qqmljstypepropagator.cpp

Go to the documentation of this file.

// Copyright (C) 2021 The Qt Company Ltd.
// SPDX-License-Identifier: LicenseRef-Qt-Commercial OR GPL-3.0-only WITH Qt-GPL-exception-1.0
// Qt-Security score:significant
 
#include "qqmljsscope_p.h"
#include "qqmljstypepropagator_p.h"
 
#include "qqmljsutils_p.h"
 
#include <private/qv4compilerscanfunctions_p.h>
 
#include <QtQmlCompiler/private/qqmlsasourcelocation_p.h>
 
QT_BEGIN_NAMESPACE
 
using namespace Qt::StringLiterals;
 
/*!
 * \internal
 * \class QQmlJSTypePropagator
 *
 * QQmlJSTypePropagator is the initial pass that performs the type inference and
 * annotates every register in use at any instruction with the possible types it
 * may hold. This includes information on how and in what scope the values are
 * retrieved. These annotations may be used by further compile passes for
 * refinement or code generation.
 */
 
QQmlJSCompilePass::BlocksAndAnnotations QQmlJSTypePropagator::run(const Function *function)
{
    m_function = function;
    m_returnType = m_function->returnType;
 
    // We are the only pass that merges register contents. See QQmlJSTypeResolver::m_mergeCache.
    m_typeResolver->clearMergeCache();
 
    // We cannot assume anything about how a script string will be used
    if (m_returnType.containedType() == m_typeResolver->qQmlScriptStringType())
        return {};
 
    do {
        // Reset the error if we need to do another pass
        if (m_state.needsMorePasses)
            m_logger->rollback();
 
        m_logger->startTransaction();
 
        m_prevStateAnnotations = m_state.annotations;
        m_state = PassState();
        m_state.annotations = m_annotations;
        m_state.State::operator=(initialState(m_function));
 
        reset();
        decode(m_function->code.constData(), static_cast<uint>(m_function->code.size()));
 
        // If we have found unresolved backwards jumps, we need to start over with a fresh state.
        // Mind that m_jumpOriginRegisterStateByTargetInstructionOffset is retained in that case.
        // This means that we won't start over for the same reason again.
    } while (m_state.needsMorePasses);
 
    m_logger->commit();
    return { std::move(m_basicBlocks), std::move(m_state.annotations) };
}
 
#define INSTR_PROLOGUE_NOT_IMPLEMENTED()
    addError(u"Instruction \"%1\" not implemented"_s.arg(QString::fromUtf8(__func__)));
    return;
 
#define INSTR_PROLOGUE_NOT_IMPLEMENTED_POPULATES_ACC()
    addError(u"Instruction \"%1\" not implemented"_s.arg(QString::fromUtf8(__func__)));
    setVarAccumulatorAndError(); /* Keep sane state after error */
    return;
 
#define INSTR_PROLOGUE_NOT_IMPLEMENTED_IGNORE()
    m_logger->log(u"Instruction \"%1\" not implemented"_s.arg(QString::fromUtf8(__func__)),
                  qmlCompiler, QQmlJS::SourceLocation());
    return;
 
void QQmlJSTypePropagator::generate_Ret()
{
    if (m_function->isSignalHandler) {
        // Signal handlers cannot return anything.
    } else if (m_state.accumulatorIn().contains(m_typeResolver->voidType())) {
        // You can always return undefined.
    } else if (!m_returnType.isValid() && m_state.accumulatorIn().isValid()) {
        addError(u"function without return type annotation returns %1. This may prevent proper "_s
                 u"compilation to Cpp."_s.arg(m_state.accumulatorIn().descriptiveName()));
        return;
    } else if (!canConvertFromTo(m_state.accumulatorIn(), m_returnType)) {
        addError(u"cannot convert from %1 to %2"_s
                         .arg(m_state.accumulatorIn().descriptiveName(),
                              m_returnType.descriptiveName()));
        return;
    }
 
    if (m_returnType.isValid()) {
        // We need to preserve any possible undefined value as that resets the property.
        if (m_typeResolver->canHoldUndefined(m_state.accumulatorIn()))
            addReadAccumulator();
        else
            addReadAccumulator(m_returnType);
    }
 
    m_state.setHasInternalSideEffects();
    m_state.skipInstructionsUntilNextJumpTarget = true;
}
 
void QQmlJSTypePropagator::generate_Debug()
{
    INSTR_PROLOGUE_NOT_IMPLEMENTED();
}
 
void QQmlJSTypePropagator::generate_LoadConst(int index)
{
    auto encodedConst = m_jsUnitGenerator->constant(index);
    setAccumulator(m_typeResolver->literalType(m_typeResolver->typeForConst(encodedConst)));
}
 
void QQmlJSTypePropagator::generate_LoadZero()
{
    setAccumulator(m_typeResolver->literalType(m_typeResolver->int32Type()));
}
 
void QQmlJSTypePropagator::generate_LoadTrue()
{
    setAccumulator(m_typeResolver->literalType(m_typeResolver->boolType()));
}
 
void QQmlJSTypePropagator::generate_LoadFalse()
{
    setAccumulator(m_typeResolver->literalType(m_typeResolver->boolType()));
}
 
void QQmlJSTypePropagator::generate_LoadNull()
{
    setAccumulator(m_typeResolver->literalType(m_typeResolver->nullType()));
}
 
void QQmlJSTypePropagator::generate_LoadUndefined()
{
    setAccumulator(m_typeResolver->literalType(m_typeResolver->voidType()));
}
 
void QQmlJSTypePropagator::generate_LoadInt(int)
{
    setAccumulator(m_typeResolver->literalType(m_typeResolver->int32Type()));
}
 
void QQmlJSTypePropagator::generate_MoveConst(int constIndex, int destTemp)
{
    auto encodedConst = m_jsUnitGenerator->constant(constIndex);
    setRegister(destTemp, m_typeResolver->literalType(m_typeResolver->typeForConst(encodedConst)));
}
 
void QQmlJSTypePropagator::generate_LoadReg(int reg)
{
    // Do not re-track the register. We're not manipulating it.
    m_state.setIsRename(true);
    const QQmlJSRegisterContent content = checkedInputRegister(reg);
    m_state.addReadRegister(reg, content);
    m_state.setRegister(Accumulator, content);
}
 
void QQmlJSTypePropagator::generate_StoreReg(int reg)
{
    // Do not re-track the register. We're not manipulating it.
    m_state.setIsRename(true);
    m_state.addReadAccumulator(m_state.accumulatorIn());
    m_state.setRegister(reg, m_state.accumulatorIn());
}
 
void QQmlJSTypePropagator::generate_MoveReg(int srcReg, int destReg)
{
    Q_ASSERT(destReg != InvalidRegister);
    // Do not re-track the register. We're not manipulating it.
    m_state.setIsRename(true);
    const QQmlJSRegisterContent content = checkedInputRegister(srcReg);
    m_state.addReadRegister(srcReg, content);
    m_state.setRegister(destReg, content);
}
 
void QQmlJSTypePropagator::generate_LoadImport(int index)
{
    Q_UNUSED(index)
    INSTR_PROLOGUE_NOT_IMPLEMENTED_POPULATES_ACC();
}
 
void QQmlJSTypePropagator::generate_LoadLocal(int index)
{
    // TODO: In order to accurately track locals we'd need to track JavaScript contexts first.
    //       This could be done by populating the initial JS context and implementing the various
    //       Push and Pop operations. For now, this is pretty barren.
 
    QQmlJSMetaProperty local;
    local.setType(m_typeResolver->jsValueType());
    local.setIndex(index);
 
    setAccumulator(m_pool->createProperty(
            local, QQmlJSRegisterContent::InvalidLookupIndex,
            QQmlJSRegisterContent::InvalidLookupIndex,
            QQmlJSRegisterContent::Property, QQmlJSRegisterContent()));
}
 
void QQmlJSTypePropagator::generate_StoreLocal(int index)
{
    Q_UNUSED(index)
    INSTR_PROLOGUE_NOT_IMPLEMENTED();
}
 
void QQmlJSTypePropagator::generate_LoadScopedLocal(int scope, int index)
{
    Q_UNUSED(scope)
    Q_UNUSED(index)
    INSTR_PROLOGUE_NOT_IMPLEMENTED_POPULATES_ACC();
}
 
void QQmlJSTypePropagator::generate_StoreScopedLocal(int scope, int index)
{
    Q_UNUSED(scope)
    Q_UNUSED(index)
    INSTR_PROLOGUE_NOT_IMPLEMENTED();
}
 
void QQmlJSTypePropagator::generate_LoadRuntimeString(int stringId)
{
    Q_UNUSED(stringId)
    setAccumulator(m_typeResolver->literalType(m_typeResolver->stringType()));
}
 
void QQmlJSTypePropagator::generate_MoveRegExp(int regExpId, int destReg)
{
    Q_UNUSED(regExpId)
    m_state.setRegister(destReg, m_typeResolver->literalType(m_typeResolver->regexpType()));
}
 
void QQmlJSTypePropagator::generate_LoadClosure(int value)
{
    Q_UNUSED(value)
    // TODO: Check the function at index and see whether it's a generator to return another type
    // instead.
    setAccumulator(m_typeResolver->literalType(m_typeResolver->functionType()));
}
 
void QQmlJSTypePropagator::generate_LoadName(int nameIndex)
{
    const QString name = m_jsUnitGenerator->stringForIndex(nameIndex);
    setAccumulator(m_typeResolver->scopedType(m_function->qmlScope, name));
    if (!m_state.accumulatorOut().isValid()) {
        addError(u"Cannot find name "_s + name);
        setVarAccumulatorAndError();
    }
}
 
void QQmlJSTypePropagator::generate_LoadGlobalLookup(int index)
{
    generate_LoadName(m_jsUnitGenerator->lookupNameIndex(index));
}
 
void QQmlJSTypePropagator::handleUnqualifiedAccess(const QString &name, bool isMethod) const
{
    Q_UNUSED(name);
    Q_UNUSED(isMethod);
}
 
void QQmlJSTypePropagator::handleUnqualifiedAccessAndContextProperties(
        const QString &name, bool isMethod) const
{
    Q_UNUSED(name);
    Q_UNUSED(isMethod);
}
 
void QQmlJSTypePropagator::checkDeprecated(QQmlJSScope::ConstPtr scope, const QString &name,
                                           bool isMethod) const
{
    Q_UNUSED(scope);
    Q_UNUSED(name);
    Q_UNUSED(isMethod);
}
 
bool QQmlJSTypePropagator::isCallingProperty(QQmlJSScope::ConstPtr scope, const QString &name) const
{
    const auto property = scope->property(name);
    return property.isValid();
}
 
void QQmlJSTypePropagator::generate_LoadQmlContextPropertyLookup(int index)
{
    // LoadQmlContextPropertyLookup does not use accumulatorIn. It always refers to the scope.
    // Any import namespaces etc. are handled via LoadProperty or GetLookup.
 
    const int nameIndex = m_jsUnitGenerator->lookupNameIndex(index);
    const QString name = m_jsUnitGenerator->stringForIndex(nameIndex);
 
    setAccumulator(m_typeResolver->scopedType(m_function->qmlScope, name, index));
 
    if (!m_state.accumulatorOut().isValid() && m_typeResolver->isPrefix(name)) {
        setAccumulator(m_pool->createImportNamespace(
                    nameIndex, m_typeResolver->voidType(), QQmlJSRegisterContent::ModulePrefix,
                    m_function->qmlScope));
        return;
    }
 
    checkDeprecated(m_function->qmlScope.containedType(), name, false);
 
    const QQmlJSRegisterContent accumulatorOut = m_state.accumulatorOut();
 
    if (!accumulatorOut.isValid()) {
        addError(u"Cannot access value for name "_s + name);
        handleUnqualifiedAccessAndContextProperties(name, false);
        setVarAccumulatorAndError();
        return;
    }
 
    const QQmlJSScope::ConstPtr retrieved
            = m_typeResolver->genericType(accumulatorOut.containedType());
 
    if (retrieved.isNull()) {
        // It should really be valid.
        // We get the generic type from aotContext->loadQmlContextPropertyIdLookup().
        addError(u"Cannot determine generic type for "_s + name);
        return;
    }
 
    if (accumulatorOut.variant() == QQmlJSRegisterContent::ObjectById
            && !retrieved->isReferenceType()) {
        addError(u"Cannot retrieve a non-object type by ID: "_s + name);
        return;
    }
}
 
