[turbofan] Properly connect DeoptimizeIf/Unless to effect chain.

The DeoptimizeIf and DeoptimizeUnless operators should actually produce
an effect in addition to the control output.

R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2002253003
Cr-Commit-Position: refs/heads/master@{#36477}

src/compiler/branch-elimination.cc

@@ -99,17 +99,17 @@ Reduction BranchElimination::ReduceDeoptimizeConditional(Node* node) {
   if (condition_value.IsJust()) {
     // If we know the condition we can discard the branch.
     if (condition_is_true == condition_value.FromJust()) {
-      // We don't to update the conditions here, because we're replacing with
-      // the {control} node that already contains the right information.
-      return Replace(control);
+      // We don't update the conditions here, because we're replacing {node}
+      // with the {control} node that already contains the right information.
+      ReplaceWithValue(node, dead(), effect, control);
     } else {
       control = graph()->NewNode(common()->Deoptimize(DeoptimizeKind::kEager),
                                  frame_state, effect, control);
       // TODO(bmeurer): This should be on the AdvancedReducer somehow.
       NodeProperties::MergeControlToEnd(graph(), common(), control);
       Revisit(graph()->end());
-      return Replace(dead());
     }
+    return Replace(dead());
   }
   return UpdateConditions(
       node, conditions->AddCondition(zone_, condition, condition_is_true));

src/compiler/common-operator-reducer.cc

@@ -142,13 +142,14 @@ Reduction CommonOperatorReducer::ReduceDeoptimizeConditional(Node* node) {
   Decision const decision = DecideCondition(condition);
   if (decision == Decision::kUnknown) return NoChange();
   if (condition_is_true == (decision == Decision::kTrue)) {
-    return Replace(control);
-  }
+    ReplaceWithValue(node, dead(), effect, control);
+  } else {
     control = graph()->NewNode(common()->Deoptimize(DeoptimizeKind::kEager),
                                frame_state, effect, control);
     // TODO(bmeurer): This should be on the AdvancedReducer somehow.
     NodeProperties::MergeControlToEnd(graph(), common(), control);
     Revisit(graph()->end());
+  }
   return Replace(dead());
 }
 

src/compiler/common-operator.cc

@@ -169,8 +169,8 @@ std::ostream& operator<<(std::ostream& os,
 
 #define CACHED_OP_LIST(V)                                    \
   V(Dead, Operator::kFoldable, 0, 0, 0, 1, 1, 1)             \
-  V(DeoptimizeIf, Operator::kFoldable, 2, 1, 1, 0, 0, 1)     \
-  V(DeoptimizeUnless, Operator::kFoldable, 2, 1, 1, 0, 0, 1) \
+  V(DeoptimizeIf, Operator::kFoldable, 2, 1, 1, 0, 1, 1)     \
+  V(DeoptimizeUnless, Operator::kFoldable, 2, 1, 1, 0, 1, 1) \
   V(IfTrue, Operator::kKontrol, 0, 0, 1, 0, 0, 1)            \
   V(IfFalse, Operator::kKontrol, 0, 0, 1, 0, 0, 1)           \
   V(IfSuccess, Operator::kKontrol, 0, 0, 1, 0, 0, 1)         \

src/compiler/js-call-reducer.cc

@@ -328,8 +328,8 @@ Reduction JSCallReducer::ReduceJSCallFunction(Node* node) {
     // Check that the {target} is still the {array_function}.
     Node* check = graph()->NewNode(javascript()->StrictEqual(), target,
                                    array_function, context);
-    control = graph()->NewNode(common()->DeoptimizeUnless(), check, frame_state,
-                               effect, control);
+    control = effect = graph()->NewNode(common()->DeoptimizeUnless(), check,
+                                        frame_state, effect, control);
 
