[turbofan] Avoid introducing machine operators during typed lowering.

src/compiler/js-typed-lowering.cc

Index: src/compiler/js-typed-lowering.cc
diff --git a/src/compiler/js-typed-lowering.cc b/src/compiler/js-typed-lowering.cc
index 9af6e6e44d6ece3efe070c56447f8ec272c92302..a88658c408eed258899ff31448f2a6e9620a8f8c 100644
--- a/src/compiler/js-typed-lowering.cc
+++ b/src/compiler/js-typed-lowering.cc
@@ -219,7 +219,6 @@ class JSBinopReduction final {
   Graph* graph() const { return lowering_->graph(); }
   JSGraph* jsgraph() { return lowering_->jsgraph(); }
   JSOperatorBuilder* javascript() { return lowering_->javascript(); }
-  MachineOperatorBuilder* machine() { return lowering_->machine(); }
   CommonOperatorBuilder* common() { return jsgraph()->common(); }
   Zone* zone() const { return graph()->zone(); }
 
@@ -1019,77 +1018,55 @@ Reduction JSTypedLowering::ReduceJSToObject(Node* node) {
   Node* frame_state = NodeProperties::GetFrameStateInput(node, 0);
   Node* effect = NodeProperties::GetEffectInput(node);
   Node* control = NodeProperties::GetControlInput(node);
-  if (!receiver_type->Is(Type::Receiver())) {
-    // TODO(bmeurer/mstarzinger): Add support for lowering inside try blocks.
-    if (receiver_type->Maybe(Type::NullOrUndefined()) &&
-        NodeProperties::IsExceptionalCall(node)) {
-      // ToObject throws for null or undefined inputs.
-      return NoChange();
-    }
+  if (receiver_type->Is(Type::Receiver())) {
+    ReplaceWithValue(node, receiver, effect, control);
+    return Replace(receiver);
+  }
 
-    // Check whether {receiver} is a Smi.
-    Node* check0 = graph()->NewNode(simplified()->ObjectIsSmi(), receiver);
-    Node* branch0 =
-        graph()->NewNode(common()->Branch(BranchHint::kFalse), check0, control);
-    Node* if_true0 = graph()->NewNode(common()->IfTrue(), branch0);
-    Node* etrue0 = effect;
-
-    Node* if_false0 = graph()->NewNode(common()->IfFalse(), branch0);
-    Node* efalse0 = effect;
-
-    // Determine the instance type of {receiver}.
-    Node* receiver_map = efalse0 =
-        graph()->NewNode(simplified()->LoadField(AccessBuilder::ForMap()),
-                         receiver, efalse0, if_false0);
-    Node* receiver_instance_type = efalse0 = graph()->NewNode(
-        simplified()->LoadField(AccessBuilder::ForMapInstanceType()),
-        receiver_map, efalse0, if_false0);
-
-    // Check whether {receiver} is a spec object.
-    STATIC_ASSERT(LAST_JS_RECEIVER_TYPE == LAST_TYPE);
-    Node* check1 =
-        graph()->NewNode(machine()->Uint32LessThanOrEqual(),
-                         jsgraph()->Uint32Constant(FIRST_JS_RECEIVER_TYPE),
-                         receiver_instance_type);
-    Node* branch1 = graph()->NewNode(common()->Branch(BranchHint::kTrue),
-                                     check1, if_false0);
-    Node* if_true1 = graph()->NewNode(common()->IfTrue(), branch1);
-    Node* etrue1 = efalse0;
-
-    Node* if_false1 = graph()->NewNode(common()->IfFalse(), branch1);
-    Node* efalse1 = efalse0;
+  // TODO(bmeurer/mstarzinger): Add support for lowering inside try blocks.
+  if (receiver_type->Maybe(Type::NullOrUndefined()) &&
+      NodeProperties::IsExceptionalCall(node)) {
+    // ToObject throws for null or undefined inputs.
+    return NoChange();
+  }
 