/*!
    \internal
    As far as type propagation is involved, StoreNameSloppy and
    StoreNameStrict are completely the same
    StoreNameStrict is rejecting a few writes (where the variable was not
    defined before) that would work in a sloppy context in JS, but the
    compiler would always reject this. And for type propagation, this does
    not matter at all.
    \a nameIndex is the index in the string table corresponding to
    the name which we are storing
 */
void QQmlJSTypePropagator::generate_StoreNameCommon(int nameIndex)
{
    const QString name = m_jsUnitGenerator->stringForIndex(nameIndex);
    const QQmlJSRegisterContent type = m_typeResolver->scopedType(m_function->qmlScope, name);
    const QQmlJSRegisterContent in = m_state.accumulatorIn();
 
    if (!type.isValid()) {
        handleUnqualifiedAccess(name, false);
        addError(u"Cannot find name "_s + name);
        return;
    }
 
    if (!type.isProperty()) {
        QString message = type.isMethod() ? u"Cannot assign to method %1"_s
                                          : u"Cannot assign to non-property %1"_s;
        // The interpreter treats methods as read-only properties in its error messages
        // and we lack a better fitting category. We might want to revisit this later.
        m_logger->log(message.arg(name), qmlReadOnlyProperty,
                      currentSourceLocation());
        addError(u"Cannot assign to non-property "_s + name);
        return;
    }
 
    if (!type.isWritable() && !type.isList()) {
        addError(u"Can't assign to read-only property %1"_s.arg(name));
 
        m_logger->log(u"Cannot assign to read-only property %1"_s.arg(name), qmlReadOnlyProperty,
                      currentSourceLocation());
 
        return;
    }
 
    if (!canConvertFromTo(in, type)) {
        addError(u"cannot convert from %1 to %2"_s
                 .arg(in.descriptiveName(), type.descriptiveName()));
    }
 
    if (m_typeResolver->canHoldUndefined(in) && !m_typeResolver->canHoldUndefined(type)) {
        if (in.contains(m_typeResolver->voidType()))
            addReadAccumulator(m_typeResolver->varType());
        else
            addReadAccumulator();
    } else {
        addReadAccumulator(type);
    }
 
    m_state.setHasExternalSideEffects();
}
 
void QQmlJSTypePropagator::generate_StoreNameSloppy(int nameIndex)
{
    return generate_StoreNameCommon(nameIndex);
}
 
void QQmlJSTypePropagator::generate_StoreNameStrict(int name)
{
    return generate_StoreNameCommon(name);
}
 
bool QQmlJSTypePropagator::checkForEnumProblems(
        QQmlJSRegisterContent base, const QString &propertyName)
{
    if (base.isEnumeration()) {
        const auto metaEn = base.enumeration();
        if (!metaEn.hasKey(propertyName)) {
            addError(u"\"%1\" is not an entry of enum \"%2\"."_s
                             .arg(propertyName, metaEn.name()));
            return true;
        }
    }
 
    return false;
}
 
void QQmlJSTypePropagator::generate_LoadElement(int base)
{
    const QQmlJSRegisterContent in = m_state.accumulatorIn();
    const QQmlJSRegisterContent baseRegister = m_state.registers[base].content;
 
    const auto fallback = [&]() {
        const QQmlJSScope::ConstPtr jsValue = m_typeResolver->jsValueType();
 
        addReadAccumulator(jsValue);
        addReadRegister(base, jsValue);
 
        QQmlJSMetaProperty property;
        property.setPropertyName(u"[]"_s);
        property.setTypeName(jsValue->internalName());
        property.setType(jsValue);
 
        setAccumulator(m_pool->createProperty(
                property, QQmlJSRegisterContent::InvalidLookupIndex,
                QQmlJSRegisterContent::InvalidLookupIndex, QQmlJSRegisterContent::ListValue,
                m_typeResolver->convert(m_typeResolver->elementType(baseRegister), jsValue)));
    };
 
    if (baseRegister.isList()) {
        addReadRegister(base, m_typeResolver->arrayPrototype());
    } else if (baseRegister.contains(m_typeResolver->stringType())) {
        addReadRegister(base, m_typeResolver->stringType());
    } else {
        fallback();
        return;
    }
 
    if (m_typeResolver->isNumeric(in)) {
        const auto contained = in.containedType();
        if (m_typeResolver->isSignedInteger(contained))
            addReadAccumulator(m_typeResolver->sizeType());
        else if (m_typeResolver->isUnsignedInteger(contained))
            addReadAccumulator(m_typeResolver->uint32Type());
        else
            addReadAccumulator(m_typeResolver->realType());
    } else if (m_typeResolver->isNumeric(m_typeResolver->extractNonVoidFromOptionalType(in))) {
        addReadAccumulator();
    } else {
        fallback();
        return;
    }
 
    // We can end up with undefined.
    setAccumulator(m_typeResolver->merge(
            m_typeResolver->elementType(baseRegister),
            m_typeResolver->literalType(m_typeResolver->voidType())));
}
 
void QQmlJSTypePropagator::generate_StoreElement(int base, int index)
{
    const QQmlJSRegisterContent baseRegister = m_state.registers[base].content;
    const QQmlJSRegisterContent indexRegister = checkedInputRegister(index);
 
    if (!baseRegister.isList()
            || !m_typeResolver->isNumeric(indexRegister)) {
        const auto jsValue = m_typeResolver->jsValueType();
        addReadAccumulator(jsValue);
        addReadRegister(base, jsValue);
        addReadRegister(index, jsValue);
 
        // Writing to a JS array can have side effects all over the place since it's
        // passed by reference.
        m_state.setHasExternalSideEffects();
        return;
    }
 
    const auto contained = indexRegister.containedType();
    if (m_typeResolver->isSignedInteger(contained))
        addReadRegister(index, m_typeResolver->int32Type());
    else if (m_typeResolver->isUnsignedInteger(contained))
        addReadRegister(index, m_typeResolver->uint32Type());
    else
        addReadRegister(index, m_typeResolver->realType());
 
    addReadRegister(base, m_typeResolver->arrayPrototype());
    addReadAccumulator(m_typeResolver->elementType(baseRegister));
 
    // If we're writing a QQmlListProperty backed by a container somewhere else,
    // that has side effects.
    // If we're writing to a list retrieved from a property, that _should_ have side effects,
    // but currently the QML engine doesn't implement them.
    // TODO: Figure out the above and accurately set the flag.
    m_state.setHasExternalSideEffects();
}
 
bool QQmlJSTypePropagator::handleImportNamespaceLookup(const QString &propertyName)
{
    const QQmlJSRegisterContent accumulatorIn = m_state.accumulatorIn();
 
    if (m_typeResolver->isPrefix(propertyName)) {
        Q_ASSERT(accumulatorIn.isValid());
 
        if (!accumulatorIn.containedType()->isReferenceType()) {
            setVarAccumulatorAndError();
            return true;
        }
 
        addReadAccumulator();
        setAccumulator(m_pool->createImportNamespace(
                m_jsUnitGenerator->getStringId(propertyName),
                accumulatorIn.containedType(),
                QQmlJSRegisterContent::ModulePrefix,
                accumulatorIn));
        return true;
    }
 
    return false;
}
 
void QQmlJSTypePropagator::handleLookupError(const QString &propertyName)
{
    const QQmlJSRegisterContent accumulatorIn = m_state.accumulatorIn();
 
    setVarAccumulatorAndError();
    if (checkForEnumProblems(accumulatorIn, propertyName))
        return;
 
    addError(u"Cannot load property %1 from %2."_s
                     .arg(propertyName, accumulatorIn.descriptiveName()));
}
 
void QQmlJSTypePropagator::propagatePropertyLookup(const QString &propertyName, int lookupIndex)
{
    const QQmlJSRegisterContent accumulatorIn = m_state.accumulatorIn();
    setAccumulator(
            m_typeResolver->memberType(
                accumulatorIn,
                accumulatorIn.isImportNamespace()
                    ? m_jsUnitGenerator->stringForIndex(accumulatorIn.importNamespace())
                      + u'.' + propertyName
                    : propertyName, lookupIndex));
 
    if (!m_state.accumulatorOut().isValid() && handleImportNamespaceLookup(propertyName))
        return;
 
    if (m_state.accumulatorOut().variant() == QQmlJSRegisterContent::Singleton
            && accumulatorIn.variant() == QQmlJSRegisterContent::ModulePrefix
            && !isQmlScopeObject(accumulatorIn.scope())) {
        m_logger->log(
                u"Cannot access singleton as a property of an object. Did you want to access an attached object?"_s,
                qmlAccessSingleton, currentSourceLocation());
        setAccumulator(QQmlJSRegisterContent());
    } else if (m_state.accumulatorOut().isEnumeration()) {
        switch (accumulatorIn.variant()) {
        case QQmlJSRegisterContent::MetaType:
        case QQmlJSRegisterContent::Attachment:
        case QQmlJSRegisterContent::Enum:
        case QQmlJSRegisterContent::ModulePrefix:
        case QQmlJSRegisterContent::Singleton:
            break; // OK, can look up enums on that thing
        default:
            setAccumulator(QQmlJSRegisterContent());
        }
    }
 
    if (m_state.instructionHasError || !m_state.accumulatorOut().isValid()) {
        handleLookupError(propertyName);
        return;
    }
 
    if (m_state.accumulatorOut().isMethod() && m_state.accumulatorOut().method().size() != 1) {
        addError(u"Cannot determine overloaded method on loadProperty"_s);
        return;
    }
 
    if (m_state.accumulatorOut().isProperty()) {
        const QQmlJSScope::ConstPtr mathObject
                = m_typeResolver->jsGlobalObject()->property(u"Math"_s).type();
        if (accumulatorIn.contains(mathObject)) {
            QQmlJSMetaProperty prop;
            prop.setPropertyName(propertyName);
            prop.setTypeName(u"double"_s);
            prop.setType(m_typeResolver->realType());
            setAccumulator(
                m_pool->createProperty(
                    prop, accumulatorIn.resultLookupIndex(), lookupIndex,
                    // Use pre-determined scope type here to avoid adjusting it later.
                    QQmlJSRegisterContent::Property, m_state.accumulatorOut().scope())
            );
 
            return;
        }
 
        if (m_state.accumulatorOut().contains(m_typeResolver->voidType())) {
            addError(u"Type %1 does not have a property %2 for reading"_s
                             .arg(accumulatorIn.descriptiveName(), propertyName));
            return;
        }
 
        if (!m_state.accumulatorOut().property().type()) {
            m_logger->log(
                    QString::fromLatin1("Type of property \"%2\" not found").arg(propertyName),
                    qmlMissingType, currentSourceLocation());
        }
    }
 
    switch (m_state.accumulatorOut().variant()) {
    case QQmlJSRegisterContent::Enum:
    case QQmlJSRegisterContent::Singleton:
        // For reading enums or singletons, we don't need to access anything, unless it's an
        // import namespace. Then we need the name.
        if (accumulatorIn.isImportNamespace())
            addReadAccumulator();
        break;
    default:
        addReadAccumulator();
        break;
    }
}
 
void QQmlJSTypePropagator::generate_LoadProperty(int nameIndex)
{
    propagatePropertyLookup(m_jsUnitGenerator->stringForIndex(nameIndex));
}
 
void QQmlJSTypePropagator::generate_LoadOptionalProperty(int name, int offset)
{
    Q_UNUSED(name);
    Q_UNUSED(offset);
    INSTR_PROLOGUE_NOT_IMPLEMENTED_POPULATES_ACC();
}
 
void QQmlJSTypePropagator::generate_GetLookup(int index)
{
    propagatePropertyLookup(m_jsUnitGenerator->lookupName(index), index);
}
 
void QQmlJSTypePropagator::generate_GetOptionalLookup(int index, int offset)
{
    Q_UNUSED(offset);
    saveRegisterStateForJump(offset);
    propagatePropertyLookup(m_jsUnitGenerator->lookupName(index), index);
}
 
void QQmlJSTypePropagator::generate_StoreProperty(int nameIndex, int base)
{
    auto callBase = m_state.registers[base].content;
    const QString propertyName = m_jsUnitGenerator->stringForIndex(nameIndex);
 
    QQmlJSRegisterContent property = m_typeResolver->memberType(callBase, propertyName);
    if (!property.isProperty()) {
        QString name = callBase.descriptiveName();
        if (!name.isEmpty())
            name += u' ';
        addError(u"Type %1does not have a property %2 for writing"_s.arg(name, propertyName));
        return;
    }
 
    if (property.containedType().isNull()) {
        addError(u"Cannot determine type for property %1 of type %2"_s.arg(
                propertyName, callBase.descriptiveName()));
        return;
    }
 
    if (!property.isWritable() && !property.containedType()->isListProperty()) {
        addError(u"Can't assign to read-only property %1"_s.arg(propertyName));
 
        m_logger->log(u"Cannot assign to read-only property %1"_s.arg(propertyName),
                      qmlReadOnlyProperty, currentSourceLocation());
 
        return;
    }
 
    if (!canConvertFromTo(m_state.accumulatorIn(), property)) {
        addError(u"cannot convert from %1 to %2"_s
                         .arg(m_state.accumulatorIn().descriptiveName(), property.descriptiveName()));
        return;
    }
 
    // If the input can hold undefined we must not coerce it to the property type
    // as that might eliminate an undefined value. For example, undefined -> string
    // becomes "undefined".
    // We need the undefined value for either resetting the property if that is supported
    // or generating an exception otherwise. Therefore we explicitly require the value to
    // be given as QVariant. This triggers the QVariant fallback path that's also used for
    // shadowable properties. QVariant can hold undefined and the lookup functions will
    // handle that appropriately.
 
