[turbofan] Remove frame state input from speculative ops.

These speculative binary operators are simplified operators and should
not need a frame state themselves. These eager bailout points can by now
be found via checkpoints in the graph, whereas frame states attached to
nodes directly should always represent lazy bailout points.

R=jarin@chromium.org
BUG=v8:5021

Review-Url: https://codereview.chromium.org/2037673002
Cr-Commit-Position: refs/heads/master@{#36705}

src/compiler/js-typed-lowering.cc

@@ -131,7 +131,7 @@ class JSBinopReduction final {
     DCHECK_EQ(false, OperatorProperties::HasContextInput(op));
     DCHECK_EQ(1, op->ControlInputCount());
     DCHECK_EQ(1, op->ControlOutputCount());
-    DCHECK_EQ(1, OperatorProperties::GetFrameStateInputCount(op));
+    DCHECK_EQ(0, OperatorProperties::GetFrameStateInputCount(op));
     DCHECK_EQ(2, op->ValueInputCount());
 
     DCHECK_EQ(1, node_->op()->EffectInputCount());
@@ -157,7 +157,8 @@ class JSBinopReduction final {
       }
     }
 
-    // Remove the lazy bailout frame state and the context.
+    // Remove both bailout frame states and the context.
+    node_->RemoveInput(NodeProperties::FirstFrameStateIndex(node_) + 1);
     node_->RemoveInput(NodeProperties::FirstFrameStateIndex(node_));
     node_->RemoveInput(NodeProperties::FirstContextIndex(node_));
 

src/compiler/operator-properties.cc

@@ -80,11 +80,6 @@ int OperatorProperties::GetFrameStateInputCount(const Operator* op) {
     case IrOpcode::kJSStackCheck:
       return 1;
 
-    // We record the frame state immediately before and immediately after
-    // every property or global variable access.
-
-      return 2;
-
     // Binary operators that can deopt in the middle the operation (e.g.,
     // as a result of lazy deopt in ToNumber conversion) need a second frame
     // state so that we can resume before the operation.
@@ -110,9 +105,6 @@ int OperatorProperties::GetFrameStateInputCount(const Operator* op) {
     case IrOpcode::kJSLessThanOrEqual:
       return 2;
 
-    // Simplified operators with type feedback.
-    case IrOpcode::kSpeculativeNumberAdd:
-    case IrOpcode::kSpeculativeNumberSubtract:
     // Checked conversions.
     case IrOpcode::kCheckedUint32ToInt32:
     case IrOpcode::kCheckedFloat64ToInt32:

src/compiler/representation-change.cc

@@ -451,7 +451,7 @@ Node* RepresentationChanger::InsertConversion(Node* node, const Operator* op,
     // and also provide it with a frame state.
     Node* effect = NodeProperties::GetEffectInput(use_node);
     Node* control = NodeProperties::GetControlInput(use_node);
-    Node* frame_state = NodeProperties::GetFrameStateInput(use_node, 0);
+    Node* frame_state = NodeProperties::FindFrameStateBefore(use_node);
     Node* conversion =
         jsgraph()->graph()->NewNode(op, node, frame_state, effect, control);
     NodeProperties::ReplaceControlInput(use_node, control);

src/compiler/simplified-lowering.cc

@@ -1033,9 +1033,9 @@ class RepresentationSelector {
   }
 
   void ChangeToInt32OverflowOp(Node* node, const Operator* op) {
-    Node* frame_state = NodeProperties::GetFrameStateInput(node, 0);
     Node* effect = NodeProperties::GetEffectInput(node);
     Node* control = NodeProperties::GetControlInput(node);
+    Node* frame_state = NodeProperties::FindFrameStateBefore(node);
     Node* arith = graph()->NewNode(op, node->InputAt(0), node->InputAt(1));
     Node* overflow = graph()->NewNode(common()->Projection(1), arith);
     control = effect = graph()->NewNode(common()->DeoptimizeIf(), overflow,

test/unittests/compiler/js-typed-lowering-unittest.cc

@@ -858,7 +858,7 @@ TEST_F(JSTypedLoweringTest, JSAddSmis) {
     ASSERT_TRUE(r.Changed());
     EXPECT_THAT(r.replacement(),
                 IsSpeculativeNumberAdd(BinaryOperationHints::kSignedSmall, lhs,
-                                       rhs, frame_state1, effect, control));
+                                       rhs, effect, control));
   }
 }
 
