[turbofan] Add a Simplified::CheckMaps instruction.

src/compiler/simplified-lowering.cc

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/compiler/simplified-lowering.h"
 
 #include <limits>
 
 #include "src/base/bits.h"
 #include "src/code-factory.h"
+#include "src/compiler/access-builder.h"
 #include "src/compiler/common-operator.h"
 #include "src/compiler/diamond.h"
 #include "src/compiler/linkage.h"
 #include "src/compiler/node-matchers.h"
 #include "src/compiler/node-properties.h"
 #include "src/compiler/operator-properties.h"
 #include "src/compiler/representation-change.h"
 #include "src/compiler/simplified-lowering.h"
 #include "src/compiler/simplified-operator.h"
 #include "src/compiler/source-position.h"
@@ skipping 841 matching lines @@
         ProcessInput(node, 2, access.machine_type);                   // value
         ProcessRemainingInputs(node, 3);
         SetOutput(node, 0);
         if (lower()) lowering->DoStoreElement(node);
         break;
       }
       case IrOpcode::kObjectIsSmi: {
         ProcessInput(node, 0, kMachAnyTagged);
         SetOutput(node, kRepBit | kTypeBool);
         if (lower()) {
-          Node* is_tagged = jsgraph_->graph()->NewNode(
-              jsgraph_->machine()->WordAnd(), node->InputAt(0),
-              jsgraph_->IntPtrConstant(kSmiTagMask));
-          Node* is_smi = jsgraph_->graph()->NewNode(
-              jsgraph_->machine()->WordEqual(), is_tagged,
-              jsgraph_->IntPtrConstant(kSmiTag));
+          Node* is_smi = lowering->IsSmi(node->InputAt(0));
           DeferReplacement(node, is_smi);
         }
         break;
       }
       case IrOpcode::kObjectIsNonNegativeSmi: {
         ProcessInput(node, 0, kMachAnyTagged);
         SetOutput(node, kRepBit | kTypeBool);
         if (lower()) {
-          Node* is_tagged = jsgraph_->graph()->NewNode(
-              jsgraph_->machine()->WordAnd(), node->InputAt(0),
-              jsgraph_->IntPtrConstant(kSmiTagMask));
-          Node* is_smi = jsgraph_->graph()->NewNode(
-              jsgraph_->machine()->WordEqual(), is_tagged,
-              jsgraph_->IntPtrConstant(kSmiTag));
+          Node* is_smi = lowering->IsSmi(node->InputAt(0));
           Node* is_non_neg = jsgraph_->graph()->NewNode(
               jsgraph_->machine()->IntLessThanOrEqual(),
               jsgraph_->IntPtrConstant(0), node->InputAt(0));
           Node* is_non_neg_smi = jsgraph_->graph()->NewNode(
               jsgraph_->machine()->Word32And(), is_smi, is_non_neg);
           DeferReplacement(node, is_non_neg_smi);
         }
         break;
       }
+      case IrOpcode::kCheckMaps: {
+        // TODO(titzer): don't require tagged input to CheckMaps.
+        VisitInputs(node);
+        if (lower()) lowering->DoCheckMaps(node);
+        break;
+      }
 
       //------------------------------------------------------------------
       // Machine-level operators.
       //------------------------------------------------------------------
       case IrOpcode::kLoad: {
         // TODO(titzer): machine loads/stores need to know BaseTaggedness!?
         MachineTypeUnion tBase = kRepTagged | kMachPtr;
         LoadRepresentation rep = OpParameter<LoadRepresentation>(node);
         ProcessInput(node, 0, tBase);   // pointer or object
         ProcessInput(node, 1, kMachIntPtr);  // index
@@ skipping 202 matching lines @@
 
 
 Node* SimplifiedLowering::IsTagged(Node* node) {
   // TODO(titzer): factor this out to a TaggingScheme abstraction.
   STATIC_ASSERT(kSmiTagMask == 1);  // Only works if tag is the low bit.
   return graph()->NewNode(machine()->WordAnd(), node,
                           jsgraph()->Int32Constant(kSmiTagMask));
 }
 
