[turbofan] Remove obsolete JSTypeFeedbackSpecializer and JSTypeFeedbackLowering.

Both the JSTypeFeedbackSpecializer and the JSTypeFeedbackLowering is
dead code by now, since the more general JSNativeContextSpecialization
deals with the property/global load/store type feedback in a way that
also interacts properly with inlining.

BUG=v8:4470
LOG=n
R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1407913003 .

Cr-Commit-Position: refs/heads/master@{#31462}

BUILD.gn

@@ -777,10 +777,6 @@ source_set("v8_base") {
     "src/compiler/js-native-context-specialization.h",
     "src/compiler/js-operator.cc",
     "src/compiler/js-operator.h",
-    "src/compiler/js-type-feedback.cc",
-    "src/compiler/js-type-feedback.h",
-    "src/compiler/js-type-feedback-lowering.cc",
-    "src/compiler/js-type-feedback-lowering.h",
     "src/compiler/js-typed-lowering.cc",
     "src/compiler/js-typed-lowering.h",
     "src/compiler/jump-threading.cc",

src/compiler.cc

@@ -443,9 +443,6 @@ OptimizedCompileJob::Status OptimizedCompileJob::CreateGraph() {
                FLAG_native_context_specialization) {
       info()->MarkAsNativeContextSpecializing();
       info()->MarkAsTypingEnabled();
-    } else if (FLAG_turbo_type_feedback) {
-      info()->MarkAsTypeFeedbackEnabled();
-      info()->EnsureFeedbackVector();
     }
     if (!info()->shared_info()->asm_function() ||
         FLAG_turbo_asm_deoptimization) {

src/compiler.h

@@ -122,7 +122,6 @@ class CompilationInfo {
     kTypingEnabled = 1 << 12,
     kDisableFutureOptimization = 1 << 13,
     kSplittingEnabled = 1 << 14,
-    kTypeFeedbackEnabled = 1 << 15,
     kDeoptimizationEnabled = 1 << 16,
     kSourcePositionsEnabled = 1 << 17,
     kFirstCompile = 1 << 18,
@@ -239,12 +238,6 @@ class CompilationInfo {
     return GetFlag(kNativeContextSpecializing);
   }
 
-  void MarkAsTypeFeedbackEnabled() { SetFlag(kTypeFeedbackEnabled); }
-
-  bool is_type_feedback_enabled() const {
-    return GetFlag(kTypeFeedbackEnabled);
-  }
-
   void MarkAsDeoptimizationEnabled() { SetFlag(kDeoptimizationEnabled); }
 
   bool is_deoptimization_enabled() const {

src/compiler/ast-graph-builder.cc

@@ -7,7 +7,6 @@
 #include "src/compiler.h"
 #include "src/compiler/ast-loop-assignment-analyzer.h"
 #include "src/compiler/control-builders.h"
-#include "src/compiler/js-type-feedback.h"
 #include "src/compiler/linkage.h"
 #include "src/compiler/liveness-analyzer.h"
 #include "src/compiler/machine-operator.h"
@@ -428,8 +427,7 @@ class AstGraphBuilder::FrameStateBeforeAndAfter {
 
 
 AstGraphBuilder::AstGraphBuilder(Zone* local_zone, CompilationInfo* info,
-                                 JSGraph* jsgraph, LoopAssignmentAnalysis* loop,
-                                 JSTypeFeedbackTable* js_type_feedback)
+                                 JSGraph* jsgraph, LoopAssignmentAnalysis* loop)
     : isolate_(info->isolate()),
       local_zone_(local_zone),
       info_(info),
@@ -451,8 +449,7 @@ AstGraphBuilder::AstGraphBuilder(Zone* local_zone, CompilationInfo* info,
       frame_state_function_info_(common()->CreateFrameStateFunctionInfo(
           FrameStateType::kJavaScriptFunction, info->num_parameters() + 1,
           info->scope()->num_stack_slots(), info->shared_info(),
-          CALL_MAINTAINS_NATIVE_CONTEXT)),
-      js_type_feedback_(js_type_feedback) {
+          CALL_MAINTAINS_NATIVE_CONTEXT)) {
   InitializeAstVisitor(info->isolate());
 }
 
