[turbofan] Turn JSToBoolean and JSUnaryNot into pure operators.

src/compiler/js-typed-lowering.cc

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/compiler/access-builder.h"
 #include "src/compiler/graph-inl.h"
 #include "src/compiler/js-builtin-reducer.h"
 #include "src/compiler/js-typed-lowering.h"
 #include "src/compiler/node-aux-data-inl.h"
 #include "src/compiler/node-matchers.h"
@@ skipping 123 matching lines @@
     // that encapsulates changing the operator and re-typing.
     Bounds const bounds = NodeProperties::GetBounds(node_);
     NodeProperties::SetBounds(node_, Bounds::NarrowUpper(bounds, type, zone()));
 
     if (invert) {
       // Insert an boolean not to invert the value.
       Node* value = graph()->NewNode(simplified()->BooleanNot(), node_);
       node_->ReplaceUses(value);
       // Note: ReplaceUses() smashes all uses, so smash it back here.
       value->ReplaceInput(0, node_);
-      return lowering_->ReplaceWith(value);
+      return lowering_->Replace(value);
     }
     return lowering_->Changed(node_);
   }
 
   Reduction ChangeToPureOperator(const Operator* op, Type* type) {
     return ChangeToPureOperator(op, false, type);
   }
 
   bool OneInputIs(Type* t) { return left_type_->Is(t) || right_type_->Is(t); }
 
@@ skipping 342 matching lines @@
     if (result.Changed()) return result;
     return Changed(input);  // JSToNumber(JSToNumber(x)) => JSToNumber(x)
   }
   Type* input_type = NodeProperties::GetBounds(input).upper;
   if (input_type->Is(Type::Number())) {
     // JSToNumber(x:number) => x
     return Changed(input);
   }
   if (input_type->Is(Type::Undefined())) {
     // JSToNumber(undefined) => #NaN
-    return ReplaceWith(jsgraph()->NaNConstant());
+    return Replace(jsgraph()->NaNConstant());
   }
   if (input_type->Is(Type::Null())) {
     // JSToNumber(null) => #0
-    return ReplaceWith(jsgraph()->ZeroConstant());
+    return Replace(jsgraph()->ZeroConstant());
   }
   if (input_type->Is(Type::Boolean())) {
     // JSToNumber(x:boolean) => BooleanToNumber(x)
-    return ReplaceWith(
-        graph()->NewNode(simplified()->BooleanToNumber(), input));
+    return Replace(graph()->NewNode(simplified()->BooleanToNumber(), input));
   }
   // TODO(turbofan): js-typed-lowering of ToNumber(x:string)
   return NoChange();
 }
 
 
 Reduction JSTypedLowering::ReduceJSToNumber(Node* node) {
   // Try to reduce the input first.
   Node* const input = node->InputAt(0);
   Reduction reduction = ReduceJSToNumberInput(input);
@@ skipping 50 matching lines @@
       RelaxEffects(input);
       return result;
     }
     return Changed(input);  // JSToString(JSToString(x)) => JSToString(x)
   }
   Type* input_type = NodeProperties::GetBounds(input).upper;
   if (input_type->Is(Type::String())) {
     return Changed(input);  // JSToString(x:string) => x
   }
   if (input_type->Is(Type::Undefined())) {
-    return ReplaceWith(jsgraph()->HeapConstant(
+    return Replace(jsgraph()->HeapConstant(
         graph()->zone()->isolate()->factory()->undefined_string()));
   }
   if (input_type->Is(Type::Null())) {
-    return ReplaceWith(jsgraph()->HeapConstant(
+    return Replace(jsgraph()->HeapConstant(
         graph()->zone()->isolate()->factory()->null_string()));
   }
   // TODO(turbofan): js-typed-lowering of ToString(x:boolean)
   // TODO(turbofan): js-typed-lowering of ToString(x:number)
   return NoChange();
 }
 
 
 Reduction JSTypedLowering::ReduceJSToBooleanInput(Node* input) {
   if (input->opcode() == IrOpcode::kJSToBoolean) {
     // Recursively try to reduce the input first.
     Reduction result = ReduceJSToBoolean(input);
     if (result.Changed()) return result;
     return Changed(input);  // JSToBoolean(JSToBoolean(x)) => JSToBoolean(x)
   }
   Type* input_type = NodeProperties::GetBounds(input).upper;
   if (input_type->Is(Type::Boolean())) {
     return Changed(input);  // JSToBoolean(x:boolean) => x
   }
   if (input_type->Is(Type::Undefined())) {
     // JSToBoolean(undefined) => #false
-    return ReplaceWith(jsgraph()->FalseConstant());
+    return Replace(jsgraph()->FalseConstant());
   }
   if (input_type->Is(Type::Null())) {
     // JSToBoolean(null) => #false
-    return ReplaceWith(jsgraph()->FalseConstant());
+    return Replace(jsgraph()->FalseConstant());
   }
   if (input_type->Is(Type::DetectableReceiver())) {
     // JSToBoolean(x:detectable) => #true
-    return ReplaceWith(jsgraph()->TrueConstant());
+    return Replace(jsgraph()->TrueConstant());
   }
   if (input_type->Is(Type::Undetectable())) {
     // JSToBoolean(x:undetectable) => #false
-    return ReplaceWith(jsgraph()->FalseConstant());
+    return Replace(jsgraph()->FalseConstant());
   }
   if (input_type->Is(Type::OrderedNumber())) {
     // JSToBoolean(x:ordered-number) => BooleanNot(NumberEqual(x, #0))
     Node* cmp = graph()->NewNode(simplified()->NumberEqual(), input,
                                  jsgraph()->ZeroConstant());
     Node* inv = graph()->NewNode(simplified()->BooleanNot(), cmp);
-    return ReplaceWith(inv);
+    return Replace(inv);
   }
   if (input_type->Is(Type::String())) {
     // JSToBoolean(x:string) => BooleanNot(NumberEqual(x.length, #0))
     FieldAccess access = AccessBuilder::ForStringLength();
     Node* length = graph()->NewNode(simplified()->LoadField(access), input,
                                     graph()->start(), graph()->start());
     Node* cmp = graph()->NewNode(simplified()->NumberEqual(), length,
                                  jsgraph()->ZeroConstant());
     Node* inv = graph()->NewNode(simplified()->BooleanNot(), cmp);
-    return ReplaceWith(inv);
+    return Replace(inv);
   }
   return NoChange();
 }
 
 
 Reduction JSTypedLowering::ReduceJSToBoolean(Node* node) {
   // Try to reduce the input first.
   Node* const input = node->InputAt(0);
   Reduction reduction = ReduceJSToBooleanInput(input);
-  if (reduction.Changed()) {
-    NodeProperties::ReplaceWithValue(node, reduction.replacement());
-    return reduction;
-  }
-  Type* const input_type = NodeProperties::GetBounds(input).upper;
-  if (input->opcode() == IrOpcode::kPhi && input_type->Is(Type::Primitive())) {
-    Node* const context = node->InputAt(1);
-    // JSToBoolean(phi(x1,...,xn,control):primitive)
-    //   => phi(JSToBoolean(x1),...,JSToBoolean(xn),control):boolean
-    RelaxEffects(node);
+  if (reduction.Changed()) return reduction;
+  if (input->opcode() == IrOpcode::kPhi) {
+    // JSToBoolean(phi(x1,...,xn,control),context)
+    //   => phi(JSToBoolean(x1,no-context),...,JSToBoolean(xn,no-context))
     int const input_count = input->InputCount() - 1;
     Node* const control = input->InputAt(input_count);
     DCHECK_LE(0, input_count);
     DCHECK(NodeProperties::IsControl(control));
     DCHECK(NodeProperties::GetBounds(node).upper->Is(Type::Boolean()));
     DCHECK(!NodeProperties::GetBounds(input).upper->Is(Type::Boolean()));
     node->set_op(common()->Phi(kMachAnyTagged, input_count));
     for (int i = 0; i < input_count; ++i) {
       Node* value = input->InputAt(i);
       // Recursively try to reduce the value first.
       Reduction reduction = ReduceJSToBooleanInput(value);
       if (reduction.Changed()) {
         value = reduction.replacement();
       } else {
-        value = graph()->NewNode(javascript()->ToBoolean(), value, context,
-                                 graph()->start(), graph()->start());
+        // We must be very careful not to introduce cycles when pushing
+        // operations into phis. It is safe for {value}, since it appears
+        // as input to the phi that we are replacing, but it's not safe
+        // to simply reuse the context of the {node}. However, ToBoolean()
+        // does not require a context anyways, so it's safe to discard it
+        // here and pass the dummy context.
+        value = graph()->NewNode(javascript()->ToBoolean(), value,
+                                 jsgraph()->NoContextConstant());
       }
       if (i < node->InputCount()) {
         node->ReplaceInput(i, value);
       } else {
         node->AppendInput(graph()->zone(), value);
       }
     }
     if (input_count < node->InputCount()) {
       node->ReplaceInput(input_count, control);
     } else {
       node->AppendInput(graph()->zone(), control);
     }
     node->TrimInputCount(input_count + 1);
     return Changed(node);
   }
+  if (input->opcode() == IrOpcode::kSelect) {
+    // JSToBoolean(select(c,x1,x2),context)
+    //   => select(c,JSToBoolean(x1,no-context),...,JSToBoolean(x2,no-context))
+    int const input_count = input->InputCount();
+    BranchHint const input_hint = SelectParametersOf(input->op()).hint();
+    DCHECK_EQ(3, input_count);
+    DCHECK(NodeProperties::GetBounds(node).upper->Is(Type::Boolean()));
+    DCHECK(!NodeProperties::GetBounds(input).upper->Is(Type::Boolean()));
+    node->set_op(common()->Select(kMachAnyTagged, input_hint));
+    node->InsertInput(graph()->zone(), 0, input->InputAt(0));
+    for (int i = 1; i < input_count; ++i) {
+      Node* value = input->InputAt(i);
+      // Recursively try to reduce the value first.
+      Reduction reduction = ReduceJSToBooleanInput(value);
+      if (reduction.Changed()) {
+        value = reduction.replacement();
+      } else {
+        // We must be very careful not to introduce cycles when pushing
+        // operations into selects. It is safe for {value}, since it appears
+        // as input to the select that we are replacing, but it's not safe
+        // to simply reuse the context of the {node}. However, ToBoolean()
+        // does not require a context anyways, so it's safe to discard it
+        // here and pass the dummy context.
+        value = graph()->NewNode(javascript()->ToBoolean(), value,
+                                 jsgraph()->NoContextConstant());
+      }
+      node->ReplaceInput(i, value);
+    }
+    DCHECK_EQ(3, node->InputCount());
+    return Changed(node);
+  }
   return NoChange();
 }
 
