Revert of [turbofan] Optimize loads from the global object in JSTypeFeedbackSpecializer.

src/compiler/js-type-feedback.cc

 // Copyright 2015 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/compiler/js-type-feedback.h"
 
 #include "src/property-details.h"
 
 #include "src/accessors.h"
 #include "src/ast.h"
-#include "src/compiler.h"
 #include "src/type-info.h"
 
 #include "src/compiler/access-builder.h"
 #include "src/compiler/common-operator.h"
 #include "src/compiler/node-aux-data.h"
 #include "src/compiler/node-matchers.h"
 #include "src/compiler/operator-properties.h"
 #include "src/compiler/simplified-operator.h"
 
 namespace v8 {
@@ skipping 50 matching lines @@
       }
       return ReduceJSStoreProperty(node);
     }
     default:
       break;
   }
   return NoChange();
 }
 
 
-static void AddFieldAccessTypes(FieldAccess* access,
-                                PropertyDetails property_details) {
-  if (property_details.representation().IsSmi()) {
-    access->type = Type::SignedSmall();
-    access->machine_type = static_cast<MachineType>(kTypeInt32 | kRepTagged);
-  } else if (property_details.representation().IsDouble()) {
-    access->type = Type::Number();
-    access->machine_type = kMachFloat64;
-  }
-}
-
-
 static bool GetInObjectFieldAccess(LoadOrStore mode, Handle<Map> map,
                                    Handle<Name> name, FieldAccess* access) {
   access->base_is_tagged = kTaggedBase;
   access->offset = -1;
   access->name = name;
   access->type = Type::Any();
   access->machine_type = kMachAnyTagged;
 
   // Check for properties that have accessors but are JSObject fields.
   if (Accessors::IsJSObjectFieldAccessor(map, name, &access->offset)) {
@@ skipping 11 matching lines @@
   PropertyDetails property_details = descriptors->GetDetails(number);
 
   bool is_smi = property_details.representation().IsSmi();
   bool is_double = property_details.representation().IsDouble();
 
   if (property_details.type() != DATA) {
     // TODO(turbofan): constant loads and stores.
     return false;
   }
 
-  // Transfer known types from property details.
-  AddFieldAccessTypes(access, property_details);
-
   if (mode == STORE) {
-    if (property_details.IsReadOnly()) {
-      // TODO(turbofan): deopt, ignore or throw on readonly stores.
+    if (property_details.IsReadOnly()) return false;
+    if (is_smi) {
+      // TODO(turbofan): SMI stores.
       return false;
     }
-    if (is_smi || is_double) {
-      // TODO(turbofan): check type and deopt for SMI/double stores.
+    if (is_double) {
+      // TODO(turbofan): double stores.
       return false;
     }
+  } else {
+    // Check property details for loads.
+    if (is_smi) {
+      access->type = Type::SignedSmall();
+      access->machine_type = static_cast<MachineType>(kTypeInt32 | kRepTagged);
+    }
+    if (is_double) {
+      access->type = Type::Number();
+      access->machine_type = kMachFloat64;
+    }
   }
 
   int index = map->instance_descriptors()->GetFieldIndex(number);
   FieldIndex field_index = FieldIndex::ForPropertyIndex(*map, index, is_double);
 
   if (field_index.is_inobject()) {
     access->offset = field_index.offset();
     return true;
   }
 
   // TODO(turbofan): handle out of object properties.
   return false;
 }
 
 
-static bool IsGlobalObject(Node* node) {
-  return NodeProperties::IsTyped(node) &&
-         NodeProperties::GetBounds(node).upper->Is(Type::GlobalObject());
-}
-
-
 Reduction JSTypeFeedbackSpecializer::ReduceJSLoadNamed(Node* node) {
   DCHECK(node->opcode() == IrOpcode::kJSLoadNamed);
-  Node* receiver = node->InputAt(0);
-  if (IsGlobalObject(receiver)) {
-    return ReduceJSLoadNamedForGlobalVariable(node);
-  }
-
-  if (!FLAG_turbo_deoptimization) return NoChange();
   // TODO(titzer): deopt locations are wrong for property accesses
   if (!EAGER_DEOPT_LOCATIONS_FOR_PROPERTY_ACCESS_ARE_CORRECT) return NoChange();
 
