
4575         * preserve the optimism of the values even if they're subsequently immediately coerced into a narrower type. This
4576         * is beneficial because in this case we can still presume that since the original getter was optimistic, the
4577         * conversion has no side effects.
4578         * @param name the name of the property being get
4579         * @param flags call site flags
4580         * @param isMethod whether we're preferrably retrieving a function
4581         * @return the current method emitter
4582         */
4583        MethodEmitter dynamicGet(final String name, final int flags, final boolean isMethod) {
4584            if(isOptimistic) {
4585                return method.dynamicGet(getOptimisticCoercedType(), name, getOptimisticFlags(flags), isMethod);
4586            }
4587            return method.dynamicGet(resultBounds.within(expression.getType()), name, nonOptimisticFlags(flags), isMethod);
4588        }
4589
4590        MethodEmitter dynamicGetIndex(final int flags, final boolean isMethod) {
4591            if(isOptimistic) {
4592                return method.dynamicGetIndex(getOptimisticCoercedType(), getOptimisticFlags(flags), isMethod);
4593            }
4594            return method.dynamicGetIndex(resultBounds.within(expression.getType()), nonOptimisticFlags(flags), isMethod);
4595        }
4596
4597        MethodEmitter dynamicCall(final int argCount, final int flags) {
4598            if (isOptimistic) {
4599                return method.dynamicCall(getOptimisticCoercedType(), argCount, getOptimisticFlags(flags));
4600            }
4601            return method.dynamicCall(resultBounds.within(expression.getType()), argCount, nonOptimisticFlags(flags));
4602        }
4603
4604        int getOptimisticFlags(final int flags) {
4605            return flags | CALLSITE_OPTIMISTIC | (optimistic.getProgramPoint() << CALLSITE_PROGRAM_POINT_SHIFT); //encode program point in high bits
4606        }
4607
4608        int getProgramPoint() {
4609            return isOptimistic ? optimistic.getProgramPoint() : INVALID_PROGRAM_POINT;
4610        }
4611
4612        void convertOptimisticReturnValue() {
4613            if (isOptimistic) {
4614                final Type optimisticType = getOptimisticCoercedType();
4615                if(!optimisticType.isObject()) {
4616                    method.load(optimistic.getProgramPoint());
4617                    if(optimisticType.isInteger()) {
4618                        method.invoke(ENSURE_INT);
4619                    } else if(optimisticType.isLong()) {
4620                        method.invoke(ENSURE_LONG);
4621                    } else if(optimisticType.isNumber()) {
4622                        method.invoke(ENSURE_NUMBER);
4623                    } else {
4624                        throw new AssertionError(optimisticType);
4625                    }
4626                }
4627            }
4628        }
4629
4630        void replaceCompileTimeProperty() {
4631            final IdentNode identNode = (IdentNode)expression;
4632            final String name = identNode.getSymbol().getName();
4633            if (CompilerConstants.__FILE__.name().equals(name)) {
4634                replaceCompileTimeProperty(getCurrentSource().getName());
4635            } else if (CompilerConstants.__DIR__.name().equals(name)) {
4636                replaceCompileTimeProperty(getCurrentSource().getBase());
4637            } else if (CompilerConstants.__LINE__.name().equals(name)) {
4638                replaceCompileTimeProperty(getCurrentSource().getLine(identNode.position()));
4639            }
4640        }
4641
4642        /**
4643         * When an ident with name __FILE__, __DIR__, or __LINE__ is loaded, we'll try to look it up as any other
4644         * identifier. However, if it gets all the way up to the Global object, it will send back a special value that
4645         * represents a placeholder for these compile-time location properties. This method will generate code that loads
4646         * the value of the compile-time location property and then invokes a method in Global that will replace the
4647         * placeholder with the value. Effectively, if the symbol for these properties is defined anywhere in the lexical
4648         * scope, they take precedence, but if they aren't, then they resolve to the compile-time location property.
