[turbofan] Enforce native context specialization.

src/compiler/js-native-context-specialization.cc

 // Copyright 2015 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/compiler/js-native-context-specialization.h"
 
 #include "src/accessors.h"
 #include "src/code-factory.h"
 #include "src/compilation-dependencies.h"
 #include "src/compiler/access-builder.h"
@@ skipping 39 matching lines @@
   for (auto map : maps) {
     if (!map->IsStringMap()) return false;
   }
   return true;
 }
 
 }  // namespace
 
 JSNativeContextSpecialization::JSNativeContextSpecialization(
     Editor* editor, JSGraph* jsgraph, Flags flags,
-    MaybeHandle<Context> native_context, CompilationDependencies* dependencies,
+    Handle<Context> native_context, CompilationDependencies* dependencies,
     Zone* zone)
     : AdvancedReducer(editor),
       jsgraph_(jsgraph),
       flags_(flags),
       native_context_(native_context),
       dependencies_(dependencies),
       zone_(zone),
       type_cache_(TypeCache::Get()) {}
 
-
 Reduction JSNativeContextSpecialization::Reduce(Node* node) {
   switch (node->opcode()) {
     case IrOpcode::kJSLoadContext:
       return ReduceJSLoadContext(node);
     case IrOpcode::kJSLoadNamed:
       return ReduceJSLoadNamed(node);
     case IrOpcode::kJSStoreNamed:
       return ReduceJSStoreNamed(node);
     case IrOpcode::kJSLoadProperty:
       return ReduceJSLoadProperty(node);
     case IrOpcode::kJSStoreProperty:
       return ReduceJSStoreProperty(node);
     default:
       break;
   }
   return NoChange();
 }
 
 Reduction JSNativeContextSpecialization::ReduceJSLoadContext(Node* node) {
   DCHECK_EQ(IrOpcode::kJSLoadContext, node->opcode());
   ContextAccess const& access = ContextAccessOf(node->op());
-  Handle<Context> native_context;
   // Specialize JSLoadContext(NATIVE_CONTEXT_INDEX) to the known native
   // context (if any), so we can constant-fold those fields, which is
   // safe, since the NATIVE_CONTEXT_INDEX slot is always immutable.
-  if (access.index() == Context::NATIVE_CONTEXT_INDEX &&
-      GetNativeContext(node).ToHandle(&native_context)) {
-    Node* value = jsgraph()->HeapConstant(native_context);
+  if (access.index() == Context::NATIVE_CONTEXT_INDEX) {
+    Node* value = jsgraph()->HeapConstant(native_context());
     ReplaceWithValue(node, value);
     return Replace(value);
   }
   return NoChange();
 }
 
 Reduction JSNativeContextSpecialization::ReduceNamedAccess(
     Node* node, Node* value, MapHandleList const& receiver_maps,
     Handle<Name> name, AccessMode access_mode, LanguageMode language_mode,
     Node* index) {
   DCHECK(node->opcode() == IrOpcode::kJSLoadNamed ||
          node->opcode() == IrOpcode::kJSStoreNamed ||
          node->opcode() == IrOpcode::kJSLoadProperty ||
          node->opcode() == IrOpcode::kJSStoreProperty);
   Node* receiver = NodeProperties::GetValueInput(node, 0);
   Node* context = NodeProperties::GetContextInput(node);
   Node* frame_state_eager = NodeProperties::FindFrameStateBefore(node);
   Node* frame_state_lazy = NodeProperties::GetFrameStateInput(node);
   Node* effect = NodeProperties::GetEffectInput(node);
   Node* control = NodeProperties::GetControlInput(node);
 
   // Not much we can do if deoptimization support is disabled.
   if (!(flags() & kDeoptimizationEnabled)) return NoChange();
 
-  // Retrieve the native context from the given {node}.
-  Handle<Context> native_context;
-  if (!GetNativeContext(node).ToHandle(&native_context)) return NoChange();
-
   // Compute property access infos for the receiver maps.
-  AccessInfoFactory access_info_factory(dependencies(), native_context,
+  AccessInfoFactory access_info_factory(dependencies(), native_context(),
                                         graph()->zone());
   ZoneVector<PropertyAccessInfo> access_infos(zone());
   if (!access_info_factory.ComputePropertyAccessInfos(
           receiver_maps, name, access_mode, &access_infos)) {
     return NoChange();
   }
 
