[turbofan] Add frame state before JavaScript comparisons.

src/compiler/js-typed-lowering.cc

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/code-factory.h"
 #include "src/compiler/access-builder.h"
 #include "src/compiler/js-graph.h"
 #include "src/compiler/js-typed-lowering.h"
 #include "src/compiler/linkage.h"
 #include "src/compiler/node-matchers.h"
@@ skipping 103 matching lines @@
 
 // A helper class to simplify the process of reducing a single binop node with a
 // JSOperator. This class manages the rewriting of context, control, and effect
 // dependencies during lowering of a binop and contains numerous helper
 // functions for matching the types of inputs to an operation.
 class JSBinopReduction final {
  public:
   JSBinopReduction(JSTypedLowering* lowering, Node* node)
       : lowering_(lowering), node_(node) {}
 
-  void ConvertPrimitiveInputsToNumber() {
-    node_->ReplaceInput(0, ConvertPrimitiveToNumber(left()));
-    node_->ReplaceInput(1, ConvertPrimitiveToNumber(right()));
-  }
-
   void ConvertInputsToNumber(Node* frame_state) {
     // To convert the inputs to numbers, we have to provide frame states
     // for lazy bailouts in the ToNumber conversions.
     // We use a little hack here: we take the frame state before the binary
     // operation and use it to construct the frame states for the conversion
     // so that after the deoptimization, the binary operation IC gets
     // already converted values from full code. This way we are sure that we
     // will not re-do any of the side effects.
 
     Node* left_input =
         left_type()->Is(Type::PlainPrimitive())
-            ? ConvertPrimitiveToNumber(left())
+            ? ConvertPlainPrimitiveToNumber(left())
             : ConvertToNumber(left(),
                               CreateFrameStateForLeftInput(frame_state));
 
     Node* right_input =
         right_type()->Is(Type::PlainPrimitive())
-            ? ConvertPrimitiveToNumber(right())
+            ? ConvertPlainPrimitiveToNumber(right())
             : ConvertToNumber(right(), CreateFrameStateForRightInput(
                                            frame_state, left_input));
 
     node_->ReplaceInput(0, left_input);
     node_->ReplaceInput(1, right_input);
   }
 
   void ConvertInputsToUI32(Signedness left_signedness,
                            Signedness right_signedness) {
     node_->ReplaceInput(0, ConvertToUI32(left(), left_signedness));
     node_->ReplaceInput(1, ConvertToUI32(right(), right_signedness));
   }
 
   void ConvertInputsToString() {
     node_->ReplaceInput(0, ConvertToString(left()));
     node_->ReplaceInput(1, ConvertToString(right()));
   }
 
   // Convert inputs for bitwise shift operation (ES5 spec 11.7).
   void ConvertInputsForShift(Signedness left_signedness) {
-    node_->ReplaceInput(
-        0, ConvertToUI32(ConvertPrimitiveToNumber(left()), left_signedness));
-    Node* rnum = ConvertToUI32(ConvertPrimitiveToNumber(right()), kUnsigned);
+    node_->ReplaceInput(0, ConvertToUI32(ConvertPlainPrimitiveToNumber(left()),
+                                         left_signedness));
+    Node* rnum =
+        ConvertToUI32(ConvertPlainPrimitiveToNumber(right()), kUnsigned);
     Type* rnum_type = NodeProperties::GetBounds(rnum).upper;
     if (!rnum_type->Is(lowering_->zero_thirtyone_range_)) {
       rnum = graph()->NewNode(machine()->Word32And(), rnum,
                               jsgraph()->Int32Constant(0x1F));
     }
     node_->ReplaceInput(1, rnum);
   }
 
   void SwapInputs() {
     Node* l = left();
@@ skipping 146 matching lines @@
       }
     }
     Node* new_stack =
         graph()->NewNode(stack->op(), stack->InputCount(), &new_values.front());
 
     return graph()->NewNode(op, frame_state->InputAt(0),
                             frame_state->InputAt(1), new_stack,
                             frame_state->InputAt(3), frame_state->InputAt(4));
   }
 
-  Node* ConvertPrimitiveToNumber(Node* node) {
-    return lowering_->ConvertPrimitiveToNumber(node);
+  Node* ConvertPlainPrimitiveToNumber(Node* node) {
+    DCHECK(NodeProperties::GetBounds(node).upper->Is(Type::PlainPrimitive()));
+    // Avoid inserting too many eager ToNumber() operations.
+    Reduction const reduction = lowering_->ReduceJSToNumberInput(node);
+    if (reduction.Changed()) return reduction.replacement();
+    // TODO(jarin) Use PlainPrimitiveToNumber once we have it.
+    return graph()->NewNode(
+        javascript()->ToNumber(), node, jsgraph()->NoContextConstant(),
+        jsgraph()->EmptyFrameState(), graph()->start(), graph()->start());
   }
 
