[turbofan] Kill type Guard nodes during effect/control linearization.

These guards are useless anyways once you make it throw the
effect/control linearizer because all memory operations and
calls are connected to the control and/or effect chain anyways
afterwards.

Drive-by-fix: Fail in the InstructionSelector if we ever see
a Guard node.

R=jarin@chromium.org
BUG=chromium:612142

Review-Url: https://codereview.chromium.org/1980383002
Cr-Commit-Position: refs/heads/master@{#36302}

src/compiler/effect-control-linearizer.cc

@@ -351,6 +351,9 @@ bool EffectControlLinearizer::TryWireInStateEffect(Node* node, Node** effect,
                                                    Node** control) {
   ValueEffectControl state(nullptr, nullptr, nullptr);
   switch (node->opcode()) {
+    case IrOpcode::kGuard:
+      state = LowerGuard(node, *effect, *control);
+      break;
     case IrOpcode::kChangeBitToTagged:
       state = LowerChangeBitToTagged(node, *effect, *control);
       break;
@@ -411,6 +414,12 @@ bool EffectControlLinearizer::TryWireInStateEffect(Node* node, Node** effect,
   return true;
 }
 
+EffectControlLinearizer::ValueEffectControl EffectControlLinearizer::LowerGuard(
+    Node* node, Node* effect, Node* control) {
+  Node* value = node->InputAt(0);
+  return ValueEffectControl(value, effect, control);
+}
+
 EffectControlLinearizer::ValueEffectControl
 EffectControlLinearizer::LowerChangeFloat64ToTagged(Node* node, Node* effect,
                                                     Node* control) {

src/compiler/effect-control-linearizer.h

@@ -41,6 +41,7 @@ class EffectControlLinearizer {
   };
 
   bool TryWireInStateEffect(Node* node, Node** effect, Node** control);
+  ValueEffectControl LowerGuard(Node* node, Node* effect, Node* control);
   ValueEffectControl LowerChangeBitToTagged(Node* node, Node* effect,
                                             Node* control);
   ValueEffectControl LowerChangeInt31ToTaggedSigned(Node* node, Node* effect,

src/compiler/instruction-selector.cc

@@ -858,8 +858,6 @@ void InstructionSelector::VisitNode(Node* node) {
       return MarkAsReference(node), VisitIfException(node);
     case IrOpcode::kFinishRegion:
       return MarkAsReference(node), VisitFinishRegion(node);
-    case IrOpcode::kGuard:
-      return MarkAsReference(node), VisitGuard(node);
     case IrOpcode::kParameter: {
       MachineType type =
           linkage()->GetParameterType(ParameterIndexOf(node->op()));
@@ -1444,13 +1442,6 @@ void InstructionSelector::VisitFinishRegion(Node* node) {
 }
 
 
-void InstructionSelector::VisitGuard(Node* node) {
-  OperandGenerator g(this);
-  Node* value = node->InputAt(0);
-  Emit(kArchNop, g.DefineSameAsFirst(node), g.Use(value));
-}
-
-
 void InstructionSelector::VisitParameter(Node* node) {
   OperandGenerator g(this);
   int index = ParameterIndexOf(node->op());

src/compiler/instruction-selector.h

@@ -247,7 +247,6 @@ class InstructionSelector final {
 #undef DECLARE_GENERATOR
 
   void VisitFinishRegion(Node* node);
-  void VisitGuard(Node* node);
   void VisitParameter(Node* node);
   void VisitIfException(Node* node);
   void VisitOsrValue(Node* node);

test/mjsunit/regress/regress-crbug-612142.js

+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var thrower = {[Symbol.toPrimitive]: function(e) { throw e }};
+try {
+  for (var i = 0; i < 10; i++) { }
+  for (var i = 0.5; i < 100000; ++i) { }
+  for (var i = 16 | 0 || 0 || this || 1; i;) { String.fromCharCode(thrower); }
+} catch (e) { }