[turbofan] Fix lazy deopt for JSToNumber conversions in binary operations.

src/compiler/js-typed-lowering.cc

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/compiler/access-builder.h"
 #include "src/compiler/js-graph.h"
 #include "src/compiler/js-typed-lowering.h"
 #include "src/compiler/node-matchers.h"
 #include "src/compiler/node-properties.h"
 #include "src/compiler/operator-properties.h"
@@ skipping 44 matching lines @@
 }
 
 
 // A helper class to simplify the process of reducing a single binop node with a
 // JSOperator. This class manages the rewriting of context, control, and effect
 // dependencies during lowering of a binop and contains numerous helper
 // functions for matching the types of inputs to an operation.
 class JSBinopReduction FINAL {
  public:
   JSBinopReduction(JSTypedLowering* lowering, Node* node)
-      : lowering_(lowering),
-        node_(node),
-        left_type_(NodeProperties::GetBounds(node->InputAt(0)).upper),
-        right_type_(NodeProperties::GetBounds(node->InputAt(1)).upper) {}
+      : lowering_(lowering), node_(node) {}
 
-  void ConvertInputsToNumber() {
-    node_->ReplaceInput(0, ConvertToNumber(left()));
-    node_->ReplaceInput(1, ConvertToNumber(right()));
+  void ConvertPrimitiveInputsToNumber() {
+    node_->ReplaceInput(0, ConvertPrimitiveToNumber(left()));
+    node_->ReplaceInput(1, ConvertPrimitiveToNumber(right()));
+  }
+
+  void ConvertInputsToNumber(Node* frame_state) {
+    // To convert the inputs to numbers, we have to provide frame states
+    // for lazy bailouts in the ToNumber conversions.
+    // We use a little hack here: we take the frame state before the binary
+    // operation and use it to construct the frame states for the conversion
+    // so that after the deoptimization, the binary operation IC gets
+    // already converted values from full code. This way we are sure that we
+    // will not re-do any of the side effects.
+
+    Node* left_input =
+        left_type()->Is(Type::PlainPrimitive())
+            ? ConvertPrimitiveToNumber(left())
+            : ConvertToNumber(left(),
+                              CreateFrameStateForLeftInput(frame_state));
+
+    Node* right_input =
+        right_type()->Is(Type::PlainPrimitive())
+            ? ConvertPrimitiveToNumber(right())
+            : ConvertToNumber(right(), CreateFrameStateForRightInput(
+                                           frame_state, left_input));
+
+    node_->ReplaceInput(0, left_input);
+    node_->ReplaceInput(1, right_input);
   }
 
   void ConvertInputsToUI32(Signedness left_signedness,
                            Signedness right_signedness) {
     node_->ReplaceInput(0, ConvertToUI32(left(), left_signedness));
     node_->ReplaceInput(1, ConvertToUI32(right(), right_signedness));
   }
 
   void ConvertInputsToString() {
     node_->ReplaceInput(0, ConvertToString(left()));
     node_->ReplaceInput(1, ConvertToString(right()));
   }
 
   // Convert inputs for bitwise shift operation (ES5 spec 11.7).
   void ConvertInputsForShift(Signedness left_signedness) {
-    node_->ReplaceInput(0, ConvertToUI32(left(), left_signedness));
-    Node* rnum = ConvertToUI32(right(), kUnsigned);
+    node_->ReplaceInput(
+        0, ConvertToUI32(ConvertPrimitiveToNumber(left()), left_signedness));
+    Node* rnum = ConvertToUI32(ConvertPrimitiveToNumber(right()), kUnsigned);
     Type* rnum_type = NodeProperties::GetBounds(rnum).upper;
     if (!rnum_type->Is(lowering_->zero_thirtyone_range_)) {
       rnum = graph()->NewNode(machine()->Word32And(), rnum,
                               jsgraph()->Int32Constant(0x1F));
     }
     node_->ReplaceInput(1, rnum);
   }
 
   void SwapInputs() {
     Node* l = left();
     Node* r = right();
     node_->ReplaceInput(0, r);
     node_->ReplaceInput(1, l);
-    std::swap(left_type_, right_type_);
   }
 
   // Remove all effect and control inputs and outputs to this node and change
   // to the pure operator {op}, possibly inserting a boolean inversion.
   Reduction ChangeToPureOperator(const Operator* op, bool invert = false,
                                  Type* type = Type::Any()) {
     DCHECK_EQ(0, op->EffectInputCount());
     DCHECK_EQ(false, OperatorProperties::HasContextInput(op));
     DCHECK_EQ(0, op->ControlInputCount());
     DCHECK_EQ(2, op->ValueInputCount());
@@ skipping 20 matching lines @@
       value->ReplaceInput(0, node_);
       return lowering_->Replace(value);
     }
     return lowering_->Changed(node_);
   }
 