-    // Convert {receiver} using the ToObjectStub.
-    Node* if_convert =
-        graph()->NewNode(common()->Merge(2), if_true0, if_false1);
-    Node* econvert =
-        graph()->NewNode(common()->EffectPhi(2), etrue0, efalse1, if_convert);
-    Node* rconvert;
-    {
-      Callable callable = CodeFactory::ToObject(isolate());
-      CallDescriptor const* const desc = Linkage::GetStubCallDescriptor(
-          isolate(), graph()->zone(), callable.descriptor(), 0,
-          CallDescriptor::kNeedsFrameState, node->op()->properties());
-      rconvert = econvert = graph()->NewNode(
-          common()->Call(desc), jsgraph()->HeapConstant(callable.code()),
-          receiver, context, frame_state, econvert, if_convert);
-    }
+  // Check whether {receiver} is a spec object.
+  Node* check = graph()->NewNode(simplified()->ObjectIsReceiver(), receiver);
+  Node* branch =
+      graph()->NewNode(common()->Branch(BranchHint::kTrue), check, control);
 
-    // The {receiver} is already a spec object.
-    Node* if_done = if_true1;
-    Node* edone = etrue1;
-    Node* rdone = receiver;
+  Node* if_true = graph()->NewNode(common()->IfTrue(), branch);
+  Node* etrue = effect;
+  Node* rtrue = receiver;
 
-    control = graph()->NewNode(common()->Merge(2), if_convert, if_done);
-    effect = graph()->NewNode(common()->EffectPhi(2), econvert, edone, control);
-    receiver =
-        graph()->NewNode(common()->Phi(MachineRepresentation::kTagged, 2),
-                         rconvert, rdone, control);
+  Node* if_false = graph()->NewNode(common()->IfFalse(), branch);
+  Node* efalse = effect;
+  Node* rfalse;
+  {
+    // Convert {receiver} using the ToObjectStub.
+    Callable callable = CodeFactory::ToObject(isolate());
+    CallDescriptor const* const desc = Linkage::GetStubCallDescriptor(
+        isolate(), graph()->zone(), callable.descriptor(), 0,
+        CallDescriptor::kNeedsFrameState, node->op()->properties());
+    rfalse = efalse = graph()->NewNode(
+        common()->Call(desc), jsgraph()->HeapConstant(callable.code()),
+        receiver, context, frame_state, efalse, if_false);
+    if_false = graph()->NewNode(common()->IfSuccess(), rfalse);
   }
-  ReplaceWithValue(node, receiver, effect, control);
-  return Changed(receiver);
-}
 
+  control = graph()->NewNode(common()->Merge(2), if_true, if_false);
+  effect = graph()->NewNode(common()->EffectPhi(2), etrue, efalse, control);
+
+  // Morph the {node} into an appropriate Phi.
+  ReplaceWithValue(node, node, effect, control);
+  node->ReplaceInput(0, rtrue);
+  node->ReplaceInput(1, rfalse);
+  node->ReplaceInput(2, control);
+  node->TrimInputCount(3);
+  NodeProperties::ChangeOp(node,
+                           common()->Phi(MachineRepresentation::kTagged, 2));
+  return Changed(node);
+}
 
