[turbofan] Avoid overflow checks on SpeculativeNumberAdd/Subtract/Multiply.

src/compiler/simplified-lowering.cc

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/compiler/simplified-lowering.h"
 
 #include <limits>
 
 #include "src/address-map.h"
 #include "src/base/bits.h"
@@ skipping 223 matching lines @@
 
     MachineRepresentation representation() const { return representation_; }
 
     // Helpers for feedback typing.
     void set_feedback_type(Type* type) { feedback_type_ = type; }
     Type* feedback_type() const { return feedback_type_; }
     void set_weakened() { weakened_ = true; }
     bool weakened() const { return weakened_; }
     void set_restriction_type(Type* type) { restriction_type_ = type; }
     Type* restriction_type() const { return restriction_type_; }
+    void set_unrestricted_feedback_type(Type* type) {
+      unrestricted_feedback_type_ = type;
+    }
+    Type* unrestricted_feedback_type() const {
+      return unrestricted_feedback_type_;
+    }
 
    private:
     enum State : uint8_t { kUnvisited, kPushed, kVisited, kQueued };
     State state_ = kUnvisited;
     MachineRepresentation representation_ =
         MachineRepresentation::kNone;             // Output representation.
     Truncation truncation_ = Truncation::None();  // Information about uses.
 
     Type* restriction_type_ = Type::Any();
     Type* feedback_type_ = nullptr;
+    Type* unrestricted_feedback_type_ = nullptr;
     bool weakened_ = false;
   };
 
   RepresentationSelector(JSGraph* jsgraph, Zone* zone,
                          RepresentationChanger* changer,
                          SourcePositionTable* source_positions)
       : jsgraph_(jsgraph),
         zone_(zone),
         count_(jsgraph->graph()->NodeCount()),
         info_(count_, zone),
@@ skipping 93 matching lines @@
   Type* TypeOf(Node* node) {
     Type* type = GetInfo(node)->feedback_type();
     return type == nullptr ? NodeProperties::GetType(node) : type;
   }
 
   Type* FeedbackTypeOf(Node* node) {
     Type* type = GetInfo(node)->feedback_type();
     return type == nullptr ? Type::None() : type;
   }
 
+  Type* UnrestrictedFeedbackTypeOf(Node* node) {
+    Type* type = GetInfo(node)->unrestricted_feedback_type();
+    return type == nullptr ? NodeProperties::GetType(node) : type;
+  }
+
   Type* TypePhi(Node* node) {
     int arity = node->op()->ValueInputCount();
     Type* type = FeedbackTypeOf(node->InputAt(0));
     for (int i = 1; i < arity; ++i) {
       type = op_typer_.Merge(type, FeedbackTypeOf(node->InputAt(i)));
     }
     return type;
   }
 
   Type* TypeSelect(Node* node) {
@@ skipping 22 matching lines @@
     switch (node->opcode()) {
 #define DECLARE_CASE(Name)                                       \
   case IrOpcode::k##Name: {                                      \
     new_type = op_typer_.Name(FeedbackTypeOf(node->InputAt(0)),  \
                               FeedbackTypeOf(node->InputAt(1))); \
     break;                                                       \
   }
       SIMPLIFIED_NUMBER_BINOP_LIST(DECLARE_CASE)
 #undef DECLARE_CASE
 
-#define DECLARE_CASE(Name)                                                \
-  case IrOpcode::k##Name: {                                               \
-    new_type =                                                            \
-        Type::Intersect(op_typer_.Name(FeedbackTypeOf(node->InputAt(0)),  \
-                                       FeedbackTypeOf(node->InputAt(1))), \
-                        info->restriction_type(), graph_zone());          \
-    break;                                                                \
+#define DECLARE_CASE(Name)                                       \
+  case IrOpcode::k##Name: {                                      \
+    new_type = op_typer_.Name(FeedbackTypeOf(node->InputAt(0)),  \
+                              FeedbackTypeOf(node->InputAt(1))); \
+    break;                                                       \
   }
       SIMPLIFIED_SPECULATIVE_NUMBER_BINOP_LIST(DECLARE_CASE)
 #undef DECLARE_CASE
 
