[turbofan] Revert "Avoid overflow checks on SpeculativeNumberAdd/Subtract/Multiply."

src/compiler/simplified-lowering.cc

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/compiler/simplified-lowering.h"
 
 #include <limits>
 
 #include "src/address-map.h"
 #include "src/base/bits.h"
@@ skipping 223 matching lines @@
 
     MachineRepresentation representation() const { return representation_; }
 
     // Helpers for feedback typing.
     void set_feedback_type(Type* type) { feedback_type_ = type; }
     Type* feedback_type() const { return feedback_type_; }
     void set_weakened() { weakened_ = true; }
     bool weakened() const { return weakened_; }
     void set_restriction_type(Type* type) { restriction_type_ = type; }
     Type* restriction_type() const { return restriction_type_; }
-    void set_unrestricted_feedback_type(Type* type) {
-      unrestricted_feedback_type_ = type;
-    }
-    Type* unrestricted_feedback_type() const {
-      return unrestricted_feedback_type_;
-    }
 
    private:
     enum State : uint8_t { kUnvisited, kPushed, kVisited, kQueued };
     State state_ = kUnvisited;
     MachineRepresentation representation_ =
         MachineRepresentation::kNone;             // Output representation.
     Truncation truncation_ = Truncation::None();  // Information about uses.
 
     Type* restriction_type_ = Type::Any();
     Type* feedback_type_ = nullptr;
-    Type* unrestricted_feedback_type_ = nullptr;
     bool weakened_ = false;
   };
 
   RepresentationSelector(JSGraph* jsgraph, Zone* zone,
                          RepresentationChanger* changer,
                          SourcePositionTable* source_positions)
       : jsgraph_(jsgraph),
         zone_(zone),
         count_(jsgraph->graph()->NodeCount()),
         info_(count_, zone),
@@ skipping 93 matching lines @@
   Type* TypeOf(Node* node) {
     Type* type = GetInfo(node)->feedback_type();
     return type == nullptr ? NodeProperties::GetType(node) : type;
   }
 
   Type* FeedbackTypeOf(Node* node) {
     Type* type = GetInfo(node)->feedback_type();
     return type == nullptr ? Type::None() : type;
   }
 
-  Type* UnrestrictedFeedbackTypeOf(Node* node) {
-    Type* type = GetInfo(node)->unrestricted_feedback_type();
-    return type == nullptr ? NodeProperties::GetType(node) : type;
-  }
-
   Type* TypePhi(Node* node) {
     int arity = node->op()->ValueInputCount();
     Type* type = FeedbackTypeOf(node->InputAt(0));
     for (int i = 1; i < arity; ++i) {
       type = op_typer_.Merge(type, FeedbackTypeOf(node->InputAt(i)));
     }
     return type;
   }
 
   Type* TypeSelect(Node* node) {
@@ skipping 22 matching lines @@
     switch (node->opcode()) {
 #define DECLARE_CASE(Name)                                       \
   case IrOpcode::k##Name: {                                      \
     new_type = op_typer_.Name(FeedbackTypeOf(node->InputAt(0)),  \
                               FeedbackTypeOf(node->InputAt(1))); \
     break;                                                       \
   }
       SIMPLIFIED_NUMBER_BINOP_LIST(DECLARE_CASE)
 #undef DECLARE_CASE
 
-#define DECLARE_CASE(Name)                                       \
-  case IrOpcode::k##Name: {                                      \
-    new_type = op_typer_.Name(FeedbackTypeOf(node->InputAt(0)),  \
-                              FeedbackTypeOf(node->InputAt(1))); \
-    break;                                                       \
+#define DECLARE_CASE(Name)                                                \
+  case IrOpcode::k##Name: {                                               \
+    new_type =                                                            \
+        Type::Intersect(op_typer_.Name(FeedbackTypeOf(node->InputAt(0)),  \
+                                       FeedbackTypeOf(node->InputAt(1))), \
+                        info->restriction_type(), graph_zone());          \
+    break;                                                                \
   }
       SIMPLIFIED_SPECULATIVE_NUMBER_BINOP_LIST(DECLARE_CASE)
 #undef DECLARE_CASE
 