   // TODO(turbofan): handle vector-based type feedback.
   TypeFeedbackId id = js_type_feedback_->find(node);
   if (id.IsNone() || oracle()->LoadInlineCacheState(id) == UNINITIALIZED) {
     return NoChange();
   }
 
   const LoadNamedParameters& p = LoadNamedParametersOf(node->op());
   SmallMapList maps;
   Handle<Name> name = p.name().handle();
+  Node* receiver = node->InputAt(0);
   Node* effect = NodeProperties::GetEffectInput(node);
   GatherReceiverTypes(receiver, effect, id, name, &maps);
 
   if (maps.length() != 1) return NoChange();  // TODO(turbofan): polymorphism
 
   Handle<Map> map = maps.first();
   FieldAccess field_access;
   if (!GetInObjectFieldAccess(LOAD, map, name, &field_access)) {
     return NoChange();
   }
@@ skipping 12 matching lines @@
   // TODO(titzer): frame state should be from before the load.
   Node* frame_state = NodeProperties::GetFrameStateInput(node, 0);
   Node* deopt = graph()->NewNode(common()->Deoptimize(), frame_state, effect,
                                  check_failed);
   NodeProperties::MergeControlToEnd(graph(), common(), deopt);
   NodeProperties::ReplaceWithValue(node, load, load, check_success);
   return Replace(load);
 }
 
 
-Reduction JSTypeFeedbackSpecializer::ReduceJSLoadNamedForGlobalVariable(
-    Node* node) {
-  Handle<String> name =
-      Handle<String>::cast(LoadNamedParametersOf(node->op()).name().handle());
-  // Try to optimize loads from the global object.
-  Handle<Object> constant_value =
-      jsgraph()->isolate()->factory()->GlobalConstantFor(name);
-  if (!constant_value.is_null()) {
-    // Always optimize global constants.
-    Node* constant = jsgraph()->Constant(constant_value);
-    NodeProperties::ReplaceWithValue(node, constant);
-    return Replace(constant);
-  }
-
-  if (global_object_.is_null()) {
-    // Nothing else can be done if we don't have a global object.
-    return NoChange();
-  }
-
-  if (FLAG_turbo_deoptimization) {
-    // Handle lookups in the script context.
-    {
-      Handle<ScriptContextTable> script_contexts(
-          global_object_->native_context()->script_context_table());
-      ScriptContextTable::LookupResult lookup;
-      if (ScriptContextTable::Lookup(script_contexts, name, &lookup)) {
-        // TODO(turbofan): introduce a LoadContext here.
-        return NoChange();
-      }
-    }
-
-    // Constant promotion or cell access requires lazy deoptimization support.
-    LookupIterator it(global_object_, name, LookupIterator::OWN);
-
-    if (it.state() == LookupIterator::DATA) {
-      Handle<PropertyCell> cell = it.GetPropertyCell();
-      dependencies_->AssumePropertyCell(cell);
-
-      if (it.property_details().cell_type() == PropertyCellType::kConstant) {
-        // Constant promote the global's current value.
-        Handle<Object> constant_value(cell->value(), jsgraph()->isolate());
-        if (constant_value->IsConsString()) {
-          constant_value =
-              String::Flatten(Handle<String>::cast(constant_value));
-        }
-        Node* constant = jsgraph()->Constant(constant_value);
-        NodeProperties::ReplaceWithValue(node, constant);
-        return Replace(constant);
-      } else {
-        // Load directly from the property cell.
-        FieldAccess access = AccessBuilder::ForPropertyCellValue();
-        Node* control = NodeProperties::GetControlInput(node);
-        Node* load_field = graph()->NewNode(
-            simplified()->LoadField(access), jsgraph()->Constant(cell),
-            NodeProperties::GetEffectInput(node), control);
-        NodeProperties::ReplaceWithValue(node, load_field, load_field, control);
-        return Replace(load_field);
-      }
-    }
-  } else {
-    // TODO(turbofan): non-configurable properties on the global object
-    // should be loadable through a cell without deoptimization support.
-  }
-
-  return NoChange();
-}
-
-
 Reduction JSTypeFeedbackSpecializer::ReduceJSLoadProperty(Node* node) {
   return NoChange();
 }
 
 
 Reduction JSTypeFeedbackSpecializer::ReduceJSStoreNamed(Node* node) {
   DCHECK(node->opcode() == IrOpcode::kJSStoreNamed);
   // TODO(titzer): deopt locations are wrong for property accesses
   if (!EAGER_DEOPT_LOCATIONS_FOR_PROPERTY_ACCESS_ARE_CORRECT) return NoChange();
 
@@ skipping 80 matching lines @@
   // TODO(turbofan): filter maps by initial receiver map if known
   // TODO(turbofan): filter maps by native context (if specializing)
   // TODO(turbofan): filter maps by effect chain
   oracle()->PropertyReceiverTypes(id, name, maps);
 }
 
 
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8