V8 API Reference, 7.2.502.16 (for Deno 0.2.4)
verifier.cc
1 // Copyright 2014 the V8 project authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file.
4 
5 #include "src/compiler/verifier.h"
6 
7 #include <algorithm>
8 #include <deque>
9 #include <queue>
10 #include <sstream>
11 #include <string>
12 
13 #include "src/bit-vector.h"
14 #include "src/compiler/all-nodes.h"
15 #include "src/compiler/common-operator.h"
16 #include "src/compiler/graph.h"
17 #include "src/compiler/js-operator.h"
18 #include "src/compiler/node-properties.h"
19 #include "src/compiler/node.h"
20 #include "src/compiler/opcodes.h"
21 #include "src/compiler/operator-properties.h"
22 #include "src/compiler/operator.h"
23 #include "src/compiler/schedule.h"
24 #include "src/compiler/simplified-operator.h"
25 #include "src/compiler/type-cache.h"
26 #include "src/ostreams.h"
27 
28 namespace v8 {
29 namespace internal {
30 namespace compiler {
31 
32 
33 class Verifier::Visitor {
34  public:
35  Visitor(Zone* z, Typing typed, CheckInputs check_inputs, CodeType code_type)
36  : zone(z),
37  typing(typed),
38  check_inputs(check_inputs),
39  code_type(code_type) {}
40 
41  void Check(Node* node, const AllNodes& all);
42 
43  Zone* zone;
44  Typing typing;
45  CheckInputs check_inputs;
46  CodeType code_type;
47 
48  private:
49  void CheckNotTyped(Node* node) {
50  if (NodeProperties::IsTyped(node)) {
51  std::ostringstream str;
52  str << "TypeError: node #" << node->id() << ":" << *node->op()
53  << " should never have a type";
54  FATAL("%s", str.str().c_str());
55  }
56  }
57  void CheckTypeIs(Node* node, Type type) {
58  if (typing == TYPED && !NodeProperties::GetType(node).Is(type)) {
59  std::ostringstream str;
60  str << "TypeError: node #" << node->id() << ":" << *node->op() << " type "
61  << NodeProperties::GetType(node) << " is not " << type;
62  FATAL("%s", str.str().c_str());
63  }
64  }
65  void CheckTypeMaybe(Node* node, Type type) {
66  if (typing == TYPED && !NodeProperties::GetType(node).Maybe(type)) {
67  std::ostringstream str;
68  str << "TypeError: node #" << node->id() << ":" << *node->op() << " type "
69  << NodeProperties::GetType(node) << " must intersect " << type;
70  FATAL("%s", str.str().c_str());
71  }
72  }
73  void CheckValueInputIs(Node* node, int i, Type type) {
74  Node* input = NodeProperties::GetValueInput(node, i);
75  if (typing == TYPED && !NodeProperties::GetType(input).Is(type)) {
76  std::ostringstream str;
77  str << "TypeError: node #" << node->id() << ":" << *node->op()
78  << "(input @" << i << " = " << input->opcode() << ":"
79  << input->op()->mnemonic() << ") type "
80  << NodeProperties::GetType(input) << " is not " << type;
81  FATAL("%s", str.str().c_str());
82  }
83  }
84  void CheckOutput(Node* node, Node* use, int count, const char* kind) {
85  if (count <= 0) {
86  std::ostringstream str;
87  str << "GraphError: node #" << node->id() << ":" << *node->op()
88  << " does not produce " << kind << " output used by node #"
89  << use->id() << ":" << *use->op();
90  FATAL("%s", str.str().c_str());
91  }
92  }
93 };
94 
95 void Verifier::Visitor::Check(Node* node, const AllNodes& all) {
96  int value_count = node->op()->ValueInputCount();
97  int context_count = OperatorProperties::GetContextInputCount(node->op());
98  int frame_state_count =
99  OperatorProperties::GetFrameStateInputCount(node->op());
100  int effect_count = node->op()->EffectInputCount();
101  int control_count = node->op()->ControlInputCount();
102 
103  // Verify number of inputs matches up.
104  int input_count = value_count + context_count + frame_state_count;
105  if (check_inputs == kAll) {
106  input_count += effect_count + control_count;
107  }
108  CHECK_EQ(input_count, node->InputCount());
109 
110  // If this node has any effect outputs, make sure that it is
111  // consumed as an effect input somewhere else.
112  // TODO(mvstanton): support this kind of verification for WASM
113  // compiles, too.
114  if (code_type != kWasm && node->op()->EffectOutputCount() > 0) {
115  int effect_edges = 0;
116  for (Edge edge : node->use_edges()) {
117  if (all.IsLive(edge.from()) && NodeProperties::IsEffectEdge(edge)) {
118  effect_edges++;
119  }
120  }
121  DCHECK_GT(effect_edges, 0);
122  }
123 
124  // Verify that frame state has been inserted for the nodes that need it.
125  for (int i = 0; i < frame_state_count; i++) {
126  Node* frame_state = NodeProperties::GetFrameStateInput(node);
127  CHECK(frame_state->opcode() == IrOpcode::kFrameState ||
128  // kFrameState uses Start as a sentinel.
129  (node->opcode() == IrOpcode::kFrameState &&
130  frame_state->opcode() == IrOpcode::kStart));
131  }
132 
133  // Verify all value inputs actually produce a value.
134  for (int i = 0; i < value_count; ++i) {
135  Node* value = NodeProperties::GetValueInput(node, i);
136  CheckOutput(value, node, value->op()->ValueOutputCount(), "value");
137  // Verify that only parameters and projections can have input nodes with
138  // multiple outputs.
139  CHECK(node->opcode() == IrOpcode::kParameter ||
140  node->opcode() == IrOpcode::kProjection ||
141  value->op()->ValueOutputCount() <= 1);
142  }
143 
144  // Verify all context inputs are value nodes.
145  for (int i = 0; i < context_count; ++i) {
146  Node* context = NodeProperties::GetContextInput(node);
147  CheckOutput(context, node, context->op()->ValueOutputCount(), "context");
148  }
149 
150  if (check_inputs == kAll) {
151  // Verify all effect inputs actually have an effect.
152  for (int i = 0; i < effect_count; ++i) {
153  Node* effect = NodeProperties::GetEffectInput(node);
154  CheckOutput(effect, node, effect->op()->EffectOutputCount(), "effect");
155  }
156 
157  // Verify all control inputs are control nodes.
158  for (int i = 0; i < control_count; ++i) {
159  Node* control = NodeProperties::GetControlInput(node, i);
160  CheckOutput(control, node, control->op()->ControlOutputCount(),
161  "control");
162  }
163 
164  // Verify that nodes that can throw either have both IfSuccess/IfException
165  // projections as the only control uses or no projections at all.
166  if (!node->op()->HasProperty(Operator::kNoThrow)) {
167  Node* discovered_if_exception = nullptr;
168  Node* discovered_if_success = nullptr;
169  int total_number_of_control_uses = 0;
170  for (Edge edge : node->use_edges()) {
171  if (!NodeProperties::IsControlEdge(edge)) {
172  continue;
173  }
174  total_number_of_control_uses++;
175  Node* control_use = edge.from();
176  if (control_use->opcode() == IrOpcode::kIfSuccess) {
177  CHECK_NULL(discovered_if_success); // Only one allowed.
178  discovered_if_success = control_use;
179  }
180  if (control_use->opcode() == IrOpcode::kIfException) {
181  CHECK_NULL(discovered_if_exception); // Only one allowed.
182  discovered_if_exception = control_use;
183  }
184  }
185  if (discovered_if_success && !discovered_if_exception) {
186  FATAL(
187  "#%d:%s should be followed by IfSuccess/IfException, but is "
188  "only followed by single #%d:%s",
189  node->id(), node->op()->mnemonic(), discovered_if_success->id(),
190  discovered_if_success->op()->mnemonic());
191  }
192  if (discovered_if_exception && !discovered_if_success) {
193  FATAL(
194  "#%d:%s should be followed by IfSuccess/IfException, but is "
195  "only followed by single #%d:%s",
196  node->id(), node->op()->mnemonic(), discovered_if_exception->id(),
197  discovered_if_exception->op()->mnemonic());
198  }
199  if (discovered_if_success || discovered_if_exception) {
200  CHECK_EQ(2, total_number_of_control_uses);
201  }
202  }
203  }
204 
205  switch (node->opcode()) {
206  case IrOpcode::kStart:
207  // Start has no inputs.
208  CHECK_EQ(0, input_count);
209  // Type is a tuple.
210  // TODO(rossberg): Multiple outputs are currently typed as Internal.
211  CheckTypeIs(node, Type::Internal());
212  break;
213  case IrOpcode::kEnd:
214  // End has no outputs.
215  CHECK_EQ(0, node->op()->ValueOutputCount());
216  CHECK_EQ(0, node->op()->EffectOutputCount());
217  CHECK_EQ(0, node->op()->ControlOutputCount());
218  // All inputs are graph terminators.
219  for (const Node* input : node->inputs()) {
220  CHECK(IrOpcode::IsGraphTerminator(input->opcode()));
221  }
222  // Type is empty.
223  CheckNotTyped(node);
224  break;
225  case IrOpcode::kDead:
226  // Dead is never connected to the graph.
227  UNREACHABLE();
228  case IrOpcode::kDeadValue:
229  CheckValueInputIs(node, 0, Type::None());
230  CheckTypeIs(node, Type::None());
231  break;
232  case IrOpcode::kUnreachable:
233  CheckTypeIs(node, Type::None());
234  for (Edge edge : node->use_edges()) {
235  Node* use = edge.from();
236  if (NodeProperties::IsValueEdge(edge) && all.IsLive(use)) {
237  // {Unreachable} nodes can only be used by {DeadValue}, because they
238  // don't actually produce a value.
239  CHECK_EQ(IrOpcode::kDeadValue, use->opcode());
240  }
241  }
242  break;
243  case IrOpcode::kBranch: {
244  // Branch uses are IfTrue and IfFalse.
245  int count_true = 0, count_false = 0;
246  for (const Node* use : node->uses()) {
247  CHECK(all.IsLive(use) && (use->opcode() == IrOpcode::kIfTrue ||
248  use->opcode() == IrOpcode::kIfFalse));
249  if (use->opcode() == IrOpcode::kIfTrue) ++count_true;
250  if (use->opcode() == IrOpcode::kIfFalse) ++count_false;
251  }
252  CHECK_EQ(1, count_true);
253  CHECK_EQ(1, count_false);
254  // The condition must be a Boolean.
255  CheckValueInputIs(node, 0, Type::Boolean());
256  // Type is empty.
257  CheckNotTyped(node);
258  break;
259  }
260  case IrOpcode::kIfTrue:
261  case IrOpcode::kIfFalse: {
262  Node* control = NodeProperties::GetControlInput(node, 0);
263  CHECK_EQ(IrOpcode::kBranch, control->opcode());
264  // Type is empty.
265  CheckNotTyped(node);
266  break;
267  }
268  case IrOpcode::kIfSuccess: {
269  // IfSuccess and IfException continuation only on throwing nodes.
270  Node* input = NodeProperties::GetControlInput(node, 0);
271  CHECK(!input->op()->HasProperty(Operator::kNoThrow));
272  // Type is empty.
273  CheckNotTyped(node);
274  break;
275  }
276  case IrOpcode::kIfException: {
277  // IfSuccess and IfException continuation only on throwing nodes.
278  Node* input = NodeProperties::GetControlInput(node, 0);
279  CHECK(!input->op()->HasProperty(Operator::kNoThrow));
280  // Type can be anything.
281  CheckTypeIs(node, Type::Any());
282  break;
283  }
284  case IrOpcode::kSwitch: {
285  // Switch uses are Case and Default.
286  int count_case = 0, count_default = 0;
287  for (const Node* use : node->uses()) {
288  CHECK(all.IsLive(use));
289  switch (use->opcode()) {
290  case IrOpcode::kIfValue: {
291  for (const Node* user : node->uses()) {
292  if (user != use && user->opcode() == IrOpcode::kIfValue) {
293  CHECK_NE(IfValueParametersOf(use->op()).value(),
294  IfValueParametersOf(user->op()).value());
295  }
296  }
297  ++count_case;
298  break;
299  }
300  case IrOpcode::kIfDefault: {
301  ++count_default;
302  break;
303  }
304  default: {
305  FATAL("Switch #%d illegally used by #%d:%s", node->id(), use->id(),
306  use->op()->mnemonic());
307  break;
308  }
309  }
310  }
311  CHECK_EQ(1, count_default);
312  CHECK_EQ(node->op()->ControlOutputCount(), count_case + count_default);
313  // Type is empty.