     // Turn the {node} into a {JSCreateArray} call.
     NodeProperties::ReplaceValueInput(node, array_function, 0);
@@ -345,11 +345,12 @@ Reduction JSCallReducer::ReduceJSCallFunction(Node* node) {
       // Check that the {target} is still the {target_function}.
       Node* check = graph()->NewNode(javascript()->StrictEqual(), target,
                                      target_function, context);
-      control = graph()->NewNode(common()->DeoptimizeUnless(), check,
+      control = effect = graph()->NewNode(common()->DeoptimizeUnless(), check,
                                           frame_state, effect, control);
 
       // Specialize the JSCallFunction node to the {target_function}.
       NodeProperties::ReplaceValueInput(node, target_function, 0);
+      NodeProperties::ReplaceEffectInput(node, effect);
       NodeProperties::ReplaceControlInput(node, control);
 
       // Try to further reduce the JSCallFunction {node}.
@@ -453,8 +454,8 @@ Reduction JSCallReducer::ReduceJSCallConstruct(Node* node) {
     // Check that the {target} is still the {array_function}.
     Node* check = graph()->NewNode(javascript()->StrictEqual(), target,
                                    array_function, context);
-    control = graph()->NewNode(common()->DeoptimizeUnless(), check, frame_state,
-                               effect, control);
+    control = effect = graph()->NewNode(common()->DeoptimizeUnless(), check,
+                                        frame_state, effect, control);
 
     // Turn the {node} into a {JSCreateArray} call.
     NodeProperties::ReplaceEffectInput(node, effect);
@@ -476,7 +477,7 @@ Reduction JSCallReducer::ReduceJSCallConstruct(Node* node) {
       // Check that the {target} is still the {target_function}.
       Node* check = graph()->NewNode(javascript()->StrictEqual(), target,
                                      target_function, context);
-      control = graph()->NewNode(common()->DeoptimizeUnless(), check,
+      control = effect = graph()->NewNode(common()->DeoptimizeUnless(), check,
                                           frame_state, effect, control);
 
       // Specialize the JSCallConstruct node to the {target_function}.

src/compiler/js-global-object-specialization.cc

@@ -173,7 +173,7 @@ Reduction JSGlobalObjectSpecialization::ReduceJSStoreGlobal(Node* node) {
       Node* check =
           graph()->NewNode(simplified()->ReferenceEqual(Type::Tagged()), value,
                            jsgraph()->Constant(property_cell_value));
-      control = graph()->NewNode(common()->DeoptimizeUnless(), check,
+      control = effect = graph()->NewNode(common()->DeoptimizeUnless(), check,
                                           frame_state, effect, control);
       break;
     }
@@ -185,8 +185,8 @@ Reduction JSGlobalObjectSpecialization::ReduceJSStoreGlobal(Node* node) {
       Type* property_cell_value_type = Type::TaggedSigned();
       if (property_cell_value->IsHeapObject()) {
         // Deoptimize if the {value} is a Smi.
-        control = graph()->NewNode(common()->DeoptimizeIf(), check, frame_state,
-                                   effect, control);
+        control = effect = graph()->NewNode(common()->DeoptimizeIf(), check,
+                                            frame_state, effect, control);
 
         // Load the {value} map check against the {property_cell} map.
         Node* value_map = effect =
@@ -199,7 +199,7 @@ Reduction JSGlobalObjectSpecialization::ReduceJSStoreGlobal(Node* node) {
             jsgraph()->HeapConstant(property_cell_value_map));
         property_cell_value_type = Type::TaggedPointer();
       }
-      control = graph()->NewNode(common()->DeoptimizeUnless(), check,
+      control = effect = graph()->NewNode(common()->DeoptimizeUnless(), check,
                                           frame_state, effect, control);
       effect = graph()->NewNode(
           simplified()->StoreField(

src/compiler/memory-optimizer.cc

@@ -87,6 +87,8 @@ void MemoryOptimizer::VisitNode(Node* node, AllocationState const* state) {
       return VisitStoreField(node, state);
     case IrOpcode::kCheckedLoad:
     case IrOpcode::kCheckedStore:
+    case IrOpcode::kDeoptimizeIf:
+    case IrOpcode::kDeoptimizeUnless:
     case IrOpcode::kIfException:
     case IrOpcode::kLoad:
     case IrOpcode::kStore: