[turbofan] Reland: Optimize loads from the global object in JSTypeFeedbackSpecializer.

src/compiler/js-type-feedback.cc

 // Copyright 2015 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/compiler/js-type-feedback.h"
 
 #include "src/property-details.h"
 
 #include "src/accessors.h"
 #include "src/ast.h"
+#include "src/compiler.h"
 #include "src/type-info.h"
 
 #include "src/compiler/access-builder.h"
 #include "src/compiler/common-operator.h"
 #include "src/compiler/node-aux-data.h"
 #include "src/compiler/node-matchers.h"
 #include "src/compiler/operator-properties.h"
 #include "src/compiler/simplified-operator.h"
 
 namespace v8 {
@@ skipping 50 matching lines @@
       }
       return ReduceJSStoreProperty(node);
     }
     default:
       break;
   }
   return NoChange();
 }
 
 
+static void AddFieldAccessTypes(FieldAccess* access,
+                                PropertyDetails property_details) {
+  if (property_details.representation().IsSmi()) {
+    access->type = Type::SignedSmall();
+    access->machine_type = static_cast<MachineType>(kTypeInt32 | kRepTagged);
+  } else if (property_details.representation().IsDouble()) {
+    access->type = Type::Number();
+    access->machine_type = kMachFloat64;
+  }
+}
+
+
 static bool GetInObjectFieldAccess(LoadOrStore mode, Handle<Map> map,
                                    Handle<Name> name, FieldAccess* access) {
   access->base_is_tagged = kTaggedBase;
   access->offset = -1;
   access->name = name;
   access->type = Type::Any();
   access->machine_type = kMachAnyTagged;
 
   // Check for properties that have accessors but are JSObject fields.
   if (Accessors::IsJSObjectFieldAccessor(map, name, &access->offset)) {
@@ skipping 11 matching lines @@
   PropertyDetails property_details = descriptors->GetDetails(number);
 
   bool is_smi = property_details.representation().IsSmi();
   bool is_double = property_details.representation().IsDouble();
 
   if (property_details.type() != DATA) {
     // TODO(turbofan): constant loads and stores.
     return false;
   }
 
+  // Transfer known types from property details.
+  AddFieldAccessTypes(access, property_details);
+
   if (mode == STORE) {
-    if (property_details.IsReadOnly()) return false;
-    if (is_smi) {
-      // TODO(turbofan): SMI stores.
+    if (property_details.IsReadOnly()) {
+      // TODO(turbofan): deopt, ignore or throw on readonly stores.
       return false;
     }
-    if (is_double) {
-      // TODO(turbofan): double stores.
+    if (is_smi || is_double) {
+      // TODO(turbofan): check type and deopt for SMI/double stores.
       return false;
     }
-  } else {
-    // Check property details for loads.
-    if (is_smi) {
-      access->type = Type::SignedSmall();
-      access->machine_type = static_cast<MachineType>(kTypeInt32 | kRepTagged);
-    }
-    if (is_double) {
-      access->type = Type::Number();
-      access->machine_type = kMachFloat64;
-    }
   }
 
   int index = map->instance_descriptors()->GetFieldIndex(number);
   FieldIndex field_index = FieldIndex::ForPropertyIndex(*map, index, is_double);
 
   if (field_index.is_inobject()) {
     access->offset = field_index.offset();
     return true;
   }
 
   // TODO(turbofan): handle out of object properties.
   return false;
 }
 
 
+static bool IsGlobalObject(Node* node) {
+  return NodeProperties::IsTyped(node) &&
+         NodeProperties::GetBounds(node).upper->Is(Type::GlobalObject());
+}
+
+
 Reduction JSTypeFeedbackSpecializer::ReduceJSLoadNamed(Node* node) {
   DCHECK(node->opcode() == IrOpcode::kJSLoadNamed);
+  Node* receiver = node->InputAt(0);
+  if (IsGlobalObject(receiver)) {
+    return ReduceJSLoadNamedForGlobalVariable(node);
+  }
+
+  if (!FLAG_turbo_deoptimization) return NoChange();
   // TODO(titzer): deopt locations are wrong for property accesses
   if (!EAGER_DEOPT_LOCATIONS_FOR_PROPERTY_ACCESS_ARE_CORRECT) return NoChange();
 
   // TODO(turbofan): handle vector-based type feedback.
   TypeFeedbackId id = js_type_feedback_->find(node);
   if (id.IsNone() || oracle()->LoadInlineCacheState(id) == UNINITIALIZED) {
     return NoChange();
   }
 
   const LoadNamedParameters& p = LoadNamedParametersOf(node->op());
   SmallMapList maps;
   Handle<Name> name = p.name().handle();
-  Node* receiver = node->InputAt(0);
   Node* effect = NodeProperties::GetEffectInput(node);
   GatherReceiverTypes(receiver, effect, id, name, &maps);
 
   if (maps.length() != 1) return NoChange();  // TODO(turbofan): polymorphism
 
   Handle<Map> map = maps.first();
   FieldAccess field_access;
   if (!GetInObjectFieldAccess(LOAD, map, name, &field_access)) {
     return NoChange();
   }
@@ skipping 12 matching lines @@
   // TODO(titzer): frame state should be from before the load.
   Node* frame_state = NodeProperties::GetFrameStateInput(node, 0);
   Node* deopt = graph()->NewNode(common()->Deoptimize(), frame_state, effect,
                                  check_failed);
   NodeProperties::MergeControlToEnd(graph(), common(), deopt);
   NodeProperties::ReplaceWithValue(node, load, load, check_success);
   return Replace(load);
 }
 
 
+Reduction JSTypeFeedbackSpecializer::ReduceJSLoadNamedForGlobalVariable(
+    Node* node) {
+  Handle<String> name =
+      Handle<String>::cast(LoadNamedParametersOf(node->op()).name().handle());
+  // Try to optimize loads from the global object.
+  Handle<Object> constant_value =
+      jsgraph()->isolate()->factory()->GlobalConstantFor(name);
+  if (!constant_value.is_null()) {
+    // Always optimize global constants.
+    Node* constant = jsgraph()->Constant(constant_value);
+    NodeProperties::ReplaceWithValue(node, constant);
+    return Replace(constant);
+  }
+
+  if (global_object_.is_null()) {
+    // Nothing else can be done if we don't have a global object.
+    return NoChange();
+  }
+
+  if (FLAG_turbo_deoptimization) {
+    // Handle lookups in the script context.
+    {
+      Handle<ScriptContextTable> script_contexts(
+          global_object_->native_context()->script_context_table());
+      ScriptContextTable::LookupResult lookup;
+      if (ScriptContextTable::Lookup(script_contexts, name, &lookup)) {
+        // TODO(turbofan): introduce a LoadContext here.
+        return NoChange();
+      }
+    }
+
+    // Constant promotion or cell access requires lazy deoptimization support.
+    LookupIterator it(global_object_, name, LookupIterator::OWN);
+
+    if (it.state() == LookupIterator::DATA) {
+      Handle<PropertyCell> cell = it.GetPropertyCell();
+      dependencies_->AssumePropertyCell(cell);
+
+      if (it.property_details().cell_type() == PropertyCellType::kConstant) {
+        // Constant promote the global's current value.
+        Handle<Object> constant_value(cell->value(), jsgraph()->isolate());
+        if (constant_value->IsConsString()) {
+          constant_value =
+              String::Flatten(Handle<String>::cast(constant_value));
+        }
+        Node* constant = jsgraph()->Constant(constant_value);
+        NodeProperties::ReplaceWithValue(node, constant);
+        return Replace(constant);
+      } else {
+        // Load directly from the property cell.
+        FieldAccess access = AccessBuilder::ForPropertyCellValue();
+        Node* control = NodeProperties::GetControlInput(node);
+        Node* load_field = graph()->NewNode(
+            simplified()->LoadField(access), jsgraph()->Constant(cell),
+            NodeProperties::GetEffectInput(node), control);
+        NodeProperties::ReplaceWithValue(node, load_field, load_field, control);
+        return Replace(load_field);
+      }
+    }
+  } else {
+    // TODO(turbofan): non-configurable properties on the global object
+    // should be loadable through a cell without deoptimization support.
+  }
+
+  return NoChange();
+}
+
+
 Reduction JSTypeFeedbackSpecializer::ReduceJSLoadProperty(Node* node) {
   return NoChange();
 }
 
 
 Reduction JSTypeFeedbackSpecializer::ReduceJSStoreNamed(Node* node) {
   DCHECK(node->opcode() == IrOpcode::kJSStoreNamed);
   // TODO(titzer): deopt locations are wrong for property accesses
   if (!EAGER_DEOPT_LOCATIONS_FOR_PROPERTY_ACCESS_ARE_CORRECT) return NoChange();
 
@@ skipping 80 matching lines @@
   // TODO(turbofan): filter maps by initial receiver map if known
   // TODO(turbofan): filter maps by native context (if specializing)
   // TODO(turbofan): filter maps by effect chain
   oracle()->PropertyReceiverTypes(id, name, maps);
 }
 
 
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8