[turbofan] Fix RedundancyElimination and add more test coverage.

Make the RedundancyElimination handle all simplified operators that are
listed in the SIMPLIFIED_CHECKED_OP_LIST, and fix a couple of bugs and
oversights in the code. This also adds a lot of test coverage for all
the cases that we care about in RedundancyElimination (with respect to
Check/Checked simplified operators).

Bug: v8:8015
Change-Id: I57d29113389841b09abcd013313bf5dd1c67735f
Reviewed-on: https://chromium-review.googlesource.com/1233655Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#56032}

src/compiler/redundancy-elimination.cc

@@ -32,23 +32,9 @@ Reduction RedundancyElimination::Reduce(Node* node) {
     case IrOpcode::kCheckSmi:
     case IrOpcode::kCheckString:
     case IrOpcode::kCheckSymbol:
-    case IrOpcode::kCheckedFloat64ToInt32:
-    case IrOpcode::kCheckedInt32Add:
-    case IrOpcode::kCheckedInt32Div:
-    case IrOpcode::kCheckedInt32Mod:
-    case IrOpcode::kCheckedInt32Mul:
-    case IrOpcode::kCheckedInt32Sub:
-    case IrOpcode::kCheckedInt32ToTaggedSigned:
-    case IrOpcode::kCheckedTaggedSignedToInt32:
-    case IrOpcode::kCheckedTaggedToFloat64:
-    case IrOpcode::kCheckedTaggedToInt32:
-    case IrOpcode::kCheckedTaggedToTaggedPointer:
-    case IrOpcode::kCheckedTaggedToTaggedSigned:
-    case IrOpcode::kCheckedTruncateTaggedToWord32:
-    case IrOpcode::kCheckedUint32Div:
-    case IrOpcode::kCheckedUint32Mod:
-    case IrOpcode::kCheckedUint32ToInt32:
-    case IrOpcode::kCheckedUint32ToTaggedSigned:
+#define SIMPLIFIED_CHECKED_OP(Opcode) case IrOpcode::k##Opcode:
+      SIMPLIFIED_CHECKED_OP_LIST(SIMPLIFIED_CHECKED_OP)
+#undef SIMPLIFIED_CHECKED_OP
       return ReduceCheckNode(node);
     case IrOpcode::kSpeculativeNumberAdd:
     case IrOpcode::kSpeculativeNumberSubtract:
@@ -140,6 +126,12 @@ bool CheckSubsumes(Node const* a, Node const* b) {
     if (a->opcode() == IrOpcode::kCheckInternalizedString &&
         b->opcode() == IrOpcode::kCheckString) {
       // CheckInternalizedString(node) implies CheckString(node)
+    } else if (a->opcode() == IrOpcode::kCheckSmi &&
+               b->opcode() == IrOpcode::kCheckNumber) {
+      // CheckSmi(node) implies CheckNumber(node)
+    } else if (a->opcode() == IrOpcode::kCheckedTaggedSignedToInt32 &&
+               b->opcode() == IrOpcode::kCheckedTaggedToInt32) {
+      // CheckedTaggedSignedToInt32(node) implies CheckedTaggedToInt32(node)
     } else if (a->opcode() != b->opcode()) {
       return false;
     } else {
@@ -150,11 +142,15 @@ bool CheckSubsumes(Node const* a, Node const* b) {
         case IrOpcode::kCheckNumber:
           break;
         case IrOpcode::kCheckedInt32ToTaggedSigned:
+        case IrOpcode::kCheckedInt64ToInt32:
+        case IrOpcode::kCheckedInt64ToTaggedSigned:
         case IrOpcode::kCheckedTaggedSignedToInt32:
         case IrOpcode::kCheckedTaggedToTaggedPointer:
         case IrOpcode::kCheckedTaggedToTaggedSigned:
         case IrOpcode::kCheckedUint32ToInt32:
         case IrOpcode::kCheckedUint32ToTaggedSigned:
+        case IrOpcode::kCheckedUint64ToInt32:
+        case IrOpcode::kCheckedUint64ToTaggedSigned:
           break;
         case IrOpcode::kCheckedFloat64ToInt32:
         case IrOpcode::kCheckedTaggedToInt32: {
@@ -167,6 +163,20 @@ bool CheckSubsumes(Node const* a, Node const* b) {
           }
           break;
         }
+        case IrOpcode::kCheckedTaggedToFloat64:
+        case IrOpcode::kCheckedTruncateTaggedToWord32: {
+          CheckTaggedInputParameters const& ap =
+              CheckTaggedInputParametersOf(a->op());
+          CheckTaggedInputParameters const& bp =
+              CheckTaggedInputParametersOf(b->op());
+          // {a} subsumes {b} if the modes are either the same, or {a} checks
+          // for Number, in which case {b} will be subsumed no matter what.
+          if (ap.mode() != bp.mode() &&
+              ap.mode() != CheckTaggedInputMode::kNumber) {
+            return false;
+          }
+          break;
+        }
         default:
           DCHECK(!IsCheckedWithFeedback(a->op()));
           return false;

src/compiler/redundancy-elimination.h

@@ -11,7 +11,7 @@ namespace v8 {
 namespace internal {
 namespace compiler {
 
-class RedundancyElimination final : public AdvancedReducer {
+class V8_EXPORT_PRIVATE RedundancyElimination final : public AdvancedReducer {
  public:
   RedundancyElimination(Editor* editor, Zone* zone);
   ~RedundancyElimination() final;

src/compiler/simplified-operator.h

@@ -228,7 +228,7 @@ enum class CheckTaggedInputMode : uint8_t {
 
 size_t hash_value(CheckTaggedInputMode);
 
-std::ostream& operator<<(std::ostream&, CheckTaggedInputMode);
+V8_EXPORT_PRIVATE std::ostream& operator<<(std::ostream&, CheckTaggedInputMode);
 
 class CheckTaggedInputParameters {
  public:

src/vector-slot-pair.h

@@ -40,7 +40,8 @@ class V8_EXPORT_PRIVATE VectorSlotPair {
 bool operator==(VectorSlotPair const&, VectorSlotPair const&);
 bool operator!=(VectorSlotPair const&, VectorSlotPair const&);
 
-std::ostream& operator<<(std::ostream& os, VectorSlotPair const&);
+V8_EXPORT_PRIVATE std::ostream& operator<<(std::ostream& os,
+                                           VectorSlotPair const&);
 
 size_t hash_value(VectorSlotPair const&);
 

test/unittests/BUILD.gn

@@ -131,6 +131,7 @@ v8_source_set("unittests_sources") {
     "compiler/node-unittest.cc",
     "compiler/opcodes-unittest.cc",
     "compiler/persistent-unittest.cc",
+    "compiler/redundancy-elimination-unittest.cc",
     "compiler/regalloc/live-range-unittest.cc",
     "compiler/regalloc/move-optimizer-unittest.cc",
     "compiler/regalloc/register-allocator-unittest.cc",