[turbofan]: Integrate basic type feedback for property accesses.

src/compiler/ast-graph-builder.cc

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/compiler/ast-graph-builder.h"
 
 #include "src/compiler.h"
 #include "src/compiler/ast-loop-assignment-analyzer.h"
 #include "src/compiler/control-builders.h"
+#include "src/compiler/js-type-feedback.h"
 #include "src/compiler/linkage.h"
 #include "src/compiler/liveness-analyzer.h"
 #include "src/compiler/machine-operator.h"
 #include "src/compiler/node-matchers.h"
 #include "src/compiler/node-properties.h"
 #include "src/compiler/operator-properties.h"
 #include "src/compiler/state-values-utils.h"
 #include "src/full-codegen.h"
 #include "src/parser.h"
 #include "src/scopes.h"
@@ skipping 354 matching lines @@
     return true;
   }
 
  private:
   DeferredCommands* commands_;
   TryFinallyBuilder* control_;
 };
 
 
 AstGraphBuilder::AstGraphBuilder(Zone* local_zone, CompilationInfo* info,
-                                 JSGraph* jsgraph, LoopAssignmentAnalysis* loop)
+                                 JSGraph* jsgraph, LoopAssignmentAnalysis* loop,
+                                 JSTypeFeedbackTable* js_type_feedback)
     : local_zone_(local_zone),
       info_(info),
       jsgraph_(jsgraph),
       environment_(nullptr),
       ast_context_(nullptr),
       globals_(0, local_zone),
       execution_control_(nullptr),
       execution_context_(nullptr),
       try_nesting_level_(0),
       input_buffer_size_(0),
       input_buffer_(nullptr),
       exit_control_(nullptr),
       loop_assignment_analysis_(loop),
       state_values_cache_(jsgraph),
       liveness_analyzer_(static_cast<size_t>(info->scope()->num_stack_slots()),
-                         local_zone) {
+                         local_zone),
+      js_type_feedback_(js_type_feedback) {
   InitializeAstVisitor(info->isolate(), local_zone);
 }
 
 
 Node* AstGraphBuilder::GetFunctionClosure() {
   if (!function_closure_.is_set()) {
     const Operator* op =
         common()->Parameter(Linkage::kJSFunctionCallClosureParamIndex);
     Node* node = NewNode(op, graph()->start());
     function_closure_.set(node);
@@ skipping 1240 matching lines @@
         DCHECK(!CompileTimeValue::IsCompileTimeValue(property->value()));
       // Fall through.
       case ObjectLiteral::Property::COMPUTED: {
         // It is safe to use [[Put]] here because the boilerplate already
         // contains computed properties with an uninitialized value.
         if (key->value()->IsInternalizedString()) {
           if (property->emit_store()) {
             VisitForValue(property->value());
             Node* value = environment()->Pop();
             Handle<Name> name = key->AsPropertyName();
-            Node* store = BuildNamedStore(literal, name, value);
+            Node* store =
+                BuildNamedStore(literal, name, value, TypeFeedbackId::None());
             PrepareFrameState(store, key->id());
             BuildSetHomeObject(value, literal, property->value());
           } else {
             VisitForEffect(property->value());
           }
           break;
         }
         environment()->Push(literal);  // Duplicate receiver.
         VisitForValue(property->key());
         VisitForValue(property->value());
@@ skipping 154 matching lines @@
   // them into the newly cloned array.
   for (int i = 0; i < expr->values()->length(); i++) {
     Expression* subexpr = expr->values()->at(i);
     if (CompileTimeValue::IsCompileTimeValue(subexpr)) continue;
 
     VisitForValue(subexpr);
     Node* frame_state_before = environment()->Checkpoint(
         subexpr->id(), OutputFrameStateCombine::PokeAt(0));
     Node* value = environment()->Pop();
     Node* index = jsgraph()->Constant(i);
-    Node* store = BuildKeyedStore(literal, index, value);
+    Node* store =
+        BuildKeyedStore(literal, index, value, TypeFeedbackId::None());
     PrepareFrameStateAfterAndBefore(store, expr->GetIdForElement(i),
                                     OutputFrameStateCombine::Ignore(),
                                     frame_state_before);
   }
 
   environment()->Pop();  // Array literal index.
   ast_context()->ProduceValue(environment()->Pop());
 }
 
