Attachment 302917 Details for Bug 162349 – adding X86 instruction formatting for atomics

[patch] adding X86 instruction formatting for atomics

blah.patch (text/plain), 133.73 KB, created by Filip Pizlo on 2017-02-27 20:17:25 PST

(hide)

Description:

Filename:

MIME Type:

Creator: Filip Pizlo

Created: 2017-02-27 20:17:25 PST

Size: 133.73 KB

patch

obsolete

>Index: Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj
>===================================================================
>--- Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj	(revision 212990)
>+++ Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj	(working copy)
>@@ -274,6 +274,12 @@
> 		0F2C63B01E60AE4300C13839 /* B3Bank.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F2C63AC1E60AE3C00C13839 /* B3Bank.h */; };
> 		0F2C63B11E60AE4500C13839 /* B3Width.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F2C63AD1E60AE3C00C13839 /* B3Width.cpp */; };
> 		0F2C63B21E60AE4700C13839 /* B3Width.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F2C63AE1E60AE3D00C13839 /* B3Width.h */; };
>+		0F2C63B61E6343EA00C13839 /* B3AtomicValue.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F2C63B31E6343E800C13839 /* B3AtomicValue.cpp */; };
>+		0F2C63B71E6343ED00C13839 /* B3AtomicValue.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F2C63B41E6343E800C13839 /* B3AtomicValue.h */; };
>+		0F2C63B81E6343F700C13839 /* B3GenericBlockInsertionSet.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F2C63B51E6343E800C13839 /* B3GenericBlockInsertionSet.h */; };
>+		0F2C63BB1E63440A00C13839 /* AirBlockInsertionSet.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F2C63B91E63440800C13839 /* AirBlockInsertionSet.cpp */; };
>+		0F2C63BC1E63440C00C13839 /* AirBlockInsertionSet.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F2C63BA1E63440800C13839 /* AirBlockInsertionSet.h */; };
>+		0F2C63BE1E649DC400C13839 /* AbstractMacroAssembler.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F2C63BD1E649DC200C13839 /* AbstractMacroAssembler.cpp */; };
> 		0F2D4DDD19832D34007D4B19 /* DebuggerScope.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F2D4DDB19832D34007D4B19 /* DebuggerScope.cpp */; };
> 		0F2D4DDE19832D34007D4B19 /* DebuggerScope.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F2D4DDC19832D34007D4B19 /* DebuggerScope.h */; settings = {ATTRIBUTES = (Private, ); }; };
> 		0F2D4DE819832DAC007D4B19 /* ToThisStatus.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F2D4DE519832DAC007D4B19 /* ToThisStatus.cpp */; };
>@@ -2764,6 +2770,12 @@
> 		0F2C63AC1E60AE3C00C13839 /* B3Bank.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = B3Bank.h; path = b3/B3Bank.h; sourceTree = "<group>"; };
> 		0F2C63AD1E60AE3C00C13839 /* B3Width.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = B3Width.cpp; path = b3/B3Width.cpp; sourceTree = "<group>"; };
> 		0F2C63AE1E60AE3D00C13839 /* B3Width.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = B3Width.h; path = b3/B3Width.h; sourceTree = "<group>"; };
>+		0F2C63B31E6343E800C13839 /* B3AtomicValue.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = B3AtomicValue.cpp; path = b3/B3AtomicValue.cpp; sourceTree = "<group>"; };
>+		0F2C63B41E6343E800C13839 /* B3AtomicValue.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = B3AtomicValue.h; path = b3/B3AtomicValue.h; sourceTree = "<group>"; };
>+		0F2C63B51E6343E800C13839 /* B3GenericBlockInsertionSet.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = B3GenericBlockInsertionSet.h; path = b3/B3GenericBlockInsertionSet.h; sourceTree = "<group>"; };
>+		0F2C63B91E63440800C13839 /* AirBlockInsertionSet.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = AirBlockInsertionSet.cpp; path = b3/air/AirBlockInsertionSet.cpp; sourceTree = "<group>"; };
>+		0F2C63BA1E63440800C13839 /* AirBlockInsertionSet.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = AirBlockInsertionSet.h; path = b3/air/AirBlockInsertionSet.h; sourceTree = "<group>"; };
>+		0F2C63BD1E649DC200C13839 /* AbstractMacroAssembler.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = AbstractMacroAssembler.cpp; sourceTree = "<group>"; };
> 		0F2D4DDB19832D34007D4B19 /* DebuggerScope.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = DebuggerScope.cpp; sourceTree = "<group>"; };
> 		0F2D4DDC19832D34007D4B19 /* DebuggerScope.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DebuggerScope.h; sourceTree = "<group>"; };
> 		0F2D4DDF19832D91007D4B19 /* TypeProfilerLog.cpp */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.cpp.cpp; path = TypeProfilerLog.cpp; sourceTree = "<group>"; };
>@@ -5292,6 +5304,8 @@
> 				0FEC84B31BDACD880080FF74 /* air */,
> 				0FEC84B41BDACDAC0080FF74 /* B3ArgumentRegValue.cpp */,
> 				0FEC84B51BDACDAC0080FF74 /* B3ArgumentRegValue.h */,
>+				0F2C63B31E6343E800C13839 /* B3AtomicValue.cpp */,
>+				0F2C63B41E6343E800C13839 /* B3AtomicValue.h */,
> 				0F2C63AB1E60AE3C00C13839 /* B3Bank.cpp */,
> 				0F2C63AC1E60AE3C00C13839 /* B3Bank.h */,
> 				0FEC84B61BDACDAC0080FF74 /* B3BasicBlock.cpp */,
>@@ -5354,6 +5368,7 @@
> 				0FEC84CD1BDACDAC0080FF74 /* B3FrequentedBlock.h */,
> 				0FEC84CE1BDACDAC0080FF74 /* B3Generate.cpp */,
> 				0FEC84CF1BDACDAC0080FF74 /* B3Generate.h */,
>+				0F2C63B51E6343E800C13839 /* B3GenericBlockInsertionSet.h */,
> 				0FEC84D01BDACDAC0080FF74 /* B3GenericFrequentedBlock.h */,
> 				0FEC85BF1BE167A00080FF74 /* B3HeapRange.cpp */,
> 				0FEC85C01BE167A00080FF74 /* B3HeapRange.h */,
>@@ -5469,6 +5484,8 @@
> 				0F64EAF21C4ECD0600621E9B /* AirArgInlines.h */,
> 				0FEC854C1BDACDC70080FF74 /* AirBasicBlock.cpp */,
> 				0FEC854D1BDACDC70080FF74 /* AirBasicBlock.h */,
>+				0F2C63B91E63440800C13839 /* AirBlockInsertionSet.cpp */,
>+				0F2C63BA1E63440800C13839 /* AirBlockInsertionSet.h */,
> 				0FB3878B1BFBC44D00E3AB1E /* AirBlockWorklist.h */,
> 				0F6183201C45BF070072450B /* AirCCallingConvention.cpp */,
> 				0F6183211C45BF070072450B /* AirCCallingConvention.h */,
>@@ -7326,6 +7343,7 @@
> 			isa = PBXGroup;
> 			children = (
> 				0F1FE51B1922A3BC006987C5 /* AbortReason.h */,
>+				0F2C63BD1E649DC200C13839 /* AbstractMacroAssembler.cpp */,
> 				860161DF0F3A83C100F84710 /* AbstractMacroAssembler.h */,
> 				0F3730901C0CD70C00052BFA /* AllowMacroScratchRegisterUsage.h */,
> 				8640923B156EED3B00566CB2 /* ARM64Assembler.h */,
>@@ -7354,8 +7372,8 @@
> 				86C568DE11A213EE0007F7F0 /* MacroAssemblerMIPS.h */,
> 				FE68C6351B90DDD90042BCB3 /* MacroAssemblerPrinter.cpp */,
> 				FE68C6361B90DDD90042BCB3 /* MacroAssemblerPrinter.h */,
>-				860161E00F3A83C100F84710 /* MacroAssemblerX86.h */,
> 				860161E10F3A83C100F84710 /* MacroAssemblerX86_64.h */,
>+				860161E00F3A83C100F84710 /* MacroAssemblerX86.h */,
> 				A7A4AE0717973B26005612B1 /* MacroAssemblerX86Common.cpp */,
> 				860161E20F3A83C100F84710 /* MacroAssemblerX86Common.h */,
> 				65860177185A8F5E00030EEE /* MaxFrameExtentForSlowPathCall.h */,
>@@ -7956,6 +7974,7 @@
> 				0FEC85801BDACDC70080FF74 /* AirInst.h in Headers */,
> 				0FEC85811BDACDC70080FF74 /* AirInstInlines.h in Headers */,
> 				0FDF67D71D9DC442001B9825 /* AirKind.h in Headers */,
>+				0F2C63BC1E63440C00C13839 /* AirBlockInsertionSet.h in Headers */,
> 				2684D4381C00161C0081D663 /* AirLiveness.h in Headers */,
> 				0FE34C1A1C4B39AE0003A512 /* AirLogRegisterPressure.h in Headers */,
> 				0F61832F1C45BF070072450B /* AirLowerAfterRegAlloc.h in Headers */,
>@@ -8047,6 +8066,7 @@
> 				43422A631C158E6D00E2EB98 /* B3ConstFloatValue.h in Headers */,
> 				0FEC85B31BDED9570080FF74 /* B3ConstPtrValue.h in Headers */,
> 				0F338DF61BE93D550013C88F /* B3ConstrainedValue.h in Headers */,
>+				0F2C63B81E6343F700C13839 /* B3GenericBlockInsertionSet.h in Headers */,
> 				0F338E0E1BF0276C0013C88F /* B3DataSection.h in Headers */,
> 				0F33FCFC1C1625BE00323F67 /* B3Dominators.h in Headers */,
> 				0F6B8AD91C4EDDA200969052 /* B3DuplicateTails.h in Headers */,
>@@ -8366,6 +8386,7 @@
> 				0F392C8A1B46188400844728 /* DFGOSRExitFuzz.h in Headers */,
> 				0FEFC9AB1681A3B600567F53 /* DFGOSRExitJumpPlaceholder.h in Headers */,
> 				0F235BEE17178E7300690C7F /* DFGOSRExitPreparation.h in Headers */,
>+				0F2C63B71E6343ED00C13839 /* B3AtomicValue.h in Headers */,
> 				0F6237981AE45CA700D402EA /* DFGPhantomInsertionPhase.h in Headers */,
> 				0FFFC95C14EF90AF00C72532 /* DFGPhase.h in Headers */,
> 				0F2B9CEB19D0BA7D00B1D1B5 /* DFGPhiChildren.h in Headers */,
>@@ -9792,6 +9813,7 @@
> 			buildActionMask = 2147483647;
> 			files = (
> 				0FFA549716B8835000B3A982 /* A64DOpcode.cpp in Sources */,
>+				0F2C63BE1E649DC400C13839 /* AbstractMacroAssembler.cpp in Sources */,
> 				AD4937C31DDBE6140077C807 /* AbstractModuleRecord.cpp in Sources */,
> 				0F55F0F414D1063900AC7649 /* AbstractPC.cpp in Sources */,
> 				5370B4F51BF26202005C40FC /* AdaptiveInferredPropertyValueWatchpointBase.cpp in Sources */,
>@@ -10248,6 +10270,7 @@
> 				9E729407190F01A5001A91B5 /* InitializeThreading.cpp in Sources */,
> 				A513E5B7185B8BD3007E95AD /* InjectedScript.cpp in Sources */,
> 				A514B2C2185A684400F3C7CB /* InjectedScriptBase.cpp in Sources */,
>+				0F2C63B61E6343EA00C13839 /* B3AtomicValue.cpp in Sources */,
> 				A58E35911860DECF001F24FE /* InjectedScriptHost.cpp in Sources */,
> 				A513E5CA185F9624007E95AD /* InjectedScriptManager.cpp in Sources */,
> 				A5840E20187B7B8600843B10 /* InjectedScriptModule.cpp in Sources */,
>@@ -10266,6 +10289,7 @@
> 				E35E035F1B7AB43E0073AD2A /* InspectorInstrumentationObject.cpp in Sources */,
> 				A532438B18568335002ED692 /* InspectorProtocolObjects.cpp in Sources */,
> 				A50E4B6118809DD50068A46D /* InspectorRuntimeAgent.cpp in Sources */,
>+				0F2C63BB1E63440A00C13839 /* AirBlockInsertionSet.cpp in Sources */,
> 				A55165D21BDF0B98003B75C1 /* InspectorScriptProfilerAgent.cpp in Sources */,
> 				A593CF821840377100BFCE27 /* InspectorValues.cpp in Sources */,
> 				147F39CF107EC37600427A48 /* InternalFunction.cpp in Sources */,
>Index: Source/JavaScriptCore/assembler/AbstractMacroAssembler.cpp
>===================================================================
>--- Source/JavaScriptCore/assembler/AbstractMacroAssembler.cpp	(nonexistent)
>+++ Source/JavaScriptCore/assembler/AbstractMacroAssembler.cpp	(working copy)
>@@ -0,0 +1,52 @@
>+/*
>+ * Copyright (C) 2017 Apple Inc. All rights reserved.
>+ *
>+ * Redistribution and use in source and binary forms, with or without
>+ * modification, are permitted provided that the following conditions
>+ * are met:
>+ * 1. Redistributions of source code must retain the above copyright
>+ *    notice, this list of conditions and the following disclaimer.
>+ * 2. Redistributions in binary form must reproduce the above copyright
>+ *    notice, this list of conditions and the following disclaimer in the
>+ *    documentation and/or other materials provided with the distribution.
>+ *
>+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
>+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
>+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
>+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
>+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
>+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
>+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
>+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
>+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
>+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
>+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
>+ */
>+
>+#include "config.h"
>+#include "AbstractMacroAssembler.h"
>+
>+#if ENABLE(ASSEMBLER)
>+
>+#include <wtf/PrintStream.h>
>+
>+using namespace JSC;
>+
>+namespace WTF {
>+
>+void printInternal(PrintStream& out, AbstractMacroAssembler::StatusCondition condition)
>+{
>+    switch (condition) {
>+    case AbstractMacroAssembler::Success:
>+        out.print("Success");
>+        return;
>+    case AbstractMacroAssembler::Failure:
>+        out.print("Failure");
>+        return;
>+    }
>+    RELEASE_ASSERT_NOT_REACHED();
>+}
>+
>+} // namespace WTF
>+
>+#endif // ENABLE(ASSEMBLER)
>Index: Source/JavaScriptCore/assembler/AbstractMacroAssembler.h
>===================================================================
>--- Source/JavaScriptCore/assembler/AbstractMacroAssembler.h	(revision 212990)
>+++ Source/JavaScriptCore/assembler/AbstractMacroAssembler.h	(working copy)
>@@ -1,5 +1,5 @@
> /*
>- * Copyright (C) 2008, 2012, 2014-2016 Apple Inc. All rights reserved.
>+ * Copyright (C) 2008-2017 Apple Inc. All rights reserved.
>  *
>  * Redistribution and use in source and binary forms, with or without
>  * modification, are permitted provided that the following conditions
>@@ -89,6 +89,23 @@ public:
>         return TimesEight;
>     }
>     
>+    enum StatusCondition {
>+        Success,
>+        Failure
>+    };
>+    
>+    static StatusCondition invert(StatusCondition condition)
>+    {
>+        switch (condition) {
>+        case Success:
>+            return Failure;
>+        case Failure:
>+            return Success;
>+        }
>+        RELEASE_ASSERT_NOT_REACHED();
>+        return Success;
>+    }
>+    
>     struct BaseIndex;
>     
>     // Address:
>@@ -1108,3 +1125,16 @@ AbstractMacroAssembler<AssemblerType, Ma
> #endif // ENABLE(ASSEMBLER)
> 
> } // namespace JSC
>+
>+#if ENABLE(ASSEMBLER)
>+
>+namespace WTF {
>+
>+class PrintStream;
>+
>+void printInternal(PrintStream&, JSC::AbstractMacroAssembler::StatusCondition);
>+
>+} // namespace WTF
>+
>+#endif // ENABLE(ASSEMBLER)
>+
>Index: Source/JavaScriptCore/assembler/X86Assembler.h
>===================================================================
>--- Source/JavaScriptCore/assembler/X86Assembler.h	(revision 212990)
>+++ Source/JavaScriptCore/assembler/X86Assembler.h	(working copy)
>@@ -290,6 +290,8 @@ private:
>         OP_SETCC            = 0x90,
>         OP2_3BYTE_ESCAPE_AE = 0xAE,
>         OP2_IMUL_GvEv       = 0xAF,
>+        OP2_CMPXCHGb        = 0xB0,
>+        OP2_CMPXCHG         = 0xB1,
>         OP2_MOVZX_GvEb      = 0xB6,
>         OP2_BSF             = 0xBC,
>         OP2_TZCNT           = 0xBC,
>@@ -298,6 +300,8 @@ private:
>         OP2_MOVSX_GvEb      = 0xBE,
>         OP2_MOVZX_GvEw      = 0xB7,
>         OP2_MOVSX_GvEw      = 0xBF,
>+        OP2_XADDb           = 0xC0,
>+        OP2_XADD            = 0xC1,
>         OP2_PEXTRW_GdUdIb   = 0xC5,
>         OP2_PSLLQ_UdqIb     = 0x73,
>         OP2_PSRLQ_UdqIb     = 0x73,
>@@ -2775,6 +2779,48 @@ public:
>         m_formatter.prefix(PRE_LOCK);
>     }
>     
>+    void cmpxchgb_rm(RegisterID src, int offset, RegisterID base)
>+    {
>+        m_formatter.twoByteOp8(OP2_CMPXCHGb, src, base, offset);
>+    }
>+    
>+    void cmpxchgb_rm(RegisterID src, int offset, RegisterID base, RegisterID index, int scale)
>+    {
>+        m_formatter.twoByteOp8(OP2_CMPXCHGb, src, base, index, scale, offset);
>+    }
>+    
>+    void cmpxchgw_rm(RegisterID src, int offset, RegisterID base)
>+    {
>+        m_formatter.prefix(PRE_OPERAND_SIZE);
>+        m_formatter.twoByteOp(OP2_CMPXCHG, src, base, offset);
>+    }
>+    
>+    void cmpxchgw_rm(RegisterID src, int offset, RegisterID base, RegisterID index, int scale)
>+    {
>+        m_formatter.prefix(PRE_OPERAND_SIZE);
>+        m_formatter.twoByteOp(OP2_CMPXCHG, src, base, index, scale, offset);
>+    }
>+    
>+    void cmpxchgl_rm(RegisterID src, int offset, RegisterID base)
>+    {
>+        m_formatter.twoByteOp(OP2_CMPXCHG, src, base, offset);
>+    }
>+    
>+    void cmpxchgl_rm(RegisterID src, int offset, RegisterID base, RegisterID index, int scale)
>+    {
>+        m_formatter.twoByteOp(OP2_CMPXCHG, src, base, index, scale, offset);
>+    }
>+    
>+    void cmpxchgq_rm(RegisterID src, int offset, RegisterID base)
>+    {
>+        m_formatter.twoByteOp64(OP2_CMPXCHG, src, base, offset);
>+    }
>+    
>+    void cmpxchgq_rm(RegisterID src, int offset, RegisterID base, RegisterID index, int scale)
>+    {
>+        m_formatter.twoByteOp64(OP2_CMPXCHG, src, base, index, scale, offset);
>+    }
>+    
>     void mfence()
>     {
>         m_formatter.threeByteOp(OP2_3BYTE_ESCAPE_AE, OP3_MFENCE);
>Index: Source/JavaScriptCore/b3/B3AtomicValue.cpp
>===================================================================
>--- Source/JavaScriptCore/b3/B3AtomicValue.cpp	(nonexistent)
>+++ Source/JavaScriptCore/b3/B3AtomicValue.cpp	(working copy)
>@@ -0,0 +1,95 @@
>+/*
>+ * Copyright (C) 2017 Apple Inc. All rights reserved.