    const QQmlJSScope::ConstPtr varType = m_typeResolver->varType();
    const QQmlJSRegisterContent readType = m_typeResolver->canHoldUndefined(m_state.accumulatorIn())
            ? m_typeResolver->convert(property, varType)
            : std::move(property);
    addReadAccumulator(readType);
    addReadRegister(base);
    m_state.setHasExternalSideEffects();
}
 
void QQmlJSTypePropagator::generate_SetLookup(int index, int base)
{
    generate_StoreProperty(m_jsUnitGenerator->lookupNameIndex(index), base);
}
 
void QQmlJSTypePropagator::generate_LoadSuperProperty(int property)
{
    Q_UNUSED(property)
    INSTR_PROLOGUE_NOT_IMPLEMENTED_POPULATES_ACC();
}
 
void QQmlJSTypePropagator::generate_StoreSuperProperty(int property)
{
    Q_UNUSED(property)
    INSTR_PROLOGUE_NOT_IMPLEMENTED();
}
 
void QQmlJSTypePropagator::generate_Yield()
{
    INSTR_PROLOGUE_NOT_IMPLEMENTED();
}
 
void QQmlJSTypePropagator::generate_YieldStar()
{
    INSTR_PROLOGUE_NOT_IMPLEMENTED();
}
 
void QQmlJSTypePropagator::generate_Resume(int)
{
    INSTR_PROLOGUE_NOT_IMPLEMENTED();
}
 
void QQmlJSTypePropagator::generate_CallValue(int name, int argc, int argv)
{
    m_state.setHasExternalSideEffects();
    Q_UNUSED(name)
    Q_UNUSED(argc)
    Q_UNUSED(argv)
    INSTR_PROLOGUE_NOT_IMPLEMENTED_POPULATES_ACC();
}
 
void QQmlJSTypePropagator::generate_CallWithReceiver(int name, int thisObject, int argc, int argv)
{
    m_state.setHasExternalSideEffects();
    Q_UNUSED(name)
    Q_UNUSED(thisObject)
    Q_UNUSED(argc)
    Q_UNUSED(argv)
    INSTR_PROLOGUE_NOT_IMPLEMENTED_POPULATES_ACC();
}
 
bool QQmlJSTypePropagator::isLoggingMethod(const QString &consoleMethod)
{
    return consoleMethod == u"log" || consoleMethod == u"debug" || consoleMethod == u"info"
            || consoleMethod == u"warn" || consoleMethod == u"error";
}
 
void QQmlJSTypePropagator::generate_CallProperty_SCMath(
        const QString &name, int base, int argc, int argv)
{
    // If we call a method on the Math object we don't need the actual Math object. We do need
    // to transfer the type information to the code generator so that it knows that this is the
    // Math object. Read the base register as void. void isn't stored, and the place where it's
    // created will be optimized out if there are no other readers. The code generator can
    // retrieve the original type and determine that it was the Math object.
 
    addReadRegister(base, m_typeResolver->voidType());
 
    QQmlJSRegisterContent math = m_state.registers[base].content;
    const QList<QQmlJSMetaMethod> methods = math.containedType()->ownMethods(name);
    if (methods.isEmpty()) {
        setVarAccumulatorAndError();
        std::optional<QQmlJSFixSuggestion> fixSuggestion = QQmlJSUtils::didYouMean(
                name, math.containedType()->methods().keys(), m_logger->filePath(),
                currentSourceLocation());
        m_logger->log(u"Member \"%1\" not found on Math object"_s.arg(name),
                      qmlMissingProperty, currentSourceLocation(),
                      true, true, std::move(fixSuggestion));
        return;
    }
    Q_ASSERT(methods.length() == 1);
 
    // Declare the Math object as base type of itself so that it gets cloned and won't be
    // adjusted later. This is what we do with all method calls.
    QQmlJSRegisterContent realType = m_typeResolver->returnType(
            methods[0], m_typeResolver->realType(),
            m_typeResolver->baseType(math.containedType(), math));
    for (int i = 0; i < argc; ++i)
        addReadRegister(argv + i, realType);
    setAccumulator(realType);
}
 
void QQmlJSTypePropagator::generate_CallProperty_SCconsole(
        const QString &name, int base, int argc, int argv)
{
    // If we call a method on the console object we don't need the console object.
    addReadRegister(base, m_typeResolver->voidType());
 
    if (argc > 0) {
        const QQmlJSRegisterContent firstContent = m_state.registers[argv].content;
        const QQmlJSScope::ConstPtr firstArg = firstContent.containedType();
        switch (firstArg->accessSemantics()) {
        case QQmlJSScope::AccessSemantics::Reference:
            // We cannot know whether this will be a logging category at run time.
            // Therefore we always pass any object types as special last argument.
            addReadRegister(argv, m_typeResolver->genericType(firstArg));
            break;
        case QQmlJSScope::AccessSemantics::Sequence:
            addReadRegister(argv);
            break;
        default:
            addReadRegister(argv, m_typeResolver->stringType());
            break;
        }
    }
 
    for (int i = 1; i < argc; ++i) {
        const QQmlJSRegisterContent argContent = m_state.registers[argv + i].content;
        const QQmlJSScope::ConstPtr arg = argContent.containedType();
        if (arg->accessSemantics() == QQmlJSScope::AccessSemantics::Sequence)
            addReadRegister(argv + i);
        else
            addReadRegister(argv + i, m_typeResolver->stringType());
    }
 
    // It's debatable whether the console API should be considered an external side effect.
    // You can certainly qInstallMessageHandler and then react to the message and change
    // some property in an object exposed to the currently running method. However, we might
    // disregard such a thing as abuse of the API. For now, the console API is considered to
    // have external side effects, though.
    m_state.setHasExternalSideEffects();
 
    QQmlJSRegisterContent console = m_state.registers[base].content;
    QList<QQmlJSMetaMethod> methods = console.containedType()->ownMethods(name);
    Q_ASSERT(methods.length() == 1);
 
    // Declare the console object as base type of itself so that it gets cloned and won't be
    // adjusted later. This is what we do with all method calls.
    setAccumulator(m_typeResolver->returnType(
            methods[0], m_typeResolver->voidType(),
            m_typeResolver->baseType(console.containedType(), console)));
}
 
void QQmlJSTypePropagator::generate_CallProperty(int nameIndex, int base, int argc, int argv)
{
    Q_ASSERT(m_state.registers.contains(base));
    const auto callBase = m_state.registers[base].content;
    const QString propertyName = m_jsUnitGenerator->stringForIndex(nameIndex);
 
    if (callBase.contains(m_typeResolver->mathObject())) {
        generate_CallProperty_SCMath(propertyName, base, argc, argv);
        return;
    }
 
    if (callBase.contains(m_typeResolver->consoleObject()) && isLoggingMethod(propertyName)) {
        generate_CallProperty_SCconsole(propertyName, base, argc, argv);
        return;
    }
 
    const auto baseType = callBase.containedType();
    const auto member = m_typeResolver->memberType(callBase, propertyName);
 
    if (!member.isMethod()) {
        if (callBase.contains(m_typeResolver->jsValueType())
                || callBase.contains(m_typeResolver->varType())) {
            const auto jsValueType = m_typeResolver->jsValueType();
            addReadRegister(base, jsValueType);
            for (int i = 0; i < argc; ++i)
                addReadRegister(argv + i, jsValueType);
            m_state.setHasExternalSideEffects();
 
            QQmlJSMetaMethod method;
            method.setIsJavaScriptFunction(true);
            method.setMethodName(propertyName);
            method.setMethodType(QQmlJSMetaMethod::MethodType::Method);
 
            setAccumulator(m_typeResolver->returnType(
                    method, m_typeResolver->jsValueType(), callBase));
            return;
        }
 
        setVarAccumulatorAndError();
        addError(u"Type %1 does not have a property %2 for calling"_s
                         .arg(callBase.descriptiveName(), propertyName));
 
        if (callBase.isType() && isCallingProperty(callBase.type(), propertyName))
            return;
 
        if (checkForEnumProblems(callBase, propertyName))
            return;
 
        std::optional<QQmlJSFixSuggestion> fixSuggestion;
 
        if (auto suggestion = QQmlJSUtils::didYouMean(propertyName, baseType->methods().keys(),
                                                      m_logger->filePath(), currentSourceLocation());
            suggestion.has_value()) {
            fixSuggestion = suggestion;
        }
 
        if (baseType->isFullyResolved() || baseType->isScript()) {
            m_logger->log(u"Member \"%1\" not found on type \"%2\""_s.arg(
                                  propertyName, callBase.containedTypeName()),
                          qmlMissingProperty, currentSourceLocation(), true, true, fixSuggestion);
        }
        return;
    }
 
    checkDeprecated(baseType, propertyName, true);
 
    addReadRegister(base);
 
    if (callBase.contains(m_typeResolver->stringType())) {
        if (propertyName == u"arg"_s && argc == 1) {
            propagateStringArgCall(callBase, argv);
            return;
        }
    }
 
    if (baseType->accessSemantics() == QQmlJSScope::AccessSemantics::Sequence
            && member.scope().contains(m_typeResolver->arrayPrototype())
            && propagateArrayMethod(propertyName, argc, argv, callBase)) {
        return;
    }
 
    propagateCall(member.method(), argc, argv, member.scope());
}
 
QQmlJSMetaMethod QQmlJSTypePropagator::bestMatchForCall(const QList<QQmlJSMetaMethod> &methods,
                                                        int argc, int argv, QStringList *errors)
{
    QQmlJSMetaMethod javascriptFunction;
    QQmlJSMetaMethod candidate;
    bool hasMultipleCandidates = false;
 
    for (const auto &method : methods) {
 
        // If we encounter a JavaScript function, use this as a fallback if no other method matches
        if (method.isJavaScriptFunction() && !javascriptFunction.isValid())
            javascriptFunction = method;
 
        if (method.returnType().isNull() && !method.returnTypeName().isEmpty()) {
            errors->append(u"return type %1 cannot be resolved"_s
                                   .arg(method.returnTypeName()));
            continue;
        }
 
        const auto arguments = method.parameters();
        if (argc != arguments.size()) {
            errors->append(
                    u"Function expects %1 arguments, but %2 were provided"_s.arg(arguments.size())
                            .arg(argc));
            continue;
        }
 
        bool fuzzyMatch = true;
        bool exactMatch = true;
        for (int i = 0; i < argc; ++i) {
            const auto argumentType = arguments[i].type();
            if (argumentType.isNull()) {
                errors->append(
                        u"type %1 for argument %2 cannot be resolved"_s.arg(arguments[i].typeName())
                                .arg(i));
                exactMatch = false;
                fuzzyMatch = false;
                break;
            }
 
            const auto content = m_state.registers[argv + i].content;
            if (content.contains(argumentType))
                continue;
 
            exactMatch = false;
            if (canConvertFromTo(content, argumentType))
                continue;
 
            // We can try to call a method that expects a derived type.
            if (argumentType->isReferenceType()
                    && m_typeResolver->inherits(
                        argumentType->baseType(), content.containedType())) {
                continue;
            }
 
            errors->append(
                    u"argument %1 contains %2 but is expected to contain the type %3"_s.arg(i).arg(
                            content.descriptiveName(), arguments[i].typeName()));
            fuzzyMatch = false;
            break;
        }
 
        if (exactMatch) {
            return method;
        } else if (fuzzyMatch) {
            if (!candidate.isValid())
                candidate = method;
            else
                hasMultipleCandidates = true;
        }
    }
 
    if (hasMultipleCandidates)
        return QQmlJSMetaMethod();
 
    return candidate.isValid() ? candidate : javascriptFunction;
}
 
void QQmlJSTypePropagator::setAccumulator(QQmlJSRegisterContent content)
{
    setRegister(Accumulator, content);
}
 
void QQmlJSTypePropagator::setRegister(int index, QQmlJSRegisterContent content)
{
    // If we've come to the same conclusion before, let's not track the type again.
    auto it = m_prevStateAnnotations.find(currentInstructionOffset());
    if (it != m_prevStateAnnotations.end()) {
        QQmlJSRegisterContent lastTry = it->second.changedRegister;
        if (lastTry.contains(content.containedType())) {
            m_state.setRegister(index, lastTry);
            return;
        }
    }
 
    m_state.setRegister(index, content);
}
 
/*! \internal
 * Merges the types of two variations of the register at \index
 * When the code branches and merges, the same register can carry one of multiple types.
 * For example:
 *
 * let a
 * if (something)
 *     a = 12
 * else
 *     a = "stringstring"
 * console.log(a)
 *
 * At the point where we log the value we need a type that can hold both, the number and
 * the string because we don't know which branch was taken before. mergeRegister chooses a
 * type that can hold both variants.
 *
 * Since the type propagator can run multiple passes over the same code (for loops with back
 * jumps), we need to reproduce previous resolutions of the merge where they still fit. To that
 * effect, we check m_prevStateAnnotations here.
 */
void QQmlJSTypePropagator::mergeRegister(
            int index, const VirtualRegister &a, const VirtualRegister &b)
{
    const VirtualRegister merged = {
        (a.content == b.content) ? a.content : m_typeResolver->merge(a.content, b.content),
        a.canMove && b.canMove,
        a.affectedBySideEffects || b.affectedBySideEffects,
        a.isShadowable || b.isShadowable,
    };
 
    Q_ASSERT(merged.content.isValid());
 
    if (!merged.content.isConversion()) {
        // The registers were the same. We're already tracking them.
        m_state.annotations[currentInstructionOffset()].typeConversions[index] = merged;
        m_state.registers[index] = merged;
        return;
    }
 
    auto tryPrevStateConversion = [this](int index, const VirtualRegister &merged) -> bool {
        auto it = m_prevStateAnnotations.find(currentInstructionOffset());
        if (it == m_prevStateAnnotations.end())
            return false;
 
        auto conversion = it->second.typeConversions.find(index);
        if (conversion == it->second.typeConversions.end())
            return false;
 
        const VirtualRegister &lastTry = conversion.value();
 
