[turbofan] Add FrameStates before all property accesses.

src/compiler/js-generic-lowering.cc

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/code-factory.h"
 #include "src/code-stubs.h"
 #include "src/compiler/common-operator.h"
 #include "src/compiler/js-generic-lowering.h"
 #include "src/compiler/js-graph.h"
 #include "src/compiler/machine-operator.h"
 #include "src/compiler/node-matchers.h"
 #include "src/compiler/node-properties.h"
 #include "src/compiler/operator-properties.h"
 #include "src/unique.h"
 
 namespace v8 {
 namespace internal {
 namespace compiler {
 
+static CallDescriptor::Flags AdjustFrameStatesForCall(Node* node) {
+  int count = OperatorProperties::GetFrameStateInputCount(node->op());
+  if (count > 1) {
+    int index = NodeProperties::FirstFrameStateIndex(node) + 1;
+    do {
+      node->RemoveInput(index);
+    } while (--count > 1);
+  }
+  return count > 0 ? CallDescriptor::kNeedsFrameState
+                   : CallDescriptor::kNoFlags;
+}
+
+
 JSGenericLowering::JSGenericLowering(bool is_typing_enabled, JSGraph* jsgraph)
     : is_typing_enabled_(is_typing_enabled), jsgraph_(jsgraph) {}
 
 
 JSGenericLowering::~JSGenericLowering() {}
 
 
 Reduction JSGenericLowering::Reduce(Node* node) {
   switch (node->opcode()) {
 #define DECLARE_CASE(x)  \
@@ skipping 15 matching lines @@
       }
       // Fall-through.
     default:
       // Nothing to see.
       return NoChange();
   }
   return Changed(node);
 }
 
 
-#define REPLACE_BINARY_OP_IC_CALL(op, token)                             \
-  void JSGenericLowering::Lower##op(Node* node) {                        \
-    ReplaceWithStubCall(node, CodeFactory::BinaryOpIC(isolate(), token,  \
-                        OpParameter<LanguageMode>(node)),                \
-                        CallDescriptor::kPatchableCallSiteWithNop);      \
+#define REPLACE_BINARY_OP_IC_CALL(op, token)                            \
+  void JSGenericLowering::Lower##op(Node* node) {                       \
+    CallDescriptor::Flags flags = AdjustFrameStatesForCall(node);       \
+    ReplaceWithStubCall(                                                \
+        node, CodeFactory::BinaryOpIC(isolate(), token,                 \
+                                      OpParameter<LanguageMode>(node)), \
+        CallDescriptor::kPatchableCallSiteWithNop | flags);             \
   }
 REPLACE_BINARY_OP_IC_CALL(JSBitwiseOr, Token::BIT_OR)
 REPLACE_BINARY_OP_IC_CALL(JSBitwiseXor, Token::BIT_XOR)
 REPLACE_BINARY_OP_IC_CALL(JSBitwiseAnd, Token::BIT_AND)
 REPLACE_BINARY_OP_IC_CALL(JSShiftLeft, Token::SHL)
 REPLACE_BINARY_OP_IC_CALL(JSShiftRight, Token::SAR)
 REPLACE_BINARY_OP_IC_CALL(JSShiftRightLogical, Token::SHR)
 REPLACE_BINARY_OP_IC_CALL(JSAdd, Token::ADD)
 REPLACE_BINARY_OP_IC_CALL(JSSubtract, Token::SUB)
 REPLACE_BINARY_OP_IC_CALL(JSMultiply, Token::MUL)
@@ skipping 41 matching lines @@
   if (OperatorProperties::GetFrameStateInputCount(node->op()) > 0) {
     result |= CallDescriptor::kNeedsFrameState;
   }
   return result;
 }
 
 
 void JSGenericLowering::ReplaceWithCompareIC(Node* node, Token::Value token) {
   Callable callable =
       CodeFactory::CompareIC(isolate(), token, OpParameter<LanguageMode>(node));
-  CallDescriptor* desc_compare = Linkage::GetStubCallDescriptor(
-      isolate(), zone(), callable.descriptor(), 0,
-      CallDescriptor::kPatchableCallSiteWithNop | FlagsForNode(node),
-      Operator::kNoProperties, kMachIntPtr);
 
