[turbofan] Use unboxed doubles in range types.

src/compiler/typer.cc

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/bootstrapper.h"
 #include "src/compiler/graph-inl.h"
 #include "src/compiler/graph-reducer.h"
 #include "src/compiler/js-operator.h"
 #include "src/compiler/node.h"
 #include "src/compiler/node-properties-inl.h"
@@ skipping 111 matching lines @@
     return Type::Intersect(semantic, representation, zone());
   }
 
   template <typename T>
   Type* CreateRange() const {
     return CreateRange(std::numeric_limits<T>::min(),
                        std::numeric_limits<T>::max());
   }
 
   Type* CreateRange(double min, double max) const {
-    return Type::Range(factory()->NewNumber(min), factory()->NewNumber(max),
-                       zone());
+    return Type::Range(min, max, zone());
   }
 
   Factory* factory() const { return isolate()->factory(); }
   Isolate* isolate() const { return isolate_; }
   Zone* zone() const { return zone_; }
 
   Type* cache_[kNumLazyCachedTypes];
   Isolate* isolate_;
   Zone* zone_;
 };
@@ skipping 13 matching lines @@
     : isolate_(isolate),
       graph_(graph),
       context_(context),
       decorator_(NULL),
       cache_(new (graph->zone()) LazyTypeCache(isolate, graph->zone())),
       weaken_min_limits_(graph->zone()),
       weaken_max_limits_(graph->zone()) {
   Zone* zone = this->zone();
   Factory* f = isolate->factory();
 
-  Handle<Object> zero = f->NewNumber(0);
-  Handle<Object> one = f->NewNumber(1);
   Handle<Object> infinity = f->NewNumber(+V8_INFINITY);
   Handle<Object> minusinfinity = f->NewNumber(-V8_INFINITY);
 
   Type* number = Type::Number();
   Type* signed32 = Type::Signed32();
   Type* unsigned32 = Type::Unsigned32();
   Type* nan_or_minuszero = Type::Union(Type::NaN(), Type::MinusZero(), zone);
   Type* truncating_to_zero =
       Type::Union(Type::Union(Type::Constant(infinity, zone),
                               Type::Constant(minusinfinity, zone), zone),
                   nan_or_minuszero, zone);
 
   boolean_or_number = Type::Union(Type::Boolean(), Type::Number(), zone);
   undefined_or_null = Type::Union(Type::Undefined(), Type::Null(), zone);
   undefined_or_number = Type::Union(Type::Undefined(), Type::Number(), zone);
   singleton_false = Type::Constant(f->false_value(), zone);
   singleton_true = Type::Constant(f->true_value(), zone);
-  singleton_zero = Type::Range(zero, zero, zone);
-  singleton_one = Type::Range(one, one, zone);
+  singleton_zero = Type::Range(0.0, 0.0, zone);
+  singleton_one = Type::Range(1.0, 1.0, zone);
   zero_or_one = Type::Union(singleton_zero, singleton_one, zone);
   zeroish = Type::Union(singleton_zero, nan_or_minuszero, zone);
   signed32ish = Type::Union(signed32, truncating_to_zero, zone);
   unsigned32ish = Type::Union(unsigned32, truncating_to_zero, zone);
   falsish = Type::Union(Type::Undetectable(),
                         Type::Union(Type::Union(singleton_false, zeroish, zone),
                                     undefined_or_null, zone),
                         zone);
   truish = Type::Union(
       singleton_true,
       Type::Union(Type::DetectableReceiver(), Type::Symbol(), zone), zone);
-  integer = Type::Range(minusinfinity, infinity, zone);
+  integer = Type::Range(-V8_INFINITY, V8_INFINITY, zone);
   weakint = Type::Union(integer, nan_or_minuszero, zone);
 
   number_fun0_ = Type::Function(number, zone);
   number_fun1_ = Type::Function(number, number, zone);
   number_fun2_ = Type::Function(number, number, number, zone);
 
