[turbofan] Add support for named access to Number primitives.

src/compiler/js-native-context-specialization.cc

 // Copyright 2015 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/compiler/js-native-context-specialization.h"
 
 #include "src/accessors.h"
 #include "src/code-factory.h"
 #include "src/compilation-dependencies.h"
 #include "src/compiler/access-builder.h"
@@ skipping 336 matching lines @@
     Node* check = graph()->NewNode(simplified()->ReferenceEqual(Type::Name()),
                                    index, jsgraph()->HeapConstant(name));
     Node* branch =
         graph()->NewNode(common()->Branch(BranchHint::kTrue), check, control);
     exit_controls.push_back(graph()->NewNode(common()->IfFalse(), branch));
     control = graph()->NewNode(common()->IfTrue(), branch);
   }
 
   // Ensure that {receiver} is a heap object.
   Node* check = graph()->NewNode(simplified()->ObjectIsSmi(), receiver);
-  Node* branch =
-      graph()->NewNode(common()->Branch(BranchHint::kFalse), check, control);
-  exit_controls.push_back(graph()->NewNode(common()->IfTrue(), branch));
+  Node* branch = graph()->NewNode(common()->Branch(), check, control);
   control = graph()->NewNode(common()->IfFalse(), branch);
+  Node* receiverissmi_control = graph()->NewNode(common()->IfTrue(), branch);
+  Node* receiverissmi_effect = effect;
 
   // Load the {receiver} map. The resulting effect is the dominating effect for
   // all (polymorphic) branches.
   Node* receiver_map = effect =
       graph()->NewNode(simplified()->LoadField(AccessBuilder::ForMap()),
                        receiver, effect, control);
 
   // Generate code for the various different property access patterns.
   Node* fallthrough_control = control;
   for (PropertyAccessInfo const& access_info : access_infos) {
@@ skipping 10 matching lines @@
           simplified()->LoadField(AccessBuilder::ForMapInstanceType()),
           receiver_map, this_effect, fallthrough_control);
       Node* check =
           graph()->NewNode(machine()->Uint32LessThan(), receiver_instance_type,
                            jsgraph()->Uint32Constant(FIRST_NONSTRING_TYPE));
       Node* branch =
           graph()->NewNode(common()->Branch(), check, fallthrough_control);
       fallthrough_control = graph()->NewNode(common()->IfFalse(), branch);
       this_control = graph()->NewNode(common()->IfTrue(), branch);
     } else {
-      // Emit a (sequence of) map checks for other properties.
+      // Emit a (sequence of) map checks for other {receiver}s.
       ZoneVector<Node*> this_controls(zone());
+      ZoneVector<Node*> this_effects(zone());
       for (auto i = access_info.receiver_type()->Classes(); !i.Done();
            i.Advance()) {
         Handle<Map> map = i.Current();
         Node* check =
             graph()->NewNode(simplified()->ReferenceEqual(Type::Internal()),
                              receiver_map, jsgraph()->Constant(map));
         Node* branch =
             graph()->NewNode(common()->Branch(), check, fallthrough_control);
+        fallthrough_control = graph()->NewNode(common()->IfFalse(), branch);
         this_controls.push_back(graph()->NewNode(common()->IfTrue(), branch));
-        fallthrough_control = graph()->NewNode(common()->IfFalse(), branch);
+        this_effects.push_back(this_effect);
       }
+
+      // The Number case requires special treatment to also deal with Smis.
+      if (receiver_type->Is(Type::Number())) {
+        // Join this check with the "receiver is smi" check above, and mark the
+        // "receiver is smi" check as "consumed" so that we don't deoptimize if
+        // the {receiver} is actually a Smi.
+        if (receiverissmi_control != nullptr) {
+          this_controls.push_back(receiverissmi_control);
+          this_effects.push_back(receiverissmi_effect);
+          receiverissmi_control = receiverissmi_effect = nullptr;
+        }
+      }
+
+      // Create dominating Merge+EffectPhi for this {receiver} type.
       int const this_control_count = static_cast<int>(this_controls.size());
       this_control =
           (this_control_count == 1)
               ? this_controls.front()
               : graph()->NewNode(common()->Merge(this_control_count),
                                  this_control_count, &this_controls.front());
+      this_effects.push_back(this_control);
+      int const this_effect_count = static_cast<int>(this_effects.size());
+      this_effect =
+          (this_control_count == 1)
+              ? this_effects.front()
+              : graph()->NewNode(common()->EffectPhi(this_control_count),
+                                 this_effect_count, &this_effects.front());
     }
 
     // Determine actual holder and perform prototype chain checks.
     Handle<JSObject> holder;
     if (access_info.holder().ToHandle(&holder)) {
       AssumePrototypesStable(receiver_type, holder);
     }
 