   // Create a new call node asking a CompareIC for help.
   NodeVector inputs(zone());
   inputs.reserve(node->InputCount() + 1);
   inputs.push_back(jsgraph()->HeapConstant(callable.code()));
   inputs.push_back(NodeProperties::GetValueInput(node, 0));
   inputs.push_back(NodeProperties::GetValueInput(node, 1));
   inputs.push_back(NodeProperties::GetContextInput(node));
   if (node->op()->HasProperty(Operator::kPure)) {
     // A pure (strict) comparison doesn't have an effect, control or frame
     // state.  But for the graph, we need to add control and effect inputs.
     DCHECK(OperatorProperties::GetFrameStateInputCount(node->op()) == 0);
     inputs.push_back(graph()->start());
     inputs.push_back(graph()->start());
   } else {
     inputs.push_back(NodeProperties::GetFrameStateInput(node, 0));
     inputs.push_back(NodeProperties::GetEffectInput(node));
     inputs.push_back(NodeProperties::GetControlInput(node));
   }
+  CallDescriptor* desc_compare = Linkage::GetStubCallDescriptor(
+      isolate(), zone(), callable.descriptor(), 0,
+      CallDescriptor::kPatchableCallSiteWithNop | FlagsForNode(node),
+      Operator::kNoProperties, kMachIntPtr);
   Node* compare =
       graph()->NewNode(common()->Call(desc_compare),
                        static_cast<int>(inputs.size()), &inputs.front());
 
   // Decide how the return value from the above CompareIC can be converted into
   // a JavaScript boolean oddball depending on the given token.
   Node* false_value = jsgraph()->FalseConstant();
   Node* true_value = jsgraph()->TrueConstant();
   const Operator* op = nullptr;
   switch (token) {
@@ skipping 33 matching lines @@
   node->TrimInputCount(3);
   node->ReplaceInput(0, booleanize);
   node->ReplaceInput(1, true_value);
   node->ReplaceInput(2, false_value);
   node->set_op(common()->Select(kMachAnyTagged));
 }
 
 
 void JSGenericLowering::ReplaceWithStubCall(Node* node, Callable callable,
                                             CallDescriptor::Flags flags) {
-  Operator::Properties properties = node->op()->properties();
-  flags |= FlagsForNode(node);
+  const Operator* old_op = node->op();
+  Operator::Properties properties = old_op->properties();
   CallDescriptor* desc = Linkage::GetStubCallDescriptor(
       isolate(), zone(), callable.descriptor(), 0, flags, properties);
   const Operator* new_op = common()->Call(desc);
 
-  // Take care of frame states.
-  int old_frame_state_count =
-      OperatorProperties::GetFrameStateInputCount(node->op());
-  int new_frame_state_count =
-      (flags & CallDescriptor::kNeedsFrameState) ? 1 : 0;
-  DCHECK_GE(old_frame_state_count, new_frame_state_count);
-  // If there are extra frame states, get rid of them.
-  for (int i = new_frame_state_count; i < old_frame_state_count; i++) {
-    node->RemoveInput(NodeProperties::FirstFrameStateIndex(node) +
-                      new_frame_state_count);
-  }
-
   Node* stub_code = jsgraph()->HeapConstant(callable.code());
   node->InsertInput(zone(), 0, stub_code);
   node->set_op(new_op);
+
+#if 0 && DEBUG
+    // Check for at most one framestate and that it's at the right position.
+  int where = -1;
+  for (int index = 0; index < node->InputCount(); index++) {
+    if (node->InputAt(index)->opcode() == IrOpcode::kFrameState) {
+      if (where >= 0) {
+        V8_Fatal(__FILE__, __LINE__,
+                 "node #%d:%s already has a framestate at index %d",
+                 node->id(), node->op()->mnemonic(), where);
+      }
+      where = index;
+      DCHECK_EQ(NodeProperties::FirstFrameStateIndex(node), where);
+      DCHECK(flags & CallDescriptor::kNeedsFrameState);
+    }
+  }
+  if (flags & CallDescriptor::kNeedsFrameState) {
+    DCHECK_GE(where, 0);  // should have found a frame state.
+  }
+#endif
 }
 