   weakint_fun1_ = Type::Function(weakint, number, zone);
   random_fun_ = Type::Function(Type::OrderedNumber(), zone);
 
   const int limits_count = 20;
 
   weaken_min_limits_.reserve(limits_count + 1);
   weaken_max_limits_.reserve(limits_count + 1);
 
   double limit = 1 << 30;
-  weaken_min_limits_.push_back(f->NewNumber(0));
-  weaken_max_limits_.push_back(f->NewNumber(0));
+  weaken_min_limits_.push_back(0);
+  weaken_max_limits_.push_back(0);
   for (int i = 0; i < limits_count; i++) {
-    weaken_min_limits_.push_back(f->NewNumber(-limit));
-    weaken_max_limits_.push_back(f->NewNumber(limit - 1));
+    weaken_min_limits_.push_back(-limit);
+    weaken_max_limits_.push_back(limit - 1);
     limit *= 2;
   }
 
   decorator_ = new (zone) Decorator(this);
   graph_->AddDecorator(decorator_);
 }
 
 
 Typer::~Typer() {
   graph_->RemoveDecorator(decorator_);
@@ skipping 259 matching lines @@
     return type;  // Give up on non-integer types.
   }
   double min = type->Min();
   double max = type->Max();
   // Handle the degenerate case of empty bitset types (such as
   // OtherUnsigned31 and OtherSigned32 on 64-bit architectures).
   if (std::isnan(min)) {
     DCHECK(std::isnan(max));
     return type;
   }
-  Factory* f = t->isolate()->factory();
-  return Type::Range(f->NewNumber(min), f->NewNumber(max), t->zone());
+  return Type::Range(min, max, t->zone());
 }
 
 
 // Type conversion.
 
 
 Type* Typer::Visitor::ToPrimitive(Type* type, Typer* t) {
   if (type->Is(Type::Primitive()) && !type->Maybe(Type::Receiver())) {
     return type;
   }
@@ skipping 92 matching lines @@
   // OSR values explicitly have type {None} before OSR form is deconstructed.
   if (node->InputAt(0)->opcode() == IrOpcode::kOsrLoopEntry) {
     return Bounds(Type::None(), Type::None());
   }
   // TODO(turbofan): preserve the type of OSR values after deconstruction.
   return Bounds::Unbounded(zone());
 }
 
 
 Bounds Typer::Visitor::TypeInt32Constant(Node* node) {
-  Factory* f = isolate()->factory();
-  Handle<Object> number = f->NewNumber(OpParameter<int32_t>(node));
+  double number = OpParameter<int32_t>(node);
   return Bounds(Type::Intersect(
       Type::Range(number, number, zone()), Type::UntaggedSigned32(), zone()));
 }
 
 
 Bounds Typer::Visitor::TypeInt64Constant(Node* node) {
   // TODO(rossberg): This actually seems to be a PointerConstant so far...
   return Bounds(Type::Internal());  // TODO(rossberg): Add int64 bitset type?
 }
 
@@ skipping 194 matching lines @@
 Type* Typer::Visitor::JSGreaterThanOrEqualTyper(
     Type* lhs, Type* rhs, Typer* t) {
   return FalsifyUndefined(Invert(JSCompareTyper(lhs, rhs, t), t), t);
 }
 
 
 // JS bitwise operators.
 
 
 Type* Typer::Visitor::JSBitwiseOrTyper(Type* lhs, Type* rhs, Typer* t) {
-  Factory* f = t->isolate()->factory();
   lhs = NumberToInt32(ToNumber(lhs, t), t);
   rhs = NumberToInt32(ToNumber(rhs, t), t);
   double lmin = lhs->Min();
   double rmin = rhs->Min();
   double lmax = lhs->Max();
   double rmax = rhs->Max();
   // Or-ing any two values results in a value no smaller than their minimum.
   // Even no smaller than their maximum if both values are non-negative.
   double min =
       lmin >= 0 && rmin >= 0 ? std::max(lmin, rmin) : std::min(lmin, rmin);
   double max = Type::Signed32()->Max();
 
   // Or-ing with 0 is essentially a conversion to int32.
   if (rmin == 0 && rmax == 0) {
     min = lmin;
     max = lmax;
   }
   if (lmin == 0 && lmax == 0) {
     min = rmin;
     max = rmax;
   }
 
   if (lmax < 0 || rmax < 0) {
     // Or-ing two values of which at least one is negative results in a negative
     // value.
     max = std::min(max, -1.0);
   }
-  return Type::Range(f->NewNumber(min), f->NewNumber(max), t->zone());
+  return Type::Range(min, max, t->zone());
   // TODO(neis): Be precise for singleton inputs, here and elsewhere.
 }
 
 
 Type* Typer::Visitor::JSBitwiseAndTyper(Type* lhs, Type* rhs, Typer* t) {
-  Factory* f = t->isolate()->factory();
   lhs = NumberToInt32(ToNumber(lhs, t), t);
   rhs = NumberToInt32(ToNumber(rhs, t), t);
   double lmin = lhs->Min();
   double rmin = rhs->Min();
   double lmax = lhs->Max();
   double rmax = rhs->Max();
   double min = Type::Signed32()->Min();
   // And-ing any two values results in a value no larger than their maximum.
   // Even no larger than their minimum if both values are non-negative.
   double max =
       lmin >= 0 && rmin >= 0 ? std::min(lmax, rmax) : std::max(lmax, rmax);
   // And-ing with a non-negative value x causes the result to be between
   // zero and x.
   if (lmin >= 0) {
     min = 0;
     max = std::min(max, lmax);
   }
   if (rmin >= 0) {
     min = 0;
     max = std::min(max, rmax);
   }
-  return Type::Range(f->NewNumber(min), f->NewNumber(max), t->zone());
+  return Type::Range(min, max, t->zone());
 }
 
 
 Type* Typer::Visitor::JSBitwiseXorTyper(Type* lhs, Type* rhs, Typer* t) {
   lhs = NumberToInt32(ToNumber(lhs, t), t);
   rhs = NumberToInt32(ToNumber(rhs, t), t);
   double lmin = lhs->Min();
   double rmin = rhs->Min();
   double lmax = lhs->Max();
   double rmax = rhs->Max();
@@ skipping 39 matching lines @@
   if (rhs->Min() > 0 && rhs->Max() <= 31) {
     // Right-shifting by a positive value yields a small integer value.
     double shift_min = kMinInt >> static_cast<int>(rhs->Min());
     double shift_max = kMaxInt >> static_cast<int>(rhs->Min());
     min = std::max(min, shift_min);
     max = std::min(max, shift_max);
   }
   // TODO(jarin) Ideally, the following micro-optimization should be performed
   // by the type constructor.
   if (max != Type::Signed32()->Max() || min != Type::Signed32()->Min()) {
-    Factory* f = t->isolate()->factory();
-    return Type::Range(f->NewNumber(min), f->NewNumber(max), t->zone());
+    return Type::Range(min, max, t->zone());
   }
   return Type::Signed32();
 }
 
 
 Type* Typer::Visitor::JSShiftRightLogicalTyper(Type* lhs, Type* rhs, Typer* t) {
   lhs = NumberToUint32(ToNumber(lhs, t), t);
-  Factory* f = t->isolate()->factory();
   // Logical right-shifting any value cannot make it larger.
-  Handle<Object> min = f->NewNumber(0);
-  Handle<Object> max = f->NewNumber(lhs->Max());
-  return Type::Range(min, max, t->zone());
+  return Type::Range(0.0, lhs->Max(), t->zone());
 }
 
 
 // JS arithmetic operators.
 