>+ *
>+ * Redistribution and use in source and binary forms, with or without
>+ * modification, are permitted provided that the following conditions
>+ * are met:
>+ * 1. Redistributions of source code must retain the above copyright
>+ *    notice, this list of conditions and the following disclaimer.
>+ * 2. Redistributions in binary form must reproduce the above copyright
>+ *    notice, this list of conditions and the following disclaimer in the
>+ *    documentation and/or other materials provided with the distribution.
>+ *
>+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
>+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
>+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
>+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
>+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
>+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
>+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
>+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
>+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
>+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
>+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
>+ */
>+
>+#include "config.h"
>+#include "B3AtomicValue.h"
>+
>+#if ENABLE(B3_JIT)
>+
>+namespace JSC { namespace B3 {
>+
>+AtomicValue::~AtomicValue()
>+{
>+}
>+
>+Width AtomicValue::accessWidth() const
>+{
>+    return m_width;
>+}
>+
>+void AtomicValue::dumpMeta(CommaPrinter& comma, PrintStream& out) const
>+{
>+    out.print(comma, "width = ", m_width);
>+    
>+    MemoryValue::dumpMeta(comma, out);
>+}
>+
>+Value* AtomicValue::cloneImpl() const
>+{
>+    return new AtomicValue(*this);
>+}
>+
>+AtomicValue::AtomicValue(Kind kind, Origin origin, Width width, Value* operand, Value* pointer, int32_t offset = 0)
>+    : MemoryValue(CheckedOpcode, kind, operand->type(), origin, offset, operand, pointer)
>+    , m_width(width)
>+{
>+    setFenceRange(HeapRange::top());
>+    
>+    ASSERT(bestType(operationWidth()) == operationType());
>+    
>+    switch (kind.opcode()) {
>+    case AtomicXchgAdd:
>+    case AtomicXchgAnd:
>+    case AtomicXchgOr:
>+    case AtomicXchgSub:
>+    case AtomicXchgXor:
>+    case AtomicXchg:
>+        break;
>+    default:
>+        ASSERT_NOT_REACHED();
>+    }
>+}
>+
>+AtomicValue::AtomicValue(Kind kind, Origin origin, Width width, Value* expectedValue, Value* newValue, Value* pointer, int32_t offset = 0)
>+    : MemoryValue(CheckedOpcode, kind, kind.opcode() == AtomicWeakCAS ? Int32 : expectedValue->type(), origin, offset, expectedValue, newValue, pointer)
>+    , m_width(width)
>+{
>+    setFenceRange(HeapRange::top());
>+    
>+    ASSERT(bestType(operationWidth()) == operationType());
>+
>+    switch (kind.opcode()) {
>+    case AtomicWeakCAS:
>+    case AtomicStrongCAS:
>+        break;
>+    default:
>+        ASSERT_NOT_REACHED();
>+    }
>+}
>+
>+} } // namespace JSC::B3
>+
>+#endif // ENABLE(B3_JIT)
>+
>Index: Source/JavaScriptCore/b3/B3AtomicValue.h
>===================================================================
>--- Source/JavaScriptCore/b3/B3AtomicValue.h	(nonexistent)
>+++ Source/JavaScriptCore/b3/B3AtomicValue.h	(working copy)
>@@ -0,0 +1,69 @@
>+/*
>+ * Copyright (C) 2017 Apple Inc. All rights reserved.
>+ *
>+ * Redistribution and use in source and binary forms, with or without
>+ * modification, are permitted provided that the following conditions
>+ * are met:
>+ * 1. Redistributions of source code must retain the above copyright
>+ *    notice, this list of conditions and the following disclaimer.
>+ * 2. Redistributions in binary form must reproduce the above copyright
>+ *    notice, this list of conditions and the following disclaimer in the
>+ *    documentation and/or other materials provided with the distribution.
>+ *
>+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
>+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
>+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
>+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
>+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
>+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
>+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
>+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
>+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
>+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
>+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
>+ */
>+
>+#pragma once
>+
>+#if ENABLE(B3_JIT)
>+
>+#include "B3MemoryValue.h"
>+#include "B3Width.h"
>+
>+namespace JSC { namespace B3 {
>+
>+class JS_EXPORT_PRIVATE AtomicValue : public MemoryValue {
>+public:
>+    static bool accepts(Kind kind)
>+    {
>+        return isAtomic(kind.opcode());
>+    }
>+    
>+    ~AtomicValue();
>+    
>+    Type operationType() const { return child(0)->type(); }
>+    
>+    Width operationWidth() const { return m_width; }
>+    
>+    // Synonym for width(), if you're accessing via MemoryValue.
>+    Width accessWidth() const override;
>+    
>+protected:
>+    void dumpMeta(CommaPrinter&, PrintStream&) const override;
>+    
>+    Value* cloneImpl() const override;
>+    
>+private:
>+    friend class Procedure;
>+    
>+    AtomicValue(Kind, Origin, Width, Value* operand, Value* pointer, int32_t offset = 0);
>+    
>+    AtomicValue(Kind, Origin, Width, Value* expectedValue, Value* newValue, Value* pointer, int32_t offset = 0);
>+    
>+    Width m_width;
>+};
>+
>+} } // namespace JSC::B3
>+
>+#endif // ENABLE(B3_JIT)
>+
>Index: Source/JavaScriptCore/b3/B3BlockInsertionSet.cpp
>===================================================================
>--- Source/JavaScriptCore/b3/B3BlockInsertionSet.cpp	(revision 212990)
>+++ Source/JavaScriptCore/b3/B3BlockInsertionSet.cpp	(working copy)
>@@ -1,5 +1,5 @@
> /*
>- * Copyright (C) 2015 Apple Inc. All rights reserved.
>+ * Copyright (C) 2015-2017 Apple Inc. All rights reserved.
>  *
>  * Redistribution and use in source and binary forms, with or without
>  * modification, are permitted provided that the following conditions
>@@ -36,35 +36,13 @@
> namespace JSC { namespace B3 {
> 
> BlockInsertionSet::BlockInsertionSet(Procedure &proc)
>-    : m_proc(proc)
>+    : GenericBlockInsertionSet(proc.m_blocks)
>+    , m_proc(proc)
> {
> }
> 
> BlockInsertionSet::~BlockInsertionSet() { }
> 
>-void BlockInsertionSet::insert(BlockInsertion&& insertion)
>-{
>-    m_insertions.append(WTFMove(insertion));
>-}
>-
>-BasicBlock* BlockInsertionSet::insert(unsigned index, double frequency)
>-{
>-    std::unique_ptr<BasicBlock> block(new BasicBlock(UINT_MAX, frequency));
>-    BasicBlock* result = block.get();
>-    insert(BlockInsertion(index, WTFMove(block)));
>-    return result;
>-}
>-
>-BasicBlock* BlockInsertionSet::insertBefore(BasicBlock* before, double frequency)
>-{
>-    return insert(before->index(), frequency == frequency ? frequency : before->frequency());
>-}
>-
>-BasicBlock* BlockInsertionSet::insertAfter(BasicBlock* after, double frequency)
>-{
>-    return insert(after->index() + 1, frequency == frequency ? frequency : after->frequency());
>-}
>-
> BasicBlock* BlockInsertionSet::splitForward(
>     BasicBlock* block, unsigned& valueIndex, InsertionSet* insertionSet, double frequency)
> {
>@@ -102,32 +80,6 @@ BasicBlock* BlockInsertionSet::splitForw
>     return result;
> }
> 
>-bool BlockInsertionSet::execute()
>-{
>-    if (m_insertions.isEmpty())
>-        return false;
>-    
>-    // We allow insertions to be given to us in any order. So, we need to sort them before
>-    // running WTF::executeInsertions. We strongly prefer a stable sort and we want it to be
>-    // fast, so we use bubble sort.
>-    bubbleSort(m_insertions.begin(), m_insertions.end());
>-
>-    executeInsertions(m_proc.m_blocks, m_insertions);
>-    
>-    // Prune out empty entries. This isn't strictly necessary but it's
>-    // healthy to keep the block list from growing.
>-    m_proc.m_blocks.removeAllMatching(
>-        [&] (std::unique_ptr<BasicBlock>& blockPtr) -> bool {
>-            return !blockPtr;
>-        });
>-    
>-    // Make sure that the blocks know their new indices.
>-    for (unsigned i = 0; i < m_proc.m_blocks.size(); ++i)
>-        m_proc.m_blocks[i]->m_index = i;
>-    
>-    return true;
>-}
>-
> } } // namespace JSC::B3
> 
> #endif // ENABLE(B3_JIT)
>Index: Source/JavaScriptCore/b3/B3BlockInsertionSet.h
>===================================================================
>--- Source/JavaScriptCore/b3/B3BlockInsertionSet.h	(revision 212990)
>+++ Source/JavaScriptCore/b3/B3BlockInsertionSet.h	(working copy)
>@@ -1,5 +1,5 @@
> /*
>- * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
>+ * Copyright (C) 2015-2017 Apple Inc. All rights reserved.
>  *
>  * Redistribution and use in source and binary forms, with or without
>  * modification, are permitted provided that the following conditions
>@@ -27,6 +27,7 @@
> 
> #if ENABLE(B3_JIT)
> 
>+#include "B3GenericBlockInsertionSet.h"
> #include "B3Procedure.h"
> #include <wtf/Insertion.h>
> #include <wtf/Vector.h>
>@@ -35,26 +36,13 @@ namespace JSC { namespace B3 {
> 
> class InsertionSet;
> 
>-typedef WTF::Insertion<std::unique_ptr<BasicBlock>> BlockInsertion;
>+typedef GenericBlockInsertionSet<BasicBlock>::BlockInsertion BlockInsertion;
> 
>-class BlockInsertionSet {
>+class BlockInsertionSet : public GenericBlockInsertionSet<BasicBlock> {
> public:
>     BlockInsertionSet(Procedure&);
>     ~BlockInsertionSet();
>     
>-    void insert(BlockInsertion&&);
>-
>-    // Insert a new block at a given index.
>-    BasicBlock* insert(unsigned index, double frequency = PNaN);
>-
>-    // Inserts a new block before the given block. Usually you will not pass the frequency
>-    // argument. Passing PNaN causes us to just use the frequency of the 'before' block. That's
>-    // usually what you want.
>-    BasicBlock* insertBefore(BasicBlock* before, double frequency = PNaN);
>-
>-    // Inserts a new block after the given block.
>-    BasicBlock* insertAfter(BasicBlock* after, double frequency = PNaN);
>-
>     // A helper to split a block when forward iterating over it. It creates a new block to hold
>     // everything before the instruction at valueIndex. The current block is left with
>     // everything at and after valueIndex. If the optional InsertionSet is provided, it will get
>@@ -80,12 +68,9 @@ public:
>     BasicBlock* splitForward(
>         BasicBlock*, unsigned& valueIndex, InsertionSet* = nullptr,
>         double frequency = PNaN);
>-    
>-    bool execute();
> 
> private:
>     Procedure& m_proc;
>-    Vector<BlockInsertion, 8> m_insertions;
> };
> 
> } } // namespace JSC::B3
>Index: Source/JavaScriptCore/b3/B3Effects.cpp
>===================================================================
>--- Source/JavaScriptCore/b3/B3Effects.cpp	(revision 212990)
>+++ Source/JavaScriptCore/b3/B3Effects.cpp	(working copy)
>@@ -82,7 +82,8 @@ bool Effects::interferes(const Effects& 
>         || interferesWithWritesPinned(other, *this)
>         || writes.overlaps(other.writes)
>         || writes.overlaps(other.reads)
>-        || reads.overlaps(other.writes);
>+        || reads.overlaps(other.writes)
>+        || (fence && other.fence);
> }
> 
> bool Effects::operator==(const Effects& other) const
>@@ -95,7 +96,8 @@ bool Effects::operator==(const Effects& 
>         && writesPinned == other.writesPinned
>         && readsPinned == other.readsPinned
>         && writes == other.writes
>-        && reads == other.reads;
>+        && reads == other.reads
>+        && fence == other.fence;
> }
> 
> bool Effects::operator!=(const Effects& other) const
>@@ -120,6 +122,8 @@ void Effects::dump(PrintStream& out) con
>         out.print(comma, "WritesPinned");
>     if (readsPinned)
>         out.print(comma, "ReadsPinned");
>+    if (fence)
>+        out.print(comma, "Fence");
>     if (writes)
>         out.print(comma, "Writes:", writes);
>     if (reads)
>Index: Source/JavaScriptCore/b3/B3Effects.h
>===================================================================
>--- Source/JavaScriptCore/b3/B3Effects.h	(revision 212990)
>+++ Source/JavaScriptCore/b3/B3Effects.h	(working copy)
>@@ -71,6 +71,10 @@ struct Effects {
>     // https://bugs.webkit.org/show_bug.cgi?id=163173
>     bool readsPinned { false };
>     bool writesPinned { false };
>+    
>+    // Memory fences cannot be reordered around each other regardless of their effects. This is flagged
>+    // if the operation is a memory fence.
>+    bool fence { false };
> 
>     HeapRange writes;
>     HeapRange reads;
>@@ -89,6 +93,7 @@ struct Effects {
>         result.reads = HeapRange::top();
>         result.readsPinned = true;
>         result.writesPinned = true;
>+        result.fence = true;
>         return result;
>     }
> 
>@@ -103,7 +108,7 @@ struct Effects {
> 
>     bool mustExecute() const
>     {
>-        return terminal || exitsSideways || writesLocalState || writes || writesPinned;
>+        return terminal || exitsSideways || writesLocalState || writes || writesPinned || fence;
>     }
> 
>     // Returns true if reordering instructions with these respective effects would change program
>Index: Source/JavaScriptCore/b3/B3EliminateCommonSubexpressions.cpp
>===================================================================
>--- Source/JavaScriptCore/b3/B3EliminateCommonSubexpressions.cpp	(revision 212990)
>+++ Source/JavaScriptCore/b3/B3EliminateCommonSubexpressions.cpp	(working copy)
>@@ -1,5 +1,5 @@
> /*
>- * Copyright (C) 2016 Apple Inc. All rights reserved.
>+ * Copyright (C) 2016-2017 Apple Inc. All rights reserved.
>  *
>  * Redistribution and use in source and binary forms, with or without
>  * modification, are permitted provided that the following conditions
>@@ -142,6 +142,7 @@ struct ImpureBlockData {
> 
>     RangeSet<HeapRange> reads; // This only gets used for forward store elimination.
>     RangeSet<HeapRange> writes; // This gets used for both load and store elimination.
>+    bool fence;
> 
>     MemoryValueMap storesAtHead;
>     MemoryValueMap memoryValuesAtTail;
>@@ -174,12 +175,14 @@ public:
>                 
>                 if (memory && memory->isStore()
>                     && !data.reads.overlaps(memory->range())
>-                    && !data.writes.overlaps(memory->range()))
>+                    && !data.writes.overlaps(memory->range())
>+                    && (!data.fence || !memory->hasFence()))
>                     data.storesAtHead.add(memory);
>                 data.reads.add(effects.reads);
> 
>                 if (HeapRange writes = effects.writes)
>                     clobber(data, writes);
>+                data.fence |= effects.fence;
> 
>                 if (memory)
>                     data.memoryValuesAtTail.add(memory);
>@@ -478,6 +481,9 @@ private:
>     template<typename Filter>
>     bool findStoreAfterClobber(Value* ptr, HeapRange range, const Filter& filter)
>     {
>+        if (m_value->as<MemoryValue>()->hasFence())
>+            return false;
>+        
>         // We can eliminate a store if every forward path hits a store to the same location before
>         // hitting any operation that observes the store. This search seems like it should be
>         // expensive, but in the overwhelming majority of cases it will almost immediately hit an 
>@@ -614,6 +620,12 @@ private:
>         if (verbose)
>             dataLog(*m_value, ": looking backward for ", *ptr, "...\n");
>         
>+        if (m_value->as<MemoryValue>()->hasFence()) {
>+            if (verbose)
>+                dataLog("    Giving up because fences.\n");
>+            return false;
>+        }
>+        
>         if (MemoryValue* match = m_data.memoryValuesAtTail.find(ptr, filter)) {
>             if (verbose)
>                 dataLog("    Found ", *match, " locally.\n");
>Index: Source/JavaScriptCore/b3/B3Generate.cpp
>===================================================================
>--- Source/JavaScriptCore/b3/B3Generate.cpp	(revision 212990)
>+++ Source/JavaScriptCore/b3/B3Generate.cpp	(working copy)
>@@ -92,6 +92,7 @@ void generateToAir(Procedure& procedure,
>         // https://bugs.webkit.org/show_bug.cgi?id=150507
>     }
> 
>+    // This puts the IR in quirks mode.
>     lowerMacros(procedure);
> 
>     if (optLevel >= 1) {
>Index: Source/JavaScriptCore/b3/B3GenericBlockInsertionSet.h
>===================================================================
>--- Source/JavaScriptCore/b3/B3GenericBlockInsertionSet.h	(nonexistent)
>+++ Source/JavaScriptCore/b3/B3GenericBlockInsertionSet.h	(working copy)
>@@ -0,0 +1,108 @@
>+/*
>+ * Copyright (C) 2017 Apple Inc. All rights reserved.
>+ *
>+ * Redistribution and use in source and binary forms, with or without
>+ * modification, are permitted provided that the following conditions
>+ * are met:
>+ * 1. Redistributions of source code must retain the above copyright
>+ *    notice, this list of conditions and the following disclaimer.
>+ * 2. Redistributions in binary form must reproduce the above copyright
>+ *    notice, this list of conditions and the following disclaimer in the
>+ *    documentation and/or other materials provided with the distribution.
>+ *
>+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
>+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
>+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
>+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
>+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
>+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
>+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
>+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
>+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
>+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
>+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
>+ */
>+
>+#pragma once
>+
>+#if ENABLE(B3_JIT)
>+
>+#include <wtf/Insertion.h>
>+#include <wtf/Vector.h>
>+
>+namespace JSC { namespace B3 {
>+
>+class InsertionSet;
>+
>+template<typename BasicBlock>
>+class GenericBlockInsertionSet {
>+public:
>+    typedef WTF::Insertion<std::unique_ptr<BasicBlock>> BlockInsertion;
>+    
>+    BlockInsertionSet(Vector<std::unique_ptr<BasicBlock>>& blocks)
>+        : m_blocks(blocks)
>+    {
>+    }
>+    
>+    void insert(BlockInsertion&& insertion)
>+    {
>+        m_insertions.append(WTFMove(insertion));
>+    }
>+
>+    // Insert a new block at a given index.