 
 void JSGenericLowering::ReplaceWithBuiltinCall(Node* node,
                                                Builtins::JavaScript id,
                                                int nargs) {
+  Node* context_input = NodeProperties::GetContextInput(node);
+  Node* effect_input = NodeProperties::GetEffectInput(node);
+
+  CallDescriptor::Flags flags = AdjustFrameStatesForCall(node);
   Operator::Properties properties = node->op()->properties();
   Callable callable =
       CodeFactory::CallFunction(isolate(), nargs - 1, NO_CALL_FUNCTION_FLAGS);
-  CallDescriptor* desc =
-      Linkage::GetStubCallDescriptor(isolate(), zone(), callable.descriptor(),
-                                     nargs, FlagsForNode(node), properties);
-  Node* global_object = graph()->NewNode(
-      machine()->Load(kMachAnyTagged), NodeProperties::GetContextInput(node),
-      jsgraph()->IntPtrConstant(
-          Context::SlotOffset(Context::GLOBAL_OBJECT_INDEX)),
-      NodeProperties::GetEffectInput(node), graph()->start());
+  CallDescriptor* desc = Linkage::GetStubCallDescriptor(
+      isolate(), zone(), callable.descriptor(), nargs, flags, properties);
+  Node* global_object =
+      graph()->NewNode(machine()->Load(kMachAnyTagged), context_input,
+                       jsgraph()->IntPtrConstant(
+                           Context::SlotOffset(Context::GLOBAL_OBJECT_INDEX)),
+                       effect_input, graph()->start());
   Node* builtins_object = graph()->NewNode(
       machine()->Load(kMachAnyTagged), global_object,
       jsgraph()->IntPtrConstant(GlobalObject::kBuiltinsOffset - kHeapObjectTag),
-      NodeProperties::GetEffectInput(node), graph()->start());
+      effect_input, graph()->start());
   Node* function = graph()->NewNode(
       machine()->Load(kMachAnyTagged), builtins_object,
       jsgraph()->IntPtrConstant(JSBuiltinsObject::OffsetOfFunctionWithId(id) -
                                 kHeapObjectTag),
-      NodeProperties::GetEffectInput(node), graph()->start());
+      effect_input, graph()->start());
   Node* stub_code = jsgraph()->HeapConstant(callable.code());
   node->InsertInput(zone(), 0, stub_code);
   node->InsertInput(zone(), 1, function);
   node->set_op(common()->Call(desc));
 }
 
 
 void JSGenericLowering::ReplaceWithRuntimeCall(Node* node,
                                                Runtime::FunctionId f,
                                                int nargs_override) {
   Operator::Properties properties = node->op()->properties();
   const Runtime::Function* fun = Runtime::FunctionForId(f);
   int nargs = (nargs_override < 0) ? fun->nargs : nargs_override;
   CallDescriptor* desc =
       Linkage::GetRuntimeCallDescriptor(zone(), f, nargs, properties);
   Node* ref = jsgraph()->ExternalConstant(ExternalReference(f, isolate()));
   Node* arity = jsgraph()->Int32Constant(nargs);
   node->InsertInput(zone(), 0, jsgraph()->CEntryStubConstant(fun->result_size));
   node->InsertInput(zone(), nargs + 1, ref);
   node->InsertInput(zone(), nargs + 2, arity);
   node->set_op(common()->Call(desc));
 }
 
 
 void JSGenericLowering::LowerJSUnaryNot(Node* node) {
   Callable callable = CodeFactory::ToBoolean(
       isolate(), ToBooleanStub::RESULT_AS_INVERSE_ODDBALL);
-  ReplaceWithStubCall(node, callable, CallDescriptor::kPatchableCallSite);
+  CallDescriptor::Flags flags = AdjustFrameStatesForCall(node);
+  ReplaceWithStubCall(node, callable,
+                      CallDescriptor::kPatchableCallSite | flags);
 }
 
 
 void JSGenericLowering::LowerJSTypeOf(Node* node) {
   Callable callable = CodeFactory::Typeof(isolate());
-  ReplaceWithStubCall(node, callable, CallDescriptor::kNoFlags);
+  CallDescriptor::Flags flags = AdjustFrameStatesForCall(node);
+  ReplaceWithStubCall(node, callable, flags);
 }
 
 
 void JSGenericLowering::LowerJSToBoolean(Node* node) {
   Callable callable =
       CodeFactory::ToBoolean(isolate(), ToBooleanStub::RESULT_AS_ODDBALL);
-  ReplaceWithStubCall(node, callable, CallDescriptor::kPatchableCallSite);
+  CallDescriptor::Flags flags = AdjustFrameStatesForCall(node);
+  ReplaceWithStubCall(node, callable,
+                      CallDescriptor::kPatchableCallSite | flags);
 }
 