314  CheckNotTyped(node);
315  break;
316  }
317  case IrOpcode::kIfValue:
318  case IrOpcode::kIfDefault:
319  CHECK_EQ(IrOpcode::kSwitch,
320  NodeProperties::GetControlInput(node)->opcode());
321  // Type is empty.
322  CheckNotTyped(node);
323  break;
324  case IrOpcode::kLoop: {
325  CHECK_EQ(control_count, input_count);
326  // Type is empty.
327  CheckNotTyped(node);
328  // All loops need to be connected to a {Terminate} node to ensure they
329  // stay connected to the graph end.
330  bool has_terminate = false;
331  for (const Node* use : node->uses()) {
332  if (all.IsLive(use) && use->opcode() == IrOpcode::kTerminate) {
333  has_terminate = true;
334  break;
335  }
336  }
337  CHECK(has_terminate);
338  break;
339  }
340  case IrOpcode::kMerge:
341  CHECK_EQ(control_count, input_count);
342  // Type is empty.
343  CheckNotTyped(node);
344  break;
345  case IrOpcode::kDeoptimizeIf:
346  case IrOpcode::kDeoptimizeUnless:
347  // Type is empty.
348  CheckNotTyped(node);
349  break;
350  case IrOpcode::kTrapIf:
351  case IrOpcode::kTrapUnless:
352  // Type is empty.
353  CheckNotTyped(node);
354  break;
355  case IrOpcode::kDeoptimize:
356  case IrOpcode::kReturn:
357  case IrOpcode::kThrow:
358  // Deoptimize, Return and Throw uses are End.
359  for (const Node* use : node->uses()) {
360  if (all.IsLive(use)) {
361  CHECK_EQ(IrOpcode::kEnd, use->opcode());
362  }
363  }
364  // Type is empty.
365  CheckNotTyped(node);
366  break;
367  case IrOpcode::kTerminate:
368  // Terminates take one loop and effect.
369  CHECK_EQ(1, control_count);
370  CHECK_EQ(1, effect_count);
371  CHECK_EQ(2, input_count);
372  CHECK_EQ(IrOpcode::kLoop,
373  NodeProperties::GetControlInput(node)->opcode());
374  // Terminate uses are End.
375  for (const Node* use : node->uses()) {
376  if (all.IsLive(use)) {
377  CHECK_EQ(IrOpcode::kEnd, use->opcode());
378  }
379  }
380  // Type is empty.
381  CheckNotTyped(node);
382  break;
383  case IrOpcode::kOsrNormalEntry:
384  case IrOpcode::kOsrLoopEntry:
385  // Osr entries take one control and effect.
386  CHECK_EQ(1, control_count);
387  CHECK_EQ(1, effect_count);
388  CHECK_EQ(2, input_count);
389  // Type is empty.
390  CheckNotTyped(node);
391  break;
392 
393  // Common operators
394  // ----------------
395  case IrOpcode::kParameter: {
396  // Parameters have the start node as inputs.
397  CHECK_EQ(1, input_count);
398  // Parameter has an input that produces enough values.
399  int const index = ParameterIndexOf(node->op());
400  Node* const start = NodeProperties::GetValueInput(node, 0);
401  CHECK_EQ(IrOpcode::kStart, start->opcode());
402  // Currently, parameter indices start at -1 instead of 0.
403  CHECK_LE(-1, index);
404  CHECK_LT(index + 1, start->op()->ValueOutputCount());
405  // Type can be anything.
406  CheckTypeIs(node, Type::Any());
407  break;
408  }
409  case IrOpcode::kInt32Constant: // TODO(turbofan): rename Word32Constant?
410  case IrOpcode::kInt64Constant: // TODO(turbofan): rename Word64Constant?
411  case IrOpcode::kFloat32Constant:
412  case IrOpcode::kFloat64Constant:
413  case IrOpcode::kRelocatableInt32Constant:
414  case IrOpcode::kRelocatableInt64Constant:
415  // Constants have no inputs.
416  CHECK_EQ(0, input_count);
417  // Type is empty.
418  CheckNotTyped(node);
419  break;
420  case IrOpcode::kNumberConstant:
421  // Constants have no inputs.
422  CHECK_EQ(0, input_count);
423  // Type is a number.
424  CheckTypeIs(node, Type::Number());
425  break;
426  case IrOpcode::kHeapConstant:
427  // Constants have no inputs.
428  CHECK_EQ(0, input_count);
429  // Type is anything.
430  CheckTypeIs(node, Type::Any());
431  break;
432  case IrOpcode::kExternalConstant:
433  case IrOpcode::kPointerConstant:
434  // Constants have no inputs.
435  CHECK_EQ(0, input_count);
436  // Type is an external pointer.
437  CheckTypeIs(node, Type::ExternalPointer());
438  break;
439  case IrOpcode::kOsrValue:
440  // OSR values have a value and a control input.
441  CHECK_EQ(1, control_count);
442  CHECK_EQ(1, input_count);
443  // Type is merged from other values in the graph and could be any.
444  CheckTypeIs(node, Type::Any());
445  break;
446  case IrOpcode::kProjection: {
447  // Projection has an input that produces enough values.
448  int index = static_cast<int>(ProjectionIndexOf(node->op()));
449  Node* input = NodeProperties::GetValueInput(node, 0);
450  CHECK_GT(input->op()->ValueOutputCount(), index);
451  // Type can be anything.
452  // TODO(rossberg): Introduce tuple types for this.
453  // TODO(titzer): Convince rossberg not to.
454  CheckTypeIs(node, Type::Any());
455  break;
456  }
457  case IrOpcode::kSelect: {
458  CHECK_EQ(0, effect_count);
459  CHECK_EQ(0, control_count);
460  CHECK_EQ(3, value_count);
461  // The condition must be a Boolean.
462  CheckValueInputIs(node, 0, Type::Boolean());
463  // Type can be anything.
464  CheckTypeIs(node, Type::Any());
465  break;
466  }
467  case IrOpcode::kPhi: {
468  // Phi input count matches parent control node.
469  CHECK_EQ(0, effect_count);
470  CHECK_EQ(1, control_count);
471  Node* control = NodeProperties::GetControlInput(node, 0);
472  CHECK_EQ(value_count, control->op()->ControlInputCount());
473  CHECK_EQ(input_count, 1 + value_count);
474  // Type must be subsumed by all input types.
475  // TODO(rossberg): for now at least, narrowing does not really hold.
476  /*
477  for (int i = 0; i < value_count; ++i) {
478  CHECK(type_of(ValueInput(node, i))->Is(type_of(node)));
479  }
480  */
481  break;
482  }
483  case IrOpcode::kInductionVariablePhi: {
484  // This is only a temporary node for the typer.
485  UNREACHABLE();
486  break;
487  }
488  case IrOpcode::kEffectPhi: {
489  // EffectPhi input count matches parent control node.
490  CHECK_EQ(0, value_count);
491  CHECK_EQ(1, control_count);
492  Node* control = NodeProperties::GetControlInput(node, 0);
493  CHECK_EQ(effect_count, control->op()->ControlInputCount());
494  CHECK_EQ(input_count, 1 + effect_count);
495  // If the control input is a Merge, then make sure that at least one
496  // of it's usages is non-phi.
497  if (control->opcode() == IrOpcode::kMerge) {
498  bool non_phi_use_found = false;
499  for (Node* use : control->uses()) {
500  if (all.IsLive(use) && use->opcode() != IrOpcode::kEffectPhi &&
501  use->opcode() != IrOpcode::kPhi) {
502  non_phi_use_found = true;
503  }
504  }
505  CHECK(non_phi_use_found);
506  }
507  break;
508  }
509  case IrOpcode::kLoopExit: {
510  CHECK_EQ(2, control_count);
511  Node* loop = NodeProperties::GetControlInput(node, 1);
512  CHECK_EQ(IrOpcode::kLoop, loop->opcode());
513  break;
514  }
515  case IrOpcode::kLoopExitValue: {
516  CHECK_EQ(1, control_count);
517  Node* loop_exit = NodeProperties::GetControlInput(node, 0);
518  CHECK_EQ(IrOpcode::kLoopExit, loop_exit->opcode());
519  break;
520  }
521  case IrOpcode::kLoopExitEffect: {
522  CHECK_EQ(1, control_count);
523  Node* loop_exit = NodeProperties::GetControlInput(node, 0);
524  CHECK_EQ(IrOpcode::kLoopExit, loop_exit->opcode());
525  break;
526  }
527  case IrOpcode::kCheckpoint:
528  // Type is empty.
529  CheckNotTyped(node);
530  break;
531  case IrOpcode::kBeginRegion:
532  // TODO(rossberg): what are the constraints on these?
533  break;
534  case IrOpcode::kFinishRegion: {
535  // TODO(rossberg): what are the constraints on these?
536  // Type must be subsumed by input type.
537  if (typing == TYPED) {
538  Node* val = NodeProperties::GetValueInput(node, 0);
539  CHECK(NodeProperties::GetType(val).Is(NodeProperties::GetType(node)));
540  }
541  break;
542  }
543  case IrOpcode::kFrameState: {
544  // TODO(jarin): what are the constraints on these?
545  CHECK_EQ(5, value_count);
546  CHECK_EQ(0, control_count);
547  CHECK_EQ(0, effect_count);
548  CHECK_EQ(6, input_count);
549  // Check that the parameters and registers are kStateValues or
550  // kTypedStateValues.
551  for (int i = 0; i < 2; ++i) {
552  CHECK(NodeProperties::GetValueInput(node, i)->opcode() ==
553  IrOpcode::kStateValues ||
554  NodeProperties::GetValueInput(node, i)->opcode() ==
555  IrOpcode::kTypedStateValues);
556  }
557  // The accumulator (InputAt(2)) cannot be kStateValues, but it can be
558  // kTypedStateValues (to signal the type). Once AST graph builder
559  // is removed, we should check this here. Until then, AST graph
560  // builder can generate expression stack as InputAt(2), which can
561  // still be kStateValues.
562  break;
563  }
564  case IrOpcode::kObjectId:
565  CheckTypeIs(node, Type::Object());
566  break;
567  case IrOpcode::kStateValues:
568  case IrOpcode::kTypedStateValues:
569  case IrOpcode::kArgumentsElementsState:
570  case IrOpcode::kArgumentsLengthState:
571  case IrOpcode::kObjectState:
572  case IrOpcode::kTypedObjectState:
573  // TODO(jarin): what are the constraints on these?
574  break;
575  case IrOpcode::kCall:
576  case IrOpcode::kCallWithCallerSavedRegisters:
577  // TODO(rossberg): what are the constraints on these?
578  break;
579  case IrOpcode::kTailCall:
580  // TODO(bmeurer): what are the constraints on these?
581  break;
582 
583  // JavaScript operators
584  // --------------------
585  case IrOpcode::kJSEqual:
586  case IrOpcode::kJSStrictEqual:
587  case IrOpcode::kJSLessThan:
588  case IrOpcode::kJSGreaterThan:
589  case IrOpcode::kJSLessThanOrEqual:
590  case IrOpcode::kJSGreaterThanOrEqual:
591  // Type is Boolean.
592  CheckTypeIs(node, Type::Boolean());
593  break;
594 
595  case IrOpcode::kJSAdd:
596  CheckTypeIs(node, Type::NumericOrString());
597  break;
598  case IrOpcode::kJSBitwiseOr:
599  case IrOpcode::kJSBitwiseXor:
600  case IrOpcode::kJSBitwiseAnd:
601  case IrOpcode::kJSShiftLeft:
602  case IrOpcode::kJSShiftRight:
603  case IrOpcode::kJSShiftRightLogical:
604  case IrOpcode::kJSSubtract:
605  case IrOpcode::kJSMultiply:
606  case IrOpcode::kJSDivide:
607  case IrOpcode::kJSModulus:
608  case IrOpcode::kJSExponentiate:
609  case IrOpcode::kJSBitwiseNot:
610  case IrOpcode::kJSDecrement:
611  case IrOpcode::kJSIncrement:
612  case IrOpcode::kJSNegate:
613  CheckTypeIs(node, Type::Numeric());
614  break;
615 
616  case IrOpcode::kToBoolean:
617  // Type is Boolean.
618  CheckTypeIs(node, Type::Boolean());
619  break;
620  case IrOpcode::kJSToLength:
621  CheckTypeIs(node, Type::Range(0, kMaxSafeInteger, zone));
622  break;
623  case IrOpcode::kJSToName:
624  // Type is Name.
625  CheckTypeIs(node, Type::Name());
626  break;
627  case IrOpcode::kJSToNumber:
628  case IrOpcode::kJSToNumberConvertBigInt:
629  // Type is Number.
630  CheckTypeIs(node, Type::Number());
631  break;
632  case IrOpcode::kJSToNumeric:
633  // Type is Numeric.
634  CheckTypeIs(node, Type::Numeric());
635  break;
636  case IrOpcode::kJSToString:
637  // Type is String.
638  CheckTypeIs(node, Type::String());
639  break;
640  case IrOpcode::kJSToObject:
641  // Type is Receiver.
642  CheckTypeIs(node, Type::Receiver());
643  break;
644  case IrOpcode::kJSParseInt:
645  CheckValueInputIs(node, 0, Type::Any());
646  CheckValueInputIs(node, 1, Type::Any());
647  CheckTypeIs(node, Type::Number());
648  break;
649  case IrOpcode::kJSRegExpTest:
650  CheckValueInputIs(node, 0, Type::Any());
651  CheckValueInputIs(node, 1, Type::String());
652  CheckTypeIs(node, Type::Boolean());
653  break;
654  case IrOpcode::kJSCreate:
655  // Type is Object.
656  CheckTypeIs(node, Type::Object());
657  break;
658  case IrOpcode::kJSCreateArguments:
659  // Type is Array \/ OtherObject.
660  CheckTypeIs(node, Type::ArrayOrOtherObject());
661  break;
662  case IrOpcode::kJSCreateArray:
663  // Type is Array.
664  CheckTypeIs(node, Type::Array());
665  break;
666  case IrOpcode::kJSCreateArrayIterator:
667  // Type is OtherObject.
668  CheckTypeIs(node, Type::OtherObject());
669  break;
670  case IrOpcode::kJSCreateAsyncFunctionObject:
671  // Type is OtherObject.
672  CheckTypeIs(node, Type::OtherObject());
673  break;
674  case IrOpcode::kJSCreateCollectionIterator:
675  // Type is OtherObject.
676  CheckTypeIs(node, Type::OtherObject());
677  break;
678  case IrOpcode::kJSCreateBoundFunction:
679  // Type is BoundFunction.
680  CheckTypeIs(node, Type::BoundFunction());
681  break;
682  case IrOpcode::kJSCreateClosure:
683  // Type is Function.
684  CheckTypeIs(node, Type::Function());
685  break;
686  case IrOpcode::kJSCreateIterResultObject:
687  // Type is OtherObject.
688  CheckTypeIs(node, Type::OtherObject());
689  break;
690  case IrOpcode::kJSCreateStringIterator:
691  // Type is OtherObject.
692  CheckTypeIs(node, Type::OtherObject());
693  break;
694  case IrOpcode::kJSCreateKeyValueArray:
695  // Type is OtherObject.
696  CheckTypeIs(node, Type::OtherObject());
697  break;
698  case IrOpcode::kJSCreateObject:
699  // Type is Object.
700  CheckTypeIs(node, Type::OtherObject());
701  break;
702  case IrOpcode::kJSCreatePromise:
703  // Type is OtherObject.
704  CheckTypeIs(node, Type::OtherObject());
705  break;
706  case IrOpcode::kJSCreateTypedArray:
707  // Type is OtherObject.
708  CheckTypeIs(node, Type::OtherObject());
709  break;
710  case IrOpcode::kJSCreateLiteralArray:
711  // Type is Array.
712  CheckTypeIs(node, Type::Array());
713  break;
714  case IrOpcode::kJSCreateEmptyLiteralArray:
715  // Type is Array.
716  CheckTypeIs(node, Type::Array());
717  break;
718  case IrOpcode::kJSCreateArrayFromIterable:
719  // Type is Array.
720  CheckTypeIs(node, Type::Array());
721  break;
722  case IrOpcode::kJSCreateLiteralObject:
723  case IrOpcode::kJSCreateEmptyLiteralObject:
724  case IrOpcode::kJSCloneObject:
725  case IrOpcode::kJSCreateLiteralRegExp:
726  // Type is OtherObject.
727  CheckTypeIs(node, Type::OtherObject());
728  break;
729  case IrOpcode::kJSLoadProperty:
730  // Type can be anything.
731  CheckTypeIs(node, Type::Any());
732  CHECK(PropertyAccessOf(node->op()).feedback().IsValid());
733  break;
734  case IrOpcode::kJSLoadNamed:
735  // Type can be anything.
736  CheckTypeIs(node, Type::Any());
737  break;
738  case IrOpcode::kJSLoadGlobal:
739  // Type can be anything.
740  CheckTypeIs(node, Type::Any());
741  CHECK(LoadGlobalParametersOf(node->op()).feedback().IsValid());
742  break;
743  case IrOpcode::kJSStoreProperty:
744  // Type is empty.
745  CheckNotTyped(node);
746  CHECK(PropertyAccessOf(node->op()).feedback().IsValid());
747  break;
748  case IrOpcode::kJSStoreNamed:
749  // Type is empty.
750  CheckNotTyped(node);
751  break;
752  case IrOpcode::kJSStoreGlobal:
753  // Type is empty.
754  CheckNotTyped(node);
755  CHECK(StoreGlobalParametersOf(node->op()).feedback().IsValid());
756  break;
757  case IrOpcode::kJSStoreNamedOwn:
758  // Type is empty.
759  CheckNotTyped(node);
760  CHECK(StoreNamedOwnParametersOf(node->op()).feedback().IsValid());
761  break;
762  case IrOpcode::kJSStoreDataPropertyInLiteral:
763  case IrOpcode::kJSStoreInArrayLiteral:
764  // Type is empty.
765  CheckNotTyped(node);
766  CHECK(FeedbackParameterOf(node->op()).feedback().IsValid());
767  break;
768  case IrOpcode::kJSDeleteProperty:
769  case IrOpcode::kJSHasProperty:
770  case IrOpcode::kJSHasInPrototypeChain:
771  case IrOpcode::kJSInstanceOf:
772  case IrOpcode::kJSOrdinaryHasInstance:
773  // Type is Boolean.
774  CheckTypeIs(node, Type::Boolean());
775  break;
776  case IrOpcode::kTypeOf:
777  // Type is InternalizedString.
778  CheckTypeIs(node, Type::InternalizedString());
779  break;
780  case IrOpcode::kJSGetSuperConstructor:
781  // We don't check the input for Type::Function because
782  // this_function can be context-allocated.
783  // Any -> Callable.
784  CheckValueInputIs(node, 0, Type::Any());
785  CheckTypeIs(node, Type::Callable());
786  break;
787 
788  case IrOpcode::kJSLoadContext:
789  // Type can be anything.
790  CheckTypeIs(node, Type::Any());
791  break;
792  case IrOpcode::kJSStoreContext:
793  // Type is empty.
794  CheckNotTyped(node);
795  break;
796  case IrOpcode::kJSCreateFunctionContext:
797  case IrOpcode::kJSCreateCatchContext:
798  case IrOpcode::kJSCreateWithContext:
799  case IrOpcode::kJSCreateBlockContext: {
800  // Type is Context, and operand is Internal.
801  Node* context = NodeProperties::GetContextInput(node);
802  // TODO(bmeurer): This should say CheckTypeIs, but we don't have type
803  // OtherInternal on certain contexts, i.e. those from OsrValue inputs.
804  CheckTypeMaybe(context, Type::OtherInternal());
805  CheckTypeIs(node, Type::OtherInternal());
806  break;
807  }
808 
809  case IrOpcode::kJSConstructForwardVarargs:
810  case IrOpcode::kJSConstruct:
811  case IrOpcode::kJSConstructWithArrayLike:
812  case IrOpcode::kJSConstructWithSpread:
813  // Type is Receiver.
814  CheckTypeIs(node, Type::Receiver());
815  break;
816  case IrOpcode::kJSCallForwardVarargs:
817  case IrOpcode::kJSCall:
818  case IrOpcode::kJSCallWithArrayLike:
819  case IrOpcode::kJSCallWithSpread:
820  case IrOpcode::kJSCallRuntime:
821  // Type can be anything.
822  CheckTypeIs(node, Type::Any());
823  break;
824 
825  case IrOpcode::kJSForInEnumerate:
826  // Any -> OtherInternal.
827  CheckValueInputIs(node, 0, Type::Any());
828  CheckTypeIs(node, Type::OtherInternal());
829  break;
830  case IrOpcode::kJSForInPrepare:
831  // TODO(bmeurer): What are the constraints on thse?
832  CheckTypeIs(node, Type::Any());
833  break;
834  case IrOpcode::kJSForInNext:
835  CheckTypeIs(node, Type::Union(Type::Name(), Type::Undefined(), zone));
836  break;
837 
838  case IrOpcode::kJSLoadMessage:
839  case IrOpcode::kJSStoreMessage:
840  break;
841 
842  case IrOpcode::kJSLoadModule:
843  CheckTypeIs(node, Type::Any());
844  break;
845  case IrOpcode::kJSStoreModule:
846  CheckNotTyped(node);
847  break;
848 
849  case IrOpcode::kJSGeneratorStore:
850  CheckNotTyped(node);
851  break;
852 
853  case IrOpcode::kJSCreateGeneratorObject:
854  CheckTypeIs(node, Type::OtherObject());
855  break;
856 
857  case IrOpcode::kJSGeneratorRestoreContinuation:
858  CheckTypeIs(node, Type::SignedSmall());
859  break;
860 
861  case IrOpcode::kJSGeneratorRestoreContext:
862  CheckTypeIs(node, Type::Any());
863  break;
864 
865  case IrOpcode::kJSGeneratorRestoreRegister:
866  CheckTypeIs(node, Type::Any());
867  break;
868 
869  case IrOpcode::kJSGeneratorRestoreInputOrDebugPos:
870  CheckTypeIs(node, Type::Any());
871  break;
872 
873  case IrOpcode::kJSStackCheck:
874  case IrOpcode::kJSDebugger:
875  // Type is empty.
