[turbofan] Nuke types before entering the concurrent phase.

src/compiler/pipeline.cc

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/compiler/pipeline.h"
 
 #include <fstream>  // NOLINT(readability/streams)
 #include <sstream>
 
 #include "src/base/adapters.h"
@@ skipping 750 matching lines @@
 struct TyperPhase {
   static const char* phase_name() { return "typer"; }
 
   void Run(PipelineData* data, Zone* temp_zone, Typer* typer) {
     NodeVector roots(temp_zone);
     data->jsgraph()->GetCachedNodes(&roots);
     typer->Run(roots);
   }
 };
 
+#ifdef DEBUG
+
+struct UntyperPhase {
+  static const char* phase_name() { return "untyper"; }
+
+  void Run(PipelineData* data, Zone* temp_zone) {
+    class RemoveTypeReducer final : public Reducer {
+     public:
+      Reduction Reduce(Node* node) final {
+        if (NodeProperties::IsTyped(node)) {
+          NodeProperties::RemoveType(node);
+          return Changed(node);
+        }
+        return NoChange();
+      }
+    };
+
+    JSGraphReducer graph_reducer(data->jsgraph(), temp_zone);
+    RemoveTypeReducer remove_type_reducer;
+    AddReducer(data, &graph_reducer, &remove_type_reducer);
+    graph_reducer.ReduceGraph();
+  }
+};
+
+#endif  // DEBUG
 
 struct OsrDeconstructionPhase {
   static const char* phase_name() { return "OSR deconstruction"; }
 
   void Run(PipelineData* data, Zone* temp_zone) {
     OsrHelper osr_helper(data->info());
     osr_helper.Deconstruct(data->jsgraph(), data->common(), temp_zone);
   }
 };
 
@@ skipping 525 matching lines @@
 
   // Remove dead->live edges from the graph.
   Run<EarlyGraphTrimmingPhase>();
   RunPrintAndVerify("Early trimmed", true);
 
   if (FLAG_print_turbo_replay) {
     // Print a replay of the initial graph.
     GraphReplayPrinter::PrintReplay(data->graph());
   }
 
-  // Type the graph.
-  Typer typer(isolate(), data->graph(), info()->is_deoptimization_enabled()
-                                            ? Typer::kDeoptimizationEnabled
-                                            : Typer::kNoFlags,
-              info()->dependencies());
-  Run<TyperPhase>(&typer);
-  RunPrintAndVerify("Typed");
+  // Run the type-sensitive lowerings and optimizations on the graph.
+  {
+    // Type the graph and keep the Typer running on newly created nodes within
+    // this scope; the Typer is automatically unlinked from the Graph once we
+    // leave this scope below.
+    Typer typer(isolate(), data->graph(), info()->is_deoptimization_enabled()
+                                              ? Typer::kDeoptimizationEnabled
+                                              : Typer::kNoFlags,
+                info()->dependencies());
+    Run<TyperPhase>(&typer);
+    RunPrintAndVerify("Typed");
 
-  BeginPhaseKind("lowering");
+    BeginPhaseKind("lowering");
 
-  // Lower JSOperators where we can determine types.
-  Run<TypedLoweringPhase>();
-  RunPrintAndVerify("Lowered typed");
+    // Lower JSOperators where we can determine types.
+    Run<TypedLoweringPhase>();
+    RunPrintAndVerify("Lowered typed");
 
-  if (FLAG_turbo_stress_loop_peeling) {
-    Run<StressLoopPeelingPhase>();
-    RunPrintAndVerify("Loop peeled");
+    if (FLAG_turbo_stress_loop_peeling) {
+      Run<StressLoopPeelingPhase>();
+      RunPrintAndVerify("Loop peeled");
+    }
+
+    if (FLAG_experimental_turbo_escape) {
+      Run<EscapeAnalysisPhase>();
+      RunPrintAndVerify("Escape Analysed");
+    }
+
+    // Select representations.
+    Run<RepresentationSelectionPhase>();
+    RunPrintAndVerify("Representations selected");
+
+    // Run early optimization pass.
+    Run<EarlyOptimizationPhase>();
+    RunPrintAndVerify("Early optimized");
   }
 
-  if (FLAG_experimental_turbo_escape) {
-    Run<EscapeAnalysisPhase>();
-    RunPrintAndVerify("Escape Analysed");
-  }
-
-  // Select representations.
-  Run<RepresentationSelectionPhase>();
-  RunPrintAndVerify("Representations selected");
-
-  // Run early optimization pass.
-  Run<EarlyOptimizationPhase>();
-  RunPrintAndVerify("Early optimized");
+#ifdef DEBUG
+  // From now on it is invalid to look at types on the nodes, because:
+  //
+  //  (a) The remaining passes (might) run concurrent to the main thread and
+  //      therefore must not access the Heap or the Isolate in an uncontrolled
+  //      way (as done by the type system), and
+  //  (b) the types on the nodes might not make sense after representation
+  //      selection due to the way we handle truncations; if we'd want to look
+  //      at types afterwards we'd essentially need to re-type (large portions
+  //      of) the graph.
+  //
+  // In order to catch bugs related to type access after this point we remove
+  // the types from the nodes at this point (currently only in Debug builds).
+  Run<UntyperPhase>();
+  RunPrintAndVerify("Untyped", true);
+#endif
 
   EndPhaseKind();
 
   return true;
 }
 
 bool Pipeline::OptimizeGraph(Linkage* linkage) {
   PipelineData* data = this->data_;
 
   BeginPhaseKind("block building");
@@ skipping 356 matching lines @@
   data->DeleteRegisterAllocationZone();
 }
 
 CompilationInfo* Pipeline::info() const { return data_->info(); }
 
 Isolate* Pipeline::isolate() const { return info()->isolate(); }
 
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8