[turbofan] Various cleanups.

src/compiler/js-typed-lowering.cc

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/compiler/access-builder.h"
 #include "src/compiler/graph-inl.h"
-#include "src/compiler/js-builtin-reducer.h"
+#include "src/compiler/js-graph.h"
 #include "src/compiler/js-typed-lowering.h"
 #include "src/compiler/node-aux-data-inl.h"
 #include "src/compiler/node-matchers.h"
 #include "src/compiler/node-properties-inl.h"
 #include "src/types.h"
 
 namespace v8 {
 namespace internal {
 namespace compiler {
 
 // TODO(turbofan): js-typed-lowering improvements possible
 // - immediately put in type bounds for all new nodes
 // - relax effects from generic but not-side-effecting operations
 // - relax effects for ToNumber(mixed)
 
 
 // Relax the effects of {node} by immediately replacing effect uses of {node}
 // with the effect input to {node}.
 // TODO(turbofan): replace the effect input to {node} with {graph->start()}.
 // TODO(titzer): move into a GraphEditor?
 static void RelaxEffects(Node* node) {
   NodeProperties::ReplaceWithValue(node, node, NULL);
 }
 
 
 JSTypedLowering::JSTypedLowering(JSGraph* jsgraph)
     : jsgraph_(jsgraph), simplified_(jsgraph->zone()) {
-  Factory* factory = zone()->isolate()->factory();
-  Handle<Object> zero = factory->NewNumber(0.0);
-  Handle<Object> one = factory->NewNumber(1.0);
-  zero_range_ = Type::Range(zero, zero, zone());
-  one_range_ = Type::Range(one, one, zone());
-  Handle<Object> thirtyone = factory->NewNumber(31.0);
-  zero_thirtyone_range_ = Type::Range(zero, thirtyone, zone());
+  Handle<Object> zero = factory()->NewNumber(0.0);
+  Handle<Object> one = factory()->NewNumber(1.0);
+  zero_range_ = Type::Range(zero, zero, graph()->zone());
+  one_range_ = Type::Range(one, one, graph()->zone());
+  Handle<Object> thirtyone = factory()->NewNumber(31.0);
+  zero_thirtyone_range_ = Type::Range(zero, thirtyone, graph()->zone());
   // TODO(jarin): Can we have a correctification of the stupid type system?
   // These stupid work-arounds are just stupid!
   shifted_int32_ranges_[0] = Type::Signed32();
   if (SmiValuesAre31Bits()) {
     shifted_int32_ranges_[1] = Type::SignedSmall();
     for (size_t k = 2; k < arraysize(shifted_int32_ranges_); ++k) {
-      Handle<Object> min = factory->NewNumber(kMinInt / (1 << k));
-      Handle<Object> max = factory->NewNumber(kMaxInt / (1 << k));
-      shifted_int32_ranges_[k] = Type::Range(min, max, zone());
+      Handle<Object> min = factory()->NewNumber(kMinInt / (1 << k));
+      Handle<Object> max = factory()->NewNumber(kMaxInt / (1 << k));
+      shifted_int32_ranges_[k] = Type::Range(min, max, graph()->zone());
     }
   } else {
     for (size_t k = 1; k < arraysize(shifted_int32_ranges_); ++k) {
-      Handle<Object> min = factory->NewNumber(kMinInt / (1 << k));
-      Handle<Object> max = factory->NewNumber(kMaxInt / (1 << k));
-      shifted_int32_ranges_[k] = Type::Range(min, max, zone());
+      Handle<Object> min = factory()->NewNumber(kMinInt / (1 << k));
+      Handle<Object> max = factory()->NewNumber(kMaxInt / (1 << k));
+      shifted_int32_ranges_[k] = Type::Range(min, max, graph()->zone());
     }
   }
 }
 
 
 Reduction JSTypedLowering::ReplaceEagerly(Node* old, Node* node) {
   NodeProperties::ReplaceWithValue(old, node, node);
   return Changed(node);
 }
 