>+    BasicBlock* insert(unsigned index, double frequency = PNaN)
>+    {
>+        std::unique_ptr<BasicBlock> block(new BasicBlock(UINT_MAX, frequency));
>+        BasicBlock* result = block.get();
>+        insert(BlockInsertion(index, WTFMove(block)));
>+        return result;
>+    }
>+
>+    // Inserts a new block before the given block. Usually you will not pass the frequency
>+    // argument. Passing PNaN causes us to just use the frequency of the 'before' block. That's
>+    // usually what you want.
>+    BasicBlock* insertBefore(BasicBlock* before, double frequency = PNaN)
>+    {
>+        return insert(before->index(), frequency == frequency ? frequency : before->frequency());
>+    }
>+
>+    // Inserts a new block after the given block.
>+    BasicBlock* insertAfter(BasicBlock* after, double frequency = PNaN)
>+    {
>+        return insert(after->index() + 1, frequency == frequency ? frequency : after->frequency());
>+    }
>+
>+    bool execute()
>+    {
>+        if (m_insertions.isEmpty())
>+            return false;
>+        
>+        // We allow insertions to be given to us in any order. So, we need to sort them before
>+        // running WTF::executeInsertions. We strongly prefer a stable sort and we want it to be
>+        // fast, so we use bubble sort.
>+        bubbleSort(m_insertions.begin(), m_insertions.end());
>+        
>+        executeInsertions(m_blocks, m_insertions);
>+        
>+        // Prune out empty entries. This isn't strictly necessary but it's
>+        // healthy to keep the block list from growing.
>+        m_blocks.removeAllMatching(
>+            [&] (std::unique_ptr<BasicBlock>& blockPtr) -> bool {
>+                return !blockPtr;
>+            });
>+        
>+        // Make sure that the blocks know their new indices.
>+        for (unsigned i = 0; i < m_blocks.size(); ++i)
>+            m_blocks[i]->m_index = i;
>+        
>+        return true;
>+    }
>+
>+private:
>+    Vector<std::unique_ptr<BasicBlock>>& m_blocks;
>+    Vector<BlockInsertion, 8> m_insertions;
>+};
>+
>+} } // namespace JSC::B3
>+
>+#endif // ENABLE(B3_JIT)
>Index: Source/JavaScriptCore/b3/B3HeapRange.h
>===================================================================
>--- Source/JavaScriptCore/b3/B3HeapRange.h	(revision 212990)
>+++ Source/JavaScriptCore/b3/B3HeapRange.h	(working copy)
>@@ -88,6 +88,13 @@ public:
>         return !(*this == other);
>     }
>     
>+    HeapRange operator|(const HeapRange& other) const
>+    {
>+        return HeapRange(
>+            std::min(m_begin, other.m_begin),
>+            std::max(m_end, other.m_end));
>+    }
>+    
>     explicit operator bool() const { return m_begin != m_end; }
> 
>     unsigned begin() const { return m_begin; }
>Index: Source/JavaScriptCore/b3/B3InsertionSet.cpp
>===================================================================
>--- Source/JavaScriptCore/b3/B3InsertionSet.cpp	(revision 212990)
>+++ Source/JavaScriptCore/b3/B3InsertionSet.cpp	(working copy)
>@@ -1,5 +1,5 @@
> /*
>- * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
>+ * Copyright (C) 2015-2017 Apple Inc. All rights reserved.
>  *
>  * Redistribution and use in source and binary forms, with or without
>  * modification, are permitted provided that the following conditions
>@@ -58,6 +58,11 @@ Value* InsertionSet::insertBottom(size_t
>     return insertBottom(index, likeValue->origin(), likeValue->type());
> }
> 
>+Value* InsertionSet::insertClone(size_t index, Value* value)
>+{
>+    return insertValue(index, m_procedure.clone(value));
>+}
>+
> void InsertionSet::execute(BasicBlock* block)
> {
>     bubbleSort(m_insertions.begin(), m_insertions.end());
>Index: Source/JavaScriptCore/b3/B3InsertionSet.h
>===================================================================
>--- Source/JavaScriptCore/b3/B3InsertionSet.h	(revision 212990)
>+++ Source/JavaScriptCore/b3/B3InsertionSet.h	(working copy)
>@@ -71,6 +71,8 @@ public:
> 
>     Value* insertBottom(size_t index, Origin, Type);
>     Value* insertBottom(size_t index, Value*);
>+    
>+    Value* insertClone(size_t index, Value*);
> 
>     void execute(BasicBlock*);
> 
>Index: Source/JavaScriptCore/b3/B3LowerMacros.cpp
>===================================================================
>--- Source/JavaScriptCore/b3/B3LowerMacros.cpp	(revision 212990)
>+++ Source/JavaScriptCore/b3/B3LowerMacros.cpp	(working copy)
>@@ -1,5 +1,5 @@
> /*
>- * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
>+ * Copyright (C) 2015-2017 Apple Inc. All rights reserved.
>  *
>  * Redistribution and use in source and binary forms, with or without
>  * modification, are permitted provided that the following conditions
>@@ -58,11 +58,14 @@ public:
>         : m_proc(proc)
>         , m_blockInsertionSet(proc)
>         , m_insertionSet(proc)
>+        , m_useCounts(proc)
>     {
>     }
> 
>     bool run()
>     {
>+        RELEASE_ASSERT(!m_proc.hasQuirks());
>+        
>         for (BasicBlock* block : m_proc) {
>             m_block = block;
>             processCurrentBlock();
>@@ -72,6 +75,10 @@ public:
>             m_proc.resetReachability();
>             m_proc.invalidateCFG();
>         }
>+        
>+        // This indicates that we've 
>+        m_proc.setHasQuirks(true);
>+        
>         return m_changed;
>     }
>     
>@@ -185,7 +192,96 @@ private:
>                 m_changed = true;
>                 break;
>             }
>+                
>+            case Depend: {
>+                if (isX86()) {
>+                    // Create a load-load fence. This codegens to nothing on X86. We use it to tell the
>+                    // compiler not to block load motion.
>+                    FenceValue* fence = m_insertionSet.insert<FenceValue>(m_index, m_origin);
>+                    fence->read = HeapRange();
>+                    fence->write = HeapRange::top();
>+                    
>+                    // Kill the Depend, which should unlock a bunch of code simplification.
>+                    m_node->replaceWithBottom(m_insertionSet, m_index);
>+                    
>+                    m_changed = true;
>+                }
>+                break;
>+            }
> 
>+            case AtomicWeakCAS:
>+            case AtomicStrongCAS: {
>+                if (isX86())
>+                    break;
>+                
>+                AtomicValue* atomic = m_value->as<AtomicValue>();
>+                Width width = atomic->operationWidth();
>+                
>+                if (isCanonicalWidth(width))
>+                    break;
>+                
>+                Value* expectedValue = atomic->child(0);
>+                
>+                // On ARM, the load part of the CAS does a load with zero extension. Therefore, we need
>+                // to zero-extend the input.
>+                Value* maskedExpectedValue = m_insertionSet.insert<Value>(
>+                    m_index, BitAnd, m_origin, expectedValue,
>+                    m_insertionSet.insertIntConstant(m_index, expectedValue, mask(width)));
>+                
>+                atomic->child(0) = maskedExpectedValue;
>+                m_changed = true;
>+                break;
>+            }
>+                
>+            case AtomicXchgAdd:
>+            case AtomicXchgAnd:
>+            case AtomicXchgOr:
>+            case AtomicXchgSub:
>+            case AtomicXchgXor:
>+            case AtomicXchg: {
>+                // On X86, these may actually return garbage in the high bits. On ARM64, these sorta
>+                // zero-extend their high bits, except that the high bits might get polluted by high
>+                // bits in the operand. . So, either way, we need to throw a sign-extend on these
>+                // things.
>+                
>+                if (isX86()) {
>+                    if (m_value->opcode() == AtomicXchgSub && m_useCounts.numUses(m_value)) {
>+                        // On x86, xchgadd is better than xchgsub if it has any users.
>+                        m_value->setKindUnsafely(AtomicXchgAdd);
>+                        m_value->child(1) = m_insertionSet.insert<Value>(
>+                            m_index, Neg, m_origin, m_value->child(1));
>+                    }
>+                    
>+                    bool exempt = false;
>+                    switch (m_value->opcode()) {
>+                    case AtomicXchgAnd:
>+                    case AtomicXchgOr:
>+                    case AtomicXchgSub:
>+                    case AtomicXchgXor:
>+                        exempt = true;
>+                        break;
>+                    default:
>+                        break;
>+                    }
>+                    if (exempt)
>+                        break;
>+                }
>+                
>+                AtomicValue* atomic = m_value->as<AtomicValue>();
>+                Width width = atomic->operationWidth();
>+                
>+                if (isCanonicalWidth(width))
>+                    break;
>+                
>+                Value* newValue = m_insertionSet.insert<Value>(
>+                    m_index, signExtendOpcode(width), m_origin,
>+                    m_insertionSet.insertClone(m_index, m_value));
>+                
>+                m_value->replaceWithIdentity(newValue);
>+                m_changed = true;
>+                break;
>+            }
>+                
>             default:
>                 break;
>             }
>@@ -470,6 +566,7 @@ private:
>     Procedure& m_proc;
>     BlockInsertionSet m_blockInsertionSet;
>     InsertionSet m_insertionSet;
>+    UseCounts m_useCounts;
>     BasicBlock* m_block;
>     unsigned m_index;
>     Value* m_value;
>Index: Source/JavaScriptCore/b3/B3LowerMacrosAfterOptimizations.cpp
>===================================================================
>--- Source/JavaScriptCore/b3/B3LowerMacrosAfterOptimizations.cpp	(revision 212990)
>+++ Source/JavaScriptCore/b3/B3LowerMacrosAfterOptimizations.cpp	(working copy)
>@@ -156,15 +156,14 @@ private:
>             case RotL: {
>                 // ARM64 doesn't have a rotate left.
>                 if (isARM64()) {
>-                    if (isARM64()) {
>-                        Value* newShift = m_insertionSet.insert<Value>(m_index, Neg, m_value->origin(), m_value->child(1));
>-                        Value* rotate = m_insertionSet.insert<Value>(m_index, RotR, m_value->origin(), m_value->child(0), newShift);
>-                        m_value->replaceWithIdentity(rotate);
>-                        break;
>-                    }
>+                    Value* newShift = m_insertionSet.insert<Value>(m_index, Neg, m_value->origin(), m_value->child(1));
>+                    Value* rotate = m_insertionSet.insert<Value>(m_index, RotR, m_value->origin(), m_value->child(0), newShift);
>+                    m_value->replaceWithIdentity(rotate);
>+                    break;
>                 }
>                 break;
>             }
>+                
>             default:
>                 break;
>             }
>Index: Source/JavaScriptCore/b3/B3LowerToAir.cpp
>===================================================================
>--- Source/JavaScriptCore/b3/B3LowerToAir.cpp	(revision 212990)
>+++ Source/JavaScriptCore/b3/B3LowerToAir.cpp	(working copy)
>@@ -72,6 +72,14 @@ namespace {
> 
> const bool verbose = false;
> 
>+// FIXME: We wouldn't need this if Air supported Width modifiers in Air::Kind.
>+// OOPS!!! (need a bug URL)
>+#define OPCODE_FOR_WIDTH(opcode, width) ( \
>+    (width) == Width8 ? opcode ## 8 : \
>+    (width) == Width16 ? opcode ## 16 : \
>+    (width) == Width32 ? opcode ## 32 : \
>+    opcode ## 64)
>+
> class LowerToAir {
> public:
>     LowerToAir(Procedure& procedure)
>@@ -83,6 +91,12 @@ public:
>         , m_dominators(procedure.dominators())
>         , m_procedure(procedure)
>         , m_code(procedure.code())
>+        , m_blockInsertionSet(m_code)
>+#if CPU(X86) || CPU(X86_64)
>+        , m_eax(X86Registers::eax)
>+        , m_ecx(X86Registers::ecx)
>+        , m_edx(X86Registers::edx)
>+#endif
>     {
>     }
> 
>@@ -124,14 +138,18 @@ public:
>         // hoisted address expression before we duplicate it back into the loop.
>         for (B3::BasicBlock* block : m_procedure.blocksInPreOrder()) {
>             m_block = block;
>-            // Reset some state.
>-            m_insts.resize(0);
> 
>             m_isRare = !m_fastWorklist.saw(block);
> 
>             if (verbose)
>                 dataLog("Lowering Block ", *block, ":\n");
>             
>+            // Make sure that the successors are set up correctly.
>+            for (B3::FrequentedBlock successor : block->successors()) {
>+                m_blockToBlock[block]->successors().append(
>+                    Air::FrequentedBlock(m_blockToBlock[successor.block()], successor.frequency()));
>+            }
>+
>             // Process blocks in reverse order so we see uses before defs. That's what allows us
>             // to match patterns effectively.
>             for (unsigned i = block->size(); i--;) {
>@@ -149,19 +167,10 @@ public:
>                 }
>             }
> 
>-            // Now append the instructions. m_insts contains them in reverse order, so we process
>-            // it in reverse.
>-            for (unsigned i = m_insts.size(); i--;) {
>-                for (Inst& inst : m_insts[i])
>-                    m_blockToBlock[block]->appendInst(WTFMove(inst));
>-            }
>-
>-            // Make sure that the successors are set up correctly.
>-            for (B3::FrequentedBlock successor : block->successors()) {
>-                m_blockToBlock[block]->successors().append(
>-                    Air::FrequentedBlock(m_blockToBlock[successor.block()], successor.frequency()));
>-            }
>+            finishAppendingInstructions(m_blockToBlock[block]);
>         }
>+        
>+        m_blockInsertionSet.execute();
> 
>         Air::InsertionSet insertionSet(m_code);
>         for (Inst& inst : m_prologue)
>@@ -538,7 +547,7 @@ private:
>             return Arg();
> 
>         int32_t offset = value->offset();
>-        Width width = value->accessWidth();
>+        Width width = value->loadStoreWidth();
> 
>         Arg result = effectiveAddr(value->lastChild(), offset, width);
>         ASSERT(result.isValidForm(width));
>@@ -562,11 +571,16 @@ private:
>     
>     ArgPromise loadPromiseAnyOpcode(Value* loadValue)
>     {
>+        RELEASE_ASSERT(loadValue->as<MemoryValue>());
>         if (!canBeInternal(loadValue))
>             return Arg();
>         if (crossesInterference(loadValue))
>             return Arg();
>-        ArgPromise result(addr(loadValue), loadValue);
>+        if (loadValue->as<MemoryValue>()->hasFence())
>+            return Arg();
>+        Arg loadAddr = addr(loadValue);
>+        RELEASE_ASSERT(loadAddr);
>+        ArgPromise result(loadAddr, loadValue);
>         if (loadValue->traps())
>             result.setTraps(true);
>         return result;
>@@ -898,11 +912,9 @@ private:
>             return;
>         }
> 
>-#if CPU(X86) || CPU(X86_64)
>         append(Move, tmp(value), tmp(m_value));
>-        append(Move, tmp(amount), Tmp(X86Registers::ecx));
>-        append(opcode, Tmp(X86Registers::ecx), tmp(m_value));
>-#endif
>+        append(Move, tmp(amount), m_ecx);
>+        append(opcode, m_ecx, tmp(m_value));
>     }
> 
>     template<Air::Opcode opcode32, Air::Opcode opcode64>
>@@ -931,10 +943,15 @@ private:
>         Air::Opcode opcode32, Air::Opcode opcode64, Commutativity commutativity = NotCommutative>
>     bool tryAppendStoreBinOp(Value* left, Value* right)
>     {
>+        RELEASE_ASSERT(m_value->as<MemoryValue>());
>+        
>         Air::Opcode opcode = tryOpcodeForType(opcode32, opcode64, left->type());
>         if (opcode == Air::Oops)
>             return false;
>         
>+        if (m_value->as<MemoryValue>()->hasFence())
>+            return false;
>+        
>         Arg storeAddr = addr(m_value);
>         ASSERT(storeAddr);
> 
>@@ -994,10 +1011,48 @@ private:
> 
>         return Inst(move, m_value, tmp(value), dest);
>     }
>+    
>+    Air::Opcode storeOpcode(Width width, Bank bank, bool release)
>+    {
>+        switch (width) {
>+        case Width8:
>+            RELEASE_ASSERT(bank == GP);
>+            return release ? StoreRel8 : Store8;
>+        case Width16:
>+            RELEASE_ASSERT(bank == GP);
>+            return release ? StoreRel16 : Store16;
>+        case Width32:
>+            switch (bank) {
>+            case GP:
>+                return release ? StoreRel32 : Move32;
>+            case FP:
>+                RELEASE_ASSERT(!release);
>+                return MoveFloat;
>+            }
>+            break;
>+        case Width64:
>+            RELEASE_ASSERT(is64Bit());
>+            switch (bank) {
>+            case GP:
>+                return release ? StoreRel64 : Move;
>+            case FP:
>+                RELEASE_ASSERT(!release);
>+                return MoveDouble;
>+            }
>+            break;
>+        }
>+        RELEASE_ASSERT_NOT_REACHED();
>+    }
>+    
>+    Air::Opcode storeOpcode(Value* value)
>+    {
>+        MemoryValue* memory = value->as<MemoryValue>();
>+        return storeOpcode(memory->loadStoreWidth(), memory->accessBank(), memory->hasFence());
>+    }
> 
>     Inst createStore(Value* value, const Arg& dest)
>     {
>-        Air::Opcode moveOpcode = moveForType(value->type());
>+        Air::Opcode moveOpcode = storeOpcode(value);
>         return createStore(moveOpcode, value, dest);
>     }
> 
>@@ -1006,7 +1061,7 @@ private:
>     {
>         append(trappingInst(m_value, createStore(std::forward<Args>(args)...)));
>     }
>-
>+    
>     Air::Opcode moveForType(Type type)
>     {
>         switch (type) {
>@@ -1073,7 +1128,41 @@ private:
>     {
>         m_insts.last().append(inst);
>     }
>+    
>+    void finishAppendingInstructions(Air::BasicBlock* target)
>+    {
>+        // Now append the instructions. m_insts contains them in reverse order, so we process
>+        // it in reverse.
>+        for (unsigned i = m_insts.size(); i--;) {
>+            for (Inst& inst : m_insts[i])
>+                target->appendInst(WTFMove(inst));
>+        }
>+        m_insts.resize(0);
>+    }
>+    
>+    Air::BasicBlock* newBlock()
>+    {
>+        return m_blockInsertionSet.insertAfter(m_blockToBlock[m_block]);
>+    }
> 
>+    // NOTE: This will create a continuation block (`nextBlock`) *after* any blocks you've created using
>+    // newBlock(). So, it's preferable to create all of your blocks upfront using newBlock(). Also note
>+    // that any code you emit before this will be prepended to the continuation, and any code you emit
>+    // after this will be appended to the previous block.