        Q_ASSERT(lastTry.content.isValid());
        if (!lastTry.content.isConversion())
            return false;
 
        if (lastTry.content.conversionResultType() != merged.content.conversionResultType()
                || lastTry.content.conversionOrigins() != merged.content.conversionOrigins()
                || lastTry.canMove != merged.canMove
                || lastTry.affectedBySideEffects != merged.affectedBySideEffects
                || lastTry.isShadowable != merged.isShadowable) {
            return false;
        }
 
        // We don't need to track it again if we've come to the same conclusion before.
        m_state.annotations[currentInstructionOffset()].typeConversions[index] = lastTry;
 
        // Do not reset the side effects
        Q_ASSERT(!m_state.registers[index].affectedBySideEffects || lastTry.affectedBySideEffects);
 
        m_state.registers[index] = lastTry;
        return true;
    };
 
    if (!tryPrevStateConversion(index, merged)) {
        // if a != b, we have already re-tracked it.
        const VirtualRegister cloned = {
            (a == b) ? m_pool->clone(merged.content) : merged.content,
            merged.canMove,
            merged.affectedBySideEffects,
            merged.isShadowable,
        };
        Q_ASSERT(cloned.content.isValid());
        m_state.annotations[currentInstructionOffset()].typeConversions[index] = cloned;
        m_state.registers[index] = cloned;
    }
}
 
void QQmlJSTypePropagator::addReadRegister(int index)
{
    // Explicitly pass the same type through without conversion
    m_state.addReadRegister(index, m_state.registers[index].content);
}
 
void QQmlJSTypePropagator::addReadRegister(int index, QQmlJSRegisterContent convertTo)
{
    if (m_state.registers[index].content == convertTo) {
        // Explicitly pass the same type through without conversion
        m_state.addReadRegister(index, convertTo);
    } else {
        m_state.addReadRegister(
                index, m_typeResolver->convert(m_state.registers[index].content, convertTo));
    }
}
 
void QQmlJSTypePropagator::addReadRegister(int index, const QQmlJSScope::ConstPtr &convertTo)
{
    m_state.addReadRegister(
            index, m_typeResolver->convert(m_state.registers[index].content, convertTo));
}
 
void QQmlJSTypePropagator::propagateCall(
        const QList<QQmlJSMetaMethod> &methods, int argc, int argv,
        QQmlJSRegisterContent scope)
{
    QStringList errors;
    const QQmlJSMetaMethod match = bestMatchForCall(methods, argc, argv, &errors);
 
    if (!match.isValid()) {
        setVarAccumulatorAndError();
        if (methods.size() == 1) {
            // Cannot have multiple fuzzy matches if there is only one method
            Q_ASSERT(errors.size() == 1);
            addError(errors.first());
        } else if (errors.size() < methods.size()) {
            addError(u"Multiple matching overrides found. Cannot determine the right one."_s);
        } else {
            addError(u"No matching override found. Candidates:\n"_s + errors.join(u'\n'));
        }
        return;
    }
 
    QQmlJSScope::ConstPtr returnType;
    if (match.isJavaScriptFunction())
        returnType = m_typeResolver->jsValueType();
    else if (match.isConstructor())
        returnType = scope.containedType();
    else
        returnType = match.returnType();
 
    setAccumulator(m_typeResolver->returnType(match, returnType, scope));
    if (!m_state.accumulatorOut().isValid())
        addError(u"Cannot store return type of method %1()."_s.arg(match.methodName()));
 
    const auto types = match.parameters();
    for (int i = 0; i < argc; ++i) {
        if (i < types.size()) {
            const QQmlJSScope::ConstPtr type = match.isJavaScriptFunction()
                    ? m_typeResolver->jsValueType()
                    : QQmlJSScope::ConstPtr(types.at(i).type());
            if (!type.isNull()) {
                addReadRegister(argv + i, type);
                continue;
            }
        }
        addReadRegister(argv + i, m_typeResolver->jsValueType());
    }
    m_state.setHasExternalSideEffects();
}
 
void QQmlJSTypePropagator::propagateTranslationMethod_SAcheck(const QString &methodName)
{
    Q_UNUSED(methodName);
}
 
bool QQmlJSTypePropagator::propagateTranslationMethod(
        const QList<QQmlJSMetaMethod> &methods, int argc, int argv)
{
    if (methods.size() != 1)
        return false;
 
    const QQmlJSMetaMethod method = methods.front();
    const QQmlJSScope::ConstPtr intType = m_typeResolver->int32Type();
    const QQmlJSScope::ConstPtr stringType = m_typeResolver->stringType();
 
    const QQmlJSRegisterContent returnType = m_typeResolver->returnType(
            method, m_typeResolver->stringType(), m_typeResolver->jsGlobalObjectContent());
 
    if (method.methodName() == u"qsTranslate"_s) {
        switch (argc) {
        case 4:
            addReadRegister(argv + 3, intType);    // n
            Q_FALLTHROUGH();
        case 3:
            addReadRegister(argv + 2, stringType); // disambiguation
            Q_FALLTHROUGH();
        case 2:
            addReadRegister(argv + 1, stringType); // sourceText
            addReadRegister(argv, stringType);     // context
            setAccumulator(returnType);
            propagateTranslationMethod_SAcheck(method.methodName());
            return true;
        default:
            return false;
        }
    }
 
    if (method.methodName() == u"QT_TRANSLATE_NOOP"_s) {
        switch (argc) {
        case 3:
            addReadRegister(argv + 2, stringType); // disambiguation
            Q_FALLTHROUGH();
        case 2:
            addReadRegister(argv + 1, stringType); // sourceText
            addReadRegister(argv, stringType);     // context
            setAccumulator(returnType);
            propagateTranslationMethod_SAcheck(method.methodName());
            return true;
        default:
            return false;
        }
    }
 
    if (method.methodName() == u"qsTr"_s) {
        switch (argc) {
        case 3:
            addReadRegister(argv + 2, intType);    // n
            Q_FALLTHROUGH();
        case 2:
            addReadRegister(argv + 1, stringType); // disambiguation
            Q_FALLTHROUGH();
        case 1:
            addReadRegister(argv, stringType);     // sourceText
            setAccumulator(returnType);
            propagateTranslationMethod_SAcheck(method.methodName());
            return true;
        default:
            return false;
        }
    }
 
    if (method.methodName() == u"QT_TR_NOOP"_s) {
        switch (argc) {
        case 2:
            addReadRegister(argv + 1, stringType); // disambiguation
            Q_FALLTHROUGH();
        case 1:
            addReadRegister(argv, stringType);     // sourceText
            setAccumulator(returnType);
            propagateTranslationMethod_SAcheck(method.methodName());
            return true;
        default:
            return false;
        }
    }
 
    if (method.methodName() == u"qsTrId"_s) {
        switch (argc) {
        case 2:
            addReadRegister(argv + 1, intType);    // n
            Q_FALLTHROUGH();
        case 1:
            addReadRegister(argv, stringType);     // id
            setAccumulator(returnType);
            propagateTranslationMethod_SAcheck(method.methodName());
            return true;
        default:
            return false;
        }
    }
 
    if (method.methodName() == u"QT_TRID_NOOP"_s) {
        switch (argc) {
        case 1:
            addReadRegister(argv, stringType);     // id
            setAccumulator(returnType);
            propagateTranslationMethod_SAcheck(method.methodName());
            return true;
        default:
            return false;
        }
    }
 
    return false;
}
 
void QQmlJSTypePropagator::propagateStringArgCall(QQmlJSRegisterContent base, int argv)
{
    QQmlJSMetaMethod method;
    method.setIsJavaScriptFunction(true);
    method.setMethodName(u"arg"_s);
    setAccumulator(m_typeResolver->returnType(method, m_typeResolver->stringType(), base));
    Q_ASSERT(m_state.accumulatorOut().isValid());
 
    const QQmlJSScope::ConstPtr input = m_state.registers[argv].content.containedType();
 
    if (input == m_typeResolver->uint32Type()
            || input == m_typeResolver->int64Type()
            || input == m_typeResolver->uint64Type()) {
        addReadRegister(argv, m_typeResolver->realType());
        return;
    }
 
    if (m_typeResolver->isIntegral(input)) {
        addReadRegister(argv, m_typeResolver->int32Type());
        return;
    }
 
    if (m_typeResolver->isNumeric(input)) {
        addReadRegister(argv, m_typeResolver->realType());
        return;
    }
 
    if (input == m_typeResolver->boolType()) {
        addReadRegister(argv, m_typeResolver->boolType());
        return;
    }
 
    addReadRegister(argv, m_typeResolver->stringType());
}
 
bool QQmlJSTypePropagator::propagateArrayMethod(
        const QString &name, int argc, int argv, QQmlJSRegisterContent baseType)
{
    // TODO:
    // * For concat() we need to decide what kind of array to return and what kinds of arguments to
    //   accept.
    // * For entries(), keys(), and values() we need iterators.
    // * For find(), findIndex(), sort(), every(), some(), forEach(), map(), filter(), reduce(),
    //   and reduceRight() we need typed function pointers.
 
    // TODO:
    // For now, every method that mutates the original array is considered to have external
    // side effects. We could do better by figuring out whether the array is actually backed
    // by an external property or has entries backed by an external property. If not, there
    // can't be any external side effects.
 
    const auto intType = m_typeResolver->int32Type();
    const auto stringType = m_typeResolver->stringType();
    const auto baseContained = baseType.containedType();
    const auto elementContained = baseContained->elementType();
 
    const auto setReturnType = [&](const QQmlJSScope::ConstPtr type) {
        QQmlJSMetaMethod method;
        method.setIsJavaScriptFunction(true);
        method.setMethodName(name);
        setAccumulator(m_typeResolver->returnType(method, type, baseType));
    };
 
    if (name == u"copyWithin" && argc > 0 && argc < 4) {
        for (int i = 0; i < argc; ++i) {
            if (!canConvertFromTo(m_state.registers[argv + i].content, intType))
                return false;
        }
 
        for (int i = 0; i < argc; ++i)
            addReadRegister(argv + i, intType);
 
        m_state.setHasExternalSideEffects();
        setReturnType(baseContained);
        return true;
    }
 
    if (name == u"fill" && argc > 0 && argc < 4) {
        if (!canConvertFromTo(m_state.registers[argv].content, elementContained))
            return false;
 
        for (int i = 1; i < argc; ++i) {
            if (!canConvertFromTo(m_state.registers[argv + i].content, intType))
                return false;
        }
 
        addReadRegister(argv, elementContained);
 
        for (int i = 1; i < argc; ++i)
            addReadRegister(argv + i, intType);
 
        m_state.setHasExternalSideEffects();
        setReturnType(baseContained);
        return true;
    }
 
    if (name == u"includes" && argc > 0 && argc < 3) {
        if (!canConvertFromTo(m_state.registers[argv].content, elementContained))
            return false;
 
        if (argc == 2) {
            if (!canConvertFromTo(m_state.registers[argv + 1].content, intType))
                return false;
            addReadRegister(argv + 1, intType);
        }
 
        addReadRegister(argv, elementContained);
        setReturnType(m_typeResolver->boolType());
        return true;
    }
 
    if (name == u"toString" || (name == u"join" && argc < 2)) {
        if (argc == 1) {
            if (!canConvertFromTo(m_state.registers[argv].content, stringType))
                return false;
            addReadRegister(argv, stringType);
        }
 
        setReturnType(m_typeResolver->stringType());
        return true;
    }
 
    if ((name == u"pop" || name == u"shift") && argc == 0) {
        m_state.setHasExternalSideEffects();
        setReturnType(elementContained);
        return true;
    }
 
    if (name == u"push" || name == u"unshift") {
        for (int i = 0; i < argc; ++i) {
            if (!canConvertFromTo(m_state.registers[argv + i].content, elementContained))
                return false;
        }
 
        for (int i = 0; i < argc; ++i)
            addReadRegister(argv + i, elementContained);
 
        m_state.setHasExternalSideEffects();
        setReturnType(m_typeResolver->int32Type());
        return true;
    }
 
    if (name == u"reverse" && argc == 0) {
        m_state.setHasExternalSideEffects();
        setReturnType(baseContained);
        return true;
    }
 
    if (name == u"slice" && argc < 3) {
        for (int i = 0; i < argc; ++i) {
            if (!canConvertFromTo(m_state.registers[argv + i].content, intType))
                return false;
        }
 
        for (int i = 0; i < argc; ++i)
            addReadRegister(argv + i, intType);
 
        setReturnType(baseType.containedType()->isListProperty()
                               ? m_typeResolver->qObjectListType()
                               : baseContained);
        return true;
    }
 
    if (name == u"splice" && argc > 0) {
        const int startAndDeleteCount = std::min(argc, 2);
        for (int i = 0; i < startAndDeleteCount; ++i) {
            if (!canConvertFromTo(m_state.registers[argv + i].content, intType))
                return false;
        }
 
        for (int i = 2; i < argc; ++i) {
            if (!canConvertFromTo(m_state.registers[argv + i].content, elementContained))
                return false;
        }
 
        for (int i = 0; i < startAndDeleteCount; ++i)
            addReadRegister(argv + i, intType);
 
        for (int i = 2; i < argc; ++i)
            addReadRegister(argv + i, elementContained);
 
        m_state.setHasExternalSideEffects();
        setReturnType(baseContained);
        return true;
    }
 
    if ((name == u"indexOf" || name == u"lastIndexOf") && argc > 0 && argc < 3) {
        if (!canConvertFromTo(m_state.registers[argv].content, elementContained))
            return false;
 
        if (argc == 2) {
            if (!canConvertFromTo(m_state.registers[argv + 1].content, intType))
                return false;
            addReadRegister(argv + 1, intType);
        }
 
        addReadRegister(argv, elementContained);
        setReturnType(m_typeResolver->int32Type());
        return true;
    }
 
    return false;
}
 
void QQmlJSTypePropagator::generate_CallPropertyLookup(int lookupIndex, int base, int argc,
                                                       int argv)
{
    generate_CallProperty(m_jsUnitGenerator->lookupNameIndex(lookupIndex), base, argc, argv);
}
 
void QQmlJSTypePropagator::generate_CallName(int name, int argc, int argv)
{
    propagateScopeLookupCall(m_jsUnitGenerator->stringForIndex(name), argc, argv);
}
 
void QQmlJSTypePropagator::generate_CallPossiblyDirectEval(int argc, int argv)
{
    m_state.setHasExternalSideEffects();
    Q_UNUSED(argc)
    Q_UNUSED(argv)
 
