[turbofan] Initial version of number type feedback.

[turbofan] Initial version of number type feedback.

This introduces optimized number operations based on type feedback.

Summary of changes:

1. Typed lowering produces SpeculativeNumberAdd/Subtract for JSAdd/Subtract if
   there is suitable feedback. The speculative nodes are connected to both the
   effect chain and the control chain and they retain the eager frame state.

2. Simplified lowering now executes in three phases:
  a. Propagation phase computes truncations by traversing the graph from uses to
     definitions until checkpoint is reached. It also records type-check decisions
     for later typing phase, and computes representation.
  b. The typing phase computes more precise types base on the speculative types (and recomputes
     representation for affected nodes).
  c. The lowering phase performs lowering and inserts representation changes and/or checks.

3. Effect-control linearization lowers the checks to machine graphs.

Notes:

- SimplifiedLowering will be refactored to have handling of each operation one place and
  with clearer input/output protocol for each sub-phase. I would prefer to do this once
  we have more operations implemented, and the pattern is clearer.

- The check operations (Checked<A>To<B>) should have some flags that would affect
  the kind of truncations that they can handle. E.g., if we know that a node produces
  a number, we can omit the oddball check in the CheckedTaggedToFloat64 lowering.

- In future, we want the typer to reuse the logic from OperationTyper.

BUG=v8:4583
LOG=n

Committed: https://crrev.com/216bcf9fb3cd1e24e06d594c5f6a2ebfdcf37d1c
Cr-Commit-Position: refs/heads/master@{#36674}

[Jarin, 2016-05-30 11:58:31]

Description was changed from

==========
[turbofan] Initial version of number type feedback.
==========

to

==========
[turbofan] Initial version of number type feedback.

This introduces optimized number operations based on type feedback.

Summary of changes:

1. Typed lowering produces SpeculativeNumberAdd/Subtract for JSAdd/Subtract if
there is suitable feedback. The speculative nodes are connected to both the
effect chain and the control chain and they retain the eager frame state.

2. Simplified lowering now executes in three phases:
  a. Propagation phase computes truncations by traversing the graph from uses to

     definitions until checkpoint is reached. It also records type-check
decisions
     for later typing phase, and computes representation.
  b. The typing phase computes more precise types base on the speculative types
(and recomputes
     representation for affected nodes.
  c. The lowering phase performs lowering and inserts representation changes
and/or checks.
 
3. Effect-control linearization lowers the checks to machine graphs.

Notes:

- SimplifiedLowering will be refactored to have handling of each operation one
place and
  with clearer input/output protocol. I would prefer to do this once we have
more operations
  implemented, and pattern is clearer.

- The check operations (Checked<A>To<B>) should have some flags that would
affect
  the kind of truncations that we can handle. E.g., if we know that a node
produces 
  a number, we can omit the oddball check in the CheckedTaggedToFloat64
lowering.

- In future, we want the the typer reuse the logic from OperationTyper.
==========

[Jarin, 2016-05-30 11:58:57]

Description was changed from

==========
[turbofan] Initial version of number type feedback.

This introduces optimized number operations based on type feedback.

Summary of changes:

1. Typed lowering produces SpeculativeNumberAdd/Subtract for JSAdd/Subtract if
there is suitable feedback. The speculative nodes are connected to both the
effect chain and the control chain and they retain the eager frame state.

2. Simplified lowering now executes in three phases:
  a. Propagation phase computes truncations by traversing the graph from uses to

     definitions until checkpoint is reached. It also records type-check
decisions
     for later typing phase, and computes representation.
  b. The typing phase computes more precise types base on the speculative types
(and recomputes
     representation for affected nodes.
  c. The lowering phase performs lowering and inserts representation changes
and/or checks.
 
3. Effect-control linearization lowers the checks to machine graphs.

Notes:

- SimplifiedLowering will be refactored to have handling of each operation one
place and
  with clearer input/output protocol. I would prefer to do this once we have
more operations
  implemented, and pattern is clearer.

- The check operations (Checked<A>To<B>) should have some flags that would
affect
  the kind of truncations that we can handle. E.g., if we know that a node
produces 
  a number, we can omit the oddball check in the CheckedTaggedToFloat64
lowering.

- In future, we want the the typer reuse the logic from OperationTyper.
==========

to

==========
[turbofan] Initial version of number type feedback.

This introduces optimized number operations based on type feedback.