 
@@ skipping 11 matching lines @@
       Variable* var = expr->AsVariableProxy()->var();
       BuildVariableAssignment(var, value, Token::ASSIGN, bailout_id);
       break;
     }
     case NAMED_PROPERTY: {
       environment()->Push(value);
       VisitForValue(property->obj());
       Node* object = environment()->Pop();
       value = environment()->Pop();
       Handle<Name> name = property->key()->AsLiteral()->AsPropertyName();
-      Node* store = BuildNamedStore(object, name, value);
+      Node* store =
+          BuildNamedStore(object, name, value, TypeFeedbackId::None());
       PrepareFrameState(store, bailout_id);
       break;
     }
     case KEYED_PROPERTY: {
       environment()->Push(value);
       VisitForValue(property->obj());
       VisitForValue(property->key());
       Node* key = environment()->Pop();
       Node* object = environment()->Pop();
       value = environment()->Pop();
-      Node* store = BuildKeyedStore(object, key, value);
+      Node* store = BuildKeyedStore(object, key, value, TypeFeedbackId::None());
       // TODO(jarin) Provide a real frame state before.
       PrepareFrameStateAfterAndBefore(store, bailout_id,
                                       OutputFrameStateCombine::Ignore(),
                                       jsgraph()->EmptyFrameState());
       break;
     }
   }
 }
 
 
@@ skipping 31 matching lines @@
         VectorSlotPair pair =
             CreateVectorSlotPair(proxy->VariableFeedbackSlot());
         old_value = BuildVariableLoad(proxy->var(), expr->target()->id(), pair);
         break;
       }
       case NAMED_PROPERTY: {
         Node* object = environment()->Top();
         Handle<Name> name = property->key()->AsLiteral()->AsPropertyName();
         VectorSlotPair pair =
             CreateVectorSlotPair(property->PropertyFeedbackSlot());
-        old_value = BuildNamedLoad(object, name, pair);
+        old_value =
+            BuildNamedLoad(object, name, pair, expr->AssignmentFeedbackId());

[Michael Starzinger, 2015/03/24 09:06:40]

Shouldn't the property loads in the assignment use
property->PropertyFeedbackId() here?

[titzer, 2015/03/24 10:49:31]

I cribbed from typing.cc which adds the type feedback to the AST for Crankshaft,
and it uses the AssignmentFeedbackId.

[Michael Starzinger, 2015/03/24 12:11:18]

As discussed offline: In typing.cc the AstTyper::VisitAssignment recurses on
expr->target, which in turn will go into AstTyper::VisitProperty where
expr->target()->PropertyFeedbackId() is used.

[titzer, 2015/03/24 14:52:06]

Done.

         PrepareFrameState(old_value, property->LoadId(),
                           OutputFrameStateCombine::Push());
         break;
       }
       case KEYED_PROPERTY: {
         Node* key = environment()->Top();
         Node* object = environment()->Peek(1);
         VectorSlotPair pair =
             CreateVectorSlotPair(property->PropertyFeedbackSlot());
-        old_value = BuildKeyedLoad(object, key, pair);
+        old_value =
+            BuildKeyedLoad(object, key, pair, expr->AssignmentFeedbackId());

[Michael Starzinger, 2015/03/24 09:06:40]

Likewise.

[titzer, 2015/03/24 10:49:31]

Same as above.

[Michael Starzinger, 2015/03/24 12:11:17]

Likewise.

[titzer, 2015/03/24 14:52:06]

Done.

         PrepareFrameState(old_value, property->LoadId(),
                           OutputFrameStateCombine::Push());
         break;
       }
     }
     environment()->Push(old_value);
     VisitForValue(expr->value());
     Node* frame_state_before = environment()->Checkpoint(expr->value()->id());
     Node* right = environment()->Pop();
     Node* left = environment()->Pop();
@@ skipping 24 matching lines @@
   switch (assign_type) {
     case VARIABLE: {
       Variable* variable = expr->target()->AsVariableProxy()->var();
       BuildVariableAssignment(variable, value, expr->op(), expr->id(),
                               ast_context()->GetStateCombine());
       break;
     }
     case NAMED_PROPERTY: {
       Node* object = environment()->Pop();
       Handle<Name> name = property->key()->AsLiteral()->AsPropertyName();
-      Node* store = BuildNamedStore(object, name, value);
+      Node* store =
+          BuildNamedStore(object, name, value, expr->AssignmentFeedbackId());
       PrepareFrameState(store, expr->id(), ast_context()->GetStateCombine());
       break;
     }
     case KEYED_PROPERTY: {
       Node* key = environment()->Pop();
       Node* object = environment()->Pop();
-      Node* store = BuildKeyedStore(object, key, value);
+      Node* store =
+          BuildKeyedStore(object, key, value, expr->AssignmentFeedbackId());
       PrepareFrameStateAfterAndBefore(store, expr->id(),
                                       ast_context()->GetStateCombine(),
                                       frame_state_before_store);
       break;
     }
   }
 
