[turbofan] Remove eager frame state from bitwise ops.

This removes the frame state input representing the before-state from
nodes having any int32 bitwise operator. Lowering that inserts number
conversions of the inputs has to be disabled when deoptimization is
enabled, because the frame state layout is no longer known.

R=epertoso@chromium.org
BUG=v8:5021,v8:4746

Review-Url: https://codereview.chromium.org/2194383004
Cr-Commit-Position: refs/heads/master@{#38280}

src/compiler/js-typed-lowering.cc

@@ -582,7 +582,6 @@ Reduction JSTypedLowering::ReduceJSModulus(Node* node) {
 
 Reduction JSTypedLowering::ReduceInt32Binop(Node* node,
                                             const Operator* int_op) {
-  if (flags() & kDisableIntegerBinaryOpReduction) return NoChange();
   JSBinopReduction r(this, node);
   BinaryOperationHints::Hint feedback = r.GetNumberBinaryOperationFeedback();
   if (feedback != BinaryOperationHints::kAny) {
@@ -597,9 +596,15 @@ Reduction JSTypedLowering::ReduceInt32Binop(Node* node,
     }
     return r.ChangeToSpeculativeOperator(speculative_op, Type::Signed32());
   }
-  r.ConvertInputsToNumber();
-  r.ConvertInputsToUI32(kSigned, kSigned);
-  return r.ChangeToPureOperator(int_op, Type::Signed32());
+
+  // If deoptimization is enabled we rely on type feedback.
+  if (r.BothInputsAre(Type::PlainPrimitive()) ||
+      !(flags() & kDeoptimizationEnabled)) {
+    r.ConvertInputsToNumber();
+    r.ConvertInputsToUI32(kSigned, kSigned);
+    return r.ChangeToPureOperator(int_op, Type::Signed32());
+  }
+  return NoChange();
 }
 
 Reduction JSTypedLowering::ReduceUI32Shift(Node* node,

src/compiler/js-typed-lowering.h

@@ -34,7 +34,6 @@ class JSTypedLowering final : public AdvancedReducer {
   enum Flag {
     kNoFlags = 0u,
     kDeoptimizationEnabled = 1u << 0,
-    kDisableIntegerBinaryOpReduction = 1u << 1,
   };
   typedef base::Flags<Flag> Flags;
 

src/compiler/operator-properties.cc

@@ -42,6 +42,11 @@ int OperatorProperties::GetFrameStateInputCount(const Operator* op) {
     case IrOpcode::kJSDivide:
     case IrOpcode::kJSModulus:
 
+    // Bitwise operations
+    case IrOpcode::kJSBitwiseOr:
+    case IrOpcode::kJSBitwiseXor:
+    case IrOpcode::kJSBitwiseAnd:
+
     // Shift operations
     case IrOpcode::kJSShiftLeft:
     case IrOpcode::kJSShiftRight:
@@ -96,14 +101,6 @@ int OperatorProperties::GetFrameStateInputCount(const Operator* op) {
     case IrOpcode::kJSStackCheck:
       return 1;
 
-    // Binary operators that can deopt in the middle the operation (e.g.,
-    // as a result of lazy deopt in ToNumber conversion) need a second frame
-    // state so that we can resume before the operation.
-    case IrOpcode::kJSBitwiseAnd:
-    case IrOpcode::kJSBitwiseOr:
-    case IrOpcode::kJSBitwiseXor:
-      return 2;
-
     default:
       return 0;
   }

src/compiler/pipeline.cc

@@ -909,9 +909,6 @@ struct TypedLoweringPhase {
     if (data->info()->is_deoptimization_enabled()) {
       typed_lowering_flags |= JSTypedLowering::kDeoptimizationEnabled;
     }
-    if (data->info()->is_optimizing_from_bytecode()) {
-      typed_lowering_flags |= JSTypedLowering::kDisableIntegerBinaryOpReduction;
-    }
     JSTypedLowering typed_lowering(&graph_reducer, data->info()->dependencies(),
                                    typed_lowering_flags, data->jsgraph(),
                                    temp_zone);

test/cctest/compiler/test-js-typed-lowering.cc

@@ -1044,7 +1044,8 @@ TEST(Int32BinopEffects) {
   JSBitwiseTypedLoweringTester R;
   for (int j = 0; j < R.kNumberOps; j += 2) {
     bool signed_left = R.signedness[j], signed_right = R.signedness[j + 1];
-    BinopEffectsTester B(R.ops[j], I32Type(signed_left), I32Type(signed_right));
+    BinopEffectsTester B(R.ops[j], I32Type(signed_left), I32Type(signed_right),
+                         JSTypedLowering::kNoFlags);
     CHECK_EQ(R.ops[j + 1]->opcode(), B.result->op()->opcode());
 