@@ -1753,8 +1750,7 @@ void AstGraphBuilder::VisitObjectLiteral(ObjectLiteral* expr) {
             Handle<Name> name = key->AsPropertyName();
             VectorSlotPair feedback =
                 CreateVectorSlotPair(property->GetSlot(0));
-            Node* store = BuildNamedStore(literal, name, value, feedback,
-                                          TypeFeedbackId::None());
+            Node* store = BuildNamedStore(literal, name, value, feedback);
             states.AddToNode(store, key->id(),
                              OutputFrameStateCombine::Ignore());
             BuildSetHomeObject(value, literal, property, 1);
@@ -1946,8 +1942,7 @@ void AstGraphBuilder::VisitArrayLiteral(ArrayLiteral* expr) {
       VectorSlotPair pair = CreateVectorSlotPair(expr->LiteralFeedbackSlot());
       Node* value = environment()->Pop();
       Node* index = jsgraph()->Constant(array_index);
-      Node* store =
-          BuildKeyedStore(literal, index, value, pair, TypeFeedbackId::None());
+      Node* store = BuildKeyedStore(literal, index, value, pair);
       states.AddToNode(store, expr->GetIdForElement(array_index),
                        OutputFrameStateCombine::Ignore());
     }
@@ -2016,8 +2011,7 @@ void AstGraphBuilder::VisitForInAssignment(Expression* expr, Node* value,
       Node* object = environment()->Pop();
       value = environment()->Pop();
       Handle<Name> name = property->key()->AsLiteral()->AsPropertyName();
-      Node* store = BuildNamedStore(object, name, value, feedback,
-                                    TypeFeedbackId::None());
+      Node* store = BuildNamedStore(object, name, value, feedback);
       states.AddToNode(store, bailout_id_after,
                        OutputFrameStateCombine::Ignore());
       break;
@@ -2030,8 +2024,7 @@ void AstGraphBuilder::VisitForInAssignment(Expression* expr, Node* value,
       Node* key = environment()->Pop();
       Node* object = environment()->Pop();
       value = environment()->Pop();
-      Node* store =
-          BuildKeyedStore(object, key, value, feedback, TypeFeedbackId::None());
+      Node* store = BuildKeyedStore(object, key, value, feedback);
       states.AddToNode(store, bailout_id_after,
                        OutputFrameStateCombine::Ignore());
       break;
@@ -2045,8 +2038,7 @@ void AstGraphBuilder::VisitForInAssignment(Expression* expr, Node* value,
       Node* receiver = environment()->Pop();
       value = environment()->Pop();
       Handle<Name> name = property->key()->AsLiteral()->AsPropertyName();
-      Node* store = BuildNamedSuperStore(receiver, home_object, name, value,
-                                         TypeFeedbackId::None());
+      Node* store = BuildNamedSuperStore(receiver, home_object, name, value);
       states.AddToNode(store, bailout_id_after,
                        OutputFrameStateCombine::Ignore());
       break;
@@ -2061,8 +2053,7 @@ void AstGraphBuilder::VisitForInAssignment(Expression* expr, Node* value,
       Node* home_object = environment()->Pop();
       Node* receiver = environment()->Pop();
       value = environment()->Pop();
-      Node* store = BuildKeyedSuperStore(receiver, home_object, key, value,
-                                         TypeFeedbackId::None());
+      Node* store = BuildKeyedSuperStore(receiver, home_object, key, value);
       states.AddToNode(store, bailout_id_after,
                        OutputFrameStateCombine::Ignore());
       break;
@@ -2207,8 +2198,7 @@ void AstGraphBuilder::VisitAssignment(Assignment* expr) {
     case NAMED_PROPERTY: {
       Node* object = environment()->Pop();
       Handle<Name> name = property->key()->AsLiteral()->AsPropertyName();
-      Node* store = BuildNamedStore(object, name, value, feedback,
-                                    expr->AssignmentFeedbackId());
+      Node* store = BuildNamedStore(object, name, value, feedback);
       store_states.AddToNode(store, expr->id(),
                              ast_context()->GetStateCombine());
       break;
@@ -2216,8 +2206,7 @@ void AstGraphBuilder::VisitAssignment(Assignment* expr) {
     case KEYED_PROPERTY: {
       Node* key = environment()->Pop();
       Node* object = environment()->Pop();
-      Node* store = BuildKeyedStore(object, key, value, feedback,
-                                    expr->AssignmentFeedbackId());
+      Node* store = BuildKeyedStore(object, key, value, feedback);
       store_states.AddToNode(store, expr->id(),
                              ast_context()->GetStateCombine());
       break;
@@ -2226,8 +2215,7 @@ void AstGraphBuilder::VisitAssignment(Assignment* expr) {
       Node* home_object = environment()->Pop();
       Node* receiver = environment()->Pop();
       Handle<Name> name = property->key()->AsLiteral()->AsPropertyName();
-      Node* store = BuildNamedSuperStore(receiver, home_object, name, value,
-                                         expr->AssignmentFeedbackId());
+      Node* store = BuildNamedSuperStore(receiver, home_object, name, value);
       store_states.AddToNode(store, expr->id(),
                              ast_context()->GetStateCombine());
       break;
@@ -2236,8 +2224,7 @@ void AstGraphBuilder::VisitAssignment(Assignment* expr) {
       Node* key = environment()->Pop();
       Node* home_object = environment()->Pop();
       Node* receiver = environment()->Pop();
-      Node* store = BuildKeyedSuperStore(receiver, home_object, key, value,
-                                         expr->AssignmentFeedbackId());
+      Node* store = BuildKeyedSuperStore(receiver, home_object, key, value);
       store_states.AddToNode(store, expr->id(),
                              ast_context()->GetStateCombine());
       break;
@@ -2725,8 +2712,7 @@ void AstGraphBuilder::VisitCountOperation(CountOperation* expr) {
     case NAMED_PROPERTY: {
       Node* object = environment()->Pop();
       Handle<Name> name = property->key()->AsLiteral()->AsPropertyName();
-      Node* store = BuildNamedStore(object, name, value, feedback,
-                                    expr->CountStoreFeedbackId());
+      Node* store = BuildNamedStore(object, name, value, feedback);
       environment()->Push(value);
       store_states.AddToNode(store, expr->AssignmentId(),
                              OutputFrameStateCombine::Ignore());
@@ -2736,8 +2722,7 @@ void AstGraphBuilder::VisitCountOperation(CountOperation* expr) {
     case KEYED_PROPERTY: {
       Node* key = environment()->Pop();
       Node* object = environment()->Pop();
-      Node* store = BuildKeyedStore(object, key, value, feedback,
-                                    expr->CountStoreFeedbackId());
+      Node* store = BuildKeyedStore(object, key, value, feedback);
       environment()->Push(value);
       store_states.AddToNode(store, expr->AssignmentId(),
                              OutputFrameStateCombine::Ignore());
@@ -2748,8 +2733,7 @@ void AstGraphBuilder::VisitCountOperation(CountOperation* expr) {
       Node* home_object = environment()->Pop();
       Node* receiver = environment()->Pop();
       Handle<Name> name = property->key()->AsLiteral()->AsPropertyName();
-      Node* store = BuildNamedSuperStore(receiver, home_object, name, value,
-                                         expr->CountStoreFeedbackId());
+      Node* store = BuildNamedSuperStore(receiver, home_object, name, value);
       environment()->Push(value);
       store_states.AddToNode(store, expr->AssignmentId(),
                              OutputFrameStateCombine::Ignore());
@@ -2760,8 +2744,7 @@ void AstGraphBuilder::VisitCountOperation(CountOperation* expr) {
       Node* key = environment()->Pop();
       Node* home_object = environment()->Pop();
       Node* receiver = environment()->Pop();
-      Node* store = BuildKeyedSuperStore(receiver, home_object, key, value,
-                                         expr->CountStoreFeedbackId());
+      Node* store = BuildKeyedSuperStore(receiver, home_object, key, value);
       environment()->Push(value);
       store_states.AddToNode(store, expr->AssignmentId(),
                              OutputFrameStateCombine::Ignore());
@@ -3448,8 +3431,7 @@ Node* AstGraphBuilder::BuildVariableAssignment(
     case VariableLocation::UNALLOCATED: {
       // Global var, const, or let variable.
       Handle<Name> name = variable->name();
-      Node* store =
-          BuildGlobalStore(name, value, feedback, TypeFeedbackId::None());
+      Node* store = BuildGlobalStore(name, value, feedback);
       states.AddToNode(store, bailout_id, combine);
       return store;
     }
@@ -3566,29 +3548,11 @@ Node* AstGraphBuilder::BuildVariableAssignment(
 }
 
 
-static inline Node* Record(JSTypeFeedbackTable* js_type_feedback, Node* node,
-                           FeedbackVectorSlot slot) {
-  if (js_type_feedback) {
-    js_type_feedback->Record(node, slot);
-  }
-  return node;
-}
-
-
-static inline Node* Record(JSTypeFeedbackTable* js_type_feedback, Node* node,
-                           TypeFeedbackId id) {
-  if (js_type_feedback) {
-    js_type_feedback->Record(node, id);
-  }
-  return node;
-}
-
-
 Node* AstGraphBuilder::BuildKeyedLoad(Node* object, Node* key,
                                       const VectorSlotPair& feedback) {
   const Operator* op = javascript()->LoadProperty(language_mode(), feedback);
   Node* node = NewNode(op, object, key, BuildLoadFeedbackVector());
-  return Record(js_type_feedback_, node, feedback.slot());
+  return node;
 }
 