    INSTR_PROLOGUE_NOT_IMPLEMENTED_POPULATES_ACC();
}
 
void QQmlJSTypePropagator::propagateScopeLookupCall(const QString &functionName, int argc, int argv)
{
    const QQmlJSRegisterContent resolvedContent
            = m_typeResolver->scopedType(m_function->qmlScope, functionName);
    if (resolvedContent.isMethod()) {
        const auto methods = resolvedContent.method();
        if (resolvedContent.scope().contains(m_typeResolver->jsGlobalObject())) {
            if (propagateTranslationMethod(methods, argc, argv))
                return;
        }
 
        if (!methods.isEmpty()) {
            propagateCall(methods, argc, argv, resolvedContent.scope());
            return;
        }
    }
 
    addError(u"method %1 cannot be resolved."_s.arg(functionName));
    const auto jsValue = m_typeResolver->jsValueType();
    QQmlJSMetaMethod method;
    method.setMethodName(functionName);
    method.setIsJavaScriptFunction(true);
    setAccumulator(m_typeResolver->returnType(method, jsValue, m_function->qmlScope));
 
    addError(u"Cannot find function '%1'"_s.arg(functionName));
 
    handleUnqualifiedAccessAndContextProperties(functionName, true);
}
 
void QQmlJSTypePropagator::generate_CallGlobalLookup(int index, int argc, int argv)
{
    propagateScopeLookupCall(m_jsUnitGenerator->lookupName(index), argc, argv);
}
 
void QQmlJSTypePropagator::generate_CallQmlContextPropertyLookup(int index, int argc, int argv)
{
    const QString name = m_jsUnitGenerator->lookupName(index);
    propagateScopeLookupCall(name, argc, argv);
    checkDeprecated(m_function->qmlScope.containedType(), name, true);
}
 
void QQmlJSTypePropagator::generate_CallWithSpread(int func, int thisObject, int argc, int argv)
{
    m_state.setHasExternalSideEffects();
    Q_UNUSED(func)
    Q_UNUSED(thisObject)
    Q_UNUSED(argc)
    Q_UNUSED(argv)
    INSTR_PROLOGUE_NOT_IMPLEMENTED_POPULATES_ACC();
}
 
void QQmlJSTypePropagator::generate_TailCall(int func, int thisObject, int argc, int argv)
{
    m_state.setHasExternalSideEffects();
    Q_UNUSED(func)
    Q_UNUSED(thisObject)
    Q_UNUSED(argc)
    Q_UNUSED(argv)
    INSTR_PROLOGUE_NOT_IMPLEMENTED();
}
 
void QQmlJSTypePropagator::generate_Construct_SCDate(
        const QQmlJSMetaMethod &ctor, int argc, int argv)
{
    setAccumulator(m_typeResolver->returnType(ctor, m_typeResolver->dateTimeType(), {}));
 
    if (argc == 1) {
        const QQmlJSRegisterContent argType = m_state.registers[argv].content;
        if (m_typeResolver->isNumeric(argType)) {
            addReadRegister(argv, m_typeResolver->realType());
        } else if (argType.contains(m_typeResolver->stringType())) {
            addReadRegister(argv, m_typeResolver->stringType());
        } else if (argType.contains(m_typeResolver->dateTimeType())
                   || argType.contains(m_typeResolver->dateType())
                   || argType.contains(m_typeResolver->timeType())) {
            addReadRegister(argv, m_typeResolver->dateTimeType());
        } else {
            addReadRegister(argv, m_typeResolver->jsPrimitiveType());
        }
    } else {
        constexpr int maxArgc = 7; // year, month, day, hours, minutes, seconds, milliseconds
        for (int i = 0; i < std::min(argc, maxArgc); ++i)
            addReadRegister(argv + i, m_typeResolver->realType());
    }
}
 
void QQmlJSTypePropagator::generate_Construct_SCArray(
        const QQmlJSMetaMethod &ctor, int argc, int argv)
{
    if (argc == 1) {
        if (m_typeResolver->isNumeric(m_state.registers[argv].content)) {
            setAccumulator(m_typeResolver->returnType(ctor, m_typeResolver->variantListType(), {}));
            addReadRegister(argv, m_typeResolver->realType());
        } else {
            generate_DefineArray(argc, argv);
        }
    } else {
        generate_DefineArray(argc, argv);
    }
}
void QQmlJSTypePropagator::generate_Construct(int func, int argc, int argv)
{
    const QQmlJSRegisterContent type = m_state.registers[func].content;
    if (type.contains(m_typeResolver->metaObjectType())) {
        const QQmlJSRegisterContent valueType = type.scope();
        const QQmlJSScope::ConstPtr contained = type.scopeType();
        if (contained->isValueType() && contained->isCreatable()) {
            const auto extension = contained->extensionType();
            if (extension.extensionSpecifier == QQmlJSScope::ExtensionType) {
                propagateCall(
                        extension.scope->ownMethods(extension.scope->internalName()),
                        argc, argv, valueType);
            } else {
                propagateCall(
                        contained->ownMethods(contained->internalName()), argc, argv, valueType);
            }
            return;
        }
    }
 
    if (!type.isMethod()) {
        m_state.setHasExternalSideEffects();
        QQmlJSMetaMethod method;
        method.setMethodName(type.containedTypeName());
        method.setIsJavaScriptFunction(true);
        method.setIsConstructor(true);
        setAccumulator(m_typeResolver->returnType(method, m_typeResolver->jsValueType(), {}));
        return;
    }
 
    if (const auto methods = type.method();
            methods == m_typeResolver->jsGlobalObject()->methods(u"Date"_s)) {
        Q_ASSERT(methods.length() == 1);
        generate_Construct_SCDate(methods[0], argc, argv);
        return;
    }
 
    if (const auto methods = type.method();
            methods == m_typeResolver->jsGlobalObject()->methods(u"Array"_s)) {
        Q_ASSERT(methods.length() == 1);
        generate_Construct_SCArray(methods[0], argc, argv);
        return;
    }
 
    m_state.setHasExternalSideEffects();
 
    QStringList errors;
    QQmlJSMetaMethod match = bestMatchForCall(type.method(), argc, argv, &errors);
    if (!match.isValid())
        addError(u"Cannot determine matching constructor. Candidates:\n"_s + errors.join(u'\n'));
    setAccumulator(m_typeResolver->returnType(match, m_typeResolver->jsValueType(), {}));
}
 
void QQmlJSTypePropagator::generate_ConstructWithSpread(int func, int argc, int argv)
{
    m_state.setHasExternalSideEffects();
    Q_UNUSED(func)
    Q_UNUSED(argc)
    Q_UNUSED(argv)
    INSTR_PROLOGUE_NOT_IMPLEMENTED_POPULATES_ACC();
}
 
void QQmlJSTypePropagator::generate_SetUnwindHandler(int offset)
{
    m_state.setHasInternalSideEffects();
    Q_UNUSED(offset)
    INSTR_PROLOGUE_NOT_IMPLEMENTED_IGNORE();
}
 
void QQmlJSTypePropagator::generate_UnwindDispatch()
{
    m_state.setHasInternalSideEffects();
    INSTR_PROLOGUE_NOT_IMPLEMENTED_IGNORE();
}
 
void QQmlJSTypePropagator::generate_UnwindToLabel(int level, int offset)
{
    m_state.setHasInternalSideEffects();
    Q_UNUSED(level)
    Q_UNUSED(offset)
    INSTR_PROLOGUE_NOT_IMPLEMENTED();
}
 
void QQmlJSTypePropagator::generate_DeadTemporalZoneCheck(int name)
{
    const auto fail = [this, name]() {
        addError(u"Cannot statically assert the dead temporal zone check for %1"_s.arg(
                name ? m_jsUnitGenerator->stringForIndex(name) : u"the anonymous accumulator"_s));
    };
 
    const QQmlJSRegisterContent in = m_state.accumulatorIn();
    if (in.isConversion()) {
        const auto &inConversionOrigins = in.conversionOrigins();
        for (QQmlJSRegisterContent origin : inConversionOrigins) {
            if (!origin.contains(m_typeResolver->emptyType()))
                continue;
            fail();
            break;
        }
    } else if (in.contains(m_typeResolver->emptyType())) {
        fail();
    }
}
 
void QQmlJSTypePropagator::generate_ThrowException()
{
    addReadAccumulator(m_typeResolver->jsValueType());
    m_state.setHasInternalSideEffects();
    m_state.skipInstructionsUntilNextJumpTarget = true;
}
 
void QQmlJSTypePropagator::generate_GetException()
{
    INSTR_PROLOGUE_NOT_IMPLEMENTED_POPULATES_ACC();
}
 
void QQmlJSTypePropagator::generate_SetException()
{
    m_state.setHasInternalSideEffects();
    INSTR_PROLOGUE_NOT_IMPLEMENTED();
}
 
void QQmlJSTypePropagator::generate_CreateCallContext()
{
    m_state.setHasInternalSideEffects();
}
 
void QQmlJSTypePropagator::generate_PushCatchContext(int index, int name)
{
    m_state.setHasInternalSideEffects();
    Q_UNUSED(index)
    Q_UNUSED(name)
    INSTR_PROLOGUE_NOT_IMPLEMENTED_IGNORE();
}
 
void QQmlJSTypePropagator::generate_PushWithContext()
{
    m_state.setHasInternalSideEffects();
    INSTR_PROLOGUE_NOT_IMPLEMENTED_POPULATES_ACC();
}
 
void QQmlJSTypePropagator::generate_PushBlockContext(int index)
{
    m_state.setHasInternalSideEffects();
    Q_UNUSED(index)
    INSTR_PROLOGUE_NOT_IMPLEMENTED();
}
 
void QQmlJSTypePropagator::generate_CloneBlockContext()
{
    m_state.setHasInternalSideEffects();
    INSTR_PROLOGUE_NOT_IMPLEMENTED();
}
 
void QQmlJSTypePropagator::generate_PushScriptContext(int index)
{
    m_state.setHasInternalSideEffects();
    Q_UNUSED(index)
    INSTR_PROLOGUE_NOT_IMPLEMENTED();
}
 
void QQmlJSTypePropagator::generate_PopScriptContext()
{
    m_state.setHasInternalSideEffects();
    INSTR_PROLOGUE_NOT_IMPLEMENTED();
}
 
void QQmlJSTypePropagator::generate_PopContext()
{
    m_state.setHasInternalSideEffects();
}
 
void QQmlJSTypePropagator::generate_GetIterator(int iterator)
{
    const QQmlJSRegisterContent listType = m_state.accumulatorIn();
    if (!listType.isList()) {
        const QQmlJSScope::ConstPtr jsValue = m_typeResolver->jsValueType();
        addReadAccumulator(jsValue);
 
        QQmlJSMetaProperty prop;
        prop.setPropertyName(u"<>"_s);
        prop.setTypeName(jsValue->internalName());
        prop.setType(jsValue);
        setAccumulator(m_pool->createProperty(
                prop, currentInstructionOffset(),
                QQmlJSRegisterContent::InvalidLookupIndex, QQmlJSRegisterContent::ListIterator,
                listType));
        return;
    }
 
    addReadAccumulator();
    setAccumulator(m_typeResolver->iteratorPointer(
            listType, QQmlJS::AST::ForEachType(iterator), currentInstructionOffset()));
}
 
void QQmlJSTypePropagator::generate_IteratorNext(int value, int offset)
{
    const QQmlJSRegisterContent iteratorType = m_state.accumulatorIn();
    addReadAccumulator();
    setRegister(value, m_typeResolver->merge(
                                m_typeResolver->elementType(iteratorType),
                                m_typeResolver->literalType(m_typeResolver->voidType())));
    saveRegisterStateForJump(offset);
    m_state.setHasInternalSideEffects();
}
 
void QQmlJSTypePropagator::generate_IteratorNextForYieldStar(int iterator, int object, int offset)
{
    Q_UNUSED(iterator)
    Q_UNUSED(object)
    Q_UNUSED(offset)
    INSTR_PROLOGUE_NOT_IMPLEMENTED_POPULATES_ACC();
}
 
void QQmlJSTypePropagator::generate_IteratorClose()
{
    // Noop
}
 
void QQmlJSTypePropagator::generate_DestructureRestElement()
{
    INSTR_PROLOGUE_NOT_IMPLEMENTED_POPULATES_ACC();
}
 
void QQmlJSTypePropagator::generate_DeleteProperty(int base, int index)
{
    Q_UNUSED(base)
    Q_UNUSED(index)
    INSTR_PROLOGUE_NOT_IMPLEMENTED_POPULATES_ACC();
}
 
void QQmlJSTypePropagator::generate_DeleteName(int name)
{
    Q_UNUSED(name)
    INSTR_PROLOGUE_NOT_IMPLEMENTED_POPULATES_ACC();
}
 
void QQmlJSTypePropagator::generate_TypeofName(int name)
{
    Q_UNUSED(name);
    setAccumulator(m_typeResolver->operationType(m_typeResolver->stringType()));
}
 
void QQmlJSTypePropagator::generate_TypeofValue()
{
    setAccumulator(m_typeResolver->operationType(m_typeResolver->stringType()));
}
 
void QQmlJSTypePropagator::generate_DeclareVar(int varName, int isDeletable)
{
    Q_UNUSED(varName)
    Q_UNUSED(isDeletable)
    INSTR_PROLOGUE_NOT_IMPLEMENTED();
}
 
void QQmlJSTypePropagator::generate_DefineArray(int argc, int args)
{
    setAccumulator(m_typeResolver->operationType(m_typeResolver->variantListType()));
 
    // Track all arguments as the same type.
    const QQmlJSScope::ConstPtr elementType = m_typeResolver->varType();
    for (int i = 0; i < argc; ++i)
        addReadRegister(args + i, elementType);
}
 
void QQmlJSTypePropagator::generate_DefineObjectLiteral(int internalClassId, int argc, int args)
{
    const int classSize = m_jsUnitGenerator->jsClassSize(internalClassId);
    Q_ASSERT(argc >= classSize);
 
    // Track each element as separate type
    for (int i = 0; i < classSize; ++i)
        addReadRegister(args + i, m_typeResolver->varType());
 
    for (int i = classSize; i < argc; i += 3) {
        // layout for remaining members is:
        // 0: ObjectLiteralArgument - Value|Method|Getter|Setter
        // We cannot do anything useful with this. Any code that would call a getter/setter/method
        // could not be compiled to C++. Ignore it.
 
        // 1: name of argument
        addReadRegister(args + i + 1, m_typeResolver->stringType());
 
        // 2: value of argument
        addReadRegister(args + i + 2, m_typeResolver->varType());
    }
 
    setAccumulator(m_typeResolver->operationType(m_typeResolver->variantMapType()));
}
 
void QQmlJSTypePropagator::generate_CreateClass(int classIndex, int heritage, int computedNames)
{
    Q_UNUSED(classIndex)
    Q_UNUSED(heritage)
    Q_UNUSED(computedNames)
    INSTR_PROLOGUE_NOT_IMPLEMENTED_POPULATES_ACC();
}
 
void QQmlJSTypePropagator::generate_CreateMappedArgumentsObject()
{
    INSTR_PROLOGUE_NOT_IMPLEMENTED_POPULATES_ACC();
}
 
void QQmlJSTypePropagator::generate_CreateUnmappedArgumentsObject()
{
    INSTR_PROLOGUE_NOT_IMPLEMENTED_POPULATES_ACC();
}
 
void QQmlJSTypePropagator::generate_CreateRestParameter(int argIndex)
{
    Q_UNUSED(argIndex)
    INSTR_PROLOGUE_NOT_IMPLEMENTED_POPULATES_ACC();
}
 
void QQmlJSTypePropagator::generate_ConvertThisToObject()
{
    setRegister(This, m_pool->clone(m_function->qmlScope));
}
 
void QQmlJSTypePropagator::generate_LoadSuperConstructor()
{
    INSTR_PROLOGUE_NOT_IMPLEMENTED_POPULATES_ACC();
}
 
void QQmlJSTypePropagator::generate_ToObject()
{
    INSTR_PROLOGUE_NOT_IMPLEMENTED_POPULATES_ACC();
}
 
void QQmlJSTypePropagator::generate_Jump(int offset)
{
    saveRegisterStateForJump(offset);
    m_state.skipInstructionsUntilNextJumpTarget = true;
    m_state.setHasInternalSideEffects();
}
 
void QQmlJSTypePropagator::generate_JumpTrue(int offset)
{
    if (!canConvertFromTo(m_state.accumulatorIn(), m_typeResolver->boolType())) {
        addError(u"cannot convert from %1 to boolean"_s
                         .arg(m_state.accumulatorIn().descriptiveName()));
        return;
    }
    saveRegisterStateForJump(offset);
    addReadAccumulator(m_typeResolver->boolType());
    m_state.setHasInternalSideEffects();
}
 
void QQmlJSTypePropagator::generate_JumpFalse(int offset)
{
    if (!canConvertFromTo(m_state.accumulatorIn(), m_typeResolver->boolType())) {
        addError(u"cannot convert from %1 to boolean"_s
                         .arg(m_state.accumulatorIn().descriptiveName()));
        return;
    }
    saveRegisterStateForJump(offset);
    addReadAccumulator(m_typeResolver->boolType());
    m_state.setHasInternalSideEffects();
}
 
void QQmlJSTypePropagator::generate_JumpNoException(int offset)
{
    saveRegisterStateForJump(offset);
    m_state.setHasInternalSideEffects();
}
 
void QQmlJSTypePropagator::generate_JumpNotUndefined(int offset)
{
    Q_UNUSED(offset)
    INSTR_PROLOGUE_NOT_IMPLEMENTED();
}
 
void QQmlJSTypePropagator::generate_CheckException()
{
    m_state.setHasInternalSideEffects();
}
 
void QQmlJSTypePropagator::recordEqualsNullType()
{
    // TODO: We can specialize this further, for QVariant, QJSValue, int, bool, whatever.
    if (m_state.accumulatorIn().contains(m_typeResolver->nullType())
            || m_state.accumulatorIn().containedType()->isReferenceType()) {
        addReadAccumulator();
    } else {
        addReadAccumulator(m_typeResolver->jsPrimitiveType());
    }
}
void QQmlJSTypePropagator::recordEqualsIntType()
{
    // We have specializations for numeric types and bool.
    const QQmlJSScope::ConstPtr in = m_state.accumulatorIn().containedType();
    if (m_state.accumulatorIn().contains(m_typeResolver->boolType())
            || m_typeResolver->isNumeric(m_state.accumulatorIn())) {
        addReadAccumulator();
    } else {
        addReadAccumulator(m_typeResolver->jsPrimitiveType());
    }
}
void QQmlJSTypePropagator::recordEqualsType(int lhs)
{
    const auto isNumericOrEnum = [this](QQmlJSRegisterContent content) {
        return content.isEnumeration() || m_typeResolver->isNumeric(content);
    };
 
    const auto accumulatorIn = m_state.accumulatorIn();
    const auto lhsRegister = m_state.registers[lhs].content;
 
    // If the types are primitive, we compare directly ...
    if (m_typeResolver->isPrimitive(accumulatorIn) || accumulatorIn.isEnumeration()) {
        if (accumulatorIn.contains(lhsRegister.containedType())
                || (isNumericOrEnum(accumulatorIn) && isNumericOrEnum(lhsRegister))
                || m_typeResolver->isPrimitive(lhsRegister)) {
            addReadRegister(lhs);
            addReadAccumulator();
            return;
        }
    }
 
    const auto containedAccumulatorIn = m_typeResolver->isOptionalType(accumulatorIn)
            ? m_typeResolver->extractNonVoidFromOptionalType(accumulatorIn).containedType()
            : accumulatorIn.containedType();
 
    const auto containedLhs = m_typeResolver->isOptionalType(lhsRegister)
            ? m_typeResolver->extractNonVoidFromOptionalType(lhsRegister).containedType()
            : lhsRegister.containedType();
 
    // We don't modify types if the types are comparable with QObject, QUrl or var types
    if (QQmlJSUtils::canStrictlyCompareWithVar(m_typeResolver, containedLhs, containedAccumulatorIn)
        || QQmlJSUtils::canCompareWithQObject(m_typeResolver, containedLhs, containedAccumulatorIn)
        || QQmlJSUtils::canCompareWithQUrl(m_typeResolver, containedLhs, containedAccumulatorIn)) {
        addReadRegister(lhs);
        addReadAccumulator();
        return;
    }
 
    // Otherwise they're both casted to QJSValue.
    // TODO: We can add more specializations here: object/null etc
 
    const QQmlJSScope::ConstPtr jsval = m_typeResolver->jsValueType();
    addReadRegister(lhs, jsval);
    addReadAccumulator(jsval);
}
 
void QQmlJSTypePropagator::recordCompareType(int lhs)
{
    // TODO: Revisit this. Does it make any sense to do a comparison on something non-numeric?
    //       Does it pay off to record the exact number type to use?
 
    const QQmlJSRegisterContent lhsContent = m_state.registers[lhs].content;
    const QQmlJSRegisterContent rhsContent = m_state.accumulatorIn();
    if (lhsContent == rhsContent) {
        // Do not re-track in this case. We want any manipulations on the original types to persist.
        // TODO: Why? Can we just use double and be done with it?
        addReadRegister(lhs, lhsContent);
        addReadAccumulator(lhsContent);
    } else if (m_typeResolver->isNumeric(lhsContent) && m_typeResolver->isNumeric(rhsContent)) {
        // If they're both numeric, we can compare them directly.
        // They may be casted to double, though.
        const QQmlJSRegisterContent merged = m_typeResolver->merge(lhsContent, rhsContent);
        addReadRegister(lhs, merged);
        addReadAccumulator(merged);
    } else {
        const QQmlJSScope::ConstPtr primitive = m_typeResolver->jsPrimitiveType();
        addReadRegister(lhs, primitive);
        addReadAccumulator(primitive);
    }
}
 
void QQmlJSTypePropagator::warnAboutTypeCoercion(int lhs)
{
    Q_UNUSED(lhs);
}
 
void QQmlJSTypePropagator::generate_CmpEqNull()
{
    recordEqualsNullType();
    setAccumulator(m_typeResolver->operationType(m_typeResolver->boolType()));
}
 
void QQmlJSTypePropagator::generate_CmpNeNull()
{
    recordEqualsNullType();
    setAccumulator(m_typeResolver->operationType(m_typeResolver->boolType()));
}
 
void QQmlJSTypePropagator::generate_CmpEqInt(int lhsConst)
{
    recordEqualsIntType();
    Q_UNUSED(lhsConst)
    setAccumulator(m_typeResolver->typeForBinaryOperation(
            QSOperator::Op::Equal, m_typeResolver->literalType(m_typeResolver->int32Type()),
            m_state.accumulatorIn()));
}
 
void QQmlJSTypePropagator::generate_CmpNeInt(int lhsConst)
{
    recordEqualsIntType();
    Q_UNUSED(lhsConst)
    setAccumulator(m_typeResolver->typeForBinaryOperation(
            QSOperator::Op::NotEqual, m_typeResolver->literalType(m_typeResolver->int32Type()),
            m_state.accumulatorIn()));
}
 
void QQmlJSTypePropagator::generate_CmpEq(int lhs)
{
    warnAboutTypeCoercion(lhs);
    recordEqualsType(lhs);
    propagateBinaryOperation(QSOperator::Op::Equal, lhs);
}
 
void QQmlJSTypePropagator::generate_CmpNe(int lhs)
{
    warnAboutTypeCoercion(lhs);
    recordEqualsType(lhs);
    propagateBinaryOperation(QSOperator::Op::NotEqual, lhs);
}
 
void QQmlJSTypePropagator::generate_CmpGt(int lhs)
{
    recordCompareType(lhs);
    propagateBinaryOperation(QSOperator::Op::Gt, lhs);
}
 
void QQmlJSTypePropagator::generate_CmpGe(int lhs)
{
    recordCompareType(lhs);
    propagateBinaryOperation(QSOperator::Op::Ge, lhs);
}
 
void QQmlJSTypePropagator::generate_CmpLt(int lhs)
{
    recordCompareType(lhs);
    propagateBinaryOperation(QSOperator::Op::Lt, lhs);
}
 
void QQmlJSTypePropagator::generate_CmpLe(int lhs)
{
    recordCompareType(lhs);
    propagateBinaryOperation(QSOperator::Op::Le, lhs);
}
 
void QQmlJSTypePropagator::generate_CmpStrictEqual(int lhs)
{
    recordEqualsType(lhs);
    propagateBinaryOperation(QSOperator::Op::StrictEqual, lhs);
}
 
void QQmlJSTypePropagator::generate_CmpStrictNotEqual(int lhs)
{
    recordEqualsType(lhs);
    propagateBinaryOperation(QSOperator::Op::StrictNotEqual, lhs);
}
 
void QQmlJSTypePropagator::generate_CmpIn(int lhs)
{
    // TODO: Most of the time we don't need the object at all, but only its metatype.
    //       Fix this when we add support for the "in" instruction to the code generator.
    //       Also, specialize on lhs to avoid conversion to QJSPrimitiveValue.
 
