Use type information to eliminate unnecessary bitwise-and operations.

src/compiler/js-typed-lowering.cc

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/compiler/access-builder.h"
 #include "src/compiler/js-graph.h"
 #include "src/compiler/js-typed-lowering.h"
 #include "src/compiler/node-matchers.h"
 #include "src/compiler/node-properties.h"
 #include "src/compiler/operator-properties.h"
@@ skipping 352 matching lines @@
   JSBinopReduction r(this, node);
   Node* frame_state = FLAG_turbo_deoptimization
                           ? NodeProperties::GetFrameStateInput(node, 1)
                           : nullptr;
   r.ConvertInputsToNumber(frame_state);
   r.ConvertInputsToUI32(kSigned, kSigned);
   return r.ChangeToPureOperator(intOp, Type::Integral32());
 }
 
 
+Reduction JSTypedLowering::ReduceBitwiseAnd(Node* node) {

[titzer, 2015/04/20 12:20:39]

I think you want to move this optimization to machine-operator-reducer. That
will make it more general and also avoid the problem you see below. 

JSTypedLowering has accumulated a lot of optimizations, but its primary role is
to replace JS nodes with simplified or machine operators, whereas
machine-operator-reducer has exactly one job, which is to optimize machine-level
operations.

+  JSBinopReduction r(this, node);
+  Node* lhs = NodeProperties::GetValueInput(node, 0);
+  Node* rhs = NodeProperties::GetValueInput(node, 1);
+  Type* lhs_type = NodeProperties::GetBounds(lhs).upper;
+  Type* rhs_type = NodeProperties::GetBounds(rhs).upper;
+  // Check if the bitwise-and operation can be eliminated - if either input is a
+  // constant power of two minus one and the other input is no greater.
+  // HELP - can it be assumed that a constant argument is always on the rhs, and
+  // thus this first case is unnecessary?
+  if (lhs_type->Min() == lhs_type->Max() &&
+      lhs_type->Max() > 0 && lhs_type->Max() <= kMaxInt) {
+    uint32_t value = lhs_type->Max();
+    if ((value & (value + 1)) == 0) {
+      if (rhs_type->Min() >= 0 && rhs_type->Max() <= value) {
+        // HELP - would like to just return the rhs, but Replace(rhs) causes
+        // errors?  Replace the input with -1 which can be optimized away later.
+        node->ReplaceInput(0, jsgraph()->Int32Constant(-1));
+      }
+    }
+  }
+  if (rhs_type->Min() == rhs_type->Max() &&
+      rhs_type->Max() > 0 && rhs_type->Max() <= kMaxInt) {
+    uint32_t value = rhs_type->Max();
+    if ((value & (value + 1)) == 0) {
+      if (lhs_type->Min() >= 0 && lhs_type->Max() <= value) {

[titzer, 2015/04/20 12:20:40]

Yep, the problem is that JS operators have value and effect edges that aren't
handled correctly by this lowering, thus the validation problems.

+        // HELP - would like to just return the rhs, but Replace(rhs) causes
+        // errors?  Replace the input with -1 which can be optimized away later.
+        node->ReplaceInput(1, jsgraph()->Int32Constant(-1));
+      }
+    }
+  }
+
+  Node* frame_state = FLAG_turbo_deoptimization
+                          ? NodeProperties::GetFrameStateInput(node, 1)
+                          : nullptr;
+  r.ConvertInputsToNumber(frame_state);
+  r.ConvertInputsToUI32(kSigned, kSigned);
+  return r.ChangeToPureOperator(machine()->Word32And(), Type::Integral32());
+}
+
+
 Reduction JSTypedLowering::ReduceUI32Shift(Node* node,
                                            Signedness left_signedness,
                                            const Operator* shift_op) {
   JSBinopReduction r(this, node);
   if (r.BothInputsAre(Type::Primitive())) {
     r.ConvertInputsForShift(left_signedness);
     return r.ChangeToPureOperator(shift_op, Type::Integral32());
   }
   return NoChange();
 }
@@ skipping 598 matching lines @@
     case IrOpcode::kJSLessThan:         // fall through
     case IrOpcode::kJSGreaterThan:      // fall through
     case IrOpcode::kJSLessThanOrEqual:  // fall through
     case IrOpcode::kJSGreaterThanOrEqual:
       return ReduceJSComparison(node);
     case IrOpcode::kJSBitwiseOr:
       return ReduceInt32Binop(node, machine()->Word32Or());
     case IrOpcode::kJSBitwiseXor:
       return ReduceInt32Binop(node, machine()->Word32Xor());
     case IrOpcode::kJSBitwiseAnd:
-      return ReduceInt32Binop(node, machine()->Word32And());
+      return ReduceBitwiseAnd(node);
     case IrOpcode::kJSShiftLeft:
       return ReduceUI32Shift(node, kSigned, machine()->Word32Shl());
     case IrOpcode::kJSShiftRight:
       return ReduceUI32Shift(node, kSigned, machine()->Word32Sar());
     case IrOpcode::kJSShiftRightLogical:
       return ReduceUI32Shift(node, kUnsigned, machine()->Word32Shr());
     case IrOpcode::kJSAdd:
       return ReduceJSAdd(node);
     case IrOpcode::kJSSubtract:
       return ReduceNumberBinop(node, simplified()->NumberSubtract());
@@ skipping 94 matching lines @@
 }
 
 
 MachineOperatorBuilder* JSTypedLowering::machine() const {
   return jsgraph()->machine();
 }
 
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8