[turbofan] Cache conversions inserted during typed lowering.

src/compiler/js-typed-lowering.cc

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/compiler/access-builder.h"
 #include "src/compiler/graph-inl.h"
 #include "src/compiler/js-graph.h"
 #include "src/compiler/js-typed-lowering.h"
 #include "src/compiler/node-aux-data-inl.h"
 #include "src/compiler/node-matchers.h"
@@ skipping 11 matching lines @@
 
 // Relax the effects of {node} by immediately replacing effect uses of {node}
 // with the effect input to {node}.
 // TODO(turbofan): replace the effect input to {node} with {graph->start()}.
 // TODO(titzer): move into a GraphEditor?
 static void RelaxEffects(Node* node) {
   NodeProperties::ReplaceWithValue(node, node, NULL);
 }
 
 
-JSTypedLowering::JSTypedLowering(JSGraph* jsgraph)
-    : jsgraph_(jsgraph), simplified_(jsgraph->zone()) {
+JSTypedLowering::JSTypedLowering(JSGraph* jsgraph, Zone* zone)
+    : jsgraph_(jsgraph), simplified_(graph()->zone()), conversions_(zone) {
   Handle<Object> zero = factory()->NewNumber(0.0);
   Handle<Object> one = factory()->NewNumber(1.0);
   zero_range_ = Type::Range(zero, zero, graph()->zone());
   one_range_ = Type::Range(one, one, graph()->zone());
   Handle<Object> thirtyone = factory()->NewNumber(31.0);
   zero_thirtyone_range_ = Type::Range(zero, thirtyone, graph()->zone());
   // TODO(jarin): Can we have a correctification of the stupid type system?
   // These stupid work-arounds are just stupid!
   shifted_int32_ranges_[0] = Type::Signed32();
   if (SmiValuesAre31Bits()) {
@@ skipping 144 matching lines @@
     // Avoid introducing too many eager ToString() operations.
     Reduction reduced = lowering_->ReduceJSToStringInput(node);
     if (reduced.Changed()) return reduced.replacement();
     Node* n = graph()->NewNode(javascript()->ToString(), node, context(),
                                effect(), control());
     update_effect(n);
     return n;
   }
 
   Node* ConvertToNumber(Node* node) {
-    // Avoid introducing too many eager ToNumber() operations.
-    Reduction reduced = lowering_->ReduceJSToNumberInput(node);
-    if (reduced.Changed()) return reduced.replacement();
+    if (NodeProperties::GetBounds(node).upper->Is(Type::PlainPrimitive())) {
+      return lowering_->ConvertToNumber(node);
+    }
     Node* n = graph()->NewNode(javascript()->ToNumber(), node, context(),
                                effect(), control());
     update_effect(n);
     return n;
   }
 
   Node* ConvertToUI32(Node* node, Signedness signedness) {
     // Avoid introducing too many eager NumberToXXnt32() operations.
     node = ConvertToNumber(node);
     Type* type = NodeProperties::GetBounds(node).upper;
@@ skipping 279 matching lines @@
 }
 