 
+Node* SimplifiedLowering::IsSmi(Node* node) {
+  Node* is_tagged = jsgraph_->graph()->NewNode(
+      machine()->WordAnd(), node, jsgraph()->IntPtrConstant(kSmiTagMask));
+  Node* is_smi =
+      jsgraph_->graph()->NewNode(jsgraph()->machine()->WordEqual(), is_tagged,
+                                 jsgraph()->IntPtrConstant(kSmiTag));
+  return is_smi;
+}
+
+
 void SimplifiedLowering::LowerAllNodes() {
   SimplifiedOperatorBuilder simplified(graph()->zone());
   RepresentationChanger changer(jsgraph(), &simplified, jsgraph()->isolate());
   RepresentationSelector selector(jsgraph(), zone_, &changer,
                                   source_positions_);
   selector.Run(this);
 }
 
 
 Node* SimplifiedLowering::Untag(Node* node) {
@@ skipping 475 matching lines @@
   node->ReplaceInput(1, jsgraph()->SmiConstant(EQUAL));
 }
 
 
 void SimplifiedLowering::DoStringLessThanOrEqual(Node* node) {
   node->set_op(machine()->IntLessThanOrEqual());
   node->ReplaceInput(0, StringComparison(node, true));
   node->ReplaceInput(1, jsgraph()->SmiConstant(EQUAL));
 }
 
+
+void SimplifiedLowering::DoCheckMaps(Node* node) {
+  bool smi_check = true;
+
+  Node* receiver = node->InputAt(0);
+  Node* control = NodeProperties::GetControlInput(node);
+  Node* effect = NodeProperties::GetEffectInput(node);
+  int map_count = OpParameter<int32_t>(node->op());
+  Node* frame_state = node->InputAt(1 + map_count);
+
+  if (smi_check) {
+    // Inline a smi check first.
+    Node* branch_smi = graph()->NewNode(common()->Branch(BranchHint::kFalse),
+                                        IsSmi(receiver), control);
+    Node* if_smi = graph()->NewNode(common()->IfTrue(), branch_smi);
+    AddDeoptimize(frame_state, effect, if_smi);
+    control = graph()->NewNode(common()->IfFalse(), branch_smi);
+  }
+
+  // Add checks against the maps.
+  NodeVector checks(zone());
+  checks.reserve(map_count);
+  FieldAccess map_access = AccessBuilder::ForMap();
+  Node* offset =
+      jsgraph()->IntPtrConstant(map_access.offset - map_access.tag());
+  Node* receiver_map =
+      graph()->NewNode(machine()->Load(map_access.machine_type), receiver,
+                       offset, effect, control);
+  for (int i = 1; i <= map_count; i++) {
+    Node* map = node->InputAt(i);
+    Node* cmp = graph()->NewNode(machine()->WordEqual(), receiver_map, map);
+    Node* branch =
+        graph()->NewNode(common()->Branch(BranchHint::kTrue), cmp, control);
+    Node* fail = graph()->NewNode(common()->IfFalse(), branch);
+    AddDeoptimize(frame_state, effect, fail);
+    Node* success = graph()->NewNode(common()->IfTrue(), branch);
+    checks.push_back(success);
+  }
+
+  // Create a merge of the checks if necessary.
+  Node* success =
+      checks.size() == 1
+          ? checks[0]
+          : graph()->NewNode(common()->Merge(map_count), map_count, &checks[0]);
+
+  node->ReplaceUses(success);
+}
+
+
+void SimplifiedLowering::AddDeoptimize(Node* frame_state_before, Node* effect,
+                                       Node* control) {
+  Node* deopt = graph()->NewNode(common()->Deoptimize(), frame_state_before,
+                                 effect, control);
+  NodeProperties::MergeControlToEnd(graph(), common(), deopt);
+}
+
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8