[turbofan] Improve deferred code handling for polymorphic property access.

src/compiler/js-native-context-specialization.cc

Index: src/compiler/js-native-context-specialization.cc
diff --git a/src/compiler/js-native-context-specialization.cc b/src/compiler/js-native-context-specialization.cc
index 38735e1dc7fea22737b15c85145837ad7522a41c..7b119c19b992a7486841df388d76b689094d1fe6 100644
--- a/src/compiler/js-native-context-specialization.cc
+++ b/src/compiler/js-native-context-specialization.cc
@@ -537,8 +537,8 @@ Reduction JSNativeContextSpecialization::ReduceJSLoadNamed(Node* node) {
       Node* check =
           graph()->NewNode(machine()->Uint32LessThan(), receiver_instance_type,
                            jsgraph()->Uint32Constant(FIRST_NONSTRING_TYPE));
-      Node* branch = graph()->NewNode(common()->Branch(BranchHint::kTrue),
-                                      check, fallthrough_control);
+      Node* branch =
+          graph()->NewNode(common()->Branch(), check, fallthrough_control);
       fallthrough_control = graph()->NewNode(common()->IfFalse(), branch);
       this_control = graph()->NewNode(common()->IfTrue(), branch);
     } else {
@@ -550,8 +550,8 @@ Reduction JSNativeContextSpecialization::ReduceJSLoadNamed(Node* node) {
         Node* check =
             graph()->NewNode(simplified()->ReferenceEqual(Type::Internal()),
                              receiver_map, jsgraph()->Constant(map));
-        Node* branch = graph()->NewNode(common()->Branch(BranchHint::kTrue),
-                                        check, fallthrough_control);
+        Node* branch =
+            graph()->NewNode(common()->Branch(), check, fallthrough_control);
         this_controls.push_back(graph()->NewNode(common()->IfTrue(), branch));
         fallthrough_control = graph()->NewNode(common()->IfFalse(), branch);
       }
@@ -613,6 +613,17 @@ Reduction JSNativeContextSpecialization::ReduceJSLoadNamed(Node* node) {
   }
 
   // Collect the fallthru control as final "exit" control.
+  if (fallthrough_control != control) {
+    // Mark the last fallthru branch as deferred.
+    Node* branch = NodeProperties::GetControlInput(fallthrough_control);
+    DCHECK_EQ(IrOpcode::kBranch, branch->opcode());
+    if (fallthrough_control->opcode() == IrOpcode::kIfTrue) {
+      NodeProperties::ChangeOp(branch, common()->Branch(BranchHint::kFalse));
+    } else {
+      DCHECK_EQ(IrOpcode::kIfFalse, fallthrough_control->opcode());
+      NodeProperties::ChangeOp(branch, common()->Branch(BranchHint::kTrue));
+    }
+  }
   exit_controls.push_back(fallthrough_control);
 
   // Generate the single "exit" point, where we get if either all map/instance
@@ -721,8 +732,8 @@ Reduction JSNativeContextSpecialization::ReduceJSStoreNamed(Node* node) {
       Node* check =
           graph()->NewNode(machine()->Uint32LessThan(), receiver_instance_type,
                            jsgraph()->Uint32Constant(FIRST_NONSTRING_TYPE));
-      Node* branch = graph()->NewNode(common()->Branch(BranchHint::kTrue),
-                                      check, fallthrough_control);
+      Node* branch =
+          graph()->NewNode(common()->Branch(), check, fallthrough_control);
       fallthrough_control = graph()->NewNode(common()->IfFalse(), branch);
       this_control = graph()->NewNode(common()->IfTrue(), branch);
     } else {
@@ -734,8 +745,8 @@ Reduction JSNativeContextSpecialization::ReduceJSStoreNamed(Node* node) {
         Node* check =
             graph()->NewNode(simplified()->ReferenceEqual(Type::Internal()),
                              receiver_map, jsgraph()->Constant(map));
-        Node* branch = graph()->NewNode(common()->Branch(BranchHint::kTrue),
-                                        check, fallthrough_control);
+        Node* branch =
+            graph()->NewNode(common()->Branch(), check, fallthrough_control);
         this_controls.push_back(graph()->NewNode(common()->IfTrue(), branch));
         fallthrough_control = graph()->NewNode(common()->IfFalse(), branch);
       }
@@ -830,6 +841,17 @@ Reduction JSNativeContextSpecialization::ReduceJSStoreNamed(Node* node) {
   }
 
   // Collect the fallthru control as final "exit" control.

[Jarin, 2015/10/26 21:14:50]

Why the funny spelling of fallthru? (Also in other places)

How about replacing copy&paste-fu with a separate-function-fu?

[Benedikt Meurer, 2015/10/28 10:20:50]

Done. Refactored the whole thing into a single named access reduce method.

+  if (fallthrough_control != control) {
+    // Mark the last fallthru branch as deferred.
+    Node* branch = NodeProperties::GetControlInput(fallthrough_control);
+    DCHECK_EQ(IrOpcode::kBranch, branch->opcode());
+    if (fallthrough_control->opcode() == IrOpcode::kIfTrue) {
+      NodeProperties::ChangeOp(branch, common()->Branch(BranchHint::kFalse));
+    } else {
+      DCHECK_EQ(IrOpcode::kIfFalse, fallthrough_control->opcode());
+      NodeProperties::ChangeOp(branch, common()->Branch(BranchHint::kTrue));
+    }
+  }
   exit_controls.push_back(fallthrough_control);
 
   // Generate the single "exit" point, where we get if either all map/instance