   Node* ConvertToNumber(Node* node, Node* frame_state) {
     if (NodeProperties::GetBounds(node).upper->Is(Type::PlainPrimitive())) {
-      return ConvertPrimitiveToNumber(node);
+      return ConvertPlainPrimitiveToNumber(node);
     } else {
       Node* const n =
           graph()->NewNode(javascript()->ToNumber(), node, context(),
                            frame_state, effect(), control());
       update_effect(n);
       return n;
     }
   }
 
   Node* ConvertToUI32(Node* node, Signedness signedness) {
@@ skipping 110 matching lines @@
         break;
       case IrOpcode::kJSGreaterThanOrEqual:
         stringOp = simplified()->StringLessThanOrEqual();
         r.SwapInputs();  // a >= b => b <= a
         break;
       default:
         return NoChange();
     }
     return r.ChangeToPureOperator(stringOp);
   }
-  if (r.IsStrong() && !r.BothInputsAre(Type::Number())) {
-    return NoChange();
-  }
-#if 0
-  // TODO(turbofan): General ToNumber disabled for now because:
-  //   a) The inserted ToNumber operation screws up observability of valueOf.
-  //   b) Deoptimization at ToNumber doesn't have corresponding bailout id.
-  Type* maybe_string = Type::Union(Type::String(), Type::Receiver(), zone());
-  if (r.OneInputCannotBe(maybe_string)) {
-    // If one input cannot be a string, then emit a number comparison.
-    ...
-  }
-#endif
-  if (r.BothInputsAre(Type::PlainPrimitive()) &&
-      r.OneInputCannotBe(Type::StringOrReceiver())) {
+  if (r.OneInputCannotBe(Type::StringOrReceiver())) {
     const Operator* less_than;
     const Operator* less_than_or_equal;
     if (r.BothInputsAre(Type::Unsigned32())) {
       less_than = machine()->Uint32LessThan();
       less_than_or_equal = machine()->Uint32LessThanOrEqual();
     } else if (r.BothInputsAre(Type::Signed32())) {
       less_than = machine()->Int32LessThan();
       less_than_or_equal = machine()->Int32LessThanOrEqual();
     } else {
       // TODO(turbofan): mixed signed/unsigned int32 comparisons.
-      r.ConvertPrimitiveInputsToNumber();
+      if (r.IsStrong() && !r.BothInputsAre(Type::Number())) {
+        return NoChange();
+      }
+      Node* frame_state = NodeProperties::GetFrameStateInput(node, 1);
+      r.ConvertInputsToNumber(frame_state);
       less_than = simplified()->NumberLessThan();
       less_than_or_equal = simplified()->NumberLessThanOrEqual();
     }
     const Operator* comparison;
     switch (node->opcode()) {
       case IrOpcode::kJSLessThan:
         comparison = less_than;
         break;
       case IrOpcode::kJSGreaterThan:
         comparison = less_than;
@@ skipping 676 matching lines @@
       return ReduceJSCreateWithContext(node);
     case IrOpcode::kJSCreateBlockContext:
       return ReduceJSCreateBlockContext(node);
     default:
       break;
   }
   return NoChange();
 }
 
 
-Node* JSTypedLowering::ConvertPrimitiveToNumber(Node* input) {
-  DCHECK(NodeProperties::GetBounds(input).upper->Is(Type::PlainPrimitive()));
-  // Avoid inserting too many eager ToNumber() operations.
-  Reduction const reduction = ReduceJSToNumberInput(input);
-  if (reduction.Changed()) return reduction.replacement();
-  // TODO(jarin) Use PlainPrimitiveToNumber once we have it.
-  return graph()->NewNode(
-      javascript()->ToNumber(), input, jsgraph()->NoContextConstant(),
-      jsgraph()->EmptyFrameState(), graph()->start(), graph()->start());
-}
-
-
 Node* JSTypedLowering::Word32Shl(Node* const lhs, int32_t const rhs) {
   if (rhs == 0) return lhs;
   return graph()->NewNode(machine()->Word32Shl(), lhs,
                           jsgraph()->Int32Constant(rhs));
 }
 
 
 Factory* JSTypedLowering::factory() const { return jsgraph()->factory(); }
 
 
@@ skipping 10 matching lines @@
 }
 
 
 MachineOperatorBuilder* JSTypedLowering::machine() const {
   return jsgraph()->machine();
 }
 
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8