[crankshaft] Make sure +x is as fast as Number(x).

src/crankshaft/hydrogen.cc

 // Copyright 2013 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/crankshaft/hydrogen.h"
 
 #include <sstream>
 
 #include "src/allocation-site-scopes.h"
 #include "src/ast/ast-numbering.h"
@@ skipping 2039 matching lines @@
     Push(Add<HCallRuntime>(
             Runtime::FunctionForId(Runtime::kNumberToStringSkipCache),
             1));
   }
   if_found.End();
 
   return Pop();
 }
 
 
+HValue* HGraphBuilder::BuildToNumber(HValue* input, Type* input_type) {
+  if (input->type().IsTaggedNumber() || input_type->Is(Type::Number())) {
+    return input;
+  }
+  Callable callable = CodeFactory::ToNumber(isolate());
+  HValue* stub = Add<HConstant>(callable.code());
+  HValue* values[] = {context(), input};
+  HCallWithDescriptor* instr =
+      Add<HCallWithDescriptor>(stub, 0, callable.descriptor(),
+                               Vector<HValue*>(values, arraysize(values)));
+  instr->set_type(HType::TaggedNumber());
+  return instr;
+}
+
+
 HValue* HGraphBuilder::BuildToObject(HValue* receiver) {
   NoObservableSideEffectsScope scope(this);
 
   // Create a joinable continuation.
   HIfContinuation wrap(graph()->CreateBasicBlock(),
                        graph()->CreateBasicBlock());
 
   // Determine the proper global constructor function required to wrap
   // {receiver} into a JSValue, unless {receiver} is already a {JSReceiver}, in
   // which case we just return it.  Deopts to Runtime::kToObject if {receiver}
@@ skipping 9061 matching lines @@
            ConsString::kMinLength)) {
       return BuildStringAdd(left, right, allocation_mode);
     }
 
     // Fallback to using the string add stub.
     return AddUncasted<HStringAdd>(
         left, right, allocation_mode.GetPretenureMode(), STRING_ADD_CHECK_NONE,
         allocation_mode.feedback_site());
   }
 
+  // Special case for +x here.
+  if (op == Token::MUL) {
+    if (left->EqualsInteger32Constant(1)) {
+      return BuildToNumber(right, right_type);

[Jakob Kummerow, 2016/03/02 15:06:18]

You can't trust |right_type| and |left_type| at this point because they may have
been modified by the calls in lines 11071/11072 above. So |BuildToNumber()| will
erroneously take the |input_type->Is(Type::Number())| branch and not do anything
(see crbug.com/590989).

[Benedikt Meurer, 2016/03/02 18:35:23]

Crankshaft...

+    }
+    if (right->EqualsInteger32Constant(1)) {
+      return BuildToNumber(left, left_type);
+    }
+  }
+
   if (graph()->info()->IsStub()) {
     left = EnforceNumberType(left, left_type);
     right = EnforceNumberType(right, right_type);
   }
 
   Representation result_rep = RepresentationFor(result_type);
 
   bool is_non_primitive = (left_rep.IsTagged() && !left_rep.IsSmi()) ||
                           (right_rep.IsTagged() && !right_rep.IsSmi());
 
@@ skipping 1204 matching lines @@
                                Vector<HValue*>(values, arraysize(values)));
   return ast_context()->ReturnInstruction(result, call->id());
 }
 
 
 void HOptimizedGraphBuilder::GenerateToNumber(CallRuntime* call) {
   DCHECK_EQ(1, call->arguments()->length());
   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
   Callable callable = CodeFactory::ToNumber(isolate());
   HValue* input = Pop();
-  if (input->type().IsTaggedNumber()) {
-    return ast_context()->ReturnValue(input);
-  } else {
-    HValue* stub = Add<HConstant>(callable.code());
-    HValue* values[] = {context(), input};
-    HInstruction* result =
-        New<HCallWithDescriptor>(stub, 0, callable.descriptor(),
-                                 Vector<HValue*>(values, arraysize(values)));
-    return ast_context()->ReturnInstruction(result, call->id());
+  Type* input_type = Type::Any();
+  HValue* result = BuildToNumber(input, input_type);
+  if (result->HasObservableSideEffects()) {
+    if (!ast_context()->IsEffect()) Push(result);
+    Add<HSimulate>(call->id(), REMOVABLE_SIMULATE);
+    if (!ast_context()->IsEffect()) result = Pop();
   }
+  return ast_context()->ReturnValue(result);
 }
 
 
 void HOptimizedGraphBuilder::GenerateIsJSProxy(CallRuntime* call) {
   DCHECK(call->arguments()->length() == 1);
   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
   HValue* value = Pop();
   HIfContinuation continuation;
   IfBuilder if_proxy(this);
 
@@ skipping 1153 matching lines @@
     isolate()->GetHTracer()->TraceHydrogen(name(), graph_);
   }
 
 #ifdef DEBUG
   graph_->Verify(false);  // No full verify.
 #endif
 }
 
 }  // namespace internal
 }  // namespace v8