[turbofan] Improve representation selection for Smi checking.

src/compiler/js-native-context-specialization.cc

 // Copyright 2015 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/compiler/js-native-context-specialization.h"
 
 #include "src/accessors.h"
 #include "src/code-factory.h"
 #include "src/compilation-dependencies.h"
 #include "src/compiler/access-builder.h"
@@ skipping 150 matching lines @@
       // Monormorphic string access (ignoring the fact that there are multiple
       // String maps).
       receiver = effect = graph()->NewNode(simplified()->CheckString(),
                                            receiver, effect, control);
     } else if (HasOnlyNumberMaps(access_info.receiver_maps())) {
       // Monomorphic number access (we also deal with Smis here).
       receiver = effect = graph()->NewNode(simplified()->CheckNumber(),
                                            receiver, effect, control);
     } else {
       // Monomorphic property access.
-      effect = BuildCheckTaggedPointer(receiver, effect, control);
+      effect = BuildCheckHeapObject(receiver, effect, control);
       effect = BuildCheckMaps(receiver, effect, control,
                               access_info.receiver_maps());
     }
 
     // Generate the actual property access.
     ValueEffectControl continuation = BuildPropertyAccess(
         receiver, value, context, frame_state_lazy, effect, control, name,
         native_context, access_info, access_mode);
     value = continuation.value();
     effect = continuation.effect();
@@ skipping 17 matching lines @@
     // Ensure that {receiver} is a heap object.
     Node* receiverissmi_control = nullptr;
     Node* receiverissmi_effect = effect;
     if (receiverissmi_possible) {
       Node* check = graph()->NewNode(simplified()->ObjectIsSmi(), receiver);
       Node* branch = graph()->NewNode(common()->Branch(), check, control);
       control = graph()->NewNode(common()->IfFalse(), branch);
       receiverissmi_control = graph()->NewNode(common()->IfTrue(), branch);
       receiverissmi_effect = effect;
     } else {
-      effect = BuildCheckTaggedPointer(receiver, effect, control);
+      effect = BuildCheckHeapObject(receiver, effect, control);
     }
 
     // Load the {receiver} map. The resulting effect is the dominating effect
     // for all (polymorphic) branches.
     Node* receiver_map = effect =
         graph()->NewNode(simplified()->LoadField(AccessBuilder::ForMap()),
                          receiver, effect, control);
 
     // Generate code for the various different property access patterns.
     Node* fallthrough_control = control;
@@ skipping 283 matching lines @@
         }
       }
 
       // Install dependencies on the relevant prototype maps.
       for (Handle<Map> prototype_map : prototype_maps) {
         dependencies()->AssumeMapStable(prototype_map);
       }
     }
 
     // Ensure that {receiver} is a heap object.
-    effect = BuildCheckTaggedPointer(receiver, effect, control);
+    effect = BuildCheckHeapObject(receiver, effect, control);
 
     // Check for the monomorphic case.
     if (access_infos.size() == 1) {
       ElementAccessInfo access_info = access_infos.front();
 
