[turbofan] Narrow upper bounds during typed lowering.

src/compiler/js-typed-lowering.cc

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/compiler/access-builder.h"
 #include "src/compiler/graph-inl.h"
 #include "src/compiler/js-builtin-reducer.h"
 #include "src/compiler/js-typed-lowering.h"
 #include "src/compiler/node-aux-data-inl.h"
 #include "src/compiler/node-matchers.h"
@@ skipping 96 matching lines @@
   void SwapInputs() {
     Node* l = left();
     Node* r = right();
     node_->ReplaceInput(0, r);
     node_->ReplaceInput(1, l);
     std::swap(left_type_, right_type_);
   }
 
   // Remove all effect and control inputs and outputs to this node and change
   // to the pure operator {op}, possibly inserting a boolean inversion.
-  Reduction ChangeToPureOperator(const Operator* op, bool invert = false) {
+  Reduction ChangeToPureOperator(const Operator* op, bool invert = false,
+                                 Type* type = Type::Any()) {
     DCHECK_EQ(0, op->EffectInputCount());
     DCHECK_EQ(false, OperatorProperties::HasContextInput(op));
     DCHECK_EQ(0, op->ControlInputCount());
     DCHECK_EQ(2, op->ValueInputCount());
 
     // Remove the effects from the node, if any, and update its effect usages.
     if (node_->op()->EffectInputCount() > 0) {
       RelaxEffects(node_);
     }
     // Remove the inputs corresponding to context, effect, and control.
     NodeProperties::RemoveNonValueInputs(node_);
     // Finally, update the operator to the new one.
     node_->set_op(op);
 
+    // TODO(jarin): Narrow the type after patching the operator.

[Jarin, 2014/12/04 10:43:01]

This is not really a big fat TODO. Could you write something like 'Replace the
explicit typing hack with a call to some method that encapsulates changing the
operator and re-typing.'?

[Benedikt Meurer, 2014/12/04 11:19:01]

Done.

+    Bounds const bounds = NodeProperties::GetBounds(node_);
+    NodeProperties::SetBounds(node_, Bounds::NarrowUpper(bounds, type, zone()));
+
     if (invert) {
       // Insert an boolean not to invert the value.
       Node* value = graph()->NewNode(simplified()->BooleanNot(), node_);
       node_->ReplaceUses(value);
       // Note: ReplaceUses() smashes all uses, so smash it back here.
       value->ReplaceInput(0, node_);
       return lowering_->ReplaceWith(value);
     }
     return lowering_->Changed(node_);
   }

[Jarin, 2014/12/04 10:43:01]

Insert an empty line here?

[Benedikt Meurer, 2014/12/04 11:19:01]

Done.

+  Reduction ChangeToPureOperator(const Operator* op, Type* type) {
+    return ChangeToPureOperator(op, false, type);
+  }
 
   bool OneInputIs(Type* t) { return left_type_->Is(t) || right_type_->Is(t); }
 
   bool BothInputsAre(Type* t) {
     return left_type_->Is(t) && right_type_->Is(t);
   }
 
   bool OneInputCannotBe(Type* t) {
     return !left_type_->Maybe(t) || !right_type_->Maybe(t);
   }
 
   bool NeitherInputCanBe(Type* t) {
     return !left_type_->Maybe(t) && !right_type_->Maybe(t);
   }
 
   Node* effect() { return NodeProperties::GetEffectInput(node_); }
   Node* control() { return NodeProperties::GetControlInput(node_); }
   Node* context() { return NodeProperties::GetContextInput(node_); }
   Node* left() { return NodeProperties::GetValueInput(node_, 0); }
   Node* right() { return NodeProperties::GetValueInput(node_, 1); }
   Type* left_type() { return left_type_; }
   Type* right_type() { return right_type_; }
 
   SimplifiedOperatorBuilder* simplified() { return lowering_->simplified(); }
-  Graph* graph() { return lowering_->graph(); }
+  Graph* graph() const { return lowering_->graph(); }
   JSGraph* jsgraph() { return lowering_->jsgraph(); }
   JSOperatorBuilder* javascript() { return lowering_->javascript(); }
   MachineOperatorBuilder* machine() { return lowering_->machine(); }
+  Zone* zone() const { return graph()->zone(); }
 
  private:
   JSTypedLowering* lowering_;  // The containing lowering instance.
   Node* node_;                 // The original node.
   Type* left_type_;            // Cache of the left input's type.
   Type* right_type_;           // Cache of the right input's type.
 