   ast_context()->ProduceValue(value);
 }
 
@@ skipping 13 matching lines @@
 }
 
 
 void AstGraphBuilder::VisitProperty(Property* expr) {
   Node* value;
   VectorSlotPair pair = CreateVectorSlotPair(expr->PropertyFeedbackSlot());
   if (expr->key()->IsPropertyName()) {
     VisitForValue(expr->obj());
     Node* object = environment()->Pop();
     Handle<Name> name = expr->key()->AsLiteral()->AsPropertyName();
-    value = BuildNamedLoad(object, name, pair);
+    value = BuildNamedLoad(object, name, pair, expr->PropertyFeedbackId());
   } else {
     VisitForValue(expr->obj());
     VisitForValue(expr->key());
     Node* key = environment()->Pop();
     Node* object = environment()->Pop();
-    value = BuildKeyedLoad(object, key, pair);
+    value = BuildKeyedLoad(object, key, pair, expr->PropertyFeedbackId());
   }
   PrepareFrameState(value, expr->id(), ast_context()->GetStateCombine());
   ast_context()->ProduceValue(value);
 }
 
 
 void AstGraphBuilder::VisitCall(Call* expr) {
   Expression* callee = expr->expression();
   Call::CallType call_type = expr->GetCallType(isolate());
 
@@ skipping 27 matching lines @@
       break;
     }
     case Call::PROPERTY_CALL: {
       Property* property = callee->AsProperty();
       VisitForValue(property->obj());
       Node* object = environment()->Top();
       VectorSlotPair pair =
           CreateVectorSlotPair(property->PropertyFeedbackSlot());
       if (property->key()->IsPropertyName()) {
         Handle<Name> name = property->key()->AsLiteral()->AsPropertyName();
-        callee_value = BuildNamedLoad(object, name, pair);
+        callee_value =
+            BuildNamedLoad(object, name, pair, property->PropertyFeedbackId());
       } else {
         VisitForValue(property->key());
         Node* key = environment()->Pop();
-        callee_value = BuildKeyedLoad(object, key, pair);
+        callee_value =
+            BuildKeyedLoad(object, key, pair, property->PropertyFeedbackId());
       }
       PrepareFrameState(callee_value, property->LoadId(),
                         OutputFrameStateCombine::Push());
       receiver_value = environment()->Pop();
       // Note that a PROPERTY_CALL requires the receiver to be wrapped into an
       // object for sloppy callees. This could also be modeled explicitly here,
       // thereby obsoleting the need for a flag to the call operator.
       flags = CALL_AS_METHOD;
       break;
     }
@@ skipping 75 matching lines @@
 
 
 void AstGraphBuilder::VisitCallJSRuntime(CallRuntime* expr) {
   Handle<String> name = expr->name();
 
   // The callee and the receiver both have to be pushed onto the operand stack
   // before arguments are being evaluated.
   CallFunctionFlags flags = NO_CALL_FUNCTION_FLAGS;
   Node* receiver_value = BuildLoadBuiltinsObject();
   VectorSlotPair pair = CreateVectorSlotPair(expr->CallRuntimeFeedbackSlot());
-  Node* callee_value = BuildNamedLoad(receiver_value, name, pair);
+  Node* callee_value =
+      BuildNamedLoad(receiver_value, name, pair, expr->CallRuntimeFeedbackId());
   // TODO(jarin): Find/create a bailout id to deoptimize to (crankshaft
   // refuses to optimize functions with jsruntime calls).
   PrepareFrameState(callee_value, BailoutId::None(),
                     OutputFrameStateCombine::Push());
   environment()->Push(callee_value);
   environment()->Push(receiver_value);
 
   // Evaluate all arguments to the JS runtime call.
   ZoneList<Expression*>* args = expr->arguments();
   VisitForValues(args);
@@ skipping 67 matching lines @@
           BuildVariableLoad(proxy->var(), expr->expression()->id(), pair);
       stack_depth = 0;
       break;
     }
     case NAMED_PROPERTY: {
       VisitForValue(property->obj());
       Node* object = environment()->Top();
       Handle<Name> name = property->key()->AsLiteral()->AsPropertyName();
       VectorSlotPair pair =
           CreateVectorSlotPair(property->PropertyFeedbackSlot());
-      old_value = BuildNamedLoad(object, name, pair);
+      old_value =
+          BuildNamedLoad(object, name, pair, property->PropertyFeedbackId());
       PrepareFrameState(old_value, property->LoadId(),
                         OutputFrameStateCombine::Push());
       stack_depth = 1;
       break;
     }
     case KEYED_PROPERTY: {
       VisitForValue(property->obj());
       VisitForValue(property->key());
       Node* key = environment()->Top();
       Node* object = environment()->Peek(1);
       VectorSlotPair pair =
           CreateVectorSlotPair(property->PropertyFeedbackSlot());
-      old_value = BuildKeyedLoad(object, key, pair);
+      old_value =
+          BuildKeyedLoad(object, key, pair, property->PropertyFeedbackId());
       PrepareFrameState(old_value, property->LoadId(),
                         OutputFrameStateCombine::Push());
       stack_depth = 2;
       break;
     }
   }
 
   // Convert old value into a number.
   old_value = NewNode(javascript()->ToNumber(), old_value);
   PrepareFrameState(old_value, expr->ToNumberId(),
@@ skipping 22 matching lines @@
       Variable* variable = expr->expression()->AsVariableProxy()->var();
       environment()->Push(value);
       BuildVariableAssignment(variable, value, expr->op(),
                               expr->AssignmentId());
       environment()->Pop();
       break;
     }
     case NAMED_PROPERTY: {
       Node* object = environment()->Pop();
       Handle<Name> name = property->key()->AsLiteral()->AsPropertyName();
-      Node* store = BuildNamedStore(object, name, value);
+      Node* store =
+          BuildNamedStore(object, name, value, expr->CountStoreFeedbackId());
       environment()->Push(value);
       PrepareFrameState(store, expr->AssignmentId());
       environment()->Pop();
       break;
     }
     case KEYED_PROPERTY: {
       Node* key = environment()->Pop();
       Node* object = environment()->Pop();
-      Node* store = BuildKeyedStore(object, key, value);
+      Node* store =
+          BuildKeyedStore(object, key, value, expr->CountStoreFeedbackId());
       environment()->Push(value);
       PrepareFrameStateAfterAndBefore(store, expr->AssignmentId(),
                                       OutputFrameStateCombine::Ignore(),
                                       frame_state_before_store);
       environment()->Pop();
       break;
     }
   }
 
   // Restore old value for postfix expressions.
@@ skipping 388 matching lines @@
                                          BailoutId bailout_id,
                                          const VectorSlotPair& feedback,
                                          ContextualMode contextual_mode) {
   Node* the_hole = jsgraph()->TheHoleConstant();
   VariableMode mode = variable->mode();
   switch (variable->location()) {
     case Variable::UNALLOCATED: {
       // Global var, const, or let variable.
       Node* global = BuildLoadGlobalObject();
       Handle<Name> name = variable->name();
-      Node* node = BuildNamedLoad(global, name, feedback, contextual_mode);
+      Node* node = BuildNamedLoad(global, name, feedback,
+                                  TypeFeedbackId::None(), contextual_mode);
       PrepareFrameState(node, bailout_id, OutputFrameStateCombine::Push());
       return node;
     }
     case Variable::PARAMETER:
     case Variable::LOCAL: {
       // Local var, const, or let variable.
       Node* value = environment()->Lookup(variable);
       if (mode == CONST_LEGACY) {
         // Perform check for uninitialized legacy const variables.
         if (value->op() == the_hole->op()) {
@@ skipping 86 matching lines @@
 Node* AstGraphBuilder::BuildVariableAssignment(
     Variable* variable, Node* value, Token::Value op, BailoutId bailout_id,
     OutputFrameStateCombine combine) {
   Node* the_hole = jsgraph()->TheHoleConstant();
   VariableMode mode = variable->mode();
   switch (variable->location()) {
     case Variable::UNALLOCATED: {
       // Global var, const, or let variable.
       Node* global = BuildLoadGlobalObject();
       Handle<Name> name = variable->name();
-      Node* store = BuildNamedStore(global, name, value);
+      Node* store =
+          BuildNamedStore(global, name, value, TypeFeedbackId::None());
       PrepareFrameState(store, bailout_id, combine);
       return store;
     }
     case Variable::PARAMETER:
     case Variable::LOCAL:
       // Local var, const, or let variable.
       if (mode == CONST_LEGACY && op == Token::INIT_CONST_LEGACY) {
         // Perform an initialization check for legacy const variables.
         Node* current = environment()->Lookup(variable);
         if (current->op() != the_hole->op()) {
@@ skipping 75 matching lines @@
       Node* store = NewNode(op, value, current_context(), name, language);
       PrepareFrameState(store, bailout_id, combine);
       return store;
     }
   }
   UNREACHABLE();
   return NULL;
 }
 