Summary of changes:

1. Typed lowering produces SpeculativeNumberAdd/Subtract for JSAdd/Subtract if
   there is suitable feedback. The speculative nodes are connected to both the
   effect chain and the control chain and they retain the eager frame state.

2. Simplified lowering now executes in three phases:
  a. Propagation phase computes truncations by traversing the graph from uses to

     definitions until checkpoint is reached. It also records type-check
decisions
     for later typing phase, and computes representation.
  b. The typing phase computes more precise types base on the speculative types
(and recomputes
     representation for affected nodes.
  c. The lowering phase performs lowering and inserts representation changes
and/or checks.
 
3. Effect-control linearization lowers the checks to machine graphs.

Notes:

- SimplifiedLowering will be refactored to have handling of each operation one
place and
  with clearer input/output protocol. I would prefer to do this once we have
more operations
  implemented, and pattern is clearer.

- The check operations (Checked<A>To<B>) should have some flags that would
affect
  the kind of truncations that we can handle. E.g., if we know that a node
produces 
  a number, we can omit the oddball check in the CheckedTaggedToFloat64
lowering.

- In future, we want the the typer reuse the logic from OperationTyper.
==========

[Jarin, 2016-05-30 11:59:51]

Description was changed from

==========
[turbofan] Initial version of number type feedback.

This introduces optimized number operations based on type feedback.

Summary of changes:

1. Typed lowering produces SpeculativeNumberAdd/Subtract for JSAdd/Subtract if
   there is suitable feedback. The speculative nodes are connected to both the
   effect chain and the control chain and they retain the eager frame state.

2. Simplified lowering now executes in three phases:
  a. Propagation phase computes truncations by traversing the graph from uses to

     definitions until checkpoint is reached. It also records type-check
decisions
     for later typing phase, and computes representation.
  b. The typing phase computes more precise types base on the speculative types
(and recomputes
     representation for affected nodes.
  c. The lowering phase performs lowering and inserts representation changes
and/or checks.
 
3. Effect-control linearization lowers the checks to machine graphs.

Notes:

- SimplifiedLowering will be refactored to have handling of each operation one
place and
  with clearer input/output protocol. I would prefer to do this once we have
more operations
  implemented, and pattern is clearer.

- The check operations (Checked<A>To<B>) should have some flags that would
affect
  the kind of truncations that we can handle. E.g., if we know that a node
produces 
  a number, we can omit the oddball check in the CheckedTaggedToFloat64
lowering.

- In future, we want the the typer reuse the logic from OperationTyper.
==========

to

==========
[turbofan] Initial version of number type feedback.

This introduces optimized number operations based on type feedback.

Summary of changes:

1. Typed lowering produces SpeculativeNumberAdd/Subtract for JSAdd/Subtract if
   there is suitable feedback. The speculative nodes are connected to both the
   effect chain and the control chain and they retain the eager frame state.

2. Simplified lowering now executes in three phases:
  a. Propagation phase computes truncations by traversing the graph from uses to

     definitions until checkpoint is reached. It also records type-check
decisions
     for later typing phase, and computes representation.
  b. The typing phase computes more precise types base on the speculative types
(and recomputes
     representation for affected nodes.
  c. The lowering phase performs lowering and inserts representation changes
and/or checks.
 
3. Effect-control linearization lowers the checks to machine graphs.

Notes:

- SimplifiedLowering will be refactored to have handling of each operation one
place and
  with clearer input/output protocol for each sub-phase. I would prefer to do
this once 
  we have more operations implemented, and pattern is clearer.

- The check operations (Checked<A>To<B>) should have some flags that would
affect
  the kind of truncations that we can handle. E.g., if we know that a node
produces 
  a number, we can omit the oddball check in the CheckedTaggedToFloat64
lowering.

- In future, we want the the typer reuse the logic from OperationTyper.
==========

[Jarin, 2016-05-30 12:00:56]

Description was changed from

==========
[turbofan] Initial version of number type feedback.

This introduces optimized number operations based on type feedback.

Summary of changes:

1. Typed lowering produces SpeculativeNumberAdd/Subtract for JSAdd/Subtract if
   there is suitable feedback. The speculative nodes are connected to both the
   effect chain and the control chain and they retain the eager frame state.

2. Simplified lowering now executes in three phases:
  a. Propagation phase computes truncations by traversing the graph from uses to

     definitions until checkpoint is reached. It also records type-check
decisions
     for later typing phase, and computes representation.
  b. The typing phase computes more precise types base on the speculative types
(and recomputes
     representation for affected nodes.
  c. The lowering phase performs lowering and inserts representation changes
and/or checks.
 
3. Effect-control linearization lowers the checks to machine graphs.

Notes:

- SimplifiedLowering will be refactored to have handling of each operation one
place and
  with clearer input/output protocol for each sub-phase. I would prefer to do
this once 
  we have more operations implemented, and pattern is clearer.

- The check operations (Checked<A>To<B>) should have some flags that would
affect
  the kind of truncations that we can handle. E.g., if we know that a node
produces 
  a number, we can omit the oddball check in the CheckedTaggedToFloat64
lowering.

- In future, we want the the typer reuse the logic from OperationTyper.
==========

to

==========
[turbofan] Initial version of number type feedback.

This introduces optimized number operations based on type feedback.

Summary of changes:

1. Typed lowering produces SpeculativeNumberAdd/Subtract for JSAdd/Subtract if
   there is suitable feedback. The speculative nodes are connected to both the
   effect chain and the control chain and they retain the eager frame state.

2. Simplified lowering now executes in three phases:
  a. Propagation phase computes truncations by traversing the graph from uses to

     definitions until checkpoint is reached. It also records type-check
decisions
     for later typing phase, and computes representation.
  b. The typing phase computes more precise types base on the speculative types
(and recomputes
     representation for affected nodes.
  c. The lowering phase performs lowering and inserts representation changes
and/or checks.
 
3. Effect-control linearization lowers the checks to machine graphs.

Notes:

- SimplifiedLowering will be refactored to have handling of each operation one
place and
  with clearer input/output protocol for each sub-phase. I would prefer to do
this once 
  we have more operations implemented, and the pattern is clearer.

- The check operations (Checked<A>To<B>) should have some flags that would
affect
  the kind of truncations that they can handle. E.g., if we know that a node
produces 
  a number, we can omit the oddball check in the CheckedTaggedToFloat64
lowering.

- In future, we want the typer to reuse the logic from OperationTyper.
==========

[Jarin, 2016-05-30 12:01:37]

Description was changed from

==========
[turbofan] Initial version of number type feedback.

This introduces optimized number operations based on type feedback.

Summary of changes:

1. Typed lowering produces SpeculativeNumberAdd/Subtract for JSAdd/Subtract if
   there is suitable feedback. The speculative nodes are connected to both the
   effect chain and the control chain and they retain the eager frame state.

2. Simplified lowering now executes in three phases:
  a. Propagation phase computes truncations by traversing the graph from uses to

     definitions until checkpoint is reached. It also records type-check
decisions
     for later typing phase, and computes representation.
  b. The typing phase computes more precise types base on the speculative types
(and recomputes
     representation for affected nodes.
  c. The lowering phase performs lowering and inserts representation changes
and/or checks.
 
3. Effect-control linearization lowers the checks to machine graphs.

Notes:

- SimplifiedLowering will be refactored to have handling of each operation one
place and
  with clearer input/output protocol for each sub-phase. I would prefer to do
this once 
  we have more operations implemented, and the pattern is clearer.

- The check operations (Checked<A>To<B>) should have some flags that would
affect
  the kind of truncations that they can handle. E.g., if we know that a node
produces 
  a number, we can omit the oddball check in the CheckedTaggedToFloat64
lowering.

- In future, we want the typer to reuse the logic from OperationTyper.
==========

to

==========
[turbofan] Initial version of number type feedback.

This introduces optimized number operations based on type feedback.

Summary of changes:

1. Typed lowering produces SpeculativeNumberAdd/Subtract for JSAdd/Subtract if
   there is suitable feedback. The speculative nodes are connected to both the
   effect chain and the control chain and they retain the eager frame state.

2. Simplified lowering now executes in three phases:
  a. Propagation phase computes truncations by traversing the graph from uses to

     definitions until checkpoint is reached. It also records type-check
decisions
     for later typing phase, and computes representation.
  b. The typing phase computes more precise types base on the speculative types
(and recomputes
     representation for affected nodes).
  c. The lowering phase performs lowering and inserts representation changes
and/or checks.
 
3. Effect-control linearization lowers the checks to machine graphs.

Notes:

- SimplifiedLowering will be refactored to have handling of each operation one
place and
  with clearer input/output protocol for each sub-phase. I would prefer to do
this once 
  we have more operations implemented, and the pattern is clearer.

