[WIP] TrapHandler 2014/11/27.

src/compiler/simplified-lowering.cc

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/compiler/simplified-lowering.h"
 
 #include <limits>
 
 #include "src/base/bits.h"
 #include "src/code-factory.h"
@@ skipping 746 matching lines @@
         ProcessInput(node, 1, access.machine_type);
         ProcessRemainingInputs(node, 2);
         SetOutput(node, 0);
         if (lower()) lowering->DoStoreField(node);
         break;
       }
       case IrOpcode::kLoadElement: {
         ElementAccess access = ElementAccessOf(node->op());
         ProcessInput(node, 0, changer_->TypeForBasePointer(access));
         ProcessInput(node, 1, kMachInt32);  // element index
-        ProcessInput(node, 2, kMachInt32);  // length
-        ProcessRemainingInputs(node, 3);
-        // Tagged overrides everything if we have to do a typed array bounds
-        // check, because we may need to return undefined then.
-        MachineType output_type =
-            (access.bounds_check == kTypedArrayBoundsCheck &&
-             (use & kRepTagged))
-                ? kMachAnyTagged
-                : access.machine_type;
-        SetOutput(node, output_type);
-        if (lower()) lowering->DoLoadElement(node, output_type);
+        ProcessRemainingInputs(node, 2);
+        SetOutput(node, access.machine_type);
+        if (lower()) lowering->DoLoadElement(node);
         break;
       }
       case IrOpcode::kStoreElement: {
         ElementAccess access = ElementAccessOf(node->op());
         ProcessInput(node, 0, changer_->TypeForBasePointer(access));
         ProcessInput(node, 1, kMachInt32);  // element index
-        ProcessInput(node, 2, kMachInt32);  // length
-        ProcessInput(node, 3, access.machine_type);
+        ProcessInput(node, 2, access.machine_type);
+        ProcessRemainingInputs(node, 3);
+        SetOutput(node, 0);
+        if (lower()) lowering->DoStoreElement(node);
+        break;
+      }
+      case IrOpcode::kLoadBuffer: {
+        BufferAccess const access = BufferAccessOf(node->op());
+        ProcessInput(node, 0, kMachPtr);     // buffer
+        ProcessInput(node, 1, kMachInt32);   // offset
+        ProcessInput(node, 2, kMachUint32);  // length
+        ProcessRemainingInputs(node, 3);
+        // Tagged overrides everything, because we may need to return undefined.
+        MachineType const output_type =
+            (use & kRepTagged) ? kMachAnyTagged : access.machine_type();
+        SetOutput(node, output_type);
+        if (lower()) lowering->DoLoadBuffer(node, output_type);
+        break;
+      }
+      case IrOpcode::kStoreBuffer: {
+        BufferAccess const access = BufferAccessOf(node->op());
+        ProcessInput(node, 0, kMachPtr);               // buffer
+        ProcessInput(node, 1, kMachInt32);             // offset
+        ProcessInput(node, 2, kMachUint32);            // length
+        ProcessInput(node, 3, access.machine_type());  // value
         ProcessRemainingInputs(node, 4);
         SetOutput(node, 0);
-        if (lower()) lowering->DoStoreElement(node);
+        if (lower()) lowering->DoStoreBuffer(node);
+        break;
+      }
+      case IrOpcode::kBoundsCheck: {
+        ProcessInput(node, 0, kRepWord32);
+        ProcessInput(node, 1, kMachUint32);
+        SetOutput(node, kMachUint32);
         break;
       }
       case IrOpcode::kObjectIsSmi: {
         ProcessInput(node, 0, kMachAnyTagged);
         SetOutput(node, kRepBit | kTypeBool);
         if (lower()) {
           Node* is_tagged = jsgraph_->graph()->NewNode(
               jsgraph_->machine()->WordAnd(), node->InputAt(0),
               jsgraph_->Int32Constant(static_cast<int>(kSmiTagMask)));
           Node* is_smi = jsgraph_->graph()->NewNode(
@@ skipping 225 matching lines @@
 
 Node* SimplifiedLowering::IsTagged(Node* node) {
   // TODO(titzer): factor this out to a TaggingScheme abstraction.
   STATIC_ASSERT(kSmiTagMask == 1);  // Only works if tag is the low bit.
   return graph()->NewNode(machine()->WordAnd(), node,
                           jsgraph()->Int32Constant(kSmiTagMask));
 }
 
 
 void SimplifiedLowering::LowerAllNodes() {
-  SimplifiedOperatorBuilder simplified(graph()->zone());
-  RepresentationChanger changer(jsgraph(), &simplified,
+  RepresentationChanger changer(jsgraph(), simplified(),
                                 graph()->zone()->isolate());
   RepresentationSelector selector(jsgraph(), zone(), &changer);
   selector.Run(this);
 }
 