876  CheckNotTyped(node);
877  break;
878 
879  case IrOpcode::kJSAsyncFunctionEnter:
880  CheckValueInputIs(node, 0, Type::Any());
881  CheckValueInputIs(node, 1, Type::Any());
882  CheckTypeIs(node, Type::OtherObject());
883  break;
884  case IrOpcode::kJSAsyncFunctionReject:
885  CheckValueInputIs(node, 0, Type::Any());
886  CheckValueInputIs(node, 1, Type::Any());
887  CheckValueInputIs(node, 2, Type::Boolean());
888  CheckTypeIs(node, Type::OtherObject());
889  break;
890  case IrOpcode::kJSAsyncFunctionResolve:
891  CheckValueInputIs(node, 0, Type::Any());
892  CheckValueInputIs(node, 1, Type::Any());
893  CheckValueInputIs(node, 2, Type::Boolean());
894  CheckTypeIs(node, Type::OtherObject());
895  break;
896  case IrOpcode::kJSFulfillPromise:
897  CheckValueInputIs(node, 0, Type::Any());
898  CheckValueInputIs(node, 1, Type::Any());
899  CheckTypeIs(node, Type::Undefined());
900  break;
901  case IrOpcode::kJSPerformPromiseThen:
902  CheckValueInputIs(node, 0, Type::Any());
903  CheckValueInputIs(node, 1, Type::Any());
904  CheckValueInputIs(node, 2, Type::Any());
905  CheckValueInputIs(node, 3, Type::Any());
906  CheckTypeIs(node, Type::Receiver());
907  break;
908  case IrOpcode::kJSPromiseResolve:
909  CheckValueInputIs(node, 0, Type::Any());
910  CheckValueInputIs(node, 1, Type::Any());
911  CheckTypeIs(node, Type::Receiver());
912  break;
913  case IrOpcode::kJSRejectPromise:
914  CheckValueInputIs(node, 0, Type::Any());
915  CheckValueInputIs(node, 1, Type::Any());
916  CheckValueInputIs(node, 2, Type::Any());
917  CheckTypeIs(node, Type::Undefined());
918  break;
919  case IrOpcode::kJSResolvePromise:
920  CheckValueInputIs(node, 0, Type::Any());
921  CheckValueInputIs(node, 1, Type::Any());
922  CheckTypeIs(node, Type::Undefined());
923  break;
924  case IrOpcode::kJSObjectIsArray:
925  CheckValueInputIs(node, 0, Type::Any());
926  CheckTypeIs(node, Type::Boolean());
927  break;
928 
929  case IrOpcode::kComment:
930  case IrOpcode::kDebugAbort:
931  case IrOpcode::kDebugBreak:
932  case IrOpcode::kRetain:
933  case IrOpcode::kUnsafePointerAdd:
934  case IrOpcode::kRuntimeAbort:
935  CheckNotTyped(node);
936  break;
937 
938  // Simplified operators
939  // -------------------------------
940  case IrOpcode::kBooleanNot:
941  // Boolean -> Boolean
942  CheckValueInputIs(node, 0, Type::Boolean());
943  CheckTypeIs(node, Type::Boolean());
944  break;
945  case IrOpcode::kNumberEqual:
946  // (Number, Number) -> Boolean
947  CheckValueInputIs(node, 0, Type::Number());
948  CheckValueInputIs(node, 1, Type::Number());
949  CheckTypeIs(node, Type::Boolean());
950  break;
951  case IrOpcode::kNumberLessThan:
952  case IrOpcode::kNumberLessThanOrEqual:
953  // (Number, Number) -> Boolean
954  CheckValueInputIs(node, 0, Type::Number());
955  CheckValueInputIs(node, 1, Type::Number());
956  CheckTypeIs(node, Type::Boolean());
957  break;
958  case IrOpcode::kSpeculativeSafeIntegerAdd:
959  case IrOpcode::kSpeculativeSafeIntegerSubtract:
960  case IrOpcode::kSpeculativeNumberAdd:
961  case IrOpcode::kSpeculativeNumberSubtract:
962  case IrOpcode::kSpeculativeNumberMultiply:
963  case IrOpcode::kSpeculativeNumberDivide:
964  case IrOpcode::kSpeculativeNumberModulus:
965  CheckTypeIs(node, Type::Number());
966  break;
967  case IrOpcode::kSpeculativeNumberEqual:
968  case IrOpcode::kSpeculativeNumberLessThan:
969  case IrOpcode::kSpeculativeNumberLessThanOrEqual:
970  CheckTypeIs(node, Type::Boolean());
971  break;
972  case IrOpcode::kNumberAdd:
973  case IrOpcode::kNumberSubtract:
974  case IrOpcode::kNumberMultiply:
975  case IrOpcode::kNumberDivide:
976  // (Number, Number) -> Number
977  CheckValueInputIs(node, 0, Type::Number());
978  CheckValueInputIs(node, 1, Type::Number());
979  CheckTypeIs(node, Type::Number());
980  break;
981  case IrOpcode::kNumberModulus:
982  // (Number, Number) -> Number
983  CheckValueInputIs(node, 0, Type::Number());
984  CheckValueInputIs(node, 1, Type::Number());
985  CheckTypeIs(node, Type::Number());
986  break;
987  case IrOpcode::kNumberBitwiseOr:
988  case IrOpcode::kNumberBitwiseXor:
989  case IrOpcode::kNumberBitwiseAnd:
990  // (Signed32, Signed32) -> Signed32
991  CheckValueInputIs(node, 0, Type::Signed32());
992  CheckValueInputIs(node, 1, Type::Signed32());
993  CheckTypeIs(node, Type::Signed32());
994  break;
995  case IrOpcode::kSpeculativeNumberBitwiseOr:
996  case IrOpcode::kSpeculativeNumberBitwiseXor:
997  case IrOpcode::kSpeculativeNumberBitwiseAnd:
998  CheckTypeIs(node, Type::Signed32());
999  break;
1000  case IrOpcode::kNumberShiftLeft:
1001  case IrOpcode::kNumberShiftRight:
1002  // (Signed32, Unsigned32) -> Signed32
1003  CheckValueInputIs(node, 0, Type::Signed32());
1004  CheckValueInputIs(node, 1, Type::Unsigned32());
1005  CheckTypeIs(node, Type::Signed32());
1006  break;
1007  case IrOpcode::kSpeculativeNumberShiftLeft:
1008  case IrOpcode::kSpeculativeNumberShiftRight:
1009  CheckTypeIs(node, Type::Signed32());
1010  break;
1011  case IrOpcode::kNumberShiftRightLogical:
1012  // (Unsigned32, Unsigned32) -> Unsigned32
1013  CheckValueInputIs(node, 0, Type::Unsigned32());
1014  CheckValueInputIs(node, 1, Type::Unsigned32());
1015  CheckTypeIs(node, Type::Unsigned32());
1016  break;
1017  case IrOpcode::kSpeculativeNumberShiftRightLogical:
1018  CheckTypeIs(node, Type::Unsigned32());
1019  break;
1020  case IrOpcode::kNumberImul:
1021  // (Unsigned32, Unsigned32) -> Signed32
1022  CheckValueInputIs(node, 0, Type::Unsigned32());
1023  CheckValueInputIs(node, 1, Type::Unsigned32());
1024  CheckTypeIs(node, Type::Signed32());
1025  break;
1026  case IrOpcode::kNumberClz32:
1027  // Unsigned32 -> Unsigned32
1028  CheckValueInputIs(node, 0, Type::Unsigned32());
1029  CheckTypeIs(node, Type::Unsigned32());
1030  break;
1031  case IrOpcode::kNumberAtan2:
1032  case IrOpcode::kNumberMax:
1033  case IrOpcode::kNumberMin:
1034  case IrOpcode::kNumberPow:
1035  // (Number, Number) -> Number
1036  CheckValueInputIs(node, 0, Type::Number());
1037  CheckValueInputIs(node, 1, Type::Number());
1038  CheckTypeIs(node, Type::Number());
1039  break;
1040  case IrOpcode::kNumberAbs:
1041  case IrOpcode::kNumberCeil:
1042  case IrOpcode::kNumberFloor:
1043  case IrOpcode::kNumberFround:
1044  case IrOpcode::kNumberAcos:
1045  case IrOpcode::kNumberAcosh:
1046  case IrOpcode::kNumberAsin:
1047  case IrOpcode::kNumberAsinh:
1048  case IrOpcode::kNumberAtan:
1049  case IrOpcode::kNumberAtanh:
1050  case IrOpcode::kNumberCos:
1051  case IrOpcode::kNumberCosh:
1052  case IrOpcode::kNumberExp:
1053  case IrOpcode::kNumberExpm1:
1054  case IrOpcode::kNumberLog:
1055  case IrOpcode::kNumberLog1p:
1056  case IrOpcode::kNumberLog2:
1057  case IrOpcode::kNumberLog10:
1058  case IrOpcode::kNumberCbrt:
1059  case IrOpcode::kNumberRound:
1060  case IrOpcode::kNumberSign:
1061  case IrOpcode::kNumberSin:
1062  case IrOpcode::kNumberSinh:
1063  case IrOpcode::kNumberSqrt:
1064  case IrOpcode::kNumberTan:
1065  case IrOpcode::kNumberTanh:
1066  case IrOpcode::kNumberTrunc:
1067  // Number -> Number
1068  CheckValueInputIs(node, 0, Type::Number());
1069  CheckTypeIs(node, Type::Number());
1070  break;
1071  case IrOpcode::kNumberToBoolean:
1072  // Number -> Boolean
1073  CheckValueInputIs(node, 0, Type::Number());
1074  CheckTypeIs(node, Type::Boolean());
1075  break;
1076  case IrOpcode::kNumberToInt32:
1077  // Number -> Signed32
1078  CheckValueInputIs(node, 0, Type::Number());
1079  CheckTypeIs(node, Type::Signed32());
1080  break;
1081  case IrOpcode::kNumberToString:
1082  // Number -> String
1083  CheckValueInputIs(node, 0, Type::Number());
1084  CheckTypeIs(node, Type::String());
1085  break;
1086  case IrOpcode::kNumberToUint32:
1087  case IrOpcode::kNumberToUint8Clamped:
1088  // Number -> Unsigned32
1089  CheckValueInputIs(node, 0, Type::Number());
1090  CheckTypeIs(node, Type::Unsigned32());
1091  break;
1092  case IrOpcode::kSpeculativeToNumber:
1093  // Any -> Number
1094  CheckValueInputIs(node, 0, Type::Any());
1095  CheckTypeIs(node, Type::Number());
1096  break;
1097  case IrOpcode::kPlainPrimitiveToNumber:
1098  // PlainPrimitive -> Number
1099  CheckValueInputIs(node, 0, Type::PlainPrimitive());
1100  CheckTypeIs(node, Type::Number());
1101  break;
1102  case IrOpcode::kPlainPrimitiveToWord32:
1103  // PlainPrimitive -> Integral32
1104  CheckValueInputIs(node, 0, Type::PlainPrimitive());
1105  CheckTypeIs(node, Type::Integral32());
1106  break;
1107  case IrOpcode::kPlainPrimitiveToFloat64:
1108  // PlainPrimitive -> Number
1109  CheckValueInputIs(node, 0, Type::PlainPrimitive());
1110  CheckTypeIs(node, Type::Number());
1111  break;
1112  case IrOpcode::kStringConcat:
1113  CheckValueInputIs(node, 0, TypeCache::Get().kStringLengthType);
1114  CheckValueInputIs(node, 1, Type::String());
1115  CheckValueInputIs(node, 2, Type::String());
1116  CheckTypeIs(node, Type::String());
1117  break;
1118  case IrOpcode::kStringEqual:
1119  case IrOpcode::kStringLessThan:
1120  case IrOpcode::kStringLessThanOrEqual:
1121  // (String, String) -> Boolean
1122  CheckValueInputIs(node, 0, Type::String());
1123  CheckValueInputIs(node, 1, Type::String());
1124  CheckTypeIs(node, Type::Boolean());
1125  break;
1126  case IrOpcode::kStringToNumber:
1127  // String -> Number
1128  CheckValueInputIs(node, 0, Type::String());
1129  CheckTypeIs(node, Type::Number());
1130  break;
1131  case IrOpcode::kStringCharCodeAt:
1132  // (String, Unsigned32) -> UnsignedSmall
1133  CheckValueInputIs(node, 0, Type::String());
1134  CheckValueInputIs(node, 1, Type::Unsigned32());
1135  CheckTypeIs(node, Type::UnsignedSmall());
1136  break;
1137  case IrOpcode::kStringCodePointAt:
1138  // (String, Unsigned32) -> UnsignedSmall
1139  CheckValueInputIs(node, 0, Type::String());
1140  CheckValueInputIs(node, 1, Type::Unsigned32());
1141  CheckTypeIs(node, Type::UnsignedSmall());
1142  break;
1143  case IrOpcode::kStringFromSingleCharCode:
1144  // Number -> String
1145  CheckValueInputIs(node, 0, Type::Number());
1146  CheckTypeIs(node, Type::String());
1147  break;
1148  case IrOpcode::kStringFromSingleCodePoint:
1149  // (Unsigned32) -> String
1150  CheckValueInputIs(node, 0, Type::Number());
1151  CheckTypeIs(node, Type::String());
1152  break;
