[turbofan] Utilize maps from field type tracking to eliminate map checks.

src/compiler/js-global-object-specialization.cc

 // Copyright 2015 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/compiler/js-global-object-specialization.h"
 
 #include "src/compilation-dependencies.h"
 #include "src/compiler/access-builder.h"
 #include "src/compiler/common-operator.h"
 #include "src/compiler/js-graph.h"
@@ skipping 31 matching lines @@
       return ReduceJSStoreGlobal(node);
     default:
       break;
   }
   return NoChange();
 }
 
 namespace {
 
 FieldAccess ForPropertyCellValue(MachineRepresentation representation,
-                                 Type* type, Handle<Name> name) {
+                                 Type* type, MaybeHandle<Map> map,
+                                 Handle<Name> name) {
   WriteBarrierKind kind = kFullWriteBarrier;
   if (representation == MachineRepresentation::kTaggedSigned) {
     kind = kNoWriteBarrier;
   } else if (representation == MachineRepresentation::kTaggedPointer) {
     kind = kPointerWriteBarrier;
   }
   MachineType r = MachineType::TypeForRepresentation(representation);
-  FieldAccess access = {kTaggedBase, PropertyCell::kValueOffset, name, type, r,
-                        kind};
+  FieldAccess access = {
+      kTaggedBase, PropertyCell::kValueOffset, name, map, type, r, kind};
   return access;
 }
 }  // namespace
 
 Reduction JSGlobalObjectSpecialization::ReduceJSLoadGlobal(Node* node) {
   DCHECK_EQ(IrOpcode::kJSLoadGlobal, node->opcode());
   Handle<Name> name = LoadGlobalParametersOf(node->op()).name();
   Node* effect = NodeProperties::GetEffectInput(node);
   Node* control = NodeProperties::GetControlInput(node);
 
@@ skipping 36 matching lines @@
 
   // Load from constant/undefined global property can be constant-folded.
   if (property_details.cell_type() == PropertyCellType::kConstant ||
       property_details.cell_type() == PropertyCellType::kUndefined) {
     Node* value = jsgraph()->Constant(property_cell_value);
     ReplaceWithValue(node, value);
     return Replace(value);
   }
 
   // Load from constant type cell can benefit from type feedback.
+  MaybeHandle<Map> map;
   Type* property_cell_value_type = Type::NonInternal();
   MachineRepresentation representation = MachineRepresentation::kTagged;
   if (property_details.cell_type() == PropertyCellType::kConstantType) {
     // Compute proper type based on the current value in the cell.
     if (property_cell_value->IsSmi()) {
       property_cell_value_type = Type::SignedSmall();
       representation = MachineRepresentation::kTaggedSigned;
     } else if (property_cell_value->IsNumber()) {
       property_cell_value_type = Type::Number();
       representation = MachineRepresentation::kTaggedPointer;
     } else {
-      // TODO(turbofan): Track the property_cell_value_map on the FieldAccess
-      // below and use it in LoadElimination to eliminate map checks.
       Handle<Map> property_cell_value_map(
           Handle<HeapObject>::cast(property_cell_value)->map(), isolate());
       property_cell_value_type = Type::For(property_cell_value_map);
       representation = MachineRepresentation::kTaggedPointer;
+
+      // We can only use the property cell value map for map check elimination
+      // if it's stable, i.e. the HeapObject wasn't mutated without the cell
+      // state being updated.
+      if (property_cell_value_map->is_stable()) {
+        dependencies()->AssumeMapStable(property_cell_value_map);
+        map = property_cell_value_map;
+      }
     }
   }
-  Node* value = effect =
-      graph()->NewNode(simplified()->LoadField(ForPropertyCellValue(
-                           representation, property_cell_value_type, name)),
-                       jsgraph()->HeapConstant(property_cell), effect, control);
+  Node* value = effect = graph()->NewNode(
+      simplified()->LoadField(ForPropertyCellValue(
+          representation, property_cell_value_type, map, name)),
+      jsgraph()->HeapConstant(property_cell), effect, control);
   ReplaceWithValue(node, value, effect, control);
   return Replace(value);
 }
 
 
 Reduction JSGlobalObjectSpecialization::ReduceJSStoreGlobal(Node* node) {
   DCHECK_EQ(IrOpcode::kJSStoreGlobal, node->opcode());
   Handle<Name> name = StoreGlobalParametersOf(node->op()).name();
   Node* value = NodeProperties::GetValueInput(node, 0);
   Node* effect = NodeProperties::GetEffectInput(node);
@@ skipping 60 matching lines @@
                                   value, effect, control);
         property_cell_value_type = Type::OtherInternal();
         representation = MachineRepresentation::kTaggedPointer;
       } else {
         // Check that the {value} is a Smi.
         value = effect =
             graph()->NewNode(simplified()->CheckSmi(), value, effect, control);
         property_cell_value_type = Type::SignedSmall();
         representation = MachineRepresentation::kTaggedSigned;
       }
-      effect = graph()->NewNode(
-          simplified()->StoreField(ForPropertyCellValue(
-              representation, property_cell_value_type, name)),
-          jsgraph()->HeapConstant(property_cell), value, effect, control);
+      effect = graph()->NewNode(simplified()->StoreField(ForPropertyCellValue(
+                                    representation, property_cell_value_type,
+                                    MaybeHandle<Map>(), name)),
+                                jsgraph()->HeapConstant(property_cell), value,
+                                effect, control);
       break;
     }
     case PropertyCellType::kMutable: {
       // Record a code dependency on the cell, and just deoptimize if the
       // property ever becomes read-only.
       dependencies()->AssumePropertyCell(property_cell);
       effect = graph()->NewNode(
           simplified()->StoreField(ForPropertyCellValue(
-              MachineRepresentation::kTagged, Type::NonInternal(), name)),
+              MachineRepresentation::kTagged, Type::NonInternal(),
+              MaybeHandle<Map>(), name)),
           jsgraph()->HeapConstant(property_cell), value, effect, control);
       break;
     }
   }
   ReplaceWithValue(node, value, effect, control);
   return Replace(value);
 }
 
 bool JSGlobalObjectSpecialization::LookupInScriptContextTable(
     Handle<Name> name, ScriptContextTableLookupResult* result) {
@@ skipping 29 matching lines @@
   return jsgraph()->javascript();
 }
 
 SimplifiedOperatorBuilder* JSGlobalObjectSpecialization::simplified() const {
   return jsgraph()->simplified();
 }
 
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8