>+    void splitBlock(Air::BasicBlock*& previousBlock, Air::BasicBlock*& nextBlock)
>+    {
>+        Air::BasicBlock* block = m_blockToBlock[m_block];
>+        
>+        previousBlock = block;
>+        nextBlock = m_blockInsertionSet.insertAfter(block);
>+        
>+        finishAppendingInstructions(nextBlock);
>+        nextBlock->successors() = block->successors();
>+        block->successors().clear();
>+        
>+        m_insts.append(Vector<Inst>());
>+    }
>+    
>     template<typename T, typename... Arguments>
>     T* ensureSpecial(T*& field, Arguments&&... arguments)
>     {
>@@ -1123,7 +1212,7 @@ private:
>                 break;
>             case ValueRep::StackArgument:
>                 arg = Arg::callArg(value.rep().offsetFromSP());
>-                appendStore(value.value(), arg);
>+                appendStore(moveForType(value.value()), arg);
>                 break;
>             default:
>                 RELEASE_ASSERT_NOT_REACHED();
>@@ -1961,6 +2050,308 @@ private:
>         return true;
>     }
> 
>+    void appendX86Div(B3::Opcode op)
>+    {
>+        Air::Opcode convertToDoubleWord;
>+        Air::Opcode div;
>+        switch (m_value->type()) {
>+        case Int32:
>+            convertToDoubleWord = X86ConvertToDoubleWord32;
>+            div = X86Div32;
>+            break;
>+        case Int64:
>+            convertToDoubleWord = X86ConvertToQuadWord64;
>+            div = X86Div64;
>+            break;
>+        default:
>+            RELEASE_ASSERT_NOT_REACHED();
>+            return;
>+        }
>+
>+        ASSERT(op == Div || op == Mod);
>+        Tmp result = op == Div ? m_eax : m_edx;
>+
>+        append(Move, tmp(m_value->child(0)), m_eax);
>+        append(convertToDoubleWord, m_eax, m_edx);
>+        append(div, m_eax, m_edx, tmp(m_value->child(1)));
>+        append(Move, result, tmp(m_value));
>+    }
>+
>+    void appendX86UDiv(B3::Opcode op)
>+    {
>+        Air::Opcode div = m_value->type() == Int32 ? X86UDiv32 : X86UDiv64;
>+
>+        ASSERT(op == UDiv || op == UMod);
>+        Tmp result = op == UDiv ? m_eax : m_edx;
>+
>+        append(Move, tmp(m_value->child(0)), m_eax);
>+        append(Xor64, m_edx, m_edx);
>+        append(div, m_eax, m_edx, tmp(m_value->child(1)));
>+        append(Move, result, tmp(m_value));
>+    }
>+    
>+    Air::Opcode loadLinkOpcode(Width width, bool fence)
>+    {
>+        return fence ? OPCODE_FOR_WIDTH(LoadLinkAcq, width) : OPCODE_FOR_WIDTH(LoadLink, width);
>+    }
>+    
>+    Air::Opcode storeCondOpcode(Width width, bool fence)
>+    {
>+        return fence ? OPCODE_FOR_WIDTH(StoreCondRel, width) : OPCODE_FOR_WIDTH(StoreCond, width);
>+    }
>+    
>+    // This can emit code for the following patterns:
>+    // AtomicWeakCAS
>+    // BitXor(AtomicWeakCAS, 1)
>+    // AtomicStrongCAS
>+    // Equal(AtomicStrongCAS, expected)
>+    // NotEqual(AtomicStrongCAS, expected)
>+    // Branch(AtomicWeakCAS)
>+    // Branch(Equal(AtomicStrongCAS, expected))
>+    // Branch(NotEqual(AtomicStrongCAS, expected))
>+    //
>+    // It assumes that atomicValue points to the CAS, and m_value points to the instruction being
>+    // generated. It assumes that you've consumed everything that needs to be consumed.
>+    void appendCAS(Value* atomicValue, bool invert)
>+    {
>+        AtomicValue* atomic = atomicValue->as<AtomicValue>();
>+        RELEASE_ASSERT(atomic);
>+        
>+        bool isBranch = m_value->op() == Branch;
>+        bool isStrong = atomic->op() == AtomicStrongCAS;
>+        bool returnsOldValue = m_value->op() == AtomicStrongCAS;
>+        
>+        Width width = atomic->operationWidth();
>+        Arg address = addr(atomic);
>+
>+        Tmp valueResultTmp;
>+        Tmp boolResultTmp;
>+        if (returnsOldValue) {
>+            RELEASE_ASSERT(!invert);
>+            valueResultTmp = tmp(m_value);
>+            boolResultTmp = m_code.newTmp(GP);
>+        } else if (isBranch) {
>+            valueResultTmp = m_code.newTmp(GP);
>+            boolResultTmp = m_code.newTmp(GP);
>+        } else {
>+            valueResultTmp = m_code.newTmp(GP);
>+            boolResultTmp = tmp(m_value);
>+        }
>+        
>+        Tmp successBoolResultTmp;
>+        if (isStrong && !isBranch)
>+            successBoolResultTmp = m_code.newTmp(GP);
>+        else
>+            successBoolResultTmp = boolResultTmp;
>+
>+        Tmp expectedValueTmp = tmp(atomic->child(0));
>+        Tmp newValueTmp = tmp(atomic->child(1));
>+        
>+        FrequentedBlock success;
>+        FrequentedBlock failure;
>+        if (isBranch) {
>+            success = m_blockToBlock[m_block]->successor(invert);
>+            failure = m_blockToBlock[m_block]->successor(!invert);
>+        }
>+        
>+        if (isX86()) {
>+            append(relaxedMoveForType(atomic->operationType()), immOrTmp(atomic->child(0)), m_eax);
>+            if (returnsOldValue) {
>+                append(OPCODE_FOR_WIDTH(AtomicStrongCAS, width), m_eax, newValueTmp, address);
>+                append(relaxedMoveForType(atomic->operationType()), m_eax, valueResultTmp);
>+            } else if (isBranch) {
>+                append(OPCODE_FOR_WIDTH(BranchAtomicStrongCAS, width), Arg::statusCond(MacroAssembler::Success), m_eax, newValueTmp, address);
>+                m_blockToBlock[m_block]->setSuccessors(success, failure);
>+            } else
>+                append(OPCODE_FOR_WIDTH(AtomicStrongCAS, width), Arg::statusCond(invert ? MacroAssembler::Failure : MacroAssembler::Success), m_eax, tmp(atomic->child(1)), address, boolResultTmp);
>+            return;
>+        }
>+        
>+        RELEASE_ASSERT(isARM64());
>+        // We wish to emit:
>+        //
>+        // Block #reloop:
>+        //     LoadLink
>+        //     Branch NotEqual
>+        //   Successors: Then:#fail, Else: #store
>+        // Block #store:
>+        //     StoreCond
>+        //     Xor $1, %result    <--- only if !invert
>+        //     Jump
>+        //   Successors: #done
>+        // Block #fail:
>+        //     Move $invert, %result
>+        //     Jump
>+        //   Successors: #done
>+        // Block #done:
>+        
>+        Air::BasicBlock* reloopBlock = newBlock();
>+        Air::BasicBlock* storeBlock = newBlock();
>+        Air::BasicBlock* successBlock = nullptr;
>+        if (!isBranch && isStrong)
>+            successBlock = newBlock();
>+        Air::BasicBlock* failBlock = nullptr;
>+        if (!isBranch)
>+            failBlock = newBlock();
>+        Air::BasicBlock* strongFailBlock;
>+        if (isStrong)
>+            strongFailBlock = newBlock();
>+        FrequentedBlock comparisonFail;
>+        FrequentedBlock weakFail;
>+        if (isStrong) {
>+            comparisonFail = strongFailBlock;
>+            weakFail = reloopBlock;
>+        } else {
>+            if (isBranch)
>+                comparisonFail = failure;
>+            else
>+                comparisonFail = failBlock;
>+            weakFail = failure;
>+        }
>+        Air::BasicBlock* beginBlock;
>+        Air::BasicBlock* doneBlock;
>+        splitBlock(beginBlock, doneBlock);
>+        
>+        append(Jump);
>+        beginBlock->setSuccessors(reloopBlock);
>+        
>+        reloopBlock->append(loadLinkOpcode(width, atomic->hasFence()), m_value, valueResultTmp, address);
>+        reloopBlock->append(OPCODE_FOR_WIDTH(Branch, canonicalWidth(width)), m_value, Arg::relCond(MacroAssembler::NotEqual) valueResultTmp, expectedValueTmp);
>+        reloopBlock->setSuccessors(comparisonFail, storeBlock);
>+        
>+        storeBlock->append(storeCondOpcode(width, atomic->hasFence()), m_value, newValueTmp, address, successBoolResultTmp);
>+        if (isBranch) {
>+            storeBlock->append(BranchTest32, Arg::resCond(MacroAssembler::Zero), boolResultTmp, Arg::bitImm(-1));
>+            storeBlock->setSuccessors(success, weakFail);
>+            doneBlock->successors().clear();
>+            RELEASE_ASSERT(!doneBlock->size());
>+            doneBlock->append(Oops, m_value);
>+        } else {
>+            if (isStrong) {
>+                storeBlock->append(BranchTest32, Arg::resCond(MacroAssembler::Zero), successBoolResultTmp, Arg::bitImm(-1));
>+                storeBlock->setSuccessors(successBlock, reloopBlock);
>+                
>+                successBlock->append(Move, m_value, Arg::imm(!invert), boolResultTmp);
>+                successBlock->append(Jump, m_value);
>+                successBlock->setSuccessors(doneBlock);
>+            } else {
>+                if (!invert)
>+                    storeBlock->append(Xor32, m_value, Arg::bitImm(1), boolResultTmp, boolResultTmp);
>+                
>+                storeBlock->append(Jump, m_value);
>+                storeBlock->setSuccessors(doneBlock);
>+            }
>+            
>+            failBlock->append(Move, m_value, Arg::imm(invert), boolResultTmp);
>+            failBlock->append(Jump, m_value);
>+            failBlock->setSuccessors(doneBlock);
>+        }
>+        
>+        if (isStrong) {
>+            Tmp tmp = m_code.newTmp(GP);
>+            strongFailBlock->append(storeCondOpcode(width, atomic->hasFence()), m_value, valueResultTmp, address, tmp);
>+            strongFailBlock->append(BranchTest32, Arg::resCond(MacroAssembler::Zero), tmp, Arg::bitImm(-1));
>+            strongFailBlock->setSuccessors(failBlock, reloopBlock);
>+        }
>+    }
>+    
>+    bool appendVoidAtomic(Air::Opcode atomicOpcode)
>+    {
>+        if (m_useCounts.numUses(m_value))
>+            return false;
>+        
>+        Arg address = addr(m_value);
>+        
>+        if (isValidForm(atomicOpcode, Arg::Imm, address.kind()) && imm(m_value->child(0))) {
>+            append(atomicOpcode, imm(m_value->child(0)), address);
>+            return true;
>+        }
>+        
>+        if (isValidForm(atomicOpcode, Arg::Tmp, address.kind())) {
>+            append(atomicOpcode, tmp(m_value->child(0)), address);
>+            return true;
>+        }
>+        
>+        return true;
>+    }
>+    
>+    void appendGeneralAtomic(Air::Opcode opcode)
>+    {
>+        AtomicValue* atomic = m_value->as<AtomicValue>();
>+        
>+        Arg address = addr(m_value);
>+        Tmp oldValue = m_code.newTmp(GP);
>+        Tmp newValue = m_code.newTmp(GP);
>+        
>+        // We need a CAS loop or a LL/SC loop. Using prepare/attempt jargon, we want:
>+        //
>+        // Block #reloop:
>+        //     Prepare
>+        //     opcode
>+        //     Attempt
>+        //   Successors: Then:#done, Else:#reloop
>+        // Block #done:
>+        //     Move oldValue, result
>+        
>+        append(relaxedMoveForType(atomic->type()), oldValue, tmp(atomic));
>+        
>+        Air::BasicBlock* reloopBlock = newBlock();
>+        Air::BasicBlock* beginBlock;
>+        Air::BasicBlock* doneBlock;
>+        splitBlock(beginBlock, doneBlock);
>+        
>+        append(Jump);
>+        beginBlock->setSuccessors(reloopBlock);
>+        
>+        Air::Opcode prepareOpcode;
>+        if (isX86()) {
>+            switch (atomic->operationWidth()) {
>+            case Width8:
>+                prepareOpcode = Load8SignedExtendTo32;
>+                break;
>+            case Width16:
>+                prepareOpcode = Load16SignedExtendTo32;
>+                break;
>+            case Width32:
>+                prepareOpcode = Move32;
>+                break;
>+            case Width64:
>+                prepareOpcode = Move;
>+                break;
>+            }
>+        } else {
>+            RELEASE_ASSERT(isARM64());
>+            opcode = loadLinkOpcode(atomic->operationWidth(), atomic->hasFence());
>+        }
>+        reloopBlock->append(prepareOpcode, m_value, address, oldValue);
>+        
>+        if (opcode != Nop) {
>+            if (imm(atomic->child(0)) && isValidForm(opcode, Arg::Imm, Arg::Tmp, Arg::Tmp))
>+                reloopBlock->append(opcode, m_value, imm(atomic->child(0)), oldValue, newValue);
>+            else if (isValidForm(opcode, Arg::Tmp, Arg::Tmp, Arg::Tmp))
>+                reloopBlock->append(opcode, m_value, tmp(atomic->child(0)), oldValue, newValue);
>+            else {
>+                reloopBlock->append(relaxedMoveForType(atomic->type()), oldValue, newValue);
>+                if (imm(atomic->child(0)) && isValidForm(opcode, Arg::Imm, Arg::Tmp))
>+                    reloopBlock->append(opcode, m_value, imm(atomic->child(0)), newValue);
>+                else
>+                    reloopBlock->append(opcode, m_value, tmp(atomic->child(0)), newValue);
>+            }
>+        }
>+
>+        if (isX86()) {
>+            Air::Opcode casOpcode = OPCODE_FOR_WIDTH(BranchAtomicStrongCAS, atomic->operationWidth());
>+            reloopBlock->append(relaxedMoveForType(atomic->type()), oldValue, m_eax);
>+            reloopBlock->append(casOpcode, m_value, Arg::statusCond(MacroAssembler::Success), m_eax, newValue, address);
>+        } else {
>+            RELEASE_ASSERT(isARM64());
>+            Tmp boolResult = m_code.newTmp(GP);
>+            reloopBlock->append(storeCondOpcode(atomic->operationWidth(), atomic->hasFence()), newValue, address, boolResult);
>+            reloopBlock->append(BranchTest32, Arg::resCond(MacroAssembler::Zero), boolResult, Arg::bitImm(-1));
>+        }
>+        reloopBlock->setSuccessors(doneBlock, reloopBlock);
>+    }
>+    
>     void lower()
>     {
>         switch (m_value->opcode()) {
>@@ -1971,30 +2362,50 @@ private:
>         }
>             
>         case Load: {
>-            append(trappingInst(m_value, moveForType(m_value->type()), m_value, addr(m_value), tmp(m_value)));
>+            MemoryValue* memory = m_value->as<MemoryValue>();
>+            Air::Opcode opcode = Air::Oops;
>+            if (memory->hasFence()) {
>+                switch (memory->type()) {
>+                case Int32:
>+                    opcode = LoadAcq32;
>+                    break;
>+                case Int64:
>+                    opcode = LoadAcq64;
>+                    break;
>+                default:
>+                    RELEASE_ASSERT_NOT_REACHED();
>+                    break;
>+                }
>+            } else
>+                opcode = moveForType(memory->type());
>+            append(trappingInst(m_value, opcode, m_value, addr(m_value), tmp(m_value)));
>             return;
>         }
>             
>         case Load8S: {
>-            append(trappingInst(m_value, Load8SignedExtendTo32, m_value, addr(m_value), tmp(m_value)));
>+            Air::Opcode opcode = m_value->as<MemoryValue>()->hasFence() ? LoadAcq8SignedExtendTo32 : Load8SignedExtendTo32;
>+            append(trappingInst(m_value, opcode, m_value, addr(m_value), tmp(m_value)));
>             return;
>         }
> 
>         case Load8Z: {
>-            append(trappingInst(m_value, Load8, m_value, addr(m_value), tmp(m_value)));
>+            Air::Opcode opcode = m_value->as<MemoryValue>()->hasFence() ? LoadAcq8 : Load8;
>+            append(trappingInst(m_value, opcode, m_value, addr(m_value), tmp(m_value)));
>             return;
>         }
> 
>         case Load16S: {
>-            append(trappingInst(m_value, Load16SignedExtendTo32, m_value, addr(m_value), tmp(m_value)));
>+            Air::Opcode opcode = m_value->as<MemoryValue>()->hasFence() ? LoadAcq16SignedExtendTo32 : Load16SignedExtendTo32;
>+            append(trappingInst(m_value, opcode, m_value, addr(m_value), tmp(m_value)));
>             return;
>         }
> 
>         case Load16Z: {
>-            append(trappingInst(m_value, Load16, m_value, addr(m_value), tmp(m_value)));
>+            Air::Opcode opcode = m_value->as<MemoryValue>()->hasFence() ? LoadAcq16 : Load16;
>+            append(trappingInst(m_value, opcode, m_value, addr(m_value), tmp(m_value)));
>             return;
>         }
>-
>+            
>         case Add: {
>             if (tryAppendLea())
>                 return;
>@@ -2092,7 +2503,7 @@ private:
>             if (m_value->isChill())
>                 RELEASE_ASSERT(isARM64());
>             if (isInt(m_value->type()) && isX86()) {
>-                lowerX86Div(Div);
>+                appendX86Div(Div);
>                 return;
>             }
>             ASSERT(!isX86() || isFloat(m_value->type()));
>@@ -2103,7 +2514,7 @@ private:
> 
>         case UDiv: {
>             if (isInt(m_value->type()) && isX86()) {
>-                lowerX86UDiv(UDiv);
>+                appendX86UDiv(UDiv);
>                 return;
>             }
> 
>@@ -2117,13 +2528,13 @@ private:
>         case Mod: {
>             RELEASE_ASSERT(isX86());
>             RELEASE_ASSERT(!m_value->isChill());
>-            lowerX86Div(Mod);
>+            appendX86Div(Mod);
>             return;
>         }
> 
>         case UMod: {
>             RELEASE_ASSERT(isX86());
>-            lowerX86UDiv(UMod);
>+            appendX86UDiv(UMod);
>             return;
>         }
> 
>@@ -2162,10 +2573,24 @@ private:
>                 appendUnOp<Not32, Not64>(m_value->child(0));
>                 return;
>             }
>+            
>+            if (m_value->child(1)->isInt(1)
>+                && isAtomicCAS(m_value->child(0)->opcode())
>+                && canBeInternal(m_value->child(0))) {
>+                commitInternal(m_value->child(0));
>+                appendCAS(m_value->child(0), true);
>+                return;
>+            }
>+            
>             appendBinOp<Xor32, Xor64, XorDouble, XorFloat, Commutative>(
>                 m_value->child(0), m_value->child(1));
>             return;
>         }
>+            
>+        case Depend: {
>+            appendUnOp<Depend32, Depend64>(m_value->child(0));
>+            return;
>+        }
> 
>         case Shl: {
>             if (m_value->child(1)->isInt32(1)) {
>@@ -2266,7 +2691,7 @@ private:
>                 }
>             }
> 
>-            appendStore(valueToStore, addr(m_value));
>+            appendStore(m_value, addr(m_value));
>             return;
>         }
> 
>@@ -2287,7 +2712,7 @@ private:
>                     return;
>                 }
>             }
>-            appendStore(Air::Store8, valueToStore, addr(m_value));
>+            appendStore(m_value, valueToStore, addr(m_value));
>             return;
>         }
> 
>@@ -2308,7 +2733,7 @@ private:
>                     return;
>                 }
>             }
>-            appendStore(Air::Store16, valueToStore, addr(m_value));
>+            appendStore(m_value, valueToStore, addr(m_value));
>             return;
>         }
> 
>@@ -2416,7 +2841,22 @@ private:
>         }
> 
>         case Equal:
>-        case NotEqual:
>+        case NotEqual: {
>+            if (m_value->child(0)->opcode() == AtomicStrongCAS
>+                && m_value->child(0)->child(0) == m_value->child(1)
>+                && canBeInternal(m_value->child(0))) {
>+                ASSERT(!m_locked.contains(m_value->child(0)->child(1)));
>+                ASSERT(!m_locked.contains(m_value->child(1)));
>+                
>+                commitInternal(m_value->child(0));
>+                appendCAS(m_value->child(0), m_value->opcode() == NotEqual);
>+                return;
>+            }
>+                
>+            m_insts.last().append(createCompare(m_value));
>+            return;
>+        }
>+            
>         case LessThan:
>         case GreaterThan:
>         case LessEqual:
>@@ -2727,6 +3167,39 @@ private:
>         }
> 
>         case Branch: {
>+            if (canBeInternal(m_value->child(0))) {
>+                Value* branchChild = m_value->child(0);
>+                switch (branchChild->opcode()) {
>+                case AtomicWeakCAS:
>+                    commitInternal(branchChild);
>+                    appendCAS(branchChild, false);
>+                    return;
>+                    
>+                case AtomicStrongCAS:
>+                    // A branch is a comparison to zero.