1153  case IrOpcode::kStringIndexOf:
1154  // (String, String, SignedSmall) -> SignedSmall
1155  CheckValueInputIs(node, 0, Type::String());
1156  CheckValueInputIs(node, 1, Type::String());
1157  CheckValueInputIs(node, 2, Type::SignedSmall());
1158  CheckTypeIs(node, Type::SignedSmall());
1159  break;
1160  case IrOpcode::kStringLength:
1161  CheckValueInputIs(node, 0, Type::String());
1162  CheckTypeIs(node, TypeCache::Get().kStringLengthType);
1163  break;
1164  case IrOpcode::kStringToLowerCaseIntl:
1165  case IrOpcode::kStringToUpperCaseIntl:
1166  CheckValueInputIs(node, 0, Type::String());
1167  CheckTypeIs(node, Type::String());
1168  break;
1169  case IrOpcode::kStringSubstring:
1170  CheckValueInputIs(node, 0, Type::String());
1171  CheckValueInputIs(node, 1, Type::SignedSmall());
1172  CheckValueInputIs(node, 2, Type::SignedSmall());
1173  CheckTypeIs(node, Type::String());
1174  break;
1175  case IrOpcode::kReferenceEqual:
1176  // (Unique, Any) -> Boolean and
1177  // (Any, Unique) -> Boolean
1178  CheckTypeIs(node, Type::Boolean());
1179  break;
1180  case IrOpcode::kSameValue:
1181  // (Any, Any) -> Boolean
1182  CheckValueInputIs(node, 0, Type::Any());
1183  CheckValueInputIs(node, 1, Type::Any());
1184  CheckTypeIs(node, Type::Boolean());
1185  break;
1186 
1187  case IrOpcode::kObjectIsArrayBufferView:
1188  case IrOpcode::kObjectIsBigInt:
1189  case IrOpcode::kObjectIsCallable:
1190  case IrOpcode::kObjectIsConstructor:
1191  case IrOpcode::kObjectIsDetectableCallable:
1192  case IrOpcode::kObjectIsMinusZero:
1193  case IrOpcode::kObjectIsNaN:
1194  case IrOpcode::kObjectIsNonCallable:
1195  case IrOpcode::kObjectIsNumber:
1196  case IrOpcode::kObjectIsReceiver:
1197  case IrOpcode::kObjectIsSmi:
1198  case IrOpcode::kObjectIsString:
1199  case IrOpcode::kObjectIsSymbol:
1200  case IrOpcode::kObjectIsUndetectable:
1201  CheckValueInputIs(node, 0, Type::Any());
1202  CheckTypeIs(node, Type::Boolean());
1203  break;
1204  case IrOpcode::kNumberIsFloat64Hole:
1205  CheckValueInputIs(node, 0, Type::NumberOrHole());
1206  CheckTypeIs(node, Type::Boolean());
1207  break;
1208  case IrOpcode::kNumberIsFinite:
1209  CheckValueInputIs(node, 0, Type::Number());
1210  CheckTypeIs(node, Type::Boolean());
1211  break;
1212  case IrOpcode::kNumberIsMinusZero:
1213  case IrOpcode::kNumberIsNaN:
1214  CheckValueInputIs(node, 0, Type::Number());
1215  CheckTypeIs(node, Type::Boolean());
1216  break;
1217  case IrOpcode::kObjectIsFiniteNumber:
1218  CheckValueInputIs(node, 0, Type::Any());
1219  CheckTypeIs(node, Type::Boolean());
1220  break;
1221  case IrOpcode::kNumberIsInteger:
1222  CheckValueInputIs(node, 0, Type::Number());
1223  CheckTypeIs(node, Type::Boolean());
1224  break;
1225  case IrOpcode::kObjectIsSafeInteger:
1226  CheckValueInputIs(node, 0, Type::Any());
1227  CheckTypeIs(node, Type::Boolean());
1228  break;
1229  case IrOpcode::kNumberIsSafeInteger:
1230  CheckValueInputIs(node, 0, Type::Number());
1231  CheckTypeIs(node, Type::Boolean());
1232  break;
1233  case IrOpcode::kObjectIsInteger:
1234  CheckValueInputIs(node, 0, Type::Any());
1235  CheckTypeIs(node, Type::Boolean());
1236  break;
1237  case IrOpcode::kFindOrderedHashMapEntry:
1238  CheckValueInputIs(node, 0, Type::Any());
1239  CheckTypeIs(node, Type::SignedSmall());
1240  break;
1241  case IrOpcode::kFindOrderedHashMapEntryForInt32Key:
1242  CheckValueInputIs(node, 0, Type::Any());
1243  CheckValueInputIs(node, 1, Type::Signed32());
1244  CheckTypeIs(node, Type::SignedSmall());
1245  break;
1246  case IrOpcode::kArgumentsLength:
1247  CheckValueInputIs(node, 0, Type::ExternalPointer());
1248  CheckTypeIs(node, TypeCache::Get().kArgumentsLengthType);
1249  break;
1250  case IrOpcode::kArgumentsFrame:
1251  CheckTypeIs(node, Type::ExternalPointer());
1252  break;
1253  case IrOpcode::kNewDoubleElements:
1254  case IrOpcode::kNewSmiOrObjectElements:
1255  CheckValueInputIs(node, 0,
1256  Type::Range(0.0, FixedArray::kMaxLength, zone));
1257  CheckTypeIs(node, Type::OtherInternal());
1258  break;
1259  case IrOpcode::kNewArgumentsElements:
1260  CheckValueInputIs(node, 0, Type::ExternalPointer());
1261  CheckValueInputIs(node, 1, Type::Unsigned30());
1262  CheckTypeIs(node, Type::OtherInternal());
1263  break;
1264  case IrOpcode::kNewConsString:
1265  CheckValueInputIs(node, 0, TypeCache::Get().kStringLengthType);
1266  CheckValueInputIs(node, 1, Type::String());
1267  CheckValueInputIs(node, 2, Type::String());
1268  CheckTypeIs(node, Type::String());
1269  break;
1270  case IrOpcode::kDelayedStringConstant:
1271  CheckTypeIs(node, Type::String());
1272  break;
1273  case IrOpcode::kAllocate:
1274  CheckValueInputIs(node, 0, Type::PlainNumber());
1275  break;
1276  case IrOpcode::kAllocateRaw:
1277  // CheckValueInputIs(node, 0, Type::PlainNumber());
1278  break;
1279  case IrOpcode::kEnsureWritableFastElements:
1280  CheckValueInputIs(node, 0, Type::Any());
1281  CheckValueInputIs(node, 1, Type::Internal());
1282  CheckTypeIs(node, Type::Internal());
1283  break;
1284  case IrOpcode::kMaybeGrowFastElements:
1285  CheckValueInputIs(node, 0, Type::Any());
1286  CheckValueInputIs(node, 1, Type::Internal());
1287  CheckValueInputIs(node, 2, Type::Unsigned31());
1288  CheckValueInputIs(node, 3, Type::Unsigned31());
1289  CheckTypeIs(node, Type::Internal());
1290  break;
1291  case IrOpcode::kTransitionElementsKind:
1292  CheckValueInputIs(node, 0, Type::Any());
1293  CheckNotTyped(node);
1294  break;
1295 
1296  case IrOpcode::kChangeTaggedSignedToInt32: {
1297  // Signed32 /\ Tagged -> Signed32 /\ UntaggedInt32
1298  // TODO(neis): Activate once ChangeRepresentation works in typer.
1299  // Type from = Type::Intersect(Type::Signed32(), Type::Tagged());
1300  // Type to = Type::Intersect(Type::Signed32(), Type::UntaggedInt32());
1301  // CheckValueInputIs(node, 0, from));
1302  // CheckTypeIs(node, to));
1303  break;
1304  }
1305  case IrOpcode::kChangeTaggedSignedToInt64:
1306  break;
1307  case IrOpcode::kChangeTaggedToInt32: {
1308  // Signed32 /\ Tagged -> Signed32 /\ UntaggedInt32
1309  // TODO(neis): Activate once ChangeRepresentation works in typer.
1310  // Type from = Type::Intersect(Type::Signed32(), Type::Tagged());
1311  // Type to = Type::Intersect(Type::Signed32(), Type::UntaggedInt32());
1312  // CheckValueInputIs(node, 0, from));
1313  // CheckTypeIs(node, to));
1314  break;
1315  }
1316  case IrOpcode::kChangeTaggedToInt64:
1317  break;
1318  case IrOpcode::kChangeTaggedToUint32: {
1319  // Unsigned32 /\ Tagged -> Unsigned32 /\ UntaggedInt32
1320  // TODO(neis): Activate once ChangeRepresentation works in typer.
1321  // Type from = Type::Intersect(Type::Unsigned32(), Type::Tagged());
1322  // Type to =Type::Intersect(Type::Unsigned32(), Type::UntaggedInt32());
1323  // CheckValueInputIs(node, 0, from));
1324  // CheckTypeIs(node, to));
1325  break;
1326  }
1327  case IrOpcode::kChangeTaggedToFloat64: {
1328  // NumberOrUndefined /\ Tagged -> Number /\ UntaggedFloat64
1329  // TODO(neis): Activate once ChangeRepresentation works in typer.
1330  // Type from = Type::Intersect(Type::Number(), Type::Tagged());
1331  // Type to = Type::Intersect(Type::Number(), Type::UntaggedFloat64());
1332  // CheckValueInputIs(node, 0, from));
1333  // CheckTypeIs(node, to));
1334  break;
1335  }
1336  case IrOpcode::kChangeTaggedToTaggedSigned:
1337  break;
1338  case IrOpcode::kTruncateTaggedToFloat64: {
1339  // NumberOrUndefined /\ Tagged -> Number /\ UntaggedFloat64
1340  // TODO(neis): Activate once ChangeRepresentation works in typer.
1341  // Type from = Type::Intersect(Type::NumberOrUndefined(),
1342  // Type::Tagged());
1343  // Type to = Type::Intersect(Type::Number(), Type::UntaggedFloat64());
1344  // CheckValueInputIs(node, 0, from));
1345  // CheckTypeIs(node, to));
1346  break;
1347  }
1348  case IrOpcode::kChangeInt31ToTaggedSigned: {
1349  // Signed31 /\ UntaggedInt32 -> Signed31 /\ Tagged
1350  // TODO(neis): Activate once ChangeRepresentation works in typer.
1351  // Type from =Type::Intersect(Type::Signed31(), Type::UntaggedInt32());
1352  // Type to = Type::Intersect(Type::Signed31(), Type::Tagged());
1353  // CheckValueInputIs(node, 0, from));
1354  // CheckTypeIs(node, to));
1355  break;
1356  }
1357  case IrOpcode::kChangeInt32ToTagged: {
1358  // Signed32 /\ UntaggedInt32 -> Signed32 /\ Tagged
1359  // TODO(neis): Activate once ChangeRepresentation works in typer.
1360  // Type from =Type::Intersect(Type::Signed32(), Type::UntaggedInt32());
1361  // Type to = Type::Intersect(Type::Signed32(), Type::Tagged());
1362  // CheckValueInputIs(node, 0, from));
1363  // CheckTypeIs(node, to));
1364  break;
1365  }
1366  case IrOpcode::kChangeInt64ToTagged:
1367  break;
1368  case IrOpcode::kChangeUint32ToTagged: {
1369  // Unsigned32 /\ UntaggedInt32 -> Unsigned32 /\ Tagged
1370  // TODO(neis): Activate once ChangeRepresentation works in typer.
1371  // Type from=Type::Intersect(Type::Unsigned32(),Type::UntaggedInt32());
1372  // Type to = Type::Intersect(Type::Unsigned32(), Type::Tagged());
1373  // CheckValueInputIs(node, 0, from));
1374  // CheckTypeIs(node, to));
1375  break;
1376  }
1377  case IrOpcode::kChangeUint64ToTagged:
1378  break;
1379  case IrOpcode::kChangeFloat64ToTagged: {
1380  // Number /\ UntaggedFloat64 -> Number /\ Tagged
1381  // TODO(neis): Activate once ChangeRepresentation works in typer.
1382  // Type from =Type::Intersect(Type::Number(), Type::UntaggedFloat64());
1383  // Type to = Type::Intersect(Type::Number(), Type::Tagged());
1384  // CheckValueInputIs(node, 0, from));
1385  // CheckTypeIs(node, to));
1386  break;
1387  }
1388  case IrOpcode::kChangeFloat64ToTaggedPointer:
1389  break;
1390  case IrOpcode::kChangeTaggedToBit: {
1391  // Boolean /\ TaggedPtr -> Boolean /\ UntaggedInt1
1392  // TODO(neis): Activate once ChangeRepresentation works in typer.
1393  // Type from = Type::Intersect(Type::Boolean(), Type::TaggedPtr());
1394  // Type to = Type::Intersect(Type::Boolean(), Type::UntaggedInt1());
1395  // CheckValueInputIs(node, 0, from));
1396  // CheckTypeIs(node, to));
1397  break;
1398  }
1399  case IrOpcode::kChangeBitToTagged: {
1400  // Boolean /\ UntaggedInt1 -> Boolean /\ TaggedPtr
1401  // TODO(neis): Activate once ChangeRepresentation works in typer.