       // Perform possible elements kind transitions.
       for (auto transition : access_info.transitions()) {
         Handle<Map> const transition_source = transition.first;
         Handle<Map> const transition_target = transition.second;
         effect = graph()->NewNode(
@@ skipping 440 matching lines @@
                   graph()->NewNode(simplified()->LoadField(storage_access),
                                    storage, effect, control);
               field_access.offset = HeapNumber::kValueOffset;
               field_access.name = MaybeHandle<Name>();
               field_access.machine_type = MachineType::Float64();
             }
           }
           break;
         }
         case MachineRepresentation::kTaggedSigned: {
-          value = effect = graph()->NewNode(simplified()->CheckTaggedSigned(),
-                                            value, effect, control);
+          value = effect = graph()->NewNode(simplified()->CheckSmi(), value,
+                                            effect, control);
           field_access.write_barrier_kind = kNoWriteBarrier;
           break;
         }
         case MachineRepresentation::kTaggedPointer: {
           // Ensure that {value} is a HeapObject.
-          value = effect = graph()->NewNode(simplified()->CheckTaggedPointer(),
+          value = effect = graph()->NewNode(simplified()->CheckHeapObject(),
                                             value, effect, control);
           Handle<Map> field_map;
           if (access_info.field_map().ToHandle(&field_map)) {
             // Emit a map check for the value.
             effect = graph()->NewNode(simplified()->CheckMaps(1), value,
                                       jsgraph()->HeapConstant(field_map),
                                       effect, control);
           }
           field_access.write_barrier_kind = kPointerWriteBarrier;
           break;
@@ skipping 244 matching lines @@
         if (CanTreatHoleAsUndefined(receiver_maps, native_context)) {
           // Return the signaling NaN hole directly if all uses are truncating.
           mode = CheckFloat64HoleMode::kAllowReturnHole;
         }
         value = effect = graph()->NewNode(simplified()->CheckFloat64Hole(mode),
                                           value, effect, control);
       }
     } else {
       DCHECK_EQ(AccessMode::kStore, access_mode);
       if (IsFastSmiElementsKind(elements_kind)) {
-        value = effect = graph()->NewNode(simplified()->CheckTaggedSigned(),
-                                          value, effect, control);
+        value = effect =
+            graph()->NewNode(simplified()->CheckSmi(), value, effect, control);
       } else if (IsFastDoubleElementsKind(elements_kind)) {
         value = effect = graph()->NewNode(simplified()->CheckNumber(), value,
                                           effect, control);
         // Make sure we do not store signalling NaNs into double arrays.
         value = graph()->NewNode(simplified()->NumberSilenceNaN(), value);
       }
 
       // Ensure that copy-on-write backing store is writable.
       if (IsFastSmiOrObjectElementsKind(elements_kind) &&
           store_mode == STORE_NO_TRANSITION_HANDLE_COW) {
@@ skipping 50 matching lines @@
   inputs[0] = receiver;
   for (int i = 0; i < map_input_count; ++i) {
     inputs[1 + i] = jsgraph()->HeapConstant(maps[i]);
   }
   inputs[input_count - 2] = effect;
   inputs[input_count - 1] = control;
   return graph()->NewNode(simplified()->CheckMaps(map_input_count), input_count,
                           inputs);
 }
 
-Node* JSNativeContextSpecialization::BuildCheckTaggedPointer(Node* receiver,
-                                                             Node* effect,
-                                                             Node* control) {
+Node* JSNativeContextSpecialization::BuildCheckHeapObject(Node* receiver,
+                                                          Node* effect,
+                                                          Node* control) {
   switch (receiver->opcode()) {
     case IrOpcode::kHeapConstant:
     case IrOpcode::kJSCreate:
     case IrOpcode::kJSCreateArguments:
     case IrOpcode::kJSCreateArray:
     case IrOpcode::kJSCreateClosure:
     case IrOpcode::kJSCreateIterResultObject:
     case IrOpcode::kJSCreateLiteralArray:
     case IrOpcode::kJSCreateLiteralObject:
     case IrOpcode::kJSCreateLiteralRegExp:
     case IrOpcode::kJSConvertReceiver:
     case IrOpcode::kJSToName:
     case IrOpcode::kJSToString:
     case IrOpcode::kJSToObject:
     case IrOpcode::kJSTypeOf: {
       return effect;
     }
     default: {
-      return graph()->NewNode(simplified()->CheckTaggedPointer(), receiver,
-                              effect, control);
+      return graph()->NewNode(simplified()->CheckHeapObject(), receiver, effect,
+                              control);
     }
   }
 }
 
 void JSNativeContextSpecialization::AssumePrototypesStable(
     std::vector<Handle<Map>> const& receiver_maps,
     Handle<Context> native_context, Handle<JSObject> holder) {
   // Determine actual holder and perform prototype chain checks.
   for (auto map : receiver_maps) {
     // Perform the implicit ToObject for primitives here.
@@ skipping 164 matching lines @@
 }
 
 
 SimplifiedOperatorBuilder* JSNativeContextSpecialization::simplified() const {
   return jsgraph()->simplified();
 }
 
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8