>+                    if (branchChild->child(0)->isInt(0)) {
>+                        commitInternal(branchChild);
>+                        appendCAS(branchChild, false);
>+                        return;
>+                    }
>+                    break;
>+                    
>+                case Equal:
>+                case NotEqual:
>+                    if (branchChild->child(0)->opcode() == AtomicStrongCAS
>+                        && canBeInternal(branchChild->opcode(0))
>+                        && branchChild->child(0)->child(0) == branchChild->child(1)) {
>+                        commitInternal(branchChild);
>+                        commitInternal(branchChild->child(0));
>+                        appendCAS(branchChild->child(0), branchChild->opcode() == NotEqual);
>+                        return;
>+                    }
>+                    
>+                default:
>+                    break;
>+                }
>+            }
>+            
>             m_insts.last().append(createBranch(m_value->child(0)));
>             return;
>         }
>@@ -2784,7 +3257,81 @@ private:
>             append(Air::EntrySwitch);
>             return;
>         }
>+            
>+        case AtomicWeakCAS:
>+        case AtomicStrongCAS: {
>+            appendCAS(m_value, false);
>+            return;
>+        }
>+            
>+        case AtomicXchgAdd: {
>+            AtomicValue* atomic = m_value->as<AtomicValue>();
>+            if (appendVoidAtomic(OPCODE_FOR_WIDTH(AtomicAdd, atomic->operationWidth())))
>+                return;
>+            
>+            Arg address = addr(atomic);
>+            Air::Opcode opcode = OPCODE_FOR_WIDTH(AtomicXchgAdd, atomic->operationWidth());
>+            if (isValidOpcode(opcode, Arg::Tmp, address)) {
>+                append(relaxedMoveForType(atomic->type()), tmp(atomic->child(0)), tmp(atomic));
>+                append(opcode, tmp(atomic), address);
>+                return;
>+            }
>+
>+            appendGeneralAtomic(OPCODE_FOR_WIDTH(Add, canonicalWidth(atomic->operationWidth())));
>+            return;
>+        }
> 
>+        case AtomicXchgSub: {
>+            AtomicValue* atomic = m_value->as<AtomicValue>();
>+            if (appendVoidAtomic(OPCODE_FOR_WIDTH(AtomicSub, atomic->operationWidth())))
>+                return;
>+            
>+            appendGeneralAtomic(OPCODE_FOR_WIDTH(Sub, canonicalWidth(atomic->operationWidth())));
>+            return;
>+        }
>+            
>+        case AtomicXchgAnd: {
>+            AtomicValue* atomic = m_value->as<AtomicValue>();
>+            if (appendVoidAtomic(OPCODE_FOR_WIDTH(AtomicAnd, atomic->operationWidth())))
>+                return;
>+            
>+            appendGeneralAtomic(OPCODE_FOR_WIDTH(And, canonicalWidth(atomic->operationWidth())));
>+            return;
>+        }
>+            
>+        case AtomicXchgOr: {
>+            AtomicValue* atomic = m_value->as<AtomicValue>();
>+            if (appendVoidAtomic(OPCODE_FOR_WIDTH(AtomicOr, atomic->operationWidth())))
>+                return;
>+            
>+            appendGeneralAtomic(OPCODE_FOR_WIDTH(Or, canonicalWidth(atomic->operationWidth())));
>+            return;
>+        }
>+            
>+        case AtomicXchgXor: {
>+            AtomicValue* atomic = m_value->as<AtomicValue>();
>+            if (appendVoidAtomic(OPCODE_FOR_WIDTH(AtomicXor, atomic->operationWidth())))
>+                return;
>+            
>+            appendGeneralAtomic(OPCODE_FOR_WIDTH(Xor, canonicalWidth(atomic->operationWidth())));
>+            return;
>+        }
>+            
>+        case AtomicXchg: {
>+            AtomicValue* atomic = m_value->as<AtomicValue>();
>+            
>+            Arg address = addr(atomic);
>+            Air::Opcode opcode = OPCODE_FOR_WIDTH(AtomicXchg, atomic->operationWidth());
>+            if (isValidOpcode(opcode, Arg::Tmp, address)) {
>+                append(relaxedMoveForType(atomic->type()), tmp(atomic->child(0)), tmp(atomic));
>+                append(opcode, tmp(atomic), address);
>+                return;
>+            }
>+            
>+            appendGeneralAtomic(OPCODE_FOR_WIDTH(Xor, canonicalWidth(atomic->operationWidth())));
>+            return;
>+        }
>+            
>         default:
>             break;
>         }
>@@ -2792,64 +3339,7 @@ private:
>         dataLog("FATAL: could not lower ", deepDump(m_procedure, m_value), "\n");
>         RELEASE_ASSERT_NOT_REACHED();
>     }
>-
>-    void lowerX86Div(B3::Opcode op)
>-    {
>-#if CPU(X86) || CPU(X86_64)
>-        Tmp eax = Tmp(X86Registers::eax);
>-        Tmp edx = Tmp(X86Registers::edx);
>-
>-        Air::Opcode convertToDoubleWord;
>-        Air::Opcode div;
>-        switch (m_value->type()) {
>-        case Int32:
>-            convertToDoubleWord = X86ConvertToDoubleWord32;
>-            div = X86Div32;
>-            break;
>-        case Int64:
>-            convertToDoubleWord = X86ConvertToQuadWord64;
>-            div = X86Div64;
>-            break;
>-        default:
>-            RELEASE_ASSERT_NOT_REACHED();
>-            return;
>-        }
>-
>-        ASSERT(op == Div || op == Mod);
>-        X86Registers::RegisterID result = op == Div ? X86Registers::eax : X86Registers::edx;
>-
>-        append(Move, tmp(m_value->child(0)), eax);
>-        append(convertToDoubleWord, eax, edx);
>-        append(div, eax, edx, tmp(m_value->child(1)));
>-        append(Move, Tmp(result), tmp(m_value));
>-
>-#else
>-        UNUSED_PARAM(op);
>-        UNREACHABLE_FOR_PLATFORM();
>-#endif
>-    }
>-
>-    void lowerX86UDiv(B3::Opcode op)
>-    {
>-#if CPU(X86) || CPU(X86_64)
>-        Tmp eax = Tmp(X86Registers::eax);
>-        Tmp edx = Tmp(X86Registers::edx);
>-
>-        Air::Opcode div = m_value->type() == Int32 ? X86UDiv32 : X86UDiv64;
>-
>-        ASSERT(op == UDiv || op == UMod);
>-        X86Registers::RegisterID result = op == UDiv ? X86Registers::eax : X86Registers::edx;
>-
>-        append(Move, tmp(m_value->child(0)), eax);
>-        append(Xor64, edx, edx);
>-        append(div, eax, edx, tmp(m_value->child(1)));
>-        append(Move, Tmp(result), tmp(m_value));
>-#else
>-        UNUSED_PARAM(op);
>-        UNREACHABLE_FOR_PLATFORM();
>-#endif
>-    }
>-
>+    
>     IndexSet<Value> m_locked; // These are values that will have no Tmp in Air.
>     IndexMap<Value, Tmp> m_valueToTmp; // These are values that must have a Tmp in Air. We say that a Value* with a non-null Tmp is "pinned".
>     IndexMap<Value, Tmp> m_phiToTmp; // Each Phi gets its own Tmp.
>@@ -2864,7 +3354,7 @@ private:
> 
>     Vector<Vector<Inst, 4>> m_insts;
>     Vector<Inst> m_prologue;
>-
>+    
>     B3::BasicBlock* m_block;
>     bool m_isRare;
>     unsigned m_index;
>@@ -2875,6 +3365,12 @@ private:
> 
>     Procedure& m_procedure;
>     Code& m_code;
>+
>+    Air::BlockInsertionSet m_blockInsertionSet;
>+
>+    Tmp m_eax;
>+    Tmp m_ecx;
>+    Tmp m_edx;
> };
> 
> } // anonymous namespace
>Index: Source/JavaScriptCore/b3/B3MemoryValue.cpp
>===================================================================
>--- Source/JavaScriptCore/b3/B3MemoryValue.cpp	(revision 212990)
>+++ Source/JavaScriptCore/b3/B3MemoryValue.cpp	(working copy)
>@@ -34,30 +34,48 @@ MemoryValue::~MemoryValue()
> {
> }
> 
>+Type MemoryValue::accessType() const
>+{
>+    if (isLoad(opcode()))
>+        return type();
>+    // This happens to work for atomics, too. That's why AtomicValue does not need to override this.
>+    return child(0)->type();
>+}
>+
>+Bank MemoryValue::accessBank() const
>+{
>+    return bankForType(accessType());
>+}
>+
> size_t MemoryValue::accessByteSize() const
> {
>+    return bytes(accessWidth());
>+}
>+
>+Width MemoryValue::loadStoreWidth() const
>+{
>     switch (opcode()) {
>     case Load8Z:
>     case Load8S:
>     case Store8:
>-        return 1;
>+        return Width8;
>     case Load16Z:
>     case Load16S:
>     case Store16:
>-        return 2;
>+        return Width16;
>     case Load:
>-        return sizeofType(type());
>+        return widthForType(type());
>     case Store:
>-        return sizeofType(child(0)->type());
>+        return widthForType(child(0)->type());
>     default:
>         RELEASE_ASSERT_NOT_REACHED();
>-        return 0;
>+        return Width8;
>     }
> }
> 
> Width MemoryValue::accessWidth() const
> {
>-    return widthForBytes(accessByteSize());
>+    return loadStoreWidth();
> }
> 
> void MemoryValue::dumpMeta(CommaPrinter& comma, PrintStream& out) const
>@@ -67,6 +85,8 @@ void MemoryValue::dumpMeta(CommaPrinter&
>     if ((isLoad() && effects().reads != range())
>         || (isStore() && effects().writes != range()))
>         out.print(comma, "range = ", range());
>+    if (phantomRange())
>+        out.print(comma, "phantomRange = ", phantomRange());
> }
> 
> Value* MemoryValue::cloneImpl() const
>@@ -74,6 +94,58 @@ Value* MemoryValue::cloneImpl() const
>     return new MemoryValue(*this);
> }
> 
>+// Use this form for Load (but not Load8Z, Load8S, or any of the Loads that have a suffix that
>+// describes the returned type).
>+MemoryValue::MemoryValue(Kind kind, Type type, Origin origin, Value* pointer, int32_t offset = 0)
>+    : Value(CheckedOpcode, kind, type, origin, pointer)
>+    , m_offset(offset)
>+{
>+    if (!ASSERT_DISABLED) {
>+        switch (kind.opcode()) {
>+        case Load:
>+            break;
>+        case Load8Z:
>+        case Load8S:
>+        case Load16Z:
>+        case Load16S:
>+            ASSERT(type == Int32);
>+            break;
>+        case Store8:
>+        case Store16:
>+        case Store:
>+            ASSERT(type == Void);
>+            break;
>+        default:
>+            ASSERT_NOT_REACHED();
>+        }
>+    }
>+}
>+
>+// Use this form for loads where the return type is implied.
>+MemoryValue::MemoryValue(Kind kind, Origin origin, Value* pointer, int32_t offset = 0)
>+    : MemoryValue(kind, Int32, origin, pointer, offset)
>+{
>+    if (!ASSERT_DISABLED) {
>+        switch (kind.opcode()) {
>+        case Load8Z:
>+        case Load8S:
>+        case Load16Z:
>+        case Load16S:
>+            break;
>+        default:
>+            ASSERT_NOT_REACHED();
>+        }
>+    }
>+}
>+
>+// Use this form for stores.
>+MemoryValue::MemoryValue(Kind kind, Origin origin, Value* value, Value* pointer, int32_t offset = 0)
>+    : Value(CheckedOpcode, kind, Void, origin, value, pointer)
>+    , m_offset(offset)
>+{
>+    ASSERT(isStore(kind.opcode()));
>+}
>+
> } } // namespace JSC::B3
> 
> #endif // ENABLE(B3_JIT)
>Index: Source/JavaScriptCore/b3/B3MemoryValue.h
>===================================================================
>--- Source/JavaScriptCore/b3/B3MemoryValue.h	(revision 212990)
>+++ Source/JavaScriptCore/b3/B3MemoryValue.h	(working copy)
>@@ -27,48 +27,17 @@
> 
> #if ENABLE(B3_JIT)
> 
>+#include "B3Bank.h"
> #include "B3HeapRange.h"
> #include "B3Value.h"
> 
> namespace JSC { namespace B3 {
> 
>-// FIXME: We want to allow fenced memory accesses on ARM.
>-// https://bugs.webkit.org/show_bug.cgi?id=162349
>-
> class JS_EXPORT_PRIVATE MemoryValue : public Value {
> public:
>     static bool accepts(Kind kind)
>     {
>-        switch (kind.opcode()) {
>-        case Load8Z:
>-        case Load8S:
>-        case Load16Z:
>-        case Load16S:
>-        case Load:
>-        case Store8:
>-        case Store16:
>-        case Store:
>-            return true;
>-        default:
>-            return false;
>-        }
>-    }
>-
>-    static bool isStore(Kind kind)
>-    {
>-        switch (kind.opcode()) {
>-        case Store8:
>-        case Store16:
>-        case Store:
>-            return true;
>-        default:
>-            return false;
>-        }
>-    }
>-
>-    static bool isLoad(Kind kind)
>-    {
>-        return accepts(kind) && !isStore(kind);
>+        return isMemory(kind.opcode());
>     }
> 
>     ~MemoryValue();
>@@ -78,76 +47,56 @@ public:
> 
>     const HeapRange& range() const { return m_range; }
>     void setRange(const HeapRange& range) { m_range = range; }
>+    
>+    // This is an alias for range.
>+    const HeapRange& accessRange() const { return range(); }
>+    void setAccessRange(const HeapRange& range) { setRange(range); }
>+    
>+    const HeapRange& fenceRange() const { return m_fenceRange; }
>+    void setFenceRange(const HeapRange& range) { m_fenceRange = range; }
>+
>+    bool isStore() const { return isStore(opcode()); }
>+    bool isLoad() const { return isLoad(opcode()); }
> 
>-    bool isStore() const { return type() == Void; }
>-    bool isLoad() const { return type() != Void; }
>+    bool hasFence() const { return !!fenceRange(); }
> 
>+    Type accessType() const;
>+    Bank accessBank() const;
>     size_t accessByteSize() const;
>-    Width accessWidth() const;
>+    
>+    // Slightly faster version of accessWidth, if you know that you're working with a load or store.
>+    Width loadStoreWidth() const;
>+    
>+    virtual Width accessWidth() const;
> 
> protected:
>-    void dumpMeta(CommaPrinter& comma, PrintStream&) const override;
>+    void dumpMeta(CommaPrinter&, PrintStream&) const override;
> 
>     Value* cloneImpl() const override;
> 
> private:
>     friend class Procedure;
>-
>-    // Use this form for Load (but not Load8Z, Load8S, or any of the Loads that have a suffix that
>-    // describes the returned type).
>-    MemoryValue(Kind kind, Type type, Origin origin, Value* pointer, int32_t offset = 0)
>-        : Value(CheckedOpcode, kind, type, origin, pointer)
>+    
>+    template<typename... Arguments>
>+    MemoryValue(CheckedOpcodeTag, Kind kind, Type type, Origin origin, int32_t offset, Arguments... arguments)
>+        : Value(CheckedOpcode, kind, type, origin, arguments...)
>         , m_offset(offset)
>-        , m_range(HeapRange::top())
>     {
>-        if (!ASSERT_DISABLED) {
>-            switch (kind.opcode()) {
>-            case Load:
>-                break;
>-            case Load8Z:
>-            case Load8S:
>-            case Load16Z:
>-            case Load16S:
>-                ASSERT(type == Int32);
>-                break;
>-            case Store8:
>-            case Store16:
>-            case Store:
>-                ASSERT(type == Void);
>-                break;
>-            default:
>-                ASSERT_NOT_REACHED();
>-            }
>-        }
>     }
>+    
>+    // Use this form for Load (but not Load8Z, Load8S, or any of the Loads that have a suffix that
>+    // describes the returned type).
>+    MemoryValue(Kind, Type, Origin, Value* pointer, int32_t offset = 0);
> 
>     // Use this form for loads where the return type is implied.
>-    MemoryValue(Kind kind, Origin origin, Value* pointer, int32_t offset = 0)
>-        : MemoryValue(kind, Int32, origin, pointer, offset)
>-    {
>-    }
>+    MemoryValue(Kind, Origin, Value* pointer, int32_t offset = 0);
> 
>     // Use this form for stores.
>-    MemoryValue(Kind kind, Origin origin, Value* value, Value* pointer, int32_t offset = 0)
>-        : Value(CheckedOpcode, kind, Void, origin, value, pointer)
>-        , m_offset(offset)
>-        , m_range(HeapRange::top())
>-    {
>-        if (!ASSERT_DISABLED) {
>-            switch (kind.opcode()) {
>-            case Store8:
>-            case Store16:
>-            case Store:
>-                break;
>-            default:
>-                ASSERT_NOT_REACHED();
>-                break;
>-            }
>-        }
>-    }
>-
>+    MemoryValue(Kind, Origin, Value* value, Value* pointer, int32_t offset = 0);
>+    
>     int32_t m_offset { 0 };
>-    HeapRange m_range;
>+    HeapRange m_range { HeapRange::top() };
>+    HeapRange m_fenceRange { HeapRange() };
> };
> 
> } } // namespace JSC::B3
>Index: Source/JavaScriptCore/b3/B3Opcode.h
>===================================================================
>--- Source/JavaScriptCore/b3/B3Opcode.h	(revision 212990)
>+++ Source/JavaScriptCore/b3/B3Opcode.h	(working copy)
>@@ -1,5 +1,5 @@
> /*
>- * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
>+ * Copyright (C) 2015-2017 Apple Inc. All rights reserved.