 
@@ -3596,33 +3560,25 @@ Node* AstGraphBuilder::BuildNamedLoad(Node* object, Handle<Name> name,
                                       const VectorSlotPair& feedback) {
   const Operator* op = javascript()->LoadNamed(language_mode(), name, feedback);
   Node* node = NewNode(op, object, BuildLoadFeedbackVector());
-  return Record(js_type_feedback_, node, feedback.slot());
+  return node;
 }
 
 
 Node* AstGraphBuilder::BuildKeyedStore(Node* object, Node* key, Node* value,
-                                       const VectorSlotPair& feedback,
-                                       TypeFeedbackId id) {
+                                       const VectorSlotPair& feedback) {
   const Operator* op = javascript()->StoreProperty(language_mode(), feedback);
   Node* node = NewNode(op, object, key, value, BuildLoadFeedbackVector());
-  if (FLAG_vector_stores) {
-    return Record(js_type_feedback_, node, feedback.slot());
-  }
-  return Record(js_type_feedback_, node, id);
+  return node;
 }
 
 
 Node* AstGraphBuilder::BuildNamedStore(Node* object, Handle<Name> name,
                                        Node* value,
-                                       const VectorSlotPair& feedback,
-                                       TypeFeedbackId id) {
+                                       const VectorSlotPair& feedback) {
   const Operator* op =
       javascript()->StoreNamed(language_mode(), name, feedback);
   Node* node = NewNode(op, object, value, BuildLoadFeedbackVector());
-  if (FLAG_vector_stores) {
-    return Record(js_type_feedback_, node, feedback.slot());
-  }
-  return Record(js_type_feedback_, node, id);
+  return node;
 }
 
 
@@ -3633,7 +3589,7 @@ Node* AstGraphBuilder::BuildNamedSuperLoad(Node* receiver, Node* home_object,
   Node* language = jsgraph()->Constant(language_mode());
   const Operator* op = javascript()->CallRuntime(Runtime::kLoadFromSuper, 4);
   Node* node = NewNode(op, receiver, home_object, name_node, language);
-  return Record(js_type_feedback_, node, feedback.slot());
+  return node;
 }
 
 
@@ -3644,32 +3600,30 @@ Node* AstGraphBuilder::BuildKeyedSuperLoad(Node* receiver, Node* home_object,
   const Operator* op =
       javascript()->CallRuntime(Runtime::kLoadKeyedFromSuper, 4);
   Node* node = NewNode(op, receiver, home_object, key, language);
-  return Record(js_type_feedback_, node, feedback.slot());
+  return node;
 }
 
 
 Node* AstGraphBuilder::BuildKeyedSuperStore(Node* receiver, Node* home_object,
-                                            Node* key, Node* value,
-                                            TypeFeedbackId id) {
+                                            Node* key, Node* value) {
   Runtime::FunctionId function_id = is_strict(language_mode())
                                         ? Runtime::kStoreKeyedToSuper_Strict
                                         : Runtime::kStoreKeyedToSuper_Sloppy;
   const Operator* op = javascript()->CallRuntime(function_id, 4);
   Node* node = NewNode(op, receiver, home_object, key, value);
-  return Record(js_type_feedback_, node, id);
+  return node;
 }
 
 
 Node* AstGraphBuilder::BuildNamedSuperStore(Node* receiver, Node* home_object,
-                                            Handle<Name> name, Node* value,
-                                            TypeFeedbackId id) {
+                                            Handle<Name> name, Node* value) {
   Node* name_node = jsgraph()->Constant(name);
   Runtime::FunctionId function_id = is_strict(language_mode())
                                         ? Runtime::kStoreToSuper_Strict
                                         : Runtime::kStoreToSuper_Sloppy;
   const Operator* op = javascript()->CallRuntime(function_id, 4);
   Node* node = NewNode(op, receiver, home_object, name_node, value);
-  return Record(js_type_feedback_, node, id);
+  return node;
 }
 
 
@@ -3678,20 +3632,16 @@ Node* AstGraphBuilder::BuildGlobalLoad(Handle<Name> name,
                                        TypeofMode typeof_mode) {
   const Operator* op = javascript()->LoadGlobal(name, feedback, typeof_mode);
   Node* node = NewNode(op, BuildLoadFeedbackVector());
-  return Record(js_type_feedback_, node, feedback.slot());
+  return node;
 }
 
 
 Node* AstGraphBuilder::BuildGlobalStore(Handle<Name> name, Node* value,
-                                        const VectorSlotPair& feedback,
-                                        TypeFeedbackId id) {
+                                        const VectorSlotPair& feedback) {
   const Operator* op =
       javascript()->StoreGlobal(language_mode(), name, feedback);
   Node* node = NewNode(op, value, BuildLoadFeedbackVector());
-  if (FLAG_vector_stores) {
-    return Record(js_type_feedback_, node, feedback.slot());
-  }
-  return Record(js_type_feedback_, node, id);
+  return node;
 }
 
 
@@ -3820,8 +3770,7 @@ Node* AstGraphBuilder::BuildSetHomeObject(Node* value, Node* home_object,
   FrameStateBeforeAndAfter states(this, BailoutId::None());
   VectorSlotPair feedback =
       CreateVectorSlotPair(property->GetSlot(slot_number));
-  Node* store = BuildNamedStore(value, name, home_object, feedback,
-                                TypeFeedbackId::None());
+  Node* store = BuildNamedStore(value, name, home_object, feedback);
   states.AddToNode(store, BailoutId::None(), OutputFrameStateCombine::Ignore());
   return store;
 }

src/compiler/ast-graph-builder.h

@@ -19,7 +19,6 @@ namespace compiler {
 
 class ControlBuilder;
 class Graph;
-class JSTypeFeedbackTable;
 class LoopAssignmentAnalysis;
 class LoopBuilder;
 class Node;
@@ -31,8 +30,7 @@ class Node;
 class AstGraphBuilder : public AstVisitor {
  public:
   AstGraphBuilder(Zone* local_zone, CompilationInfo* info, JSGraph* jsgraph,
-                  LoopAssignmentAnalysis* loop_assignment = NULL,
-                  JSTypeFeedbackTable* js_type_feedback = NULL);
+                  LoopAssignmentAnalysis* loop_assignment = NULL);
 
