Fix misoptimization of 'is' test

runtime/vm/jit_optimizer.cc

 // Copyright (c) 2013, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 #ifndef DART_PRECOMPILED_RUNTIME
 #include "vm/jit_optimizer.h"
 
 #include "vm/bit_vector.h"
 #include "vm/branch_optimizer.h"
 #include "vm/cha.h"
 #include "vm/compiler.h"
 #include "vm/cpu.h"
 #include "vm/dart_entry.h"
 #include "vm/exceptions.h"
 #include "vm/flow_graph_builder.h"
 #include "vm/flow_graph_compiler.h"
 #include "vm/flow_graph_inliner.h"
 #include "vm/flow_graph_range_analysis.h"
 #include "vm/hash_map.h"
 #include "vm/il_printer.h"
 #include "vm/intermediate_language.h"
 #include "vm/object_store.h"
+#include "vm/optimizer.h"
 #include "vm/parser.h"
 #include "vm/resolver.h"
 #include "vm/scopes.h"
 #include "vm/stack_frame.h"
 #include "vm/symbols.h"
 
 namespace dart {
 
 // Quick access to the current isolate and zone.
 #define I (isolate())
@@ skipping 1202 matching lines @@
     const TypeArguments& type_arguments =
         TypeArguments::Handle(type.arguments());
     const bool is_raw_type = type_arguments.IsNull() ||
                              type_arguments.IsRaw(from_index, num_type_params);
     return is_raw_type;
   }
   return true;
 }
 
 
-static bool CidTestResultsContains(const ZoneGrowableArray<intptr_t>& results,
-                                   intptr_t test_cid) {
-  for (intptr_t i = 0; i < results.length(); i += 2) {
-    if (results[i] == test_cid) return true;
-  }
-  return false;
-}
-
-
-static void TryAddTest(ZoneGrowableArray<intptr_t>* results,
-                       intptr_t test_cid,
-                       bool result) {
-  if (!CidTestResultsContains(*results, test_cid)) {
-    results->Add(test_cid);
-    results->Add(result);
-  }
-}
-
-
-// Tries to add cid tests to 'results' so that no deoptimization is
-// necessary.
-// TODO(srdjan): Do also for other than 'int' type.
-static bool TryExpandTestCidsResult(ZoneGrowableArray<intptr_t>* results,
-                                    const AbstractType& type) {
-  ASSERT(results->length() >= 2);  // At least on eentry.
-  const ClassTable& class_table = *Isolate::Current()->class_table();
-  if ((*results)[0] != kSmiCid) {
-    const Class& cls = Class::Handle(class_table.At(kSmiCid));
-    const Class& type_class = Class::Handle(type.type_class());
-    const bool smi_is_subtype =
-        cls.IsSubtypeOf(Object::null_type_arguments(), type_class,
-                        Object::null_type_arguments(), NULL, NULL, Heap::kOld);
-    results->Add((*results)[results->length() - 2]);
-    results->Add((*results)[results->length() - 2]);
-    for (intptr_t i = results->length() - 3; i > 1; --i) {
-      (*results)[i] = (*results)[i - 2];
-    }
-    (*results)[0] = kSmiCid;
-    (*results)[1] = smi_is_subtype;
-  }
-
-  ASSERT(type.IsInstantiated() && !type.IsMalformedOrMalbounded());
-  ASSERT(results->length() >= 2);
-  if (type.IsIntType()) {
-    ASSERT((*results)[0] == kSmiCid);
-    TryAddTest(results, kMintCid, true);
-    TryAddTest(results, kBigintCid, true);
-    // Cannot deoptimize since all tests returning true have been added.
-    return false;
-  }
-
-  return true;  // May deoptimize since we have not identified all 'true' tests.
-}
-
-
 // TODO(srdjan): Use ICData to check if always true or false.
 void JitOptimizer::ReplaceWithInstanceOf(InstanceCallInstr* call) {
   ASSERT(Token::IsTypeTestOperator(call->token_kind()));
   Definition* left = call->ArgumentAt(0);
   Definition* instantiator_type_args = NULL;
   Definition* function_type_args = NULL;
   AbstractType& type = AbstractType::ZoneHandle(Z);
   if (call->ArgumentCount() == 2) {
     instantiator_type_args = flow_graph()->constant_null();
     function_type_args = flow_graph()->constant_null();
     ASSERT(call->MatchesCoreName(Symbols::_simpleInstanceOf()));
     type = AbstractType::Cast(call->ArgumentAt(1)->AsConstant()->value()).raw();
   } else {
     instantiator_type_args = call->ArgumentAt(1);
     function_type_args = call->ArgumentAt(2);
     type = AbstractType::Cast(call->ArgumentAt(3)->AsConstant()->value()).raw();
   }
   const ICData& unary_checks =
       ICData::ZoneHandle(Z, call->ic_data()->AsUnaryClassChecks());
   const intptr_t number_of_checks = unary_checks.NumberOfChecks();
   if ((number_of_checks > 0) &&
       (number_of_checks <= FLAG_max_polymorphic_checks)) {
     ZoneGrowableArray<intptr_t>* results =
         new (Z) ZoneGrowableArray<intptr_t>(number_of_checks * 2);
     Bool& as_bool =
         Bool::ZoneHandle(Z, InstanceOfAsBool(unary_checks, type, results));
     if (as_bool.IsNull()) {
       if (results->length() == number_of_checks * 2) {
-        const bool can_deopt = TryExpandTestCidsResult(results, type);
+        const bool can_deopt =
+            Optimizer::SpecializeTestCidsForNumericTypes(results, type);
         TestCidsInstr* test_cids = new (Z) TestCidsInstr(
             call->token_pos(), Token::kIS, new (Z) Value(left), *results,
             can_deopt ? call->deopt_id() : Thread::kNoDeoptId);
         // Remove type.
         ReplaceCall(call, test_cids);
         return;
       }
     } else {
       // TODO(srdjan): Use TestCidsInstr also for this case.
       // One result only.
@@ skipping 434 matching lines @@
   // Discard the environment from the original instruction because the store
   // can't deoptimize.
   instr->RemoveEnvironment();
   ReplaceCall(instr, store);
   return true;
 }
 
 
 }  // namespace dart
 #endif  // DART_PRECOMPILED_RUNTIME