 
+static inline Node* Record(JSTypeFeedbackTable* js_type_feedback, Node* node,
+                           TypeFeedbackId id) {
+  if (js_type_feedback) js_type_feedback->Record(node, id);
+  return node;
+}
+
+
 Node* AstGraphBuilder::BuildKeyedLoad(Node* object, Node* key,
-                                      const VectorSlotPair& feedback) {
+                                      const VectorSlotPair& feedback,
+                                      TypeFeedbackId id) {
   const Operator* op = javascript()->LoadProperty(feedback);
-  return NewNode(op, object, key);
+  return Record(js_type_feedback_, NewNode(op, object, key), id);
 }
 
 
 Node* AstGraphBuilder::BuildNamedLoad(Node* object, Handle<Name> name,
                                       const VectorSlotPair& feedback,
-                                      ContextualMode mode) {
+                                      TypeFeedbackId id, ContextualMode mode) {
   const Operator* op =
       javascript()->LoadNamed(MakeUnique(name), feedback, mode);
-  return NewNode(op, object);
+  return Record(js_type_feedback_, NewNode(op, object), id);
 }
 
 
-Node* AstGraphBuilder::BuildKeyedStore(Node* object, Node* key, Node* value) {
+Node* AstGraphBuilder::BuildKeyedStore(Node* object, Node* key, Node* value,
+                                       TypeFeedbackId id) {
   const Operator* op = javascript()->StoreProperty(language_mode());
-  return NewNode(op, object, key, value);
+  return Record(js_type_feedback_, NewNode(op, object, key, value), id);
 }
 
 
 Node* AstGraphBuilder::BuildNamedStore(Node* object, Handle<Name> name,
-                                       Node* value) {
+                                       Node* value, TypeFeedbackId id) {
   const Operator* op =
       javascript()->StoreNamed(language_mode(), MakeUnique(name));
-  return NewNode(op, object, value);
+  return Record(js_type_feedback_, NewNode(op, object, value), id);
 }
 
 
 Node* AstGraphBuilder::BuildLoadObjectField(Node* object, int offset) {
   return NewNode(jsgraph()->machine()->Load(kMachAnyTagged), object,
                  jsgraph()->IntPtrConstant(offset - kHeapObjectTag));
 }
 
 
 Node* AstGraphBuilder::BuildLoadBuiltinsObject() {
@@ skipping 68 matching lines @@
   Node* name = NewNode(javascript()->ToName(), input);
   PrepareFrameState(name, bailout_id);
   return name;
 }
 
 
 Node* AstGraphBuilder::BuildSetHomeObject(Node* value, Node* home_object,
                                           Expression* expr) {
   if (!FunctionLiteral::NeedsHomeObject(expr)) return value;
   Handle<Name> name = isolate()->factory()->home_object_symbol();
-  Node* store = BuildNamedStore(value, name, home_object);
+  Node* store =
+      BuildNamedStore(value, name, home_object, TypeFeedbackId::None());
   PrepareFrameState(store, BailoutId::None());
   return store;
 }
 
 
 Node* AstGraphBuilder::BuildThrowError(Node* exception, BailoutId bailout_id) {
   const Operator* op = javascript()->CallRuntime(Runtime::kThrow, 1);
   Node* call = NewNode(op, exception);
   PrepareFrameState(call, bailout_id);
   return call;
@@ skipping 414 matching lines @@
     // Phi does not exist yet, introduce one.
     value = NewPhi(inputs, value, control);
     value->ReplaceInput(inputs - 1, other);
   }
   return value;
 }
 
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8