   // Creates a graph by visiting the entire AST.
   bool CreateGraph(bool stack_check = true);
@@ -116,9 +114,6 @@ class AstGraphBuilder : public AstVisitor {
   // Function info for frame state construction.
   const FrameStateFunctionInfo* const frame_state_function_info_;
 
-  // Type feedback table.
-  JSTypeFeedbackTable* js_type_feedback_;
-
   // Growth increment for the temporary buffer used to construct input lists to
   // new nodes.
   static const int kInputBufferSizeIncrement = 64;
@@ -286,15 +281,15 @@ class AstGraphBuilder : public AstVisitor {
   Node* BuildNamedLoad(Node* receiver, Handle<Name> name,
                        const VectorSlotPair& feedback);
   Node* BuildKeyedStore(Node* receiver, Node* key, Node* value,
-                        const VectorSlotPair& feedback, TypeFeedbackId id);
+                        const VectorSlotPair& feedback);
   Node* BuildNamedStore(Node* receiver, Handle<Name> name, Node* value,
-                        const VectorSlotPair& feedback, TypeFeedbackId id);
+                        const VectorSlotPair& feedback);
 
   // Builders for super property loads and stores.
   Node* BuildKeyedSuperStore(Node* receiver, Node* home_object, Node* key,
-                             Node* value, TypeFeedbackId id);
+                             Node* value);
   Node* BuildNamedSuperStore(Node* receiver, Node* home_object,
-                             Handle<Name> name, Node* value, TypeFeedbackId id);
+                             Handle<Name> name, Node* value);
   Node* BuildNamedSuperLoad(Node* receiver, Node* home_object,
                             Handle<Name> name, const VectorSlotPair& feedback);
   Node* BuildKeyedSuperLoad(Node* receiver, Node* home_object, Node* key,
@@ -304,7 +299,7 @@ class AstGraphBuilder : public AstVisitor {
   Node* BuildGlobalLoad(Handle<Name> name, const VectorSlotPair& feedback,
                         TypeofMode typeof_mode);
   Node* BuildGlobalStore(Handle<Name> name, Node* value,
-                         const VectorSlotPair& feedback, TypeFeedbackId id);
+                         const VectorSlotPair& feedback);
 
   // Builders for accessing the function context.
   Node* BuildLoadGlobalObject();

src/compiler/js-type-feedback-lowering.cc

-// Copyright 2015 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "src/compiler/js-type-feedback-lowering.h"
-
-#include "src/compiler/access-builder.h"
-#include "src/compiler/js-graph.h"
-#include "src/compiler/node-properties.h"
-#include "src/objects-inl.h"  // TODO(mstarzinger): Temporary cycle breaker!
-#include "src/type-feedback-vector.h"
-
-namespace v8 {
-namespace internal {
-namespace compiler {
-
-JSTypeFeedbackLowering::JSTypeFeedbackLowering(Editor* editor, Flags flags,
-                                               JSGraph* jsgraph)
-    : AdvancedReducer(editor), flags_(flags), jsgraph_(jsgraph) {}
-
-
-Reduction JSTypeFeedbackLowering::Reduce(Node* node) {
-  switch (node->opcode()) {
-    case IrOpcode::kJSLoadNamed:
-      return ReduceJSLoadNamed(node);
-    default:
-      break;
-  }
-  return NoChange();
-}
-
-
-Reduction JSTypeFeedbackLowering::ReduceJSLoadNamed(Node* node) {
-  DCHECK_EQ(IrOpcode::kJSLoadNamed, node->opcode());
-  Node* receiver = NodeProperties::GetValueInput(node, 0);
-  Type* receiver_type = NodeProperties::GetType(receiver);
-  Node* frame_state = NodeProperties::GetFrameStateInput(node, 1);
-  Node* effect = NodeProperties::GetEffectInput(node);
-  Node* control = NodeProperties::GetControlInput(node);
-  // We need to make optimistic assumptions to continue.
-  if (!(flags() & kDeoptimizationEnabled)) return NoChange();
-  NamedAccess const& p = NamedAccessOf(node->op());
-  if (!p.feedback().IsValid()) return NoChange();  // No feedback.
-  if (p.name().is_identical_to(factory()->length_string())) {
-    LoadICNexus nexus(p.feedback().vector(), p.feedback().slot());
-    MapHandleList maps;
-    if (nexus.ExtractMaps(&maps) > 0) {
-      for (Handle<Map> map : maps) {
-        if (map->instance_type() >= FIRST_NONSTRING_TYPE) return NoChange();
-      }
-      // Optimistic optimization for "length" property of strings.
-      if (receiver_type->Maybe(Type::TaggedSigned())) {
-        Node* check = graph()->NewNode(simplified()->ObjectIsSmi(), receiver);
-        Node* branch = graph()->NewNode(common()->Branch(BranchHint::kFalse),
-                                        check, control);
-        Node* if_true = graph()->NewNode(common()->IfTrue(), branch);
-        Node* deoptimize = graph()->NewNode(common()->Deoptimize(), frame_state,
-                                            effect, if_true);
-        // TODO(bmeurer): This should be on the AdvancedReducer somehow.
-        NodeProperties::MergeControlToEnd(graph(), common(), deoptimize);
-        control = graph()->NewNode(common()->IfFalse(), branch);
-      }
-      Node* receiver_map = effect =
-          graph()->NewNode(simplified()->LoadField(AccessBuilder::ForMap()),
-                           receiver, effect, control);
-      Node* receiver_instance_type = effect = graph()->NewNode(
-          simplified()->LoadField(AccessBuilder::ForMapInstanceType()),
-          receiver_map, effect, control);
-      Node* check =
-          graph()->NewNode(machine()->Uint32LessThan(), receiver_instance_type,
-                           jsgraph()->Uint32Constant(FIRST_NONSTRING_TYPE));
-      Node* branch =
-          graph()->NewNode(common()->Branch(BranchHint::kTrue), check, control);
-      Node* if_false = graph()->NewNode(common()->IfFalse(), branch);
-      Node* deoptimize = graph()->NewNode(common()->Deoptimize(), frame_state,
-                                          effect, if_false);
-      // TODO(bmeurer): This should be on the AdvancedReducer somehow.
-      NodeProperties::MergeControlToEnd(graph(), common(), deoptimize);
-      control = graph()->NewNode(common()->IfTrue(), branch);
-      Node* value = effect =
-          graph()->NewNode(simplified()->LoadField(
-                               AccessBuilder::ForStringLength(graph()->zone())),
-                           receiver, effect, control);
-      ReplaceWithValue(node, value, effect, control);
-      return Replace(value);
-    }
-  }
-  return NoChange();
-}
-
-
-Factory* JSTypeFeedbackLowering::factory() const {
-  return isolate()->factory();
-}
-
-
-CommonOperatorBuilder* JSTypeFeedbackLowering::common() const {
-  return jsgraph()->common();
-}
-
-
-Graph* JSTypeFeedbackLowering::graph() const { return jsgraph()->graph(); }
-
-
-Isolate* JSTypeFeedbackLowering::isolate() const {
-  return jsgraph()->isolate();
-}
-
-
-MachineOperatorBuilder* JSTypeFeedbackLowering::machine() const {
-  return jsgraph()->machine();
-}
-
-
-SimplifiedOperatorBuilder* JSTypeFeedbackLowering::simplified() const {
-  return jsgraph()->simplified();
-}
-
-}  // namespace compiler
-}  // namespace internal
-}  // namespace v8