>  *
>  * Redistribution and use in source and binary forms, with or without
>  * modification, are permitted provided that the following conditions
>@@ -28,6 +28,7 @@
> #if ENABLE(B3_JIT)
> 
> #include "B3Type.h"
>+#include "B3Width.h"
> #include <wtf/Optional.h>
> #include <wtf/StdLibExtras.h>
> 
>@@ -82,7 +83,6 @@ enum Opcode : int16_t {
>     Mod, // All bets are off as to what will happen when you execute this for -2^31%-1 and x%0.
>     UMod,
> 
>-
>     // Polymorphic negation. Note that we only need this for floating point, since integer negation
>     // is exactly like Sub(0, x). But that's not true for floating point. Sub(0, 0) is 0, while
>     // Neg(0) is -0. Also, we canonicalize Sub(0, x) into Neg(x) in case of integers.
>@@ -162,6 +162,107 @@ enum Opcode : int16_t {
>     Store16,
>     // This is a polymorphic store for Int32, Int64, Float, and Double.
>     Store,
>+    
>+    // Atomic compare and swap that returns a boolean. May choose to do nothing and return false. You can
>+    // usually assume that this is faster and results in less code than AtomicStrongCAS, though that's
>+    // not necessarily true on Intel, if instruction selection does its job. Imagine that this opcode is
>+    // as if you did this atomically:
>+    //
>+    // template<typename T>
>+    // bool AtomicWeakCAS(T expectedValue, T newValue, T* ptr)
>+    // {
>+    //     if (!rand())
>+    //         return false; // Real world example of this: context switch on ARM while doing CAS.
>+    //     if (*ptr != expectedValue)
>+    //         return false;
>+    //     *ptr = newValue;
>+    //     return true;
>+    // }
>+    //
>+    // Note that all atomics put the pointer last to be consistent with how loads and stores work. This
>+    // is a goofy tradition, but it's harmless, and better than being inconsistent.
>+    //
>+    // Note that weak CAS has no fencing guarantees when it fails. This means that the following
>+    // transformation is always valid:
>+    //
>+    // Before:
>+    //
>+    //         Branch(AtomicWeakCAS(expected, new, ptr))
>+    //       Successors: Then:#success, Else:#fail
>+    //
>+    // After:
>+    //
>+    //         Branch(Equal(Load(ptr), expected))
>+    //       Successors: Then:#attempt, Else:#fail
>+    //     BB#attempt:
>+    //         Branch(AtomicWeakCAS(expected, new, ptr))
>+    //       Successors: Then:#success, Else:#fail
>+    //
>+    // Both kinds of CAS for non-canonical widths (Width8 and Width16) ignore the irrelevant bits of the
>+    // input.
>+    AtomicWeakCAS,
>+    
>+    // Atomic compare and swap that returns the old value. Does not have the nondeterminism of WeakCAS.
>+    // This is a bit more code and a bit slower in some cases, though not by a lot. Imagine that this
>+    // opcode is as if you did this atomically:
>+    //
>+    // template<typename T>
>+    // T AtomicStrongCAS(T expectedValue, T newValue, T* ptr)
>+    // {
>+    //     T oldValue = *ptr;
>+    //     if (oldValue == expectedValue)
>+    //         *ptr = newValue;
>+    //     return oldValue
>+    // }
>+    //
>+    // Note that AtomicWeakCAS and AtomicStrongCAS sort of have this kind of equivalence:
>+    //
>+    // AtomicWeakCAS(@exp, @new, @ptr) == Equal(AtomicStrongCAS(@exp, @new, @ptr), @exp)
>+    //
>+    // Assuming that the WeakCAS does not spuriously fail, of course.
>+    AtomicStrongCAS,
>+    
>+    // Atomically ___ a memory location and return the old value. Syntax:
>+    //
>+    // @oldValue = AtomicXchg___(@operand, @ptr)
>+    //
>+    // For non-canonical widths (Width8 and Width16), these return sign-extended results and ignore the
>+    // irrelevant bits of their inputs.
>+    AtomicXchgAdd,
>+    AtomicXchgAnd,
>+    AtomicXchgOr,
>+    AtomicXchgSub,
>+    AtomicXchgXor,
>+    
>+    // FIXME: Maybe we should have AtomicXchgNeg and AtomicXchgNot.
>+    
>+    // Atomically exchange a value with a memory location. Syntax:
>+    //
>+    // @oldValue = AtomicXchg(@newValue, @ptr)
>+    AtomicXchg,
>+    
>+    // Introduce an invisible dependency for blocking motion of loads with respect to each other. Syntax:
>+    //
>+    // @result = Depend(@phantom)
>+    //
>+    // This is eventually codegenerated to have local semantics as if we did:
>+    //
>+    // @result = $0
>+    //
>+    // But it ensures that the users of @result cannot execute until @phantom is computed.
>+    //
>+    // The compiler is not allowed to reason about the fact that Depend codegenerates this way. Any kind
>+    // of transformation or analysis that relies on the insight that Depend is really zero is unsound,
>+    // because it unlocks reordering of users of @result and @phantom.
>+    //
>+    // On X86, this is lowered to a load-load fence and @result uses @phantom directly.
>+    //
>+    // On ARM, this is lowered as if like:
>+    //
>+    // @result = BitXor(@phantom, @phantom)
>+    //
>+    // Except that the compiler never gets an opportunity to simplify out the BitXor.
>+    Depend,
> 
>     // This is used to compute the actual address of a Wasm memory operation. It takes an IntPtr
>     // and a pinned register then computes the appropriate IntPtr address. For the use-case of
>@@ -301,6 +402,110 @@ inline bool isDefinitelyTerminal(Opcode 
>     }
> }
> 
>+inline bool isLoad(Opcode opcode)
>+{
>+    switch (opcode) {
>+    case Load8Z:
>+    case Load8S:
>+    case Load16Z:
>+    case Load16S:
>+    case Load:
>+        return true;
>+    default:
>+        return false;
>+    }
>+}
>+
>+inline bool isStore(Opcode opcode)
>+{
>+    switch (opcode) {
>+    case Store8:
>+    case Store16:
>+    case Store:
>+        return true;
>+    default:
>+        return false;
>+    }
>+}
>+
>+inline bool isLoadStore(Opcode opcode)
>+{
>+    switch (opcode) {
>+    case Load8Z:
>+    case Load8S:
>+    case Load16Z:
>+    case Load16S:
>+    case Load:
>+    case Store8:
>+    case Store16:
>+    case Store:
>+        return true;
>+    default:
>+        return false;
>+    }
>+}
>+
>+inline bool isAtomic(Opcode opcode)
>+{
>+    switch (opcode) {
>+    case AtomicWeakCAS:
>+    case AtomicStrongCAS:
>+    case AtomicXchgAdd:
>+    case AtomicXchgAnd:
>+    case AtomicXchgOr:
>+    case AtomicXchgSub:
>+    case AtomicXchgXor:
>+    case AtomicXchg:
>+        return true;
>+    default:
>+        return false;
>+    }
>+}
>+
>+inline bool isAtomicCAS(Opcode opcode)
>+{
>+    switch (opcode) {
>+    case AtomicWeakCAS:
>+    case AtomicStrongCAS:
>+        return true;
>+    default:
>+        return false;
>+    }
>+}
>+
>+inline bool isAtomicXchg(Opcode opcode)
>+{
>+    switch (opcode) {
>+    case AtomicXchgAdd:
>+    case AtomicXchgAnd:
>+    case AtomicXchgOr:
>+    case AtomicXchgSub:
>+    case AtomicXchgXor:
>+    case AtomicXchg:
>+        return true;
>+    default:
>+        return false;
>+    }
>+}
>+
>+inline bool isMemoryAccess(Opcode opcode)
>+{
>+    return isAtomic(opcode) || isLoadStore(opcode);
>+}
>+
>+inline Opcode signExtendOpcode(Width width)
>+{
>+    switch (width) {
>+    case Width8:
>+        return SExt8;
>+    case Width16:
>+        return SExt16;
>+    default:
>+        RELEASE_ASSERT_NOT_REACHED();
>+        return Oops;
>+    }
>+}
>+
> } } // namespace JSC::B3
> 
> namespace WTF {
>Index: Source/JavaScriptCore/b3/B3Procedure.cpp
>===================================================================
>--- Source/JavaScriptCore/b3/B3Procedure.cpp	(revision 212990)
>+++ Source/JavaScriptCore/b3/B3Procedure.cpp	(working copy)
>@@ -202,6 +202,8 @@ void Procedure::dump(PrintStream& out) c
>         }
>         dataLog("    ", deepDump(*this, value), "\n");
>     }
>+    if (hasQuirks())
>+        out.print("Has Quirks: True\n");
>     if (variables().size()) {
>         out.print("Variables:\n");
>         for (Variable* variable : variables())
>Index: Source/JavaScriptCore/b3/B3Procedure.h
>===================================================================
>--- Source/JavaScriptCore/b3/B3Procedure.h	(revision 212990)
>+++ Source/JavaScriptCore/b3/B3Procedure.h	(working copy)
>@@ -117,6 +117,7 @@ public:
>     Value* addIntConstant(Origin, Type, int64_t value);
>     Value* addIntConstant(Value*, int64_t value);
> 
>+    // You're guaranteed that bottom is zero.
>     Value* addBottom(Origin, Type);
>     Value* addBottom(Value*);
> 
>@@ -195,6 +196,12 @@ public:
>     // alive. Great for compiler-generated data sections, like switch jump tables and constant pools.
>     // This returns memory that has been zero-initialized.
>     JS_EXPORT_PRIVATE void* addDataSection(size_t);
>+    
>+    // Some operations are specified in B3 IR to behave one way but on this given CPU they behave a
>+    // different way. When true, those B3 IR ops switch to behaving the CPU way, and the optimizer may
>+    // start taking advantage of it.
>+    bool hasQuirks() const { return m_hasQuirks; }
>+    void setHasQuirks(bool value) { m_hasQuirks = value; }
> 
>     OpaqueByproducts& byproducts() { return *m_byproducts; }
> 
>@@ -252,6 +259,7 @@ private:
>     RefPtr<SharedTask<void(PrintStream&, Origin)>> m_originPrinter;
>     const void* m_frontendData;
>     PCToOriginMap m_pcToOriginMap;
>+    bool m_hasQuirks { false };
> };
> 
> } } // namespace JSC::B3
>Index: Source/JavaScriptCore/b3/B3ReduceStrength.cpp
>===================================================================
>--- Source/JavaScriptCore/b3/B3ReduceStrength.cpp	(revision 212990)
>+++ Source/JavaScriptCore/b3/B3ReduceStrength.cpp	(working copy)
>@@ -602,7 +602,7 @@ private:
>             }
> 
>             break;
>-
>+            
>         case Neg:
>             // Turn this: Neg(constant)
>             // Into this: -constant
>@@ -1295,6 +1295,16 @@ private:
>                     break;
>                 }
>             }
>+            
>+            if (!m_proc.hasQuirks()) {
>+                // Turn this: SExt8(AtomicXchg___)
>+                // Into this: AtomicXchg___
>+                if (isAtomicXchg(m_value->child(0)->opcode())
>+                    && m_value->child(0)->as<AtomicValue>()->operationWidth() == Width8) {
>+                    replaceWithIdentity(m_value->child(0));
>+                    break;
>+                }
>+            }
>             break;
> 
>         case SExt16:
>@@ -1343,6 +1353,16 @@ private:
>                     break;
>                 }
>             }
>+
>+            if (!m_proc.hasQuirks()) {
>+                // Turn this: SExt16(AtomicXchg___)
>+                // Into this: AtomicXchg___
>+                if (isAtomicXchg(m_value->child(0)->opcode())
>+                    && m_value->child(0)->as<AtomicValue>()->operationWidth() == Width16) {
>+                    replaceWithIdentity(m_value->child(0));
>+                    break;
>+                }
>+            }
>             break;
> 
>         case SExt32:
>@@ -2101,22 +2121,25 @@ private:
>         ASSERT(m_value->numChildren() >= 2);
>         
>         // Leave it alone if the right child is a constant.
>-        if (m_value->child(1)->isConstant())
>+        if (m_value->child(1)->isConstant()
>+            || m_value->child(0)->opcode() == AtomicStrongCAS)
>             return;
>         
>-        if (m_value->child(0)->isConstant()) {
>+        auto swap = [&] () {
>             std::swap(m_value->child(0), m_value->child(1));
>             m_changed = true;
>-            return;
>-        }
>-
>+        };
>+        
>+        if (m_value->child(0)->isConstant())
>+            return swap();
>+        
>+        if (m_value->child(1)->opcode() == AtomicStrongCAS)
>+            return swap();
>+        
>         // Sort the operands. This is an important canonicalization. We use the index instead of
>         // the address to make this at least slightly deterministic.
>-        if (m_value->child(0)->index() > m_value->child(1)->index()) {
>-            std::swap(m_value->child(0), m_value->child(1));
>-            m_changed = true;
>-            return;
>-        }
>+        if (m_value->child(0)->index() > m_value->child(1)->index())
>+            return swap();
>     }
> 
>     // FIXME: This should really be a forward analysis. Instead, we uses a bounded-search backwards
>Index: Source/JavaScriptCore/b3/B3Validate.cpp
>===================================================================
>--- Source/JavaScriptCore/b3/B3Validate.cpp	(revision 212990)
>+++ Source/JavaScriptCore/b3/B3Validate.cpp	(working copy)
>@@ -346,6 +346,7 @@ public:
>                 VALIDATE(value->numChildren() == 1, ("At ", *value));
>                 VALIDATE(value->child(0)->type() == pointerType(), ("At ", *value));
>                 VALIDATE(value->type() == Int32, ("At ", *value));
>+                validateFence(value);
>                 validateStackAccess(value);
>                 break;
>             case Load:
>@@ -353,6 +354,7 @@ public:
>                 VALIDATE(value->numChildren() == 1, ("At ", *value));
>                 VALIDATE(value->child(0)->type() == pointerType(), ("At ", *value));
>                 VALIDATE(value->type() != Void, ("At ", *value));
>+                validateFence(value);
>                 validateStackAccess(value);
>                 break;
>             case Store8:
>@@ -362,6 +364,7 @@ public:
>                 VALIDATE(value->child(0)->type() == Int32, ("At ", *value));
>                 VALIDATE(value->child(1)->type() == pointerType(), ("At ", *value));
>                 VALIDATE(value->type() == Void, ("At ", *value));
>+                validateFence(value);
>                 validateStackAccess(value);
>                 break;
>             case Store:
>@@ -369,8 +372,49 @@ public:
>                 VALIDATE(value->numChildren() == 2, ("At ", *value));
>                 VALIDATE(value->child(1)->type() == pointerType(), ("At ", *value));
>                 VALIDATE(value->type() == Void, ("At ", *value));
>+                validateFence(value);
>                 validateStackAccess(value);
>                 break;
>+            case AtomicWeakCAS:
>+                VALIDATE(!value->kind().isChill(), ("At ", *value));
>+                VALIDATE(value->numChildren() == 3, ("At ", *value));
>+                VALIDATE(value->type() == Void, ("At ", *value));
>+                VALIDATE(value->child(0)->type() == value->child(1)->type(), ("At ", *value));
>+                VALIDATE(isInt(value->child(0)->type()), ("At ", *value));
>+                VALIDATE(value->child(2)->type() == pointerType(), ("At ", *value));
>+                validateAtomic(value);
>+                validateStackAccess(value);
>+                break;
>+            case AtomicStrongCAS:
>+                VALIDATE(!value->kind().isChill(), ("At ", *value));
>+                VALIDATE(value->numChildren() == 3, ("At ", *value));
>+                VALIDATE(value->type() == value->child(0)->type(), ("At ", *value));
>+                VALIDATE(value->type() == value->child(1)->type(), ("At ", *value));
>+                VALIDATE(isInt(value->type()), ("At ", *value));
>+                VALIDATE(value->child(2)->type() == pointerType(), ("At ", *value));
>+                validateAtomic(value);
>+                validateStackAccess(value);
>+                break;
>+            case AtomicXchgAdd:
>+            case AtomicXchgAnd:
>+            case AtomicXchgOr:
>+            case AtomicXchgSub:
>+            case AtomicXchgXor:
>+            case AtomicXchg:
>+                VALIDATE(!value->kind().isChill(), ("At ", *value));
>+                VALIDATE(value->numChildren() == 2, ("At ", *value));
>+                VALIDATE(value->type() == value->child(0)->type(), ("At ", *value));
>+                VALIDATE(isInt(value->type()), ("At ", *value));
>+                VALIDATE(value->child(1)->type() == pointerType(), ("At ", *value));
>+                validateAtomic(value);
>+                validateStackAccess(value);
>+                break;
>+            case Depend:
>+                VALIDATE(!value->kind().hasExtraBits(), ("At ", *value));
>+                VALIDATE(value->numChildren() == 1, ("At ", *value));
>+                VALIDATE(value->type() == value->child(0)->type(), ("At ", *value));
>+                VALIDATE(isInt(value->type()), ("At ", *value));
>+                break;
>             case WasmAddress:
>                 VALIDATE(!value->kind().hasExtraBits(), ("At ", *value));
>                 VALIDATE(value->numChildren() == 1, ("At ", *value));
>@@ -537,6 +581,20 @@ private:
>             break;
>         }
>     }
>+    
>+    void validateFence(Value* value)
>+    {
>+        MemoryValue* memory = value->as<MemoryValue>();
>+        if (memory->hasFence())
>+            VALIDATE(memorty->accessBank() == GP, ("Fence at ", *memory));
>+    }
>+    
>+    void validateAtomic(Value* value)
>+    {
>+        AtomicValue* atomic = value->as<AtomicValue>();
>+        
>+        VALIDATE(bestType(atomic->operationWidth()) == atomic->operationType(), ("At ", *value));
>+    }
> 
>     void validateStackAccess(Value* value)
>     {
>Index: Source/JavaScriptCore/b3/B3Value.cpp
>===================================================================
>--- Source/JavaScriptCore/b3/B3Value.cpp	(revision 212990)
>+++ Source/JavaScriptCore/b3/B3Value.cpp	(working copy)
>@@ -510,6 +510,7 @@ bool Value::returnsBool() const
>     case AboveEqual:
>     case BelowEqual:
>     case EqualOrUnordered:
>+    case AtomicWeakCAS:
>         return true;
>     case Phi:
>         // FIXME: We should have a story here.