- The check operations (Checked<A>To<B>) should have some flags that would
affect
  the kind of truncations that they can handle. E.g., if we know that a node
produces 
  a number, we can omit the oddball check in the CheckedTaggedToFloat64
lowering.

- In future, we want the typer to reuse the logic from OperationTyper.
==========

[Jarin, 2016-05-30 12:03:04]

Description was changed from

==========
[turbofan] Initial version of number type feedback.

This introduces optimized number operations based on type feedback.

Summary of changes:

1. Typed lowering produces SpeculativeNumberAdd/Subtract for JSAdd/Subtract if
   there is suitable feedback. The speculative nodes are connected to both the
   effect chain and the control chain and they retain the eager frame state.

2. Simplified lowering now executes in three phases:
  a. Propagation phase computes truncations by traversing the graph from uses to

     definitions until checkpoint is reached. It also records type-check
decisions
     for later typing phase, and computes representation.
  b. The typing phase computes more precise types base on the speculative types
(and recomputes
     representation for affected nodes).
  c. The lowering phase performs lowering and inserts representation changes
and/or checks.
 
3. Effect-control linearization lowers the checks to machine graphs.

Notes:

- SimplifiedLowering will be refactored to have handling of each operation one
place and
  with clearer input/output protocol for each sub-phase. I would prefer to do
this once 
  we have more operations implemented, and the pattern is clearer.

- The check operations (Checked<A>To<B>) should have some flags that would
affect
  the kind of truncations that they can handle. E.g., if we know that a node
produces 
  a number, we can omit the oddball check in the CheckedTaggedToFloat64
lowering.

- In future, we want the typer to reuse the logic from OperationTyper.
==========

to

==========
[turbofan] Initial version of number type feedback.

This introduces optimized number operations based on type feedback.

Summary of changes:

1. Typed lowering produces SpeculativeNumberAdd/Subtract for JSAdd/Subtract if
   there is suitable feedback. The speculative nodes are connected to both the
   effect chain and the control chain and they retain the eager frame state.

2. Simplified lowering now executes in three phases:
  a. Propagation phase computes truncations by traversing the graph from uses to

     definitions until checkpoint is reached. It also records type-check
decisions
     for later typing phase, and computes representation.
  b. The typing phase computes more precise types base on the speculative types
(and recomputes
     representation for affected nodes).
  c. The lowering phase performs lowering and inserts representation changes
and/or checks.
 
3. Effect-control linearization lowers the checks to machine graphs.

Notes:

- SimplifiedLowering will be refactored to have handling of each operation one
place and
  with clearer input/output protocol for each sub-phase. I would prefer to do
this once 
  we have more operations implemented, and the pattern is clearer.

- The check operations (Checked<A>To<B>) should have some flags that would
affect
  the kind of truncations that they can handle. E.g., if we know that a node
produces 
  a number, we can omit the oddball check in the CheckedTaggedToFloat64
lowering.

- In future, we want the typer to reuse the logic from OperationTyper.

BUG=v8:4583
LOG=n
==========

[Jarin, 2016-05-30 12:03:04]

jarin@chromium.org changed reviewers:
+ bmeurer@chromium.org

[Jarin, 2016-05-30 12:06:43]

Benedikt, could you start looking at this? I am sure there will be some
discussion, but I am quite happy with the high-level structure of this.

I am working on an mjsunit test so that there is some coverage at least for the
compiler (if not for the generated code).

[Benedikt Meurer, 2016-05-30 18:39:51]

First round of comments. My mind just exploded while reviewing
SimplifiedLowering and RepresentationChange, so more on that tomorrow.

https://codereview.chromium.org/1921563002/diff/120001/src/compiler/effect-co...
File src/compiler/effect-control-linearizer.cc (right):

https://codereview.chromium.org/1921563002/diff/120001/src/compiler/effect-co...
src/compiler/effect-control-linearizer.cc:860: // TODO(jarin) Truncate undefined
(and null?) here.
This TODO doesn't seem relevant anymore?

https://codereview.chromium.org/1921563002/diff/120001/src/compiler/js-typed-...
File src/compiler/js-typed-lowering.cc (right):

https://codereview.chromium.org/1921563002/diff/120001/src/compiler/js-typed-...
src/compiler/js-typed-lowering.cc:174: Reduction
ChangeToStringComparisonOperator(const Operator* op,
This seems to reintroduce dead code. ChangeToStringComparisonOperator was killed
before.

https://codereview.chromium.org/1921563002/diff/120001/src/compiler/memory-op...
File src/compiler/memory-optimizer.cc (right):

https://codereview.chromium.org/1921563002/diff/120001/src/compiler/memory-op...
src/compiler/memory-optimizer.cc:95: case IrOpcode::kCheckedUint32ToInt32:
These nodes should be lowered long before we get here (in the effect/control
linearization), so they shouldn't be part of this switch.

https://codereview.chromium.org/1921563002/diff/120001/src/compiler/opcodes.h
File src/compiler/opcodes.h (right):

https://codereview.chromium.org/1921563002/diff/120001/src/compiler/opcodes.h...
src/compiler/opcodes.h:325: V(CheckedUint32ToInt32)       \
These should really be simplified operators.

https://codereview.chromium.org/1921563002/diff/120001/src/compiler/operation...
File src/compiler/operation-typer.h (right):

https://codereview.chromium.org/1921563002/diff/120001/src/compiler/operation...
src/compiler/operation-typer.h:22: class OperationTyper {
This is a terrible name... but I don't have a better suggestion right now.

https://codereview.chromium.org/1921563002/diff/120001/src/compiler/pipeline.cc
File src/compiler/pipeline.cc (right):

https://codereview.chromium.org/1921563002/diff/120001/src/compiler/pipeline....
src/compiler/pipeline.cc:885: if (FLAG_turbo_type_feedback) {
Can you add a CompilationInfo flag for this?

https://codereview.chromium.org/1921563002/diff/120001/src/compiler/pipeline....
src/compiler/pipeline.cc:951: FLAG_turbo_type_feedback ?
SimplifiedLowering::kTypeFeedbackEnabled
See comment above.

https://codereview.chromium.org/1921563002/diff/120001/src/compiler/represent...
File src/compiler/representation-change.cc (right):

https://codereview.chromium.org/1921563002/diff/120001/src/compiler/represent...
src/compiler/representation-change.cc:343: op =
simplified()->ChangeTaggedToFloat64();
This should probably be TruncateTaggedToFloat64

[Jarin, 2016-05-31 20:28:53]

https://codereview.chromium.org/1921563002/diff/120001/src/compiler/effect-co...
File src/compiler/effect-control-linearizer.cc (right):

https://codereview.chromium.org/1921563002/diff/120001/src/compiler/effect-co...
src/compiler/effect-control-linearizer.cc:860: // TODO(jarin) Truncate undefined
(and null?) here.
On 2016/05/30 18:39:50, Benedikt Meurer wrote:
> This TODO doesn't seem relevant anymore?

Done.

https://codereview.chromium.org/1921563002/diff/120001/src/compiler/js-typed-...
File src/compiler/js-typed-lowering.cc (right):

https://codereview.chromium.org/1921563002/diff/120001/src/compiler/js-typed-...
src/compiler/js-typed-lowering.cc:174: Reduction
ChangeToStringComparisonOperator(const Operator* op,
On 2016/05/30 18:39:50, Benedikt Meurer wrote:
> This seems to reintroduce dead code. ChangeToStringComparisonOperator was
killed
> before.

Done.

https://codereview.chromium.org/1921563002/diff/120001/src/compiler/memory-op...
File src/compiler/memory-optimizer.cc (right):

https://codereview.chromium.org/1921563002/diff/120001/src/compiler/memory-op...
src/compiler/memory-optimizer.cc:95: case IrOpcode::kCheckedUint32ToInt32:
On 2016/05/30 18:39:50, Benedikt Meurer wrote:
> These nodes should be lowered long before we get here (in the effect/control
> linearization), so they shouldn't be part of this switch.

Done.

https://codereview.chromium.org/1921563002/diff/120001/src/compiler/opcodes.h
File src/compiler/opcodes.h (right):

https://codereview.chromium.org/1921563002/diff/120001/src/compiler/opcodes.h...
src/compiler/opcodes.h:325: V(CheckedUint32ToInt32)       \
On 2016/05/30 18:39:50, Benedikt Meurer wrote:
> These should really be simplified operators.

Done.

https://codereview.chromium.org/1921563002/diff/120001/src/compiler/pipeline.cc
File src/compiler/pipeline.cc (right):

https://codereview.chromium.org/1921563002/diff/120001/src/compiler/pipeline....
src/compiler/pipeline.cc:885: if (FLAG_turbo_type_feedback) {
On 2016/05/30 18:39:50, Benedikt Meurer wrote:
> Can you add a CompilationInfo flag for this?