   Reduction ChangeToPureOperator(const Operator* op, Type* type) {
     return ChangeToPureOperator(op, false, type);
   }
 
-  bool OneInputIs(Type* t) { return left_type_->Is(t) || right_type_->Is(t); }
+  bool OneInputIs(Type* t) { return left_type()->Is(t) || right_type()->Is(t); }
 
   bool BothInputsAre(Type* t) {
-    return left_type_->Is(t) && right_type_->Is(t);
+    return left_type()->Is(t) && right_type()->Is(t);
   }
 
   bool OneInputCannotBe(Type* t) {
-    return !left_type_->Maybe(t) || !right_type_->Maybe(t);
+    return !left_type()->Maybe(t) || !right_type()->Maybe(t);
   }
 
   bool NeitherInputCanBe(Type* t) {
-    return !left_type_->Maybe(t) && !right_type_->Maybe(t);
+    return !left_type()->Maybe(t) && !right_type()->Maybe(t);
   }
 
   Node* effect() { return NodeProperties::GetEffectInput(node_); }
   Node* control() { return NodeProperties::GetControlInput(node_); }
   Node* context() { return NodeProperties::GetContextInput(node_); }
   Node* left() { return NodeProperties::GetValueInput(node_, 0); }
   Node* right() { return NodeProperties::GetValueInput(node_, 1); }
-  Type* left_type() { return left_type_; }
-  Type* right_type() { return right_type_; }
+  Type* left_type() {
+    return NodeProperties::GetBounds(node_->InputAt(0)).upper;
+  }
+  Type* right_type() {
+    return NodeProperties::GetBounds(node_->InputAt(1)).upper;
+  }
 
   SimplifiedOperatorBuilder* simplified() { return lowering_->simplified(); }
   Graph* graph() const { return lowering_->graph(); }
   JSGraph* jsgraph() { return lowering_->jsgraph(); }
   JSOperatorBuilder* javascript() { return lowering_->javascript(); }
   MachineOperatorBuilder* machine() { return lowering_->machine(); }
   Zone* zone() const { return graph()->zone(); }
 
  private:
   JSTypedLowering* lowering_;  // The containing lowering instance.
   Node* node_;                 // The original node.
-  Type* left_type_;            // Cache of the left input's type.
-  Type* right_type_;           // Cache of the right input's type.
 
   Node* ConvertToString(Node* node) {
     // Avoid introducing too many eager ToString() operations.
     Reduction reduced = lowering_->ReduceJSToStringInput(node);
     if (reduced.Changed()) return reduced.replacement();
     Node* n = graph()->NewNode(javascript()->ToString(), node, context(),
                                effect(), control());
     update_effect(n);
     return n;
   }
 
-  Node* ConvertToNumber(Node* node) {
+  Node* CreateFrameStateForLeftInput(Node* frame_state) {
+    if (!FLAG_turbo_deoptimization) return nullptr;
+
+    FrameStateCallInfo state_info =
+        OpParameter<FrameStateCallInfo>(frame_state);
+    // If the frame state is already the right one, just return it.
+    if (state_info.state_combine().kind() == OutputFrameStateCombine::kPokeAt &&
+        state_info.state_combine().GetOffsetToPokeAt() == 1) {
+      return frame_state;
+    }
+
+    // Here, we smash the result of the conversion into the slot just below
+    // the stack top. This is the slot that full code uses to store the
+    // left operand.
+    const Operator* op = jsgraph()->common()->FrameState(
+        state_info.type(), state_info.bailout_id(),
+        OutputFrameStateCombine::PokeAt(1));
+
+    return graph()->NewNode(op, frame_state->InputAt(0),

[Benedikt Meurer, 2015/03/09 09:57:29]

As discussed offline, please add something like NodeProperties::Clone(Node*)
here with set_op() on the clone.

