| Index: src/compiler/js-native-context-specialization.cc
|
| diff --git a/src/compiler/js-native-context-specialization.cc b/src/compiler/js-native-context-specialization.cc
|
| index fb8e53b034878cc5ec9d203f2832ad98ae3b9db8..be0e3aae58366e920720ae7786d5747971be25e8 100644
|
| --- a/src/compiler/js-native-context-specialization.cc
|
| +++ b/src/compiler/js-native-context-specialization.cc
|
| @@ -138,9 +138,6 @@ Reduction JSNativeContextSpecialization::ReduceJSGetSuperConstructor(
|
| DCHECK_EQ(IrOpcode::kJSGetSuperConstructor, node->opcode());
|
| Node* constructor = NodeProperties::GetValueInput(node, 0);
|
|
|
| - // If deoptimization is disabled, we cannot optimize.
|
| - if (!(flags() & kDeoptimizationEnabled)) return NoChange();
|
| -
|
| // Check if the input is a known JSFunction.
|
| HeapObjectMatcher m(constructor);
|
| if (!m.HasValue()) return NoChange();
|
| @@ -176,9 +173,6 @@ Reduction JSNativeContextSpecialization::ReduceJSInstanceOf(Node* node) {
|
| Node* effect = NodeProperties::GetEffectInput(node);
|
| Node* control = NodeProperties::GetControlInput(node);
|
|
|
| - // If deoptimization is disabled, we cannot optimize.
|
| - if (!(flags() & kDeoptimizationEnabled)) return NoChange();
|
| -
|
| // Check if the right hand side is a known {receiver}.
|
| HeapObjectMatcher m(constructor);
|
| if (!m.HasValue() || !m.Value()->IsJSObject()) return NoChange();
|
| @@ -513,9 +507,6 @@ Reduction JSNativeContextSpecialization::ReduceJSLoadGlobal(Node* node) {
|
| return Replace(value);
|
| }
|
|
|
| - // Not much we can do if deoptimization support is disabled.
|
| - if (!(flags() & kDeoptimizationEnabled)) return NoChange();
|
| -
|
| // Lookup the {name} on the global object instead.
|
| return ReduceGlobalAccess(node, nullptr, nullptr, name, AccessMode::kLoad);
|
| }
|
| @@ -539,9 +530,6 @@ Reduction JSNativeContextSpecialization::ReduceJSStoreGlobal(Node* node) {
|
| return Replace(value);
|
| }
|
|
|
| - // Not much we can do if deoptimization support is disabled.
|
| - if (!(flags() & kDeoptimizationEnabled)) return NoChange();
|
| -
|
| // Lookup the {name} on the global object instead.
|
| return ReduceGlobalAccess(node, nullptr, value, name, AccessMode::kStore);
|
| }
|
| @@ -561,9 +549,6 @@ Reduction JSNativeContextSpecialization::ReduceNamedAccess(
|
| Node* effect = NodeProperties::GetEffectInput(node);
|
| Node* control = NodeProperties::GetControlInput(node);
|
|
|
| - // Not much we can do if deoptimization support is disabled.
|
| - if (!(flags() & kDeoptimizationEnabled)) return NoChange();
|
| -
|
| // Check if we have an access o.x or o.x=v where o is the current
|
| // native contexts' global proxy, and turn that into a direct access
|
| // to the current native contexts' global object instead.
|
| @@ -790,19 +775,16 @@ Reduction JSNativeContextSpecialization::ReduceNamedAccessFromNexus(
|
| Node* const receiver = NodeProperties::GetValueInput(node, 0);
|
| Node* const effect = NodeProperties::GetEffectInput(node);
|
|
|
| - if (flags() & kDeoptimizationEnabled) {
|
| - // Check if we are accessing the current native contexts' global proxy.
|
| - HeapObjectMatcher m(receiver);
|
| - if (m.HasValue() && m.Value().is_identical_to(global_proxy())) {
|
| - // Optimize accesses to the current native contexts' global proxy.
|
| - return ReduceGlobalAccess(node, nullptr, value, name, access_mode);
|
| - }
|
| + // Check if we are accessing the current native contexts' global proxy.
|
| + HeapObjectMatcher m(receiver);
|
| + if (m.HasValue() && m.Value().is_identical_to(global_proxy())) {
|
| + // Optimize accesses to the current native contexts' global proxy.
|
| + return ReduceGlobalAccess(node, nullptr, value, name, access_mode);
|
| }
|
|
|
| // Check if the {nexus} reports type feedback for the IC.
|
| if (nexus.IsUninitialized()) {
|
| - if ((flags() & kDeoptimizationEnabled) &&
|
| - (flags() & kBailoutOnUninitialized)) {
|
| + if (flags() & kBailoutOnUninitialized) {
|
| return ReduceSoftDeoptimize(
|
| node,
|
| DeoptimizeReason::kInsufficientTypeFeedbackForGenericNamedAccess);
|
| @@ -815,8 +797,7 @@ Reduction JSNativeContextSpecialization::ReduceNamedAccessFromNexus(
|
| if (!ExtractReceiverMaps(receiver, effect, nexus, &receiver_maps)) {
|
| return NoChange();
|
| } else if (receiver_maps.length() == 0) {
|
| - if ((flags() & kDeoptimizationEnabled) &&
|
| - (flags() & kBailoutOnUninitialized)) {
|
| + if (flags() & kBailoutOnUninitialized) {
|
| return ReduceSoftDeoptimize(
|
| node,
|
| DeoptimizeReason::kInsufficientTypeFeedbackForGenericNamedAccess);
|
| @@ -847,14 +828,12 @@ Reduction JSNativeContextSpecialization::ReduceJSLoadNamed(Node* node) {
|
| // {function} in order to be notified about changes to the
|
| // "prototype" of {function}, so it doesn't make sense to
|
| // continue unless deoptimization is enabled.
|
| - if (flags() & kDeoptimizationEnabled) {
|
| - Handle<Map> initial_map(function->initial_map(), isolate());
|
| - dependencies()->AssumeInitialMapCantChange(initial_map);
|
| - Handle<Object> prototype(initial_map->prototype(), isolate());
|
| - Node* value = jsgraph()->Constant(prototype);
|
| - ReplaceWithValue(node, value);
|
| - return Replace(value);
|
| - }
|
| + Handle<Map> initial_map(function->initial_map(), isolate());
|
| + dependencies()->AssumeInitialMapCantChange(initial_map);
|
| + Handle<Object> prototype(initial_map->prototype(), isolate());
|
| + Node* value = jsgraph()->Constant(prototype);
|
| + ReplaceWithValue(node, value);
|
| + return Replace(value);
|
| }
|
| } else if (m.Value()->IsString() &&
|
| p.name().is_identical_to(factory()->length_string())) {
|
| @@ -915,9 +894,6 @@ Reduction JSNativeContextSpecialization::ReduceElementAccess(
|
| Node* control = NodeProperties::GetControlInput(node);
|
| Node* frame_state = NodeProperties::FindFrameStateBefore(node);
|
|
|
| - // Not much we can do if deoptimization support is disabled.
|
| - if (!(flags() & kDeoptimizationEnabled)) return NoChange();
|
| -
|
| // Check for keyed access to strings.
|
| if (HasOnlyStringMaps(receiver_maps)) {
|
| // Strings are immutable in JavaScript.
|
| @@ -1163,41 +1139,40 @@ Reduction JSNativeContextSpecialization::ReduceKeyedAccess(
|
| if (mreceiver.HasValue() && mreceiver.Value()->IsString()) {
|
| Handle<String> string = Handle<String>::cast(mreceiver.Value());
|
|
|
| + // Strings are immutable in JavaScript.
|
| + if (access_mode == AccessMode::kStore) return NoChange();
|
| +
|
| + // Properly deal with constant {index}.
|
| + NumberMatcher mindex(index);
|
| + if (mindex.IsInteger() && mindex.IsInRange(0.0, string->length() - 1)) {
|
| + // Constant-fold the {index} access to {string}.