1402  // Type from = Type::Intersect(Type::Boolean(), Type::UntaggedInt1());
1403  // Type to = Type::Intersect(Type::Boolean(), Type::TaggedPtr());
1404  // CheckValueInputIs(node, 0, from));
1405  // CheckTypeIs(node, to));
1406  break;
1407  }
1408  case IrOpcode::kTruncateTaggedToWord32: {
1409  // Number /\ Tagged -> Signed32 /\ UntaggedInt32
1410  // TODO(neis): Activate once ChangeRepresentation works in typer.
1411  // Type from = Type::Intersect(Type::Number(), Type::Tagged());
1412  // Type to = Type::Intersect(Type::Number(), Type::UntaggedInt32());
1413  // CheckValueInputIs(node, 0, from));
1414  // CheckTypeIs(node, to));
1415  break;
1416  }
1417  case IrOpcode::kTruncateTaggedToBit:
1418  case IrOpcode::kTruncateTaggedPointerToBit:
1419  break;
1420 
1421  case IrOpcode::kCheckBounds:
1422  CheckValueInputIs(node, 0, Type::Any());
1423  CheckValueInputIs(node, 1, TypeCache::Get().kPositiveSafeInteger);
1424  CheckTypeIs(node, TypeCache::Get().kPositiveSafeInteger);
1425  break;
1426  case IrOpcode::kPoisonIndex:
1427  CheckValueInputIs(node, 0, Type::Unsigned32());
1428  CheckTypeIs(node, Type::Unsigned32());
1429  break;
1430  case IrOpcode::kCheckHeapObject:
1431  CheckValueInputIs(node, 0, Type::Any());
1432  break;
1433  case IrOpcode::kCheckIf:
1434  CheckValueInputIs(node, 0, Type::Boolean());
1435  CheckNotTyped(node);
1436  break;
1437  case IrOpcode::kCheckInternalizedString:
1438  CheckValueInputIs(node, 0, Type::Any());
1439  CheckTypeIs(node, Type::InternalizedString());
1440  break;
1441  case IrOpcode::kCheckMaps:
1442  CheckValueInputIs(node, 0, Type::Any());
1443  CheckNotTyped(node);
1444  break;
1445  case IrOpcode::kCompareMaps:
1446  CheckValueInputIs(node, 0, Type::Any());
1447  CheckTypeIs(node, Type::Boolean());
1448  break;
1449  case IrOpcode::kCheckNumber:
1450  CheckValueInputIs(node, 0, Type::Any());
1451  CheckTypeIs(node, Type::Number());
1452  break;
1453  case IrOpcode::kCheckReceiver:
1454  CheckValueInputIs(node, 0, Type::Any());
1455  CheckTypeIs(node, Type::Receiver());
1456  break;
1457  case IrOpcode::kCheckReceiverOrNullOrUndefined:
1458  CheckValueInputIs(node, 0, Type::Any());
1459  CheckTypeIs(node, Type::ReceiverOrNullOrUndefined());
1460  break;
1461  case IrOpcode::kCheckSmi:
1462  CheckValueInputIs(node, 0, Type::Any());
1463  break;
1464  case IrOpcode::kCheckString:
1465  CheckValueInputIs(node, 0, Type::Any());
1466  CheckTypeIs(node, Type::String());
1467  break;
1468  case IrOpcode::kCheckSymbol:
1469  CheckValueInputIs(node, 0, Type::Any());
1470  CheckTypeIs(node, Type::Symbol());
1471  break;
1472  case IrOpcode::kConvertReceiver:
1473  // (Any, Any) -> Receiver
1474  CheckValueInputIs(node, 0, Type::Any());
1475  CheckValueInputIs(node, 1, Type::Any());
1476  CheckTypeIs(node, Type::Receiver());
1477  break;
1478 
1479  case IrOpcode::kCheckedInt32Add:
1480  case IrOpcode::kCheckedInt32Sub:
1481  case IrOpcode::kCheckedInt32Div:
1482  case IrOpcode::kCheckedInt32Mod:
1483  case IrOpcode::kCheckedUint32Div:
1484  case IrOpcode::kCheckedUint32Mod:
1485  case IrOpcode::kCheckedInt32Mul:
1486  case IrOpcode::kCheckedInt32ToTaggedSigned:
1487  case IrOpcode::kCheckedInt64ToInt32:
1488  case IrOpcode::kCheckedInt64ToTaggedSigned:
1489  case IrOpcode::kCheckedUint32Bounds:
1490  case IrOpcode::kCheckedUint32ToInt32:
1491  case IrOpcode::kCheckedUint32ToTaggedSigned:
1492  case IrOpcode::kCheckedUint64Bounds:
1493  case IrOpcode::kCheckedUint64ToInt32:
1494  case IrOpcode::kCheckedUint64ToTaggedSigned:
1495  case IrOpcode::kCheckedFloat64ToInt32:
1496  case IrOpcode::kCheckedFloat64ToInt64:
1497  case IrOpcode::kCheckedTaggedSignedToInt32:
1498  case IrOpcode::kCheckedTaggedToInt32:
1499  case IrOpcode::kCheckedTaggedToInt64:
1500  case IrOpcode::kCheckedTaggedToFloat64:
1501  case IrOpcode::kCheckedTaggedToTaggedSigned:
1502  case IrOpcode::kCheckedTaggedToTaggedPointer:
1503  case IrOpcode::kCheckedTruncateTaggedToWord32:
1504  break;
1505 
1506  case IrOpcode::kCheckFloat64Hole:
1507  CheckValueInputIs(node, 0, Type::NumberOrHole());
1508  CheckTypeIs(node, Type::NumberOrUndefined());
1509  break;
1510  case IrOpcode::kCheckNotTaggedHole:
1511  CheckValueInputIs(node, 0, Type::Any());
1512  CheckTypeIs(node, Type::NonInternal());
1513  break;
1514  case IrOpcode::kConvertTaggedHoleToUndefined:
1515  CheckValueInputIs(node, 0, Type::Any());
1516  CheckTypeIs(node, Type::NonInternal());
1517  break;
1518 
1519  case IrOpcode::kCheckEqualsInternalizedString:
1520  CheckValueInputIs(node, 0, Type::InternalizedString());
1521  CheckValueInputIs(node, 1, Type::Any());
1522  CheckNotTyped(node);
1523  break;
1524  case IrOpcode::kCheckEqualsSymbol:
1525  CheckValueInputIs(node, 0, Type::Symbol());
1526  CheckValueInputIs(node, 1, Type::Any());
1527  CheckNotTyped(node);
1528  break;
1529 
1530  case IrOpcode::kLoadFieldByIndex:
1531  CheckValueInputIs(node, 0, Type::Any());
1532  CheckValueInputIs(node, 1, Type::SignedSmall());
1533  CheckTypeIs(node, Type::NonInternal());
1534  break;
1535  case IrOpcode::kLoadField:
1536  // Object -> fieldtype
1537  // TODO(rossberg): activate once machine ops are typed.
1538  // CheckValueInputIs(node, 0, Type::Object());
1539  // CheckTypeIs(node, FieldAccessOf(node->op()).type));
1540  break;
1541  case IrOpcode::kLoadElement:
1542  // Object -> elementtype
1543  // TODO(rossberg): activate once machine ops are typed.
1544  // CheckValueInputIs(node, 0, Type::Object());
1545  // CheckTypeIs(node, ElementAccessOf(node->op()).type));
1546  break;
1547  case IrOpcode::kLoadTypedElement:
1548  break;
1549  case IrOpcode::kLoadDataViewElement:
1550  break;
1551  case IrOpcode::kStoreField:
1552  // (Object, fieldtype) -> _|_
1553  // TODO(rossberg): activate once machine ops are typed.
1554  // CheckValueInputIs(node, 0, Type::Object());
1555  // CheckValueInputIs(node, 1, FieldAccessOf(node->op()).type));
1556  CheckNotTyped(node);
1557  break;
1558  case IrOpcode::kStoreElement:
1559  // (Object, elementtype) -> _|_
1560  // TODO(rossberg): activate once machine ops are typed.
1561  // CheckValueInputIs(node, 0, Type::Object());
1562  // CheckValueInputIs(node, 1, ElementAccessOf(node->op()).type));
1563  CheckNotTyped(node);
1564  break;
1565  case IrOpcode::kTransitionAndStoreElement:
1566  CheckNotTyped(node);
1567  break;
1568  case IrOpcode::kTransitionAndStoreNumberElement:
1569  CheckNotTyped(node);
1570  break;
1571  case IrOpcode::kTransitionAndStoreNonNumberElement:
1572  CheckNotTyped(node);
1573  break;
1574  case IrOpcode::kStoreSignedSmallElement:
1575  CheckNotTyped(node);
1576  break;
1577  case IrOpcode::kStoreTypedElement:
1578  CheckNotTyped(node);
1579  break;
1580  case IrOpcode::kStoreDataViewElement:
1581  CheckNotTyped(node);
1582  break;
1583  case IrOpcode::kNumberSilenceNaN:
1584  CheckValueInputIs(node, 0, Type::Number());
1585  CheckTypeIs(node, Type::Number());
1586  break;
1587  case IrOpcode::kMapGuard:
1588  CheckNotTyped(node);
1589  break;
1590  case IrOpcode::kTypeGuard:
1591  CheckTypeIs(node, TypeGuardTypeOf(node->op()));
1592  break;
1593  case IrOpcode::kDateNow:
1594  CHECK_EQ(0, value_count);
1595  CheckTypeIs(node, Type::Number());
1596  break;
1597 
1598  // Machine operators
1599  // -----------------------
1600  case IrOpcode::kLoad:
1601  case IrOpcode::kPoisonedLoad:
1602  case IrOpcode::kProtectedLoad:
1603  case IrOpcode::kProtectedStore:
1604  case IrOpcode::kStore:
1605  case IrOpcode::kStackSlot:
1606  case IrOpcode::kWord32And:
1607  case IrOpcode::kWord32Or:
1608  case IrOpcode::kWord32Xor:
1609  case IrOpcode::kWord32Shl:
1610  case IrOpcode::kWord32Shr:
1611  case IrOpcode::kWord32Sar:
1612  case IrOpcode::kWord32Ror:
1613  case IrOpcode::kWord32Equal:
1614  case IrOpcode::kWord32Clz:
1615  case IrOpcode::kWord32Ctz:
1616  case IrOpcode::kWord32ReverseBits:
1617  case IrOpcode::kWord32ReverseBytes:
1618  case IrOpcode::kInt32AbsWithOverflow:
1619  case IrOpcode::kWord32Popcnt:
1620  case IrOpcode::kWord64And:
1621  case IrOpcode::kWord64Or:
1622  case IrOpcode::kWord64Xor:
1623  case IrOpcode::kWord64Shl:
1624  case IrOpcode::kWord64Shr:
1625  case IrOpcode::kWord64Sar:
1626  case IrOpcode::kWord64Ror:
1627  case IrOpcode::kWord64Clz:
1628  case IrOpcode::kWord64Popcnt:
1629  case IrOpcode::kWord64Ctz:
1630  case IrOpcode::kWord64ReverseBits:
1631  case IrOpcode::kWord64ReverseBytes:
1632  case IrOpcode::kInt64AbsWithOverflow:
1633  case IrOpcode::kWord64Equal:
1634  case IrOpcode::kInt32Add:
1635  case IrOpcode::kInt32AddWithOverflow:
1636  case IrOpcode::kInt32Sub:
1637  case IrOpcode::kInt32SubWithOverflow:
1638  case IrOpcode::kInt32Mul:
1639  case IrOpcode::kInt32MulWithOverflow:
1640  case IrOpcode::kInt32MulHigh:
1641  case IrOpcode::kInt32Div:
1642  case IrOpcode::kInt32Mod:
1643  case IrOpcode::kInt32LessThan:
1644  case IrOpcode::kInt32LessThanOrEqual:
1645  case IrOpcode::kUint32Div:
1646  case IrOpcode::kUint32Mod:
1647  case IrOpcode::kUint32MulHigh:
1648  case IrOpcode::kUint32LessThan:
1649  case IrOpcode::kUint32LessThanOrEqual:
1650  case IrOpcode::kInt64Add:
1651  case IrOpcode::kInt64AddWithOverflow:
1652  case IrOpcode::kInt64Sub:
1653  case IrOpcode::kInt64SubWithOverflow:
1654  case IrOpcode::kInt64Mul:
1655  case IrOpcode::kInt64Div:
1656  case IrOpcode::kInt64Mod:
1657  case IrOpcode::kInt64LessThan:
1658  case IrOpcode::kInt64LessThanOrEqual:
1659  case IrOpcode::kUint64Div:
1660  case IrOpcode::kUint64Mod:
1661  case IrOpcode::kUint64LessThan:
1662  case IrOpcode::kUint64LessThanOrEqual:
1663  case IrOpcode::kFloat32Add:
1664  case IrOpcode::kFloat32Sub:
1665  case IrOpcode::kFloat32Neg:
1666  case IrOpcode::kFloat32Mul:
1667  case IrOpcode::kFloat32Div:
1668  case IrOpcode::kFloat32Abs:
1669  case IrOpcode::kFloat32Sqrt:
1670  case IrOpcode::kFloat32Equal:
1671  case IrOpcode::kFloat32LessThan:
1672  case IrOpcode::kFloat32LessThanOrEqual:
1673  case IrOpcode::kFloat32Max:
1674  case IrOpcode::kFloat32Min:
1675  case IrOpcode::kFloat64Add:
1676  case IrOpcode::kFloat64Sub:
1677  case IrOpcode::kFloat64Neg:
1678  case IrOpcode::kFloat64Mul:
1679  case IrOpcode::kFloat64Div:
1680  case IrOpcode::kFloat64Mod:
1681  case IrOpcode::kFloat64Max:
1682  case IrOpcode::kFloat64Min:
1683  case IrOpcode::kFloat64Abs:
1684  case IrOpcode::kFloat64Acos:
1685  case IrOpcode::kFloat64Acosh:
1686  case IrOpcode::kFloat64Asin:
1687  case IrOpcode::kFloat64Asinh:
1688  case IrOpcode::kFloat64Atan:
1689  case IrOpcode::kFloat64Atan2:
1690  case IrOpcode::kFloat64Atanh:
1691  case IrOpcode::kFloat64Cbrt:
1692  case IrOpcode::kFloat64Cos:
1693  case IrOpcode::kFloat64Cosh:
1694  case IrOpcode::kFloat64Exp:
1695  case IrOpcode::kFloat64Expm1:
1696  case IrOpcode::kFloat64Log:
1697  case IrOpcode::kFloat64Log1p:
1698  case IrOpcode::kFloat64Log10:
1699  case IrOpcode::kFloat64Log2:
1700  case IrOpcode::kFloat64Pow:
1701  case IrOpcode::kFloat64Sin:
1702  case IrOpcode::kFloat64Sinh:
1703  case IrOpcode::kFloat64Sqrt:
1704  case IrOpcode::kFloat64Tan:
1705  case IrOpcode::kFloat64Tanh:
1706  case IrOpcode::kFloat32RoundDown:
1707  case IrOpcode::kFloat64RoundDown:
1708  case IrOpcode::kFloat32RoundUp:
1709  case IrOpcode::kFloat64RoundUp:
1710  case IrOpcode::kFloat32RoundTruncate:
1711  case IrOpcode::kFloat64RoundTruncate:
1712  case IrOpcode::kFloat64RoundTiesAway:
1713  case IrOpcode::kFloat32RoundTiesEven:
1714  case IrOpcode::kFloat64RoundTiesEven:
1715  case IrOpcode::kFloat64Equal:
1716  case IrOpcode::kFloat64LessThan:
1717  case IrOpcode::kFloat64LessThanOrEqual:
1718  case IrOpcode::kTruncateInt64ToInt32:
1719  case IrOpcode::kRoundFloat64ToInt32:
1720  case IrOpcode::kRoundInt32ToFloat32:
1721  case IrOpcode::kRoundInt64ToFloat32:
1722  case IrOpcode::kRoundInt64ToFloat64:
1723  case IrOpcode::kRoundUint32ToFloat32:
1724  case IrOpcode::kRoundUint64ToFloat64:
1725  case IrOpcode::kRoundUint64ToFloat32:
1726  case IrOpcode::kTruncateFloat64ToFloat32:
1727  case IrOpcode::kTruncateFloat64ToWord32:
1728  case IrOpcode::kBitcastFloat32ToInt32:
1729  case IrOpcode::kBitcastFloat64ToInt64:
1730  case IrOpcode::kBitcastInt32ToFloat32:
1731  case IrOpcode::kBitcastInt64ToFloat64:
1732  case IrOpcode::kBitcastTaggedToWord:
1733  case IrOpcode::kBitcastWordToTagged:
1734  case IrOpcode::kBitcastWordToTaggedSigned:
1735  case IrOpcode::kChangeInt32ToInt64:
1736  case IrOpcode::kChangeUint32ToUint64:
1737  case IrOpcode::kChangeInt32ToFloat64:
1738  case IrOpcode::kChangeInt64ToFloat64:
1739  case IrOpcode::kChangeUint32ToFloat64:
1740  case IrOpcode::kChangeFloat32ToFloat64:
1741  case IrOpcode::kChangeFloat64ToInt32:
1742  case IrOpcode::kChangeFloat64ToInt64:
1743  case IrOpcode::kChangeFloat64ToUint32:
1744  case IrOpcode::kChangeFloat64ToUint64:
1745  case IrOpcode::kFloat64SilenceNaN:
1746  case IrOpcode::kTruncateFloat64ToInt64:
1747  case IrOpcode::kTruncateFloat64ToUint32:
1748  case IrOpcode::kTruncateFloat32ToInt32:
1749  case IrOpcode::kTruncateFloat32ToUint32:
1750  case IrOpcode::kTryTruncateFloat32ToInt64:
1751  case IrOpcode::kTryTruncateFloat64ToInt64:
1752  case IrOpcode::kTryTruncateFloat32ToUint64:
1753  case IrOpcode::kTryTruncateFloat64ToUint64:
1754  case IrOpcode::kFloat64ExtractLowWord32:
1755  case IrOpcode::kFloat64ExtractHighWord32:
1756  case IrOpcode::kFloat64InsertLowWord32:
1757  case IrOpcode::kFloat64InsertHighWord32:
1758  case IrOpcode::kInt32PairAdd:
1759  case IrOpcode::kInt32PairSub:
1760  case IrOpcode::kInt32PairMul:
1761  case IrOpcode::kWord32PairShl:
1762  case IrOpcode::kWord32PairShr:
1763  case IrOpcode::kWord32PairSar:
1764  case IrOpcode::kTaggedPoisonOnSpeculation:
1765  case IrOpcode::kWord32PoisonOnSpeculation:
1766  case IrOpcode::kWord64PoisonOnSpeculation:
1767  case IrOpcode::kLoadStackPointer:
1768  case IrOpcode::kLoadFramePointer:
1769  case IrOpcode::kLoadParentFramePointer:
1770  case IrOpcode::kUnalignedLoad:
1771  case IrOpcode::kUnalignedStore:
1772  case IrOpcode::kWord32AtomicLoad:
1773  case IrOpcode::kWord32AtomicStore:
1774  case IrOpcode::kWord32AtomicExchange:
1775  case IrOpcode::kWord32AtomicCompareExchange:
1776  case IrOpcode::kWord32AtomicAdd:
1777  case IrOpcode::kWord32AtomicSub:
1778  case IrOpcode::kWord32AtomicAnd:
1779  case IrOpcode::kWord32AtomicOr:
1780  case IrOpcode::kWord32AtomicXor:
1781  case IrOpcode::kWord64AtomicLoad:
1782  case IrOpcode::kWord64AtomicStore:
1783  case IrOpcode::kWord64AtomicAdd:
1784  case IrOpcode::kWord64AtomicSub:
1785  case IrOpcode::kWord64AtomicAnd:
1786  case IrOpcode::kWord64AtomicOr:
1787  case IrOpcode::kWord64AtomicXor:
1788  case IrOpcode::kWord64AtomicExchange:
1789  case IrOpcode::kWord64AtomicCompareExchange:
1790  case IrOpcode::kWord32AtomicPairLoad:
1791  case IrOpcode::kWord32AtomicPairStore:
1792  case IrOpcode::kWord32AtomicPairAdd:
1793  case IrOpcode::kWord32AtomicPairSub:
1794  case IrOpcode::kWord32AtomicPairAnd:
1795  case IrOpcode::kWord32AtomicPairOr:
1796  case IrOpcode::kWord32AtomicPairXor:
1797  case IrOpcode::kWord32AtomicPairExchange:
1798  case IrOpcode::kWord32AtomicPairCompareExchange:
1799  case IrOpcode::kSpeculationFence:
1800  case IrOpcode::kSignExtendWord8ToInt32:
1801  case IrOpcode::kSignExtendWord16ToInt32:
1802  case IrOpcode::kSignExtendWord8ToInt64:
1803  case IrOpcode::kSignExtendWord16ToInt64:
1804  case IrOpcode::kSignExtendWord32ToInt64:
1805 
1806 #define SIMD_MACHINE_OP_CASE(Name) case IrOpcode::k##Name:
1807  MACHINE_SIMD_OP_LIST(SIMD_MACHINE_OP_CASE)
1808 #undef SIMD_MACHINE_OP_CASE
1809 
1810  // TODO(rossberg): Check.
1811  break;
1812  }
1813 } // NOLINT(readability/fn_size)
1814 
1815 void Verifier::Run(Graph* graph, Typing typing, CheckInputs check_inputs,
1816  CodeType code_type) {
1817  CHECK_NOT_NULL(graph->start());
1818  CHECK_NOT_NULL(graph->end());
1819  Zone zone(graph->zone()->allocator(), ZONE_NAME);
1820  Visitor visitor(&zone, typing, check_inputs, code_type);
1821  AllNodes all(&zone, graph);
1822  for (Node* node : all.reachable) visitor.Check(node, all);
1823 
1824  // Check the uniqueness of projections.
1825  for (Node* proj : all.reachable) {
1826  if (proj->opcode() != IrOpcode::kProjection) continue;
1827  Node* node = proj->InputAt(0);
1828  for (Node* other : node->uses()) {
1829  if (all.IsLive(other) && other != proj &&
1830  other->opcode() == IrOpcode::kProjection &&
1831  other->InputAt(0) == node &&
1832  ProjectionIndexOf(other->op()) == ProjectionIndexOf(proj->op())) {
1833  FATAL("Node #%d:%s has duplicate projections #%d and #%d", node->id(),
1834  node->op()->mnemonic(), proj->id(), other->id());
1835  }
1836  }
1837  }
1838 }
1839 
1840 
1841 // -----------------------------------------------------------------------------
1842 
1843 static bool HasDominatingDef(Schedule* schedule, Node* node,
1844  BasicBlock* container, BasicBlock* use_block,
1845  int use_pos) {
1846  BasicBlock* block = use_block;
1847  while (true) {
1848  while (use_pos >= 0) {
1849  if (block->NodeAt(use_pos) == node) return true;
1850  use_pos--;
1851  }
1852  block = block->dominator();
1853  if (block == nullptr) break;
1854  use_pos = static_cast<int>(block->NodeCount()) - 1;
1855  if (node == block->control_input()) return true;
1856  }
1857  return false;
1858 }
1859 
1860 
1861 static bool Dominates(Schedule* schedule, Node* dominator, Node* dominatee) {
1862  BasicBlock* dom = schedule->block(dominator);
1863  BasicBlock* sub = schedule->block(dominatee);
1864  while (sub != nullptr) {
1865  if (sub == dom) {
1866  return true;
1867  }
1868  sub = sub->dominator();
1869  }
1870  return false;
1871 }
1872 
1873 
1874 static void CheckInputsDominate(Schedule* schedule, BasicBlock* block,
1875  Node* node, int use_pos) {
1876  for (int j = node->op()->ValueInputCount() - 1; j >= 0; j--) {
1877  BasicBlock* use_block = block;
1878  if (node->opcode() == IrOpcode::kPhi) {
1879  use_block = use_block->PredecessorAt(j);
1880  use_pos = static_cast<int>(use_block->NodeCount()) - 1;
1881  }
1882  Node* input = node->InputAt(j);
1883  if (!HasDominatingDef(schedule, node->InputAt(j), block, use_block,
1884  use_pos)) {
1885  FATAL("Node #%d:%s in B%d is not dominated by input@%d #%d:%s",
1886  node->id(), node->op()->mnemonic(), block->rpo_number(), j,
1887  input->id(), input->op()->mnemonic());
1888  }
1889  }
1890  // Ensure that nodes are dominated by their control inputs;
1891  // kEnd is an exception, as unreachable blocks resulting from kMerge
1892  // are not in the RPO.