 
 Reduction JSTypedLowering::ReduceJSLoadProperty(Node* node) {
   Node* key = NodeProperties::GetValueInput(node, 1);
   Node* base = NodeProperties::GetValueInput(node, 0);
   Type* key_type = NodeProperties::GetBounds(key).upper;
   Type* base_type = NodeProperties::GetBounds(base).upper;
   // TODO(mstarzinger): This lowering is not correct if:
@@ skipping 205 matching lines @@
     case IrOpcode::kJSSubtract:
       return ReduceNumberBinop(node, simplified()->NumberSubtract());
     case IrOpcode::kJSMultiply:
       return ReduceJSMultiply(node);
     case IrOpcode::kJSDivide:
       return ReduceNumberBinop(node, simplified()->NumberDivide());
     case IrOpcode::kJSModulus:
       return ReduceNumberBinop(node, simplified()->NumberModulus());
     case IrOpcode::kJSUnaryNot: {
       Reduction result = ReduceJSToBooleanInput(node->InputAt(0));
-      Node* value;
       if (result.Changed()) {
         // JSUnaryNot(x:boolean) => BooleanNot(x)
-        value =
-            graph()->NewNode(simplified()->BooleanNot(), result.replacement());
-        NodeProperties::ReplaceWithValue(node, value);
-        return Changed(value);
+        node = result.replacement();
       } else {
         // JSUnaryNot(x) => BooleanNot(JSToBoolean(x))
-        value = graph()->NewNode(simplified()->BooleanNot(), node);
         node->set_op(javascript()->ToBoolean());
-        NodeProperties::ReplaceWithValue(node, value, node);
-        // Note: ReplaceUses() smashes all uses, so smash it back here.
-        value->ReplaceInput(0, node);
-        return Changed(node);
       }
+      Node* value = graph()->NewNode(simplified()->BooleanNot(), node);
+      return Replace(value);
     }
     case IrOpcode::kJSToBoolean:
       return ReduceJSToBoolean(node);
     case IrOpcode::kJSToNumber:
       return ReduceJSToNumber(node);
     case IrOpcode::kJSToString:
       return ReplaceWithReduction(node,
                                   ReduceJSToStringInput(node->InputAt(0)));
     case IrOpcode::kJSLoadProperty:
       return ReduceJSLoadProperty(node);
@@ skipping 14 matching lines @@
 
 Node* JSTypedLowering::Word32Shl(Node* const lhs, int32_t const rhs) {
   if (rhs == 0) return lhs;
   return graph()->NewNode(machine()->Word32Shl(), lhs,
                           jsgraph()->Int32Constant(rhs));
 }
 
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8