[turbofan] Correctify FrameState before operations in JSTypeFeedbackSpecializer.

src/compiler/js-type-feedback.cc

 // Copyright 2015 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/compiler/js-type-feedback.h"
 
 #include "src/property-details.h"
 
 #include "src/accessors.h"
 #include "src/ast.h"
 #include "src/compiler.h"
 #include "src/type-info.h"
 
 #include "src/compiler/access-builder.h"
 #include "src/compiler/common-operator.h"
+#include "src/compiler/frame-states.h"
 #include "src/compiler/node-aux-data.h"
 #include "src/compiler/node-matchers.h"
 #include "src/compiler/operator-properties.h"
 #include "src/compiler/simplified-operator.h"
 
 namespace v8 {
 namespace internal {
 namespace compiler {
 
 enum LoadOrStore { LOAD, STORE };
 
-#define EAGER_DEOPT_LOCATIONS_FOR_PROPERTY_ACCESS_ARE_CORRECT false
-
 JSTypeFeedbackTable::JSTypeFeedbackTable(Zone* zone)
     : map_(TypeFeedbackIdMap::key_compare(),
            TypeFeedbackIdMap::allocator_type(zone)) {}
 
 
 void JSTypeFeedbackTable::Record(Node* node, TypeFeedbackId id) {
   map_.insert(std::make_pair(node->id(), id));
 }
 
 
@@ skipping 117 matching lines @@
 
 
 Reduction JSTypeFeedbackSpecializer::ReduceJSLoadNamed(Node* node) {
   DCHECK(node->opcode() == IrOpcode::kJSLoadNamed);
   Node* receiver = node->InputAt(0);
   if (IsGlobalObject(receiver)) {
     return ReduceJSLoadNamedForGlobalVariable(node);
   }
 
   if (!FLAG_turbo_deoptimization) return NoChange();
-  // TODO(titzer): deopt locations are wrong for property accesses
-  if (!EAGER_DEOPT_LOCATIONS_FOR_PROPERTY_ACCESS_ARE_CORRECT) return NoChange();
+  Node* frame_state_before = GetFrameStateBefore(node);
+  if (frame_state_before == nullptr) return NoChange();
 
   // TODO(turbofan): handle vector-based type feedback.
   TypeFeedbackId id = js_type_feedback_->find(node);
   if (id.IsNone() || oracle()->LoadInlineCacheState(id) == UNINITIALIZED) {
     return NoChange();
   }
 
   const LoadNamedParameters& p = LoadNamedParametersOf(node->op());
   SmallMapList maps;
   Handle<Name> name = p.name().handle();
@@ skipping 12 matching lines @@
   Node* check_success;
   Node* check_failed;
   BuildMapCheck(receiver, map, true, effect, control, &check_success,
                 &check_failed);
 
   // Build the actual load.
   Node* load = graph()->NewNode(simplified()->LoadField(field_access), receiver,
                                 effect, check_success);
 
   // TODO(turbofan): handle slow case instead of deoptimizing.
-  // TODO(titzer): frame state should be from before the load.
-  Node* frame_state = NodeProperties::GetFrameStateInput(node, 0);
-  Node* deopt = graph()->NewNode(common()->Deoptimize(), frame_state, effect,
-                                 check_failed);
+  Node* deopt = graph()->NewNode(common()->Deoptimize(), frame_state_before,
+                                 effect, check_failed);
   NodeProperties::MergeControlToEnd(graph(), common(), deopt);
   NodeProperties::ReplaceWithValue(node, load, load, check_success);
   return Replace(load);
 }
 
 
 Reduction JSTypeFeedbackSpecializer::ReduceJSLoadNamedForGlobalVariable(
     Node* node) {
   Handle<String> name =
       Handle<String>::cast(LoadNamedParametersOf(node->op()).name().handle());
@@ skipping 61 matching lines @@
 }
 
 
 Reduction JSTypeFeedbackSpecializer::ReduceJSLoadProperty(Node* node) {
   return NoChange();
 }
 
 
 Reduction JSTypeFeedbackSpecializer::ReduceJSStoreNamed(Node* node) {
   DCHECK(node->opcode() == IrOpcode::kJSStoreNamed);
-  // TODO(titzer): deopt locations are wrong for property accesses
-  if (!EAGER_DEOPT_LOCATIONS_FOR_PROPERTY_ACCESS_ARE_CORRECT) return NoChange();
+  Node* frame_state_before = GetFrameStateBefore(node);
+  if (frame_state_before == nullptr) return NoChange();
 
   TypeFeedbackId id = js_type_feedback_->find(node);
   if (id.IsNone() || oracle()->StoreIsUninitialized(id)) return NoChange();
 
   const StoreNamedParameters& p = StoreNamedParametersOf(node->op());
   SmallMapList maps;
   Handle<Name> name = p.name().handle();
   Node* receiver = node->InputAt(0);
   Node* effect = NodeProperties::GetEffectInput(node);
   GatherReceiverTypes(receiver, effect, id, name, &maps);
@@ skipping 11 matching lines @@
   Node* check_failed;
   BuildMapCheck(receiver, map, true, effect, control, &check_success,
                 &check_failed);
 
   // Build the actual load.
   Node* value = node->InputAt(1);
   Node* store = graph()->NewNode(simplified()->StoreField(field_access),
                                  receiver, value, effect, check_success);
 
   // TODO(turbofan): handle slow case instead of deoptimizing.
-  // TODO(titzer): frame state should be from before the store.
-  Node* frame_state = NodeProperties::GetFrameStateInput(node, 0);
-  Node* deopt = graph()->NewNode(common()->Deoptimize(), frame_state, effect,
-                                 check_failed);
+  Node* deopt = graph()->NewNode(common()->Deoptimize(), frame_state_before,
+                                 effect, check_failed);
   NodeProperties::MergeControlToEnd(graph(), common(), deopt);
   NodeProperties::ReplaceWithValue(node, store, store, check_success);
   return Replace(store);
 }
 
 
 Reduction JSTypeFeedbackSpecializer::ReduceJSStoreProperty(Node* node) {
   return NoChange();
 }
 
@@ skipping 33 matching lines @@
                                                     TypeFeedbackId id,
                                                     Handle<Name> name,
                                                     SmallMapList* maps) {
   // TODO(turbofan): filter maps by initial receiver map if known
   // TODO(turbofan): filter maps by native context (if specializing)
   // TODO(turbofan): filter maps by effect chain
   oracle()->PropertyReceiverTypes(id, name, maps);
 }
 
 
+// Get the frame state before an operation if it exists and has a valid
+// bailout id.
+Node* JSTypeFeedbackSpecializer::GetFrameStateBefore(Node* node) {
+  int count = OperatorProperties::GetFrameStateInputCount(node->op());
+  DCHECK_LE(count, 2);
+  if (count == 2) {
+    Node* frame_state = NodeProperties::GetFrameStateInput(node, 1);
+    if (frame_state->opcode() == IrOpcode::kFrameState) {
+      BailoutId id = OpParameter<FrameStateCallInfo>(node).bailout_id();
+      if (id != BailoutId::None()) return frame_state;
+    }
+  }
+  return nullptr;
+}
+
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8