[turbofan] Introduce a TransitionElementsKind simplified operator.

src/compiler/js-native-context-specialization.cc

 // Copyright 2015 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/compiler/js-native-context-specialization.h"
 
 #include "src/accessors.h"
 #include "src/code-factory.h"
 #include "src/compilation-dependencies.h"
 #include "src/compiler/access-builder.h"
@@ skipping 470 matching lines @@
 }
 
 
 Reduction JSNativeContextSpecialization::ReduceElementAccess(
     Node* node, Node* index, Node* value, MapHandleList const& receiver_maps,
     AccessMode access_mode, LanguageMode language_mode,
     KeyedAccessStoreMode store_mode) {
   DCHECK(node->opcode() == IrOpcode::kJSLoadProperty ||
          node->opcode() == IrOpcode::kJSStoreProperty);
   Node* receiver = NodeProperties::GetValueInput(node, 0);
-  Node* context = NodeProperties::GetContextInput(node);
   Node* effect = NodeProperties::GetEffectInput(node);
   Node* control = NodeProperties::GetControlInput(node);
   Node* frame_state = NodeProperties::FindFrameStateBefore(node);
 
   // Not much we can do if deoptimization support is disabled.
   if (!(flags() & kDeoptimizationEnabled)) return NoChange();
 
   // TODO(bmeurer): Add support for non-standard stores.
   if (store_mode != STANDARD_STORE) return NoChange();
 
@@ skipping 16 matching lines @@
   // The final states for every polymorphic branch. We join them with
   // Merge+Phi+EffectPhi at the bottom.
   ZoneVector<Node*> values(zone());
   ZoneVector<Node*> effects(zone());
   ZoneVector<Node*> controls(zone());
 
   // Ensure that {receiver} is a heap object.
   receiver = effect = graph()->NewNode(simplified()->CheckTaggedPointer(),
                                        receiver, effect, control);
 
-  // Load the {receiver} map. The resulting effect is the dominating effect for
-  // all (polymorphic) branches.
-  Node* receiver_map = effect =
-      graph()->NewNode(simplified()->LoadField(AccessBuilder::ForMap()),
-                       receiver, effect, control);
-
   // Generate code for the various different element access patterns.
   Node* fallthrough_control = control;
   for (size_t j = 0; j < access_infos.size(); ++j) {
     ElementAccessInfo const& access_info = access_infos[j];
     Node* this_receiver = receiver;
     Node* this_value = value;
     Node* this_index = index;
-    Node* this_effect;
-    Node* this_control;
+    Node* this_effect = effect;
+    Node* this_control = fallthrough_control;
+
+    // Perform possible elements kind transitions.
+    for (auto transition : access_info.transitions()) {
+      Handle<Map> const transition_source = transition.first;
+      Handle<Map> const transition_target = transition.second;
+      this_effect = graph()->NewNode(
+          simplified()->TransitionElementsKind(
+              IsSimpleMapChangeTransition(transition_source->elements_kind(),
+                                          transition_target->elements_kind())
+                  ? ElementsTransition::kFastTransition
+                  : ElementsTransition::kSlowTransition),
+          receiver, jsgraph()->HeapConstant(transition_source),
+          jsgraph()->HeapConstant(transition_target), this_effect,
+          this_control);
+    }
+
+    // Load the {receiver} map.
+    Node* receiver_map = this_effect =
+        graph()->NewNode(simplified()->LoadField(AccessBuilder::ForMap()),
+                         receiver, this_effect, this_control);
 
     // Perform map check on {receiver}.
     Type* receiver_type = access_info.receiver_type();
     bool receiver_is_jsarray = true;
     {
       ZoneVector<Node*> this_controls(zone());
       ZoneVector<Node*> this_effects(zone());
-      size_t num_transitions = access_info.transitions().size();
       int num_classes = access_info.receiver_type()->NumClasses();
       for (auto i = access_info.receiver_type()->Classes(); !i.Done();
            i.Advance()) {
         DCHECK_LT(0, num_classes);
         Handle<Map> map = i.Current();
         Node* check =
             graph()->NewNode(simplified()->ReferenceEqual(Type::Any()),
                              receiver_map, jsgraph()->Constant(map));
-        if (--num_classes == 0 && num_transitions == 0 &&
-            j == access_infos.size() - 1) {
+        if (--num_classes == 0 && j == access_infos.size() - 1) {
           // Last map check on the fallthrough control path, do a conditional
           // eager deoptimization exit here.
           // TODO(turbofan): This is ugly as hell! We should probably introduce
           // macro-ish operators for property access that encapsulate this whole
           // mess.
-          check = graph()->NewNode(simplified()->CheckIf(), check, effect,
-                                   fallthrough_control);
-          this_controls.push_back(fallthrough_control);
+          check = graph()->NewNode(simplified()->CheckIf(), check, this_effect,
+                                   this_control);
+          this_controls.push_back(this_control);
           this_effects.push_back(check);
           fallthrough_control = nullptr;
         } else {
           Node* branch =
               graph()->NewNode(common()->Branch(), check, fallthrough_control);
           this_controls.push_back(graph()->NewNode(common()->IfTrue(), branch));
           this_effects.push_back(effect);
           fallthrough_control = graph()->NewNode(common()->IfFalse(), branch);
         }
         if (!map->IsJSArrayMap()) receiver_is_jsarray = false;
       }
 
-      // Generate possible elements kind transitions.
-      for (auto transition : access_info.transitions()) {
-        DCHECK_LT(0u, num_transitions);
-        Handle<Map> transition_source = transition.first;
-        Handle<Map> transition_target = transition.second;
-        Node* transition_control;
-        Node* transition_effect = effect;
-
-        // Check if {receiver} has the specified {transition_source} map.
-        Node* check = graph()->NewNode(
-            simplified()->ReferenceEqual(Type::Any()), receiver_map,
-            jsgraph()->HeapConstant(transition_source));
-        if (--num_transitions == 0 && j == access_infos.size() - 1) {
-          transition_effect =
-              graph()->NewNode(simplified()->CheckIf(), check,
-                               transition_effect, fallthrough_control);
-          transition_control = fallthrough_control;
-          fallthrough_control = nullptr;
-        } else {
-          Node* branch =
-              graph()->NewNode(common()->Branch(), check, fallthrough_control);
-          fallthrough_control = graph()->NewNode(common()->IfFalse(), branch);
-          transition_control = graph()->NewNode(common()->IfTrue(), branch);
-        }
-
-        // Migrate {receiver} from {transition_source} to {transition_target}.
-        if (IsSimpleMapChangeTransition(transition_source->elements_kind(),
-                                        transition_target->elements_kind())) {
-          // In-place migration, just store the {transition_target} map.
-          transition_effect = graph()->NewNode(
-              simplified()->StoreField(AccessBuilder::ForMap()), receiver,
-              jsgraph()->HeapConstant(transition_target), transition_effect,
-              transition_control);
-        } else {
-          // Instance migration, let the stub deal with the {receiver}.
-          TransitionElementsKindStub stub(isolate(),
-                                          transition_source->elements_kind(),
-                                          transition_target->elements_kind());
-          CallDescriptor const* const desc = Linkage::GetStubCallDescriptor(
-              isolate(), graph()->zone(), stub.GetCallInterfaceDescriptor(), 0,
-              CallDescriptor::kNeedsFrameState, node->op()->properties());
-          transition_effect = graph()->NewNode(
-              common()->Call(desc), jsgraph()->HeapConstant(stub.GetCode()),
-              receiver, jsgraph()->HeapConstant(transition_target), context,
-              frame_state, transition_effect, transition_control);
-        }
-
-        this_controls.push_back(transition_control);
-        this_effects.push_back(transition_effect);
-      }
-
       // Create single chokepoint for the control.
       int const this_control_count = static_cast<int>(this_controls.size());
       if (this_control_count == 1) {
         this_control = this_controls.front();
         this_effect = this_effects.front();
       } else {
         this_control =
             graph()->NewNode(common()->Merge(this_control_count),
                              this_control_count, &this_controls.front());
         this_effects.push_back(this_control);
         this_effect =
             graph()->NewNode(common()->EffectPhi(this_control_count),
                              this_control_count + 1, &this_effects.front());
+
+        // TODO(turbofan): The effect/control linearization will not find a
+        // FrameState after the StoreField or Call that is generated for the
+        // elements kind transition above. This is because those operators
+        // don't have the kNoWrite flag on it, even though they are not
+        // observable by JavaScript.
+        this_effect = graph()->NewNode(common()->Checkpoint(), frame_state,
+                                       this_effect, this_control);
       }
-
-      // TODO(turbofan): The effect/control linearization will not find a
-      // FrameState after the StoreField or Call that is generated for the
-      // elements kind transition above. This is because those operators
-      // don't have the kNoWrite flag on it, even though they are not
-      // observable by JavaScript.
-      this_effect = graph()->NewNode(common()->Checkpoint(), frame_state,
-                                     this_effect, this_control);
     }
 
     // Certain stores need a prototype chain check because shape changes
     // could allow callbacks on elements in the prototype chain that are
     // not compatible with (monomorphic) keyed stores.
     Handle<JSObject> holder;
     if (access_info.holder().ToHandle(&holder)) {
       AssumePrototypesStable(receiver_type, native_context, holder);
     }
 
@@ skipping 410 matching lines @@
 }
 
 
 SimplifiedOperatorBuilder* JSNativeContextSpecialization::simplified() const {
   return jsgraph()->simplified();
 }
 
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8