 
 // A helper class to simplify the process of reducing a single binop node with a
 // JSOperator. This class manages the rewriting of context, control, and effect
 // dependencies during lowering of a binop and contains numerous helper
 // functions for matching the types of inputs to an operation.
-class JSBinopReduction {
+class JSBinopReduction FINAL {
  public:
   JSBinopReduction(JSTypedLowering* lowering, Node* node)
       : lowering_(lowering),
         node_(node),
         left_type_(NodeProperties::GetBounds(node->InputAt(0)).upper),
         right_type_(NodeProperties::GetBounds(node->InputAt(1)).upper) {}
 
   void ConvertInputsToNumber() {
     node_->ReplaceInput(0, ConvertToNumber(left()));
     node_->ReplaceInput(1, ConvertToNumber(right()));
   }
 
-  void ConvertInputsToInt32(bool left_signed, bool right_signed) {
-    node_->ReplaceInput(0, ConvertToI32(left_signed, left()));
-    node_->ReplaceInput(1, ConvertToI32(right_signed, right()));
+  void ConvertInputsToUI32(Signedness left_signedness,
+                           Signedness right_signedness) {
+    node_->ReplaceInput(0, ConvertToUI32(left(), left_signedness));
+    node_->ReplaceInput(1, ConvertToUI32(right(), right_signedness));
   }
 
   void ConvertInputsToString() {
     node_->ReplaceInput(0, ConvertToString(left()));
     node_->ReplaceInput(1, ConvertToString(right()));
   }
 
   // Convert inputs for bitwise shift operation (ES5 spec 11.7).
-  void ConvertInputsForShift(bool left_signed) {
-    node_->ReplaceInput(0, ConvertToI32(left_signed, left()));
-    Node* rnum = ConvertToI32(false, right());
+  void ConvertInputsForShift(Signedness left_signedness) {
+    node_->ReplaceInput(0, ConvertToUI32(left(), left_signedness));
+    Node* rnum = ConvertToUI32(right(), kUnsigned);
     Type* rnum_type = NodeProperties::GetBounds(rnum).upper;
     if (!rnum_type->Is(lowering_->zero_thirtyone_range_)) {
       rnum = graph()->NewNode(machine()->Word32And(), rnum,
                               jsgraph()->Int32Constant(0x1F));
     }
     node_->ReplaceInput(1, rnum);
   }
 
   void SwapInputs() {
     Node* l = left();
@@ skipping 89 matching lines @@
   Node* ConvertToNumber(Node* node) {
     // Avoid introducing too many eager ToNumber() operations.
     Reduction reduced = lowering_->ReduceJSToNumberInput(node);
     if (reduced.Changed()) return reduced.replacement();
     Node* n = graph()->NewNode(javascript()->ToNumber(), node, context(),
                                effect(), control());
     update_effect(n);
     return n;
   }
 
-  Node* ConvertToI32(bool is_signed, Node* node) {
+  Node* ConvertToUI32(Node* node, Signedness signedness) {
     // Avoid introducing too many eager NumberToXXnt32() operations.
     node = ConvertToNumber(node);
-    Type* type = is_signed ? Type::Signed32() : Type::Unsigned32();
-    Type* input_type = NodeProperties::GetBounds(node).upper;
-
-    if (input_type->Is(type)) return node;  // already in the value range.
-
-    const Operator* op = is_signed ? simplified()->NumberToInt32()
-                                   : simplified()->NumberToUint32();
-    Node* n = graph()->NewNode(op, node);
-    return n;
+    Type* type = NodeProperties::GetBounds(node).upper;
+    if (signedness == kSigned) {
+      if (!type->Is(Type::Signed32())) {
+        node = graph()->NewNode(simplified()->NumberToInt32(), node);
+      }
+    } else {
+      DCHECK_EQ(kUnsigned, signedness);
+      if (!type->Is(Type::Unsigned32())) {
+        node = graph()->NewNode(simplified()->NumberToUint32(), node);
+      }
+    }
+    return node;
   }
 
   void update_effect(Node* effect) {
     NodeProperties::ReplaceEffectInput(node_, effect);
   }
 };
 