 
 Reduction JSTypedLowering::ReduceJSToBooleanInput(Node* input) {
   if (input->opcode() == IrOpcode::kJSToBoolean) {
     // Recursively try to reduce the input first.
     Reduction result = ReduceJSToBoolean(input);
     if (result.Changed()) return result;
     return Changed(input);  // JSToBoolean(JSToBoolean(x)) => JSToBoolean(x)
   }
+  // Check if we have a cached conversion.
+  Node* conversion = FindConversion<IrOpcode::kJSToBoolean>(input);
+  if (conversion) return Replace(conversion);
   Type* input_type = NodeProperties::GetBounds(input).upper;
   if (input_type->Is(Type::Boolean())) {
     return Changed(input);  // JSToBoolean(x:boolean) => x
   }
   if (input_type->Is(Type::Undefined())) {
     // JSToBoolean(undefined) => #false
     return Replace(jsgraph()->FalseConstant());
   }
   if (input_type->Is(Type::Null())) {
     // JSToBoolean(null) => #false
@@ skipping 37 matching lines @@
     // JSToBoolean(phi(x1,...,xn,control),context)
     //   => phi(JSToBoolean(x1,no-context),...,JSToBoolean(xn,no-context))
     int const input_count = input->InputCount() - 1;
     Node* const control = input->InputAt(input_count);
     DCHECK_LE(0, input_count);
     DCHECK(NodeProperties::IsControl(control));
     DCHECK(NodeProperties::GetBounds(node).upper->Is(Type::Boolean()));
     DCHECK(!NodeProperties::GetBounds(input).upper->Is(Type::Boolean()));
     node->set_op(common()->Phi(kMachAnyTagged, input_count));
     for (int i = 0; i < input_count; ++i) {
-      Node* value = input->InputAt(i);
-      // Recursively try to reduce the value first.
-      Reduction reduction = ReduceJSToBooleanInput(value);
-      if (reduction.Changed()) {
-        value = reduction.replacement();
-      } else {
-        // We must be very careful not to introduce cycles when pushing
-        // operations into phis. It is safe for {value}, since it appears
-        // as input to the phi that we are replacing, but it's not safe
-        // to simply reuse the context of the {node}. However, ToBoolean()
-        // does not require a context anyways, so it's safe to discard it
-        // here and pass the dummy context.
-        value = graph()->NewNode(javascript()->ToBoolean(), value,
-                                 jsgraph()->NoContextConstant());
-      }
+      // We must be very careful not to introduce cycles when pushing
+      // operations into phis. It is safe for {value}, since it appears
+      // as input to the phi that we are replacing, but it's not safe
+      // to simply reuse the context of the {node}. However, ToBoolean()
+      // does not require a context anyways, so it's safe to discard it
+      // here and pass the dummy context.
+      Node* const value = ConvertToBoolean(input->InputAt(i));
       if (i < node->InputCount()) {
         node->ReplaceInput(i, value);
       } else {
         node->AppendInput(graph()->zone(), value);
       }
     }
     if (input_count < node->InputCount()) {
       node->ReplaceInput(input_count, control);
     } else {
       node->AppendInput(graph()->zone(), control);
     }
     node->TrimInputCount(input_count + 1);
     return Changed(node);
   }
   if (input->opcode() == IrOpcode::kSelect) {
     // JSToBoolean(select(c,x1,x2),context)
     //   => select(c,JSToBoolean(x1,no-context),...,JSToBoolean(x2,no-context))
     int const input_count = input->InputCount();
     BranchHint const input_hint = SelectParametersOf(input->op()).hint();
     DCHECK_EQ(3, input_count);
     DCHECK(NodeProperties::GetBounds(node).upper->Is(Type::Boolean()));
     DCHECK(!NodeProperties::GetBounds(input).upper->Is(Type::Boolean()));
     node->set_op(common()->Select(kMachAnyTagged, input_hint));
     node->InsertInput(graph()->zone(), 0, input->InputAt(0));
     for (int i = 1; i < input_count; ++i) {
-      Node* value = input->InputAt(i);
-      // Recursively try to reduce the value first.
-      Reduction reduction = ReduceJSToBooleanInput(value);
-      if (reduction.Changed()) {
-        value = reduction.replacement();
-      } else {
-        // We must be very careful not to introduce cycles when pushing
-        // operations into selects. It is safe for {value}, since it appears
-        // as input to the select that we are replacing, but it's not safe
-        // to simply reuse the context of the {node}. However, ToBoolean()
-        // does not require a context anyways, so it's safe to discard it
-        // here and pass the dummy context.
-        value = graph()->NewNode(javascript()->ToBoolean(), value,
-                                 jsgraph()->NoContextConstant());
-      }
+      // We must be very careful not to introduce cycles when pushing
+      // operations into selects. It is safe for {value}, since it appears
+      // as input to the select that we are replacing, but it's not safe
+      // to simply reuse the context of the {node}. However, ToBoolean()
+      // does not require a context anyways, so it's safe to discard it
+      // here and pass the dummy context.
+      Node* const value = ConvertToBoolean(input->InputAt(i));
       node->ReplaceInput(i, value);
     }
     DCHECK_EQ(3, node->InputCount());
     return Changed(node);
   }
+  InsertConversion(node);
+  if (node->InputAt(1) != jsgraph()->NoContextConstant()) {
+    // JSToBoolean(x,context) => JSToBoolean(x,no-context)
+    node->ReplaceInput(1, jsgraph()->NoContextConstant());
+    return Changed(node);
+  }
   return NoChange();
 }
 
 
 Reduction JSTypedLowering::ReduceJSToNumberInput(Node* input) {
   if (input->opcode() == IrOpcode::kJSToNumber) {
     // Recursively try to reduce the input first.
     Reduction result = ReduceJSToNumber(input);
     if (result.Changed()) return result;
     return Changed(input);  // JSToNumber(JSToNumber(x)) => JSToNumber(x)
   }
+  // Check if we have a cached conversion.
+  Node* conversion = FindConversion<IrOpcode::kJSToNumber>(input);
+  if (conversion) return Replace(conversion);
   Type* input_type = NodeProperties::GetBounds(input).upper;
   if (input_type->Is(Type::Number())) {
     // JSToNumber(x:number) => x
     return Changed(input);
   }
   if (input_type->Is(Type::Undefined())) {
     // JSToNumber(undefined) => #NaN
     return Replace(jsgraph()->NaNConstant());
   }
   if (input_type->Is(Type::Null())) {
@@ skipping 26 matching lines @@
       //          JSToNumber(xn,no-context),control)
       int const input_count = input->InputCount() - 1;
       Node* const control = input->InputAt(input_count);
       DCHECK_LE(0, input_count);
       DCHECK(NodeProperties::IsControl(control));
       DCHECK(NodeProperties::GetBounds(node).upper->Is(Type::Number()));
       DCHECK(!NodeProperties::GetBounds(input).upper->Is(Type::Number()));
       RelaxEffects(node);
       node->set_op(common()->Phi(kMachAnyTagged, input_count));
       for (int i = 0; i < input_count; ++i) {
-        Node* value = input->InputAt(i);
-        // Recursively try to reduce the value first.
-        Reduction reduction = ReduceJSToNumberInput(value);
-        if (reduction.Changed()) {
-          value = reduction.replacement();
-        } else {
-          // We must be very careful not to introduce cycles when pushing
-          // operations into phis. It is safe for {value}, since it appears
-          // as input to the phi that we are replacing, but it's not safe
-          // to simply reuse the context of the {node}. However, ToNumber()
-          // does not require a context anyways, so it's safe to discard it
-          // here and pass the dummy context.
-          value = graph()->NewNode(javascript()->ToNumber(), value,
-                                   jsgraph()->NoContextConstant(),
-                                   graph()->start(), graph()->start());
-        }
+        // We must be very careful not to introduce cycles when pushing
+        // operations into phis. It is safe for {value}, since it appears
+        // as input to the phi that we are replacing, but it's not safe
+        // to simply reuse the context of the {node}. However, ToNumber()
+        // does not require a context anyways, so it's safe to discard it
+        // here and pass the dummy context.
+        Node* const value = ConvertToNumber(input->InputAt(i));
         if (i < node->InputCount()) {
           node->ReplaceInput(i, value);
         } else {
           node->AppendInput(graph()->zone(), value);
         }
       }
       if (input_count < node->InputCount()) {
         node->ReplaceInput(input_count, control);
       } else {
         node->AppendInput(graph()->zone(), control);
       }
       node->TrimInputCount(input_count + 1);
       return Changed(node);
     }
     if (input->opcode() == IrOpcode::kSelect) {
       // JSToNumber(select(c,x1,x2):plain-primitive,context)
       //   => select(c,JSToNumber(x1,no-context),JSToNumber(x2,no-context))
       int const input_count = input->InputCount();
       BranchHint const input_hint = SelectParametersOf(input->op()).hint();
       DCHECK_EQ(3, input_count);
       DCHECK(NodeProperties::GetBounds(node).upper->Is(Type::Number()));
       DCHECK(!NodeProperties::GetBounds(input).upper->Is(Type::Number()));
       RelaxEffects(node);
       node->set_op(common()->Select(kMachAnyTagged, input_hint));
       node->ReplaceInput(0, input->InputAt(0));
       for (int i = 1; i < input_count; ++i) {
-        Node* value = input->InputAt(i);
-        // Recursively try to reduce the value first.
-        Reduction reduction = ReduceJSToNumberInput(value);
-        if (reduction.Changed()) {
-          value = reduction.replacement();
-        } else {
-          // We must be very careful not to introduce cycles when pushing
-          // operations into selects. It is safe for {value}, since it appears
-          // as input to the select that we are replacing, but it's not safe
-          // to simply reuse the context of the {node}. However, ToNumber()
-          // does not require a context anyways, so it's safe to discard it
-          // here and pass the dummy context.
-          value = graph()->NewNode(javascript()->ToNumber(), value,
-                                   jsgraph()->NoContextConstant(),
-                                   graph()->start(), graph()->start());
-        }
+        // We must be very careful not to introduce cycles when pushing
+        // operations into selects. It is safe for {value}, since it appears
+        // as input to the select that we are replacing, but it's not safe
+        // to simply reuse the context of the {node}. However, ToNumber()
+        // does not require a context anyways, so it's safe to discard it
+        // here and pass the dummy context.
+        Node* const value = ConvertToNumber(input->InputAt(i));
         node->ReplaceInput(i, value);
       }
       node->TrimInputCount(input_count);
       return Changed(node);
     }
+    // Remember this conversion.
+    InsertConversion(node);
     if (node->InputAt(1) != jsgraph()->NoContextConstant() ||
-        node->InputAt(2) != graph()->start()) {
-      // JSToNumber(x:plain-primitive,context) => JSToNumber(x,no-context)
+        node->InputAt(2) != graph()->start() ||
+        node->InputAt(3) != graph()->start()) {
+      // JSToNumber(x:plain-primitive,context,effect,control)
+      //   => JSToNumber(x,no-context,start,start)
+      RelaxEffects(node);
       node->ReplaceInput(1, jsgraph()->NoContextConstant());
-      RelaxEffects(node);
+      node->ReplaceInput(2, graph()->start());
+      node->ReplaceInput(3, graph()->start());
       return Changed(node);
     }
   }
   return NoChange();
 }
 
 
 Reduction JSTypedLowering::ReduceJSToStringInput(Node* input) {
   if (input->opcode() == IrOpcode::kJSToString) {
     // Recursively try to reduce the input first.
@@ skipping 263 matching lines @@
       return ReduceJSLoadContext(node);
     case IrOpcode::kJSStoreContext:
       return ReduceJSStoreContext(node);
     default:
       break;
   }
   return NoChange();
 }
 
 
+Node* JSTypedLowering::ConvertToBoolean(Node* input) {
+  // Avoid inserting too many eager ToBoolean() operations.
+  Reduction const reduction = ReduceJSToBooleanInput(input);
+  if (reduction.Changed()) return reduction.replacement();
+  Node* const conversion = graph()->NewNode(javascript()->ToBoolean(), input,
+                                            jsgraph()->NoContextConstant());
+  InsertConversion(conversion);
+  return conversion;
+}
+
+
+Node* JSTypedLowering::ConvertToNumber(Node* input) {
+  DCHECK(NodeProperties::GetBounds(input).upper->Is(Type::PlainPrimitive()));
+  // Avoid inserting too many eager ToNumber() operations.
+  Reduction const reduction = ReduceJSToNumberInput(input);
+  if (reduction.Changed()) return reduction.replacement();
+  Node* const conversion = graph()->NewNode(javascript()->ToNumber(), input,
+                                            jsgraph()->NoContextConstant(),
+                                            graph()->start(), graph()->start());
+  InsertConversion(conversion);
+  return conversion;
+}
+
+
+template <IrOpcode::Value kOpcode>
+Node* JSTypedLowering::FindConversion(Node* input) {
+  size_t const input_id = input->id();
+  if (input_id < conversions_.size()) {
+    Node* const conversion = conversions_[input_id];
+    if (conversion && conversion->opcode() == kOpcode) {
+      return conversion;
+    }
+  }
+  return nullptr;
+}
+
+
+void JSTypedLowering::InsertConversion(Node* conversion) {
+  DCHECK(conversion->opcode() == IrOpcode::kJSToBoolean ||
+         conversion->opcode() == IrOpcode::kJSToNumber);
+  size_t const input_id = conversion->InputAt(0)->id();
+  if (input_id >= conversions_.size()) {
+    conversions_.resize(2 * input_id + 1);
+  }
+  conversions_[input_id] = conversion;
+}
+
+
 Node* JSTypedLowering::Word32Shl(Node* const lhs, int32_t const rhs) {
   if (rhs == 0) return lhs;
   return graph()->NewNode(machine()->Word32Shl(), lhs,
                           jsgraph()->Int32Constant(rhs));
 }
 
 
 Factory* JSTypedLowering::factory() const { return jsgraph()->factory(); }
 
 
@@ skipping 10 matching lines @@
 }
 
 
 MachineOperatorBuilder* JSTypedLowering::machine() const {
   return jsgraph()->machine();
 }
 
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8