     // Generate the actual property access.
     if (access_info.IsNotFound()) {
@@ skipping 157 matching lines @@
 
     // Remember the final state for this property access.
     values.push_back(this_value);
     effects.push_back(this_effect);
     controls.push_back(this_control);
   }
 
   // Collect the fallthrough control as final "exit" control.
   if (fallthrough_control != control) {
     // Mark the last fallthrough branch as deferred.
-    Node* branch = NodeProperties::GetControlInput(fallthrough_control);
-    DCHECK_EQ(IrOpcode::kBranch, branch->opcode());
-    if (fallthrough_control->opcode() == IrOpcode::kIfTrue) {
-      NodeProperties::ChangeOp(branch, common()->Branch(BranchHint::kFalse));
-    } else {
-      DCHECK_EQ(IrOpcode::kIfFalse, fallthrough_control->opcode());
-      NodeProperties::ChangeOp(branch, common()->Branch(BranchHint::kTrue));
-    }
+    MarkAsDeferred(fallthrough_control);
   }
   exit_controls.push_back(fallthrough_control);
 
+  // Also collect the "receiver is smi" control if we didn't handle the case of
+  // Number primitives in the polymorphic branches above.
+  if (receiverissmi_control != nullptr) {
+    // Mark the "receiver is smi" case as deferred.
+    MarkAsDeferred(receiverissmi_control);
+    DCHECK_EQ(exit_effect, receiverissmi_effect);
+    exit_controls.push_back(receiverissmi_control);
+  }
+
   // Generate the single "exit" point, where we get if either all map/instance
   // type checks failed, or one of the assumptions inside one of the cases
   // failes (i.e. failing prototype chain check).
   // TODO(bmeurer): Consider falling back to IC here if deoptimization is
   // disabled.
   int const exit_control_count = static_cast<int>(exit_controls.size());
   Node* exit_control =
       (exit_control_count == 1)
           ? exit_controls.front()
           : graph()->NewNode(common()->Merge(exit_control_count),
@@ skipping 261 matching lines @@
 
     // Remember the final state for this element access.
     values.push_back(this_value);
     effects.push_back(this_effect);
     controls.push_back(this_control);
   }
 
   // Collect the fallthrough control as final "exit" control.
   if (fallthrough_control != control) {
     // Mark the last fallthrough branch as deferred.
-    Node* branch = NodeProperties::GetControlInput(fallthrough_control);
-    DCHECK_EQ(IrOpcode::kBranch, branch->opcode());
-    if (fallthrough_control->opcode() == IrOpcode::kIfTrue) {
-      NodeProperties::ChangeOp(branch, common()->Branch(BranchHint::kFalse));
-    } else {
-      DCHECK_EQ(IrOpcode::kIfFalse, fallthrough_control->opcode());
-      NodeProperties::ChangeOp(branch, common()->Branch(BranchHint::kTrue));
-    }
+    MarkAsDeferred(fallthrough_control);
   }
   exit_controls.push_back(fallthrough_control);
 
   // Generate the single "exit" point, where we get if either all map/instance
   // type checks failed, or one of the assumptions inside one of the cases
   // failes (i.e. failing prototype chain check).
   // TODO(bmeurer): Consider falling back to IC here if deoptimization is
   // disabled.
   int const exit_control_count = static_cast<int>(exit_controls.size());
   Node* exit_control =
@@ skipping 149 matching lines @@
       Handle<JSReceiver> const prototype =
           PrototypeIterator::GetCurrent<JSReceiver>(j);
       dependencies()->AssumeMapStable(handle(prototype->map(), isolate()));
       // Stop once we get to the holder.
       if (prototype.is_identical_to(holder)) break;
     }
   }
 }
 
 
+void JSNativeContextSpecialization::MarkAsDeferred(Node* if_projection) {
+  Node* branch = NodeProperties::GetControlInput(if_projection);
+  DCHECK_EQ(IrOpcode::kBranch, branch->opcode());
+  if (if_projection->opcode() == IrOpcode::kIfTrue) {
+    NodeProperties::ChangeOp(branch, common()->Branch(BranchHint::kFalse));
+  } else {
+    DCHECK_EQ(IrOpcode::kIfFalse, if_projection->opcode());
+    NodeProperties::ChangeOp(branch, common()->Branch(BranchHint::kTrue));
+  }
+}
+
+
 Graph* JSNativeContextSpecialization::graph() const {
   return jsgraph()->graph();
 }
 
 
 Isolate* JSNativeContextSpecialization::isolate() const {
   return jsgraph()->isolate();
 }
 
 
@@ skipping 17 matching lines @@
 }
 
 
 SimplifiedOperatorBuilder* JSNativeContextSpecialization::simplified() const {
   return jsgraph()->simplified();
 }
 
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8