 #define DECLARE_CASE(Name)                                       \
   case IrOpcode::k##Name: {                                      \
     new_type = op_typer_.Name(FeedbackTypeOf(node->InputAt(0))); \
     break;                                                       \
   }
       SIMPLIFIED_NUMBER_UNOP_LIST(DECLARE_CASE)
@@ skipping 18 matching lines @@
       }
 
       case IrOpcode::kSelect: {
         new_type = TypeSelect(node);
         break;
       }
 
       default:
         // Shortcut for operations that we do not handle.
         if (type == nullptr) {
-          type = GetUpperBound(node);
-          info->set_unrestricted_feedback_type(type);
-          info->set_feedback_type(
-              Type::Intersect(type, info->restriction_type(), graph_zone()));
+          GetInfo(node)->set_feedback_type(NodeProperties::GetType(node));
           return true;
         }
         return false;
     }
-    Type* unrestricted_feedback_type = new_type;
-    new_type =
-        Type::Intersect(new_type, info->restriction_type(), graph_zone());
     // We need to guarantee that the feedback type is a subtype of the upper
     // bound. Naively that should hold, but weakening can actually produce
     // a bigger type if we are unlucky with ordering of phi typing. To be
     // really sure, just intersect the upper bound with the feedback type.
     new_type = Type::Intersect(GetUpperBound(node), new_type, graph_zone());
 
     if (type != nullptr && new_type->Is(type)) return false;
-    info->set_unrestricted_feedback_type(unrestricted_feedback_type);
-    info->set_feedback_type(new_type);
+    GetInfo(node)->set_feedback_type(new_type);
     if (FLAG_trace_representation) {
       PrintNodeFeedbackType(node);
     }
     return true;
   }
 
   void PrintNodeFeedbackType(Node* n) {
     OFStream os(stdout);
     os << "#" << n->id() << ":" << *n->op() << "(";
     int j = 0;
@@ skipping 616 matching lines @@
     return WriteBarrierKindFor(base_taggedness, field_representation,
                                field_type, value_representation, value);
   }
 
   Graph* graph() const { return jsgraph_->graph(); }
   CommonOperatorBuilder* common() const { return jsgraph_->common(); }
   SimplifiedOperatorBuilder* simplified() const {
     return jsgraph_->simplified();
   }
 
+  void LowerToCheckedInt32Mul(Node* node, Truncation truncation,
+                              Type* input0_type, Type* input1_type) {
+    // If one of the inputs is positive and/or truncation is being applied,
+    // there is no need to return -0.
+    CheckForMinusZeroMode mz_mode =
+        truncation.IsUsedAsWord32() ||
+                (input0_type->Is(Type::OrderedNumber()) &&
+                 input0_type->Min() > 0) ||
+                (input1_type->Is(Type::OrderedNumber()) &&
+                 input1_type->Min() > 0)
+            ? CheckForMinusZeroMode::kDontCheckForMinusZero
+            : CheckForMinusZeroMode::kCheckForMinusZero;
+
+    NodeProperties::ChangeOp(node, simplified()->CheckedInt32Mul(mz_mode));
+  }
+
   void ChangeToInt32OverflowOp(Node* node) {
     NodeProperties::ChangeOp(node, Int32OverflowOp(node));
   }
 
   void ChangeToUint32OverflowOp(Node* node) {
     NodeProperties::ChangeOp(node, Uint32OverflowOp(node));
   }
 
