[turbofan] Remove eager frame state from JSMultiply.

src/compiler/js-typed-lowering.cc

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/code-factory.h"
 #include "src/compilation-dependencies.h"
 #include "src/compiler/access-builder.h"
 #include "src/compiler/js-graph.h"
 #include "src/compiler/js-typed-lowering.h"
 #include "src/compiler/linkage.h"
@@ skipping 16 matching lines @@
   JSBinopReduction(JSTypedLowering* lowering, Node* node)
       : lowering_(lowering), node_(node) {}
 
   BinaryOperationHints::Hint GetNumberBinaryOperationFeedback() {
     if (!(lowering_->flags() & JSTypedLowering::kDeoptimizationEnabled) ||
         !(lowering_->flags() & JSTypedLowering::kTypeFeedbackEnabled)) {
       return BinaryOperationHints::kAny;
     }
     DCHECK_NE(0, node_->op()->ControlOutputCount());
     DCHECK_EQ(1, node_->op()->EffectOutputCount());
-    DCHECK_EQ(2, OperatorProperties::GetFrameStateInputCount(node_->op()));
+    DCHECK_LE(1, OperatorProperties::GetFrameStateInputCount(node_->op()));
     BinaryOperationHints hints = BinaryOperationHintsOf(node_->op());
     BinaryOperationHints::Hint combined = hints.combined();
     if (combined == BinaryOperationHints::kSignedSmall ||
         combined == BinaryOperationHints::kSigned32 ||
         combined == BinaryOperationHints::kNumberOrUndefined) {
       return combined;
     }
     return BinaryOperationHints::kAny;
   }
 
@@ skipping 100 matching lines @@
     DCHECK_EQ(false, OperatorProperties::HasContextInput(op));
     DCHECK_EQ(1, op->ControlInputCount());
     DCHECK_EQ(0, op->ControlOutputCount());
     DCHECK_EQ(0, OperatorProperties::GetFrameStateInputCount(op));
     DCHECK_EQ(2, op->ValueInputCount());
 
     DCHECK_EQ(1, node_->op()->EffectInputCount());
     DCHECK_EQ(1, node_->op()->EffectOutputCount());
     DCHECK_EQ(1, node_->op()->ControlInputCount());
     DCHECK_LT(1, node_->op()->ControlOutputCount());
-    DCHECK_EQ(2, OperatorProperties::GetFrameStateInputCount(node_->op()));
+    DCHECK_LE(1, OperatorProperties::GetFrameStateInputCount(node_->op()));
     DCHECK_EQ(2, node_->op()->ValueInputCount());
 
     // Reconnect the control output to bypass the IfSuccess node and
     // possibly disconnect from the IfException node.
     for (Edge edge : node_->use_edges()) {
       Node* const user = edge.from();
       DCHECK(!user->IsDead());
       if (NodeProperties::IsControlEdge(edge)) {
         if (user->opcode() == IrOpcode::kIfSuccess) {
           user->ReplaceUses(NodeProperties::GetControlInput(node_));
           user->Kill();
         } else {
           DCHECK_EQ(user->opcode(), IrOpcode::kIfException);
           edge.UpdateTo(jsgraph()->Dead());
         }
       }
     }
 
     // Remove both bailout frame states and the context.
-    node_->RemoveInput(NodeProperties::FirstFrameStateIndex(node_) + 1);
+    if (OperatorProperties::GetFrameStateInputCount(node_->op()) == 2) {
+      node_->RemoveInput(NodeProperties::FirstFrameStateIndex(node_) + 1);
+    }
     node_->RemoveInput(NodeProperties::FirstFrameStateIndex(node_));
     node_->RemoveInput(NodeProperties::FirstContextIndex(node_));
 
     NodeProperties::ChangeOp(node_, op);
 
     // Update the type to number.
     Type* node_type = NodeProperties::GetType(node_);
     NodeProperties::SetType(node_,
                             Type::Intersect(node_type, upper_bound, zone()));
 
@@ skipping 34 matching lines @@
   JSOperatorBuilder* javascript() { return lowering_->javascript(); }
   MachineOperatorBuilder* machine() { return lowering_->machine(); }
   CommonOperatorBuilder* common() { return jsgraph()->common(); }
   Zone* zone() const { return graph()->zone(); }
 
  private:
   JSTypedLowering* lowering_;  // The containing lowering instance.
   Node* node_;                 // The original node.
 
   Node* CreateFrameStateForLeftInput() {
+    if (OperatorProperties::GetFrameStateInputCount(node_->op()) < 2) {
+      // Deoptimization is disabled => return dummy frame state instead.
+      Node* dummy_state = NodeProperties::GetFrameStateInput(node_, 0);
+      DCHECK(OpParameter<FrameStateInfo>(dummy_state).bailout_id().IsNone());
+      return dummy_state;
+    }
+
     Node* frame_state = NodeProperties::GetFrameStateInput(node_, 1);
     FrameStateInfo state_info = OpParameter<FrameStateInfo>(frame_state);
 
     if (state_info.bailout_id() == BailoutId::None()) {
       // Dummy frame state => just leave it as is.
       return frame_state;
     }
 
     // If the frame state is already the right one, just return it.
     if (state_info.state_combine().kind() == OutputFrameStateCombine::kPokeAt &&
@@ skipping 11 matching lines @@
     return graph()->NewNode(op,
                             frame_state->InputAt(kFrameStateParametersInput),
                             frame_state->InputAt(kFrameStateLocalsInput),
                             frame_state->InputAt(kFrameStateStackInput),
                             frame_state->InputAt(kFrameStateContextInput),
                             frame_state->InputAt(kFrameStateFunctionInput),
                             frame_state->InputAt(kFrameStateOuterStateInput));
   }
 
   Node* CreateFrameStateForRightInput(Node* converted_left) {
+    if (OperatorProperties::GetFrameStateInputCount(node_->op()) < 2) {
+      // Deoptimization is disabled => return dummy frame state instead.
+      Node* dummy_state = NodeProperties::GetFrameStateInput(node_, 0);
+      DCHECK(OpParameter<FrameStateInfo>(dummy_state).bailout_id().IsNone());
+      return dummy_state;
+    }
+
     Node* frame_state = NodeProperties::GetFrameStateInput(node_, 1);
     FrameStateInfo state_info = OpParameter<FrameStateInfo>(frame_state);
 
     if (state_info.bailout_id() == BailoutId::None()) {
       // Dummy frame state => just leave it as is.
       return frame_state;
     }
 
     // Create a frame state that stores the result of the operation to the
     // top of the stack (i.e., the slot used for the right operand).
@@ skipping 235 matching lines @@
 Reduction JSTypedLowering::ReduceJSMultiply(Node* node) {
   if (flags() & kDisableBinaryOpReduction) return NoChange();
   JSBinopReduction r(this, node);
 
   BinaryOperationHints::Hint feedback = r.GetNumberBinaryOperationFeedback();
   if (feedback != BinaryOperationHints::kAny) {
     return r.ChangeToSpeculativeOperator(
         simplified()->SpeculativeNumberMultiply(feedback), Type::Number());
   }
 
-  r.ConvertInputsToNumber();
-  return r.ChangeToPureOperator(simplified()->NumberMultiply(), Type::Number());
+  // If deoptimization is enabled we rely on type feedback.
+  if (r.BothInputsAre(Type::PlainPrimitive()) ||
+      !(flags() & kDeoptimizationEnabled)) {
+    r.ConvertInputsToNumber();
+    return r.ChangeToPureOperator(simplified()->NumberMultiply(),
+                                  Type::Number());
+  }
+
+  return NoChange();
 }
 
 Reduction JSTypedLowering::ReduceJSDivide(Node* node) {
   if (flags() & kDisableBinaryOpReduction) return NoChange();
   JSBinopReduction r(this, node);
   BinaryOperationHints::Hint feedback = r.GetNumberBinaryOperationFeedback();
   if (feedback != BinaryOperationHints::kAny) {
     return r.ChangeToSpeculativeOperator(
         simplified()->SpeculativeNumberDivide(feedback), Type::Number());
   }
@@ skipping 1486 matching lines @@
 }
 
 
 CompilationDependencies* JSTypedLowering::dependencies() const {
   return dependencies_;
 }
 
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8