[turbofan] Add an extra frame state for deoptimization before binary op.

src/compiler/js-generic-lowering.cc

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/code-factory.h"
 #include "src/code-stubs.h"
 #include "src/compiler/common-operator.h"
 #include "src/compiler/js-generic-lowering.h"
 #include "src/compiler/machine-operator.h"
 #include "src/compiler/node-matchers.h"
@@ skipping 89 matching lines @@
 
 #define REPLACE_UNIMPLEMENTED(op) \
   void JSGenericLowering::Lower##op(Node* node) { UNIMPLEMENTED(); }
 REPLACE_UNIMPLEMENTED(JSYield)
 REPLACE_UNIMPLEMENTED(JSDebugger)
 #undef REPLACE_UNIMPLEMENTED
 
 
 static CallDescriptor::Flags FlagsForNode(Node* node) {
   CallDescriptor::Flags result = CallDescriptor::kNoFlags;
-  if (OperatorProperties::HasFrameStateInput(node->op())) {
+  if (OperatorProperties::GetFrameStateInputCount(node->op()) > 0) {
     result |= CallDescriptor::kNeedsFrameState;
   }
   return result;
 }
 
 
 void JSGenericLowering::ReplaceWithCompareIC(Node* node, Token::Value token) {
   Callable callable = CodeFactory::CompareIC(isolate(), token);
   CallDescriptor* desc_compare = Linkage::GetStubCallDescriptor(
       isolate(), zone(), callable.descriptor(), 0,
       CallDescriptor::kPatchableCallSiteWithNop | FlagsForNode(node));
 
   // Create a new call node asking a CompareIC for help.
   NodeVector inputs(zone());
   inputs.reserve(node->InputCount() + 1);
   inputs.push_back(jsgraph()->HeapConstant(callable.code()));
   inputs.push_back(NodeProperties::GetValueInput(node, 0));
   inputs.push_back(NodeProperties::GetValueInput(node, 1));
   inputs.push_back(NodeProperties::GetContextInput(node));
   if (node->op()->HasProperty(Operator::kPure)) {
     // A pure (strict) comparison doesn't have an effect, control or frame
     // state.  But for the graph, we need to add control and effect inputs.
-    DCHECK(!OperatorProperties::HasFrameStateInput(node->op()));
+    DCHECK(OperatorProperties::GetFrameStateInputCount(node->op()) == 0);
     inputs.push_back(graph()->start());
     inputs.push_back(graph()->start());
   } else {
-    DCHECK(OperatorProperties::HasFrameStateInput(node->op()) ==
+    DCHECK((OperatorProperties::GetFrameStateInputCount(node->op()) == 1) ==
            FLAG_turbo_deoptimization);
     if (FLAG_turbo_deoptimization) {
-      inputs.push_back(NodeProperties::GetFrameStateInput(node));
+      inputs.push_back(NodeProperties::GetFrameStateInput(node, 0));
     }
     inputs.push_back(NodeProperties::GetEffectInput(node));
     inputs.push_back(NodeProperties::GetControlInput(node));
   }
   Node* compare =
       graph()->NewNode(common()->Call(desc_compare),
                        static_cast<int>(inputs.size()), &inputs.front());
   NodeProperties::SetBounds(
       compare, Bounds(Type::None(zone()), Type::UntaggedSigned(zone())));
 
@@ skipping 40 matching lines @@
   node->ReplaceInput(0, booleanize);
   node->ReplaceInput(1, true_value);
   node->ReplaceInput(2, false_value);
   node->set_op(common()->Select(kMachAnyTagged));
 }
 
 
 void JSGenericLowering::ReplaceWithStubCall(Node* node, Callable callable,
                                             CallDescriptor::Flags flags) {
   Operator::Properties properties = node->op()->properties();
-  CallDescriptor* desc =
-      Linkage::GetStubCallDescriptor(isolate(), zone(), callable.descriptor(),
-                                     0, flags | FlagsForNode(node), properties);
+  flags |= FlagsForNode(node);
+  CallDescriptor* desc = Linkage::GetStubCallDescriptor(
+      isolate(), zone(), callable.descriptor(), 0, flags, properties);
+  const Operator* new_op = common()->Call(desc);
+
+  // Take care of frame states.
+  int old_frame_state_count =
+      OperatorProperties::GetFrameStateInputCount(node->op());
+  int new_frame_state_count =
+      (flags & CallDescriptor::kNeedsFrameState) ? 1 : 0;
+  DCHECK_GE(old_frame_state_count, new_frame_state_count);
+  // If there are extra frame states, get rid of them.
+  for (int i = new_frame_state_count; i < old_frame_state_count; i++) {

[Benedikt Meurer, 2015/03/09 05:32:34]

This loop doesn't look right. If you remove input i, then input i+1 becomes
input i, and so on. So you're probably removing non-frame-state inputs here.

[Jarin, 2015/03/09 07:47:11]

Good catch! Done.

+    node->RemoveInput(i + NodeProperties::FirstFrameStateIndex(node));
+  }
+
+
   Node* stub_code = jsgraph()->HeapConstant(callable.code());
   node->InsertInput(zone(), 0, stub_code);
-  node->set_op(common()->Call(desc));
+  node->set_op(new_op);
 }
 
 
 void JSGenericLowering::ReplaceWithBuiltinCall(Node* node,
                                                Builtins::JavaScript id,
                                                int nargs) {
   Operator::Properties properties = node->op()->properties();
   Callable callable =
       CodeFactory::CallFunction(isolate(), nargs - 1, NO_CALL_FUNCTION_FLAGS);
   CallDescriptor* desc =
@@ skipping 259 matching lines @@
 
 
 void JSGenericLowering::LowerJSCallRuntime(Node* node) {
   const CallRuntimeParameters& p = CallRuntimeParametersOf(node->op());
   ReplaceWithRuntimeCall(node, p.id(), static_cast<int>(p.arity()));
 }
 
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8