[turbofan] Introduce a dedicated ArrayBufferWasNeutered operator.

src/compiler/load-elimination.cc

 // Copyright 2016 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/compiler/load-elimination.h"
 
 #include "src/compiler/js-graph.h"
 #include "src/compiler/node-properties.h"
 #include "src/compiler/simplified-operator.h"
 
@@ skipping 37 matching lines @@
 }
 
 bool MayAlias(Node* a, Node* b) { return QueryAlias(a, b) != kNoAlias; }
 
 bool MustAlias(Node* a, Node* b) { return QueryAlias(a, b) == kMustAlias; }
 
 }  // namespace
 
 Reduction LoadElimination::Reduce(Node* node) {
   switch (node->opcode()) {
+    case IrOpcode::kArrayBufferWasNeutered:
+      return ReduceArrayBufferWasNeutered(node);
     case IrOpcode::kCheckMaps:
       return ReduceCheckMaps(node);
     case IrOpcode::kEnsureWritableFastElements:
       return ReduceEnsureWritableFastElements(node);
     case IrOpcode::kMaybeGrowFastElements:
       return ReduceMaybeGrowFastElements(node);
     case IrOpcode::kTransitionElementsKind:
       return ReduceTransitionElementsKind(node);
     case IrOpcode::kLoadField:
       return ReduceLoadField(node);
@@ skipping 10 matching lines @@
     case IrOpcode::kDead:
       break;
     case IrOpcode::kStart:
       return ReduceStart(node);
     default:
       return ReduceOtherNode(node);
   }
   return NoChange();
 }
 
+namespace {
+
+bool IsCompatibleCheck(Node const* a, Node const* b) {
+  if (a->op() != b->op()) return false;
+  for (int i = a->op()->ValueInputCount(); --i >= 0;) {
+    if (!MustAlias(a->InputAt(i), b->InputAt(i))) return false;
+  }
+  return true;
+}
+
+}  // namespace
+
+Node* LoadElimination::AbstractChecks::Lookup(Node* node) const {
+  for (Node* const check : nodes_) {
+    if (check && IsCompatibleCheck(check, node)) {
+      return check;
+    }
+  }
+  return nullptr;
+}
+
+bool LoadElimination::AbstractChecks::Equals(AbstractChecks const* that) const {
+  if (this == that) return true;
+  for (size_t i = 0; i < arraysize(nodes_); ++i) {
+    if (Node* this_node = this->nodes_[i]) {
+      for (size_t j = 0;; ++j) {
+        if (j == arraysize(nodes_)) return false;
+        if (that->nodes_[j] == this_node) break;
+      }
+    }
+  }
+  for (size_t i = 0; i < arraysize(nodes_); ++i) {
+    if (Node* that_node = that->nodes_[i]) {
+      for (size_t j = 0;; ++j) {
+        if (j == arraysize(nodes_)) return false;
+        if (this->nodes_[j] == that_node) break;
+      }
+    }
+  }
+  return true;
+}
+
+LoadElimination::AbstractChecks const* LoadElimination::AbstractChecks::Merge(
+    AbstractChecks const* that, Zone* zone) const {
+  if (this->Equals(that)) return this;
+  AbstractChecks* copy = new (zone) AbstractChecks(zone);
+  for (Node* const this_node : this->nodes_) {
+    if (this_node == nullptr) continue;
+    for (Node* const that_node : that->nodes_) {
+      if (this_node == that_node) {
+        copy->nodes_[copy->next_index_++] = this_node;
+        break;
+      }
+    }
+  }
+  copy->next_index_ %= arraysize(nodes_);
+  return copy;
+}
+
 Node* LoadElimination::AbstractElements::Lookup(Node* object,
                                                 Node* index) const {
   for (Element const element : elements_) {
     if (element.object == nullptr) continue;
     DCHECK_NOT_NULL(element.index);
     DCHECK_NOT_NULL(element.value);
     if (MustAlias(object, element.object) && MustAlias(index, element.index)) {
       return element.value;
     }
   }
@@ skipping 60 matching lines @@
                                          Zone* zone) const {
   if (this->Equals(that)) return this;
   AbstractElements* copy = new (zone) AbstractElements(zone);
   for (Element const this_element : this->elements_) {
     if (this_element.object == nullptr) continue;
     for (Element const that_element : that->elements_) {
       if (this_element.object == that_element.object &&
           this_element.index == that_element.index &&
           this_element.value == that_element.value) {
         copy->elements_[copy->next_index_++] = this_element;
+        break;
       }
     }
   }
   copy->next_index_ %= arraysize(elements_);
   return copy;
 }
 
 Node* LoadElimination::AbstractField::Lookup(Node* object) const {
   for (auto pair : info_for_node_) {
     if (MustAlias(object, pair.first)) return pair.second;
   }
   return nullptr;
 }
 
