[turbofan] Add a Simplified::CheckMaps instruction.

src/compiler/js-type-feedback.cc

 // Copyright 2015 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/compiler/js-type-feedback.h"
 
 #include "src/property-details.h"
 
 #include "src/accessors.h"
 #include "src/ast.h"
@@ skipping 178 matching lines @@
   }
   if (p.load_ic() == NAMED) {
     oracle()->PropertyReceiverTypes(slot, name, &maps);
   } else {
     // The load named was originally a load property.
     bool is_string;        // Unused.
     IcCheckType key_type;  // Unused.
     oracle()->KeyedPropertyReceiverTypes(slot, &maps, &is_string, &key_type);
   }
 
-  Node* effect = NodeProperties::GetEffectInput(node);
-
   if (maps.length() != 1) return NoChange();  // TODO(turbofan): polymorphism
   if (!ENABLE_FAST_PROPERTY_LOADS) return NoChange();
 
   Handle<Map> map = maps.first();
   FieldAccess field_access;
   if (!GetInObjectFieldAccess(LOAD, map, name, &field_access)) {
     return NoChange();
   }
 
+  Node* effect = NodeProperties::GetEffectInput(node);
   Node* control = NodeProperties::GetControlInput(node);
-  Node* check_success;
-  Node* check_failed;
-  BuildMapCheck(receiver, map, true, effect, control, &check_success,
-                &check_failed);
-
+  Node* map_const = jsgraph()->Constant(map);
+  Node* map_check =
+      graph()->NewNode(simplified()->CheckMaps(1), receiver, map_const,
+                       frame_state_before, effect, control);
   // Build the actual load.
   Node* load = graph()->NewNode(simplified()->LoadField(field_access), receiver,
-                                effect, check_success);
+                                effect, map_check);
 
-  // TODO(turbofan): handle slow case instead of deoptimizing.
-  Node* deopt = graph()->NewNode(common()->Deoptimize(), frame_state_before,
-                                 effect, check_failed);
-  NodeProperties::MergeControlToEnd(graph(), common(), deopt);
-  ReplaceWithValue(node, load, load, check_success);
+  ReplaceWithValue(node, load, load, map_check);
   return Replace(load);
 }
 
 
 Reduction JSTypeFeedbackSpecializer::ReduceJSLoadNamedForGlobalVariable(
     Node* node) {
   Handle<String> name =
       Handle<String>::cast(LoadNamedParametersOf(node->op()).name().handle());
   // Try to optimize loads from the global object.
   Handle<Object> constant_value =
@@ skipping 81 matching lines @@
     if (p.store_ic() == NAMED) {
       oracle()->PropertyReceiverTypes(id, name, &maps);
     } else {
       // The named store was originally a store property.
       bool is_string;        // Unused.
       IcCheckType key_type;  // Unused.
       oracle()->KeyedPropertyReceiverTypes(id, &maps, &is_string, &key_type);
     }
   }
 
-  Node* receiver = node->InputAt(0);
-  Node* effect = NodeProperties::GetEffectInput(node);
-
   if (maps.length() != 1) return NoChange();  // TODO(turbofan): polymorphism
 
   if (!ENABLE_FAST_PROPERTY_STORES) return NoChange();
 
   Handle<Map> map = maps.first();
   FieldAccess field_access;
   if (!GetInObjectFieldAccess(STORE, map, name, &field_access)) {
     return NoChange();
   }
 
+  Node* receiver = node->InputAt(0);
+  Node* effect = NodeProperties::GetEffectInput(node);
   Node* control = NodeProperties::GetControlInput(node);
-  Node* check_success;
-  Node* check_failed;
-  BuildMapCheck(receiver, map, true, effect, control, &check_success,
-                &check_failed);
-
-  // Build the actual load.
+  Node* map_const = jsgraph()->Constant(map);
+  Node* map_check =
+      graph()->NewNode(simplified()->CheckMaps(1), receiver, map_const,
+                       frame_state_before, effect, control);
+  // Build the actual store.
   Node* value = node->InputAt(1);
   Node* store = graph()->NewNode(simplified()->StoreField(field_access),
-                                 receiver, value, effect, check_success);
-
-  // TODO(turbofan): handle slow case instead of deoptimizing.
-  Node* deopt = graph()->NewNode(common()->Deoptimize(), frame_state_before,
-                                 effect, check_failed);
-  NodeProperties::MergeControlToEnd(graph(), common(), deopt);
-  ReplaceWithValue(node, store, store, check_success);
+                                 receiver, value, effect, map_check);
+  ReplaceWithValue(node, store, store, map_check);
   return Replace(store);
 }
 
 
 Reduction JSTypeFeedbackSpecializer::ReduceJSStoreProperty(Node* node) {
   return NoChange();
 }
 
 
-void JSTypeFeedbackSpecializer::BuildMapCheck(Node* receiver, Handle<Map> map,
-                                              bool smi_check, Node* effect,
-                                              Node* control, Node** success,
-                                              Node** fail) {
-  Node* if_smi = nullptr;
-  if (smi_check) {
-    Node* branch_smi = graph()->NewNode(
-        common()->Branch(BranchHint::kFalse),
-        graph()->NewNode(simplified()->ObjectIsSmi(), receiver), control);
-    if_smi = graph()->NewNode(common()->IfTrue(), branch_smi);
-    control = graph()->NewNode(common()->IfFalse(), branch_smi);
-  }
-
-  FieldAccess map_access = AccessBuilder::ForMap();
-  Node* receiver_map = graph()->NewNode(simplified()->LoadField(map_access),
-                                        receiver, effect, control);
-  Node* map_const = jsgraph_->Constant(map);
-  Node* cmp = graph()->NewNode(simplified()->ReferenceEqual(Type::Internal()),
-                               receiver_map, map_const);
-  Node* branch =
-      graph()->NewNode(common()->Branch(BranchHint::kTrue), cmp, control);
-  *success = graph()->NewNode(common()->IfTrue(), branch);
-  *fail = graph()->NewNode(common()->IfFalse(), branch);
-
-  if (if_smi) {
-    *fail = graph()->NewNode(common()->Merge(2), *fail, if_smi);
-  }
-}
-
-
 // Get the frame state before an operation if it exists and has a valid
 // bailout id.
 Node* JSTypeFeedbackSpecializer::GetFrameStateBefore(Node* node) {
   int count = OperatorProperties::GetFrameStateInputCount(node->op());
   DCHECK_LE(count, 2);
   if (count == 2) {
     Node* frame_state = NodeProperties::GetFrameStateInput(node, 1);
     if (frame_state->opcode() == IrOpcode::kFrameState) {
       BailoutId id = OpParameter<FrameStateCallInfo>(node).bailout_id();
       if (id != BailoutId::None()) return frame_state;
     }
   }
   return nullptr;
 }
 
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8