js-type-feedback-lowering.cc 4.44 KB
Newer Older
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118
// Copyright 2015 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.

#include "src/compiler/js-type-feedback-lowering.h"

#include "src/compiler/access-builder.h"
#include "src/compiler/js-graph.h"
#include "src/compiler/node-properties.h"

namespace v8 {
namespace internal {
namespace compiler {

JSTypeFeedbackLowering::JSTypeFeedbackLowering(Editor* editor, Flags flags,
                                               JSGraph* jsgraph)
    : AdvancedReducer(editor),
      flags_(flags),
      jsgraph_(jsgraph),
      simplified_(graph()->zone()) {}


Reduction JSTypeFeedbackLowering::Reduce(Node* node) {
  switch (node->opcode()) {
    case IrOpcode::kJSLoadNamed:
      return ReduceJSLoadNamed(node);
    default:
      break;
  }
  return NoChange();
}


Reduction JSTypeFeedbackLowering::ReduceJSLoadNamed(Node* node) {
  DCHECK_EQ(IrOpcode::kJSLoadNamed, node->opcode());
  Node* receiver = NodeProperties::GetValueInput(node, 0);
  Type* receiver_type = NodeProperties::GetBounds(receiver).upper;
  Node* frame_state = NodeProperties::GetFrameStateInput(node, 1);
  Node* effect = NodeProperties::GetEffectInput(node);
  Node* control = NodeProperties::GetControlInput(node);
  // We need to make optimistic assumptions to continue.
  if (!(flags() & kDeoptimizationEnabled)) return NoChange();
  LoadNamedParameters const& p = LoadNamedParametersOf(node->op());
  Handle<TypeFeedbackVector> vector;
  if (!p.feedback().vector().ToHandle(&vector)) return NoChange();
  if (p.name().handle().is_identical_to(factory()->length_string())) {
    LoadICNexus nexus(vector, p.feedback().slot());
    MapHandleList maps;
    if (nexus.ExtractMaps(&maps) > 0) {
      for (Handle<Map> map : maps) {
        if (map->instance_type() >= FIRST_NONSTRING_TYPE) return NoChange();
      }
      // Optimistic optimization for "length" property of strings.
      if (receiver_type->Maybe(Type::TaggedSigned())) {
        Node* check = graph()->NewNode(simplified()->ObjectIsSmi(), receiver);
        Node* branch = graph()->NewNode(common()->Branch(BranchHint::kFalse),
                                        check, control);
        Node* if_true = graph()->NewNode(common()->IfTrue(), branch);
        Node* deoptimize = graph()->NewNode(common()->Deoptimize(), frame_state,
                                            effect, if_true);
        // TODO(bmeurer): This should be on the AdvancedReducer somehow.
        NodeProperties::MergeControlToEnd(graph(), common(), deoptimize);
        control = graph()->NewNode(common()->IfFalse(), branch);
      }
      Node* receiver_map = effect =
          graph()->NewNode(simplified()->LoadField(AccessBuilder::ForMap()),
                           receiver, effect, control);
      Node* receiver_instance_type = effect = graph()->NewNode(
          simplified()->LoadField(AccessBuilder::ForMapInstanceType()),
          receiver_map, effect, control);
      Node* check =
          graph()->NewNode(machine()->Uint32LessThan(), receiver_instance_type,
                           jsgraph()->Uint32Constant(FIRST_NONSTRING_TYPE));
      Node* branch =
          graph()->NewNode(common()->Branch(BranchHint::kTrue), check, control);
      Node* if_false = graph()->NewNode(common()->IfFalse(), branch);
      Node* deoptimize = graph()->NewNode(common()->Deoptimize(), frame_state,
                                          effect, if_false);
      // TODO(bmeurer): This should be on the AdvancedReducer somehow.
      NodeProperties::MergeControlToEnd(graph(), common(), deoptimize);
      control = graph()->NewNode(common()->IfTrue(), branch);
      Node* value = effect =
          graph()->NewNode(simplified()->LoadField(
                               AccessBuilder::ForStringLength(graph()->zone())),
                           receiver, effect, control);
      ReplaceWithValue(node, value, effect, control);
      return Replace(value);
    }
  }
  return NoChange();
}


Factory* JSTypeFeedbackLowering::factory() const {
  return isolate()->factory();
}


CommonOperatorBuilder* JSTypeFeedbackLowering::common() const {
  return jsgraph()->common();
}


Graph* JSTypeFeedbackLowering::graph() const { return jsgraph()->graph(); }


Isolate* JSTypeFeedbackLowering::isolate() const {
  return jsgraph()->isolate();
}


MachineOperatorBuilder* JSTypeFeedbackLowering::machine() const {
  return jsgraph()->machine();
}

}  // namespace compiler
}  // namespace internal
}  // namespace v8