4649         * @param propertyValue the actual value of the property
4650         */
4651        private void replaceCompileTimeProperty(final Object propertyValue) {
4652            assert method.peekType().isObject();
4653            if(propertyValue instanceof String || propertyValue == null) {
4654                method.load((String)propertyValue);
4655            } else if(propertyValue instanceof Integer) {
4656                method.load(((Integer)propertyValue).intValue());
4657                method.convert(Type.OBJECT);
4658            } else {
4659                throw new AssertionError();
4660            }
4661            globalReplaceLocationPropertyPlaceholder();
4662            convertOptimisticReturnValue();
4663        }
4664
4665        /**
4666         * Returns the type that should be used as the return type of the dynamic invocation that is emitted as the code
4667         * for the current optimistic operation. If the type bounds is exact boolean or narrower than the expression's
4668         * optimistic type, then the optimistic type is returned, otherwise the coercing type. Effectively, this method
4669         * allows for moving the coercion into the optimistic type when it won't adversely affect the optimistic
4670         * evaluation semantics, and for preserving the optimistic type and doing a separate coercion when it would
4671         * affect it.
4672         * @return
4673         */
4674        private Type getOptimisticCoercedType() {
4675            final Type optimisticType = expression.getType();
4676            assert resultBounds.widest.widerThan(optimisticType);
4677            final Type narrowest = resultBounds.narrowest;
4678
4679            if(narrowest.isBoolean() || narrowest.narrowerThan(optimisticType)) {
4680                assert !optimisticType.isObject();
4681                return optimisticType;
4682            }
4683            assert !narrowest.isObject();
4684            return narrowest;
4685        }
4686    }
4687
4688    private static boolean isOptimistic(final Optimistic optimistic) {
4689        if(!optimistic.canBeOptimistic()) {
4690            return false;
4691        }
4692        final Expression expr = (Expression)optimistic;
4693        return expr.getType().narrowerThan(expr.getWidestOperationType());
4694    }
4695
4696    private static boolean everyLocalLoadIsValid(final int[] loads, final int localCount) {
4697        for (final int load : loads) {
4698            if(load < 0 || load >= localCount) {
4699                return false;
4700            }
4701        }
4702        return true;
4703    }
4704
4705    private static boolean everyStackValueIsLocalLoad(final int[] loads) {
4706        for (final int load : loads) {
4707            if(load == Label.Stack.NON_LOAD) {
4708                return false;
4709            }
4710        }
4711        return true;
4712    }
4713
4714    private String getLvarTypesDescriptor(final List<Type> localVarTypes) {
4715        final int count = localVarTypes.size();
4716        final StringBuilder desc = new StringBuilder(count);
4717        for(int i = 0; i < count;) {
4718            i += appendType(desc, localVarTypes.get(i));
4719        }
4720        return method.markSymbolBoundariesInLvarTypesDescriptor(desc.toString());
4721    }
4722
4723    private static int appendType(final StringBuilder b, final Type t) {
4724        b.append(t.getBytecodeStackType());
4725        return t.getSlots();
4726    }
4727
4728    private static int countSymbolsInLvarTypeDescriptor(final String lvarTypeDescriptor) {
4729        int count = 0;
4730        for(int i = 0; i < lvarTypeDescriptor.length(); ++i) {
4731            if(Character.isUpperCase(lvarTypeDescriptor.charAt(i))) {
4732                ++count;
4733            }
4734        }
4735        return count;
4736
4737    }
4738    /**
4739     * Generates all the required {@code UnwarrantedOptimismException} handlers for the current function. The employed
4740     * strategy strives to maximize code reuse. Every handler constructs an array to hold the local variables, then
4741     * fills in some trailing part of the local variables (those for which it has a unique suffix in the descriptor),
4742     * then jumps to a handler for a prefix that's shared with other handlers. A handler that fills up locals up to
4743     * position 0 will not jump to a prefix handler (as it has no prefix), but instead end with constructing and
4744     * throwing a {@code RewriteException}. Since we lexicographically sort the entries, we only need to check every
4745     * entry to its immediately preceding one for longest matching prefix.
4746     * @return true if there is at least one exception handler
4747     */
4748    private boolean generateUnwarrantedOptimismExceptionHandlers(final FunctionNode fn) {
4749        if(!useOptimisticTypes()) {
4750            return false;
4751        }
4752
4753        // Take the mapping of lvarSpecs -> labels, and turn them into a descending lexicographically sorted list of
4754        // handler specifications.
4755        final Map<String, Collection<Label>> unwarrantedOptimismHandlers = lc.popUnwarrantedOptimismHandlers();
4756        if(unwarrantedOptimismHandlers.isEmpty()) {
4757            return false;
4758        }
4759
4760        method.lineNumber(0);
4761
4762        final List<OptimismExceptionHandlerSpec> handlerSpecs = new ArrayList<>(unwarrantedOptimismHandlers.size() * 4/3);
4763        for(final String spec: unwarrantedOptimismHandlers.keySet()) {
4764            handlerSpecs.add(new OptimismExceptionHandlerSpec(spec, true));
4765        }
4766        Collections.sort(handlerSpecs, Collections.reverseOrder());
4767
4768        // Map of local variable specifications to labels for populating the array for that local variable spec.
4769        final Map<String, Label> delegationLabels = new HashMap<>();
4770
4771        // Do everything in a single pass over the handlerSpecs list. Note that the list can actually grow as we're
4772        // passing through it as we might add new prefix handlers into it, so can't hoist size() outside of the loop.
4773        for(int handlerIndex = 0; handlerIndex < handlerSpecs.size(); ++handlerIndex) {
4774            final OptimismExceptionHandlerSpec spec = handlerSpecs.get(handlerIndex);
4775            final String lvarSpec = spec.lvarSpec;
4776            if(spec.catchTarget) {
4777                assert !method.isReachable();
4778                // Start a catch block and assign the labels for this lvarSpec with it.
4779                method._catch(unwarrantedOptimismHandlers.get(lvarSpec));
4780                // This spec is a catch target, so emit array creation code. The length of the array is the number of
4781                // symbols - the number of uppercase characters.
4782                method.load(countSymbolsInLvarTypeDescriptor(lvarSpec));
4783                method.newarray(Type.OBJECT_ARRAY);
4784            }
4785            if(spec.delegationTarget) {
4786                // If another handler can delegate to this handler as its prefix, then put a jump target here for the
4787                // shared code (after the array creation code, which is never shared).
4788                method.label(delegationLabels.get(lvarSpec)); // label must exist
4789            }
4790
4791            final boolean lastHandler = handlerIndex == handlerSpecs.size() - 1;
4792
4793            int lvarIndex;
4794            final int firstArrayIndex;
4795            final int firstLvarIndex;
4796            Label delegationLabel;
4797            final String commonLvarSpec;
4798            if(lastHandler) {
4799                // Last handler block, doesn't delegate to anything.
4800                lvarIndex = 0;
4801                firstLvarIndex = 0;
4802                firstArrayIndex = 0;
4803                delegationLabel = null;
4804                commonLvarSpec = null;
4805            } else {
4806                // Not yet the last handler block, will definitely delegate to another handler; let's figure out which
4807                // one. It can be an already declared handler further down the list, or it might need to declare a new
4808                // prefix handler.
4809
4810                // Since we're lexicographically ordered, the common prefix handler is defined by the common prefix of
4811                // this handler and the next handler on the list.
4812                final int nextHandlerIndex = handlerIndex + 1;
4813                final String nextLvarSpec = handlerSpecs.get(nextHandlerIndex).lvarSpec;
4814                commonLvarSpec = commonPrefix(lvarSpec, nextLvarSpec);
4815                // We don't chop symbols in half
4816                assert Character.isUpperCase(commonLvarSpec.charAt(commonLvarSpec.length() - 1));
4817
4818                // Let's find if we already have a declaration for such handler, or we need to insert it.
4819                {
4820                    boolean addNewHandler = true;
4821                    int commonHandlerIndex = nextHandlerIndex;
4822                    for(; commonHandlerIndex < handlerSpecs.size(); ++commonHandlerIndex) {
4823                        final OptimismExceptionHandlerSpec forwardHandlerSpec = handlerSpecs.get(commonHandlerIndex);
4824                        final String forwardLvarSpec = forwardHandlerSpec.lvarSpec;
4825                        if(forwardLvarSpec.equals(commonLvarSpec)) {
4826                            // We already have a handler for the common prefix.
4827                            addNewHandler = false;
4828                            // Make sure we mark it as a delegation target.
4829                            forwardHandlerSpec.delegationTarget = true;
4830                            break;
4831                        } else if(!forwardLvarSpec.startsWith(commonLvarSpec)) {
4832                            break;
4833                        }
4834                    }
4835                    if(addNewHandler) {
4836                        // We need to insert a common prefix handler. Note handlers created with catchTarget == false
4837                        // will automatically have delegationTarget == true (because that's the only reason for their
4838                        // existence).
4839                        handlerSpecs.add(commonHandlerIndex, new OptimismExceptionHandlerSpec(commonLvarSpec, false));
4840                    }
4841                }
4842
4843                firstArrayIndex = countSymbolsInLvarTypeDescriptor(commonLvarSpec);
4844                lvarIndex = 0;
4845                for(int j = 0; j < commonLvarSpec.length(); ++j) {
4846                    lvarIndex += CodeGeneratorLexicalContext.getTypeForSlotDescriptor(commonLvarSpec.charAt(j)).getSlots();
4847                }
4848                firstLvarIndex = lvarIndex;
4849
4850                // Create a delegation label if not already present
4851                delegationLabel = delegationLabels.get(commonLvarSpec);
4852                if(delegationLabel == null) {
4853                    // uo_pa == "unwarranted optimism, populate array"
4854                    delegationLabel = new Label("uo_pa_" + commonLvarSpec);
4855                    delegationLabels.put(commonLvarSpec, delegationLabel);
4856                }
4857            }
4858
4859            // Load local variables handled by this handler on stack
4860            int args = 0;
4861            boolean symbolHadValue = false;
4862            for(int typeIndex = commonLvarSpec == null ? 0 : commonLvarSpec.length(); typeIndex < lvarSpec.length(); ++typeIndex) {
4863                final char typeDesc = lvarSpec.charAt(typeIndex);
4864                final Type lvarType = CodeGeneratorLexicalContext.getTypeForSlotDescriptor(typeDesc);
4865                if (!lvarType.isUnknown()) {
4866                    method.load(lvarType, lvarIndex);
4867                    symbolHadValue = true;
4868                    args++;
4869                } else if(typeDesc == 'U' && !symbolHadValue) {
4870                    // Symbol boundary with undefined last value. Check if all previous values for this symbol were also
4871                    // undefined; if so, emit one explicit Undefined. This serves to ensure that we're emiting exactly
4872                    // one value for every symbol that uses local slots. While we could in theory ignore symbols that
4873                    // are undefined (in other words, dead) at the point where this exception was thrown, unfortunately
4874                    // we can't do it in practice. The reason for this is that currently our liveness analysis is
4875                    // coarse (it can determine whether a symbol has not been read with a particular type anywhere in
4876                    // the function being compiled, but that's it), and a symbol being promoted to Object due to a
4877                    // deoptimization will suddenly show up as "live for Object type", and previously dead U->O
4878                    // conversions on loop entries will suddenly become alive in the deoptimized method which will then
4879                    // expect a value for that slot in its continuation handler. If we had precise liveness analysis, we
4880                    // could go back to excluding known dead symbols from the payload of the RewriteException.