 
 void JSGenericLowering::LowerJSToNumber(Node* node) {
   Callable callable = CodeFactory::ToNumber(isolate());
-  ReplaceWithStubCall(node, callable, FlagsForNode(node));
+  CallDescriptor::Flags flags = AdjustFrameStatesForCall(node);
+  ReplaceWithStubCall(node, callable, flags);
 }
 
 
 void JSGenericLowering::LowerJSToString(Node* node) {
   ReplaceWithBuiltinCall(node, Builtins::TO_STRING, 1);
 }
 
 
 void JSGenericLowering::LowerJSToName(Node* node) {
   ReplaceWithBuiltinCall(node, Builtins::TO_NAME, 1);
 }
 
 
 void JSGenericLowering::LowerJSToObject(Node* node) {
   ReplaceWithBuiltinCall(node, Builtins::TO_OBJECT, 1);
 }
 
 
 void JSGenericLowering::LowerJSLoadProperty(Node* node) {
+  CallDescriptor::Flags flags = AdjustFrameStatesForCall(node);
   const LoadPropertyParameters& p = LoadPropertyParametersOf(node->op());
   Callable callable =
       CodeFactory::KeyedLoadICInOptimizedCode(isolate(), UNINITIALIZED);
   if (FLAG_vector_ics) {
     node->InsertInput(zone(), 2, jsgraph()->SmiConstant(p.feedback().index()));
     node->InsertInput(zone(), 3,
                       jsgraph()->HeapConstant(p.feedback().vector()));
   }
-  ReplaceWithStubCall(node, callable, CallDescriptor::kPatchableCallSite);
+  ReplaceWithStubCall(node, callable,
+                      CallDescriptor::kPatchableCallSite | flags);
 }
 
 
 void JSGenericLowering::LowerJSLoadNamed(Node* node) {
+  CallDescriptor::Flags flags = AdjustFrameStatesForCall(node);
   const LoadNamedParameters& p = LoadNamedParametersOf(node->op());
   Callable callable =
       p.load_ic() == NAMED
           ? CodeFactory::LoadICInOptimizedCode(isolate(), p.contextual_mode(),
                                                UNINITIALIZED)
           : CodeFactory::KeyedLoadICInOptimizedCode(isolate(), UNINITIALIZED);
   node->InsertInput(zone(), 1, jsgraph()->HeapConstant(p.name()));
   if (FLAG_vector_ics) {
     node->InsertInput(zone(), 2, jsgraph()->SmiConstant(p.feedback().index()));
     node->InsertInput(zone(), 3,
                       jsgraph()->HeapConstant(p.feedback().vector()));
   }
-  ReplaceWithStubCall(node, callable, CallDescriptor::kPatchableCallSite);
+  ReplaceWithStubCall(node, callable,
+                      CallDescriptor::kPatchableCallSite | flags);
 }
 
 
 void JSGenericLowering::LowerJSStoreProperty(Node* node) {
+  CallDescriptor::Flags flags = AdjustFrameStatesForCall(node);
   LanguageMode language_mode = OpParameter<LanguageMode>(node);
   Callable callable = CodeFactory::KeyedStoreICInOptimizedCode(
       isolate(), language_mode, UNINITIALIZED);
-  ReplaceWithStubCall(node, callable, CallDescriptor::kPatchableCallSite);
+  ReplaceWithStubCall(node, callable,
+                      CallDescriptor::kPatchableCallSite | flags);
 }
 
 
 void JSGenericLowering::LowerJSStoreNamed(Node* node) {
+  CallDescriptor::Flags flags = AdjustFrameStatesForCall(node);
   const StoreNamedParameters& p = StoreNamedParametersOf(node->op());
   Callable callable = p.store_ic() == NAMED
                           ? CodeFactory::StoreIC(isolate(), p.language_mode())
                           : CodeFactory::KeyedStoreICInOptimizedCode(
                                 isolate(), p.language_mode(), UNINITIALIZED);
   node->InsertInput(zone(), 1, jsgraph()->HeapConstant(p.name()));
-  ReplaceWithStubCall(node, callable, CallDescriptor::kPatchableCallSite);
+  ReplaceWithStubCall(node, callable,
+                      CallDescriptor::kPatchableCallSite | flags);
 }
 
 
 void JSGenericLowering::LowerJSDeleteProperty(Node* node) {
   LanguageMode language_mode = OpParameter<LanguageMode>(node);
   ReplaceWithBuiltinCall(node, Builtins::DELETE, 3);
   node->InsertInput(zone(), 4, jsgraph()->SmiConstant(language_mode));
 }
 