|
| + Node* value = jsgraph()->HeapConstant(
|
| + factory()->LookupSingleCharacterStringFromCode(
|
| + string->Get(static_cast<int>(mindex.Value()))));
|
| + ReplaceWithValue(node, value, effect, control);
|
| + return Replace(value);
|
| + }
|
| +
|
| // We can only assume that the {index} is a valid array index if the IC
|
| // is in element access mode and not MEGAMORPHIC, otherwise there's no
|
| // guard for the bounds check below.
|
| if (nexus.ic_state() != MEGAMORPHIC && nexus.GetKeyType() == ELEMENT) {
|
| - // Strings are immutable in JavaScript.
|
| - if (access_mode == AccessMode::kStore) return NoChange();
|
| -
|
| - // Properly deal with constant {index}.
|
| - NumberMatcher mindex(index);
|
| - if (mindex.IsInteger() && mindex.IsInRange(0.0, string->length() - 1)) {
|
| - // Constant-fold the {index} access to {string}.
|
| - Node* value = jsgraph()->HeapConstant(
|
| - factory()->LookupSingleCharacterStringFromCode(
|
| - string->Get(static_cast<int>(mindex.Value()))));
|
| - ReplaceWithValue(node, value, effect, control);
|
| - return Replace(value);
|
| - } else if (flags() & kDeoptimizationEnabled) {
|
| - // Ensure that {index} is less than {receiver} length.
|
| - Node* length = jsgraph()->Constant(string->length());
|
| - index = effect = graph()->NewNode(simplified()->CheckBounds(), index,
|
| - length, effect, control);
|
| -
|
| - // Return the character from the {receiver} as single character string.
|
| - value = graph()->NewNode(simplified()->StringCharAt(), receiver, index,
|
| - control);
|
| - ReplaceWithValue(node, value, effect, control);
|
| - return Replace(value);
|
| - }
|
| + // Ensure that {index} is less than {receiver} length.
|
| + Node* length = jsgraph()->Constant(string->length());
|
| + index = effect = graph()->NewNode(simplified()->CheckBounds(), index,
|
| + length, effect, control);
|
| +
|
| + // Return the character from the {receiver} as single character string.
|
| + value = graph()->NewNode(simplified()->StringCharAt(), receiver, index,
|
| + control);
|
| + ReplaceWithValue(node, value, effect, control);
|
| + return Replace(value);
|
| }
|
| }
|
|
|
| // Check if the {nexus} reports type feedback for the IC.
|
| if (nexus.IsUninitialized()) {
|
| - if ((flags() & kDeoptimizationEnabled) &&
|
| - (flags() & kBailoutOnUninitialized)) {
|
| + if (flags() & kBailoutOnUninitialized) {
|
| return ReduceSoftDeoptimize(
|
| node,
|
| DeoptimizeReason::kInsufficientTypeFeedbackForGenericKeyedAccess);
|
| @@ -1210,8 +1185,7 @@ Reduction JSNativeContextSpecialization::ReduceKeyedAccess(
|
| if (!ExtractReceiverMaps(receiver, effect, nexus, &receiver_maps)) {
|
| return NoChange();
|
| } else if (receiver_maps.length() == 0) {
|
| - if ((flags() & kDeoptimizationEnabled) &&
|
| - (flags() & kBailoutOnUninitialized)) {
|
| + if (flags() & kBailoutOnUninitialized) {
|
| return ReduceSoftDeoptimize(
|
| node,
|
| DeoptimizeReason::kInsufficientTypeFeedbackForGenericKeyedAccess);
|
| @@ -1681,9 +1655,6 @@ Reduction JSNativeContextSpecialization::ReduceJSStoreDataPropertyInLiteral(
|
| Node* node) {
|
| DCHECK_EQ(IrOpcode::kJSStoreDataPropertyInLiteral, node->opcode());
|
|
|
| - // If deoptimization is disabled, we cannot optimize.
|
| - if (!(flags() & kDeoptimizationEnabled)) return NoChange();
|
| -
|
| FeedbackParameter const& p = FeedbackParameterOf(node->op());
|
|
|
| if (!p.feedback().IsValid()) return NoChange();
|
|
|