src/compiler/js-type-feedback-lowering.h

-// Copyright 2015 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef V8_COMPILER_JS_TYPE_FEEDBACK_LOWERING_H_
-#define V8_COMPILER_JS_TYPE_FEEDBACK_LOWERING_H_
-
-#include "src/base/flags.h"
-#include "src/compiler/graph-reducer.h"
-
-namespace v8 {
-namespace internal {
-
-// Forward declarations.
-class Factory;
-
-namespace compiler {
-
-// Forward declarations.
-class CommonOperatorBuilder;
-class JSGraph;
-class MachineOperatorBuilder;
-class SimplifiedOperatorBuilder;
-
-
-// Lowers JS-level operators to simplified operators based on type feedback.
-class JSTypeFeedbackLowering final : public AdvancedReducer {
- public:
-  // Various configuration flags to control the operation of this lowering.
-  enum Flag {
-    kNoFlags = 0,
-    kDeoptimizationEnabled = 1 << 0,
-  };
-  typedef base::Flags<Flag> Flags;
-
-  JSTypeFeedbackLowering(Editor* editor, Flags flags, JSGraph* jsgraph);
-  ~JSTypeFeedbackLowering() final {}
-
-  Reduction Reduce(Node* node) final;
-
- private:
-  Reduction ReduceJSLoadNamed(Node* node);
-
-  Factory* factory() const;
-  Flags flags() const { return flags_; }
-  Graph* graph() const;
-  Isolate* isolate() const;
-  JSGraph* jsgraph() const { return jsgraph_; }
-  CommonOperatorBuilder* common() const;
-  MachineOperatorBuilder* machine() const;
-  SimplifiedOperatorBuilder* simplified() const;
-
-  Flags const flags_;
-  JSGraph* const jsgraph_;
-
-  DISALLOW_COPY_AND_ASSIGN(JSTypeFeedbackLowering);
-};
-
-DEFINE_OPERATORS_FOR_FLAGS(JSTypeFeedbackLowering::Flags)
-
-}  // namespace compiler
-}  // namespace internal
-}  // namespace v8
-
-#endif  // V8_COMPILER_JS_TYPE_FEEDBACK_LOWERING_H_

src/compiler/js-type-feedback.cc

-// Copyright 2015 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "src/compiler/js-type-feedback.h"
-
-#include "src/property-details.h"
-
-#include "src/accessors.h"
-#include "src/ast.h"
-#include "src/compiler.h"
-#include "src/type-info.h"
-
-#include "src/compiler/access-builder.h"
-#include "src/compiler/common-operator.h"
-#include "src/compiler/frame-states.h"
-#include "src/compiler/node-aux-data.h"
-#include "src/compiler/node-matchers.h"
-#include "src/compiler/operator-properties.h"
-#include "src/compiler/simplified-operator.h"
-
-namespace v8 {
-namespace internal {
-namespace compiler {
-
-enum LoadOrStore { LOAD, STORE };
-
-// TODO(turbofan): fix deoptimization problems
-#define ENABLE_FAST_PROPERTY_LOADS false
-#define ENABLE_FAST_PROPERTY_STORES false
-
-JSTypeFeedbackTable::JSTypeFeedbackTable(Zone* zone)
-    : type_feedback_id_map_(TypeFeedbackIdMap::key_compare(),
-                            TypeFeedbackIdMap::allocator_type(zone)),
-      feedback_vector_slot_map_(TypeFeedbackIdMap::key_compare(),
-                                TypeFeedbackIdMap::allocator_type(zone)) {}
-
-
-void JSTypeFeedbackTable::Record(Node* node, TypeFeedbackId id) {
-  type_feedback_id_map_.insert(std::make_pair(node->id(), id));
-}
-
-
-void JSTypeFeedbackTable::Record(Node* node, FeedbackVectorSlot slot) {
-  feedback_vector_slot_map_.insert(std::make_pair(node->id(), slot));
-}
-
-
-Reduction JSTypeFeedbackSpecializer::Reduce(Node* node) {
-  switch (node->opcode()) {
-    case IrOpcode::kJSLoadProperty:
-      return ReduceJSLoadProperty(node);
-    case IrOpcode::kJSLoadNamed:
-      return ReduceJSLoadNamed(node);
-    case IrOpcode::kJSLoadGlobal:
-      return ReduceJSLoadGlobal(node);
-    case IrOpcode::kJSStoreNamed:
-      return ReduceJSStoreNamed(node);
-    case IrOpcode::kJSStoreProperty:
-      return ReduceJSStoreProperty(node);
-    default:
-      break;
-  }
-  return NoChange();
-}
-
-
-static void AddFieldAccessTypes(FieldAccess* access,
-                                PropertyDetails property_details) {
-  if (property_details.representation().IsSmi()) {
-    access->type = Type::SignedSmall();
-    access->machine_type = static_cast<MachineType>(kTypeInt32 | kRepTagged);
-  } else if (property_details.representation().IsDouble()) {
-    access->type = Type::Number();
-    access->machine_type = kMachFloat64;
-  }
-}
-
-
-static bool GetInObjectFieldAccess(LoadOrStore mode, Handle<Map> map,
-                                   Handle<Name> name, FieldAccess* access) {
-  access->base_is_tagged = kTaggedBase;
-  access->offset = -1;
-  access->name = name;
-  access->type = Type::Any();
-  access->machine_type = kMachAnyTagged;
-
-  // Check for properties that have accessors but are JSObject fields.
-  if (Accessors::IsJSObjectFieldAccessor(map, name, &access->offset)) {
-    // TODO(turbofan): fill in types for special JSObject field accesses.
-    return true;
-  }
-
-  // Check if the map is a dictionary.
-  if (map->is_dictionary_map()) return false;
-
-  // Search the descriptor array.
-  DescriptorArray* descriptors = map->instance_descriptors();
-  int number = descriptors->SearchWithCache(*name, *map);
-  if (number == DescriptorArray::kNotFound) return false;
-  PropertyDetails property_details = descriptors->GetDetails(number);
-
-  bool is_smi = property_details.representation().IsSmi();
-  bool is_double = property_details.representation().IsDouble();
-
-  if (property_details.type() != DATA) {
-    // TODO(turbofan): constant loads and stores.
-    return false;
-  }
-
-  // Transfer known types from property details.
-  AddFieldAccessTypes(access, property_details);
-
-  if (mode == STORE) {
-    if (property_details.IsReadOnly()) {
-      // TODO(turbofan): deopt, ignore or throw on readonly stores.
-      return false;
-    }
-    if (is_smi || is_double) {
-      // TODO(turbofan): check type and deopt for SMI/double stores.
-      return false;
-    }
-  }
-
-  int index = map->instance_descriptors()->GetFieldIndex(number);
-  FieldIndex field_index = FieldIndex::ForPropertyIndex(*map, index, is_double);
-
-  if (field_index.is_inobject()) {
-    if (is_double && !map->IsUnboxedDoubleField(field_index)) {
-      // TODO(turbofan): support for out-of-line (MutableHeapNumber) loads.
-      return false;
-    }
-    access->offset = field_index.offset();
-    return true;
-  }
-
-  // TODO(turbofan): handle out of object properties.
-  return false;
-}
-
-
-Reduction JSTypeFeedbackSpecializer::ReduceJSLoadNamed(Node* node) {
-  DCHECK(node->opcode() == IrOpcode::kJSLoadNamed);
-  if (mode() != kDeoptimizationEnabled) return NoChange();
-  Node* frame_state_before = GetFrameStateBefore(node);
-  if (frame_state_before == nullptr) return NoChange();
-
-  NamedAccess const& p = NamedAccessOf(node->op());
-  SmallMapList maps;
-
-  FeedbackVectorSlot slot = js_type_feedback_->FindFeedbackVectorSlot(node);
-  if (slot.IsInvalid() ||
-      oracle()->LoadInlineCacheState(slot) == UNINITIALIZED) {
-    // No type feedback ids or the load is uninitialized.
-    return NoChange();
-  }
-  oracle()->PropertyReceiverTypes(slot, p.name(), &maps);
-
-  Node* receiver = node->InputAt(0);
-  Node* effect = NodeProperties::GetEffectInput(node);
-
-  if (maps.length() != 1) return NoChange();  // TODO(turbofan): polymorphism
-  if (!ENABLE_FAST_PROPERTY_LOADS) return NoChange();
-
-  Handle<Map> map = maps.first();
-  FieldAccess field_access;
-  if (!GetInObjectFieldAccess(LOAD, map, p.name(), &field_access)) {
-    return NoChange();
-  }
-
-  Node* control = NodeProperties::GetControlInput(node);
-  Node* check_success;
-  Node* check_failed;
-  BuildMapCheck(receiver, map, true, effect, control, &check_success,
-                &check_failed);
-
-  // Build the actual load.
-  Node* load = graph()->NewNode(simplified()->LoadField(field_access), receiver,
-                                effect, check_success);
-
-  // TODO(turbofan): handle slow case instead of deoptimizing.
-  Node* deopt = graph()->NewNode(common()->Deoptimize(), frame_state_before,
-                                 effect, check_failed);
-  NodeProperties::MergeControlToEnd(graph(), common(), deopt);
-  ReplaceWithValue(node, load, load, check_success);
-  return Replace(load);
-}
-
-
-Reduction JSTypeFeedbackSpecializer::ReduceJSLoadGlobal(Node* node) {
-  DCHECK(node->opcode() == IrOpcode::kJSLoadGlobal);
-  Handle<String> name =
-      Handle<String>::cast(LoadGlobalParametersOf(node->op()).name());
-  if (global_object_.is_null()) {
-    // Nothing else can be done if we don't have a global object.
-    return NoChange();
-  }
-
-  if (mode() == kDeoptimizationEnabled) {
-    // Handle lookups in the script context.
-    {
-      Handle<ScriptContextTable> script_contexts(
-          global_object_->native_context()->script_context_table());
-      ScriptContextTable::LookupResult lookup;
-      if (ScriptContextTable::Lookup(script_contexts, name, &lookup)) {
-        // TODO(turbofan): introduce a LoadContext here.
-        return NoChange();
-      }
-    }
-
-    // Constant promotion or cell access requires lazy deoptimization support.
-    LookupIterator it(global_object_, name, LookupIterator::OWN);
-
-    if (it.state() == LookupIterator::DATA) {
-      Handle<PropertyCell> cell = it.GetPropertyCell();
-      dependencies_->AssumePropertyCell(cell);
-
-      if (it.property_details().cell_type() == PropertyCellType::kConstant) {
-        // Constant promote the global's current value.
-        Handle<Object> constant_value(cell->value(), jsgraph()->isolate());
-        if (constant_value->IsConsString()) {
-          constant_value =
-              String::Flatten(Handle<String>::cast(constant_value));
-        }
-        Node* constant = jsgraph()->Constant(constant_value);
-        ReplaceWithValue(node, constant);
-        return Replace(constant);
-      } else {
-        // Load directly from the property cell.
-        FieldAccess access = AccessBuilder::ForPropertyCellValue();
-        Node* control = NodeProperties::GetControlInput(node);
-        Node* load_field = graph()->NewNode(
-            simplified()->LoadField(access), jsgraph()->Constant(cell),
-            NodeProperties::GetEffectInput(node), control);
-        ReplaceWithValue(node, load_field, load_field, control);
-        return Replace(load_field);
-      }
-    }
-  } else {
-    // TODO(turbofan): non-configurable properties on the global object
-    // should be loadable through a cell without deoptimization support.
-  }
-
-  return NoChange();
-}
-
-
-Reduction JSTypeFeedbackSpecializer::ReduceJSLoadProperty(Node* node) {
-  return NoChange();
-}
-
-
-Reduction JSTypeFeedbackSpecializer::ReduceJSStoreNamed(Node* node) {
-  DCHECK(node->opcode() == IrOpcode::kJSStoreNamed);
-  Node* frame_state_before = GetFrameStateBefore(node);
-  if (frame_state_before == nullptr) return NoChange();
-
-  NamedAccess const& p = NamedAccessOf(node->op());
-  SmallMapList maps;
-  TypeFeedbackId id = js_type_feedback_->FindTypeFeedbackId(node);
-  if (id.IsNone() || oracle()->StoreIsUninitialized(id) == UNINITIALIZED) {
-    // No type feedback ids or the store is uninitialized.
-    // TODO(titzer): no feedback from vector ICs from stores.
-    return NoChange();
-  } else {
-    oracle()->AssignmentReceiverTypes(id, p.name(), &maps);
-  }
-
-  Node* receiver = node->InputAt(0);
-  Node* effect = NodeProperties::GetEffectInput(node);
-
-  if (maps.length() != 1) return NoChange();  // TODO(turbofan): polymorphism
-
-  if (!ENABLE_FAST_PROPERTY_STORES) return NoChange();
-
-  Handle<Map> map = maps.first();
-  FieldAccess field_access;
-  if (!GetInObjectFieldAccess(STORE, map, p.name(), &field_access)) {
-    return NoChange();
-  }
-
-  Node* control = NodeProperties::GetControlInput(node);
-  Node* check_success;
-  Node* check_failed;
-  BuildMapCheck(receiver, map, true, effect, control, &check_success,
-                &check_failed);
-
-  // Build the actual load.
-  Node* value = node->InputAt(1);
-  Node* store = graph()->NewNode(simplified()->StoreField(field_access),
-                                 receiver, value, effect, check_success);
-
-  // TODO(turbofan): handle slow case instead of deoptimizing.
-  Node* deopt = graph()->NewNode(common()->Deoptimize(), frame_state_before,
-                                 effect, check_failed);
-  NodeProperties::MergeControlToEnd(graph(), common(), deopt);
-  ReplaceWithValue(node, store, store, check_success);
-  return Replace(store);
-}
-
-
-Reduction JSTypeFeedbackSpecializer::ReduceJSStoreProperty(Node* node) {
-  return NoChange();
-}
-
-
-void JSTypeFeedbackSpecializer::BuildMapCheck(Node* receiver, Handle<Map> map,
-                                              bool smi_check, Node* effect,
-                                              Node* control, Node** success,
-                                              Node** fail) {
-  Node* if_smi = nullptr;
-  if (smi_check) {
-    Node* branch_smi = graph()->NewNode(
-        common()->Branch(BranchHint::kFalse),
-        graph()->NewNode(simplified()->ObjectIsSmi(), receiver), control);
-    if_smi = graph()->NewNode(common()->IfTrue(), branch_smi);
-    control = graph()->NewNode(common()->IfFalse(), branch_smi);
-  }
-
-  FieldAccess map_access = AccessBuilder::ForMap();
-  Node* receiver_map = graph()->NewNode(simplified()->LoadField(map_access),
-                                        receiver, effect, control);
-  Node* map_const = jsgraph_->Constant(map);
-  Node* cmp = graph()->NewNode(simplified()->ReferenceEqual(Type::Internal()),
-                               receiver_map, map_const);
-  Node* branch =
-      graph()->NewNode(common()->Branch(BranchHint::kTrue), cmp, control);
-  *success = graph()->NewNode(common()->IfTrue(), branch);
-  *fail = graph()->NewNode(common()->IfFalse(), branch);
-
-  if (if_smi) {
-    *fail = graph()->NewNode(common()->Merge(2), *fail, if_smi);
-  }
-}
-
-
-// Get the frame state before an operation if it exists and has a valid
-// bailout id.
-Node* JSTypeFeedbackSpecializer::GetFrameStateBefore(Node* node) {
-  int count = OperatorProperties::GetFrameStateInputCount(node->op());
-  DCHECK_LE(count, 2);
-  if (count == 2) {
-    Node* frame_state = NodeProperties::GetFrameStateInput(node, 1);
-    if (frame_state->opcode() == IrOpcode::kFrameState) {
-      BailoutId id = OpParameter<FrameStateInfo>(node).bailout_id();
-      if (id != BailoutId::None()) return frame_state;
-    }
-  }
-  return nullptr;
-}
-
-}  // namespace compiler
-}  // namespace internal
-}  // namespace v8