@@ -881,9 +881,9 @@ TEST_F(JSTypedLoweringTest, JSSubtractSmis) {
                                           rhs, context, frame_state0,
                                           frame_state1, effect, control));
     ASSERT_TRUE(r.Changed());
-    EXPECT_THAT(r.replacement(), IsSpeculativeNumberSubtract(
-                                     BinaryOperationHints::kSignedSmall, lhs,
-                                     rhs, frame_state1, effect, control));
+    EXPECT_THAT(r.replacement(),
+                IsSpeculativeNumberSubtract(BinaryOperationHints::kSignedSmall,
+                                            lhs, rhs, effect, control));
   }
 }
 

test/unittests/compiler/node-test-utils.cc

@@ -806,13 +806,11 @@ class IsSpeculativeBinopMatcher final : public NodeMatcher {
       IrOpcode::Value opcode,
       const Matcher<BinaryOperationHints::Hint>& hint_matcher,
       const Matcher<Node*>& lhs_matcher, const Matcher<Node*>& rhs_matcher,
-      const Matcher<Node*>& frame_state_matcher,
       const Matcher<Node*>& effect_matcher,
       const Matcher<Node*>& control_matcher)
       : NodeMatcher(opcode),
         lhs_matcher_(lhs_matcher),
         rhs_matcher_(rhs_matcher),
-        frame_state_matcher_(frame_state_matcher),
         effect_matcher_(effect_matcher),
         control_matcher_(control_matcher) {}
 
@@ -823,9 +821,6 @@ class IsSpeculativeBinopMatcher final : public NodeMatcher {
                                  lhs_matcher_, listener) &&
             PrintMatchAndExplain(NodeProperties::GetValueInput(node, 1), "rhs",
                                  rhs_matcher_, listener) &&
-            PrintMatchAndExplain(NodeProperties::GetFrameStateInput(node, 0),
-                                 "frame state", frame_state_matcher_,
-                                 listener) &&
             PrintMatchAndExplain(NodeProperties::GetEffectInput(node), "effect",
                                  effect_matcher_, listener) &&
             PrintMatchAndExplain(NodeProperties::GetControlInput(node),
@@ -836,7 +831,6 @@ class IsSpeculativeBinopMatcher final : public NodeMatcher {
   const Matcher<Type*> type_matcher_;
   const Matcher<Node*> lhs_matcher_;
   const Matcher<Node*> rhs_matcher_;
-  const Matcher<Node*> frame_state_matcher_;
   const Matcher<Node*> effect_matcher_;
   const Matcher<Node*> control_matcher_;
 };
@@ -2072,23 +2066,21 @@ Matcher<Node*> IsReferenceEqual(const Matcher<Type*>& type_matcher,
 Matcher<Node*> IsSpeculativeNumberAdd(
     const Matcher<BinaryOperationHints::Hint>& hint_matcher,
     const Matcher<Node*>& lhs_matcher, const Matcher<Node*>& rhs_matcher,
-    const Matcher<Node*>& frame_state_matcher,
     const Matcher<Node*>& effect_matcher,
     const Matcher<Node*>& control_matcher) {
   return MakeMatcher(new IsSpeculativeBinopMatcher(
       IrOpcode::kSpeculativeNumberAdd, hint_matcher, lhs_matcher, rhs_matcher,
-      frame_state_matcher, effect_matcher, control_matcher));
+      effect_matcher, control_matcher));
 }
 
 Matcher<Node*> IsSpeculativeNumberSubtract(
     const Matcher<BinaryOperationHints::Hint>& hint_matcher,
     const Matcher<Node*>& lhs_matcher, const Matcher<Node*>& rhs_matcher,
-    const Matcher<Node*>& frame_state_matcher,
     const Matcher<Node*>& effect_matcher,
     const Matcher<Node*>& control_matcher) {
   return MakeMatcher(new IsSpeculativeBinopMatcher(
       IrOpcode::kSpeculativeNumberSubtract, hint_matcher, lhs_matcher,
-      rhs_matcher, frame_state_matcher, effect_matcher, control_matcher));
+      rhs_matcher, effect_matcher, control_matcher));
 }
 
 Matcher<Node*> IsAllocate(const Matcher<Node*>& size_matcher,

test/unittests/compiler/node-test-utils.h

@@ -205,13 +205,11 @@ Matcher<Node*> IsNumberAdd(const Matcher<Node*>& lhs_matcher,
 Matcher<Node*> IsSpeculativeNumberAdd(
     const Matcher<BinaryOperationHints::Hint>& hint_matcher,
     const Matcher<Node*>& lhs_matcher, const Matcher<Node*>& rhs_matcher,
-    const Matcher<Node*>& frame_state_matcher,
     const Matcher<Node*>& effect_matcher,
     const Matcher<Node*>& control_matcher);
 Matcher<Node*> IsSpeculativeNumberSubtract(
     const Matcher<BinaryOperationHints::Hint>& hint_matcher,
     const Matcher<Node*>& lhs_matcher, const Matcher<Node*>& rhs_matcher,
-    const Matcher<Node*>& frame_state_matcher,
     const Matcher<Node*>& effect_matcher,
     const Matcher<Node*>& control_matcher);
 Matcher<Node*> IsNumberSubtract(const Matcher<Node*>& lhs_matcher,