bool writesOverlap(Graph& graph, Node* node, ClobberSet& writeSet)
{
NoOpClobberize addRead;
ClobberSetOverlaps addWrite(writeSet);
clobberize(graph, node, addRead, addWrite);
return addWrite.result();
}
bool readsOverlap(Graph& graph, Node* node, ClobberSet& readSet)
{
ClobberSetOverlaps addRead(readSet);
NoOpClobberize addWrite;
clobberize(graph, node, addRead, addWrite);
return addRead.result();
}
void addReadsAndWrites(Graph& graph, Node* node, ClobberSet& readSet, ClobberSet& writeSet)
{
ClobberSetAdd addRead(readSet);
ClobberSetAdd addWrite(writeSet);
clobberize(graph, node, addRead, addWrite);
}
void addWrites(Graph& graph, Node* node, ClobberSet& writeSet)
{
NoOpClobberize addRead;
ClobberSetAdd addWrite(writeSet);
clobberize(graph, node, addRead, addWrite);
}
void addReads(Graph& graph, Node* node, ClobberSet& readSet)
{
ClobberSetAdd addRead(readSet);
NoOpClobberize addWrite;
clobberize(graph, node, addRead, addWrite);
}
bool clobbersExitState(Graph& graph, Node* node)
{
// There are certain nodes whose effect on the exit state has nothing to do with what they
// normally clobber.
switch (node->op()) {
case MovHint:
case ZombieHint:
case PutHint:
case KillStack:
return true;
case SetLocal:
case PutStack:
// These nodes write to the stack, but they may only do so after we have already had a MovHint
// for the exact same value and the same stack location. Hence, they have no further effect on
// exit state.
return false;
case ArrayifyToStructure:
case Arrayify:
case NewObject:
case NewRegexp:
case NewStringObject:
case PhantomNewObject:
case MaterializeNewObject:
case PhantomNewFunction:
case PhantomNewGeneratorFunction:
case PhantomNewAsyncFunction:
case PhantomCreateActivation:
case MaterializeCreateActivation:
case CountExecution:
case StoreBarrier:
case FencedStoreBarrier:
case AllocatePropertyStorage:
case ReallocatePropertyStorage:
// These do clobber memory, but nothing that is observable. It may be nice to separate the
// heaps into those that are observable and those that aren't, but we don't do that right now.
// FIXME: https://bugs.webkit.org/show_bug.cgi?id=148440
return false;
case CreateActivation:
// Like above, but with the activation allocation caveat.
return node->castOperand<SymbolTable*>()->singletonScope()->isStillValid();
case NewFunction:
case NewGeneratorFunction:
case NewAsyncFunction:
// Like above, but with the JSFunction allocation caveat.
return node->castOperand<FunctionExecutable*>()->singletonFunction()->isStillValid();
default:
// For all other nodes, we just care about whether they write to something other than SideState.
bool result = false;
clobberize(
graph, node, NoOpClobberize(),
[&] (const AbstractHeap& heap) {
// There shouldn't be such a thing as a strict subtype of SideState. That's what allows
// us to use a fast != check, below.
ASSERT(!heap.isStrictSubtypeOf(SideState));
if (heap != SideState)
result = true;
},
NoOpClobberize());
return result;
}
}
