[TurboFan] Add CheckElimination reducer to InliningPhase

Adds a CheckElimination reducer to eliminate checks which have become
unecessary due to inlining of heap constants.

BUG=v8:6243, chromium:738312

Change-Id: Ie50b274bd07c86466eead08b2f21d2b63dd9e01c
Reviewed-on: https://chromium-review.googlesource.com/559129
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46460}

BUILD.gn

@@ -1276,6 +1276,8 @@ v8_source_set("v8_base") {
     "src/compiler/bytecode-liveness-map.cc",
     "src/compiler/bytecode-liveness-map.h",
     "src/compiler/c-linkage.cc",
+    "src/compiler/check-elimination.cc",
+    "src/compiler/check-elimination.h",
     "src/compiler/checkpoint-elimination.cc",
     "src/compiler/checkpoint-elimination.h",
     "src/compiler/code-assembler.cc",

src/compiler/check-elimination.cc

+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "src/compiler/check-elimination.h"
+
+#include "src/compiler/js-graph.h"
+#include "src/compiler/node-matchers.h"
+#include "src/compiler/node-properties.h"
+#include "src/objects-inl.h"
+#include "src/objects.h"
+
+namespace v8 {
+namespace internal {
+namespace compiler {
+
+Reduction CheckElimination::Reduce(Node* node) {
+  switch (node->opcode()) {
+    case IrOpcode::kCheckHeapObject:
+      return ReduceCheckHeapObject(node);
+    case IrOpcode::kCheckString:
+      return ReduceCheckString(node);
+    case IrOpcode::kCheckSeqString:
+      return ReduceCheckSeqString(node);
+    case IrOpcode::kCheckNonEmptyString:
+      return ReduceCheckNonEmptyString(node);
+    default:
+      break;
+  }
+  return NoChange();
+}
+
+Reduction CheckElimination::ReduceCheckHeapObject(Node* node) {
+  Node* const input = NodeProperties::GetValueInput(node, 0);
+  HeapObjectMatcher m(input);
+  if (m.HasValue()) {
+    ReplaceWithValue(node, input);
+    return Replace(input);
+  }
+  return NoChange();
+}
+
+Reduction CheckElimination::ReduceCheckString(Node* node) {
+  Node* const input = NodeProperties::GetValueInput(node, 0);
+  HeapObjectMatcher m(input);
+  if (m.HasValue() && m.Value()->IsString()) {
+    ReplaceWithValue(node, input);
+    return Replace(input);
+  }
+  return NoChange();
+}
+
+Reduction CheckElimination::ReduceCheckSeqString(Node* node) {
+  Node* const input = NodeProperties::GetValueInput(node, 0);
+  HeapObjectMatcher m(input);
+  if (m.HasValue() && m.Value()->IsSeqString()) {
+    ReplaceWithValue(node, input);
+    return Replace(input);
+  }
+  return NoChange();
+}
+
+Reduction CheckElimination::ReduceCheckNonEmptyString(Node* node) {
+  Node* const input = NodeProperties::GetValueInput(node, 0);
+  HeapObjectMatcher m(input);
+  if (m.HasValue() && m.Value()->IsString() &&
+      node != jsgraph()->EmptyStringConstant()) {
+    ReplaceWithValue(node, input);
+    return Replace(input);
+  }
+  return NoChange();
+}
+
+}  // namespace compiler
+}  // namespace internal
+}  // namespace v8

src/compiler/check-elimination.h

+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef V8_COMPILER_CHECK_ELIMINATION_H_
+#define V8_COMPILER_CHECK_ELIMINATION_H_
+
+#include "src/base/compiler-specific.h"
+#include "src/compiler/graph-reducer.h"
+#include "src/globals.h"
+
+namespace v8 {
+namespace internal {
+namespace compiler {
+
+class JSGraph;
+
+// Performs elimination of redundant checks within the graph due to inlined
+// constants.
+class V8_EXPORT_PRIVATE CheckElimination final
+    : public NON_EXPORTED_BASE(AdvancedReducer) {
+ public:
+  explicit CheckElimination(Editor* editor, JSGraph* jsgraph)
+      : AdvancedReducer(editor), jsgraph_(jsgraph) {}
+  ~CheckElimination() final {}
+
+  Reduction Reduce(Node* node) final;
+
+ private:
+  Reduction ReduceCheckHeapObject(Node* node);
+  Reduction ReduceCheckString(Node* node);
+  Reduction ReduceCheckSeqString(Node* node);
+  Reduction ReduceCheckNonEmptyString(Node* node);
+
+  JSGraph* jsgraph() const { return jsgraph_; }
+
+  JSGraph* jsgraph_;
+};
+
+}  // namespace compiler
+}  // namespace internal
+}  // namespace v8
+
+#endif  // V8_COMPILER_CHECK_ELIMINATION_H_

src/compiler/pipeline.cc

@@ -18,6 +18,7 @@
 #include "src/compiler/basic-block-instrumentor.h"
 #include "src/compiler/branch-elimination.h"
 #include "src/compiler/bytecode-graph-builder.h"
+#include "src/compiler/check-elimination.h"
 #include "src/compiler/checkpoint-elimination.h"
 #include "src/compiler/code-generator.h"
 #include "src/compiler/common-operator-reducer.h"
@@ -917,6 +918,7 @@ struct InliningPhase {
     CheckpointElimination checkpoint_elimination(&graph_reducer);
     CommonOperatorReducer common_reducer(&graph_reducer, data->graph(),
                                          data->common(), data->machine());
+    CheckElimination check_elimination(&graph_reducer, data->jsgraph());
     JSCallReducer call_reducer(&graph_reducer, data->jsgraph(),
                                data->info()->is_bailout_on_uninitialized()
                                    ? JSCallReducer::kBailoutOnUninitialized
@@ -954,6 +956,7 @@ struct InliningPhase {
             : JSIntrinsicLowering::kDeoptimizationDisabled);
     AddReducer(data, &graph_reducer, &dead_code_elimination);
     AddReducer(data, &graph_reducer, &checkpoint_elimination);
+    AddReducer(data, &graph_reducer, &check_elimination);
     AddReducer(data, &graph_reducer, &common_reducer);
     if (data->info()->is_frame_specializing()) {
       AddReducer(data, &graph_reducer, &frame_specialization);

src/v8.gyp

@@ -706,6 +706,8 @@
         'compiler/bytecode-liveness-map.cc',
         'compiler/bytecode-liveness-map.h',
         'compiler/c-linkage.cc',
+        'compiler/check-elimination.cc',
+        'compiler/check-elimination.h',
         'compiler/checkpoint-elimination.cc',
         'compiler/checkpoint-elimination.h',
         'compiler/code-generator-impl.h',