>@@ -589,6 +590,7 @@ Effects Value::effects() const
>     case BelowEqual:
>     case EqualOrUnordered:
>     case Select:
>+    case Depend:
>         break;
>     case Div:
>     case UDiv:
>@@ -600,16 +602,44 @@ Effects Value::effects() const
>     case Load8S:
>     case Load16Z:
>     case Load16S:
>-    case Load:
>-        result.reads = as<MemoryValue>()->range();
>+    case Load: {
>+        MemoryValue* memory = as<MemoryValue>();
>+        result.reads = memory->range();
>+        if (memory->phantomRange()) {
>+            result.writes = memory->phantomRange();
>+            result.fence = true;
>+        }
>         result.controlDependent = true;
>         break;
>+    }
>     case Store8:
>     case Store16:
>-    case Store:
>-        result.writes = as<MemoryValue>()->range();
>+    case Store: {
>+        MemoryValue* memory = as<MemoryValue>();
>+        result.writes = memory->range();
>+        if (memory->phantomRange()) {
>+            result.reads = memory->phantomRange();
>+            result.fence = true;
>+        }
>+        result.controlDependent = true;
>+        break;
>+    }
>+    case AtomicWeakCAS:
>+    case AtomicStrongCAS:
>+    case AtomicXchgAdd:
>+    case AtomicXchgAnd:
>+    case AtomicXchgOr:
>+    case AtomicXchgSub:
>+    case AtomicXchgXor:
>+    case AtomicXchg: {
>+        MemoryValue* memory = as<MemoryValue>();
>+        result.reads = memory->range() | memory->phantomRange();
>+        result.writes = memory->range() | memorty->phantomRange();
>+        if (memory->phantomRange())
>+            result.fence = true;
>         result.controlDependent = true;
>         break;
>+    }
>     case WasmAddress:
>         result.readsPinned = true;
>         break;
>@@ -617,18 +647,7 @@ Effects Value::effects() const
>         const FenceValue* fence = as<FenceValue>();
>         result.reads = fence->read;
>         result.writes = fence->write;
>-        
>-        // Prevent killing of fences that claim not to write anything. It's a bit weird that we use
>-        // local state as the way to do this, but it happens to work: we must assume that we cannot
>-        // kill writesLocalState unless we understands exactly what the instruction is doing (like
>-        // the way that fixSSA understands Set/Get and the way that reduceStrength and others
>-        // understand Upsilon). This would only become a problem if we had some analysis that was
>-        // looking to use the writesLocalState bit to invalidate a CSE over local state operations.
>-        // Then a Fence would look block, say, the elimination of a redundant Get. But it like
>-        // that's not at all how our optimizations for Set/Get/Upsilon/Phi work - they grok their
>-        // operations deeply enough that they have no need to check this bit - so this cheat is
>-        // fine.
>-        result.writesLocalState = true;
>+        result.fence = true;
>         break;
>     }
>     case CCall:
>@@ -694,6 +713,7 @@ ValueKey Value::key() const
>     case Check:
>     case BitwiseCast:
>     case Neg:
>+    case Depend:
>         return ValueKey(kind(), type(), child(0));
>     case Add:
>     case Sub:
>Index: Source/JavaScriptCore/b3/B3Value.h
>===================================================================
>--- Source/JavaScriptCore/b3/B3Value.h	(revision 212990)
>+++ Source/JavaScriptCore/b3/B3Value.h	(working copy)
>@@ -68,6 +68,10 @@ public:
>     
>     Opcode opcode() const { return kind().opcode(); }
>     
>+    // Note that the kind is meant to be immutable. Do this when you know that this is safe. It's not
>+    // usually safe.
>+    void setKindUnsafely(Kind kind) { m_kind = kind; }
>+    
>     // It's good practice to mirror Kind methods here, so you can say value->isBlah()
>     // instead of value->kind().isBlah().
>     bool isChill() const { return kind().isChill(); }
>@@ -107,6 +111,8 @@ public:
>     // values with Identities on bottom constants. For this reason, this takes a callback that is
>     // responsible for creating bottoms. There's a utility for this, see B3BottomProvider.h. You
>     // can also access that utility using replaceWithBottom(InsertionSet&, size_t).
>+    //
>+    // You're guaranteed that bottom is zero.
>     template<typename BottomProvider>
>     void replaceWithBottom(const BottomProvider&);
>     
>@@ -321,6 +327,7 @@ private:
>         case IToF:
>         case BitwiseCast:
>         case Branch:
>+        case Depend:
>             if (UNLIKELY(numArgs != 1))
>                 badKind(kind, numArgs);
>             break;
>Index: Source/JavaScriptCore/b3/B3Width.cpp
>===================================================================
>--- Source/JavaScriptCore/b3/B3Width.cpp	(revision 212990)
>+++ Source/JavaScriptCore/b3/B3Width.cpp	(working copy)
>@@ -30,6 +30,38 @@
> 
> #include <wtf/PrintStream.h>
> 
>+namespace JSC { namespace B3 {
>+
>+Type bestType(Bank bank, Width width)
>+{
>+    switch (width) {
>+    case Width8:
>+    case Width16:
>+    case Width32:
>+        switch (bank) {
>+        case GP:
>+            return Int32;
>+        case FP:
>+            return Float;
>+        }
>+        RELEASE_ASSERT_NOT_REACHED();
>+        return Void;
>+    case Width64:
>+        switch (bank) {
>+        case GP:
>+            return Int64;
>+        case FP:
>+            return Double;
>+        }
>+        RELEASE_ASSERT_NOT_REACHED();
>+        return Void;
>+    }
>+    RELEASE_ASSERT_NOT_REACHED();
>+    return Void;
>+}
>+
>+} } // namespace JSC::B3
>+
> namespace WTF {
> 
> void printInternal(PrintStream& out, JSC::B3::Width width)
>Index: Source/JavaScriptCore/b3/B3Width.h
>===================================================================
>--- Source/JavaScriptCore/b3/B3Width.h	(revision 212990)
>+++ Source/JavaScriptCore/b3/B3Width.h	(working copy)
>@@ -62,6 +62,18 @@ inline Width widthForType(Type type)
>     ASSERT_NOT_REACHED();
> }
> 
>+inline Width canonicalWidth(Width width)
>+{
>+    return std::max(Width32, width);
>+}
>+
>+inline Width isCanonicalWidth(Width width)
>+{
>+    return width >= Width32;
>+}
>+
>+Type bestType(Bank bank, Width width);
>+
> inline Width conservativeWidth(Bank bank)
> {
>     return bank == GP ? pointerWidth() : Width64;
>@@ -93,6 +105,20 @@ inline Width widthForBytes(unsigned byte
>     }
> }
> 
>+inline uint64_t mask(Width width)
>+{
>+    switch (width) {
>+    case Width8:
>+        return 0x00000000000000ffllu;
>+    case Width16:
>+        return 0x000000000000ffffllu;
>+    case Width32:
>+        return 0x00000000ffffffffllu;
>+    case Width64:
>+        return 0xffffffffffffffffllu;
>+    }
>+}
>+
> } } // namespace JSC::B3
> 
> namespace WTF {
>Index: Source/JavaScriptCore/b3/air/AirArg.cpp
>===================================================================
>--- Source/JavaScriptCore/b3/air/AirArg.cpp	(revision 212990)
>+++ Source/JavaScriptCore/b3/air/AirArg.cpp	(working copy)
>@@ -102,6 +102,7 @@ unsigned Arg::jsHash() const
>     case RelCond:
>     case ResCond:
>     case DoubleCond:
>+    case StatusCond:
>     case WidthArg:
>         result += static_cast<unsigned>(m_offset);
>         break;
>@@ -182,6 +183,9 @@ void Arg::dump(PrintStream& out) const
>     case DoubleCond:
>         out.print(asDoubleCondition());
>         return;
>+    case StatusCond:
>+        out.print(asStatusCondition());
>+        return;
>     case Special:
>         out.print(pointerDump(special()));
>         return;
>@@ -241,6 +245,9 @@ void printInternal(PrintStream& out, Arg
>     case Arg::DoubleCond:
>         out.print("DoubleCond");
>         return;
>+    case Arg::StatusCond:
>+        out.print("StatusCond");
>+        return;
>     case Arg::Special:
>         out.print("Special");
>         return;
>@@ -285,6 +292,9 @@ void printInternal(PrintStream& out, Arg
>     case Arg::EarlyDef:
>         out.print("EarlyDef");
>         return;
>+    case Arg::EarlyZDef:
>+        out.print("EarlyZDef");
>+        return;
>     case Arg::Scratch:
>         out.print("Scratch");
>         return;
>Index: Source/JavaScriptCore/b3/air/AirArg.h
>===================================================================
>--- Source/JavaScriptCore/b3/air/AirArg.h	(revision 212990)
>+++ Source/JavaScriptCore/b3/air/AirArg.h	(working copy)
>@@ -82,6 +82,7 @@ public:
>         RelCond,
>         ResCond,
>         DoubleCond,
>+        StatusCond,
>         Special,
>         WidthArg
>     };
>@@ -151,6 +152,8 @@ public:
>         // as Use has undefined behavior: the use may happen before the def, or it may happen after
>         // it.
>         EarlyDef,
>+            
>+        EarlyZDef,
> 
>         // Some instructions need a scratch register. We model this by saying that the temporary is
>         // defined early and used late. This role implies that.
>@@ -186,6 +189,7 @@ public:
>         case ZDef:
>         case UseAddr:
>         case EarlyDef:
>+        case EarlyZDef:
>             return false;
>         }
>         ASSERT_NOT_REACHED();
>@@ -206,6 +210,7 @@ public:
>         case UseAddr:
>         case Scratch:
>         case EarlyDef:
>+        case EarlyZDef:
>             return false;
>         }
>         ASSERT_NOT_REACHED();
>@@ -228,6 +233,7 @@ public:
>         case UseAddr:
>         case Scratch:
>         case EarlyDef:
>+        case EarlyZDef:
>             return role;
>         case Use:
>             return ColdUse;
>@@ -253,6 +259,7 @@ public:
>         case LateColdUse:
>         case Scratch:
>         case EarlyDef:
>+        case EarlyZDef:
>             return false;
>         }
>         ASSERT_NOT_REACHED();
>@@ -274,6 +281,7 @@ public:
>         case ZDef:
>         case UseAddr:
>         case EarlyDef:
>+        case EarlyZDef:
>             return false;
>         }
>         ASSERT_NOT_REACHED();
>@@ -294,6 +302,7 @@ public:
>         case ZDef:
>         case UseZDef:
>         case EarlyDef:
>+        case EarlyZDef:
>         case Scratch:
>             return true;
>         }
>@@ -315,6 +324,7 @@ public:
>         case LateColdUse:
>             return false;
>         case EarlyDef:
>+        case EarlyZDef:
>         case Scratch:
>             return true;
>         }
>@@ -330,6 +340,7 @@ public:
>         case UseAddr:
>         case LateUse:
>         case EarlyDef:
>+        case EarlyZDef:
>         case Scratch:
>         case LateColdUse:
>             return false;
>@@ -358,6 +369,7 @@ public:
>             return false;
>         case ZDef:
>         case UseZDef:
>+        case EarlyZDef:
>             return true;
>         }
>         ASSERT_NOT_REACHED();
>@@ -533,6 +545,14 @@ public:
>         return result;
>     }
> 
>+    static Arg statusCond(MacroAssembler::StatusCondition condition)
>+    {
>+        Arg result;
>+        result.m_kind = StatusCond;
>+        result.m_offset = condition;
>+        return result;
>+    }
>+
>     static Arg special(Air::Special* special)
>     {
>         Arg result;
>@@ -658,12 +678,18 @@ public:
>         return kind() == DoubleCond;
>     }
> 
>+    bool isStatusCond() const
>+    {
>+        return kind() == StatusCond;
>+    }
>+
>     bool isCondition() const
>     {
>         switch (kind()) {
>         case RelCond:
>         case ResCond:
>         case DoubleCond:
>+        case StatusCond:
>             return true;
>         default:
>             return false;
>@@ -851,6 +877,7 @@ public:
>         case RelCond:
>         case ResCond:
>         case DoubleCond:
>+        case StatusCond:
>         case Special:
>         case WidthArg:
>             return true;
>@@ -872,6 +899,7 @@ public:
>         case RelCond:
>         case ResCond:
>         case DoubleCond:
>+        case StatusCond:
>         case Special:
>         case WidthArg:
>         case Invalid:
>@@ -1058,6 +1086,7 @@ public:
>         case RelCond:
>         case ResCond:
>         case DoubleCond:
>+        case StatusCond:
>         case Special:
>         case WidthArg:
>             return true;
>@@ -1177,6 +1206,12 @@ public:
>         return static_cast<MacroAssembler::DoubleCondition>(m_offset);
>     }
>     
>+    MacroAssembler::StatusCondition asStatusCondition() const
>+    {
>+        ASSERT(isStatusCond());
>+        return static_cast<MacroAssembler::StatusCondition>(m_offset);
>+    }
>+    
>     // Tells you if the Arg is invertible. Only condition arguments are invertible, and even for those, there
>     // are a few exceptions - notably Overflow and Signed.
>     bool isInvertible() const
>@@ -1184,6 +1219,7 @@ public:
>         switch (kind()) {
>         case RelCond:
>         case DoubleCond:
>+        case StatusCond:
>             return true;
>         case ResCond:
>             return MacroAssembler::isInvertible(asResultCondition());
>@@ -1204,6 +1240,8 @@ public:
>             return resCond(MacroAssembler::invert(asResultCondition()));
>         case DoubleCond:
>             return doubleCond(MacroAssembler::invert(asDoubleCondition()));
>+        case StatusCond:
>+            return statusCond(MacroAssembler::invert(asStatusCondition()));
>         default:
>             RELEASE_ASSERT_NOT_REACHED();
>             return Arg();
>Index: Source/JavaScriptCore/b3/air/AirBasicBlock.cpp
>===================================================================
>--- Source/JavaScriptCore/b3/air/AirBasicBlock.cpp	(revision 212990)
>+++ Source/JavaScriptCore/b3/air/AirBasicBlock.cpp	(working copy)
>@@ -35,6 +35,19 @@ namespace JSC { namespace B3 { namespace
> 
> const char* const BasicBlock::dumpPrefix = "#";
> 
>+void BasicBlock::setSuccessors(BasicBlock* block)
>+{
>+    m_successors.resize(1);
>+    m_successors[0] = target;
>+}
>+
>+void BasicBlock::setSuccessors(FrequentedBlock taken, FrequentedBlock notTaken)
>+{
>+    m_successors.resize(2);
>+    m_successors[0] = taken;
>+    m_successors[1] = notTaken;
>+}
>+
> bool BasicBlock::addPredecessor(BasicBlock* block)
> {
>     return B3::addPredecessor(this, block);
>Index: Source/JavaScriptCore/b3/air/AirBasicBlock.h
>===================================================================
>--- Source/JavaScriptCore/b3/air/AirBasicBlock.h	(revision 212990)
>+++ Source/JavaScriptCore/b3/air/AirBasicBlock.h	(working copy)
>@@ -99,6 +99,9 @@ public:
>     const SuccessorList& successors() const { return m_successors; }
>     SuccessorList& successors() { return m_successors; }
> 
>+    void setSuccessors(FrequentedBlock);
>+    void setSuccessors(FrequentedBlock, FrequentedBlock);
>+
>     BasicBlock* successorBlock(unsigned index) const { return successor(index).block(); }
>     BasicBlock*& successorBlock(unsigned index) { return successor(index).block(); }
>     SuccessorCollection<BasicBlock, SuccessorList> successorBlocks()
>Index: Source/JavaScriptCore/b3/air/AirBlockInsertionSet.cpp
>===================================================================
>--- Source/JavaScriptCore/b3/air/AirBlockInsertionSet.cpp	(nonexistent)
>+++ Source/JavaScriptCore/b3/air/AirBlockInsertionSet.cpp	(working copy)
>@@ -0,0 +1,49 @@
>+/*
>+ * Copyright (C) 2017 Apple Inc. All rights reserved.
>+ *
>+ * Redistribution and use in source and binary forms, with or without
>+ * modification, are permitted provided that the following conditions
>+ * are met:
>+ * 1. Redistributions of source code must retain the above copyright
>+ *    notice, this list of conditions and the following disclaimer.
>+ * 2. Redistributions in binary form must reproduce the above copyright
>+ *    notice, this list of conditions and the following disclaimer in the
>+ *    documentation and/or other materials provided with the distribution.
>+ *
>+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
>+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
>+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
>+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
>+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
>+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
>+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
>+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
>+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
>+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
>+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
>+ */
>+
>+#include "config.h"
>+#include "AirBlockInsertionSet.h"
>+
>+#if ENABLE(B3_JIT)
>+
>+#include "AirBasicBlock.h"
>+#include "AirCode.h"
>+#include <wtf/BubbleSort.h>
>+
>+namespace JSC { namespace B3 { namespace Air {
>+
>+BlockInsertionSet::BlockInsertionSet(Code &code)
>+    : GenericBlockInsertionSet(code.m_blocks)
>+{
>+}
>+
>+BlockInsertionSet::~BlockInsertionSet()
>+{
>+}
>+
>+} } } // namespace JSC::B3::Air
>+
>+#endif // ENABLE(B3_JIT)
>+
>Index: Source/JavaScriptCore/b3/air/AirBlockInsertionSet.h
>===================================================================
>--- Source/JavaScriptCore/b3/air/AirBlockInsertionSet.h	(nonexistent)
>+++ Source/JavaScriptCore/b3/air/AirBlockInsertionSet.h	(working copy)
>@@ -0,0 +1,51 @@
>+/*
>+ * Copyright (C) 2017 Apple Inc. All rights reserved.
>+ *
>+ * Redistribution and use in source and binary forms, with or without
>+ * modification, are permitted provided that the following conditions
>+ * are met:
>+ * 1. Redistributions of source code must retain the above copyright
>+ *    notice, this list of conditions and the following disclaimer.
>+ * 2. Redistributions in binary form must reproduce the above copyright
>+ *    notice, this list of conditions and the following disclaimer in the
>+ *    documentation and/or other materials provided with the distribution.
>+ *
>+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
>+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
>+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
>+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
>+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
>+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
>+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
>+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
>+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
>+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
>+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
>+ */
>+
>+#pragma once
>+
>+#if ENABLE(B3_JIT)
>+
>+#include "B3GenericBlockIsnertionSet.h"
>+#include "AirCode.h"
>+#include <wtf/Insertion.h>
>+#include <wtf/Vector.h>
>+
>+namespace JSC { namespace B3 { namespace Air {
>+
>+class InsertionSet;
>+
>+typedef GenericBlockInsertionSet<BasicBlock>::BlockInsertion BlockInsertion;
>+
>+class BlockInsertionSet : public GenericBlockInsertionSet<BasicBlock> {
>+public:
>+    BlockInsertionSet(Code&);
>+    ~BlockInsertionSet();
>+    
>+    // FIXME: We should eventually implement B3::BlockInsertionSet's splitForward().
>+};
>+
>+} } } // namespace JSC::B3::Air
>+
>+#endif // ENABLE(B3_JIT)
>Index: Source/JavaScriptCore/b3/air/AirGenerate.cpp
>===================================================================
>--- Source/JavaScriptCore/b3/air/AirGenerate.cpp	(revision 212990)
>+++ Source/JavaScriptCore/b3/air/AirGenerate.cpp	(working copy)
>@@ -73,6 +73,8 @@ void prepareForGeneration(Code& code)
>         dataLog("Initial air:\n");
>         dataLog(code);
>     }
>+    
>+    simplifyCFG(code);
> 
>     lowerMacros(code);
> 
>Index: Source/JavaScriptCore/b3/air/AirOpcode.opcodes
>===================================================================
>--- Source/JavaScriptCore/b3/air/AirOpcode.opcodes	(revision 212990)
>+++ Source/JavaScriptCore/b3/air/AirOpcode.opcodes	(working copy)
>@@ -1,4 +1,4 @@
>-# Copyright (C) 2015-2016 Apple Inc. All rights reserved.
>+# Copyright (C) 2015-2017 Apple Inc. All rights reserved.
> #
> # Redistribution and use in source and binary forms, with or without
> # modification, are permitted provided that the following conditions
>@@ -668,28 +668,380 @@ Load8 U:G:8, ZD:G:32
>     Addr, Tmp
>     Index, Tmp
> 
>+LoadAcq8 U:G:8, ZD:G:32
>+    Addr, Tmp
>+    Index, Tmp
>+
> Store8 U:G:8, D:G:8
>     Tmp, Index
>     Tmp, Addr
>     x86: Imm, Index
>     x86: Imm, Addr
> 
>+StoreRel8 U:G:8, D:G:8
>+    Tmp, Index
>+    Tmp, Addr
>+    x86: Imm, Index
>+    x86: Imm, Addr
>+
> Load8SignedExtendTo32 U:G:8, ZD:G:32
>     Addr, Tmp
>     Index, Tmp
> 
>+LoadAcq8SignedExtendTo32 U:G:8, ZD:G:32
>+    Addr, Tmp
>+    Index, Tmp
>+
> Load16 U:G:16, ZD:G:32
>     Addr, Tmp
>     Index, Tmp
> 
>+LoadAcq16 U:G:16, ZD:G:32
>+    Addr, Tmp
>+    Index, Tmp
>+
> Load16SignedExtendTo32 U:G:16, ZD:G:32
>     Addr, Tmp
>     Index, Tmp
> 
>+LoadAcq16SignedExtendTo32 U:G:16, ZD:G:32
>+    Addr, Tmp
>+    Index, Tmp
>+
> Store16 U:G:16, D:G:16
>     Tmp, Index
>     Tmp, Addr
> 
>+StoreAcq16 U:G:16, D:G:16
>+    Tmp, Index
>+    Tmp, Addr
>+
>+LoadAcq32 U:G:32 ZD:G:32
>+    Tmp, Tmp
>+    Addr, Tmp
>+    Index, Tmp
>+
>+StoreRel32 U:G:32 ZD:G:32
>+    Tmp, Addr
>+    Tmp, Index
>+    x86: Imm, Addr
>+    x86: Imm, Index
>+
>+64: LoadAcq64 U:G:64 ZD:G:64
>+    Tmp, Tmp
>+    Addr, Tmp
>+    Index, Tmp
>+
>+64: StoreRel64 U:G:64 ZD:G:64
>+    Tmp, Addr
>+    Tmp, Index
>+    x86: Imm, Addr
>+    x86: Imm, Index
>+
>+# The first operand is rax.
>+x86: AtomicStrongCAS8 U:G:32, UD:G:8, U:G:8, UD:G:8, ZD:G:8
>+    StatusCond, Tmp*, Tmp, Addr, Tmp
>+    StatusCond, Tmp*, Tmp, Index, Tmp
>+
>+x86: AtomicStrongCAS16 U:G:32, UD:G:16, U:G:32, UD:G:16, ZD:G:8
>+    StatusCond, Tmp*, Tmp, Addr, Tmp
>+    StatusCond, Tmp*, Tmp, Index, Tmp
>+
>+x86: AtomicStrongCAS32 U:G:32, UD:G:32, U:G:32, UD:G:32, ZD:G:8
>+    StatusCond, Tmp*, Tmp, Addr, Tmp
>+    StatusCond, Tmp*, Tmp, Index, Tmp
>+
>+x86_64: AtomicStrongCAS64 U:G:32, UD:G:64, U:G:64, UD:G:64, ZD:G:8
>+    StatusCond, Tmp*, Tmp, Addr, Tmp
>+    StatusCond, Tmp*, Tmp, Index, Tmp
>+
>+x86: AtomicStrongCAS8 UD:G:8, U:G:8, UD:G:8
>+    Tmp*, Tmp, Addr
>+    Tmp*, Tmp, Index
>+
>+x86: AtomicStrongCAS16 UD:G:16, U:G:32, UD:G:16
>+    Tmp*, Tmp, Addr
>+    Tmp*, Tmp, Index
>+
>+x86: AtomicStrongCAS32 UD:G:32, U:G:32, UD:G:32
>+    Tmp*, Tmp, Addr
>+    Tmp*, Tmp, Index
>+
>+x86_64: AtomicStrongCAS64 UD:G:64, U:G:64, UD:G:64
>+    Tmp*, Tmp, Addr
>+    Tmp*, Tmp, Index
>+
>+x86: BranchAtomicStrongCAS8 U:G:32, UD:G:8, U:G:8, UD:G:8 /branch
>+    StatusCond, Tmp*, Tmp, Addr
>+    StatusCond, Tmp*, Tmp, Index
>+
>+x86: BranchAtomicStrongCAS16 U:G:32, UD:G:16, U:G:32, UD:G:16 /branch
>+    StatusCond, Tmp*, Tmp, Addr
>+    StatusCond, Tmp*, Tmp, Index
>+
>+x86: BranchAtomicStrongCAS32 U:G:32, UD:G:32, U:G:32, UD:G:32 /branch
>+    StatusCond, Tmp*, Tmp, Addr
>+    StatusCond, Tmp*, Tmp, Index
>+
>+x86_64: BranchAtomicStrongCAS64 U:G:32, UD:G:64, U:G:64, UD:G:64 /branch
>+    StatusCond, Tmp*, Tmp, Addr
>+    StatusCond, Tmp*, Tmp, Index
>+
>+x86: AtomicAdd8 U:G:8, UD:G:8
>+    Imm, Addr
>+    Imm, Index
>+    Tmp, Addr
>+    Tmp, Index
>+
>+x86: AtomicAdd16 U:G:16, UD:G:16
>+    Imm, Addr
>+    Imm, Index
>+    Tmp, Addr
>+    Tmp, Index
>+
>+x86: AtomicAdd32 U:G:32, UD:G:32
>+    Imm, Addr
>+    Imm, Index
>+    Tmp, Addr
>+    Tmp, Index
>+
>+x86_64: AtomicAdd64 U:G:64, UD:G:64
>+    Imm, Addr
>+    Imm, Index
>+    Tmp, Addr
>+    Tmp, Index
>+
>+x86: AtomicSub8 U:G:8, UD:G:8
>+    Imm, Addr
>+    Imm, Index
>+    Tmp, Addr
>+    Tmp, Index
>+
>+x86: AtomicSub16 U:G:16, UD:G:16
>+    Imm, Addr
>+    Imm, Index
>+    Tmp, Addr
>+    Tmp, Index
>+
>+x86: AtomicSub32 U:G:32, UD:G:32
>+    Imm, Addr
>+    Imm, Index
>+    Tmp, Addr
>+    Tmp, Index
>+
>+x86_64: AtomicSub64 U:G:64, UD:G:64
>+    Imm, Addr
>+    Imm, Index
>+    Tmp, Addr
>+    Tmp, Index
>+
>+x86: AtomicAnd8 U:G:8, UD:G:8
>+    Imm, Addr
>+    Imm, Index
>+    Tmp, Addr
>+    Tmp, Index
>+
>+x86: AtomicAnd16 U:G:16, UD:G:16
>+    Imm, Addr
>+    Imm, Index
>+    Tmp, Addr
>+    Tmp, Index
>+
>+x86: AtomicAnd32 U:G:32, UD:G:32
>+    Imm, Addr
>+    Imm, Index
>+    Tmp, Addr
>+    Tmp, Index
>+
>+x86_64: AtomicAnd64 U:G:64, UD:G:64
>+    Imm, Addr
>+    Imm, Index
>+    Tmp, Addr
>+    Tmp, Index
>+
>+x86: AtomicOr8 U:G:8, UD:G:8
>+    Imm, Addr
>+    Imm, Index
>+    Tmp, Addr
>+    Tmp, Index
>+
>+x86: AtomicOr16 U:G:16, UD:G:16
>+    Imm, Addr
>+    Imm, Index
>+    Tmp, Addr
>+    Tmp, Index
>+
>+x86: AtomicOr32 U:G:32, UD:G:32
>+    Imm, Addr
>+    Imm, Index
>+    Tmp, Addr
>+    Tmp, Index
>+
>+x86_64: AtomicOr64 U:G:64, UD:G:64
>+    Imm, Addr
>+    Imm, Index
>+    Tmp, Addr
>+    Tmp, Index
>+
>+x86: AtomicXor8 U:G:8, UD:G:8
>+    Imm, Addr
>+    Imm, Index
>+    Tmp, Addr
>+    Tmp, Index
>+
>+x86: AtomicXor16 U:G:16, UD:G:16
>+    Imm, Addr
>+    Imm, Index
>+    Tmp, Addr
>+    Tmp, Index
>+
>+x86: AtomicXor32 U:G:32, UD:G:32
>+    Imm, Addr
>+    Imm, Index
>+    Tmp, Addr
>+    Tmp, Index
>+
>+x86_64: AtomicXor64 U:G:64, UD:G:64
>+    Imm, Addr
>+    Imm, Index
>+    Tmp, Addr
>+    Tmp, Index
>+
>+x86: AtomicNeg8 UD:G:8
>+    Addr
>+    Index
>+
>+x86: AtomicNeg16 UD:G:16
>+    Addr
>+    Index
>+
>+x86: AtomicNeg32 UD:G:32
>+    Addr
>+    Index
>+
>+x86_64: AtomicNeg64 UD:G:64
>+    Addr
>+    Index
>+
>+x86: AtomicNot8 UD:G:8
>+    Addr
>+    Index
>+
>+x86: AtomicNot16 UD:G:16
>+    Addr
>+    Index
>+
>+x86: AtomicNot32 UD:G:32
>+    Addr
>+    Index
>+
>+x86_64: AtomicNot64 UD:G:64
>+    Addr
>+    Index
>+
>+x86: AtomicXchgAdd8 UD:G:8, UD:G:8
>+    Tmp, Addr
>+    Tmp, Index
>+
>+x86: AtomicXchgAdd16 UD:G:16, UD:G:16
>+    Tmp, Addr
>+    Tmp, Index
>+
>+x86: AtomicXchgAdd32 UD:G:32, UD:G:32
>+    Tmp, Addr
>+    Tmp, Index
>+
>+x86_64: AtomicXchgAdd64 UD:G:64, UD:G:64
>+    Tmp, Addr
>+    Tmp, Index
>+
>+x86: AtomicXchg8 UD:G:8, UD:G:8
>+    Tmp, Addr
>+    Tmp, Index
>+
>+x86: AtomicXchg16 UD:G:16, UD:G:16
>+    Tmp, Addr
>+    Tmp, Index
>+
>+x86: AtomicXchg32 UD:G:32, UD:G:32
>+    Tmp, Addr
>+    Tmp, Index
>+
>+x86_64: AtomicXchg64 UD:G:64, UD:G:64
>+    Tmp, Addr
>+    Tmp, Index
>+
>+arm64: LoadLink8 U:G:8, ZD:G:8
>+    Addr, Tmp
>+    Index, Tmp
>+
>+arm64: LoadLinkAcq8 U:G:8, ZD:G:8
>+    Addr, Tmp
>+    Index, Tmp
>+
>+# Super confusing fact: this returns 0 to mean success, 1 to mean failure.
>+arm64: StoreCond8 U:G:8, D:G:8, EZD:G:8
>+    Tmp, Addr, Tmp
>+    Tmp, Index, Tmp
>+
>+arm64: StoreCondRel8 U:G:8, D:G:8, EZD:G:8
>+    Tmp, Addr, Tmp
>+    Tmp, Index, Tmp
>+
>+arm64: LoadLink16 U:G:16, ZD:G:16
>+    Addr, Tmp
>+    Index, Tmp
>+
>+arm64: LoadLinkAcq16 U:G:16, ZD:G:16
>+    Addr, Tmp
>+    Index, Tmp
>+
>+arm64: StoreCond16 U:G:16, D:G:16, EZD:G:8
>+    Tmp, Addr, Tmp
>+    Tmp, Index, Tmp
>+
>+arm64: StoreCondRel16 U:G:16, D:G:16, EZD:G:8
>+    Tmp, Addr, Tmp
>+    Tmp, Index, Tmp
>+
>+arm64: LoadLink32 U:G:32, ZD:G:32
>+    Addr, Tmp
>+    Index, Tmp
>+
>+arm64: LoadLinkAcq32 U:G:32, ZD:G:32
>+    Addr, Tmp
>+    Index, Tmp
>+
>+arm64: StoreCond32 U:G:32, D:G:32, EZD:G:8
>+    Tmp, Addr, Tmp
>+    Tmp, Index, Tmp
>+
>+arm64: StoreCondRel32 U:G:32, D:G:32, EZD:G:8
>+    Tmp, Addr, Tmp
>+    Tmp, Index, Tmp
>+
>+arm64: LoadLink64 U:G:64, ZD:G:64
>+    Addr, Tmp
>+    Index, Tmp
>+
>+arm64: LoadLinkAcq64 U:G:64, ZD:G:64
>+    Addr, Tmp
>+    Index, Tmp
>+
>+arm64: StoreCond64 U:G:64, D:G:64, EZD:G:8
>+    Tmp, Addr, Tmp
>+    Tmp, Index, Tmp
>+
>+arm64: StoreCondRel64 U:G:64, D:G:64, EZD:G:8
>+    Tmp, Addr, Tmp
>+    Tmp, Index, Tmp
>+
>+arm64: Depend32 U:G:32, D:G:32
>+    Tmp, Tmp
>+
>+arm64: Depend64 U:G:64, D:G:64
>+    Tmp, Tmp
>+
> Compare32 U:G:32, U:G:32, U:G:32, ZD:G:32
>     RelCond, Tmp, Tmp, Tmp
>     RelCond, Tmp, Imm, Tmp
>Index: Source/JavaScriptCore/b3/air/AirOptimizeBlockOrder.cpp
>===================================================================
>--- Source/JavaScriptCore/b3/air/AirOptimizeBlockOrder.cpp	(revision 212990)
>+++ Source/JavaScriptCore/b3/air/AirOptimizeBlockOrder.cpp	(working copy)
>@@ -1,5 +1,5 @@
> /*
>- * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
>+ * Copyright (C) 2015-2017 Apple Inc. All rights reserved.
>  *
>  * Redistribution and use in source and binary forms, with or without
>  * modification, are permitted provided that the following conditions
>@@ -177,6 +177,10 @@ void optimizeBlockOrder(Code& code)
>         case BranchSub64:
>         case BranchNeg32:
>         case BranchNeg64:
>+        case BranchAtomicStrongCAS8:
>+        case BranchAtomicStrongCAS16:
>+        case BranchAtomicStrongCAS32:
>+        case BranchAtomicStrongCAS64:
>             if (code.findNextBlock(block) == block->successorBlock(0) && branch.args[0].isInvertible()) {
>                 std::swap(block->successor(0), block->successor(1));
>                 branch.args[0] = branch.args[0].inverted();
>Index: Source/JavaScriptCore/b3/air/AirPadInterference.cpp
>===================================================================
>--- Source/JavaScriptCore/b3/air/AirPadInterference.cpp	(revision 212990)
>+++ Source/JavaScriptCore/b3/air/AirPadInterference.cpp	(working copy)
>@@ -48,6 +48,7 @@ void padInterference(Code& code)
>                 [&] (Arg&, Arg::Role role, Bank, Width) {
>                     switch (role) {
>                     case Arg::EarlyDef:
>+                    case Arg::EarlyZDef:
>                         hasEarlyDef = true;
>                         break;
>                     case Arg::LateUse:
>Index: Source/JavaScriptCore/b3/air/AirSpillEverything.cpp
>===================================================================
>--- Source/JavaScriptCore/b3/air/AirSpillEverything.cpp	(revision 212990)
>+++ Source/JavaScriptCore/b3/air/AirSpillEverything.cpp	(working copy)
>@@ -155,6 +155,7 @@ void spillEverything(Code& code)
>                     case Arg::LateColdUse:
>                     case Arg::Scratch:
>                     case Arg::EarlyDef:
>+                    case Arg::EarlyZDef:
>                         for (Reg reg : code.regsInPriorityOrder(bank)) {
>                             if (!setBefore.get(reg) && !setAfter.get(reg)) {
>                                 setAfter.set(reg);
>Index: Source/JavaScriptCore/b3/air/opcode_generator.rb
>===================================================================
>--- Source/JavaScriptCore/b3/air/opcode_generator.rb	(revision 212990)
>+++ Source/JavaScriptCore/b3/air/opcode_generator.rb	(working copy)
>@@ -182,7 +182,7 @@ def lex(str, fileName)
> end
> 
> def isRole(token)
>-    token =~ /\A((U)|(D)|(UD)|(ZD)|(UZD)|(UA)|(S))\Z/
>+    token =~ /\A((U)|(D)|(UD)|(ZD)|(UZD)|(UA)|(S)|(ED)|(EZD)|(LU))\Z/
> end
> 
> def isGF(token)
>@@ -190,7 +190,7 @@ def isGF(token)
> end
> 
> def isKind(token)
>-    token =~ /\A((Tmp)|(Imm)|(BigImm)|(BitImm)|(BitImm64)|(Addr)|(Index)|(RelCond)|(ResCond)|(DoubleCond))\Z/
>+    token =~ /\A((Tmp)|(Imm)|(BigImm)|(BitImm)|(BitImm64)|(Addr)|(Index)|(RelCond)|(ResCond)|(DoubleCond)|(StatusCond))\Z/
> end
> 
> def isArch(token)
>@@ -264,7 +264,7 @@ class Parser
> 
>     def consumeKind
>         result = token.string
>-        parseError("Expected kind (Imm, BigImm, BitImm, BitImm64, Tmp, Addr, Index, RelCond, ResCond, or DoubleCond)") unless isKind(result)
>+        parseError("Expected kind (Imm, BigImm, BitImm, BitImm64, Tmp, Addr, Index, RelCond, ResCond, DoubleCond, or StatusCond)") unless isKind(result)
>         advance
>         result
>     end
>@@ -651,6 +651,12 @@ writeH("OpcodeUtils") {
>                     role = "UseAddr"
>                 when "S"
>                     role = "Scratch"
>+                when "ED"
>+                    role = "EarlyDef"
>+                when "EZD"
>+                    role = "EarlyZDef"
>+                when "LU"
>+                    role = "LateUse"
>                 else
>                     raise
>                 end
>@@ -819,6 +825,7 @@ writeH("OpcodeGenerated") {
>                 when "RelCond"
>                 when "ResCond"
>                 when "DoubleCond"
>+                when "StatusCond"
>                 else
>                     raise "Unexpected kind: #{kind.name}"
>                 end
>@@ -1105,6 +1112,8 @@ writeH("OpcodeGenerated") {
>                     outp.print "args[#{index}].asResultCondition()"
>                 when "DoubleCond"
>                     outp.print "args[#{index}].asDoubleCondition()"
>+                when "StatusCond"
>+                    outp.print "args[#{index}].asStatusCondition()"
>                 end
>             }
>

Actions: View | Formatted Diff | Diff

Attachments on bug 162349: 302367 | 302571 | 302599 | 302731 | 302760 | 302761 | 302763 | 302786 | 302787 | 302795 | 302845 | 302892 | 302917 | 302922 | 302941 | 302949 | 302960 | 302963 | 302968 | 302981 | 303015 | 303078 | 303109 | 303150 | 303170 | 303237 | 303277 | 303328 | 303361 | 303369 | 303396 | 303397 | 303405 | 303435 | 303437 | 303609 | 303928