Done.

https://codereview.chromium.org/1921563002/diff/120001/src/compiler/represent...
File src/compiler/representation-change.cc (right):

https://codereview.chromium.org/1921563002/diff/120001/src/compiler/represent...
src/compiler/representation-change.cc:343: op =
simplified()->ChangeTaggedToFloat64();
On 2016/05/30 18:39:50, Benedikt Meurer wrote:
> This should probably be TruncateTaggedToFloat64

Done in https://codereview.chromium.org/2027593002/

[Benedikt Meurer, 2016-06-02 08:16:00]

The CQ bit was checked by bmeurer@chromium.org

[Benedikt Meurer, 2016-06-02 08:16:01]

lgtm

[commit-bot: I haz the power, 2016-06-02 08:16:08]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/1921563002/200001
View timeline at
 https://chromium-cq-status.appspot.com/patch-timeline/1921563002/200001

[Jarin, 2016-06-02 08:32:03]

The CQ bit was checked by jarin@chromium.org

[Jarin, 2016-06-02 08:32:04]

The patchset sent to the CQ was uploaded after l-g-t-m from bmeurer@chromium.org
Link to the patchset: https://codereview.chromium.org/1921563002/#ps220001
(title: "Rebase")

[commit-bot: I haz the power, 2016-06-02 08:32:12]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/1921563002/220001
View timeline at
 https://chromium-cq-status.appspot.com/patch-timeline/1921563002/220001

[commit-bot: I haz the power, 2016-06-02 08:49:23]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2016-06-02 08:49:24]

Try jobs failed on following builders:
  v8_linux_nodcheck_rel_ng on tryserver.v8 (JOB_FAILED,
http://build.chromium.org/p/tryserver.v8/builders/v8_linux_nodcheck_rel_ng/bu...)
  v8_linux_nodcheck_rel_ng_triggered on tryserver.v8 (JOB_FAILED,
http://build.chromium.org/p/tryserver.v8/builders/v8_linux_nodcheck_rel_ng_tr...)

[Jarin, 2016-06-02 08:55:59]

The CQ bit was checked by jarin@chromium.org

[Jarin, 2016-06-02 08:55:59]

The patchset sent to the CQ was uploaded after l-g-t-m from bmeurer@chromium.org
Link to the patchset: https://codereview.chromium.org/1921563002/#ps240001
(title: "Rebase")

[commit-bot: I haz the power, 2016-06-02 08:56:02]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/1921563002/240001
View timeline at
 https://chromium-cq-status.appspot.com/patch-timeline/1921563002/240001

[commit-bot: I haz the power, 2016-06-02 09:20:55]

Description was changed from

==========
[turbofan] Initial version of number type feedback.

This introduces optimized number operations based on type feedback.

Summary of changes:

1. Typed lowering produces SpeculativeNumberAdd/Subtract for JSAdd/Subtract if
   there is suitable feedback. The speculative nodes are connected to both the
   effect chain and the control chain and they retain the eager frame state.

2. Simplified lowering now executes in three phases:
  a. Propagation phase computes truncations by traversing the graph from uses to

     definitions until checkpoint is reached. It also records type-check
decisions
     for later typing phase, and computes representation.
  b. The typing phase computes more precise types base on the speculative types
(and recomputes
     representation for affected nodes).
  c. The lowering phase performs lowering and inserts representation changes
and/or checks.
 
3. Effect-control linearization lowers the checks to machine graphs.

Notes:

- SimplifiedLowering will be refactored to have handling of each operation one
place and
  with clearer input/output protocol for each sub-phase. I would prefer to do
this once 
  we have more operations implemented, and the pattern is clearer.

- The check operations (Checked<A>To<B>) should have some flags that would
affect
  the kind of truncations that they can handle. E.g., if we know that a node
produces 
  a number, we can omit the oddball check in the CheckedTaggedToFloat64
lowering.

- In future, we want the typer to reuse the logic from OperationTyper.

BUG=v8:4583
LOG=n
==========

to

==========
[turbofan] Initial version of number type feedback.

This introduces optimized number operations based on type feedback.

Summary of changes:

1. Typed lowering produces SpeculativeNumberAdd/Subtract for JSAdd/Subtract if
   there is suitable feedback. The speculative nodes are connected to both the
   effect chain and the control chain and they retain the eager frame state.

2. Simplified lowering now executes in three phases:
  a. Propagation phase computes truncations by traversing the graph from uses to

     definitions until checkpoint is reached. It also records type-check
decisions
     for later typing phase, and computes representation.
  b. The typing phase computes more precise types base on the speculative types
(and recomputes
     representation for affected nodes).
  c. The lowering phase performs lowering and inserts representation changes
and/or checks.
 
3. Effect-control linearization lowers the checks to machine graphs.

Notes:

- SimplifiedLowering will be refactored to have handling of each operation one
place and
  with clearer input/output protocol for each sub-phase. I would prefer to do
this once 
  we have more operations implemented, and the pattern is clearer.

- The check operations (Checked<A>To<B>) should have some flags that would
affect
  the kind of truncations that they can handle. E.g., if we know that a node
produces 
  a number, we can omit the oddball check in the CheckedTaggedToFloat64
lowering.

- In future, we want the typer to reuse the logic from OperationTyper.

BUG=v8:4583
LOG=n
==========

[commit-bot: I haz the power, 2016-06-02 09:20:57]

Committed patchset #13 (id:240001)

[commit-bot: I haz the power, 2016-06-02 09:23:21]

Description was changed from

==========
[turbofan] Initial version of number type feedback.

This introduces optimized number operations based on type feedback.

Summary of changes:

1. Typed lowering produces SpeculativeNumberAdd/Subtract for JSAdd/Subtract if
   there is suitable feedback. The speculative nodes are connected to both the
   effect chain and the control chain and they retain the eager frame state.

2. Simplified lowering now executes in three phases:
  a. Propagation phase computes truncations by traversing the graph from uses to

     definitions until checkpoint is reached. It also records type-check
decisions
     for later typing phase, and computes representation.
  b. The typing phase computes more precise types base on the speculative types
(and recomputes
     representation for affected nodes).
  c. The lowering phase performs lowering and inserts representation changes
and/or checks.
 
3. Effect-control linearization lowers the checks to machine graphs.

Notes:

- SimplifiedLowering will be refactored to have handling of each operation one
place and
  with clearer input/output protocol for each sub-phase. I would prefer to do
this once 
  we have more operations implemented, and the pattern is clearer.

- The check operations (Checked<A>To<B>) should have some flags that would
affect
  the kind of truncations that they can handle. E.g., if we know that a node
produces 
  a number, we can omit the oddball check in the CheckedTaggedToFloat64
lowering.

- In future, we want the typer to reuse the logic from OperationTyper.

BUG=v8:4583
LOG=n
==========

to

==========
[turbofan] Initial version of number type feedback.

This introduces optimized number operations based on type feedback.

Summary of changes:

1. Typed lowering produces SpeculativeNumberAdd/Subtract for JSAdd/Subtract if
   there is suitable feedback. The speculative nodes are connected to both the
   effect chain and the control chain and they retain the eager frame state.

2. Simplified lowering now executes in three phases:
  a. Propagation phase computes truncations by traversing the graph from uses to
     definitions until checkpoint is reached. It also records type-check
decisions
     for later typing phase, and computes representation.
  b. The typing phase computes more precise types base on the speculative types
(and recomputes
     representation for affected nodes).
  c. The lowering phase performs lowering and inserts representation changes
and/or checks.

3. Effect-control linearization lowers the checks to machine graphs.

Notes:

- SimplifiedLowering will be refactored to have handling of each operation one
place and
  with clearer input/output protocol for each sub-phase. I would prefer to do
this once
  we have more operations implemented, and the pattern is clearer.

- The check operations (Checked<A>To<B>) should have some flags that would
affect
  the kind of truncations that they can handle. E.g., if we know that a node
produces
  a number, we can omit the oddball check in the CheckedTaggedToFloat64
lowering.

- In future, we want the typer to reuse the logic from OperationTyper.

BUG=v8:4583
LOG=n

Committed: https://crrev.com/216bcf9fb3cd1e24e06d594c5f6a2ebfdcf37d1c
Cr-Commit-Position: refs/heads/master@{#36674}
==========

[commit-bot: I haz the power, 2016-06-02 09:23:22]

Patchset 13 (id:??) landed as
https://crrev.com/216bcf9fb3cd1e24e06d594c5f6a2ebfdcf37d1c
Cr-Commit-Position: refs/heads/master@{#36674}