Improve check elimination with branch sensitivity on HCompareObjectEqAndBranch.

BUG=
R=mvstanton@chromium.org

Review URL: https://codereview.chromium.org/106733002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18377 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

src/hydrogen-check-elimination.cc

@@ -127,9 +127,14 @@ class HCheckTable : public ZoneObject {
       new_entry->check_ = NULL;
       new_entry->maps_ = old_entry->maps_->Copy(phase_->zone());
     }
-    if (succ->predecessors()->length() == 1) {
-      HControlInstruction* end = succ->predecessors()->at(0)->end();
-      if (end->IsCompareMap() && end->SuccessorAt(0) == succ) {
+    copy->cursor_ = cursor_;
+    copy->size_ = size_;
+
+    // Branch-sensitive analysis for certain comparisons may add more facts
+    // to the state for the successor on the true branch.
+    HControlInstruction* end = succ->predecessors()->at(0)->end();
+    if (succ->predecessors()->length() == 1 && end->SuccessorAt(0) == succ) {
+      if (end->IsCompareMap()) {
         // Learn on the true branch of if(CompareMap(x)).
         HCompareMap* cmp = HCompareMap::cast(end);
         HValue* object = cmp->value()->ActualValue();
@@ -141,9 +146,29 @@ class HCheckTable : public ZoneObject {
           list->Add(cmp->map(), phase_->zone());
           entry->maps_ = list;
         }
+      } else if (end->IsCompareObjectEqAndBranch()) {
+        // Learn on the true branch of if(CmpObjectEq(x, y)).
+        HCompareObjectEqAndBranch* cmp =
+          HCompareObjectEqAndBranch::cast(end);
+        HValue* left = cmp->left()->ActualValue();
+        HValue* right = cmp->right()->ActualValue();
+        HCheckTableEntry* le = copy->Find(left);
+        HCheckTableEntry* re = copy->Find(right);
+        if (le == NULL) {
+          if (re != NULL) {
+            copy->Insert(left, NULL, re->maps_->Copy(zone));
+          }
+        } else if (re == NULL) {
+          copy->Insert(right, NULL, le->maps_->Copy(zone));
+        } else {
+          MapSet intersect = le->maps_->Intersect(re->maps_, zone);
+          le->maps_ = intersect;
+          re->maps_ = intersect->Copy(zone);
+        }
       }
-      // TODO(titzer): is it worthwhile to learn on false branch too?
+      // Learning on false branches requires storing negative facts.
     }
+
     return copy;
   }
 

src/unique.h

@@ -278,7 +278,7 @@ class UniqueSet V8_FINAL : public ZoneObject {
     return out;
   }
 
-  // Makes an exact copy of this set. O(|this| + |that|).
+  // Makes an exact copy of this set. O(|this|).
   UniqueSet<T>* Copy(Zone* zone) const {
     UniqueSet<T>* copy = new(zone) UniqueSet<T>();
     copy->size_ = this->size_;

test/mjsunit/compiler/compare_objeq_elim.js

+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax --check-elimination
+
+function A(x, y) {
+  this.x = x;
+  this.y = y;
+}
+
+function B(x, y) {
+  this.x = x;
+  this.y = y;
+}
+
+function F1(a, b) {
+  if (a == b) return a.x;
+  else return b.x;
+}
+
+function F2(a, b) {
+  if (a == b) return a.x;
+  else return b.x;
+}
+
+function F3(a, b) {
+  var f = a.y;
+  if (a == b) return a.x;
+  else return b.x;
+}
+
+function F4(a, b) {
+  var f = b.y;
+  if (a == b) return a.x;
+  else return b.x;
+}
+
+%NeverOptimizeFunction(test);
+
+function test(f, a, b) {
+  f(a, a);
+  f(a, b);
+  f(b, a);
+  f(b, c);
+  f(b, b);
+  f(c, c);
+
+  %OptimizeFunctionOnNextCall(f)
+
+  assertEquals(a.x, f(a, a));
+  assertEquals(b.x, f(b, b));
+}
+
+var a = new A(3, 5);
+var b = new B(2, 6);
+var c = new A(1, 7);
+
+test(F1, a, c);
+test(F2, a, b);
+test(F3, a, b);
+test(F4, a, b);