[turbofan] Collect and use type feedback on ToNumber.

src/interpreter/interpreter-generator.cc

 // Copyright 2017 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/interpreter/interpreter-generator.h"
 
 #include <array>
 #include <tuple>
 
 #include "src/builtins/builtins-arguments-gen.h"
@@ skipping 1676 matching lines @@
 //
 // Convert the object referenced by the accumulator to a name.
 void InterpreterGenerator::DoToName(InterpreterAssembler* assembler) {
   Node* object = __ GetAccumulator();
   Node* context = __ GetContext();
   Node* result = __ ToName(context, object);
   __ StoreRegister(result, __ BytecodeOperandReg(0));
   __ Dispatch();
 }
 
 // ToNumber

[Michael Starzinger, 2017/04/06 11:28:31]

nit: I know it was already missing before, but a better comment would be: "//
ToNumber <dst> <slot>" here.

[Benedikt Meurer, 2017/04/06 11:30:00]

Done.

 //
 // Convert the object referenced by the accumulator to a number.
 void InterpreterGenerator::DoToNumber(InterpreterAssembler* assembler) {
   Node* object = __ GetAccumulator();
   Node* context = __ GetContext();
-  Node* result = __ ToNumber(context, object);
+
+  // Convert the {object} to a Number and collect feedback for the {object}.
+  Variable var_type_feedback(assembler, MachineRepresentation::kTaggedSigned);
+  Node* result = __ ToNumberWithFeedback(context, object, &var_type_feedback);
   __ StoreRegister(result, __ BytecodeOperandReg(0));
+
+  // Record the type feedback collected for {object}.
+  Node* slot_index = __ BytecodeOperandIdx(1);
+  Node* feedback_vector = __ LoadFeedbackVector();
+  __ UpdateFeedback(var_type_feedback.value(), feedback_vector, slot_index);
+
   __ Dispatch();
 }
 
 // ToObject
 //
 // Convert the object referenced by the accumulator to a JSReceiver.
 void InterpreterGenerator::DoToObject(InterpreterAssembler* assembler) {
   Node* result = BuildUnaryOp(CodeFactory::ToObject(isolate_), assembler);
   __ StoreRegister(result, __ BytecodeOperandReg(0));
   __ Dispatch();
@@ skipping 1881 matching lines @@
   __ StoreObjectField(generator, JSGeneratorObject::kContinuationOffset,
                       __ SmiTag(new_state));
   __ SetAccumulator(old_state);
 
   __ Dispatch();
 }
 
 }  // namespace interpreter
 }  // namespace internal
 }  // namespace v8