[turbofan] Improve deferred code handling for polymorphic property access.

src/compiler/js-native-context-specialization.cc

 // Copyright 2015 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/compiler/js-native-context-specialization.h"
 
 #include "src/accessors.h"
 #include "src/compilation-dependencies.h"
 #include "src/compiler/access-builder.h"
 #include "src/compiler/js-graph.h"
@@ skipping 519 matching lines @@
     // Perform map check on {receiver}.
     Type* receiver_type = access_info.receiver_type();
     if (receiver_type->Is(Type::String())) {
       // Emit an instance type check for strings.
       Node* receiver_instance_type = this_effect = graph()->NewNode(
           simplified()->LoadField(AccessBuilder::ForMapInstanceType()),
           receiver_map, this_effect, fallthrough_control);
       Node* check =
           graph()->NewNode(machine()->Uint32LessThan(), receiver_instance_type,
                            jsgraph()->Uint32Constant(FIRST_NONSTRING_TYPE));
-      Node* branch = graph()->NewNode(common()->Branch(BranchHint::kTrue),
-                                      check, fallthrough_control);
+      Node* branch =
+          graph()->NewNode(common()->Branch(), check, fallthrough_control);
       fallthrough_control = graph()->NewNode(common()->IfFalse(), branch);
       this_control = graph()->NewNode(common()->IfTrue(), branch);
     } else {
       // Emit a (sequence of) map checks for other properties.
       ZoneVector<Node*> this_controls(zone());
       for (auto i = access_info.receiver_type()->Classes(); !i.Done();
            i.Advance()) {
         Handle<Map> map = i.Current();
         Node* check =
             graph()->NewNode(simplified()->ReferenceEqual(Type::Internal()),
                              receiver_map, jsgraph()->Constant(map));
-        Node* branch = graph()->NewNode(common()->Branch(BranchHint::kTrue),
-                                        check, fallthrough_control);
+        Node* branch =
+            graph()->NewNode(common()->Branch(), check, fallthrough_control);
         this_controls.push_back(graph()->NewNode(common()->IfTrue(), branch));
         fallthrough_control = graph()->NewNode(common()->IfFalse(), branch);
       }
       int const this_control_count = static_cast<int>(this_controls.size());
       this_control =
           (this_control_count == 1)
               ? this_controls.front()
               : graph()->NewNode(common()->Merge(this_control_count),
                                  this_control_count, &this_controls.front());
     }
@@ skipping 41 matching lines @@
                            this_effect, this_control);
     }
 
     // Remember the final state for this property access.
     values.push_back(this_value);
     effects.push_back(this_effect);
     controls.push_back(this_control);
   }
 
   // Collect the fallthru control as final "exit" control.
+  if (fallthrough_control != control) {
+    // Mark the last fallthru branch as deferred.
+    Node* branch = NodeProperties::GetControlInput(fallthrough_control);
+    DCHECK_EQ(IrOpcode::kBranch, branch->opcode());
+    if (fallthrough_control->opcode() == IrOpcode::kIfTrue) {
+      NodeProperties::ChangeOp(branch, common()->Branch(BranchHint::kFalse));
+    } else {
+      DCHECK_EQ(IrOpcode::kIfFalse, fallthrough_control->opcode());
+      NodeProperties::ChangeOp(branch, common()->Branch(BranchHint::kTrue));
+    }
+  }
   exit_controls.push_back(fallthrough_control);
 
