Fix typeof optimization for undetectable

src/compiler/effect-control-linearizer.cc

 // Copyright 2015 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/compiler/effect-control-linearizer.h"
 
 #include "src/code-factory.h"
 #include "src/compiler/access-builder.h"
 #include "src/compiler/compiler-source-position-table.h"
 #include "src/compiler/js-graph.h"
@@ skipping 720 matching lines @@
       break;
     case IrOpcode::kObjectIsSmi:
       result = LowerObjectIsSmi(node);
       break;
     case IrOpcode::kObjectIsString:
       result = LowerObjectIsString(node);
       break;
     case IrOpcode::kObjectIsUndetectable:
       result = LowerObjectIsUndetectable(node);
       break;
+    case IrOpcode::kTypeOfIsFunction:
+      result = LowerObjectTypeOfIsFunction(node);
+      break;
     case IrOpcode::kNewRestParameterElements:
       result = LowerNewRestParameterElements(node);
       break;
     case IrOpcode::kNewUnmappedArgumentsElements:
       result = LowerNewUnmappedArgumentsElements(node);
       break;
     case IrOpcode::kArrayBufferWasNeutered:
       result = LowerArrayBufferWasNeutered(node);
       break;
     case IrOpcode::kStringFromCharCode:
@@ skipping 1089 matching lines @@
       __ Int32Constant(0));
   __ Goto(&done, vfalse);
 
   __ Bind(&if_smi);
   __ Goto(&done, __ Int32Constant(0));
 
   __ Bind(&done);
   return done.PhiAt(0);
 }
 
+Node* EffectControlLinearizer::LowerObjectTypeOfIsFunction(Node* node) {
+  Node* value = node->InputAt(0);
+
+  auto return_false = __ MakeDeferredLabel<3>();
+  auto done = __ MakeLabel<2>(MachineRepresentation::kBit);
+
+  Node* check0 = ObjectIsSmi(value);
+  __ GotoIf(check0, &return_false);
+
+  Node* value_map = __ LoadField(AccessBuilder::ForMap(), value);
+  Node* value_instance_type =
+      __ LoadField(AccessBuilder::ForMapInstanceType(), value_map);
+  Node* check1 = __ Uint32LessThanOrEqual(
+      __ Uint32Constant(FIRST_FUNCTION_TYPE), value_instance_type);
+  __ GotoUnless(check1, &return_false);
+  Node* check2 = __ Uint32LessThanOrEqual(
+      value_instance_type, __ Uint32Constant(LAST_FUNCTION_TYPE));
+  __ GotoUnless(check2, &return_false);

[vabr (Chromium), 2017/02/15 23:36:41]

This ignores proxies (which was helpfully pointed out by proxy-related tests). I
need to figure out how to include function proxies in this check.

[Benedikt Meurer, 2017/02/16 04:01:19]

The code of ObjectIsCallable is the correct code for typeof x==='function', it
just has a misleading name and the typing rule is wrong. So my idea to fix this
was to rename ObjectIsCallabe and fix the typing rule in the Typer.cc.

+
+  __ Goto(&done, __ Int32Constant(1));
+
+  __ Bind(&return_false);
+  __ Goto(&done, __ Int32Constant(0));
+
+  __ Bind(&done);
+  return done.PhiAt(0);
+}
+
 Node* EffectControlLinearizer::LowerNewRestParameterElements(Node* node) {
   int const formal_parameter_count = ParameterCountOf(node->op());
 
   Callable const callable = CodeFactory::NewRestParameterElements(isolate());
   Operator::Properties const properties = node->op()->properties();
   CallDescriptor::Flags const flags = CallDescriptor::kNoFlags;
   CallDescriptor* desc = Linkage::GetStubCallDescriptor(
       isolate(), graph()->zone(), callable.descriptor(), 0, flags, properties);
   return __ Call(desc, __ HeapConstant(callable.code()),
                  __ IntPtrConstant(formal_parameter_count),
@@ skipping 935 matching lines @@
   return isolate()->factory();
 }
 
 Isolate* EffectControlLinearizer::isolate() const {
   return jsgraph()->isolate();
 }
 
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8