     B.R.CheckBinop(B.result->opcode(), B.result);
@@ -1057,7 +1058,8 @@ TEST(Int32BinopEffects) {
 
   for (int j = 0; j < R.kNumberOps; j += 2) {
     bool signed_left = R.signedness[j], signed_right = R.signedness[j + 1];
-    BinopEffectsTester B(R.ops[j], Type::Number(), Type::Number());
+    BinopEffectsTester B(R.ops[j], Type::Number(), Type::Number(),
+                         JSTypedLowering::kNoFlags);
     CHECK_EQ(R.ops[j + 1]->opcode(), B.result->op()->opcode());
 
     B.R.CheckBinop(B.result->opcode(), B.result);
@@ -1070,7 +1072,8 @@ TEST(Int32BinopEffects) {
 
   for (int j = 0; j < R.kNumberOps; j += 2) {
     bool signed_left = R.signedness[j], signed_right = R.signedness[j + 1];
-    BinopEffectsTester B(R.ops[j], Type::Number(), Type::Primitive());
+    BinopEffectsTester B(R.ops[j], Type::Number(), Type::Primitive(),
+                         JSTypedLowering::kNoFlags);
 
     B.R.CheckBinop(B.result->opcode(), B.result);
 
@@ -1087,7 +1090,8 @@ TEST(Int32BinopEffects) {
 
   for (int j = 0; j < R.kNumberOps; j += 2) {
     bool signed_left = R.signedness[j], signed_right = R.signedness[j + 1];
-    BinopEffectsTester B(R.ops[j], Type::Primitive(), Type::Number());
+    BinopEffectsTester B(R.ops[j], Type::Primitive(), Type::Number(),
+                         JSTypedLowering::kNoFlags);
 
     B.R.CheckBinop(B.result->opcode(), B.result);
 
@@ -1104,7 +1108,8 @@ TEST(Int32BinopEffects) {
 
   for (int j = 0; j < R.kNumberOps; j += 2) {
     bool signed_left = R.signedness[j], signed_right = R.signedness[j + 1];
-    BinopEffectsTester B(R.ops[j], Type::Primitive(), Type::Primitive());
+    BinopEffectsTester B(R.ops[j], Type::Primitive(), Type::Primitive(),
+                         JSTypedLowering::kNoFlags);
 
     B.R.CheckBinop(B.result->opcode(), B.result);
 

test/unittests/compiler/js-typed-lowering-unittest.cc

@@ -1019,9 +1019,9 @@ TEST_F(JSTypedLoweringTest, JSBitwiseAndWithTypeFeedback) {
     Node* rhs = Parameter(Type::Number(), 3);
     Node* effect = graph()->start();
     Node* control = graph()->start();
-    Reduction r = Reduce(graph()->NewNode(
-        javascript()->BitwiseAnd(hints), lhs, rhs, UndefinedConstant(),
-        EmptyFrameState(), EmptyFrameState(), effect, control));
+    Reduction r = Reduce(graph()->NewNode(javascript()->BitwiseAnd(hints), lhs,
+                                          rhs, UndefinedConstant(),
+                                          EmptyFrameState(), effect, control));
     ASSERT_TRUE(r.Changed());
     EXPECT_THAT(r.replacement(), IsSpeculativeNumberBitwiseAnd(
                                      feedback, lhs, rhs, effect, control));
@@ -1041,9 +1041,9 @@ TEST_F(JSTypedLoweringTest, JSBitwiseOrWithTypeFeedback) {
     Node* rhs = Parameter(Type::Number(), 3);
     Node* effect = graph()->start();
     Node* control = graph()->start();
-    Reduction r = Reduce(graph()->NewNode(
-        javascript()->BitwiseOr(hints), lhs, rhs, UndefinedConstant(),
-        EmptyFrameState(), EmptyFrameState(), effect, control));
+    Reduction r = Reduce(graph()->NewNode(javascript()->BitwiseOr(hints), lhs,
+                                          rhs, UndefinedConstant(),
+                                          EmptyFrameState(), effect, control));
     ASSERT_TRUE(r.Changed());
     EXPECT_THAT(r.replacement(), IsSpeculativeNumberBitwiseOr(
                                      feedback, lhs, rhs, effect, control));
@@ -1063,9 +1063,9 @@ TEST_F(JSTypedLoweringTest, JSBitwiseXorWithTypeFeedback) {
     Node* rhs = Parameter(Type::Number(), 3);
     Node* effect = graph()->start();
     Node* control = graph()->start();
-    Reduction r = Reduce(graph()->NewNode(
-        javascript()->BitwiseXor(hints), lhs, rhs, UndefinedConstant(),
-        EmptyFrameState(), EmptyFrameState(), effect, control));
+    Reduction r = Reduce(graph()->NewNode(javascript()->BitwiseXor(hints), lhs,
+                                          rhs, UndefinedConstant(),
+                                          EmptyFrameState(), effect, control));
     ASSERT_TRUE(r.Changed());
     EXPECT_THAT(r.replacement(), IsSpeculativeNumberBitwiseXor(
                                      feedback, lhs, rhs, effect, control));