   // Generate the single "exit" point, where we get if either all map/instance
   // type checks failed, or one of the assumptions inside one of the cases
   // failes (i.e. failing prototype chain check).
   // TODO(bmeurer): Consider falling back to IC here if deoptimization is
   // disabled.
   int const exit_control_count = static_cast<int>(exit_controls.size());
   Node* exit_control =
       (exit_control_count == 1)
@@ skipping 88 matching lines @@
     // Perform map check on {receiver}.
     Type* receiver_type = access_info.receiver_type();
     if (receiver_type->Is(Type::String())) {
       // Emit an instance type check for strings.
       Node* receiver_instance_type = this_effect = graph()->NewNode(
           simplified()->LoadField(AccessBuilder::ForMapInstanceType()),
           receiver_map, this_effect, fallthrough_control);
       Node* check =
           graph()->NewNode(machine()->Uint32LessThan(), receiver_instance_type,
                            jsgraph()->Uint32Constant(FIRST_NONSTRING_TYPE));
-      Node* branch = graph()->NewNode(common()->Branch(BranchHint::kTrue),
-                                      check, fallthrough_control);
+      Node* branch =
+          graph()->NewNode(common()->Branch(), check, fallthrough_control);
       fallthrough_control = graph()->NewNode(common()->IfFalse(), branch);
       this_control = graph()->NewNode(common()->IfTrue(), branch);
     } else {
       // Emit a (sequence of) map checks for other properties.
       ZoneVector<Node*> this_controls(zone());
       for (auto i = access_info.receiver_type()->Classes(); !i.Done();
            i.Advance()) {
         Handle<Map> map = i.Current();
         Node* check =
             graph()->NewNode(simplified()->ReferenceEqual(Type::Internal()),
                              receiver_map, jsgraph()->Constant(map));
-        Node* branch = graph()->NewNode(common()->Branch(BranchHint::kTrue),
-                                        check, fallthrough_control);
+        Node* branch =
+            graph()->NewNode(common()->Branch(), check, fallthrough_control);
         this_controls.push_back(graph()->NewNode(common()->IfTrue(), branch));
         fallthrough_control = graph()->NewNode(common()->IfFalse(), branch);
       }
       int const this_control_count = static_cast<int>(this_controls.size());
       this_control =
           (this_control_count == 1)
               ? this_controls.front()
               : graph()->NewNode(common()->Merge(this_control_count),
                                  this_control_count, &this_controls.front());
     }
@@ skipping 73 matching lines @@
       this_effect =
           graph()->NewNode(simplified()->StoreField(field_access),
                            this_receiver, value, this_effect, this_control);
     }
 
     // Remember the final state for this property access.
     effects.push_back(this_effect);
     controls.push_back(this_control);
   }
 
   // Collect the fallthru control as final "exit" control.

[Jarin, 2015/10/26 21:14:50]

Why the funny spelling of fallthru? (Also in other places)

How about replacing copy&paste-fu with a separate-function-fu?

[Benedikt Meurer, 2015/10/28 10:20:50]

Done. Refactored the whole thing into a single named access reduce method.

+  if (fallthrough_control != control) {
+    // Mark the last fallthru branch as deferred.
+    Node* branch = NodeProperties::GetControlInput(fallthrough_control);
+    DCHECK_EQ(IrOpcode::kBranch, branch->opcode());
+    if (fallthrough_control->opcode() == IrOpcode::kIfTrue) {
+      NodeProperties::ChangeOp(branch, common()->Branch(BranchHint::kFalse));
+    } else {
+      DCHECK_EQ(IrOpcode::kIfFalse, fallthrough_control->opcode());
+      NodeProperties::ChangeOp(branch, common()->Branch(BranchHint::kTrue));
+    }
+  }
   exit_controls.push_back(fallthrough_control);
 
   // Generate the single "exit" point, where we get if either all map/instance
   // type checks failed, or one of the assumptions inside one of the cases
   // failes (i.e. failing prototype chain check).
   // TODO(bmeurer): Consider falling back to IC here if deoptimization is
   // disabled.
   int const exit_control_count = static_cast<int>(exit_controls.size());
   Node* exit_control =
       (exit_control_count == 1)
@@ skipping 95 matching lines @@
 }
 
 
 SimplifiedOperatorBuilder* JSNativeContextSpecialization::simplified() const {
   return jsgraph()->simplified();
 }
 
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8