   // TODO(turbofan): Add support for inlining into try blocks.
   if (NodeProperties::IsExceptionalCall(node) ||
       !(flags() & kAccessorInliningEnabled)) {
@@ skipping 28 matching lines @@
       receiver = effect = graph()->NewNode(simplified()->CheckNumber(),
                                            receiver, effect, control);
     } else {
       // Monomorphic property access.
       effect = BuildCheckHeapObject(receiver, effect, control);
       effect = BuildCheckMaps(receiver, effect, control,
                               access_info.receiver_maps());
     }
 
     // Generate the actual property access.
-    ValueEffectControl continuation = BuildPropertyAccess(
-        receiver, value, context, frame_state_lazy, effect, control, name,
-        native_context, access_info, access_mode);
+    ValueEffectControl continuation =
+        BuildPropertyAccess(receiver, value, context, frame_state_lazy, effect,
+                            control, name, access_info, access_mode);
     value = continuation.value();
     effect = continuation.effect();
     control = continuation.control();
   } else {
     // The final states for every polymorphic branch. We join them with
     // Merge+Phi+EffectPhi at the bottom.
     ZoneVector<Node*> values(zone());
     ZoneVector<Node*> effects(zone());
     ZoneVector<Node*> controls(zone());
 
@@ skipping 90 matching lines @@
           // FrameState after the EffectPhi that is generated above.
           this_effect =
               graph()->NewNode(common()->Checkpoint(), frame_state_eager,
                                this_effect, this_control);
         }
       }
 
       // Generate the actual property access.
       ValueEffectControl continuation = BuildPropertyAccess(
           this_receiver, this_value, context, frame_state_lazy, this_effect,
-          this_control, name, native_context, access_info, access_mode);
+          this_control, name, access_info, access_mode);
       values.push_back(continuation.value());
       effects.push_back(continuation.effect());
       controls.push_back(continuation.control());
     }
 
     DCHECK_NULL(fallthrough_control);
 
     // Generate the final merge point for all (polymorphic) branches.
     int const control_count = static_cast<int>(controls.size());
     if (control_count == 0) {
@@ skipping 145 matching lines @@
                                       length, effect, control);
 
     // Load the character from the {receiver}.
     value = graph()->NewNode(simplified()->StringCharCodeAt(), receiver, index,
                              control);
 
     // Return it as a single character string.
     value = graph()->NewNode(simplified()->StringFromCharCode(), value);
   } else {
     // Retrieve the native context from the given {node}.
-    Handle<Context> native_context;
-    if (!GetNativeContext(node).ToHandle(&native_context)) return NoChange();
-
     // Compute element access infos for the receiver maps.
-    AccessInfoFactory access_info_factory(dependencies(), native_context,
+    AccessInfoFactory access_info_factory(dependencies(), native_context(),
                                           graph()->zone());
     ZoneVector<ElementAccessInfo> access_infos(zone());
     if (!access_info_factory.ComputeElementAccessInfos(
             receiver_maps, access_mode, &access_infos)) {
       return NoChange();
     }
 
     // Nothing to do if we have no non-deprecated maps.
     if (access_infos.empty()) {
       return ReduceSoftDeoptimize(
@@ skipping 65 matching lines @@
       // don't have the kNoWrite flag on it, even though they are not
       // observable by JavaScript.
       effect = graph()->NewNode(common()->Checkpoint(), frame_state, effect,
                                 control);
 
       // Perform map check on the {receiver}.
       effect = BuildCheckMaps(receiver, effect, control,
                               access_info.receiver_maps());
 
       // Access the actual element.
-      ValueEffectControl continuation = BuildElementAccess(
-          receiver, index, value, effect, control, native_context, access_info,
-          access_mode, store_mode);
+      ValueEffectControl continuation =
+          BuildElementAccess(receiver, index, value, effect, control,
+                             access_info, access_mode, store_mode);
       value = continuation.value();
       effect = continuation.effect();
       control = continuation.control();
     } else {
       // The final states for every polymorphic branch. We join them with
       // Merge+Phi+EffectPhi at the bottom.
       ZoneVector<Node*> values(zone());
       ZoneVector<Node*> effects(zone());
       ZoneVector<Node*> controls(zone());
 
@@ skipping 78 matching lines @@
             // TODO(turbofan): The effect/control linearization will not find a
             // FrameState after the EffectPhi that is generated above.
             this_effect = graph()->NewNode(common()->Checkpoint(), frame_state,
                                            this_effect, this_control);
           }
         }
 
         // Access the actual element.
         ValueEffectControl continuation = BuildElementAccess(
             this_receiver, this_index, this_value, this_effect, this_control,
-            native_context, access_info, access_mode, store_mode);
+            access_info, access_mode, store_mode);
         values.push_back(continuation.value());
         effects.push_back(continuation.effect());
         controls.push_back(continuation.control());
       }
 
       DCHECK_NULL(fallthrough_control);
 
       // Generate the final merge point for all (polymorphic) branches.
       int const control_count = static_cast<int>(controls.size());
       if (control_count == 0) {
@@ skipping 140 matching lines @@
   KeyedAccessStoreMode store_mode = nexus.GetKeyedAccessStoreMode();
 
   // Try to lower the keyed access based on the {nexus}.
   return ReduceKeyedAccess(node, index, value, nexus, AccessMode::kStore,
                            p.language_mode(), store_mode);
 }
 
 JSNativeContextSpecialization::ValueEffectControl
 JSNativeContextSpecialization::BuildPropertyAccess(
     Node* receiver, Node* value, Node* context, Node* frame_state, Node* effect,
-    Node* control, Handle<Name> name, Handle<Context> native_context,
-    PropertyAccessInfo const& access_info, AccessMode access_mode) {
+    Node* control, Handle<Name> name, PropertyAccessInfo const& access_info,
+    AccessMode access_mode) {
   // Determine actual holder and perform prototype chain checks.
   Handle<JSObject> holder;
   if (access_info.holder().ToHandle(&holder)) {
-    AssumePrototypesStable(access_info.receiver_maps(), native_context, holder);
+    AssumePrototypesStable(access_info.receiver_maps(), holder);
   }
 
   // Generate the actual property access.
   if (access_info.IsNotFound()) {
     DCHECK_EQ(AccessMode::kLoad, access_mode);
     value = jsgraph()->UndefinedConstant();
   } else if (access_info.IsDataConstant()) {
     value = jsgraph()->Constant(access_info.constant());
     if (access_mode == AccessMode::kStore) {
       Node* check =
@@ skipping 227 matching lines @@
   }
   UNREACHABLE();
   return kExternalInt8Array;
 }
 
 }  // namespace
 
 JSNativeContextSpecialization::ValueEffectControl
 JSNativeContextSpecialization::BuildElementAccess(
     Node* receiver, Node* index, Node* value, Node* effect, Node* control,
-    Handle<Context> native_context, ElementAccessInfo const& access_info,
-    AccessMode access_mode, KeyedAccessStoreMode store_mode) {
+    ElementAccessInfo const& access_info, AccessMode access_mode,
+    KeyedAccessStoreMode store_mode) {
   // TODO(bmeurer): We currently specialize based on elements kind. We should
   // also be able to properly support strings and other JSObjects here.
   ElementsKind elements_kind = access_info.elements_kind();
   MapList const& receiver_maps = access_info.receiver_maps();
 
   // Load the elements for the {receiver}.
   Node* elements = effect = graph()->NewNode(
       simplified()->LoadField(AccessBuilder::ForJSObjectElements()), receiver,
       effect, control);
 
@@ skipping 154 matching lines @@
       }
       // Perform the actual backing store access.
       value = effect =
           graph()->NewNode(simplified()->LoadElement(element_access), elements,
                            index, effect, control);
       // Handle loading from holey backing stores correctly, by either mapping
       // the hole to undefined if possible, or deoptimizing otherwise.
       if (elements_kind == FAST_HOLEY_ELEMENTS ||
           elements_kind == FAST_HOLEY_SMI_ELEMENTS) {
         // Check if we are allowed to turn the hole into undefined.
-        if (CanTreatHoleAsUndefined(receiver_maps, native_context)) {
+        if (CanTreatHoleAsUndefined(receiver_maps)) {
           // Turn the hole into undefined.
           value = graph()->NewNode(simplified()->ConvertTaggedHoleToUndefined(),
                                    value);
         } else {
           // Bailout if we see the hole.
           value = effect = graph()->NewNode(simplified()->CheckTaggedHole(),
                                             value, effect, control);
         }
       } else if (elements_kind == FAST_HOLEY_DOUBLE_ELEMENTS) {
         // Perform the hole check on the result.
         CheckFloat64HoleMode mode = CheckFloat64HoleMode::kNeverReturnHole;
         // Check if we are allowed to return the hole directly.
-        if (CanTreatHoleAsUndefined(receiver_maps, native_context)) {
+        if (CanTreatHoleAsUndefined(receiver_maps)) {
           // Return the signaling NaN hole directly if all uses are truncating.
           mode = CheckFloat64HoleMode::kAllowReturnHole;
         }
         value = effect = graph()->NewNode(simplified()->CheckFloat64Hole(mode),
                                           value, effect, control);
       }
     } else {
       DCHECK_EQ(AccessMode::kStore, access_mode);
       if (IsFastSmiElementsKind(elements_kind)) {
         value = effect =
@@ skipping 89 matching lines @@
       return effect;
     }
     default: {
       return graph()->NewNode(simplified()->CheckHeapObject(), receiver, effect,
                               control);
     }
   }
 }
 
 void JSNativeContextSpecialization::AssumePrototypesStable(
-    std::vector<Handle<Map>> const& receiver_maps,
-    Handle<Context> native_context, Handle<JSObject> holder) {
+    std::vector<Handle<Map>> const& receiver_maps, Handle<JSObject> holder) {
   // Determine actual holder and perform prototype chain checks.
   for (auto map : receiver_maps) {
     // Perform the implicit ToObject for primitives here.
     // Implemented according to ES6 section 7.3.2 GetV (V, P).
     Handle<JSFunction> constructor;
-    if (Map::GetConstructorFunction(map, native_context)
+    if (Map::GetConstructorFunction(map, native_context())
             .ToHandle(&constructor)) {
       map = handle(constructor->initial_map(), isolate());
     }
     dependencies()->AssumePrototypeMapsStable(map, holder);
   }
 }
 
 bool JSNativeContextSpecialization::CanTreatHoleAsUndefined(
-    std::vector<Handle<Map>> const& receiver_maps,
-    Handle<Context> native_context) {
+    std::vector<Handle<Map>> const& receiver_maps) {
   // Check if the array prototype chain is intact.
   if (!isolate()->IsFastArrayConstructorPrototypeChainIntact()) return false;
 
   // Make sure both the initial Array and Object prototypes are stable.
   Handle<JSObject> initial_array_prototype(
-      native_context->initial_array_prototype(), isolate());
+      native_context()->initial_array_prototype(), isolate());
   Handle<JSObject> initial_object_prototype(
-      native_context->initial_object_prototype(), isolate());
+      native_context()->initial_object_prototype(), isolate());
   if (!initial_array_prototype->map()->is_stable() ||
       !initial_object_prototype->map()->is_stable()) {
     return false;
   }
 
   // Check if all {receiver_maps} either have the initial Array.prototype
   // or the initial Object.prototype as their prototype, as those are
   // guarded by the array protector cell.
   for (Handle<Map> map : receiver_maps) {
     if (map->prototype() != *initial_array_prototype &&
@@ skipping 88 matching lines @@
         if (initial_map->constructor_or_backpointer() == *mnewtarget.Value()) {
           DCHECK_EQ(*initial_map, initial_map->FindRootMap());
           return initial_map;
         }
       }
     }
   }
   return MaybeHandle<Map>();
 }
 
-MaybeHandle<Context> JSNativeContextSpecialization::GetNativeContext(
-    Node* node) {
-  Node* const context = NodeProperties::GetContextInput(node);
-  return NodeProperties::GetSpecializationNativeContext(context,
-                                                        native_context());
-}
-
-
 Graph* JSNativeContextSpecialization::graph() const {
   return jsgraph()->graph();
 }
 
-
 Isolate* JSNativeContextSpecialization::isolate() const {
   return jsgraph()->isolate();
 }
 
-
 Factory* JSNativeContextSpecialization::factory() const {
   return isolate()->factory();
 }
 
-
 MachineOperatorBuilder* JSNativeContextSpecialization::machine() const {
   return jsgraph()->machine();
 }
 
-
 CommonOperatorBuilder* JSNativeContextSpecialization::common() const {
   return jsgraph()->common();
 }
 
-
 JSOperatorBuilder* JSNativeContextSpecialization::javascript() const {
   return jsgraph()->javascript();
 }
 
-
 SimplifiedOperatorBuilder* JSNativeContextSpecialization::simplified() const {
   return jsgraph()->simplified();
 }
 
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8