[compiler] Add back EarlyGraphTrimming.

Trimming is required before the Typer phase to ensure that all nodes
that might be reached via use links have been typed.

Add this phase back on the (background thread) OptimizeGraph
step instead of the (main-thread) CreateGraph phase since there
is no need to do it on the main thread.

BUG=chromium:1212244

Change-Id: I136aadb62d623c8f1898e4e9c0441266d5690be6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2912709Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74733}

src/compiler/pipeline.cc

@@ -1450,6 +1450,18 @@ struct WasmInliningPhase {
 };
 #endif  // V8_ENABLE_WEBASSEMBLY
 
+struct EarlyGraphTrimmingPhase {
+  DECL_PIPELINE_PHASE_CONSTANTS(EarlyGraphTrimming)
+
+  void Run(PipelineData* data, Zone* temp_zone) {
+    GraphTrimmer trimmer(temp_zone, data->graph());
+    NodeVector roots(temp_zone);
+    data->jsgraph()->GetCachedNodes(&roots);
+    UnparkedScopeIfNeeded scope(data->broker(), FLAG_trace_turbo_trimming);
+    trimmer.TrimGraph(roots.begin(), roots.end());
+  }
+};
+
 struct TyperPhase {
   DECL_PIPELINE_PHASE_CONSTANTS(Typer)
 
@@ -2649,6 +2661,10 @@ bool PipelineImpl::OptimizeGraph(Linkage* linkage) {
 
   data->BeginPhaseKind("V8.TFLowering");
 
+  // Trim the graph before typing to ensure all nodes are typed.
+  Run<EarlyGraphTrimmingPhase>();
+  RunPrintAndVerify(EarlyGraphTrimmingPhase::phase_name(), true);
+
   // Type the graph and keep the Typer running such that new nodes get
   // automatically typed when they are created.
   Run<TyperPhase>(data->CreateTyper());

src/logging/runtime-call-stats.h

@@ -333,6 +333,7 @@ class RuntimeCallTimer final {
   ADD_THREAD_SPECIFIC_COUNTER(V, Optimize, CSAOptimization)                 \
   ADD_THREAD_SPECIFIC_COUNTER(V, Optimize, DecideSpillingMode)              \
   ADD_THREAD_SPECIFIC_COUNTER(V, Optimize, DecompressionOptimization)       \
+  ADD_THREAD_SPECIFIC_COUNTER(V, Optimize, EarlyGraphTrimming)              \
   ADD_THREAD_SPECIFIC_COUNTER(V, Optimize, EarlyOptimization)               \
   ADD_THREAD_SPECIFIC_COUNTER(V, Optimize, EffectLinearization)             \
   ADD_THREAD_SPECIFIC_COUNTER(V, Optimize, EscapeAnalysis)                  \

test/mjsunit/regress/regress-1212244.js

+// Copyright 2021 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --no-turbo-loop-peeling
+
+function foo(base) {
+  class klass extends base {
+    constructor() {
+      try {
+        undefined();
+      } catch (e) {}
+        super();
+        this.d = 4.2;
+        this.o = {};
+    }
+  }
+  var __v_58 = new klass();
+  var __v_59 = new klass();
+}
+
+%PrepareFunctionForOptimization(foo);
+foo(Uint8Array);
+foo(Uint8ClampedArray);
+foo(Int16Array);
+foo(Uint16Array);
+foo(Int32Array);
+foo(Uint32Array);
+%OptimizeFunctionOnNextCall(foo);
+assertThrows(foo);