Use type information to eliminate unnecessary bitwise-and operations.

src/compiler/js-typed-lowering.cc

Index: src/compiler/js-typed-lowering.cc
diff --git a/src/compiler/js-typed-lowering.cc b/src/compiler/js-typed-lowering.cc
index 1c7a8dce22ca6702c64f71831bb4743499c2d351..90ed136eb407a49fa9c549d2d87586febec9f904 100644
--- a/src/compiler/js-typed-lowering.cc
+++ b/src/compiler/js-typed-lowering.cc
@@ -370,6 +370,48 @@ Reduction JSTypedLowering::ReduceInt32Binop(Node* node, const Operator* intOp) {
 }
 
 
+Reduction JSTypedLowering::ReduceBitwiseAnd(Node* node) {

[titzer, 2015/04/20 12:20:39]

I think you want to move this optimization to machine-operator-reducer. That
will make it more general and also avoid the problem you see below. 

JSTypedLowering has accumulated a lot of optimizations, but its primary role is
to replace JS nodes with simplified or machine operators, whereas
machine-operator-reducer has exactly one job, which is to optimize machine-level
operations.

+  JSBinopReduction r(this, node);
+  Node* lhs = NodeProperties::GetValueInput(node, 0);
+  Node* rhs = NodeProperties::GetValueInput(node, 1);
+  Type* lhs_type = NodeProperties::GetBounds(lhs).upper;
+  Type* rhs_type = NodeProperties::GetBounds(rhs).upper;
+  // Check if the bitwise-and operation can be eliminated - if either input is a
+  // constant power of two minus one and the other input is no greater.
+  // HELP - can it be assumed that a constant argument is always on the rhs, and
+  // thus this first case is unnecessary?
+  if (lhs_type->Min() == lhs_type->Max() &&
+      lhs_type->Max() > 0 && lhs_type->Max() <= kMaxInt) {
+    uint32_t value = lhs_type->Max();
+    if ((value & (value + 1)) == 0) {
+      if (rhs_type->Min() >= 0 && rhs_type->Max() <= value) {
+        // HELP - would like to just return the rhs, but Replace(rhs) causes
+        // errors?  Replace the input with -1 which can be optimized away later.
+        node->ReplaceInput(0, jsgraph()->Int32Constant(-1));
+      }
+    }
+  }
+  if (rhs_type->Min() == rhs_type->Max() &&
+      rhs_type->Max() > 0 && rhs_type->Max() <= kMaxInt) {
+    uint32_t value = rhs_type->Max();
+    if ((value & (value + 1)) == 0) {
+      if (lhs_type->Min() >= 0 && lhs_type->Max() <= value) {

[titzer, 2015/04/20 12:20:40]

Yep, the problem is that JS operators have value and effect edges that aren't
handled correctly by this lowering, thus the validation problems.

+        // HELP - would like to just return the rhs, but Replace(rhs) causes
+        // errors?  Replace the input with -1 which can be optimized away later.
+        node->ReplaceInput(1, jsgraph()->Int32Constant(-1));
+      }
+    }
+  }
+
+  Node* frame_state = FLAG_turbo_deoptimization
+                          ? NodeProperties::GetFrameStateInput(node, 1)
+                          : nullptr;
+  r.ConvertInputsToNumber(frame_state);
+  r.ConvertInputsToUI32(kSigned, kSigned);
+  return r.ChangeToPureOperator(machine()->Word32And(), Type::Integral32());
+}
+
+
 Reduction JSTypedLowering::ReduceUI32Shift(Node* node,
                                            Signedness left_signedness,
                                            const Operator* shift_op) {
@@ -988,7 +1030,7 @@ Reduction JSTypedLowering::Reduce(Node* node) {
     case IrOpcode::kJSBitwiseXor:
       return ReduceInt32Binop(node, machine()->Word32Xor());
     case IrOpcode::kJSBitwiseAnd:
-      return ReduceInt32Binop(node, machine()->Word32And());
+      return ReduceBitwiseAnd(node);
     case IrOpcode::kJSShiftLeft:
       return ReduceUI32Shift(node, kSigned, machine()->Word32Shl());
     case IrOpcode::kJSShiftRight: