[turbofan] Track multiple maps for LoadElimination.

src/compiler/js-native-context-specialization.cc

 // Copyright 2015 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/compiler/js-native-context-specialization.h"
 
 #include "src/accessors.h"
 #include "src/code-factory.h"
 #include "src/compilation-dependencies.h"
 #include "src/compiler/access-builder.h"
@@ skipping 625 matching lines @@
 
     // Check for the monomorphic case.
     if (access_infos.size() == 1) {
       ElementAccessInfo access_info = access_infos.front();
 
       // Perform possible elements kind transitions.
       for (auto transition : access_info.transitions()) {
         Handle<Map> const transition_source = transition.first;
         Handle<Map> const transition_target = transition.second;
         effect = graph()->NewNode(
-            simplified()->TransitionElementsKind(
+            simplified()->TransitionElementsKind(ElementsTransition(
                 IsSimpleMapChangeTransition(transition_source->elements_kind(),
                                             transition_target->elements_kind())
                     ? ElementsTransition::kFastTransition
-                    : ElementsTransition::kSlowTransition),
-            receiver, jsgraph()->HeapConstant(transition_source),
-            jsgraph()->HeapConstant(transition_target), effect, control);
+                    : ElementsTransition::kSlowTransition,
+                transition_source, transition_target)),
+            receiver, effect, control);
       }
 
       // TODO(turbofan): The effect/control linearization will not find a
       // FrameState after the StoreField or Call that is generated for the
       // elements kind transition above. This is because those operators
       // don't have the kNoWrite flag on it, even though they are not
       // observable by JavaScript.
       effect = graph()->NewNode(common()->Checkpoint(), frame_state, effect,
                                 control);
 
@@ skipping 24 matching lines @@
         Node* this_index = index;
         Node* this_effect = effect;
         Node* this_control = fallthrough_control;
 
         // Perform possible elements kind transitions.
         for (auto transition : access_info.transitions()) {
           Handle<Map> const transition_source = transition.first;
           Handle<Map> const transition_target = transition.second;
           this_effect = graph()->NewNode(
               simplified()->TransitionElementsKind(
-                  IsSimpleMapChangeTransition(
-                      transition_source->elements_kind(),
-                      transition_target->elements_kind())
-                      ? ElementsTransition::kFastTransition
-                      : ElementsTransition::kSlowTransition),
-              receiver, jsgraph()->HeapConstant(transition_source),
-              jsgraph()->HeapConstant(transition_target), this_effect,
-              this_control);
+                  ElementsTransition(IsSimpleMapChangeTransition(
+                                         transition_source->elements_kind(),
+                                         transition_target->elements_kind())
+                                         ? ElementsTransition::kFastTransition
+                                         : ElementsTransition::kSlowTransition,
+                                     transition_source, transition_target)),
+              receiver, this_effect, this_control);
         }
 
         // Load the {receiver} map.
         Node* receiver_map = this_effect =
             graph()->NewNode(simplified()->LoadField(AccessBuilder::ForMap()),
                              receiver, this_effect, this_control);
 
         // Perform map check(s) on {receiver}.
         MapList const& receiver_maps = access_info.receiver_maps();
         if (j == access_infos.size() - 1) {
@@ skipping 457 matching lines @@
                                             effect, control);
           field_access.write_barrier_kind = kNoWriteBarrier;
           break;
         }
         case MachineRepresentation::kTaggedPointer: {
           // Ensure that {value} is a HeapObject.
           value = BuildCheckHeapObject(value, &effect, control);
           Handle<Map> field_map;
           if (access_info.field_map().ToHandle(&field_map)) {
             // Emit a map check for the value.
-            effect = graph()->NewNode(simplified()->CheckMaps(1), value,
-                                      jsgraph()->HeapConstant(field_map),
-                                      effect, control);
+            effect = graph()->NewNode(
+                simplified()->CheckMaps(ZoneHandleSet<Map>(field_map)), value,
+                effect, control);
           }
           field_access.write_barrier_kind = kPointerWriteBarrier;
           break;
         }
         case MachineRepresentation::kTagged:
           break;
         case MachineRepresentation::kNone:
         case MachineRepresentation::kBit:
         case MachineRepresentation::kWord8:
         case MachineRepresentation::kWord16:
@@ skipping 216 matching lines @@
   } else {
     // Load the elements for the {receiver}.
     Node* elements = effect = graph()->NewNode(
         simplified()->LoadField(AccessBuilder::ForJSObjectElements()), receiver,
         effect, control);
 
     // Don't try to store to a copy-on-write backing store.
     if (access_mode == AccessMode::kStore &&
         IsFastSmiOrObjectElementsKind(elements_kind) &&
         store_mode != STORE_NO_TRANSITION_HANDLE_COW) {
-      effect =
-          graph()->NewNode(simplified()->CheckMaps(1), elements,
-                           jsgraph()->FixedArrayMapConstant(), effect, control);
+      effect = graph()->NewNode(simplified()->CheckMaps(ZoneHandleSet<Map>(
+                                    factory()->fixed_array_map())),
+                                elements, effect, control);
     }
 
     // Check if the {receiver} is a JSArray.
     bool receiver_is_jsarray = HasOnlyJSArrayMaps(receiver_maps);
 
     // Load the length of the {receiver}.
     Node* length = effect =
         receiver_is_jsarray
             ? graph()->NewNode(
                   simplified()->LoadField(
@@ skipping 199 matching lines @@
     }
     default: {
       return *effect = graph()->NewNode(simplified()->CheckHeapObject(),
                                         receiver, *effect, control);
     }
   }
 }
 
 Node* JSNativeContextSpecialization::BuildCheckMaps(
     Node* receiver, Node* effect, Node* control,
-    std::vector<Handle<Map>> const& maps) {
+    std::vector<Handle<Map>> const& receiver_maps) {
   HeapObjectMatcher m(receiver);
   if (m.HasValue()) {
     Handle<Map> receiver_map(m.Value()->map(), isolate());
     if (receiver_map->is_stable()) {
-      for (Handle<Map> map : maps) {
+      for (Handle<Map> map : receiver_maps) {
         if (map.is_identical_to(receiver_map)) {
           dependencies()->AssumeMapStable(receiver_map);
           return effect;
         }
       }
     }
   }
-  int const map_input_count = static_cast<int>(maps.size());
-  int const input_count = 1 + map_input_count + 1 + 1;
-  Node** inputs = zone()->NewArray<Node*>(input_count);
-  inputs[0] = receiver;
-  for (int i = 0; i < map_input_count; ++i) {
-    inputs[1 + i] = jsgraph()->HeapConstant(maps[i]);
+  ZoneHandleSet<Map> maps;
+  for (Handle<Map> map : receiver_maps) {
+    maps.insert(map, graph()->zone());
   }
-  inputs[input_count - 2] = effect;
-  inputs[input_count - 1] = control;
-  return graph()->NewNode(simplified()->CheckMaps(map_input_count), input_count,
-                          inputs);
+  return graph()->NewNode(simplified()->CheckMaps(maps), receiver, effect,
+                          control);
 }
 
 void JSNativeContextSpecialization::AssumePrototypesStable(
     std::vector<Handle<Map>> const& receiver_maps, Handle<JSObject> holder) {
   // Determine actual holder and perform prototype chain checks.
   for (auto map : receiver_maps) {
     // Perform the implicit ToObject for primitives here.
     // Implemented according to ES6 section 7.3.2 GetV (V, P).
     Handle<JSFunction> constructor;
     if (Map::GetConstructorFunction(map, native_context())
@@ skipping 146 matching lines @@
   return jsgraph()->javascript();
 }
 
 SimplifiedOperatorBuilder* JSNativeContextSpecialization::simplified() const {
   return jsgraph()->simplified();
 }
 
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8