 
 // Returns the array's least element, ignoring NaN.
 // There must be at least one non-NaN element.
 // Any -0 is converted to 0.
 static double array_min(double a[], size_t n) {
@@ skipping 21 matching lines @@
     }
   }
   DCHECK(!std::isnan(x));
   return x == 0 ? 0 : x;  // -0 -> 0
 }
 
 
 Type* Typer::Visitor::JSAddRanger(Type::RangeType* lhs, Type::RangeType* rhs,
                                   Typer* t) {
   double results[4];
-  results[0] = lhs->Min()->Number() + rhs->Min()->Number();
-  results[1] = lhs->Min()->Number() + rhs->Max()->Number();
-  results[2] = lhs->Max()->Number() + rhs->Min()->Number();
-  results[3] = lhs->Max()->Number() + rhs->Max()->Number();
+  results[0] = lhs->Min() + rhs->Min();
+  results[1] = lhs->Min() + rhs->Max();
+  results[2] = lhs->Max() + rhs->Min();
+  results[3] = lhs->Max() + rhs->Max();
   // Since none of the inputs can be -0, the result cannot be -0 either.
   // However, it can be nan (the sum of two infinities of opposite sign).
   // On the other hand, if none of the "results" above is nan, then the actual
   // result cannot be nan either.
   int nans = 0;
   for (int i = 0; i < 4; ++i) {
     if (std::isnan(results[i])) ++nans;
   }
   if (nans == 4) return Type::NaN();  // [-inf..-inf] + [inf..inf] or vice versa
-  Factory* f = t->isolate()->factory();
-  Type* range = Type::Range(f->NewNumber(array_min(results, 4)),
-                            f->NewNumber(array_max(results, 4)), t->zone());
+  Type* range =
+      Type::Range(array_min(results, 4), array_max(results, 4), t->zone());
   return nans == 0 ? range : Type::Union(range, Type::NaN(), t->zone());
   // Examples:
   //   [-inf, -inf] + [+inf, +inf] = NaN
   //   [-inf, -inf] + [n, +inf] = [-inf, -inf] \/ NaN
   //   [-inf, +inf] + [n, +inf] = [-inf, +inf] \/ NaN
   //   [-inf, m] + [n, +inf] = [-inf, +inf] \/ NaN
 }
 
 
 Type* Typer::Visitor::JSAddTyper(Type* lhs, Type* rhs, Typer* t) {
@@ skipping 13 matching lines @@
     return JSAddRanger(lhs->AsRange(), rhs->AsRange(), t);
   }
   // TODO(neis): Deal with numeric bitsets here and elsewhere.
   return Type::Number();
 }
 
 
 Type* Typer::Visitor::JSSubtractRanger(Type::RangeType* lhs,
                                        Type::RangeType* rhs, Typer* t) {
   double results[4];
-  results[0] = lhs->Min()->Number() - rhs->Min()->Number();
-  results[1] = lhs->Min()->Number() - rhs->Max()->Number();
-  results[2] = lhs->Max()->Number() - rhs->Min()->Number();
-  results[3] = lhs->Max()->Number() - rhs->Max()->Number();
+  results[0] = lhs->Min() - rhs->Min();
+  results[1] = lhs->Min() - rhs->Max();
+  results[2] = lhs->Max() - rhs->Min();
+  results[3] = lhs->Max() - rhs->Max();
   // Since none of the inputs can be -0, the result cannot be -0.
   // However, it can be nan (the subtraction of two infinities of same sign).
   // On the other hand, if none of the "results" above is nan, then the actual
   // result cannot be nan either.
   int nans = 0;
   for (int i = 0; i < 4; ++i) {
     if (std::isnan(results[i])) ++nans;
   }
   if (nans == 4) return Type::NaN();  // [inf..inf] - [inf..inf] (all same sign)
-  Factory* f = t->isolate()->factory();
-  Type* range = Type::Range(f->NewNumber(array_min(results, 4)),
-                            f->NewNumber(array_max(results, 4)), t->zone());
+  Type* range =
+      Type::Range(array_min(results, 4), array_max(results, 4), t->zone());
   return nans == 0 ? range : Type::Union(range, Type::NaN(), t->zone());
   // Examples:
   //   [-inf, +inf] - [-inf, +inf] = [-inf, +inf] \/ NaN
   //   [-inf, -inf] - [-inf, -inf] = NaN
   //   [-inf, -inf] - [n, +inf] = [-inf, -inf] \/ NaN
   //   [m, +inf] - [-inf, n] = [-inf, +inf] \/ NaN
 }
 
 
 Type* Typer::Visitor::JSSubtractTyper(Type* lhs, Type* rhs, Typer* t) {
   lhs = Rangify(ToNumber(lhs, t), t);
   rhs = Rangify(ToNumber(rhs, t), t);
   if (lhs->Is(Type::NaN()) || rhs->Is(Type::NaN())) return Type::NaN();
   if (lhs->IsRange() && rhs->IsRange()) {
     return JSSubtractRanger(lhs->AsRange(), rhs->AsRange(), t);
   }
   return Type::Number();
 }
 
 
 Type* Typer::Visitor::JSMultiplyRanger(Type::RangeType* lhs,
                                        Type::RangeType* rhs, Typer* t) {
   double results[4];
-  double lmin = lhs->Min()->Number();
-  double lmax = lhs->Max()->Number();
-  double rmin = rhs->Min()->Number();
-  double rmax = rhs->Max()->Number();
+  double lmin = lhs->Min();
+  double lmax = lhs->Max();
+  double rmin = rhs->Min();
+  double rmax = rhs->Max();
   results[0] = lmin * rmin;
   results[1] = lmin * rmax;
   results[2] = lmax * rmin;
   results[3] = lmax * rmax;
   // If the result may be nan, we give up on calculating a precise type, because
   // the discontinuity makes it too complicated.  Note that even if none of the
   // "results" above is nan, the actual result may still be, so we have to do a
   // different check:
   bool maybe_nan = (lhs->Maybe(t->singleton_zero) &&
                     (rmin == -V8_INFINITY || rmax == +V8_INFINITY)) ||
                    (rhs->Maybe(t->singleton_zero) &&
                     (lmin == -V8_INFINITY || lmax == +V8_INFINITY));
   if (maybe_nan) return t->weakint;  // Giving up.
   bool maybe_minuszero = (lhs->Maybe(t->singleton_zero) && rmin < 0) ||
                          (rhs->Maybe(t->singleton_zero) && lmin < 0);
-  Factory* f = t->isolate()->factory();
-  Type* range = Type::Range(f->NewNumber(array_min(results, 4)),
-                            f->NewNumber(array_max(results, 4)), t->zone());
+  Type* range =
+      Type::Range(array_min(results, 4), array_max(results, 4), t->zone());
   return maybe_minuszero ? Type::Union(range, Type::MinusZero(), t->zone())
                          : range;
 }
 
 
 Type* Typer::Visitor::JSMultiplyTyper(Type* lhs, Type* rhs, Typer* t) {
   lhs = Rangify(ToNumber(lhs, t), t);
   rhs = Rangify(ToNumber(rhs, t), t);
   if (lhs->Is(Type::NaN()) || rhs->Is(Type::NaN())) return Type::NaN();
   if (lhs->IsRange() && rhs->IsRange()) {
@@ skipping 12 matching lines @@
   bool maybe_nan =
       lhs->Maybe(Type::NaN()) || rhs->Maybe(t->zeroish) ||
       ((lhs->Min() == -V8_INFINITY || lhs->Max() == +V8_INFINITY) &&
        (rhs->Min() == -V8_INFINITY || rhs->Max() == +V8_INFINITY));
   return maybe_nan ? Type::Number() : Type::OrderedNumber();
 }
 