 #define DECLARE_CASE(Name)                                       \
   case IrOpcode::k##Name: {                                      \
     new_type = op_typer_.Name(FeedbackTypeOf(node->InputAt(0))); \
     break;                                                       \
   }
       SIMPLIFIED_NUMBER_UNOP_LIST(DECLARE_CASE)
@@ skipping 18 matching lines @@
       }
 
       case IrOpcode::kSelect: {
         new_type = TypeSelect(node);
         break;
       }
 
       default:
         // Shortcut for operations that we do not handle.
         if (type == nullptr) {
-          GetInfo(node)->set_feedback_type(NodeProperties::GetType(node));
+          type = GetUpperBound(node);
+          info->set_unrestricted_feedback_type(type);
+          info->set_feedback_type(
+              Type::Intersect(type, info->restriction_type(), graph_zone()));
           return true;
         }
         return false;
     }
+    Type* unrestricted_feedback_type = new_type;
+    new_type =
+        Type::Intersect(new_type, info->restriction_type(), graph_zone());
     // We need to guarantee that the feedback type is a subtype of the upper
     // bound. Naively that should hold, but weakening can actually produce
     // a bigger type if we are unlucky with ordering of phi typing. To be
     // really sure, just intersect the upper bound with the feedback type.
     new_type = Type::Intersect(GetUpperBound(node), new_type, graph_zone());
 
     if (type != nullptr && new_type->Is(type)) return false;
-    GetInfo(node)->set_feedback_type(new_type);
+    info->set_unrestricted_feedback_type(unrestricted_feedback_type);
+    info->set_feedback_type(new_type);
     if (FLAG_trace_representation) {
       PrintNodeFeedbackType(node);
     }
     return true;
   }
 
   void PrintNodeFeedbackType(Node* n) {
     OFStream os(stdout);
     os << "#" << n->id() << ":" << *n->op() << "(";
     int j = 0;
@@ skipping 622 matching lines @@
     return WriteBarrierKindFor(base_taggedness, field_representation,
                                field_type, value_representation, value);
   }
 
   Graph* graph() const { return jsgraph_->graph(); }
   CommonOperatorBuilder* common() const { return jsgraph_->common(); }
   SimplifiedOperatorBuilder* simplified() const {
     return jsgraph_->simplified();
   }
 
-  void LowerToCheckedInt32Mul(Node* node, Truncation truncation,
-                              Type* input0_type, Type* input1_type) {
-    // If one of the inputs is positive and/or truncation is being applied,
-    // there is no need to return -0.
-    CheckForMinusZeroMode mz_mode =
-        truncation.IsUsedAsWord32() ||
-                (input0_type->Is(Type::OrderedNumber()) &&
-                 input0_type->Min() > 0) ||
-                (input1_type->Is(Type::OrderedNumber()) &&
-                 input1_type->Min() > 0)
-            ? CheckForMinusZeroMode::kDontCheckForMinusZero
-            : CheckForMinusZeroMode::kCheckForMinusZero;
-
-    NodeProperties::ChangeOp(node, simplified()->CheckedInt32Mul(mz_mode));
-  }
-
   void ChangeToInt32OverflowOp(Node* node) {
     NodeProperties::ChangeOp(node, Int32OverflowOp(node));
   }
 
   void ChangeToUint32OverflowOp(Node* node) {
     NodeProperties::ChangeOp(node, Uint32OverflowOp(node));
   }
 