 
 Node* SimplifiedLowering::Untag(Node* node) {
   // TODO(titzer): factor this out to a TaggingScheme abstraction.
   Node* shift_amount = jsgraph()->Int32Constant(kSmiTagSize + kSmiShiftSize);
   return graph()->NewNode(machine()->WordSar(), node, shift_amount);
@@ skipping 38 matching lines @@
   WriteBarrierKind kind = ComputeWriteBarrierKind(
       access.base_is_tagged, access.machine_type, access.type);
   node->set_op(
       machine()->Store(StoreRepresentation(access.machine_type, kind)));
   Node* offset = jsgraph()->IntPtrConstant(access.offset - access.tag());
   node->InsertInput(graph()->zone(), 1, offset);
 }
 
 
 Node* SimplifiedLowering::ComputeIndex(const ElementAccess& access,
-                                       Node* const key) {
+                                       Node* key) {
   Node* index = key;
   const int element_size_shift = ElementSizeLog2Of(access.machine_type);
   if (element_size_shift) {
     index = graph()->NewNode(machine()->Word32Shl(), index,
                              jsgraph()->Int32Constant(element_size_shift));
   }
   const int fixed_offset = access.header_size - access.tag();
   if (fixed_offset) {
     index = graph()->NewNode(machine()->Int32Add(), index,
                              jsgraph()->Int32Constant(fixed_offset));
   }
   if (machine()->Is64()) {
+    index = graph()->NewNode(machine()->ChangeInt32ToInt64(), index);
+  }
+  return index;
+}
+
+
+Node* SimplifiedLowering::ComputeOffset(const BufferAccess& access,
+                                        Node* offset) {
+  int const element_size = ElementSizeOf(access.machine_type());
+  DCHECK_LE(1, element_size);
+  if (element_size > 1) {
+    offset = graph()->NewNode(machine()->Word32And(), offset,
+                              jsgraph()->Int32Constant(~(element_size - 1)));
+  }
+  if (machine()->Is64()) {
     // TODO(turbofan): This is probably only correct for typed arrays, and only
     // if the typed arrays are at most 2GiB in size, which happens to match
     // exactly our current situation.
-    index = graph()->NewNode(machine()->ChangeUint32ToUint64(), index);
+    offset = graph()->NewNode(machine()->ChangeUint32ToUint64(), offset);
   }
-  return index;
+  return offset;
 }
 
 
-namespace {
-
-intptr_t AddressForOutOfBoundsLoad(MachineType type) {
-  switch (RepresentationOf(type)) {
-    case kRepFloat32: {
-      static const float dummy = std::numeric_limits<float>::quiet_NaN();
-      return bit_cast<intptr_t>(&dummy);
-    }
-    case kRepFloat64: {
-      static const double dummy = std::numeric_limits<double>::quiet_NaN();
-      return bit_cast<intptr_t>(&dummy);
-    }
-    case kRepBit:
-    case kRepWord8:
-    case kRepWord16:
-    case kRepWord32: {
-      static const int32_t dummy = 0;
-      return bit_cast<intptr_t>(&dummy);
-    }
-    default:
-      break;
-  }
-  UNREACHABLE();
-  return 0;
-}
-
-
-intptr_t AddressForOutOfBoundsStore() {
-  static volatile double dummy = 0;
-  return bit_cast<intptr_t>(&dummy);
-}
-
-}  // namespace
-
-
-void SimplifiedLowering::DoLoadElement(Node* node, MachineType output_type) {
+void SimplifiedLowering::DoLoadElement(Node* node) {
   const ElementAccess& access = ElementAccessOf(node->op());
-  const Operator* op = machine()->Load(access.machine_type);
   Node* key = node->InputAt(1);
   Node* index = ComputeIndex(access, key);
-  Node* effect = node->InputAt(3);
-  if (access.bounds_check == kNoBoundsCheck) {
-    DCHECK_EQ(access.machine_type, output_type);
-    node->set_op(op);
-    node->ReplaceInput(1, index);
-    node->ReplaceInput(2, effect);
-    node->ReplaceInput(3, graph()->start());
-  } else {
-    DCHECK_EQ(kTypedArrayBoundsCheck, access.bounds_check);
-
-    Node* base = node->InputAt(0);
-    Node* length = node->InputAt(2);
-    Node* check = graph()->NewNode(machine()->Uint32LessThan(), key, length);
-
-    IntPtrMatcher mbase(base);
-    if (mbase.HasValue() && (output_type & kRepTagged) == 0) {
-      Node* select = graph()->NewNode(
-          common()->Select(kMachIntPtr, BranchHint::kTrue), check, index,
-          jsgraph()->IntPtrConstant(AddressForOutOfBoundsLoad(output_type) -
-                                    mbase.Value()));
-
-      node->set_op(op);
-      node->ReplaceInput(1, select);
-      node->ReplaceInput(2, effect);
-      node->ReplaceInput(3, graph()->start());
-    } else {
-      Diamond d(graph(), common(), check, BranchHint::kTrue);
-
-      Node* load = graph()->NewNode(op, base, index, effect, d.if_true);
-      Node* result = load;
-      if (output_type & kRepTagged) {
-        // TODO(turbofan): This is ugly as hell!
-        SimplifiedOperatorBuilder simplified(graph()->zone());
-        RepresentationChanger changer(jsgraph(), &simplified,
-                                      graph()->zone()->isolate());
-        result =
-            changer.GetTaggedRepresentationFor(result, access.machine_type);
-      }
-
-      Node* undefined;
-      if (output_type & kRepTagged) {
-        DCHECK_EQ(0, access.machine_type & kRepTagged);
-        undefined = jsgraph()->UndefinedConstant();
-      } else if (output_type & kRepFloat32) {
-        undefined =
-            jsgraph()->Float32Constant(std::numeric_limits<float>::quiet_NaN());
-      } else if (output_type & kRepFloat64) {
-        undefined = jsgraph()->Float64Constant(
-            std::numeric_limits<double>::quiet_NaN());
-      } else {
-        undefined = jsgraph()->Int32Constant(0);
-      }
-
-      // Replace effect uses of node with the effect phi.
-      NodeProperties::ReplaceWithValue(node, node, d.EffectPhi(load, effect));
-
-      d.OverwriteWithPhi(node, output_type, result, undefined);
-    }
-  }
+  node->set_op(machine()->Load(access.machine_type));
+  node->ReplaceInput(1, index);
 }
 