+                            frame_state->InputAt(1), frame_state->InputAt(2),
+                            frame_state->InputAt(3), frame_state->InputAt(4));
+  }
+
+  Node* CreateFrameStateForRightInput(Node* frame_state, Node* converted_left) {
+    if (!FLAG_turbo_deoptimization) return nullptr;
+
+    FrameStateCallInfo state_info =
+        OpParameter<FrameStateCallInfo>(frame_state);
+
+    if (state_info.bailout_id() == BailoutId::None()) {
+      // Dummy frame state => just leave it as is.
+      return frame_state;
+    }
+
+    // Create a frame state that stores the result of the operation to the
+    // top of the stack (i.e., the slot used for the right operand).
+    const Operator* op = jsgraph()->common()->FrameState(
+        state_info.type(), state_info.bailout_id(),
+        OutputFrameStateCombine::PokeAt(0));
+
+    // Change the left operand {converted_left} on the expression stack.
+    Node* stack = frame_state->InputAt(2);
+    DCHECK_EQ(stack->opcode(), IrOpcode::kStateValues);
+    DCHECK_GE(stack->InputCount(), 2);
+
+    // TODO(jarin) Allocate in a local zone or a reusable buffer.
+    NodeVector new_values(stack->InputCount(), zone());
+    for (int i = 0; i < stack->InputCount(); i++) {
+      if (i == stack->InputCount() - 2) {
+        new_values[i] = converted_left;
+      } else {
+        new_values[i] = stack->InputAt(i);
+      }
+    }
+    Node* new_stack =
+        graph()->NewNode(stack->op(), stack->InputCount(), &new_values.front());
+
+    return graph()->NewNode(op, frame_state->InputAt(0),

[Benedikt Meurer, 2015/03/09 09:57:29]

As discussed offline, please add something like NodeProperties::Clone(Node*)
here with set_op() and ReplaceInput() on the clone.

+                            frame_state->InputAt(1), new_stack,
+                            frame_state->InputAt(3), frame_state->InputAt(4));
+  }
+
+  Node* ConvertPrimitiveToNumber(Node* node) {
+    return lowering_->ConvertPrimitiveToNumber(node);
+  }
+
+  Node* ConvertToNumber(Node* node, Node* frame_state) {
     if (NodeProperties::GetBounds(node).upper->Is(Type::PlainPrimitive())) {
-      return lowering_->ConvertToNumber(node);
+      return ConvertPrimitiveToNumber(node);
+    } else if (!FLAG_turbo_deoptimization) {
+      // We cannot use ConvertToPrimitiveNumber here because we need context
+      // for converting general values.
+      Node* const n = graph()->NewNode(javascript()->ToNumber(), node,
+                                       context(), effect(), control());
+      update_effect(n);
+      return n;
+    } else {
+      Node* const n =
+          graph()->NewNode(javascript()->ToNumber(), node, context(),
+                           frame_state, effect(), control());
+      update_effect(n);
+      return n;
     }
-    // TODO(jarin) This ToNumber conversion can deoptimize, but we do not really
-    // have a frame state to deoptimize to. Either we provide such a frame state
-    // or we exclude the values that could lead to deoptimization (e.g., by
-    // triggering eager deopt if the value is not plain).
-    Node* const n = FLAG_turbo_deoptimization
-                        ? graph()->NewNode(
-                              javascript()->ToNumber(), node, context(),
-                              jsgraph()->EmptyFrameState(), effect(), control())
-                        : graph()->NewNode(javascript()->ToNumber(), node,
-                                           context(), effect(), control());
-    update_effect(n);
-    return n;
   }
 
   Node* ConvertToUI32(Node* node, Signedness signedness) {
     // Avoid introducing too many eager NumberToXXnt32() operations.
-    node = ConvertToNumber(node);
     Type* type = NodeProperties::GetBounds(node).upper;
     if (signedness == kSigned) {
       if (!type->Is(Type::Signed32())) {
         node = graph()->NewNode(simplified()->NumberToInt32(), node);
       }
     } else {
       DCHECK_EQ(kUnsigned, signedness);
       if (!type->Is(Type::Unsigned32())) {
         node = graph()->NewNode(simplified()->NumberToUint32(), node);
       }
     }
     return node;
   }
 
   void update_effect(Node* effect) {
     NodeProperties::ReplaceEffectInput(node_, effect);
   }
 };
 
 
 Reduction JSTypedLowering::ReduceJSAdd(Node* node) {
   JSBinopReduction r(this, node);
   if (r.BothInputsAre(Type::Number())) {
     // JSAdd(x:number, y:number) => NumberAdd(x, y)
     return r.ChangeToPureOperator(simplified()->NumberAdd(), Type::Number());
   }
-  if (r.BothInputsAre(Type::Primitive()) &&
-      r.NeitherInputCanBe(Type::StringOrReceiver())) {
+  if (r.NeitherInputCanBe(Type::StringOrReceiver())) {
     // JSAdd(x:-string, y:-string) => NumberAdd(ToNumber(x), ToNumber(y))
-    r.ConvertInputsToNumber();
+    Node* frame_state = FLAG_turbo_deoptimization
+                            ? NodeProperties::GetFrameStateInput(node, 1)
+                            : nullptr;
+    r.ConvertInputsToNumber(frame_state);
     return r.ChangeToPureOperator(simplified()->NumberAdd(), Type::Number());
   }
 #if 0
-  // TODO(turbofan): General ToNumber disabled for now because:
-  //   a) The inserted ToNumber operation screws up observability of valueOf.
-  //   b) Deoptimization at ToNumber doesn't have corresponding bailout id.
-  Type* maybe_string = Type::Union(Type::String(), Type::Receiver(), zone());
-  if (r.NeitherInputCanBe(maybe_string)) {
-    ...
-  }
-#endif
-#if 0
   // TODO(turbofan): Lowering of StringAdd is disabled for now because:
   //   a) The inserted ToString operation screws up valueOf vs. toString order.
   //   b) Deoptimization at ToString doesn't have corresponding bailout id.
   //   c) Our current StringAddStub is actually non-pure and requires context.
   if (r.OneInputIs(Type::String())) {
     // JSAdd(x:string, y:string) => StringAdd(x, y)
     // JSAdd(x:string, y) => StringAdd(x, ToString(y))
     // JSAdd(x, y:string) => StringAdd(ToString(x), y)
     r.ConvertInputsToString();
     return r.ChangeToPureOperator(simplified()->StringAdd());
   }
 #endif
   return NoChange();
 }
 
 
-Reduction JSTypedLowering::ReduceJSBitwiseOr(Node* node) {
-  JSBinopReduction r(this, node);
-
-  // We can only reduce to Word32Or if we are sure the to-number conversions
-  // cannot lazily deoptimize.
-  bool shortcut_or_zero =
-      !FLAG_turbo_deoptimization && r.OneInputIs(zero_range_);
-  if (r.BothInputsAre(Type::Primitive()) || shortcut_or_zero) {
-    // TODO(titzer): some Smi bitwise operations don't really require going
-    // all the way to int32, which can save tagging/untagging for some
-    // operations on some platforms.
-    // TODO(turbofan): make this heuristic configurable for code size.
-    r.ConvertInputsToUI32(kSigned, kSigned);
-    return r.ChangeToPureOperator(machine()->Word32Or(), Type::Integral32());
-  }
-  return NoChange();
-}
-
-
-Reduction JSTypedLowering::ReduceJSMultiply(Node* node) {
-  JSBinopReduction r(this, node);
-
-  // We can only reduce to NumberMultiply if we are sure the to-number
-  // conversions cannot lazily deoptimize.
-  bool shortcut_multiply_one =
-      !FLAG_turbo_deoptimization && r.OneInputIs(one_range_);
-
-  if (r.BothInputsAre(Type::Primitive()) || shortcut_multiply_one) {
-    r.ConvertInputsToNumber();
-    return r.ChangeToPureOperator(simplified()->NumberMultiply(),
-                                  Type::Number());
-  }
-  // TODO(turbofan): relax/remove the effects of this operator in other cases.
-  return NoChange();
-}
-
-
 Reduction JSTypedLowering::ReduceNumberBinop(Node* node,
                                              const Operator* numberOp) {
   JSBinopReduction r(this, node);
-  if (r.BothInputsAre(Type::Primitive())) {
-    r.ConvertInputsToNumber();
-    return r.ChangeToPureOperator(numberOp, Type::Number());
-  }
-#if 0
-  // TODO(turbofan): General ToNumber disabled for now because:
-  //   a) The inserted ToNumber operation screws up observability of valueOf.
-  //   b) Deoptimization at ToNumber doesn't have corresponding bailout id.
-  if (r.OneInputIs(Type::Primitive())) {
-    // If at least one input is a primitive, then insert appropriate conversions
-    // to number and reduce this operator to the given numeric one.
-    // TODO(turbofan): make this heuristic configurable for code size.
-    r.ConvertInputsToNumber();
-    return r.ChangeToPureOperator(numberOp);
-  }
-#endif
-  // TODO(turbofan): relax/remove the effects of this operator in other cases.
-  return NoChange();
+  Node* frame_state = FLAG_turbo_deoptimization
+                          ? NodeProperties::GetFrameStateInput(node, 1)
+                          : nullptr;
+  r.ConvertInputsToNumber(frame_state);
+  return r.ChangeToPureOperator(numberOp, Type::Number());
 }
 
 
 Reduction JSTypedLowering::ReduceInt32Binop(Node* node, const Operator* intOp) {
   JSBinopReduction r(this, node);
-  if (r.BothInputsAre(Type::Primitive())) {
-    // TODO(titzer): some Smi bitwise operations don't really require going
-    // all the way to int32, which can save tagging/untagging for some
-    // operations
-    // on some platforms.
-    // TODO(turbofan): make this heuristic configurable for code size.
-    r.ConvertInputsToUI32(kSigned, kSigned);
-    return r.ChangeToPureOperator(intOp, Type::Integral32());
-  }
-  return NoChange();
+  Node* frame_state = FLAG_turbo_deoptimization
+                          ? NodeProperties::GetFrameStateInput(node, 1)
+                          : nullptr;
+  r.ConvertInputsToNumber(frame_state);
+  r.ConvertInputsToUI32(kSigned, kSigned);
+  return r.ChangeToPureOperator(intOp, Type::Integral32());
 }
 
 
 Reduction JSTypedLowering::ReduceUI32Shift(Node* node,
                                            Signedness left_signedness,
                                            const Operator* shift_op) {
   JSBinopReduction r(this, node);
   if (r.BothInputsAre(Type::Primitive())) {
     r.ConvertInputsForShift(left_signedness);
     return r.ChangeToPureOperator(shift_op, Type::Integral32());
@@ skipping 30 matching lines @@
 #if 0
   // TODO(turbofan): General ToNumber disabled for now because:
   //   a) The inserted ToNumber operation screws up observability of valueOf.
   //   b) Deoptimization at ToNumber doesn't have corresponding bailout id.
   Type* maybe_string = Type::Union(Type::String(), Type::Receiver(), zone());
   if (r.OneInputCannotBe(maybe_string)) {
     // If one input cannot be a string, then emit a number comparison.
     ...
   }
 #endif
-  if (r.BothInputsAre(Type::Primitive()) &&
+  if (r.BothInputsAre(Type::PlainPrimitive()) &&
       r.OneInputCannotBe(Type::StringOrReceiver())) {
     const Operator* less_than;
     const Operator* less_than_or_equal;
     if (r.BothInputsAre(Type::Unsigned32())) {
       less_than = machine()->Uint32LessThan();
       less_than_or_equal = machine()->Uint32LessThanOrEqual();
     } else if (r.BothInputsAre(Type::Signed32())) {
       less_than = machine()->Int32LessThan();
       less_than_or_equal = machine()->Int32LessThanOrEqual();
     } else {
       // TODO(turbofan): mixed signed/unsigned int32 comparisons.
-      r.ConvertInputsToNumber();
+      r.ConvertPrimitiveInputsToNumber();
       less_than = simplified()->NumberLessThan();
       less_than_or_equal = simplified()->NumberLessThanOrEqual();
     }
     const Operator* comparison;
     switch (node->opcode()) {
       case IrOpcode::kJSLessThan:
         comparison = less_than;
         break;
       case IrOpcode::kJSGreaterThan:
         comparison = less_than;
@@ skipping 174 matching lines @@
       DCHECK(!NodeProperties::GetBounds(input).upper->Is(Type::Number()));
       RelaxEffectsAndControls(node);
       node->set_op(common()->Phi(kMachAnyTagged, input_count));
       for (int i = 0; i < input_count; ++i) {
         // We must be very careful not to introduce cycles when pushing
         // operations into phis. It is safe for {value}, since it appears
         // as input to the phi that we are replacing, but it's not safe
         // to simply reuse the context of the {node}. However, ToNumber()
         // does not require a context anyways, so it's safe to discard it
         // here and pass the dummy context.
-        Node* const value = ConvertToNumber(input->InputAt(i));
+        Node* const value = ConvertPrimitiveToNumber(input->InputAt(i));
         if (i < node->InputCount()) {
           node->ReplaceInput(i, value);
         } else {
           node->AppendInput(graph()->zone(), value);
         }
       }
       if (input_count < node->InputCount()) {
         node->ReplaceInput(input_count, control);
       } else {
         node->AppendInput(graph()->zone(), control);
@@ skipping 12 matching lines @@
       RelaxEffectsAndControls(node);
       node->set_op(common()->Select(kMachAnyTagged, input_hint));
       node->ReplaceInput(0, input->InputAt(0));
       for (int i = 1; i < input_count; ++i) {
         // We must be very careful not to introduce cycles when pushing
         // operations into selects. It is safe for {value}, since it appears
         // as input to the select that we are replacing, but it's not safe
         // to simply reuse the context of the {node}. However, ToNumber()
         // does not require a context anyways, so it's safe to discard it
         // here and pass the dummy context.
-        Node* const value = ConvertToNumber(input->InputAt(i));
+        Node* const value = ConvertPrimitiveToNumber(input->InputAt(i));
         node->ReplaceInput(i, value);
       }
       node->TrimInputCount(input_count);
       return Changed(node);
     }
     // Remember this conversion.
     InsertConversion(node);
     if (NodeProperties::GetContextInput(node) !=
             jsgraph()->NoContextConstant() ||
         NodeProperties::GetEffectInput(node) != graph()->start() ||
@@ skipping 262 matching lines @@
     case IrOpcode::kJSStrictEqual:
       return ReduceJSStrictEqual(node, false);
     case IrOpcode::kJSStrictNotEqual:
       return ReduceJSStrictEqual(node, true);
     case IrOpcode::kJSLessThan:         // fall through
     case IrOpcode::kJSGreaterThan:      // fall through
     case IrOpcode::kJSLessThanOrEqual:  // fall through
     case IrOpcode::kJSGreaterThanOrEqual:
       return ReduceJSComparison(node);
     case IrOpcode::kJSBitwiseOr:
-      return ReduceJSBitwiseOr(node);
+      return ReduceInt32Binop(node, machine()->Word32Or());
     case IrOpcode::kJSBitwiseXor:
       return ReduceInt32Binop(node, machine()->Word32Xor());
     case IrOpcode::kJSBitwiseAnd:
       return ReduceInt32Binop(node, machine()->Word32And());
     case IrOpcode::kJSShiftLeft:
       return ReduceUI32Shift(node, kSigned, machine()->Word32Shl());
     case IrOpcode::kJSShiftRight:
       return ReduceUI32Shift(node, kSigned, machine()->Word32Sar());
     case IrOpcode::kJSShiftRightLogical:
       return ReduceUI32Shift(node, kUnsigned, machine()->Word32Shr());
     case IrOpcode::kJSAdd:
       return ReduceJSAdd(node);
     case IrOpcode::kJSSubtract:
       return ReduceNumberBinop(node, simplified()->NumberSubtract());
     case IrOpcode::kJSMultiply:
-      return ReduceJSMultiply(node);
+      return ReduceNumberBinop(node, simplified()->NumberMultiply());
     case IrOpcode::kJSDivide:
       return ReduceNumberBinop(node, simplified()->NumberDivide());
     case IrOpcode::kJSModulus:
       return ReduceNumberBinop(node, simplified()->NumberModulus());
     case IrOpcode::kJSUnaryNot:
       return ReduceJSUnaryNot(node);
     case IrOpcode::kJSToBoolean:
       return ReduceJSToBoolean(node);
     case IrOpcode::kJSToNumber:
       return ReduceJSToNumber(node);
     case IrOpcode::kJSToString:
       return ReduceJSToString(node);
     case IrOpcode::kJSLoadProperty:
       return ReduceJSLoadProperty(node);
     case IrOpcode::kJSStoreProperty:
       return ReduceJSStoreProperty(node);
     case IrOpcode::kJSLoadContext:
       return ReduceJSLoadContext(node);
     case IrOpcode::kJSStoreContext:
       return ReduceJSStoreContext(node);
     default:
       break;
   }
   return NoChange();
 }
 
 
-Node* JSTypedLowering::ConvertToNumber(Node* input) {
+Node* JSTypedLowering::ConvertPrimitiveToNumber(Node* input) {
   DCHECK(NodeProperties::GetBounds(input).upper->Is(Type::PlainPrimitive()));
   // Avoid inserting too many eager ToNumber() operations.
   Reduction const reduction = ReduceJSToNumberInput(input);
   if (reduction.Changed()) return reduction.replacement();
   // TODO(jarin) Use PlainPrimitiveToNumber once we have it.
   Node* const conversion =
       FLAG_turbo_deoptimization
           ? graph()->NewNode(javascript()->ToNumber(), input,
                              jsgraph()->NoContextConstant(),
                              jsgraph()->EmptyFrameState(), graph()->start(),
@@ skipping 52 matching lines @@
 }
 
 
 MachineOperatorBuilder* JSTypedLowering::machine() const {
   return jsgraph()->machine();
 }
 
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8