[turbofan] Work towards fixing asm.js heap access.

src/compiler/js-typed-lowering.cc

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/code-factory.h"
 #include "src/compiler/access-builder.h"
 #include "src/compiler/js-graph.h"
 #include "src/compiler/js-typed-lowering.h"
 #include "src/compiler/linkage.h"
 #include "src/compiler/node-matchers.h"
@@ skipping 316 matching lines @@
     }
     Node* new_stack =
         graph()->NewNode(stack->op(), stack->InputCount(), &new_values.front());
 
     return graph()->NewNode(op, frame_state->InputAt(0),
                             frame_state->InputAt(1), new_stack,
                             frame_state->InputAt(3), frame_state->InputAt(4));
   }
 
   Node* ConvertPrimitiveToNumber(Node* node) {
-    return lowering_->ConvertPrimitiveToNumber(node);
+    DCHECK(NodeProperties::GetBounds(node).upper->Is(Type::PlainPrimitive()));
+    // Avoid inserting too many eager ToNumber() operations.
+    Reduction const reduction = lowering_->ReduceJSToNumberInput(node);
+    if (reduction.Changed()) return reduction.replacement();
+    return graph()->NewNode(
+        javascript()->ToNumber(), node, jsgraph()->NoContextConstant(),
+        jsgraph()->EmptyFrameState(), graph()->start(), graph()->start());
   }
 
   Node* ConvertToNumber(Node* node, Node* frame_state) {
     if (NodeProperties::GetBounds(node).upper->Is(Type::PlainPrimitive())) {
       return ConvertPrimitiveToNumber(node);
     } else {
       Node* const n =
           graph()->NewNode(javascript()->ToNumber(), node, context(),
                            frame_state, effect(), control());
       update_effect(n);
@@ skipping 325 matching lines @@
   }
   if (input_type->Is(Type::Boolean())) {
     // JSToNumber(x:boolean) => BooleanToNumber(x)
     return Replace(graph()->NewNode(simplified()->BooleanToNumber(), input));
   }
   // TODO(turbofan): js-typed-lowering of ToNumber(x:string)
   return NoChange();
 }
 
 
+namespace {
+
+bool CanCover(Node* user, Node* node) {
+  for (auto edge : node->use_edges()) {
+    if (NodeProperties::IsValueEdge(edge) && edge.from() != user) return false;
+  }
+  return true;
+}
+
+}  // namespace
+
+
+// TODO(bmeurer): Move this into a dedicated conversion/truncation analysis,
+// which works bottom-up from the uses.
+Reduction JSTypedLowering::ReduceNumberToInt32(Node* node) {
+  Node* const number = node->InputAt(0);
+  if (number->opcode() == IrOpcode::kJSToNumber && CanCover(node, number)) {
+    Node* const input = number->InputAt(0);
+    if (input->opcode() == IrOpcode::kJSLoadProperty &&
+        CanCover(number, input)) {
+      Node* key = NodeProperties::GetValueInput(input, 1);
+      Node* base = NodeProperties::GetValueInput(input, 0);
+      Type* key_type = NodeProperties::GetBounds(key).upper;
+      HeapObjectMatcher<Object> mbase(base);
+      if (mbase.HasValue() && mbase.Value().handle()->IsJSTypedArray()) {
+        Handle<JSTypedArray> const array =
+            Handle<JSTypedArray>::cast(mbase.Value().handle());
+        if (!array->GetBuffer()->was_neutered() &&
+            (array->type() != kExternalFloat32Array &&
+             array->type() != kExternalFloat64Array)) {
+          array->GetBuffer()->set_is_neuterable(false);
+          BufferAccess const access(array->type());
+          size_t const k = ElementSizeLog2Of(access.machine_type());
+          double const byte_length = array->byte_length()->Number();
+          CHECK_LT(k, arraysize(shifted_int32_ranges_));
+          if (IsExternalArrayElementsKind(array->map()->elements_kind()) &&
+              key_type->Is(shifted_int32_ranges_[k]) &&
+              byte_length <= kMaxInt) {
+            // JSLoadProperty(typed-array, int32)
+            Handle<ExternalArray> elements =
+                Handle<ExternalArray>::cast(handle(array->elements()));
+            Node* buffer =
+                jsgraph()->PointerConstant(elements->external_pointer());
+            Node* length = jsgraph()->Constant(byte_length);
+            Node* effect = NodeProperties::GetEffectInput(input);
+            Node* control = NodeProperties::GetControlInput(input);
+            // Compute byte offset.
+            Node* offset = Word32Shl(key, static_cast<int>(k));
+            Node* load =
+                graph()->NewNode(simplified()->LoadBuffer(access), buffer,
+                                 offset, length, effect, control);
+            NodeProperties::ReplaceWithValue(input, load, load);
+            NodeProperties::ReplaceWithValue(number, load);
+            number->Kill();
+            input->Kill();
+            return Replace(load);
+          }
+        }
+      }
+    }
+  }
+  return NoChange();
+}
+
+
+// TODO(bmeurer): Move this into a dedicated conversion/truncation analysis,
+// which works bottom-up from the uses.
+Reduction JSTypedLowering::ReduceNumberToUint32(Node* node) {
+  Node* const number = node->InputAt(0);
+  if (number->opcode() == IrOpcode::kJSToNumber && CanCover(node, number)) {
+    Node* const input = number->InputAt(0);
+    if (input->opcode() == IrOpcode::kJSLoadProperty &&
+        CanCover(number, input)) {
+      Node* key = NodeProperties::GetValueInput(input, 1);
+      Node* base = NodeProperties::GetValueInput(input, 0);
+      Type* key_type = NodeProperties::GetBounds(key).upper;
+      HeapObjectMatcher<Object> mbase(base);
+      if (mbase.HasValue() && mbase.Value().handle()->IsJSTypedArray()) {
+        Handle<JSTypedArray> const array =
+            Handle<JSTypedArray>::cast(mbase.Value().handle());
+        if (!array->GetBuffer()->was_neutered() &&
+            (array->type() != kExternalFloat32Array &&
+             array->type() != kExternalFloat64Array)) {
+          array->GetBuffer()->set_is_neuterable(false);
+          BufferAccess const access(array->type());
+          size_t const k = ElementSizeLog2Of(access.machine_type());
+          double const byte_length = array->byte_length()->Number();
+          CHECK_LT(k, arraysize(shifted_int32_ranges_));
+          if (IsExternalArrayElementsKind(array->map()->elements_kind()) &&
+              key_type->Is(shifted_int32_ranges_[k]) &&
+              byte_length <= kMaxInt) {
+            // JSLoadProperty(typed-array, int32)
+            Handle<ExternalArray> elements =
+                Handle<ExternalArray>::cast(handle(array->elements()));
+            Node* buffer =
+                jsgraph()->PointerConstant(elements->external_pointer());
+            Node* length = jsgraph()->Constant(byte_length);
+            Node* effect = NodeProperties::GetEffectInput(input);
+            Node* control = NodeProperties::GetControlInput(input);
+            // Compute byte offset.
+            Node* offset = Word32Shl(key, static_cast<int>(k));
+            Node* load =
+                graph()->NewNode(simplified()->LoadBuffer(access), buffer,
+                                 offset, length, effect, control);
+            NodeProperties::ReplaceWithValue(input, load, load);
+            NodeProperties::ReplaceWithValue(number, load);
+            number->Kill();
+            input->Kill();
+            return Replace(load);
+          }
+        }
+      }
+    }
+  }
+  return NoChange();
+}
+
+
 Reduction JSTypedLowering::ReduceJSToNumber(Node* node) {
   // Try to reduce the input first.
   Node* const input = node->InputAt(0);
   Reduction reduction = ReduceJSToNumberInput(input);
   if (reduction.Changed()) {
     NodeProperties::ReplaceWithValue(node, reduction.replacement());
     return reduction;
   }
+  // TODO(bmeurer): Move this into a dedicated conversion/truncation analysis,
+  // which works bottom-up from the uses.
+  if (input->opcode() == IrOpcode::kJSLoadProperty && CanCover(node, input)) {
+    Node* key = NodeProperties::GetValueInput(input, 1);
+    Node* base = NodeProperties::GetValueInput(input, 0);
+    Type* key_type = NodeProperties::GetBounds(key).upper;
+    HeapObjectMatcher<Object> mbase(base);
+    if (mbase.HasValue() && mbase.Value().handle()->IsJSTypedArray()) {
+      Handle<JSTypedArray> const array =
+          Handle<JSTypedArray>::cast(mbase.Value().handle());
+      if (!array->GetBuffer()->was_neutered() &&
+          (array->type() == kExternalFloat32Array ||
+           array->type() == kExternalFloat64Array)) {
+        array->GetBuffer()->set_is_neuterable(false);
+        BufferAccess const access(array->type());
+        size_t const k = ElementSizeLog2Of(access.machine_type());
+        double const byte_length = array->byte_length()->Number();
+        CHECK_LT(k, arraysize(shifted_int32_ranges_));
+        if (IsExternalArrayElementsKind(array->map()->elements_kind()) &&
+            key_type->Is(shifted_int32_ranges_[k]) && byte_length <= kMaxInt) {
+          // JSLoadProperty(typed-array, int32)
+          Handle<ExternalArray> elements =
+              Handle<ExternalArray>::cast(handle(array->elements()));
+          Node* buffer =
+              jsgraph()->PointerConstant(elements->external_pointer());
+          Node* length = jsgraph()->Constant(byte_length);
+          Node* effect = NodeProperties::GetEffectInput(input);
+          Node* control = NodeProperties::GetControlInput(input);
+          // Compute byte offset.
+          Node* offset = Word32Shl(key, static_cast<int>(k));
+          Node* load =
+              graph()->NewNode(simplified()->LoadBuffer(access), buffer, offset,
+                               length, effect, control);
+          NodeProperties::ReplaceWithValue(input, load, load);
+          NodeProperties::ReplaceWithValue(node, load);
+          input->Kill();
+          return Changed(load);
+        }
+      }
+    }
+  }
   Type* const input_type = NodeProperties::GetBounds(input).upper;
   if (input_type->Is(Type::PlainPrimitive())) {
     if (NodeProperties::GetContextInput(node) !=
             jsgraph()->NoContextConstant() ||
         NodeProperties::GetEffectInput(node) != graph()->start() ||
         NodeProperties::GetControlInput(node) != graph()->start()) {
       // JSToNumber(x:plain-primitive,context,effect,control)
       //   => JSToNumber(x,no-context,start,start)
       RelaxEffectsAndControls(node);
       NodeProperties::ReplaceContextInput(node, jsgraph()->NoContextConstant());
@@ skipping 65 matching lines @@
   Node* key = NodeProperties::GetValueInput(node, 1);
   Node* base = NodeProperties::GetValueInput(node, 0);
   Type* key_type = NodeProperties::GetBounds(key).upper;
   HeapObjectMatcher<Object> mbase(base);
   if (mbase.HasValue() && mbase.Value().handle()->IsJSTypedArray()) {
     Handle<JSTypedArray> const array =
         Handle<JSTypedArray>::cast(mbase.Value().handle());
     if (!array->GetBuffer()->was_neutered()) {
       array->GetBuffer()->set_is_neuterable(false);
       BufferAccess const access(array->type());
-      size_t const k = ElementSizeLog2Of(access.machine_type());
-      double const byte_length = array->byte_length()->Number();
-      CHECK_LT(k, arraysize(shifted_int32_ranges_));
-      if (IsExternalArrayElementsKind(array->map()->elements_kind()) &&
-          key_type->Is(shifted_int32_ranges_[k]) && byte_length <= kMaxInt) {
-        // JSLoadProperty(typed-array, int32)
+      if (array->byte_length()->Number() <= kMaxInt &&
+          key_type->Is(Type::Unsigned32()) &&
+          key_type->Max() < array->length()->Number()) {
+        // JSLoadProperty(typed-array, unsigned32)
         Handle<ExternalArray> elements =
             Handle<ExternalArray>::cast(handle(array->elements()));
         Node* buffer = jsgraph()->PointerConstant(elements->external_pointer());
-        Node* length = jsgraph()->Constant(byte_length);
         Node* effect = NodeProperties::GetEffectInput(node);
         Node* control = NodeProperties::GetControlInput(node);
-        // Check if we can avoid the bounds check.
-        if (key_type->Min() >= 0 &&
-            key_type->Max() < array->length()->Number()) {
-          Node* load = graph()->NewNode(
-              simplified()->LoadElement(
-                  AccessBuilder::ForTypedArrayElement(array->type(), true)),
-              buffer, key, effect, control);
-          return ReplaceEagerly(node, load);
-        }
-        // Compute byte offset.
-        Node* offset = Word32Shl(key, static_cast<int>(k));
-        Node* load = graph()->NewNode(simplified()->LoadBuffer(access), buffer,
-                                      offset, length, effect, control);
+        Node* load = graph()->NewNode(
+            simplified()->LoadElement(
+                AccessBuilder::ForTypedArrayElement(array->type(), true)),
+            buffer, key, effect, control);
         return ReplaceEagerly(node, load);
       }
     }
   }
   return NoChange();
 }
 
 
 Reduction JSTypedLowering::ReduceJSStoreProperty(Node* node) {
   Node* key = NodeProperties::GetValueInput(node, 1);
   Node* base = NodeProperties::GetValueInput(node, 0);
   Node* value = NodeProperties::GetValueInput(node, 2);
   Type* key_type = NodeProperties::GetBounds(key).upper;
   Type* value_type = NodeProperties::GetBounds(value).upper;
   HeapObjectMatcher<Object> mbase(base);
   if (mbase.HasValue() && mbase.Value().handle()->IsJSTypedArray()) {
     Handle<JSTypedArray> const array =
         Handle<JSTypedArray>::cast(mbase.Value().handle());
     if (!array->GetBuffer()->was_neutered()) {
       array->GetBuffer()->set_is_neuterable(false);
       BufferAccess const access(array->type());
       size_t const k = ElementSizeLog2Of(access.machine_type());
       double const byte_length = array->byte_length()->Number();
       CHECK_LT(k, arraysize(shifted_int32_ranges_));
-      if (IsExternalArrayElementsKind(array->map()->elements_kind()) &&
-          access.external_array_type() != kExternalUint8ClampedArray &&
+      if (access.external_array_type() != kExternalUint8ClampedArray &&
           key_type->Is(shifted_int32_ranges_[k]) && byte_length <= kMaxInt) {
         // JSLoadProperty(typed-array, int32)
         Handle<ExternalArray> elements =
             Handle<ExternalArray>::cast(handle(array->elements()));
         Node* buffer = jsgraph()->PointerConstant(elements->external_pointer());
         Node* length = jsgraph()->Constant(byte_length);
         Node* context = NodeProperties::GetContextInput(node);
         Node* effect = NodeProperties::GetEffectInput(node);
         Node* control = NodeProperties::GetControlInput(node);
         // Convert to a number first.
@@ skipping 338 matching lines @@
     case IrOpcode::kJSCreateClosure:
       return ReduceJSCreateClosure(node);
     case IrOpcode::kJSCreateLiteralArray:
       return ReduceJSCreateLiteralArray(node);
     case IrOpcode::kJSCreateLiteralObject:
       return ReduceJSCreateLiteralObject(node);
     case IrOpcode::kJSCreateWithContext:
       return ReduceJSCreateWithContext(node);
     case IrOpcode::kJSCreateBlockContext:
       return ReduceJSCreateBlockContext(node);
+    case IrOpcode::kNumberToInt32:
+      return ReduceNumberToInt32(node);
+    case IrOpcode::kNumberToUint32:
+      return ReduceNumberToUint32(node);
     default:
       break;
   }
   return NoChange();
 }
 
 
-Node* JSTypedLowering::ConvertPrimitiveToNumber(Node* input) {
-  DCHECK(NodeProperties::GetBounds(input).upper->Is(Type::PlainPrimitive()));
-  // Avoid inserting too many eager ToNumber() operations.
-  Reduction const reduction = ReduceJSToNumberInput(input);
-  if (reduction.Changed()) return reduction.replacement();
-  // TODO(jarin) Use PlainPrimitiveToNumber once we have it.
-  return graph()->NewNode(
-      javascript()->ToNumber(), input, jsgraph()->NoContextConstant(),
-      jsgraph()->EmptyFrameState(), graph()->start(), graph()->start());
-}
-
-
 Node* JSTypedLowering::Word32Shl(Node* const lhs, int32_t const rhs) {
   if (rhs == 0) return lhs;
   return graph()->NewNode(machine()->Word32Shl(), lhs,
                           jsgraph()->Int32Constant(rhs));
 }
 
 
 Factory* JSTypedLowering::factory() const { return jsgraph()->factory(); }
 
 
@@ skipping 10 matching lines @@
 }
 
 
 MachineOperatorBuilder* JSTypedLowering::machine() const {
   return jsgraph()->machine();
 }
 
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8