   void VisitSpeculativeAdditiveOp(Node* node, Truncation truncation,
                                   SimplifiedLowering* lowering) {
     // ToNumber(x) can throw if x is either a Receiver or a Symbol, so we can
     // only eliminate an unused speculative number operation if we know that
     // the inputs are PlainPrimitive, which excludes everything that's might
     // have side effects or throws during a ToNumber conversion.
     if (BothInputsAre(node, Type::PlainPrimitive())) {
       if (truncation.IsUnused()) return VisitUnused(node);
     }
     if (BothInputsAre(node, type_cache_.kAdditiveSafeIntegerOrMinusZero) &&
         (GetUpperBound(node)->Is(Type::Signed32()) ||
          GetUpperBound(node)->Is(Type::Unsigned32()) ||
          truncation.IsUsedAsWord32())) {
       // => Int32Add/Sub
       VisitWord32TruncatingBinop(node);
       if (lower()) ChangeToPureOp(node, Int32Op(node));
       return;
     }
 
-    // We always take SignedSmall/Signed32 feedback otherwise.
-    NumberOperationHint const hint = NumberOperationHintOf(node->op());
+    // Try to use type feedback.
+    NumberOperationHint hint = NumberOperationHintOf(node->op());
+
+    // Handle the case when no int32 checks on inputs are necessary
+    // (but an overflow check is needed on the output).
+    if (BothInputsAre(node, Type::Signed32()) ||
+        (BothInputsAre(node, Type::Signed32OrMinusZero()) &&
+         NodeProperties::GetType(node)->Is(type_cache_.kSafeInteger))) {
+      // If both the inputs the feedback are int32, use the overflow op.
+      if (hint == NumberOperationHint::kSignedSmall ||
+          hint == NumberOperationHint::kSigned32) {
+        VisitBinop(node, UseInfo::TruncatingWord32(),
+                   MachineRepresentation::kWord32, Type::Signed32());
+        if (lower()) ChangeToInt32OverflowOp(node);
+        return;
+      }
+    }
+
     if (hint == NumberOperationHint::kSignedSmall ||
         hint == NumberOperationHint::kSigned32) {
-      // Check if we can guarantee truncations for the inputs.
-      if (BothInputsAre(node, Type::Signed32()) ||
-          (BothInputsAre(node, Type::Signed32OrMinusZero()) &&
-           NodeProperties::GetType(node)->Is(type_cache_.kSafeInteger))) {
-        VisitBinop(node, UseInfo::TruncatingWord32(),
-                   MachineRepresentation::kWord32, Type::Signed32());
-      } else {
-        VisitBinop(node, CheckedUseInfoAsWord32FromHint(hint),
-                   MachineRepresentation::kWord32, Type::Signed32());
-      }
-      if (lower()) {
-        // Avoid overflow checks if the unrestricted feedback type of {node}
-        // suggests that the result will fit into Signed32/Unsigned32 range.
-        Type* const type = UnrestrictedFeedbackTypeOf(node);
-        if (type->Is(Type::Unsigned32())) {
-          ChangeToPureOp(node, Uint32Op(node));
-        } else if (type->Is(Type::Signed32())) {
-          ChangeToPureOp(node, Int32Op(node));
-        } else {
-          ChangeToInt32OverflowOp(node);
-        }
-      }
+      VisitBinop(node, CheckedUseInfoAsWord32FromHint(hint),
+                 MachineRepresentation::kWord32, Type::Signed32());
+      if (lower()) ChangeToInt32OverflowOp(node);
       return;
     }
 
     // default case => Float64Add/Sub
     VisitBinop(node, UseInfo::CheckedNumberOrOddballAsFloat64(),
                MachineRepresentation::kFloat64, Type::Number());
     if (lower()) {
       ChangeToPureOp(node, Float64Op(node));
     }
+    return;
   }
 
   void VisitSpeculativeNumberModulus(Node* node, Truncation truncation,
                                      SimplifiedLowering* lowering) {
     // ToNumber(x) can throw if x is either a Receiver or a Symbol, so we
     // can only eliminate an unused speculative number operation if we know
     // that the inputs are PlainPrimitive, which excludes everything that's
     // might have side effects or throws during a ToNumber conversion.
     if (BothInputsAre(node, Type::PlainPrimitive())) {
       if (truncation.IsUnused()) return VisitUnused(node);
@@ skipping 321 matching lines @@
                   type_cache_.kSafeIntegerOrMinusZero)))) {
           // Multiply reduces to Int32Mul if the inputs are integers, and
           // (a) the output is either known to be Signed32, or
           // (b) the output is known to be Unsigned32, or
           // (c) the uses are truncating and the result is in the safe
           //     integer range.
           VisitWord32TruncatingBinop(node);
           if (lower()) ChangeToPureOp(node, Int32Op(node));
           return;
         }
+        // Try to use type feedback.
+        NumberOperationHint hint = NumberOperationHintOf(node->op());
+        Type* input0_type = TypeOf(node->InputAt(0));
+        Type* input1_type = TypeOf(node->InputAt(1));
 
-        // We always take SignedSmall/Signed32 feedback otherwise.
-        NumberOperationHint const hint = NumberOperationHintOf(node->op());
+        // Handle the case when no int32 checks on inputs are necessary
+        // (but an overflow check is needed on the output).
+        if (BothInputsAre(node, Type::Signed32())) {
+          // If both the inputs the feedback are int32, use the overflow op.
+          if (hint == NumberOperationHint::kSignedSmall ||
+              hint == NumberOperationHint::kSigned32) {
+            VisitBinop(node, UseInfo::TruncatingWord32(),
+                       MachineRepresentation::kWord32, Type::Signed32());
+            if (lower()) {
+              LowerToCheckedInt32Mul(node, truncation, input0_type,
+                                     input1_type);
+            }
+            return;
+          }
+        }
+
         if (hint == NumberOperationHint::kSignedSmall ||
             hint == NumberOperationHint::kSigned32) {
-          // Handle the case when no int32 checks on inputs are necessary
-          // (but an overflow check is needed on the output).
-          if (BothInputsAre(node, Type::Signed32())) {
-            // If both the inputs the feedback are int32, use the overflow op.
-            VisitBinop(node, UseInfo::TruncatingWord32(),
-                       MachineRepresentation::kWord32, Type::Signed32());
-          } else {
-            VisitBinop(node, CheckedUseInfoAsWord32FromHint(hint),
-                       MachineRepresentation::kWord32, Type::Signed32());
-          }
+          VisitBinop(node, CheckedUseInfoAsWord32FromHint(hint),
+                     MachineRepresentation::kWord32, Type::Signed32());
           if (lower()) {
-            // Avoid overflow checks if the unrestricted feedback type of {node}
-            // suggests that the result will fit into Signed32/Unsigned32 range,
-            // or at least try to avoid the expensive minus zero checks.
-            Type* const type = UnrestrictedFeedbackTypeOf(node);
-            if (type->Is(Type::Unsigned32())) {
-              ChangeToPureOp(node, Uint32Op(node));
-            } else if (type->Is(Type::Signed32())) {
-              ChangeToPureOp(node, Int32Op(node));
-            } else {
-              CheckForMinusZeroMode const mode =
-                  (truncation.IdentifiesMinusZeroAndZero() ||
-                   !type->Maybe(Type::MinusZero()))
-                      ? CheckForMinusZeroMode::kDontCheckForMinusZero
-                      : CheckForMinusZeroMode::kCheckForMinusZero;
-              NodeProperties::ChangeOp(node,
-                                       simplified()->CheckedInt32Mul(mode));
-            }
+            LowerToCheckedInt32Mul(node, truncation, input0_type, input1_type);
           }
           return;
         }
 
         // Checked float64 x float64 => float64
         VisitBinop(node, UseInfo::CheckedNumberOrOddballAsFloat64(),
                    MachineRepresentation::kFloat64, Type::Number());
         if (lower()) ChangeToPureOp(node, Float64Op(node));
         return;
       }
@@ skipping 1681 matching lines @@
         isolate(), graph()->zone(), callable.descriptor(), 0, flags,
         Operator::kNoProperties);
     to_number_operator_.set(common()->Call(desc));
   }
   return to_number_operator_.get();
 }
 
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8