[turbofan] BitcastWordToTagged must not be pure.

src/compiler/machine-operator.cc

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/compiler/machine-operator.h"
 
 #include "src/base/lazy-instance.h"
 #include "src/compiler/opcodes.h"
 #include "src/compiler/operator.h"
 
@@ skipping 117 matching lines @@
   V(Uint64Mod, Operator::kNoProperties, 2, 1, 1)                         \
   V(Uint64LessThan, Operator::kNoProperties, 2, 0, 1)                    \
   V(Uint64LessThanOrEqual, Operator::kNoProperties, 2, 0, 1)
 
 #define PURE_OP_LIST(V)                                                    \
   PURE_BINARY_OP_LIST_32(V)                                                \
   PURE_BINARY_OP_LIST_64(V)                                                \
   V(Word32Clz, Operator::kNoProperties, 1, 0, 1)                           \
   V(Word64Clz, Operator::kNoProperties, 1, 0, 1)                           \
   V(BitcastTaggedToWord, Operator::kNoProperties, 1, 0, 1)                 \
-  V(BitcastWordToTagged, Operator::kNoProperties, 1, 0, 1)                 \
   V(BitcastWordToTaggedSigned, Operator::kNoProperties, 1, 0, 1)           \
   V(TruncateFloat64ToWord32, Operator::kNoProperties, 1, 0, 1)             \
   V(ChangeFloat32ToFloat64, Operator::kNoProperties, 1, 0, 1)              \
   V(ChangeFloat64ToInt32, Operator::kNoProperties, 1, 0, 1)                \
   V(ChangeFloat64ToUint32, Operator::kNoProperties, 1, 0, 1)               \
   V(TruncateFloat64ToUint32, Operator::kNoProperties, 1, 0, 1)             \
   V(TruncateFloat32ToInt32, Operator::kNoProperties, 1, 0, 1)              \
   V(TruncateFloat32ToUint32, Operator::kNoProperties, 1, 0, 1)             \
   V(TryTruncateFloat32ToInt64, Operator::kNoProperties, 1, 0, 2)           \
   V(TryTruncateFloat64ToInt64, Operator::kNoProperties, 1, 0, 2)           \
@@ skipping 451 matching lines @@
     AtomicExchange##Type##Operator()                                      \
         : Operator1<MachineType>(IrOpcode::kAtomicExchange,               \
                                  Operator::kNoDeopt | Operator::kNoThrow, \
                                  "AtomicExchange", 3, 1, 1, 1, 1, 0,      \
                                  MachineType::Type()) {}                  \
   };                                                                      \
   AtomicExchange##Type##Operator kAtomicExchange##Type;
   ATOMIC_TYPE_LIST(ATOMIC_EXCHANGE)
 #undef ATOMIC_EXCHANGE
 
+  // The {BitcastWordToTagged} operator must not be marked as pure (especially
+  // not idempotent), because otherwise the splitting logic in the Scheduler
+  // might decide to split these operators, thus potentially creating live
+  // ranges of allocation top across calls or other things that might allocate.
+  // See https://bugs.chromium.org/p/v8/issues/detail?id=6059 for more details.
+  struct BitcastWordToTaggedOperator : public Operator {
+    BitcastWordToTaggedOperator()
+        : Operator(IrOpcode::kBitcastWordToTagged,
+                   Operator::kEliminatable | Operator::kNoWrite,
+                   "BitcastWordToTagged", 1, 0, 0, 1, 0, 0) {}
+  };
+  BitcastWordToTaggedOperator kBitcastWordToTagged;
+
   struct DebugBreakOperator : public Operator {
     DebugBreakOperator()
         : Operator(IrOpcode::kDebugBreak, Operator::kNoThrow, "DebugBreak", 0,
                    0, 0, 0, 0, 0) {}
   };
   DebugBreakOperator kDebugBreak;
 
   struct UnsafePointerAddOperator final : public Operator {
     UnsafePointerAddOperator()
         : Operator(IrOpcode::kUnsafePointerAdd, Operator::kKontrol,
@@ skipping 157 matching lines @@
       break;
   }
   UNREACHABLE();
   return nullptr;
 }
 
 const Operator* MachineOperatorBuilder::UnsafePointerAdd() {
   return &cache_.kUnsafePointerAdd;
 }
 
+const Operator* MachineOperatorBuilder::BitcastWordToTagged() {
+  return &cache_.kBitcastWordToTagged;
+}
+
 const Operator* MachineOperatorBuilder::DebugBreak() {
   return &cache_.kDebugBreak;
 }
 
 const Operator* MachineOperatorBuilder::Comment(const char* msg) {
   return new (zone_) CommentOperator(msg);
 }
 
 const Operator* MachineOperatorBuilder::CheckedLoad(
     CheckedLoadRepresentation rep) {
@@ skipping 110 matching lines @@
     return new (zone_)                                                         \
         Operator1<uint32_t>(IrOpcode::kSimd##format##Swizzle, Operator::kPure, \
                             "Swizzle", 2, 0, 0, 1, 0, 0, swizzle);             \
   }
 SIMD_FORMAT_LIST(SIMD_PERMUTE_OPS)
 #undef SIMD_PERMUTE_OPS
 
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8