[Turbofan] Make GraphAssembler respect a Reducer context

Here is an alternate fix for chromium:1123379, which addresses a
TODO. A callback is provided to the GraphAssembler when it's working
on an unscheduled graph. In such cases, changed nodes in the main
graph need to be revisited after change. The callback ensures that
the GraphAssembler kicks that process off when necessary.

Bug: chromium:1123379
Change-Id: I9d864c3390fbe670ee450152a67555dcbfa8f581
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2433924
Commit-Queue: Michael Stanton <mvstanton@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70192}

src/compiler/effect-control-linearizer.cc

@@ -45,7 +45,7 @@ class EffectControlLinearizer {
         maintain_schedule_(maintain_schedule),
         source_positions_(source_positions),
         node_origins_(node_origins),
-        graph_assembler_(js_graph, temp_zone,
+        graph_assembler_(js_graph, temp_zone, base::nullopt,
                          should_maintain_schedule() ? schedule : nullptr),
         frame_state_zapper_(nullptr) {}
 

src/compiler/graph-assembler.cc

@@ -329,12 +329,15 @@ BasicBlock* GraphAssembler::BasicBlockUpdater::Finalize(BasicBlock* original) {
   return block;
 }
 
-GraphAssembler::GraphAssembler(MachineGraph* mcgraph, Zone* zone,
+GraphAssembler::GraphAssembler(
+    MachineGraph* mcgraph, Zone* zone,
+    base::Optional<NodeChangedCallback> node_changed_callback,
     Schedule* schedule, bool mark_loop_exits)
     : temp_zone_(zone),
       mcgraph_(mcgraph),
       effect_(nullptr),
       control_(nullptr),
+      node_changed_callback_(node_changed_callback),
       block_updater_(schedule != nullptr
                          ? new BasicBlockUpdater(schedule, mcgraph->graph(),
                                                  mcgraph->common(), zone)
@@ -917,6 +920,9 @@ void GraphAssembler::ConnectUnreachableToEnd() {
   if (!block_updater_) {
     Node* throw_node = graph()->NewNode(common()->Throw(), effect(), control());
     NodeProperties::MergeControlToEnd(graph(), common(), throw_node);
+    if (node_changed_callback_.has_value()) {
+      (*node_changed_callback_)(graph()->end());
+    }
     effect_ = control_ = mcgraph()->Dead();
   }
 }

src/compiler/graph-assembler.h

@@ -184,11 +184,14 @@ class GraphAssemblerLabel {
   const std::array<MachineRepresentation, VarCount> representations_;
 };
 
+using NodeChangedCallback = std::function<void(Node*)>;
 class V8_EXPORT_PRIVATE GraphAssembler {
  public:
   // Constructs a GraphAssembler. If {schedule} is not null, the graph assembler
   // will maintain the schedule as it updates blocks.
-  GraphAssembler(MachineGraph* jsgraph, Zone* zone,
+  GraphAssembler(
+      MachineGraph* jsgraph, Zone* zone,
+      base::Optional<NodeChangedCallback> node_changed_callback = base::nullopt,
       Schedule* schedule = nullptr, bool mark_loop_exits = false);
   virtual ~GraphAssembler();
 
@@ -508,6 +511,9 @@ class V8_EXPORT_PRIVATE GraphAssembler {
   MachineGraph* mcgraph_;
   Node* effect_;
   Node* control_;
+  // {node_changed_callback_} should be called when a node outside the
+  // subgraph created by the graph assembler changes.
+  base::Optional<NodeChangedCallback> node_changed_callback_;
   std::unique_ptr<BasicBlockUpdater> block_updater_;
 
   // Track loop information in order to properly mark loop exits with
@@ -776,9 +782,12 @@ class V8_EXPORT_PRIVATE JSGraphAssembler : public GraphAssembler {
  public:
   // Constructs a JSGraphAssembler. If {schedule} is not null, the graph
   // assembler will maintain the schedule as it updates blocks.
-  JSGraphAssembler(JSGraph* jsgraph, Zone* zone, Schedule* schedule = nullptr,
-                   bool mark_loop_exits = false)
-      : GraphAssembler(jsgraph, zone, schedule, mark_loop_exits),
+  JSGraphAssembler(
+      JSGraph* jsgraph, Zone* zone,
+      base::Optional<NodeChangedCallback> node_changed_callback = base::nullopt,
+      Schedule* schedule = nullptr, bool mark_loop_exits = false)
+      : GraphAssembler(jsgraph, zone, node_changed_callback, schedule,
+                       mark_loop_exits),
         jsgraph_(jsgraph) {}
 
   Node* SmiConstant(int32_t value);

src/compiler/js-call-reducer.h

@@ -64,6 +64,11 @@ class V8_EXPORT_PRIVATE JSCallReducer final : public AdvancedReducer {
   // and does a final attempt to reduce the nodes in the waitlist.
   void Finalize() final;
 
+  // JSCallReducer outsources much work to a graph assembler.
+  void RevisitForGraphAssembler(Node* node) { Revisit(node); }
+  Zone* ZoneForGraphAssembler() const { return temp_zone(); }
+  JSGraph* JSGraphForGraphAssembler() const { return jsgraph(); }
+
  private:
   Reduction ReduceBooleanConstructor(Node* node);
   Reduction ReduceCallApiFunction(Node* node,

src/compiler/scheduled-machine-lowering.cc

@@ -19,7 +19,7 @@ ScheduledMachineLowering::ScheduledMachineLowering(
     SourcePositionTable* source_positions, NodeOriginTable* node_origins,
     PoisoningMitigationLevel poison_level)
     : schedule_(schedule),
-      graph_assembler_(js_graph, temp_zone, schedule),
+      graph_assembler_(js_graph, temp_zone, base::nullopt, schedule),
       select_lowering_(&graph_assembler_, js_graph->graph()),
       memory_lowering_(js_graph, temp_zone, &graph_assembler_, poison_level),
       reducers_({&select_lowering_, &memory_lowering_}, temp_zone),