 
 Reduction JSTypedLowering::ReduceJSAdd(Node* node) {
   JSBinopReduction r(this, node);
   if (r.BothInputsAre(Type::Number())) {
     // JSAdd(x:number, y:number) => NumberAdd(x, y)
     return r.ChangeToPureOperator(simplified()->NumberAdd(), Type::Number());
   }
-  Type* maybe_string = Type::Union(Type::String(), Type::Receiver(), zone());
-  if (r.BothInputsAre(Type::Primitive()) && r.NeitherInputCanBe(maybe_string)) {
+  if (r.BothInputsAre(Type::Primitive()) &&
+      r.NeitherInputCanBe(Type::StringOrReceiver())) {
     // JSAdd(x:-string, y:-string) => NumberAdd(ToNumber(x), ToNumber(y))
     r.ConvertInputsToNumber();
     return r.ChangeToPureOperator(simplified()->NumberAdd(), Type::Number());
   }
 #if 0
   // TODO(turbofan): General ToNumber disabled for now because:
   //   a) The inserted ToNumber operation screws up observability of valueOf.
   //   b) Deoptimization at ToNumber doesn't have corresponding bailout id.
   Type* maybe_string = Type::Union(Type::String(), Type::Receiver(), zone());
   if (r.NeitherInputCanBe(maybe_string)) {
@@ skipping 20 matching lines @@
 Reduction JSTypedLowering::ReduceJSBitwiseOr(Node* node) {
   JSBinopReduction r(this, node);
   if (r.BothInputsAre(Type::Primitive()) || r.OneInputIs(zero_range_)) {
     // TODO(jarin): Propagate frame state input from non-primitive input node to
     // JSToNumber node.
     // TODO(titzer): some Smi bitwise operations don't really require going
     // all the way to int32, which can save tagging/untagging for some
     // operations
     // on some platforms.
     // TODO(turbofan): make this heuristic configurable for code size.
-    r.ConvertInputsToInt32(true, true);
+    r.ConvertInputsToUI32(kSigned, kSigned);
     return r.ChangeToPureOperator(machine()->Word32Or(), Type::Integral32());
   }
   return NoChange();
 }
 
 
 Reduction JSTypedLowering::ReduceJSMultiply(Node* node) {
   JSBinopReduction r(this, node);
   if (r.BothInputsAre(Type::Primitive()) || r.OneInputIs(one_range_)) {
     // TODO(jarin): Propagate frame state input from non-primitive input node to
@@ skipping 24 matching lines @@
     // TODO(turbofan): make this heuristic configurable for code size.
     r.ConvertInputsToNumber();
     return r.ChangeToPureOperator(numberOp);
   }
 #endif
   // TODO(turbofan): relax/remove the effects of this operator in other cases.
   return NoChange();
 }
 
 
-Reduction JSTypedLowering::ReduceI32Binop(Node* node, bool left_signed,
-                                          bool right_signed,
-                                          const Operator* intOp) {
+Reduction JSTypedLowering::ReduceInt32Binop(Node* node, const Operator* intOp) {
   JSBinopReduction r(this, node);
   if (r.BothInputsAre(Type::Primitive())) {
     // TODO(titzer): some Smi bitwise operations don't really require going
     // all the way to int32, which can save tagging/untagging for some
     // operations
     // on some platforms.
     // TODO(turbofan): make this heuristic configurable for code size.
-    r.ConvertInputsToInt32(left_signed, right_signed);
+    r.ConvertInputsToUI32(kSigned, kSigned);
     return r.ChangeToPureOperator(intOp, Type::Integral32());
   }
   return NoChange();
 }
 
 
-Reduction JSTypedLowering::ReduceI32Shift(Node* node, bool left_signed,
-                                          const Operator* shift_op) {
+Reduction JSTypedLowering::ReduceUI32Shift(Node* node,
+                                           Signedness left_signedness,
+                                           const Operator* shift_op) {
   JSBinopReduction r(this, node);
   if (r.BothInputsAre(Type::Primitive())) {
-    r.ConvertInputsForShift(left_signed);
+    r.ConvertInputsForShift(left_signedness);
     return r.ChangeToPureOperator(shift_op, Type::Integral32());
   }
   return NoChange();
 }
 
