[turbofan] Fix pushing of JSToBooleans into Phis.

src/compiler/js-typed-lowering.cc

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/compiler/access-builder.h"
 #include "src/compiler/graph-inl.h"
 #include "src/compiler/js-builtin-reducer.h"
 #include "src/compiler/js-typed-lowering.h"
 #include "src/compiler/node-aux-data-inl.h"
 #include "src/compiler/node-properties-inl.h"
@@ skipping 509 matching lines @@
   }
   // TODO(turbofan): js-typed-lowering of ToString(x:boolean)
   // TODO(turbofan): js-typed-lowering of ToString(x:number)
   return NoChange();
 }
 
 
 Reduction JSTypedLowering::ReduceJSToBooleanInput(Node* input) {
   if (input->opcode() == IrOpcode::kJSToBoolean) {
     // Recursively try to reduce the input first.
-    Reduction result = ReduceJSToBooleanInput(input->InputAt(0));
-    if (result.Changed()) {
-      RelaxEffects(input);
-      return result;
-    }
+    Reduction result = ReduceJSToBoolean(input);
+    if (result.Changed()) return result;
     return Changed(input);  // JSToBoolean(JSToBoolean(x)) => JSToBoolean(x)
   }
   Type* input_type = NodeProperties::GetBounds(input).upper;
   if (input_type->Is(Type::Boolean())) {
     return Changed(input);  // JSToBoolean(x:boolean) => x
   }
   if (input_type->Is(Type::Undefined())) {
     // JSToBoolean(undefined) => #false
     return ReplaceWith(jsgraph()->FalseConstant());
   }
@@ skipping 19 matching lines @@
   if (input_type->Is(Type::String())) {
     // JSToBoolean(x:string) => BooleanNot(NumberEqual(x.length, #0))
     FieldAccess access = AccessBuilder::ForStringLength();
     Node* length = graph()->NewNode(simplified()->LoadField(access), input,
                                     graph()->start(), graph()->start());
     Node* cmp = graph()->NewNode(simplified()->NumberEqual(), length,
                                  jsgraph()->ZeroConstant());
     Node* inv = graph()->NewNode(simplified()->BooleanNot(), cmp);
     return ReplaceWith(inv);
   }
-  // TODO(turbofan): We need some kinda of PrimitiveToBoolean simplified
-  // operator, then we can do the pushing in the SimplifiedOperatorReducer
-  // and do not need to protect against stack overflow (because of backedges
-  // in phis) below.
-  if (input->opcode() == IrOpcode::kPhi &&
-      input_type->Is(
-          Type::Union(Type::Boolean(), Type::OrderedNumber(), zone()))) {
-    // JSToBoolean(phi(x1,...,xn):ordered-number|boolean)
-    //   => phi(JSToBoolean(x1),...,JSToBoolean(xn))
-    int input_count = input->InputCount() - 1;
-    Node** inputs = zone()->NewArray<Node*>(input_count + 1);
+  return NoChange();
+}
+
+
+Reduction JSTypedLowering::ReduceJSToBoolean(Node* node) {
+  // Try to reduce the input first.
+  Node* const input = node->InputAt(0);
+  Reduction reduction = ReduceJSToBooleanInput(input);
+  if (reduction.Changed()) {
+    NodeProperties::ReplaceWithValue(node, reduction.replacement());
+    return reduction;
+  }
+  Type* const input_type = NodeProperties::GetBounds(input).upper;
+  if (input->opcode() == IrOpcode::kPhi && input_type->Is(Type::Primitive())) {
+    // JSToBoolean(phi(x1,...,xn,control):primitive)
+    //   => phi(JSToBoolean(x1),...,JSToBoolean(xn),control):boolean
+    RelaxEffects(node);
+    int const input_count = input->InputCount() - 1;
+    Node* const control = input->InputAt(input_count);
+    DCHECK_LE(0, input_count);
+    DCHECK(NodeProperties::IsControl(control));
+    DCHECK(NodeProperties::GetBounds(node).upper->Is(Type::Boolean()));
+    DCHECK(!NodeProperties::GetBounds(input).upper->Is(Type::Boolean()));
+    node->set_op(common()->Phi(kMachAnyTagged, input_count));
     for (int i = 0; i < input_count; ++i) {
       Node* value = input->InputAt(i);
-      Type* value_type = NodeProperties::GetBounds(value).upper;
       // Recursively try to reduce the value first.
-      Reduction result = (value_type->Is(Type::Boolean()) ||
-                          value_type->Is(Type::OrderedNumber()))
-                             ? ReduceJSToBooleanInput(value)
-                             : NoChange();
-      if (result.Changed()) {
-        inputs[i] = result.replacement();
+      Reduction reduction = ReduceJSToBooleanInput(value);
+      if (reduction.Changed()) {
+        value = reduction.replacement();
       } else {
-        inputs[i] = graph()->NewNode(javascript()->ToBoolean(), value,
-                                     jsgraph()->ZeroConstant(),
-                                     graph()->start(), graph()->start());
+        value = graph()->NewNode(javascript()->ToBoolean(), value,
+                                 jsgraph()->ZeroConstant(), graph()->start(),
+                                 graph()->start());
+      }
+      if (i < node->InputCount()) {
+        node->ReplaceInput(i, value);
+      } else {
+        node->AppendInput(graph()->zone(), value);
       }
     }
-    inputs[input_count] = input->InputAt(input_count);
-    Node* phi = graph()->NewNode(common()->Phi(kMachAnyTagged, input_count),
-                                 input_count + 1, inputs);
-    return ReplaceWith(phi);
+    if (input_count < node->InputCount()) {
+      node->ReplaceInput(input_count, control);
+    } else {
+      node->AppendInput(graph()->zone(), control);
+    }
+    node->TrimInputCount(input_count + 1);
+    return Changed(node);
   }
   return NoChange();
 }
 
 
 Reduction JSTypedLowering::ReduceJSLoadProperty(Node* node) {
   Node* key = NodeProperties::GetValueInput(node, 1);
   Node* base = NodeProperties::GetValueInput(node, 0);
   Type* key_type = NodeProperties::GetBounds(key).upper;
   Type* base_type = NodeProperties::GetBounds(base).upper;
@@ skipping 131 matching lines @@
         // JSUnaryNot(x) => BooleanNot(JSToBoolean(x))
         value = graph()->NewNode(simplified()->BooleanNot(), node);
         node->set_op(javascript()->ToBoolean());
         NodeProperties::ReplaceWithValue(node, value, node);
         // Note: ReplaceUses() smashes all uses, so smash it back here.
         value->ReplaceInput(0, node);
         return Changed(node);
       }
     }
     case IrOpcode::kJSToBoolean:
-      return ReplaceWithReduction(node,
-                                  ReduceJSToBooleanInput(node->InputAt(0)));
+      return ReduceJSToBoolean(node);
     case IrOpcode::kJSToNumber:
       return ReplaceWithReduction(node,
                                   ReduceJSToNumberInput(node->InputAt(0)));
     case IrOpcode::kJSToString:
       return ReplaceWithReduction(node,
                                   ReduceJSToStringInput(node->InputAt(0)));
     case IrOpcode::kJSLoadProperty:
       return ReduceJSLoadProperty(node);
     case IrOpcode::kJSStoreProperty:
       return ReduceJSStoreProperty(node);
     case IrOpcode::kJSCallFunction:
       return JSBuiltinReducer(jsgraph()).Reduce(node);
     default:
       break;
   }
   return NoChange();
 }
 
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8