    addReadRegister(lhs, m_typeResolver->jsValueType());
    addReadAccumulator(m_typeResolver->jsValueType());
 
    propagateBinaryOperation(QSOperator::Op::In, lhs);
}
 
void QQmlJSTypePropagator::generate_CmpInstanceOf(int lhs)
{
    Q_UNUSED(lhs)
    INSTR_PROLOGUE_NOT_IMPLEMENTED_POPULATES_ACC();
}
 
void QQmlJSTypePropagator::generate_As(int lhs)
{
    const QQmlJSRegisterContent input = checkedInputRegister(lhs);
    const QQmlJSScope::ConstPtr inContained = input.containedType();
 
    QQmlJSRegisterContent output;
 
    const QQmlJSRegisterContent accumulatorIn = m_state.accumulatorIn();
    switch (accumulatorIn.variant()) {
    case QQmlJSRegisterContent::Attachment:
        output = accumulatorIn.scope();
        break;
    case QQmlJSRegisterContent::MetaType:
        output = accumulatorIn.scope();
        if (output.containedType()->isComposite()) // Otherwise we don't need it
            addReadAccumulator(m_typeResolver->metaObjectType());
        break;
    default:
        output = accumulatorIn;
        break;
    }
 
    QQmlJSScope::ConstPtr outContained = output.containedType();
 
    if (outContained->accessSemantics() == QQmlJSScope::AccessSemantics::Reference) {
        // A referece type cast can result in either the type or null.
        // Reference types can hold null. We don't need to special case that.
 
        if (m_typeResolver->inherits(inContained, outContained))
            output = m_pool->clone(input);
        else
            output = m_pool->castTo(input, outContained);
    } else if (m_typeResolver->inherits(inContained, outContained)) {
        // A "slicing" cannot result in void
        output = m_pool->castTo(input, outContained);
    } else {
        // A value type cast can result in either the type or undefined.
        // Using convert() retains the variant of the input type.
        output = m_typeResolver->merge(
                m_pool->castTo(input, outContained),
                m_pool->castTo(input, m_typeResolver->voidType()));
    }
 
    addReadRegister(lhs);
    setAccumulator(output);
}
 
void QQmlJSTypePropagator::checkConversion(
        QQmlJSRegisterContent from, QQmlJSRegisterContent to)
{
    if (!canConvertFromTo(from, to)) {
        addError(u"cannot convert from %1 to %2"_s
                 .arg(from.descriptiveName(), to.descriptiveName()));
    }
}
 
void QQmlJSTypePropagator::generateUnaryArithmeticOperation(QQmlJSTypeResolver::UnaryOperator op)
{
    const QQmlJSRegisterContent type = m_typeResolver->typeForArithmeticUnaryOperation(
                op, m_state.accumulatorIn());
    checkConversion(m_state.accumulatorIn(), type);
    addReadAccumulator(type);
    setAccumulator(type);
}
 
void QQmlJSTypePropagator::generate_UNot()
{
    generateUnaryArithmeticOperation(QQmlJSTypeResolver::UnaryOperator::Not);
}
 
void QQmlJSTypePropagator::generate_UPlus()
{
    generateUnaryArithmeticOperation(QQmlJSTypeResolver::UnaryOperator::Plus);
}
 
void QQmlJSTypePropagator::generate_UMinus()
{
    generateUnaryArithmeticOperation(QQmlJSTypeResolver::UnaryOperator::Minus);
}
 
void QQmlJSTypePropagator::generate_UCompl()
{
    generateUnaryArithmeticOperation(QQmlJSTypeResolver::UnaryOperator::Complement);
}
 
void QQmlJSTypePropagator::generate_Increment()
{
    generateUnaryArithmeticOperation(QQmlJSTypeResolver::UnaryOperator::Increment);
}
 
void QQmlJSTypePropagator::generate_Decrement()
{
    generateUnaryArithmeticOperation(QQmlJSTypeResolver::UnaryOperator::Decrement);
}
 
void QQmlJSTypePropagator::generateBinaryArithmeticOperation(QSOperator::Op op, int lhs)
{
    const QQmlJSRegisterContent type = propagateBinaryOperation(op, lhs);
 
    checkConversion(checkedInputRegister(lhs), type);
    addReadRegister(lhs, type);
 
    checkConversion(m_state.accumulatorIn(), type);
    addReadAccumulator(type);
}
 
void QQmlJSTypePropagator::generateBinaryConstArithmeticOperation(QSOperator::Op op)
{
    const QQmlJSRegisterContent type = m_typeResolver->typeForBinaryOperation(
                op, m_state.accumulatorIn(),
                m_typeResolver->literalType(m_typeResolver->int32Type()));
 
    checkConversion(m_state.accumulatorIn(), type);
    addReadAccumulator(type);
    setAccumulator(type);
}
 
void QQmlJSTypePropagator::generate_Add(int lhs)
{
    generateBinaryArithmeticOperation(QSOperator::Op::Add, lhs);
}
 
void QQmlJSTypePropagator::generate_BitAnd(int lhs)
{
    generateBinaryArithmeticOperation(QSOperator::Op::BitAnd, lhs);
}
 
void QQmlJSTypePropagator::generate_BitOr(int lhs)
{
    generateBinaryArithmeticOperation(QSOperator::Op::BitOr, lhs);
}
 
void QQmlJSTypePropagator::generate_BitXor(int lhs)
{
    generateBinaryArithmeticOperation(QSOperator::Op::BitXor, lhs);
}
 
void QQmlJSTypePropagator::generate_UShr(int lhs)
{
    generateBinaryArithmeticOperation(QSOperator::Op::URShift, lhs);
}
 
void QQmlJSTypePropagator::generate_Shr(int lhs)
{
    generateBinaryArithmeticOperation(QSOperator::Op::RShift, lhs);
}
 
void QQmlJSTypePropagator::generate_Shl(int lhs)
{
    generateBinaryArithmeticOperation(QSOperator::Op::LShift, lhs);
}
 
void QQmlJSTypePropagator::generate_BitAndConst(int rhsConst)
{
    Q_UNUSED(rhsConst)
    generateBinaryConstArithmeticOperation(QSOperator::Op::BitAnd);
}
 
void QQmlJSTypePropagator::generate_BitOrConst(int rhsConst)
{
    Q_UNUSED(rhsConst)
    generateBinaryConstArithmeticOperation(QSOperator::Op::BitOr);
}
 
void QQmlJSTypePropagator::generate_BitXorConst(int rhsConst)
{
    Q_UNUSED(rhsConst)
    generateBinaryConstArithmeticOperation(QSOperator::Op::BitXor);
}
 
void QQmlJSTypePropagator::generate_UShrConst(int rhsConst)
{
    Q_UNUSED(rhsConst)
    generateBinaryConstArithmeticOperation(QSOperator::Op::URShift);
}
 
void QQmlJSTypePropagator::generate_ShrConst(int rhsConst)
{
    Q_UNUSED(rhsConst)
    generateBinaryConstArithmeticOperation(QSOperator::Op::RShift);
}
 
void QQmlJSTypePropagator::generate_ShlConst(int rhsConst)
{
    Q_UNUSED(rhsConst)
    generateBinaryConstArithmeticOperation(QSOperator::Op::LShift);
}
 
void QQmlJSTypePropagator::generate_Exp(int lhs)
{
    generateBinaryArithmeticOperation(QSOperator::Op::Exp, lhs);
}
 
void QQmlJSTypePropagator::generate_Mul(int lhs)
{
    generateBinaryArithmeticOperation(QSOperator::Op::Mul, lhs);
}
 
void QQmlJSTypePropagator::generate_Div(int lhs)
{
    generateBinaryArithmeticOperation(QSOperator::Op::Div, lhs);
}
 
void QQmlJSTypePropagator::generate_Mod(int lhs)
{
    generateBinaryArithmeticOperation(QSOperator::Op::Mod, lhs);
}
 
void QQmlJSTypePropagator::generate_Sub(int lhs)
{
    generateBinaryArithmeticOperation(QSOperator::Op::Sub, lhs);
}
 
void QQmlJSTypePropagator::generate_InitializeBlockDeadTemporalZone(int firstReg, int count)
{
    setAccumulator(m_typeResolver->literalType(m_typeResolver->emptyType()));
    for (int reg = firstReg, end = firstReg + count; reg < end; ++reg)
        setRegister(reg, m_typeResolver->literalType(m_typeResolver->emptyType()));
}
 
void QQmlJSTypePropagator::generate_ThrowOnNullOrUndefined()
{
    INSTR_PROLOGUE_NOT_IMPLEMENTED();
}
 
void QQmlJSTypePropagator::generate_GetTemplateObject(int index)
{
    Q_UNUSED(index)
    INSTR_PROLOGUE_NOT_IMPLEMENTED_POPULATES_ACC();
}
 
QV4::Moth::ByteCodeHandler::Verdict
QQmlJSTypePropagator::startInstruction(QV4::Moth::Instr::Type type)
{
    if (m_state.jumpTargets.contains(currentInstructionOffset())) {
        if (m_state.skipInstructionsUntilNextJumpTarget) {
            // When re-surfacing from dead code, all registers are invalid.
            m_state.registers.clear();
            m_state.skipInstructionsUntilNextJumpTarget = false;
        }
    } else if (m_state.skipInstructionsUntilNextJumpTarget
               && !instructionManipulatesContext(type)) {
        return SkipInstruction;
    }
 
    const int currentOffset = currentInstructionOffset();
 
    // If we reach an instruction that is a target of a jump earlier, then we must check that the
    // register state at the origin matches the current state. If not, then we may have to inject
    // conversion code (communicated to code gen via m_state.typeConversions). For
    // example:
    //
    //     function blah(x: number) { return x > 10 ? 10 : x}
    //
    // translates to a situation where in the "true" case, we load an integer into the accumulator
    // and in the else case a number (x). When the control flow is joined, the types don't match and
    // we need to make sure that the int is converted to a double just before the jump.
    for (auto originRegisterStateIt =
                 m_jumpOriginRegisterStateByTargetInstructionOffset.constFind(currentOffset);
         originRegisterStateIt != m_jumpOriginRegisterStateByTargetInstructionOffset.constEnd()
         && originRegisterStateIt.key() == currentOffset;
         ++originRegisterStateIt) {
        auto stateToMerge = *originRegisterStateIt;
        for (auto registerIt = stateToMerge.registers.constBegin(),
                  end = stateToMerge.registers.constEnd();
             registerIt != end; ++registerIt) {
            const int registerIndex = registerIt.key();
 
            const VirtualRegister &newType = registerIt.value();
            if (!newType.content.isValid()) {
                addError(u"When reached from offset %1, %2 is undefined"_s
                                 .arg(stateToMerge.originatingOffset)
                                 .arg(registerName(registerIndex)));
                return SkipInstruction;
            }
 
            auto currentRegister = m_state.registers.find(registerIndex);
            if (currentRegister != m_state.registers.end())
                mergeRegister(registerIndex, newType, currentRegister.value());
            else
                mergeRegister(registerIndex, newType, newType);
        }
    }
 