 
 Reduction JSTypedLowering::ReduceJSComparison(Node* node) {
   JSBinopReduction r(this, node);
   if (r.BothInputsAre(Type::String())) {
     // If both inputs are definitely strings, perform a string comparison.
@@ skipping 21 matching lines @@
 #if 0
   // TODO(turbofan): General ToNumber disabled for now because:
   //   a) The inserted ToNumber operation screws up observability of valueOf.
   //   b) Deoptimization at ToNumber doesn't have corresponding bailout id.
   Type* maybe_string = Type::Union(Type::String(), Type::Receiver(), zone());
   if (r.OneInputCannotBe(maybe_string)) {
     // If one input cannot be a string, then emit a number comparison.
     ...
   }
 #endif
-  Type* maybe_string = Type::Union(Type::String(), Type::Receiver(), zone());
-  if (r.BothInputsAre(Type::Primitive()) && r.OneInputCannotBe(maybe_string)) {
+  if (r.BothInputsAre(Type::Primitive()) &&
+      r.OneInputCannotBe(Type::StringOrReceiver())) {
     const Operator* less_than;
     const Operator* less_than_or_equal;
     if (r.BothInputsAre(Type::Unsigned32())) {
       less_than = machine()->Uint32LessThan();
       less_than_or_equal = machine()->Uint32LessThanOrEqual();
     } else if (r.BothInputsAre(Type::Signed32())) {
       less_than = machine()->Int32LessThan();
       less_than_or_equal = machine()->Int32LessThanOrEqual();
     } else {
       // TODO(turbofan): mixed signed/unsigned int32 comparisons.
@@ skipping 48 matching lines @@
 
 
 Reduction JSTypedLowering::ReduceJSStrictEqual(Node* node, bool invert) {
   JSBinopReduction r(this, node);
   if (r.left() == r.right()) {
     // x === x is always true if x != NaN
     if (!r.left_type()->Maybe(Type::NaN())) {
       return ReplaceEagerly(node, jsgraph()->BooleanConstant(!invert));
     }
   }
-  Type* string_or_number = Type::Union(Type::String(), Type::Number(), zone());
-  if (r.OneInputCannotBe(string_or_number)) {
+  if (r.OneInputCannotBe(Type::NumberOrString())) {
     // For values with canonical representation (i.e. not string nor number) an
     // empty type intersection means the values cannot be strictly equal.
     if (!r.left_type()->Maybe(r.right_type())) {
       return ReplaceEagerly(node, jsgraph()->BooleanConstant(invert));
     }
   }
   if (r.OneInputIs(Type::Undefined())) {
     return r.ChangeToPureOperator(
         simplified()->ReferenceEqual(Type::Undefined()), invert);
   }
@@ skipping 17 matching lines @@
     return r.ChangeToPureOperator(simplified()->StringEqual(), invert);
   }
   if (r.BothInputsAre(Type::Number())) {
     return r.ChangeToPureOperator(simplified()->NumberEqual(), invert);
   }
   // TODO(turbofan): js-typed-lowering of StrictEqual(mixed types)
   return NoChange();
 }
 
 
-Reduction JSTypedLowering::ReduceJSToNumberInput(Node* input) {
-  if (input->opcode() == IrOpcode::kJSToNumber) {
-    // Recursively try to reduce the input first.
-    Reduction result = ReduceJSToNumber(input);
-    if (result.Changed()) return result;
-    return Changed(input);  // JSToNumber(JSToNumber(x)) => JSToNumber(x)
-  }
-  Type* input_type = NodeProperties::GetBounds(input).upper;
-  if (input_type->Is(Type::Number())) {
-    // JSToNumber(x:number) => x
-    return Changed(input);
-  }
-  if (input_type->Is(Type::Undefined())) {
-    // JSToNumber(undefined) => #NaN
-    return Replace(jsgraph()->NaNConstant());
-  }
-  if (input_type->Is(Type::Null())) {
-    // JSToNumber(null) => #0
-    return Replace(jsgraph()->ZeroConstant());
-  }
-  if (input_type->Is(Type::Boolean())) {
-    // JSToNumber(x:boolean) => BooleanToNumber(x)
-    return Replace(graph()->NewNode(simplified()->BooleanToNumber(), input));
-  }
-  // TODO(turbofan): js-typed-lowering of ToNumber(x:string)
-  return NoChange();
-}
-
-
-Reduction JSTypedLowering::ReduceJSToNumber(Node* node) {
-  // Try to reduce the input first.
-  Node* const input = node->InputAt(0);
-  Reduction reduction = ReduceJSToNumberInput(input);
-  if (reduction.Changed()) {
-    NodeProperties::ReplaceWithValue(node, reduction.replacement());
-    return reduction;
-  }
-  Type* const input_type = NodeProperties::GetBounds(input).upper;
-  if (input_type->Is(Type::PlainPrimitive())) {
-    // Converting a plain primitive to a number has no observable side effects.
-    RelaxEffects(node);
-    // JSToNumber(phi(x1,...,xn,control):plain-primitive,context)
-    //   => phi(JSToNumber(x1,no-context),...,JSToNumber(xn,no-context),control)
-    if (input->opcode() == IrOpcode::kPhi) {
-      int const input_count = input->InputCount() - 1;
-      Node* const control = input->InputAt(input_count);
-      DCHECK_LE(0, input_count);
-      DCHECK(NodeProperties::IsControl(control));
-      DCHECK(NodeProperties::GetBounds(node).upper->Is(Type::Number()));
-      DCHECK(!NodeProperties::GetBounds(input).upper->Is(Type::Number()));
-      node->set_op(common()->Phi(kMachAnyTagged, input_count));
-      for (int i = 0; i < input_count; ++i) {
-        Node* value = input->InputAt(i);
-        // Recursively try to reduce the value first.
-        Reduction reduction = ReduceJSToNumberInput(value);
-        if (reduction.Changed()) {
-          value = reduction.replacement();
-        } else {
-          value = graph()->NewNode(javascript()->ToNumber(), value,
-                                   jsgraph()->NoContextConstant(),
-                                   graph()->start(), graph()->start());
-        }
-        if (i < node->InputCount()) {
-          node->ReplaceInput(i, value);
-        } else {
-          node->AppendInput(graph()->zone(), value);
-        }
-      }
-      if (input_count < node->InputCount()) {
-        node->ReplaceInput(input_count, control);
-      } else {
-        node->AppendInput(graph()->zone(), control);
-      }
-      node->TrimInputCount(input_count + 1);
-    }
-    return Changed(node);
-  }
-  return NoChange();
-}
-
-
-Reduction JSTypedLowering::ReduceJSToStringInput(Node* input) {
-  if (input->opcode() == IrOpcode::kJSToString) {
-    // Recursively try to reduce the input first.
-    Reduction result = ReduceJSToStringInput(input->InputAt(0));
-    if (result.Changed()) {
-      RelaxEffects(input);
-      return result;
-    }
-    return Changed(input);  // JSToString(JSToString(x)) => JSToString(x)
-  }
-  Type* input_type = NodeProperties::GetBounds(input).upper;
-  if (input_type->Is(Type::String())) {
-    return Changed(input);  // JSToString(x:string) => x
-  }
-  if (input_type->Is(Type::Undefined())) {
-    return Replace(jsgraph()->HeapConstant(
-        graph()->zone()->isolate()->factory()->undefined_string()));
-  }
-  if (input_type->Is(Type::Null())) {
-    return Replace(jsgraph()->HeapConstant(
-        graph()->zone()->isolate()->factory()->null_string()));
-  }
-  // TODO(turbofan): js-typed-lowering of ToString(x:boolean)
-  // TODO(turbofan): js-typed-lowering of ToString(x:number)
-  return NoChange();
-}
-
-
 Reduction JSTypedLowering::ReduceJSToBooleanInput(Node* input) {
   if (input->opcode() == IrOpcode::kJSToBoolean) {
     // Recursively try to reduce the input first.
     Reduction result = ReduceJSToBoolean(input);
     if (result.Changed()) return result;
     return Changed(input);  // JSToBoolean(JSToBoolean(x)) => JSToBoolean(x)
   }
   Type* input_type = NodeProperties::GetBounds(input).upper;
   if (input_type->Is(Type::Boolean())) {
     return Changed(input);  // JSToBoolean(x:boolean) => x
@@ skipping 108 matching lines @@
       }
       node->ReplaceInput(i, value);
     }
     DCHECK_EQ(3, node->InputCount());
     return Changed(node);
   }
   return NoChange();
 }
 
 
+Reduction JSTypedLowering::ReduceJSToNumberInput(Node* input) {
+  if (input->opcode() == IrOpcode::kJSToNumber) {
+    // Recursively try to reduce the input first.
+    Reduction result = ReduceJSToNumber(input);
+    if (result.Changed()) return result;
+    return Changed(input);  // JSToNumber(JSToNumber(x)) => JSToNumber(x)
+  }
+  Type* input_type = NodeProperties::GetBounds(input).upper;
+  if (input_type->Is(Type::Number())) {
+    // JSToNumber(x:number) => x
+    return Changed(input);
+  }
+  if (input_type->Is(Type::Undefined())) {
+    // JSToNumber(undefined) => #NaN
+    return Replace(jsgraph()->NaNConstant());
+  }
+  if (input_type->Is(Type::Null())) {
+    // JSToNumber(null) => #0
+    return Replace(jsgraph()->ZeroConstant());
+  }
+  if (input_type->Is(Type::Boolean())) {
+    // JSToNumber(x:boolean) => BooleanToNumber(x)
+    return Replace(graph()->NewNode(simplified()->BooleanToNumber(), input));
+  }
+  // TODO(turbofan): js-typed-lowering of ToNumber(x:string)
+  return NoChange();
+}
+
+
+Reduction JSTypedLowering::ReduceJSToNumber(Node* node) {
+  // Try to reduce the input first.
+  Node* const input = node->InputAt(0);
+  Reduction reduction = ReduceJSToNumberInput(input);
+  if (reduction.Changed()) {
+    NodeProperties::ReplaceWithValue(node, reduction.replacement());
+    return reduction;
+  }
+  Type* const input_type = NodeProperties::GetBounds(input).upper;
+  if (input_type->Is(Type::PlainPrimitive())) {
+    // Converting a plain primitive to a number has no observable side effects.
+    RelaxEffects(node);
+    if (input->opcode() == IrOpcode::kPhi) {
+      // JSToNumber(phi(x1,...,xn,control):plain-primitive,context)
+      //   => phi(JSToNumber(x1,no-context),
+      //          ...,
+      //          JSToNumber(xn,no-context),control)
+      int const input_count = input->InputCount() - 1;
+      Node* const control = input->InputAt(input_count);
+      DCHECK_LE(0, input_count);
+      DCHECK(NodeProperties::IsControl(control));
+      DCHECK(NodeProperties::GetBounds(node).upper->Is(Type::Number()));
+      DCHECK(!NodeProperties::GetBounds(input).upper->Is(Type::Number()));
+      node->set_op(common()->Phi(kMachAnyTagged, input_count));
+      for (int i = 0; i < input_count; ++i) {
+        Node* value = input->InputAt(i);
+        // Recursively try to reduce the value first.
+        Reduction reduction = ReduceJSToNumberInput(value);
+        if (reduction.Changed()) {
+          value = reduction.replacement();
+        } else {
+          // We must be very careful not to introduce cycles when pushing
+          // operations into phis. It is safe for {value}, since it appears
+          // as input to the phi that we are replacing, but it's not safe
+          // to simply reuse the context of the {node}. However, ToNumber()
+          // does not require a context anyways, so it's safe to discard it
+          // here and pass the dummy context.
+          value = graph()->NewNode(javascript()->ToNumber(), value,
+                                   jsgraph()->NoContextConstant(),
+                                   graph()->start(), graph()->start());
+        }
+        if (i < node->InputCount()) {
+          node->ReplaceInput(i, value);
+        } else {
+          node->AppendInput(graph()->zone(), value);
+        }
+      }
+      if (input_count < node->InputCount()) {
+        node->ReplaceInput(input_count, control);
+      } else {
+        node->AppendInput(graph()->zone(), control);
+      }
+      node->TrimInputCount(input_count + 1);
+    } else if (input->opcode() == IrOpcode::kSelect) {
+      // JSToNumber(select(c,x1,x2):plain-primitive,context)
+      //   => select(c,JSToNumber(x1,no-context),JSToNumber(x2,no-context))
+      int const input_count = input->InputCount();
+      BranchHint const input_hint = SelectParametersOf(input->op()).hint();
+      DCHECK_EQ(3, input_count);
+      DCHECK(NodeProperties::GetBounds(node).upper->Is(Type::Number()));
+      DCHECK(!NodeProperties::GetBounds(input).upper->Is(Type::Number()));
+      node->set_op(common()->Select(kMachAnyTagged, input_hint));
+      node->ReplaceInput(0, input->InputAt(0));
+      for (int i = 1; i < input_count; ++i) {
+        Node* value = input->InputAt(i);
+        // Recursively try to reduce the value first.
+        Reduction reduction = ReduceJSToNumberInput(value);
+        if (reduction.Changed()) {
+          value = reduction.replacement();
+        } else {
+          // We must be very careful not to introduce cycles when pushing
+          // operations into selects. It is safe for {value}, since it appears
+          // as input to the select that we are replacing, but it's not safe
+          // to simply reuse the context of the {node}. However, ToNumber()
+          // does not require a context anyways, so it's safe to discard it
+          // here and pass the dummy context.
+          value = graph()->NewNode(javascript()->ToNumber(), value,
+                                   jsgraph()->NoContextConstant(),
+                                   graph()->start(), graph()->start());
+        }
+        node->ReplaceInput(i, value);
+      }
+      node->TrimInputCount(input_count);
+    }
+    return Changed(node);
+  }
+  return NoChange();
+}
+
+
+Reduction JSTypedLowering::ReduceJSToStringInput(Node* input) {
+  if (input->opcode() == IrOpcode::kJSToString) {
+    // Recursively try to reduce the input first.
+    Reduction result = ReduceJSToString(input);
+    if (result.Changed()) return result;
+    return Changed(input);  // JSToString(JSToString(x)) => JSToString(x)
+  }
+  Type* input_type = NodeProperties::GetBounds(input).upper;
+  if (input_type->Is(Type::String())) {
+    return Changed(input);  // JSToString(x:string) => x
+  }
+  if (input_type->Is(Type::Undefined())) {
+    return Replace(jsgraph()->HeapConstant(factory()->undefined_string()));
+  }
+  if (input_type->Is(Type::Null())) {
+    return Replace(jsgraph()->HeapConstant(factory()->null_string()));
+  }
+  // TODO(turbofan): js-typed-lowering of ToString(x:boolean)
+  // TODO(turbofan): js-typed-lowering of ToString(x:number)
+  return NoChange();
+}
+
+
+Reduction JSTypedLowering::ReduceJSToString(Node* node) {
+  // Try to reduce the input first.
+  Node* const input = node->InputAt(0);
+  Reduction reduction = ReduceJSToStringInput(input);
+  if (reduction.Changed()) {
+    NodeProperties::ReplaceWithValue(node, reduction.replacement());
+    return reduction;
+  }
+  return NoChange();
+}
+
+
 Reduction JSTypedLowering::ReduceJSLoadProperty(Node* node) {
   Node* key = NodeProperties::GetValueInput(node, 1);
   Node* base = NodeProperties::GetValueInput(node, 0);
   Type* key_type = NodeProperties::GetBounds(key).upper;
   // TODO(mstarzinger): This lowering is not correct if:
   //   a) The typed array or it's buffer is neutered.
   HeapObjectMatcher<Object> mbase(base);
   if (mbase.HasValue() && mbase.Value().handle()->IsJSTypedArray()) {
     Handle<JSTypedArray> const array =
         Handle<JSTypedArray>::cast(mbase.Value().handle());
@@ skipping 141 matching lines @@
                NodeProperties::GetValueInput(node, 0), effect, control));
   }
   node->set_op(
       simplified()->StoreField(AccessBuilder::ForContextSlot(access.index())));
   node->RemoveInput(2);
   DCHECK_EQ(4, node->InputCount());
   return Changed(node);
 }
 
 
-static Reduction ReplaceWithReduction(Node* node, Reduction reduction) {
-  if (reduction.Changed()) {
-    NodeProperties::ReplaceWithValue(node, reduction.replacement());
-    return reduction;
-  }
-  return Reducer::NoChange();
-}
-
-
 Reduction JSTypedLowering::Reduce(Node* node) {
   // Check if the output type is a singleton.  In that case we already know the
   // result value and can simply replace the node unless there are effects.
   if (NodeProperties::IsTyped(node) &&
       NodeProperties::GetBounds(node).upper->IsConstant() &&
       !IrOpcode::IsLeafOpcode(node->opcode()) &&
       node->op()->EffectOutputCount() == 0) {
     return ReplaceEagerly(node, jsgraph()->Constant(
         NodeProperties::GetBounds(node).upper->AsConstant()->Value()));
     // TODO(neis): Extend this to Range(x,x), NaN, MinusZero, ...?
   }
   switch (node->opcode()) {
     case IrOpcode::kJSEqual:
       return ReduceJSEqual(node, false);
     case IrOpcode::kJSNotEqual:
       return ReduceJSEqual(node, true);
     case IrOpcode::kJSStrictEqual:
       return ReduceJSStrictEqual(node, false);
     case IrOpcode::kJSStrictNotEqual:
       return ReduceJSStrictEqual(node, true);
     case IrOpcode::kJSLessThan:         // fall through
     case IrOpcode::kJSGreaterThan:      // fall through
     case IrOpcode::kJSLessThanOrEqual:  // fall through
     case IrOpcode::kJSGreaterThanOrEqual:
       return ReduceJSComparison(node);
     case IrOpcode::kJSBitwiseOr:
       return ReduceJSBitwiseOr(node);
     case IrOpcode::kJSBitwiseXor:
-      return ReduceI32Binop(node, true, true, machine()->Word32Xor());
+      return ReduceInt32Binop(node, machine()->Word32Xor());
     case IrOpcode::kJSBitwiseAnd:
-      return ReduceI32Binop(node, true, true, machine()->Word32And());
+      return ReduceInt32Binop(node, machine()->Word32And());
     case IrOpcode::kJSShiftLeft:
-      return ReduceI32Shift(node, true, machine()->Word32Shl());
+      return ReduceUI32Shift(node, kSigned, machine()->Word32Shl());
     case IrOpcode::kJSShiftRight:
-      return ReduceI32Shift(node, true, machine()->Word32Sar());
+      return ReduceUI32Shift(node, kSigned, machine()->Word32Sar());
     case IrOpcode::kJSShiftRightLogical:
-      return ReduceI32Shift(node, false, machine()->Word32Shr());
+      return ReduceUI32Shift(node, kUnsigned, machine()->Word32Shr());
     case IrOpcode::kJSAdd:
       return ReduceJSAdd(node);
     case IrOpcode::kJSSubtract:
       return ReduceNumberBinop(node, simplified()->NumberSubtract());
     case IrOpcode::kJSMultiply:
       return ReduceJSMultiply(node);
     case IrOpcode::kJSDivide:
       return ReduceNumberBinop(node, simplified()->NumberDivide());
     case IrOpcode::kJSModulus:
       return ReduceNumberBinop(node, simplified()->NumberModulus());
     case IrOpcode::kJSUnaryNot: {
       Reduction result = ReduceJSToBooleanInput(node->InputAt(0));
       if (result.Changed()) {
         // JSUnaryNot(x:boolean) => BooleanNot(x)
         node = result.replacement();
       } else {
         // JSUnaryNot(x) => BooleanNot(JSToBoolean(x))
         node->set_op(javascript()->ToBoolean());
       }
       Node* value = graph()->NewNode(simplified()->BooleanNot(), node);
       return Replace(value);
     }
     case IrOpcode::kJSToBoolean:
       return ReduceJSToBoolean(node);
     case IrOpcode::kJSToNumber:
       return ReduceJSToNumber(node);
     case IrOpcode::kJSToString:
-      return ReplaceWithReduction(node,
-                                  ReduceJSToStringInput(node->InputAt(0)));
+      return ReduceJSToString(node);
     case IrOpcode::kJSLoadProperty:
       return ReduceJSLoadProperty(node);
     case IrOpcode::kJSStoreProperty:
       return ReduceJSStoreProperty(node);
     case IrOpcode::kJSLoadContext:
       return ReduceJSLoadContext(node);
     case IrOpcode::kJSStoreContext:
       return ReduceJSStoreContext(node);
-    case IrOpcode::kJSCallFunction:
-      return JSBuiltinReducer(jsgraph()).Reduce(node);
     default:
       break;
   }
   return NoChange();
 }
 
 
 Node* JSTypedLowering::Word32Shl(Node* const lhs, int32_t const rhs) {
   if (rhs == 0) return lhs;
   return graph()->NewNode(machine()->Word32Shl(), lhs,
                           jsgraph()->Int32Constant(rhs));
 }
 
+
+Factory* JSTypedLowering::factory() const { return jsgraph()->factory(); }
+
+
+Graph* JSTypedLowering::graph() const { return jsgraph()->graph(); }
+
+
+JSOperatorBuilder* JSTypedLowering::javascript() const {
+  return jsgraph()->javascript();
+}
+
+
+CommonOperatorBuilder* JSTypedLowering::common() const {
+  return jsgraph()->common();
+}
+
+
+MachineOperatorBuilder* JSTypedLowering::machine() const {
+  return jsgraph()->machine();
+}
+
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8