[turbofan] Narrow type of Phis during JSTypedLowering.

src/compiler/js-typed-lowering.cc

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/compiler/js-typed-lowering.h"
 
 #include "src/builtins/builtins-utils.h"
 #include "src/code-factory.h"
 #include "src/compilation-dependencies.h"
 #include "src/compiler/access-builder.h"
@@ skipping 1908 matching lines @@
   Node* element = effect = graph()->NewNode(
       simplified()->LoadField(element_field), array, effect, control);
   Node* stale = jsgraph()->StaleRegisterConstant();
   effect = graph()->NewNode(simplified()->StoreField(element_field), array,
                             stale, effect, control);
 
   ReplaceWithValue(node, element, effect, control);
   return Changed(element);
 }
 
+Reduction JSTypedLowering::ReducePhi(Node* node) {
+  // Try to narrow the type of the Phi {node}, which might be more precise now
+  // after lowering based on types, i.e. a SpeculativeNumberAdd has a more
+  // precise type than the JSAdd that was in the graph when the Typer was run.
+  DCHECK_EQ(IrOpcode::kPhi, node->opcode());
+  int arity = node->op()->ValueInputCount();
+  Type* type = NodeProperties::GetType(node->InputAt(0));
+  for (int i = 1; i < arity; ++i) {
+    type = Type::Union(type, NodeProperties::GetType(node->InputAt(i)),
+                       graph()->zone());
+  }
+  Type* const node_type = NodeProperties::GetType(node);
+  if (!node_type->Is(type)) {
+    type = Type::Intersect(node_type, type, graph()->zone());
+    NodeProperties::SetType(node, type);
+    return Changed(node);
+  }
+  return NoChange();
+}
+
 Reduction JSTypedLowering::ReduceSelect(Node* node) {
   DCHECK_EQ(IrOpcode::kSelect, node->opcode());
   Node* const condition = NodeProperties::GetValueInput(node, 0);
   Type* const condition_type = NodeProperties::GetType(condition);
   Node* const vtrue = NodeProperties::GetValueInput(node, 1);
   Type* const vtrue_type = NodeProperties::GetType(vtrue);
   Node* const vfalse = NodeProperties::GetValueInput(node, 2);
   Type* const vfalse_type = NodeProperties::GetType(vfalse);
   if (condition_type->Is(true_type_)) {
     // Select(condition:true, vtrue, vfalse) => vtrue
@@ skipping 220 matching lines @@
     case IrOpcode::kJSForInNext:
       return ReduceJSForInNext(node);
     case IrOpcode::kJSForInStep:
       return ReduceJSForInStep(node);
     case IrOpcode::kJSGeneratorStore:
       return ReduceJSGeneratorStore(node);
     case IrOpcode::kJSGeneratorRestoreContinuation:
       return ReduceJSGeneratorRestoreContinuation(node);
     case IrOpcode::kJSGeneratorRestoreRegister:
       return ReduceJSGeneratorRestoreRegister(node);
+    case IrOpcode::kPhi:
+      return ReducePhi(node);
     case IrOpcode::kSelect:
       return ReduceSelect(node);
     case IrOpcode::kCheckMaps:
       return ReduceCheckMaps(node);
     case IrOpcode::kCheckString:
       return ReduceCheckString(node);
     case IrOpcode::kNumberCeil:
     case IrOpcode::kNumberFloor:
     case IrOpcode::kNumberRound:
     case IrOpcode::kNumberTrunc:
@@ skipping 34 matching lines @@
 }
 
 
 CompilationDependencies* JSTypedLowering::dependencies() const {
   return dependencies_;
 }
 
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8