    return ProcessInstruction;
}
 
bool QQmlJSTypePropagator::populatesAccumulator(QV4::Moth::Instr::Type instr) const
{
    switch (instr) {
    case QV4::Moth::Instr::Type::CheckException:
    case QV4::Moth::Instr::Type::CloneBlockContext:
    case QV4::Moth::Instr::Type::ConvertThisToObject:
    case QV4::Moth::Instr::Type::CreateCallContext:
    case QV4::Moth::Instr::Type::DeadTemporalZoneCheck:
    case QV4::Moth::Instr::Type::Debug:
    case QV4::Moth::Instr::Type::DeclareVar:
    case QV4::Moth::Instr::Type::IteratorClose:
    case QV4::Moth::Instr::Type::IteratorNext:
    case QV4::Moth::Instr::Type::IteratorNextForYieldStar:
    case QV4::Moth::Instr::Type::Jump:
    case QV4::Moth::Instr::Type::JumpFalse:
    case QV4::Moth::Instr::Type::JumpNoException:
    case QV4::Moth::Instr::Type::JumpNotUndefined:
    case QV4::Moth::Instr::Type::JumpTrue:
    case QV4::Moth::Instr::Type::MoveConst:
    case QV4::Moth::Instr::Type::MoveReg:
    case QV4::Moth::Instr::Type::MoveRegExp:
    case QV4::Moth::Instr::Type::PopContext:
    case QV4::Moth::Instr::Type::PushBlockContext:
    case QV4::Moth::Instr::Type::PushCatchContext:
    case QV4::Moth::Instr::Type::PushScriptContext:
    case QV4::Moth::Instr::Type::Resume:
    case QV4::Moth::Instr::Type::Ret:
    case QV4::Moth::Instr::Type::SetException:
    case QV4::Moth::Instr::Type::SetLookup:
    case QV4::Moth::Instr::Type::SetUnwindHandler:
    case QV4::Moth::Instr::Type::StoreElement:
    case QV4::Moth::Instr::Type::StoreLocal:
    case QV4::Moth::Instr::Type::StoreNameSloppy:
    case QV4::Moth::Instr::Type::StoreNameStrict:
    case QV4::Moth::Instr::Type::StoreProperty:
    case QV4::Moth::Instr::Type::StoreReg:
    case QV4::Moth::Instr::Type::StoreScopedLocal:
    case QV4::Moth::Instr::Type::StoreSuperProperty:
    case QV4::Moth::Instr::Type::ThrowException:
    case QV4::Moth::Instr::Type::ThrowOnNullOrUndefined:
    case QV4::Moth::Instr::Type::UnwindDispatch:
    case QV4::Moth::Instr::Type::UnwindToLabel:
    case QV4::Moth::Instr::Type::Yield:
    case QV4::Moth::Instr::Type::YieldStar:
        return false;
    case QV4::Moth::Instr::Type::Add:
    case QV4::Moth::Instr::Type::As:
    case QV4::Moth::Instr::Type::BitAnd:
    case QV4::Moth::Instr::Type::BitAndConst:
    case QV4::Moth::Instr::Type::BitOr:
    case QV4::Moth::Instr::Type::BitOrConst:
    case QV4::Moth::Instr::Type::BitXor:
    case QV4::Moth::Instr::Type::BitXorConst:
    case QV4::Moth::Instr::Type::CallGlobalLookup:
    case QV4::Moth::Instr::Type::CallName:
    case QV4::Moth::Instr::Type::CallPossiblyDirectEval:
    case QV4::Moth::Instr::Type::CallProperty:
    case QV4::Moth::Instr::Type::CallPropertyLookup:
    case QV4::Moth::Instr::Type::CallQmlContextPropertyLookup:
    case QV4::Moth::Instr::Type::CallValue:
    case QV4::Moth::Instr::Type::CallWithReceiver:
    case QV4::Moth::Instr::Type::CallWithSpread:
    case QV4::Moth::Instr::Type::CmpEq:
    case QV4::Moth::Instr::Type::CmpEqInt:
    case QV4::Moth::Instr::Type::CmpEqNull:
    case QV4::Moth::Instr::Type::CmpGe:
    case QV4::Moth::Instr::Type::CmpGt:
    case QV4::Moth::Instr::Type::CmpIn:
    case QV4::Moth::Instr::Type::CmpInstanceOf:
    case QV4::Moth::Instr::Type::CmpLe:
    case QV4::Moth::Instr::Type::CmpLt:
    case QV4::Moth::Instr::Type::CmpNe:
    case QV4::Moth::Instr::Type::CmpNeInt:
    case QV4::Moth::Instr::Type::CmpNeNull:
    case QV4::Moth::Instr::Type::CmpStrictEqual:
    case QV4::Moth::Instr::Type::CmpStrictNotEqual:
    case QV4::Moth::Instr::Type::Construct:
    case QV4::Moth::Instr::Type::ConstructWithSpread:
    case QV4::Moth::Instr::Type::CreateClass:
    case QV4::Moth::Instr::Type::CreateMappedArgumentsObject:
    case QV4::Moth::Instr::Type::CreateRestParameter:
    case QV4::Moth::Instr::Type::CreateUnmappedArgumentsObject:
    case QV4::Moth::Instr::Type::Decrement:
    case QV4::Moth::Instr::Type::DefineArray:
    case QV4::Moth::Instr::Type::DefineObjectLiteral:
    case QV4::Moth::Instr::Type::DeleteName:
    case QV4::Moth::Instr::Type::DeleteProperty:
    case QV4::Moth::Instr::Type::DestructureRestElement:
    case QV4::Moth::Instr::Type::Div:
    case QV4::Moth::Instr::Type::Exp:
    case QV4::Moth::Instr::Type::GetException:
    case QV4::Moth::Instr::Type::GetIterator:
    case QV4::Moth::Instr::Type::GetLookup:
    case QV4::Moth::Instr::Type::GetOptionalLookup:
    case QV4::Moth::Instr::Type::GetTemplateObject:
    case QV4::Moth::Instr::Type::Increment:
    case QV4::Moth::Instr::Type::InitializeBlockDeadTemporalZone:
    case QV4::Moth::Instr::Type::LoadClosure:
    case QV4::Moth::Instr::Type::LoadConst:
    case QV4::Moth::Instr::Type::LoadElement:
    case QV4::Moth::Instr::Type::LoadFalse:
    case QV4::Moth::Instr::Type::LoadGlobalLookup:
    case QV4::Moth::Instr::Type::LoadImport:
    case QV4::Moth::Instr::Type::LoadInt:
    case QV4::Moth::Instr::Type::LoadLocal:
    case QV4::Moth::Instr::Type::LoadName:
    case QV4::Moth::Instr::Type::LoadNull:
    case QV4::Moth::Instr::Type::LoadOptionalProperty:
    case QV4::Moth::Instr::Type::LoadProperty:
    case QV4::Moth::Instr::Type::LoadQmlContextPropertyLookup:
    case QV4::Moth::Instr::Type::LoadReg:
    case QV4::Moth::Instr::Type::LoadRuntimeString:
    case QV4::Moth::Instr::Type::LoadScopedLocal:
    case QV4::Moth::Instr::Type::LoadSuperConstructor:
    case QV4::Moth::Instr::Type::LoadSuperProperty:
    case QV4::Moth::Instr::Type::LoadTrue:
    case QV4::Moth::Instr::Type::LoadUndefined:
    case QV4::Moth::Instr::Type::LoadZero:
    case QV4::Moth::Instr::Type::Mod:
    case QV4::Moth::Instr::Type::Mul:
    case QV4::Moth::Instr::Type::PushWithContext:
    case QV4::Moth::Instr::Type::Shl:
    case QV4::Moth::Instr::Type::ShlConst:
    case QV4::Moth::Instr::Type::Shr:
    case QV4::Moth::Instr::Type::ShrConst:
    case QV4::Moth::Instr::Type::Sub:
    case QV4::Moth::Instr::Type::TailCall:
    case QV4::Moth::Instr::Type::ToObject:
    case QV4::Moth::Instr::Type::TypeofName:
    case QV4::Moth::Instr::Type::TypeofValue:
    case QV4::Moth::Instr::Type::UCompl:
    case QV4::Moth::Instr::Type::UMinus:
    case QV4::Moth::Instr::Type::UNot:
    case QV4::Moth::Instr::Type::UPlus:
    case QV4::Moth::Instr::Type::UShr:
    case QV4::Moth::Instr::Type::UShrConst:
        return true;
    default:
        Q_UNREACHABLE_RETURN(false);
    }
}
 
bool QQmlJSTypePropagator::isNoop(QV4::Moth::Instr::Type instr) const
{
    switch (instr) {
    case QV4::Moth::Instr::Type::DeadTemporalZoneCheck:
    case QV4::Moth::Instr::Type::IteratorClose:
        return true;
    default:
        return false;
    }
}
 
void QQmlJSTypePropagator::endInstruction(QV4::Moth::Instr::Type instr)
{
    InstructionAnnotation &currentInstruction = m_state.annotations[currentInstructionOffset()];
    currentInstruction.changedRegister = m_state.changedRegister();
    currentInstruction.changedRegisterIndex = m_state.changedRegisterIndex();
    currentInstruction.readRegisters = m_state.takeReadRegisters();
    currentInstruction.hasExternalSideEffects = m_state.hasExternalSideEffects();
    currentInstruction.hasInternalSideEffects = m_state.hasInternalSideEffects();
    currentInstruction.isRename = m_state.isRename();
 
    bool populates = populatesAccumulator(instr);
    int changedIndex = m_state.changedRegisterIndex();
 
    // TODO: Find a way to deal with instructions that change multiple registers
    if (instr != QV4::Moth::Instr::Type::InitializeBlockDeadTemporalZone) {
        Q_ASSERT((populates && changedIndex == Accumulator && m_state.accumulatorOut().isValid())
                 || (!populates && changedIndex != Accumulator));
    }
 
    if (!m_logger->currentFunctionHasCompileError() && !isNoop(instr)) {
        // An instruction needs to have side effects or write to another register or be a known
        // noop. Anything else is a problem.
        Q_ASSERT(m_state.hasInternalSideEffects() || changedIndex != InvalidRegister);
    }
 
    if (changedIndex != InvalidRegister) {
        Q_ASSERT(m_logger->currentFunctionHasCompileError() || m_state.changedRegister().isValid());
        VirtualRegister &r = m_state.registers[changedIndex];
        r.content = m_state.changedRegister();
        r.canMove = false;
        r.affectedBySideEffects = m_state.isRename()
                && m_state.isRegisterAffectedBySideEffects(m_state.renameSourceRegisterIndex());
        m_state.clearChangedRegister();
    }
 
    m_state.resetSideEffects();
    m_state.setIsRename(false);
    m_state.setReadRegisters(VirtualRegisters());
    m_state.instructionHasError = false;
}
 
QQmlJSRegisterContent QQmlJSTypePropagator::propagateBinaryOperation(QSOperator::Op op, int lhs)
{
    auto lhsRegister = checkedInputRegister(lhs);
    if (!lhsRegister.isValid())
        return QQmlJSRegisterContent();
 
    const QQmlJSRegisterContent type = m_typeResolver->typeForBinaryOperation(
                op, lhsRegister, m_state.accumulatorIn());
 
    setAccumulator(type);
    return type;
}
 
static bool deepCompare(const QQmlJSRegisterContent &a, const QQmlJSRegisterContent &b)
{
    if (!a.isValid() && !b.isValid())
        return true;
 
    return a.containedType() == b.containedType()
            && a.variant() == b.variant()
            && deepCompare(a.scope(), b.scope());
}
 
void QQmlJSTypePropagator::saveRegisterStateForJump(int offset)
{
    auto jumpToOffset = offset + nextInstructionOffset();
    ExpectedRegisterState state;
    state.registers = m_state.registers;
    state.originatingOffset = currentInstructionOffset();
    m_state.jumpTargets.insert(jumpToOffset);
    if (offset < 0) {
        // We're jumping backwards. We won't get to merge the register states in this pass anymore.
 
        const auto registerStates =
                m_jumpOriginRegisterStateByTargetInstructionOffset.equal_range(jumpToOffset);
        for (auto it = registerStates.first; it != registerStates.second; ++it) {
            if (it->registers.keys() != state.registers.keys())
                continue;
 
            const auto valuesIt = it->registers.values();
            const auto valuesState = state.registers.values();
 
            bool different = false;
            for (qsizetype i = 0, end = valuesIt.size(); i != end; ++i) {
                const auto &valueIt = valuesIt[i];
                const auto &valueState = valuesState[i];
                if (valueIt.affectedBySideEffects != valueState.affectedBySideEffects
                        || valueIt.canMove != valueState.canMove
                        || valueIt.isShadowable != valueState.isShadowable
                        || !deepCompare(valueIt.content, valueState.content)) {
                    different = true;
                    break;
                }
            }
 
            if (!different)
                return; // We've seen the same register state before. No need for merging.
        }
 
        // The register state at the target offset needs to be resolved in a further pass.
        m_state.needsMorePasses = true;
    }
    m_jumpOriginRegisterStateByTargetInstructionOffset.insert(jumpToOffset, state);
}
 
QString QQmlJSTypePropagator::registerName(int registerIndex) const
{
    switch (registerIndex) {
    case InvalidRegister:
        return u"invalid"_s;
    case CurrentFunction:
        return u"function"_s;
    case Context:
        return u"context"_s;
    case Accumulator:
        return u"accumulator"_s;
    case This:
        return u"this"_s;
    case Argc:
        return u"argc"_s;
    case NewTarget:
        return u"newTarget"_s;
    default:
        break;
    }
 
    if (isArgument(registerIndex))
        return u"argument %1"_s.arg(registerIndex - FirstArgument);
 
    return u"temporary register %1"_s.arg(
            registerIndex - FirstArgument - m_function->argumentTypes.size());
}
 
QQmlJSRegisterContent QQmlJSTypePropagator::checkedInputRegister(int reg)
{
    const auto regIt = m_state.registers.find(reg);
    if (regIt != m_state.registers.end())
        return regIt.value().content;
 
    switch (reg) {
    case CurrentFunction:
        return m_typeResolver->syntheticType(m_typeResolver->functionType());
    case Context:
        return m_typeResolver->syntheticType(m_typeResolver->jsValueType());
    case Accumulator:
        addError(u"Type error: no value found in accumulator"_s);
        return {};
    case This:
        return m_function->qmlScope;
    case Argc:
        return m_typeResolver->syntheticType(m_typeResolver->int32Type());
    case NewTarget:
        // over-approximation: needed in qmllint to not crash on `eval()`-calls
        return m_typeResolver->syntheticType(m_typeResolver->varType());
    default:
        break;
    }
 
    if (isArgument(reg))
        return argumentType(reg);
 
    addError(u"Type error: could not infer the type of an expression"_s);
    return {};
}
 
bool QQmlJSTypePropagator::canConvertFromTo(
        QQmlJSRegisterContent from, QQmlJSRegisterContent to)
{
    return m_typeResolver->canConvertFromTo(from, to);
}
 
bool QQmlJSTypePropagator::canConvertFromTo(
        QQmlJSRegisterContent from, const QQmlJSScope::ConstPtr &to)
{
    return m_typeResolver->canConvertFromTo(from.containedType(), to);
}
 
QT_END_NAMESPACE