 
 void SimplifiedLowering::DoStoreElement(Node* node) {
   const ElementAccess& access = ElementAccessOf(node->op());
-  const Operator* op = machine()->Store(StoreRepresentation(
+  Node* key = node->InputAt(1);
+  Node* index = ComputeIndex(access, key);
+  node->set_op(machine()->Store(StoreRepresentation(
       access.machine_type,
       ComputeWriteBarrierKind(access.base_is_tagged, access.machine_type,
-                              access.type)));
-  Node* key = node->InputAt(1);
-  Node* index = ComputeIndex(access, key);
-  if (access.bounds_check == kNoBoundsCheck) {
-    node->set_op(op);
-    node->ReplaceInput(1, index);
+                              access.type))));
+  node->ReplaceInput(1, index);
+}
+
+
+void SimplifiedLowering::DoLoadBuffer(Node* node, MachineType output_type) {
+  BufferAccess const access = BufferAccessOf(node->op());
+  Node* buffer = node->InputAt(0);
+  Node* offset = node->InputAt(1);
+  Node* length = node->InputAt(2);
+  Node* effect = node->InputAt(3);
+  Node* control = node->InputAt(4);
+  size_t const element_size = ElementSizeOf(access.machine_type());
+  if (output_type & kRepTagged || access.guard_size() < element_size) {
+    Node* check = graph()->NewNode(machine()->Uint32LessThan(), offset, length);
+    Node* branch =
+        graph()->NewNode(common()->Branch(BranchHint::kTrue), check, control);
+
+    Node* if_true = graph()->NewNode(common()->IfTrue(), branch);
+    Node* vtrue =
+        graph()->NewNode(machine()->Load(access.machine_type()), buffer,
+                         ComputeOffset(access, offset), effect, if_true);
+    Node* etrue = vtrue;
+    if (output_type & kRepTagged) {
+      // TODO(turbofan): This is ugly as hell!
+      RepresentationChanger changer(jsgraph(), simplified(),
+                                    graph()->zone()->isolate());
+      vtrue = changer.GetTaggedRepresentationFor(vtrue, access.machine_type());
+    }
+
+    Node* if_false = graph()->NewNode(common()->IfFalse(), branch);
+    Node* vfalse;
+    // TODO(bmeurer): Refactor this into a separate method.
+    if (output_type & kRepTagged) {
+      DCHECK_EQ(0, access.machine_type() & kRepTagged);
+      vfalse = jsgraph()->UndefinedConstant();
+    } else if (output_type & kRepFloat32) {
+      vfalse =
+          jsgraph()->Float32Constant(std::numeric_limits<float>::quiet_NaN());
+    } else if (output_type & kRepFloat64) {
+      vfalse =
+          jsgraph()->Float64Constant(std::numeric_limits<double>::quiet_NaN());
+    } else {
+      vfalse = jsgraph()->Int32Constant(0);
+    }
+    Node* efalse = effect;
+
+    Node* merge = graph()->NewNode(common()->Merge(2), if_true, if_false);
+    Node* ephi = graph()->NewNode(common()->EffectPhi(2), etrue, efalse, merge);
+
+    // Replace effect uses of {node} with the EffectPhi {ephi}.
+    NodeProperties::ReplaceWithValue(node, node, ephi);
+
+    // Turn the {node} into a Phi.
+    node->set_op(common()->Phi(output_type, 2));
+    node->ReplaceInput(0, vtrue);
+    node->ReplaceInput(1, vfalse);
+    node->ReplaceInput(2, merge);
+    node->TrimInputCount(3);
+  } else {
+    offset = graph()->NewNode(
+        simplified()->BoundsCheck(access.guard_size() - element_size), offset,
+        length);
+    node->set_op(machine()->Load(access.machine_type()));
+    DCHECK_EQ(buffer, node->InputAt(0));
+    node->ReplaceInput(1, ComputeOffset(access, offset));
     node->RemoveInput(2);
-  } else {
-    DCHECK_EQ(kTypedArrayBoundsCheck, access.bounds_check);
-
-    Node* base = node->InputAt(0);
-    Node* length = node->InputAt(2);
-    Node* value = node->InputAt(3);
-    Node* effect = node->InputAt(4);
-    Node* control = node->InputAt(5);
-    Node* check = graph()->NewNode(machine()->Uint32LessThan(), key, length);
-
-    IntPtrMatcher mbase(base);
-    if (mbase.HasValue()) {
-      Node* select = graph()->NewNode(
-          common()->Select(kMachIntPtr, BranchHint::kTrue), check, index,
-          jsgraph()->IntPtrConstant(AddressForOutOfBoundsStore() -
-                                    mbase.Value()));
-
-      node->set_op(op);
-      node->ReplaceInput(1, select);
-      node->RemoveInput(2);
-    } else {
-      Diamond d(graph(), common(), check, BranchHint::kTrue);
-      d.Chain(control);
-      Node* store = graph()->NewNode(op, base, index, value, effect, d.if_true);
-      d.OverwriteWithEffectPhi(node, store, effect);
-    }
   }
 }
 