1893  if (node->op()->ControlInputCount() == 1 &&
1894  node->opcode() != IrOpcode::kEnd) {
1895  Node* ctl = NodeProperties::GetControlInput(node);
1896  if (!Dominates(schedule, ctl, node)) {
1897  FATAL("Node #%d:%s in B%d is not dominated by control input #%d:%s",
1898  node->id(), node->op()->mnemonic(), block->rpo_number(), ctl->id(),
1899  ctl->op()->mnemonic());
1900  }
1901  }
1902 }
1903 
1904 
1905 void ScheduleVerifier::Run(Schedule* schedule) {
1906  const size_t count = schedule->BasicBlockCount();
1907  Zone tmp_zone(schedule->zone()->allocator(), ZONE_NAME);
1908  Zone* zone = &tmp_zone;
1909  BasicBlock* start = schedule->start();
1910  BasicBlockVector* rpo_order = schedule->rpo_order();
1911 
1912  // Verify the RPO order contains only blocks from this schedule.
1913  CHECK_GE(count, rpo_order->size());
1914  for (BasicBlockVector::iterator b = rpo_order->begin(); b != rpo_order->end();
1915  ++b) {
1916  CHECK_EQ((*b), schedule->GetBlockById((*b)->id()));
1917  // All predecessors and successors should be in rpo and in this schedule.
1918  for (BasicBlock const* predecessor : (*b)->predecessors()) {
1919  CHECK_GE(predecessor->rpo_number(), 0);
1920  CHECK_EQ(predecessor, schedule->GetBlockById(predecessor->id()));
1921  }
1922  for (BasicBlock const* successor : (*b)->successors()) {
1923  CHECK_GE(successor->rpo_number(), 0);
1924  CHECK_EQ(successor, schedule->GetBlockById(successor->id()));
1925  }
1926  }
1927 
1928  // Verify RPO numbers of blocks.
1929  CHECK_EQ(start, rpo_order->at(0)); // Start should be first.
1930  for (size_t b = 0; b < rpo_order->size(); b++) {
1931  BasicBlock* block = rpo_order->at(b);
1932  CHECK_EQ(static_cast<int>(b), block->rpo_number());
1933  BasicBlock* dom = block->dominator();
1934  if (b == 0) {
1935  // All blocks except start should have a dominator.
1936  CHECK_NULL(dom);
1937  } else {
1938  // Check that the immediate dominator appears somewhere before the block.
1939  CHECK_NOT_NULL(dom);
1940  CHECK_LT(dom->rpo_number(), block->rpo_number());
1941  }
1942  }
1943 
1944  // Verify that all blocks reachable from start are in the RPO.
1945  BoolVector marked(static_cast<int>(count), false, zone);
1946  {
1947  ZoneQueue<BasicBlock*> queue(zone);
1948  queue.push(start);
1949  marked[start->id().ToSize()] = true;
1950  while (!queue.empty()) {
1951  BasicBlock* block = queue.front();
1952  queue.pop();
1953  for (size_t s = 0; s < block->SuccessorCount(); s++) {
1954  BasicBlock* succ = block->SuccessorAt(s);
1955  if (!marked[succ->id().ToSize()]) {
1956  marked[succ->id().ToSize()] = true;
1957  queue.push(succ);
1958  }
1959  }
1960  }
1961  }
1962  // Verify marked blocks are in the RPO.
1963  for (size_t i = 0; i < count; i++) {
1964  BasicBlock* block = schedule->GetBlockById(BasicBlock::Id::FromSize(i));
1965  if (marked[i]) {
1966  CHECK_GE(block->rpo_number(), 0);
1967  CHECK_EQ(block, rpo_order->at(block->rpo_number()));
1968  }
1969  }
1970  // Verify RPO blocks are marked.
1971  for (size_t b = 0; b < rpo_order->size(); b++) {
1972  CHECK(marked[rpo_order->at(b)->id().ToSize()]);
1973  }
1974 
1975  {
1976  // Verify the dominance relation.
1977  ZoneVector<BitVector*> dominators(zone);
1978  dominators.resize(count, nullptr);
1979 
1980  // Compute a set of all the nodes that dominate a given node by using
1981  // a forward fixpoint. O(n^2).
1982  ZoneQueue<BasicBlock*> queue(zone);
1983  queue.push(start);
1984  dominators[start->id().ToSize()] =
1985  new (zone) BitVector(static_cast<int>(count), zone);
1986  while (!queue.empty()) {
1987  BasicBlock* block = queue.front();
1988  queue.pop();
1989  BitVector* block_doms = dominators[block->id().ToSize()];
1990  BasicBlock* idom = block->dominator();
1991  if (idom != nullptr && !block_doms->Contains(idom->id().ToInt())) {
1992  FATAL("Block B%d is not dominated by B%d", block->rpo_number(),
1993  idom->rpo_number());
1994  }
1995  for (size_t s = 0; s < block->SuccessorCount(); s++) {
1996  BasicBlock* succ = block->SuccessorAt(s);
1997  BitVector* succ_doms = dominators[succ->id().ToSize()];
1998 
1999  if (succ_doms == nullptr) {
2000  // First time visiting the node. S.doms = B U B.doms
2001  succ_doms = new (zone) BitVector(static_cast<int>(count), zone);
2002  succ_doms->CopyFrom(*block_doms);
2003  succ_doms->Add(block->id().ToInt());
2004  dominators[succ->id().ToSize()] = succ_doms;
2005  queue.push(succ);
2006  } else {
2007  // Nth time visiting the successor. S.doms = S.doms ^ (B U B.doms)
2008  bool had = succ_doms->Contains(block->id().ToInt());
2009  if (had) succ_doms->Remove(block->id().ToInt());
2010  if (succ_doms->IntersectIsChanged(*block_doms)) queue.push(succ);
2011  if (had) succ_doms->Add(block->id().ToInt());
2012  }
2013  }
2014  }
2015 
2016  // Verify the immediateness of dominators.
2017  for (BasicBlockVector::iterator b = rpo_order->begin();
2018  b != rpo_order->end(); ++b) {
2019  BasicBlock* block = *b;
2020  BasicBlock* idom = block->dominator();
2021  if (idom == nullptr) continue;
2022  BitVector* block_doms = dominators[block->id().ToSize()];
2023 
2024  for (BitVector::Iterator it(block_doms); !it.Done(); it.Advance()) {
2025  BasicBlock* dom =
2026  schedule->GetBlockById(BasicBlock::Id::FromInt(it.Current()));
2027  if (dom != idom &&
2028  !dominators[idom->id().ToSize()]->Contains(dom->id().ToInt())) {
2029  FATAL("Block B%d is not immediately dominated by B%d",
2030  block->rpo_number(), idom->rpo_number());
2031  }
2032  }
2033  }
2034  }
2035 
2036  // Verify phis are placed in the block of their control input.
2037  for (BasicBlockVector::iterator b = rpo_order->begin(); b != rpo_order->end();
2038  ++b) {
2039  for (BasicBlock::const_iterator i = (*b)->begin(); i != (*b)->end(); ++i) {
2040  Node* phi = *i;
2041  if (phi->opcode() != IrOpcode::kPhi) continue;
2042  // TODO(titzer): Nasty special case. Phis from RawMachineAssembler
2043  // schedules don't have control inputs.
2044  if (phi->InputCount() > phi->op()->ValueInputCount()) {
2045  Node* control = NodeProperties::GetControlInput(phi);
2046  CHECK(control->opcode() == IrOpcode::kMerge ||
2047  control->opcode() == IrOpcode::kLoop);
2048  CHECK_EQ((*b), schedule->block(control));
2049  }
2050  }
2051  }
2052 
2053  // Verify that all uses are dominated by their definitions.
2054  for (BasicBlockVector::iterator b = rpo_order->begin(); b != rpo_order->end();
2055  ++b) {
2056  BasicBlock* block = *b;
2057 
2058  // Check inputs to control for this block.
2059  Node* control = block->control_input();
2060  if (control != nullptr) {
2061  CHECK_EQ(block, schedule->block(control));
2062  CheckInputsDominate(schedule, block, control,
2063  static_cast<int>(block->NodeCount()) - 1);
2064  }
2065  // Check inputs for all nodes in the block.
2066  for (size_t i = 0; i < block->NodeCount(); i++) {
2067  Node* node = block->NodeAt(i);
2068  CheckInputsDominate(schedule, block, node, static_cast<int>(i) - 1);
2069  }
2070  }
2071 }
2072 
2073 
2074 #ifdef DEBUG
2075 
2076 // static
2077 void Verifier::VerifyNode(Node* node) {
2078  DCHECK_EQ(OperatorProperties::GetTotalInputCount(node->op()),
2079  node->InputCount());
2080  // If this node has no effect or no control outputs,
2081  // we check that none of its uses are effect or control inputs.
2082  bool check_no_control = node->op()->ControlOutputCount() == 0;
2083  bool check_no_effect = node->op()->EffectOutputCount() == 0;
2084  bool check_no_frame_state = node->opcode() != IrOpcode::kFrameState;
2085  int effect_edges = 0;
2086  if (check_no_effect || check_no_control) {
2087  for (Edge edge : node->use_edges()) {
2088  Node* const user = edge.from();
2089  DCHECK(!user->IsDead());
2090  if (NodeProperties::IsControlEdge(edge)) {
2091  DCHECK(!check_no_control);
2092  } else if (NodeProperties::IsEffectEdge(edge)) {
2093  DCHECK(!check_no_effect);
2094  effect_edges++;
2095  } else if (NodeProperties::IsFrameStateEdge(edge)) {
2096  DCHECK(!check_no_frame_state);
2097  }
2098  }
2099  }
2100 
2101  // Frame state input should be a frame state (or sentinel).
2102  if (OperatorProperties::GetFrameStateInputCount(node->op()) > 0) {
2103  Node* input = NodeProperties::GetFrameStateInput(node);
2104  DCHECK(input->opcode() == IrOpcode::kFrameState ||
2105  input->opcode() == IrOpcode::kStart ||
2106  input->opcode() == IrOpcode::kDead ||
2107  input->opcode() == IrOpcode::kDeadValue);
2108  }
2109  // Effect inputs should be effect-producing nodes (or sentinels).
2110  for (int i = 0; i < node->op()->EffectInputCount(); i++) {
2111  Node* input = NodeProperties::GetEffectInput(node, i);
2112  DCHECK(input->op()->EffectOutputCount() > 0 ||
2113  input->opcode() == IrOpcode::kDead);
2114  }
2115  // Control inputs should be control-producing nodes (or sentinels).
2116  for (int i = 0; i < node->op()->ControlInputCount(); i++) {
2117  Node* input = NodeProperties::GetControlInput(node, i);
2118  DCHECK(input->op()->ControlOutputCount() > 0 ||
2119  input->opcode() == IrOpcode::kDead);
2120  }
2121 }
2122 
2123 
2124 void Verifier::VerifyEdgeInputReplacement(const Edge& edge,
2125  const Node* replacement) {
2126  // Check that the user does not misuse the replacement.
2127  DCHECK(!NodeProperties::IsControlEdge(edge) ||
2128  replacement->op()->ControlOutputCount() > 0);
2129  DCHECK(!NodeProperties::IsEffectEdge(edge) ||
2130  replacement->op()->EffectOutputCount() > 0);
2131  DCHECK(!NodeProperties::IsFrameStateEdge(edge) ||
2132  replacement->opcode() == IrOpcode::kFrameState ||
2133  replacement->opcode() == IrOpcode::kDead ||
2134  replacement->opcode() == IrOpcode::kDeadValue);
2135 }
2136 
2137 #endif // DEBUG
2138 
2139 } // namespace compiler
2140 } // namespace internal
2141 } // namespace v8
v8::Maybe
Definition: v8.h:56
v8
Definition: libplatform.h:13