   Node* ConvertToString(Node* node) {
     // Avoid introducing too many eager ToString() operations.
     Reduction reduced = lowering_->ReduceJSToStringInput(node);
@@ skipping 31 matching lines @@
   void update_effect(Node* effect) {
     NodeProperties::ReplaceEffectInput(node_, effect);
   }
 };
 
 
 Reduction JSTypedLowering::ReduceJSAdd(Node* node) {
   JSBinopReduction r(this, node);
   if (r.BothInputsAre(Type::Number())) {
     // JSAdd(x:number, y:number) => NumberAdd(x, y)
-    return r.ChangeToPureOperator(simplified()->NumberAdd());
+    return r.ChangeToPureOperator(simplified()->NumberAdd(), Type::Number());
   }
   Type* maybe_string = Type::Union(Type::String(), Type::Receiver(), zone());
   if (r.BothInputsAre(Type::Primitive()) && r.NeitherInputCanBe(maybe_string)) {
     // JSAdd(x:-string, y:-string) => NumberAdd(ToNumber(x), ToNumber(y))
     r.ConvertInputsToNumber();
-    return r.ChangeToPureOperator(simplified()->NumberAdd());
+    return r.ChangeToPureOperator(simplified()->NumberAdd(), Type::Number());
   }
 #if 0
   // TODO(turbofan): General ToNumber disabled for now because:
   //   a) The inserted ToNumber operation screws up observability of valueOf.
   //   b) Deoptimization at ToNumber doesn't have corresponding bailout id.
   Type* maybe_string = Type::Union(Type::String(), Type::Receiver(), zone());
   if (r.NeitherInputCanBe(maybe_string)) {
     ...
   }
 #endif
@@ skipping 18 matching lines @@
   JSBinopReduction r(this, node);
   if (r.BothInputsAre(Type::Primitive()) || r.OneInputIs(zero_range_)) {
     // TODO(jarin): Propagate frame state input from non-primitive input node to
     // JSToNumber node.
     // TODO(titzer): some Smi bitwise operations don't really require going
     // all the way to int32, which can save tagging/untagging for some
     // operations
     // on some platforms.
     // TODO(turbofan): make this heuristic configurable for code size.
     r.ConvertInputsToInt32(true, true);
-    return r.ChangeToPureOperator(machine()->Word32Or());
+    return r.ChangeToPureOperator(machine()->Word32Or(), Type::Integral32());
   }
   return NoChange();
 }
 
 
 Reduction JSTypedLowering::ReduceJSMultiply(Node* node) {
   JSBinopReduction r(this, node);
   if (r.BothInputsAre(Type::Primitive()) || r.OneInputIs(one_range_)) {
     // TODO(jarin): Propagate frame state input from non-primitive input node to
     // JSToNumber node.
     r.ConvertInputsToNumber();
-    return r.ChangeToPureOperator(simplified()->NumberMultiply());
+    return r.ChangeToPureOperator(simplified()->NumberMultiply(),
+                                  Type::Number());
   }
   // TODO(turbofan): relax/remove the effects of this operator in other cases.
   return NoChange();
 }
 
 
 Reduction JSTypedLowering::ReduceNumberBinop(Node* node,
                                              const Operator* numberOp) {
   JSBinopReduction r(this, node);
   if (r.BothInputsAre(Type::Primitive())) {
     r.ConvertInputsToNumber();
-    return r.ChangeToPureOperator(numberOp);
+    return r.ChangeToPureOperator(numberOp, Type::Number());
   }
 #if 0
   // TODO(turbofan): General ToNumber disabled for now because:
   //   a) The inserted ToNumber operation screws up observability of valueOf.
   //   b) Deoptimization at ToNumber doesn't have corresponding bailout id.
   if (r.OneInputIs(Type::Primitive())) {
     // If at least one input is a primitive, then insert appropriate conversions
     // to number and reduce this operator to the given numeric one.
     // TODO(turbofan): make this heuristic configurable for code size.
     r.ConvertInputsToNumber();
     return r.ChangeToPureOperator(numberOp);
   }
 #endif
   // TODO(turbofan): relax/remove the effects of this operator in other cases.
   return NoChange();
 }
 
 
 Reduction JSTypedLowering::ReduceI32Binop(Node* node, bool left_signed,
                                           bool right_signed,
                                           const Operator* intOp) {
   JSBinopReduction r(this, node);
   if (r.BothInputsAre(Type::Primitive())) {
     // TODO(titzer): some Smi bitwise operations don't really require going
     // all the way to int32, which can save tagging/untagging for some
     // operations
     // on some platforms.
     // TODO(turbofan): make this heuristic configurable for code size.
     r.ConvertInputsToInt32(left_signed, right_signed);
-    return r.ChangeToPureOperator(intOp);
+    return r.ChangeToPureOperator(intOp, Type::Integral32());
   }
   return NoChange();
 }
 
 
 Reduction JSTypedLowering::ReduceI32Shift(Node* node, bool left_signed,
                                           const Operator* shift_op) {
   JSBinopReduction r(this, node);
   if (r.BothInputsAre(Type::Primitive())) {
     r.ConvertInputsForShift(left_signed);
-    return r.ChangeToPureOperator(shift_op);
+    return r.ChangeToPureOperator(shift_op, Type::Integral32());
   }
   return NoChange();
 }
 
 
 Reduction JSTypedLowering::ReduceJSComparison(Node* node) {
   JSBinopReduction r(this, node);
   if (r.BothInputsAre(Type::String())) {
     // If both inputs are definitely strings, perform a string comparison.
     const Operator* stringOp;
@@ skipping 557 matching lines @@
 
 Node* JSTypedLowering::Word32Shl(Node* const lhs, int32_t const rhs) {
   if (rhs == 0) return lhs;
   return graph()->NewNode(machine()->Word32Shl(), lhs,
                           jsgraph()->Int32Constant(rhs));
 }
 
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8