   void VisitSpeculativeAdditiveOp(Node* node, Truncation truncation,
                                   SimplifiedLowering* lowering) {
     // ToNumber(x) can throw if x is either a Receiver or a Symbol, so we can
     // only eliminate an unused speculative number operation if we know that
     // the inputs are PlainPrimitive, which excludes everything that's might
     // have side effects or throws during a ToNumber conversion.
     if (BothInputsAre(node, Type::PlainPrimitive())) {
       if (truncation.IsUnused()) return VisitUnused(node);
     }
     if (BothInputsAre(node, type_cache_.kAdditiveSafeIntegerOrMinusZero) &&
         (GetUpperBound(node)->Is(Type::Signed32()) ||
          GetUpperBound(node)->Is(Type::Unsigned32()) ||
          truncation.IsUsedAsWord32())) {
       // => Int32Add/Sub
       VisitWord32TruncatingBinop(node);
       if (lower()) ChangeToPureOp(node, Int32Op(node));
       return;
     }
 
-    // Try to use type feedback.
-    NumberOperationHint hint = NumberOperationHintOf(node->op());
-
-    // Handle the case when no int32 checks on inputs are necessary
-    // (but an overflow check is needed on the output).
-    if (BothInputsAre(node, Type::Signed32()) ||
-        (BothInputsAre(node, Type::Signed32OrMinusZero()) &&
-         NodeProperties::GetType(node)->Is(type_cache_.kSafeInteger))) {
-      // If both the inputs the feedback are int32, use the overflow op.
-      if (hint == NumberOperationHint::kSignedSmall ||
-          hint == NumberOperationHint::kSigned32) {
+    // We always take SignedSmall/Signed32 feedback otherwise.
+    NumberOperationHint const hint = NumberOperationHintOf(node->op());
+    if (hint == NumberOperationHint::kSignedSmall ||
+        hint == NumberOperationHint::kSigned32) {
+      // Check if we can guarantee truncations for the inputs.
+      if (BothInputsAre(node, Type::Signed32()) ||
+          (BothInputsAre(node, Type::Signed32OrMinusZero()) &&
+           NodeProperties::GetType(node)->Is(type_cache_.kSafeInteger))) {
         VisitBinop(node, UseInfo::TruncatingWord32(),
                    MachineRepresentation::kWord32, Type::Signed32());
-        if (lower()) ChangeToInt32OverflowOp(node);
-        return;
+      } else {
+        VisitBinop(node, CheckedUseInfoAsWord32FromHint(hint),
+                   MachineRepresentation::kWord32, Type::Signed32());
       }
-    }
-
-    if (hint == NumberOperationHint::kSignedSmall ||
-        hint == NumberOperationHint::kSigned32) {
-      VisitBinop(node, CheckedUseInfoAsWord32FromHint(hint),
-                 MachineRepresentation::kWord32, Type::Signed32());
-      if (lower()) ChangeToInt32OverflowOp(node);
+      if (lower()) {
+        // Avoid overflow checks if the unrestricted feedback type of {node}
+        // suggests that the result will fit into Signed32/Unsigned32 range.
+        Type* const type = UnrestrictedFeedbackTypeOf(node);
+        if (type->Is(Type::Unsigned32())) {
+          ChangeToPureOp(node, Uint32Op(node));
+        } else if (type->Is(Type::Signed32())) {
+          ChangeToPureOp(node, Int32Op(node));
+        } else {
+          ChangeToInt32OverflowOp(node);
+        }
+      }
       return;
     }
 
     // default case => Float64Add/Sub
     VisitBinop(node, UseInfo::CheckedNumberOrOddballAsFloat64(),
                MachineRepresentation::kFloat64, Type::Number());
     if (lower()) {
       ChangeToPureOp(node, Float64Op(node));
     }
-    return;
   }
 
   void VisitSpeculativeNumberModulus(Node* node, Truncation truncation,
                                      SimplifiedLowering* lowering) {
     // ToNumber(x) can throw if x is either a Receiver or a Symbol, so we
     // can only eliminate an unused speculative number operation if we know
     // that the inputs are PlainPrimitive, which excludes everything that's
     // might have side effects or throws during a ToNumber conversion.
     if (BothInputsAre(node, Type::PlainPrimitive())) {
       if (truncation.IsUnused()) return VisitUnused(node);
@@ skipping 321 matching lines @@
                   type_cache_.kSafeIntegerOrMinusZero)))) {
           // Multiply reduces to Int32Mul if the inputs are integers, and
           // (a) the output is either known to be Signed32, or
           // (b) the output is known to be Unsigned32, or
           // (c) the uses are truncating and the result is in the safe
           //     integer range.
           VisitWord32TruncatingBinop(node);
           if (lower()) ChangeToPureOp(node, Int32Op(node));
           return;
         }
-        // Try to use type feedback.
-        NumberOperationHint hint = NumberOperationHintOf(node->op());
-        Type* input0_type = TypeOf(node->InputAt(0));
-        Type* input1_type = TypeOf(node->InputAt(1));
 
-        // Handle the case when no int32 checks on inputs are necessary
-        // (but an overflow check is needed on the output).
-        if (BothInputsAre(node, Type::Signed32())) {
-          // If both the inputs the feedback are int32, use the overflow op.
-          if (hint == NumberOperationHint::kSignedSmall ||
-              hint == NumberOperationHint::kSigned32) {
+        // We always take SignedSmall/Signed32 feedback otherwise.
+        NumberOperationHint const hint = NumberOperationHintOf(node->op());
+        if (hint == NumberOperationHint::kSignedSmall ||
+            hint == NumberOperationHint::kSigned32) {
+          // Handle the case when no int32 checks on inputs are necessary
+          // (but an overflow check is needed on the output).
+          if (BothInputsAre(node, Type::Signed32())) {
+            // If both the inputs the feedback are int32, use the overflow op.
             VisitBinop(node, UseInfo::TruncatingWord32(),
                        MachineRepresentation::kWord32, Type::Signed32());
-            if (lower()) {
-              LowerToCheckedInt32Mul(node, truncation, input0_type,
-                                     input1_type);
+          } else {
+            VisitBinop(node, CheckedUseInfoAsWord32FromHint(hint),
+                       MachineRepresentation::kWord32, Type::Signed32());
+          }
+          if (lower()) {
+            // Avoid overflow checks if the unrestricted feedback type of {node}
+            // suggests that the result will fit into Signed32/Unsigned32 range,
+            // or at least try to avoid the expensive minus zero checks.
+            Type* const type = UnrestrictedFeedbackTypeOf(node);
+            if (type->Is(Type::Unsigned32())) {
+              ChangeToPureOp(node, Uint32Op(node));
+            } else if (type->Is(Type::Signed32())) {
+              ChangeToPureOp(node, Int32Op(node));
+            } else {
+              CheckForMinusZeroMode const mode =
+                  (truncation.IdentifiesMinusZeroAndZero() ||
+                   !type->Maybe(Type::MinusZero()))
+                      ? CheckForMinusZeroMode::kDontCheckForMinusZero
+                      : CheckForMinusZeroMode::kCheckForMinusZero;
+              NodeProperties::ChangeOp(node,
+                                       simplified()->CheckedInt32Mul(mode));
             }
-            return;
-          }
-        }
-
-        if (hint == NumberOperationHint::kSignedSmall ||
-            hint == NumberOperationHint::kSigned32) {
-          VisitBinop(node, CheckedUseInfoAsWord32FromHint(hint),
-                     MachineRepresentation::kWord32, Type::Signed32());
-          if (lower()) {
-            LowerToCheckedInt32Mul(node, truncation, input0_type, input1_type);
           }
           return;
         }
 
         // Checked float64 x float64 => float64
         VisitBinop(node, UseInfo::CheckedNumberOrOddballAsFloat64(),
                    MachineRepresentation::kFloat64, Type::Number());
         if (lower()) ChangeToPureOp(node, Float64Op(node));
         return;
       }
@@ skipping 1640 matching lines @@
         isolate(), graph()->zone(), callable.descriptor(), 0, flags,
         Operator::kNoProperties);
     to_number_operator_.set(common()->Call(desc));
   }
   return to_number_operator_.get();
 }
 
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8