[turbofan] Introduce new Select operator to improve bounds checking.

src/compiler/js-generic-lowering.cc

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/code-factory.h"
 #include "src/code-stubs.h"
 #include "src/compiler/common-operator.h"
 #include "src/compiler/graph-inl.h"
 #include "src/compiler/js-generic-lowering.h"
 #include "src/compiler/machine-operator.h"
@@ skipping 46 matching lines @@
 }
 
 
 Reduction JSGenericLowering::Reduce(Node* node) {
   switch (node->opcode()) {
 #define DECLARE_CASE(x) \
   case IrOpcode::k##x:  \
     Lower##x(node);     \
     break;
     DECLARE_CASE(Branch)
+    DECLARE_CASE(Select)
     JS_OP_LIST(DECLARE_CASE)
 #undef DECLARE_CASE
     default:
       // Nothing to see.
       return NoChange();
   }
   return Changed(node);
 }
 
 
@@ skipping 157 matching lines @@
     // TODO(mstarzinger): If typing is enabled then simplified lowering will
     // have inserted the correct ChangeBoolToBit, otherwise we need to perform
     // poor-man's representation inference here and insert manual change.
     Node* test = graph()->NewNode(machine()->WordEqual(), node->InputAt(0),
                                   jsgraph()->TrueConstant());
     node->ReplaceInput(0, test);
   }
 }
 
 
+void JSGenericLowering::LowerSelect(Node* node) {
+  // TODO(bmeurer): This should probably be moved into a separate file.
+  SelectParameters const& p = SelectParametersOf(node->op());
+  Node* branch = graph()->NewNode(common()->Branch(p.hint()), node->InputAt(0),
+                                  graph()->start());
+  Node* if_true = graph()->NewNode(common()->IfTrue(), branch);
+  Node* vtrue = node->InputAt(1);
+  Node* if_false = graph()->NewNode(common()->IfFalse(), branch);
+  Node* vfalse = node->InputAt(2);
+  Node* merge = graph()->NewNode(common()->Merge(2), if_true, if_false);
+  node->set_op(common()->Phi(p.type(), 2));
+  node->ReplaceInput(0, vtrue);
+  node->ReplaceInput(1, vfalse);
+  node->ReplaceInput(2, merge);
+}
+
+
 void JSGenericLowering::LowerJSUnaryNot(Node* node) {
   Callable callable = CodeFactory::ToBoolean(
       isolate(), ToBooleanStub::RESULT_AS_INVERSE_ODDBALL);
   ReplaceWithStubCall(node, callable, CallDescriptor::kPatchableCallSite);
 }
 
 
 void JSGenericLowering::LowerJSToBoolean(Node* node) {
   Callable callable =
       CodeFactory::ToBoolean(isolate(), ToBooleanStub::RESULT_AS_ODDBALL);
@@ skipping 146 matching lines @@
 
 
 void JSGenericLowering::LowerJSCallRuntime(Node* node) {
   const CallRuntimeParameters& p = CallRuntimeParametersOf(node->op());
   ReplaceWithRuntimeCall(node, p.id(), static_cast<int>(p.arity()));
 }
 
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8