+
+void SimplifiedLowering::DoStoreBuffer(Node* node) {
+  BufferAccess const access = BufferAccessOf(node->op());
+  Node* buffer = node->InputAt(0);
+  Node* offset = node->InputAt(1);
+  Node* length = node->InputAt(2);
+  Node* value = node->InputAt(3);
+  Node* effect = node->InputAt(4);
+  Node* control = node->InputAt(5);
+  size_t const element_size = ElementSizeOf(access.machine_type());
+  if (access.guard_size() < element_size) {
+    Node* check = graph()->NewNode(machine()->Uint32LessThan(), offset, length);
+    Node* branch =
+        graph()->NewNode(common()->Branch(BranchHint::kTrue), check, control);
+
+    Node* if_true = graph()->NewNode(common()->IfTrue(), branch);
+    Node* etrue = graph()->NewNode(machine()->Store(StoreRepresentation(
+                                       access.machine_type(), kNoWriteBarrier)),
+                                   buffer, ComputeOffset(access, offset), value,
+                                   effect, if_true);
+
+    Node* if_false = graph()->NewNode(common()->IfFalse(), branch);
+    Node* efalse = effect;
+
+    Node* merge = graph()->NewNode(common()->Merge(2), if_true, if_false);
+
+    // Turn the {node} into an EffectPhi.
+    node->set_op(common()->EffectPhi(2));
+    node->ReplaceInput(0, etrue);
+    node->ReplaceInput(1, efalse);
+    node->ReplaceInput(2, merge);
+    node->TrimInputCount(3);
+  } else {
+    offset = graph()->NewNode(
+        simplified()->BoundsCheck(access.guard_size() - element_size), offset,
+        length);
+    node->set_op(machine()->Store(
+        StoreRepresentation(access.machine_type(), kNoWriteBarrier)));
+    node->ReplaceInput(1, ComputeOffset(access, offset));
+    node->RemoveInput(2);
+  }
+}
+
 
 void SimplifiedLowering::DoStringAdd(Node* node) {
   Callable callable = CodeFactory::StringAdd(
       zone()->isolate(), STRING_ADD_CHECK_NONE, NOT_TENURED);
   CallDescriptor::Flags flags = CallDescriptor::kNoFlags;
   CallDescriptor* desc =
       Linkage::GetStubCallDescriptor(callable.descriptor(), 0, flags, zone());
   node->set_op(common()->Call(desc));
   node->InsertInput(graph()->zone(), 0,
                     jsgraph()->HeapConstant(callable.code()));
@@ skipping 245 matching lines @@
 
 void SimplifiedLowering::DoStringLessThanOrEqual(Node* node) {
   node->set_op(machine()->IntLessThanOrEqual());
   node->ReplaceInput(0, StringComparison(node, true));
   node->ReplaceInput(1, jsgraph()->SmiConstant(EQUAL));
 }
 
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8