1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
|
// Copyright 2015 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
#include "src/compiler/js-type-feedback-lowering.h"
#include "src/compiler/access-builder.h"
#include "src/compiler/js-graph.h"
#include "src/compiler/node-properties.h"
#include "src/objects-inl.h" // TODO(mstarzinger): Temporary cycle breaker!
#include "src/type-feedback-vector.h"
namespace v8 {
namespace internal {
namespace compiler {
JSTypeFeedbackLowering::JSTypeFeedbackLowering(Editor* editor, Flags flags,
JSGraph* jsgraph)
: AdvancedReducer(editor),
flags_(flags),
jsgraph_(jsgraph),
simplified_(graph()->zone()) {}
Reduction JSTypeFeedbackLowering::Reduce(Node* node) {
switch (node->opcode()) {
case IrOpcode::kJSLoadNamed:
return ReduceJSLoadNamed(node);
default:
break;
}
return NoChange();
}
Reduction JSTypeFeedbackLowering::ReduceJSLoadNamed(Node* node) {
DCHECK_EQ(IrOpcode::kJSLoadNamed, node->opcode());
Node* receiver = NodeProperties::GetValueInput(node, 0);
Type* receiver_type = NodeProperties::GetType(receiver);
Node* frame_state = NodeProperties::GetFrameStateInput(node, 1);
Node* effect = NodeProperties::GetEffectInput(node);
Node* control = NodeProperties::GetControlInput(node);
// We need to make optimistic assumptions to continue.
if (!(flags() & kDeoptimizationEnabled)) return NoChange();
LoadNamedParameters const& p = LoadNamedParametersOf(node->op());
if (p.feedback().vector().is_null()) return NoChange();
if (p.name().is_identical_to(factory()->length_string())) {
LoadICNexus nexus(p.feedback().vector(), p.feedback().slot());
MapHandleList maps;
if (nexus.ExtractMaps(&maps) > 0) {
for (Handle<Map> map : maps) {
if (map->instance_type() >= FIRST_NONSTRING_TYPE) return NoChange();
}
// Optimistic optimization for "length" property of strings.
if (receiver_type->Maybe(Type::TaggedSigned())) {
Node* check = graph()->NewNode(simplified()->ObjectIsSmi(), receiver);
Node* branch = graph()->NewNode(common()->Branch(BranchHint::kFalse),
check, control);
Node* if_true = graph()->NewNode(common()->IfTrue(), branch);
Node* deoptimize = graph()->NewNode(common()->Deoptimize(), frame_state,
effect, if_true);
// TODO(bmeurer): This should be on the AdvancedReducer somehow.
NodeProperties::MergeControlToEnd(graph(), common(), deoptimize);
control = graph()->NewNode(common()->IfFalse(), branch);
}
Node* receiver_map = effect =
graph()->NewNode(simplified()->LoadField(AccessBuilder::ForMap()),
receiver, effect, control);
Node* receiver_instance_type = effect = graph()->NewNode(
simplified()->LoadField(AccessBuilder::ForMapInstanceType()),
receiver_map, effect, control);
Node* check =
graph()->NewNode(machine()->Uint32LessThan(), receiver_instance_type,
jsgraph()->Uint32Constant(FIRST_NONSTRING_TYPE));
Node* branch =
graph()->NewNode(common()->Branch(BranchHint::kTrue), check, control);
Node* if_false = graph()->NewNode(common()->IfFalse(), branch);
Node* deoptimize = graph()->NewNode(common()->Deoptimize(), frame_state,
effect, if_false);
// TODO(bmeurer): This should be on the AdvancedReducer somehow.
NodeProperties::MergeControlToEnd(graph(), common(), deoptimize);
control = graph()->NewNode(common()->IfTrue(), branch);
Node* value = effect =
graph()->NewNode(simplified()->LoadField(
AccessBuilder::ForStringLength(graph()->zone())),
receiver, effect, control);
ReplaceWithValue(node, value, effect, control);
return Replace(value);
}
}
return NoChange();
}
Factory* JSTypeFeedbackLowering::factory() const {
return isolate()->factory();
}
CommonOperatorBuilder* JSTypeFeedbackLowering::common() const {
return jsgraph()->common();
}
Graph* JSTypeFeedbackLowering::graph() const { return jsgraph()->graph(); }
Isolate* JSTypeFeedbackLowering::isolate() const {
return jsgraph()->isolate();
}
MachineOperatorBuilder* JSTypeFeedbackLowering::machine() const {
return jsgraph()->machine();
}
} // namespace compiler
} // namespace internal
} // namespace v8
|