 
 void JSGenericLowering::LowerJSHasProperty(Node* node) {
   ReplaceWithBuiltinCall(node, Builtins::IN, 2);
 }
 
 
 void JSGenericLowering::LowerJSInstanceOf(Node* node) {
   InstanceofStub::Flags flags = static_cast<InstanceofStub::Flags>(
       InstanceofStub::kReturnTrueFalseObject |
       InstanceofStub::kArgsInRegisters);
   InstanceofStub stub(isolate(), flags);
   CallInterfaceDescriptor d = stub.GetCallInterfaceDescriptor();
-  CallDescriptor* desc = Linkage::GetStubCallDescriptor(isolate(), zone(), d, 0,
-                                                        FlagsForNode(node));
+  CallDescriptor::Flags desc_flags = AdjustFrameStatesForCall(node);
+  CallDescriptor* desc =
+      Linkage::GetStubCallDescriptor(isolate(), zone(), d, 0, desc_flags);
   Node* stub_code = jsgraph()->HeapConstant(stub.GetCode());
   node->InsertInput(zone(), 0, stub_code);
   node->set_op(common()->Call(desc));
 }
 
 
 void JSGenericLowering::LowerJSLoadContext(Node* node) {
   const ContextAccess& access = ContextAccessOf(node->op());
   for (size_t i = 0; i < access.depth(); ++i) {
     node->ReplaceInput(
@@ skipping 56 matching lines @@
   Unique<String> name = OpParameter<Unique<String>>(node);
   node->InsertInput(zone(), 0, jsgraph()->HeapConstant(name));
   ReplaceWithRuntimeCall(node, Runtime::kPushCatchContext);
 }
 
 
 void JSGenericLowering::LowerJSCallConstruct(Node* node) {
   int arity = OpParameter<int>(node);
   CallConstructStub stub(isolate(), NO_CALL_CONSTRUCTOR_FLAGS);
   CallInterfaceDescriptor d = stub.GetCallInterfaceDescriptor();
-  CallDescriptor* desc = Linkage::GetStubCallDescriptor(
-      isolate(), zone(), d, arity, FlagsForNode(node));
+  CallDescriptor::Flags flags = AdjustFrameStatesForCall(node);
+  CallDescriptor* desc =
+      Linkage::GetStubCallDescriptor(isolate(), zone(), d, arity, flags);
   Node* stub_code = jsgraph()->HeapConstant(stub.GetCode());
   Node* construct = NodeProperties::GetValueInput(node, 0);
   node->InsertInput(zone(), 0, stub_code);
   node->InsertInput(zone(), 1, jsgraph()->Int32Constant(arity - 1));
   node->InsertInput(zone(), 2, construct);
   node->InsertInput(zone(), 3, jsgraph()->UndefinedConstant());
   node->set_op(common()->Call(desc));
 }
 
 
@@ skipping 40 matching lines @@
 
 void JSGenericLowering::LowerJSCallFunction(Node* node) {
   // Fast case: call function directly.
   if (TryLowerDirectJSCall(node)) return;
 
   // General case: CallFunctionStub.
   const CallFunctionParameters& p = CallFunctionParametersOf(node->op());
   int arg_count = static_cast<int>(p.arity() - 2);
   CallFunctionStub stub(isolate(), arg_count, p.flags());
   CallInterfaceDescriptor d = stub.GetCallInterfaceDescriptor();
+  CallDescriptor::Flags flags = AdjustFrameStatesForCall(node);
   CallDescriptor* desc = Linkage::GetStubCallDescriptor(
-      isolate(), zone(), d, static_cast<int>(p.arity() - 1),
-      FlagsForNode(node));
+      isolate(), zone(), d, static_cast<int>(p.arity() - 1), flags);
   Node* stub_code = jsgraph()->HeapConstant(stub.GetCode());
   node->InsertInput(zone(), 0, stub_code);
   node->set_op(common()->Call(desc));
 }
 
 
 void JSGenericLowering::LowerJSCallRuntime(Node* node) {
   const CallRuntimeParameters& p = CallRuntimeParametersOf(node->op());
   ReplaceWithRuntimeCall(node, p.id(), static_cast<int>(p.arity()));
 }
@@ skipping 47 matching lines @@
 }
 
 
 MachineOperatorBuilder* JSGenericLowering::machine() const {
   return jsgraph()->machine();
 }
 
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8