 LoadElimination::AbstractField const* LoadElimination::AbstractField::Kill(
     Node* object, Zone* zone) const {
   for (auto pair : this->info_for_node_) {
     if (MayAlias(object, pair.first)) {
       AbstractField* that = new (zone) AbstractField(zone);
       for (auto pair : this->info_for_node_) {
         if (!MayAlias(object, pair.first)) that->info_for_node_.insert(pair);
       }
       return that;
     }
   }
   return this;
 }
 
 bool LoadElimination::AbstractState::Equals(AbstractState const* that) const {
+  if (this->checks_) {
+    if (!that->checks_ || !that->checks_->Equals(this->checks_)) {
+      return false;
+    }
+  } else if (that->checks_) {
+    return false;
+  }
   if (this->elements_) {
     if (!that->elements_ || !that->elements_->Equals(this->elements_)) {
       return false;
     }
   } else if (that->elements_) {
     return false;
   }
   for (size_t i = 0u; i < arraysize(fields_); ++i) {
     AbstractField const* this_field = this->fields_[i];
     AbstractField const* that_field = that->fields_[i];
     if (this_field) {
       if (!that_field || !that_field->Equals(this_field)) return false;
     } else if (that_field) {
       return false;
     }
   }
   return true;
 }
 
 void LoadElimination::AbstractState::Merge(AbstractState const* that,
                                            Zone* zone) {
+  // Merge the information we have about the checks.
+  if (this->checks_) {
+    this->checks_ =
+        that->checks_ ? that->checks_->Merge(this->checks_, zone) : nullptr;
+  }
+
   // Merge the information we have about the elements.
   if (this->elements_) {
     this->elements_ = that->elements_
                           ? that->elements_->Merge(this->elements_, zone)
                           : nullptr;
   }
 
   // Merge the information we have about the fields.
   for (size_t i = 0; i < arraysize(fields_); ++i) {
     if (this->fields_[i]) {
       if (that->fields_[i]) {
         this->fields_[i] = this->fields_[i]->Merge(that->fields_[i], zone);
       } else {
         this->fields_[i] = nullptr;
       }
     }
   }
 }
 
+Node* LoadElimination::AbstractState::LookupCheck(Node* node) const {
+  return this->checks_ ? this->checks_->Lookup(node) : nullptr;
+}
+
+LoadElimination::AbstractState const* LoadElimination::AbstractState::AddCheck(
+    Node* node, Zone* zone) const {
+  AbstractState* that = new (zone) AbstractState(*this);
+  if (that->checks_) {
+    that->checks_ = that->checks_->Extend(node, zone);
+  } else {
+    that->checks_ = new (zone) AbstractChecks(node, zone);
+  }
+  return that;
+}
+
 Node* LoadElimination::AbstractState::LookupElement(Node* object,
                                                     Node* index) const {
   if (this->elements_) {
     return this->elements_->Lookup(object, index);
   }
   return nullptr;
 }
 
 LoadElimination::AbstractState const*
 LoadElimination::AbstractState::AddElement(Node* object, Node* index,
@@ skipping 61 matching lines @@
   return nullptr;
 }
 
 void LoadElimination::AbstractStateForEffectNodes::Set(
     Node* node, AbstractState const* state) {
   size_t const id = node->id();
   if (id >= info_for_node_.size()) info_for_node_.resize(id + 1, nullptr);
   info_for_node_[id] = state;
 }
 
+Reduction LoadElimination::ReduceArrayBufferWasNeutered(Node* node) {
+  Node* const effect = NodeProperties::GetEffectInput(node);
+  AbstractState const* state = node_states_.Get(effect);
+  if (state == nullptr) return NoChange();
+  if (Node* const check = state->LookupCheck(node)) {
+    ReplaceWithValue(node, check, effect);
+    return Replace(check);
+  }
+  state = state->AddCheck(node, zone());
+  return UpdateState(node, state);
+}
+
 Reduction LoadElimination::ReduceCheckMaps(Node* node) {
   Node* const object = NodeProperties::GetValueInput(node, 0);
   Node* const effect = NodeProperties::GetEffectInput(node);
   AbstractState const* state = node_states_.Get(effect);
   if (state == nullptr) return NoChange();
   int const map_input_count = node->op()->ValueInputCount() - 1;
   if (Node* const object_map = state->LookupField(object, 0)) {
     for (int i = 0; i < map_input_count; ++i) {
       Node* map = NodeProperties::GetValueInput(node, 1 + i);
       if (map == object_map) return Replace(effect);
@@ skipping 371 matching lines @@
   DCHECK_EQ(kTaggedBase, access.base_is_tagged);
   DCHECK_EQ(0, access.offset % kPointerSize);
   int field_index = access.offset / kPointerSize;
   if (field_index >= static_cast<int>(kMaxTrackedFields)) return -1;
   return field_index;
 }
 
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8