[turbofan] new escape analysis reducer: look through newly introduced typeguards

Bug: chromium:752438
Change-Id: I6e168f0e8101cf9f28915ca94c40d408ed75d079
Reviewed-on: https://chromium-review.googlesource.com/603612
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47203}

src/compiler/new-escape-analysis-reducer.cc

@@ -47,6 +47,17 @@ Node* NewEscapeAnalysisReducer::MaybeGuard(Node* original, Node* replacement) {
   return replacement;
 }
 
+namespace {
+
+Node* SkipTypeGuards(Node* node) {
+  while (node->opcode() == IrOpcode::kTypeGuard) {
+    node = NodeProperties::GetValueInput(node, 0);
+  }
+  return node;
+}
+
+}  // namespace
+
 Node* NewEscapeAnalysisReducer::ObjectIdNode(const VirtualObject* vobject) {
   VirtualObject::Id id = vobject->id();
   if (id >= object_id_cache_.size()) object_id_cache_.resize(id + 1);
@@ -157,7 +168,7 @@ Node* NewEscapeAnalysisReducer::ReduceDeoptState(Node* node, Node* effect,
     }
     return new_node.Get();
   } else if (const VirtualObject* vobject =
-                 analysis_result().GetVirtualObject(node)) {
+                 analysis_result().GetVirtualObject(SkipTypeGuards(node))) {
     if (vobject->HasEscaped()) return node;
     if (deduplicator->SeenBefore(vobject)) {
       return ObjectIdNode(vobject);

test/mjsunit/compiler/escape-analysis-typeguard.js

+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --turbo-escape
+
+class C { constructor(x) { this.a = x; } };
+class D { constructor(x) { this.a = x; } };
+
+function foo(){
+  var x = new C(7);
+  var y = new D(x);
+  var z = y.a;
+  %DeoptimizeNow();
+  assertEquals(7, z.a);
+}
+
+foo();
+foo();
+foo();
+foo();
+%OptimizeFunctionOnNextCall(foo)
+foo();