 Reduction JSTypedLowering::ReduceJSLoadNamed(Node* node) {
   DCHECK_EQ(IrOpcode::kJSLoadNamed, node->opcode());
@@ -1144,7 +1121,10 @@ Reduction JSTypedLowering::ReduceJSLoadProperty(Node* node) {
           return Replace(load);
         }
         // Compute byte offset.
-        Node* offset = Word32Shl(key, static_cast<int>(k));
+        Node* offset =
+            (k == 0) ? key : graph()->NewNode(
+                                 simplified()->NumberShiftLeft(), key,
+                                 jsgraph()->Constant(static_cast<double>(k)));
         Node* load = graph()->NewNode(simplified()->LoadBuffer(access), buffer,
                                       offset, length, effect, control);
         ReplaceWithValue(node, load, load);
@@ -1212,7 +1192,10 @@ Reduction JSTypedLowering::ReduceJSStoreProperty(Node* node) {
           return Changed(node);
         }
         // Compute byte offset.
-        Node* offset = Word32Shl(key, static_cast<int>(k));
+        Node* offset =
+            (k == 0) ? key : graph()->NewNode(
+                                 simplified()->NumberShiftLeft(), key,
+                                 jsgraph()->Constant(static_cast<double>(k)));
         // Turn into a StoreBuffer operation.
         RelaxControls(node);
         node->ReplaceInput(0, buffer);
@@ -1307,10 +1290,10 @@ Reduction JSTypedLowering::ReduceJSInstanceOf(Node* node) {
   int is_access_check_needed_bit = 1 << Map::kIsAccessCheckNeeded;
   Node* is_access_check_needed_num =
       graph()->NewNode(simplified()->NumberBitwiseAnd(), map_bit_field,
-                       jsgraph()->Uint32Constant(is_access_check_needed_bit));
+                       jsgraph()->Constant(is_access_check_needed_bit));
   Node* is_access_check_needed =
-      graph()->NewNode(machine()->Word32Equal(), is_access_check_needed_num,
-                       jsgraph()->Uint32Constant(is_access_check_needed_bit));
+      graph()->NewNode(simplified()->NumberEqual(), is_access_check_needed_num,
+                       jsgraph()->Constant(is_access_check_needed_bit));
 
   Node* branch_is_access_check_needed = graph()->NewNode(
       common()->Branch(BranchHint::kFalse), is_access_check_needed, control);
@@ -1325,8 +1308,9 @@ Reduction JSTypedLowering::ReduceJSInstanceOf(Node* node) {
   Node* map_instance_type = effect = graph()->NewNode(
       simplified()->LoadField(AccessBuilder::ForMapInstanceType()),
       loop_object_map, loop_effect, control);
-  Node* is_proxy = graph()->NewNode(machine()->Word32Equal(), map_instance_type,
-                                    jsgraph()->Uint32Constant(JS_PROXY_TYPE));
+  Node* is_proxy =
+      graph()->NewNode(simplified()->NumberEqual(), map_instance_type,
+                       jsgraph()->Constant(JS_PROXY_TYPE));
   Node* branch_is_proxy =
       graph()->NewNode(common()->Branch(BranchHint::kFalse), is_proxy, control);
   Node* if_is_proxy = graph()->NewNode(common()->IfTrue(), branch_is_proxy);
@@ -2043,13 +2027,6 @@ Reduction JSTypedLowering::Reduce(Node* node) {
   return NoChange();
 }
 
-
-Node* JSTypedLowering::Word32Shl(Node* const lhs, int32_t const rhs) {
-  if (rhs == 0) return lhs;
-  return graph()->NewNode(machine()->Word32Shl(), lhs,
-                          jsgraph()->Int32Constant(rhs));
-}
-
 Node* JSTypedLowering::EmptyFrameState() {
   return graph()->NewNode(
       common()->FrameState(BailoutId::None(), OutputFrameStateCombine::Ignore(),
@@ -2077,17 +2054,15 @@ CommonOperatorBuilder* JSTypedLowering::common() const {
   return jsgraph()->common();
 }
 
+MachineOperatorBuilder* JSTypedLowering::machine() const {
+  return jsgraph()->machine();
+}
 
 SimplifiedOperatorBuilder* JSTypedLowering::simplified() const {
   return jsgraph()->simplified();
 }
 
 
-MachineOperatorBuilder* JSTypedLowering::machine() const {
-  return jsgraph()->machine();
-}
-
-
 CompilationDependencies* JSTypedLowering::dependencies() const {
   return dependencies_;
 }