src/compiler/js-type-feedback.h

-// Copyright 2015 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef V8_COMPILER_JS_TYPE_FEEDBACK_H_
-#define V8_COMPILER_JS_TYPE_FEEDBACK_H_
-
-#include "src/utils.h"
-
-#include "src/compiler/graph-reducer.h"
-#include "src/compiler/js-graph.h"
-#include "src/compiler/node-aux-data.h"
-
-namespace v8 {
-namespace internal {
-
-class TypeFeedbackOracle;
-class SmallMapList;
-class CompilationDependencies;
-
-namespace compiler {
-
-// Stores type feedback information for nodes in the graph in a separate
-// data structure.
-class JSTypeFeedbackTable : public ZoneObject {
- public:
-  explicit JSTypeFeedbackTable(Zone* zone);
-
-  void Record(Node* node, TypeFeedbackId id);
-  void Record(Node* node, FeedbackVectorSlot slot);
-
- private:
-  friend class JSTypeFeedbackSpecializer;
-  typedef std::map<NodeId, TypeFeedbackId, std::less<NodeId>,
-                   zone_allocator<TypeFeedbackId> > TypeFeedbackIdMap;
-  typedef std::map<NodeId, FeedbackVectorSlot, std::less<NodeId>,
-                   zone_allocator<FeedbackVectorSlot> > FeedbackVectorSlotMap;
-
-  TypeFeedbackIdMap type_feedback_id_map_;
-  FeedbackVectorSlotMap feedback_vector_slot_map_;
-
-  TypeFeedbackId FindTypeFeedbackId(Node* node) {
-    TypeFeedbackIdMap::const_iterator it =
-        type_feedback_id_map_.find(node->id());
-    return it == type_feedback_id_map_.end() ? TypeFeedbackId::None()
-                                             : it->second;
-  }
-
-  FeedbackVectorSlot FindFeedbackVectorSlot(Node* node) {
-    FeedbackVectorSlotMap::const_iterator it =
-        feedback_vector_slot_map_.find(node->id());
-    return it == feedback_vector_slot_map_.end() ? FeedbackVectorSlot::Invalid()
-                                                 : it->second;
-  }
-};
-
-
-// Specializes a graph to the type feedback recorded in the
-// {js_type_feedback} provided to the constructor.
-class JSTypeFeedbackSpecializer : public AdvancedReducer {
- public:
-  enum DeoptimizationMode { kDeoptimizationEnabled, kDeoptimizationDisabled };
-
-  JSTypeFeedbackSpecializer(Editor* editor, JSGraph* jsgraph,
-                            JSTypeFeedbackTable* js_type_feedback,
-                            TypeFeedbackOracle* oracle,
-                            Handle<GlobalObject> global_object,
-                            DeoptimizationMode mode,
-                            CompilationDependencies* dependencies)
-      : AdvancedReducer(editor),
-        jsgraph_(jsgraph),
-        js_type_feedback_(js_type_feedback),
-        oracle_(oracle),
-        global_object_(global_object),
-        mode_(mode),
-        dependencies_(dependencies) {
-    CHECK_NOT_NULL(js_type_feedback);
-  }
-
-  Reduction Reduce(Node* node) override;
-
-  // Visible for unit testing.
-  Reduction ReduceJSLoadGlobal(Node* node);
-  Reduction ReduceJSLoadNamed(Node* node);
-  Reduction ReduceJSLoadProperty(Node* node);
-  Reduction ReduceJSStoreNamed(Node* node);
-  Reduction ReduceJSStoreProperty(Node* node);
-
- private:
-  JSGraph* jsgraph_;
-  JSTypeFeedbackTable* js_type_feedback_;
-  TypeFeedbackOracle* oracle_;
-  Handle<GlobalObject> global_object_;
-  DeoptimizationMode const mode_;
-  CompilationDependencies* dependencies_;
-
-  TypeFeedbackOracle* oracle() { return oracle_; }
-  Graph* graph() { return jsgraph_->graph(); }
-  JSGraph* jsgraph() { return jsgraph_; }
-  CommonOperatorBuilder* common() { return jsgraph_->common(); }
-  SimplifiedOperatorBuilder* simplified() { return jsgraph_->simplified(); }
-  DeoptimizationMode mode() const { return mode_; }
-
-  void BuildMapCheck(Node* receiver, Handle<Map> map, bool smi_check,
-                     Node* effect, Node* control, Node** success, Node** fail);
-
-  Node* GetFrameStateBefore(Node* node);
-};
-
-}  // namespace compiler
-}  // namespace internal
-}  // namespace v8
-
-#endif