 
 Type* Typer::Visitor::JSModulusRanger(Type::RangeType* lhs,
                                       Type::RangeType* rhs, Typer* t) {
-  double lmin = lhs->Min()->Number();
-  double lmax = lhs->Max()->Number();
-  double rmin = rhs->Min()->Number();
-  double rmax = rhs->Max()->Number();
+  double lmin = lhs->Min();
+  double lmax = lhs->Max();
+  double rmin = rhs->Min();
+  double rmax = rhs->Max();
 
   double labs = std::max(std::abs(lmin), std::abs(lmax));
   double rabs = std::max(std::abs(rmin), std::abs(rmax)) - 1;
   double abs = std::min(labs, rabs);
   bool maybe_minus_zero = false;
   double omin = 0;
   double omax = 0;
   if (lmin >= 0) {  // {lhs} positive.
     omin = 0;
     omax = abs;
   } else if (lmax <= 0) {  // {lhs} negative.
     omin = 0 - abs;
     omax = 0;
     maybe_minus_zero = true;
   } else {
     omin = 0 - abs;
     omax = abs;
     maybe_minus_zero = true;
   }
 
-  Factory* f = t->isolate()->factory();
-  Type* result = Type::Range(f->NewNumber(omin), f->NewNumber(omax), t->zone());
+  Type* result = Type::Range(omin, omax, t->zone());
   if (maybe_minus_zero)
     result = Type::Union(result, Type::MinusZero(), t->zone());
   return result;
 }
 
 
 Type* Typer::Visitor::JSModulusTyper(Type* lhs, Type* rhs, Typer* t) {
   lhs = ToNumber(lhs, t);
   rhs = ToNumber(rhs, t);
   if (lhs->Is(Type::NaN()) || rhs->Is(Type::NaN())) return Type::NaN();
@@ skipping 102 matching lines @@
   Type* previous_number =
       Type::Intersect(previous_type, typer_->integer, zone());
   Type* current_number = Type::Intersect(current_type, typer_->integer, zone());
   if (!current_number->IsRange() || !previous_number->IsRange()) {
     return current_type;
   }
 
   Type::RangeType* previous = previous_number->AsRange();
   Type::RangeType* current = current_number->AsRange();
 
-  double current_min = current->Min()->Number();
-  Handle<Object> new_min = current->Min();
-
+  double current_min = current->Min();
+  double new_min = current_min;
   // Find the closest lower entry in the list of allowed
   // minima (or negative infinity if there is no such entry).
-  if (current_min != previous->Min()->Number()) {
+  if (current_min != previous->Min()) {
     new_min = typer_->integer->AsRange()->Min();
     for (const auto val : typer_->weaken_min_limits_) {
-      if (val->Number() <= current_min) {
+      if (val <= current_min) {
         new_min = val;
         break;
       }
     }
   }
 
-  double current_max = current->Max()->Number();
-  Handle<Object> new_max = current->Max();
+  double current_max = current->Max();
+  double new_max = current_max;
   // Find the closest greater entry in the list of allowed
   // maxima (or infinity if there is no such entry).
-  if (current_max != previous->Max()->Number()) {
+  if (current_max != previous->Max()) {
     new_max = typer_->integer->AsRange()->Max();
     for (const auto val : typer_->weaken_max_limits_) {
-      if (val->Number() >= current_max) {
+      if (val >= current_max) {
         new_max = val;
         break;
       }
     }
   }
 
   return Type::Union(current_type,
                      Type::Range(new_min, new_max, typer_->zone()),
                      typer_->zone());
 }
@@ skipping 830 matching lines @@
       TYPED_ARRAYS(TYPED_ARRAY_CASE)
 #undef TYPED_ARRAY_CASE
     }
   }
   return Type::Constant(value, zone());
 }
 
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8