4881                    if(method.peekType() == Type.UNDEFINED) {
4882                        method.dup();
4883                    } else {
4884                        method.loadUndefined(Type.OBJECT);
4885                    }
4886                    args++;
4887                }
4888                if(Character.isUpperCase(typeDesc)) {
4889                    // Reached symbol boundary; reset flag for the next symbol.
4890                    symbolHadValue = false;
4891                }
4892                lvarIndex += lvarType.getSlots();
4893            }
4894            assert args > 0;
4895            // Delegate actual storing into array to an array populator utility method.
4896            //on the stack:
4897            // object array to be populated
4898            // start index
4899            // a lot of types
4900            method.dynamicArrayPopulatorCall(args + 1, firstArrayIndex);
4901            if(delegationLabel != null) {
4902                // We cascade to a prefix handler to fill out the rest of the local variables and throw the
4903                // RewriteException.
4904                assert !lastHandler;
4905                assert commonLvarSpec != null;
4906                // Must undefine the local variables that we have already processed for the sake of correct join on the
4907                // delegate label
4908                method.undefineLocalVariables(firstLvarIndex, true);
4909                final OptimismExceptionHandlerSpec nextSpec = handlerSpecs.get(handlerIndex + 1);
4910                // If the delegate immediately follows, and it's not a catch target (so it doesn't have array setup
4911                // code) don't bother emitting a jump, as we'd just jump to the next instruction.
4912                if(!nextSpec.lvarSpec.equals(commonLvarSpec) || nextSpec.catchTarget) {
4913                    method._goto(delegationLabel);
4914                }
4915            } else {
4916                assert lastHandler;
4917                // Nothing to delegate to, so this handler must create and throw the RewriteException.
4918                // At this point we have the UnwarrantedOptimismException and the Object[] with local variables on
4919                // stack. We need to create a RewriteException, push two references to it below the constructor
4920                // arguments, invoke the constructor, and throw the exception.
4921                loadConstant(getByteCodeSymbolNames(fn));
4922                if (isRestOf()) {
4923                    loadConstant(getContinuationEntryPoints());
4924                    method.invoke(CREATE_REWRITE_EXCEPTION_REST_OF);
4925                } else {
4926                    method.invoke(CREATE_REWRITE_EXCEPTION);
4927                }
4928                method.athrow();
4929            }
4930        }
4931        return true;
4932    }
4933
4934    private static String[] getByteCodeSymbolNames(final FunctionNode fn) {
4935        // Only names of local variables on the function level are captured. This information is used to reduce
4936        // deoptimizations, so as much as we can capture will help. We rely on the fact that function wide variables are
4937        // all live all the time, so the array passed to rewrite exception contains one element for every slotted symbol
4938        // here.
4939        final List<String> names = new ArrayList<>();
4940        for (final Symbol symbol: fn.getBody().getSymbols()) {
4941            if (symbol.hasSlot()) {
4942                if (symbol.isScope()) {
4943                    // slot + scope can only be true for parameters
4944                    assert symbol.isParam();
4945                    names.add(null);
4946                } else {
4947                    names.add(symbol.getName());
4948                }
4949            }
4950        }
4951        return names.toArray(new String[names.size()]);
4952    }
4953
4954    private static String commonPrefix(final String s1, final String s2) {
4955        final int l1 = s1.length();
4956        final int l = Math.min(l1, s2.length());
4957        int lms = -1; // last matching symbol
4958        for(int i = 0; i < l; ++i) {
4959            final char c1 = s1.charAt(i);
4960            if(c1 != s2.charAt(i)) {
4961                return s1.substring(0, lms + 1);
4962            } else if(Character.isUpperCase(c1)) {
4963                lms = i;
4964            }
4965        }
4966        return l == l1 ? s1 : s2;
4967    }
4968
4969    private static class OptimismExceptionHandlerSpec implements Comparable<OptimismExceptionHandlerSpec> {
4970        private final String lvarSpec;
4971        private final boolean catchTarget;
4972        private boolean delegationTarget;
4973
4974        OptimismExceptionHandlerSpec(final String lvarSpec, final boolean catchTarget) {
4975            this.lvarSpec = lvarSpec;
4976            this.catchTarget = catchTarget;
4977            if(!catchTarget) {
4978                delegationTarget = true;
4979            }
4980        }
4981
4982        @Override
4983        public int compareTo(final OptimismExceptionHandlerSpec o) {
4984            return lvarSpec.compareTo(o.lvarSpec);
4985        }
4986
4987        @Override
4988        public String toString() {
4989            final StringBuilder b = new StringBuilder(64).append("[HandlerSpec ").append(lvarSpec);
4990            if(catchTarget) {
4991                b.append(", catchTarget");
4992            }
4993            if(delegationTarget) {
4994                b.append(", delegationTarget");
4995            }
4996            return b.append("]").toString();
4997        }
4998    }
4999
5000    private static class ContinuationInfo {
5001        private final Label handlerLabel;
5002        private Label targetLabel; // Label for the target instruction.
5003        int lvarCount;
5004        // Indices of local variables that need to be loaded on the stack when this node completes
5005        private int[] stackStoreSpec;
5006        // Types of values loaded on the stack
5007        private Type[] stackTypes;
5008        // If non-null, this node should perform the requisite type conversion
5009        private Type returnValueType;
5010        // If we are in the middle of an object literal initialization, we need to update the map
5011        private PropertyMap objectLiteralMap;
5012        // Object literal stack depth for object literal - not necessarly top if property is a tree
5013        private int objectLiteralStackDepth = -1;
5014        // The line number at the continuation point
5015        private int lineNumber;
5016        // The active catch label, in case the continuation point is in a try/catch block
5017        private Label catchLabel;
5018        // The number of scopes that need to be popped before control is transferred to the catch label.
5019        private int exceptionScopePops;
5020
5021        ContinuationInfo() {
5022            this.handlerLabel = new Label("continuation_handler");
5023        }
5024
5025        Label getHandlerLabel() {
5026            return handlerLabel;
5027        }
5028
5029        boolean hasTargetLabel() {
5030            return targetLabel != null;
5031        }
5032
5033        Label getTargetLabel() {
5034            return targetLabel;
5035        }
5036
5037        void setTargetLabel(final Label targetLabel) {
5038            this.targetLabel = targetLabel;
5039        }
5040
5041        int[] getStackStoreSpec() {
5042            return stackStoreSpec.clone();
5043        }
5044
5045        void setStackStoreSpec(final int[] stackStoreSpec) {
5046            this.stackStoreSpec = stackStoreSpec;
5047        }
5048
5049        Type[] getStackTypes() {
5050            return stackTypes.clone();
5051        }
5052
5053        void setStackTypes(final Type[] stackTypes) {
5054            this.stackTypes = stackTypes;
5055        }
5056
5057        Type getReturnValueType() {
5058            return returnValueType;
5059        }
5060
5061        void setReturnValueType(final Type returnValueType) {
5062            this.returnValueType = returnValueType;
5063        }
5064
5065        int getObjectLiteralStackDepth() {
5066            return objectLiteralStackDepth;
5067        }
5068
5069        void setObjectLiteralStackDepth(final int objectLiteralStackDepth) {
5070            this.objectLiteralStackDepth = objectLiteralStackDepth;
5071        }
5072
5073        PropertyMap getObjectLiteralMap() {
5074            return objectLiteralMap;
5075        }
5076
5077        void setObjectLiteralMap(final PropertyMap objectLiteralMap) {
5078            this.objectLiteralMap = objectLiteralMap;
5079        }
5080
5081        @Override
5082        public String toString() {
5083             return "[localVariableTypes=" + targetLabel.getStack().getLocalVariableTypesCopy() + ", stackStoreSpec=" +
5084                     Arrays.toString(stackStoreSpec) + ", returnValueType=" + returnValueType + "]";
5085        }
5086    }
5087
5088    private ContinuationInfo getContinuationInfo() {
5089        return fnIdToContinuationInfo.get(lc.getCurrentFunction().getId());
5090    }
5091
5092    private void generateContinuationHandler() {
5093        if (!isRestOf()) {
5094            return;
5095        }
5096
5097        final ContinuationInfo ci = getContinuationInfo();
5098        method.label(ci.getHandlerLabel());
5099
5100        // There should never be an exception thrown from the continuation handler, but in case there is (meaning,
5101        // Nashorn has a bug), then line number 0 will be an indication of where it came from (line numbers are Uint16).
5102        method.lineNumber(0);
5103
5104        final Label.Stack stack = ci.getTargetLabel().getStack();
5105        final List<Type> lvarTypes = stack.getLocalVariableTypesCopy();
5106        final BitSet symbolBoundary = stack.getSymbolBoundaryCopy();
5107        final int lvarCount = ci.lvarCount;
5108
5109        final Type rewriteExceptionType = Type.typeFor(RewriteException.class);
5110        // Store the RewriteException into an unused local variable slot.
5111        method.load(rewriteExceptionType, 0);
5112        method.storeTemp(rewriteExceptionType, lvarCount);
5113        // Get local variable array
5114        method.load(rewriteExceptionType, 0);
5115        method.invoke(RewriteException.GET_BYTECODE_SLOTS);
5116        // Store local variables. Note that deoptimization might introduce new value types for existing local variables,
5117        // so we must use both liveLocals and symbolBoundary, as in some cases (when the continuation is inside of a try
5118        // block) we need to store the incoming value into multiple slots. The optimism exception handlers will have
5119        // exactly one array element for every symbol that uses bytecode storage. If in the originating method the value
5120        // was undefined, there will be an explicit Undefined value in the array.
5121        int arrayIndex = 0;
5122        for(int lvarIndex = 0; lvarIndex < lvarCount;) {
5123            final Type lvarType = lvarTypes.get(lvarIndex);
5124            if(!lvarType.isUnknown()) {
5125                method.dup();
5126                method.load(arrayIndex).arrayload();
5127                final Class<?> typeClass = lvarType.getTypeClass();
5128                // Deoptimization in array initializers can cause arrays to undergo component type widening
5129                if(typeClass == long[].class) {
5130                    method.load(rewriteExceptionType, lvarCount);
5131                    method.invoke(RewriteException.TO_LONG_ARRAY);
5132                } else if(typeClass == double[].class) {
5133                    method.load(rewriteExceptionType, lvarCount);
5134                    method.invoke(RewriteException.TO_DOUBLE_ARRAY);
5135                } else if(typeClass == Object[].class) {
5136                    method.load(rewriteExceptionType, lvarCount);
5137                    method.invoke(RewriteException.TO_OBJECT_ARRAY);
5138                } else {
5139                    if(!(typeClass.isPrimitive() || typeClass == Object.class)) {
5140                        // NOTE: this can only happen with dead stores. E.g. for the program "1; []; f();" in which the
5141                        // call to f() will deoptimize the call site, but it'll expect :return to have the type
5142                        // NativeArray. However, in the more optimal version, :return's only live type is int, therefore
5143                        // "{O}:return = []" is a dead store, and the variable will be sent into the continuation as
5144                        // Undefined, however NativeArray can't hold Undefined instance.
5145                        method.loadType(Type.getInternalName(typeClass));
5146                        method.invoke(RewriteException.INSTANCE_OR_NULL);
5147                    }
5148                    method.convert(lvarType);
5149                }
5150                method.storeHidden(lvarType, lvarIndex, false);
5151            }
5152            final int nextLvarIndex = lvarIndex + lvarType.getSlots();
5153            if(symbolBoundary.get(nextLvarIndex - 1)) {
5154                ++arrayIndex;
5155            }
5156            lvarIndex = nextLvarIndex;
5157        }
5158        if (AssertsEnabled.assertsEnabled()) {
5159            method.load(arrayIndex);
5160            method.invoke(RewriteException.ASSERT_ARRAY_LENGTH);
5161        } else {
5162            method.pop();
5163        }
5164
5165        final int[]   stackStoreSpec = ci.getStackStoreSpec();
5166        final Type[]  stackTypes     = ci.getStackTypes();
5167        final boolean isStackEmpty   = stackStoreSpec.length == 0;
5168        boolean replacedObjectLiteralMap = false;
5169        if(!isStackEmpty) {
5170            // Load arguments on the stack
5171            final int objectLiteralStackDepth = ci.getObjectLiteralStackDepth();
5172            for(int i = 0; i < stackStoreSpec.length; ++i) {
5173                final int slot = stackStoreSpec[i];
5174                method.load(lvarTypes.get(slot), slot);
5175                method.convert(stackTypes[i]);
5176                // stack: s0=object literal being initialized
5177                // change map of s0 so that the property we are initilizing when we failed
5178                // is now ci.returnValueType
5179                if (i == objectLiteralStackDepth) {
5180                    method.dup();
5181                    assert ci.getObjectLiteralMap() != null;
5182                    assert ScriptObject.class.isAssignableFrom(method.peekType().getTypeClass()) : method.peekType().getTypeClass() + " is not a script object";
5183                    loadConstant(ci.getObjectLiteralMap());
5184                    method.invoke(ScriptObject.SET_MAP);
5185                    replacedObjectLiteralMap = true;
5186                }
5187            }
5188        }
5189        // Must have emitted the code for replacing the map of an object literal if we have a set object literal stack depth
5190        assert ci.getObjectLiteralStackDepth() == -1 || replacedObjectLiteralMap;
5191        // Load RewriteException back.
5192        method.load(rewriteExceptionType, lvarCount);
5193        // Get rid of the stored reference
5194        method.loadNull();
5195        method.storeHidden(Type.OBJECT, lvarCount);
5196        // Mark it dead
5197        method.markDeadSlots(lvarCount, Type.OBJECT.getSlots());
5198
5199        // Load return value on the stack
5200        method.invoke(RewriteException.GET_RETURN_VALUE);
5201
5202        final Type returnValueType = ci.getReturnValueType();
5203
5204        // Set up an exception handler for primitive type conversion of return value if needed
5205        boolean needsCatch = false;
5206        final Label targetCatchLabel = ci.catchLabel;
5207        Label _try = null;
5208        if(returnValueType.isPrimitive()) {
5209            // If the conversion throws an exception, we want to report the line number of the continuation point.
5210            method.lineNumber(ci.lineNumber);
5211
5212            if(targetCatchLabel != METHOD_BOUNDARY) {
5213                _try = new Label("");
5214                method.label(_try);
5215                needsCatch = true;
5216            }
5217        }
5218
5219        // Convert return value
5220        method.convert(returnValueType);
5221
5222        final int scopePopCount = needsCatch ? ci.exceptionScopePops : 0;
5223
5224        // Declare a try/catch for the conversion. If no scopes need to be popped until the target catch block, just
5225        // jump into it. Otherwise, we'll need to create a scope-popping catch block below.
5226        final Label catchLabel = scopePopCount > 0 ? new Label("") : targetCatchLabel;
5227        if(needsCatch) {
5228            final Label _end_try = new Label("");
5229            method.label(_end_try);
5230            method._try(_try, _end_try, catchLabel);
5231        }
5232
5233        // Jump to continuation point
5234        method._goto(ci.getTargetLabel());
5235
5236        // Make a scope-popping exception delegate if needed
5237        if(catchLabel != targetCatchLabel) {
5238            method.lineNumber(0);
5239            assert scopePopCount > 0;
5240            method._catch(catchLabel);
5241            popScopes(scopePopCount);
5242            method.uncheckedGoto(targetCatchLabel);
5243        }
5244    }
5245}
5246