src/compiler/pipeline.cc

@@ -34,8 +34,6 @@
 #include "src/compiler/js-inlining-heuristic.h"
 #include "src/compiler/js-intrinsic-lowering.h"
 #include "src/compiler/js-native-context-specialization.h"
-#include "src/compiler/js-type-feedback.h"
-#include "src/compiler/js-type-feedback-lowering.h"
 #include "src/compiler/js-typed-lowering.h"
 #include "src/compiler/jump-threading.h"
 #include "src/compiler/live-range-separator.h"
@@ -89,7 +87,6 @@ class PipelineData {
         common_(nullptr),
         javascript_(nullptr),
         jsgraph_(nullptr),
-        js_type_feedback_(nullptr),
         schedule_(nullptr),
         instruction_zone_scope_(zone_pool_),
         instruction_zone_(instruction_zone_scope_.zone()),
@@ -131,7 +128,6 @@ class PipelineData {
         common_(nullptr),
         javascript_(nullptr),
         jsgraph_(nullptr),
-        js_type_feedback_(nullptr),
         schedule_(schedule),
         instruction_zone_scope_(zone_pool_),
         instruction_zone_(instruction_zone_scope_.zone()),
@@ -160,7 +156,6 @@ class PipelineData {
         common_(nullptr),
         javascript_(nullptr),
         jsgraph_(nullptr),
-        js_type_feedback_(nullptr),
         schedule_(nullptr),
         instruction_zone_scope_(zone_pool_),
         instruction_zone_(sequence->zone()),
@@ -200,10 +195,6 @@ class PipelineData {
   CommonOperatorBuilder* common() const { return common_; }
   JSOperatorBuilder* javascript() const { return javascript_; }
   JSGraph* jsgraph() const { return jsgraph_; }
-  JSTypeFeedbackTable* js_type_feedback() { return js_type_feedback_; }
-  void set_js_type_feedback(JSTypeFeedbackTable* js_type_feedback) {
-    js_type_feedback_ = js_type_feedback;
-  }
 
   LoopAssignmentAnalysis* loop_assignment() const { return loop_assignment_; }
   void set_loop_assignment(LoopAssignmentAnalysis* loop_assignment) {
@@ -240,7 +231,6 @@ class PipelineData {
     common_ = nullptr;
     javascript_ = nullptr;
     jsgraph_ = nullptr;
-    js_type_feedback_ = nullptr;
     schedule_ = nullptr;
   }
 
@@ -308,7 +298,6 @@ class PipelineData {
   CommonOperatorBuilder* common_;
   JSOperatorBuilder* javascript_;
   JSGraph* jsgraph_;
-  JSTypeFeedbackTable* js_type_feedback_;
   Schedule* schedule_;
 
   // All objects in the following group of fields are allocated in
@@ -366,10 +355,8 @@ class AstGraphBuilderWithPositions final : public AstGraphBuilder {
   AstGraphBuilderWithPositions(Zone* local_zone, CompilationInfo* info,
                                JSGraph* jsgraph,
                                LoopAssignmentAnalysis* loop_assignment,
-                               JSTypeFeedbackTable* js_type_feedback,
                                SourcePositionTable* source_positions)
-      : AstGraphBuilder(local_zone, info, jsgraph, loop_assignment,
-                        js_type_feedback),
+      : AstGraphBuilder(local_zone, info, jsgraph, loop_assignment),
         source_positions_(source_positions),
         start_position_(info->shared_info()->start_position()) {}
 
@@ -493,7 +480,7 @@ struct GraphBuilderPhase {
     } else {
       AstGraphBuilderWithPositions graph_builder(
           temp_zone, data->info(), data->jsgraph(), data->loop_assignment(),
-          data->js_type_feedback(), data->source_positions());
+          data->source_positions());
       succeeded = graph_builder.CreateGraph(stack_check);
     }
 
@@ -583,34 +570,6 @@ struct OsrDeconstructionPhase {
 };
 
 
-struct JSTypeFeedbackPhase {
-  static const char* phase_name() { return "type feedback specializing"; }
-
-  void Run(PipelineData* data, Zone* temp_zone) {
-    Handle<Context> native_context(data->info()->context()->native_context());
-    TypeFeedbackOracle oracle(data->isolate(), temp_zone,
-                              data->info()->unoptimized_code(),
-                              data->info()->feedback_vector(), native_context);
-    JSGraphReducer graph_reducer(data->jsgraph(), temp_zone);
-    Handle<GlobalObject> global_object = Handle<GlobalObject>::null();
-    if (data->info()->has_global_object()) {
-      global_object =
-          Handle<GlobalObject>(data->info()->global_object(), data->isolate());
-    }
-    // TODO(titzer): introduce a specialization mode/flags enum to control
-    // specializing to the global object here.
-    JSTypeFeedbackSpecializer specializer(
-        &graph_reducer, data->jsgraph(), data->js_type_feedback(), &oracle,
-        global_object, data->info()->is_deoptimization_enabled()
-                           ? JSTypeFeedbackSpecializer::kDeoptimizationEnabled
-                           : JSTypeFeedbackSpecializer::kDeoptimizationDisabled,
-        data->info()->dependencies());
-    AddReducer(data, &graph_reducer, &specializer);
-    graph_reducer.ReduceGraph();
-  }
-};
-
-
 struct TypedLoweringPhase {
   static const char* phase_name() { return "typed lowering"; }
 
@@ -621,11 +580,6 @@ struct TypedLoweringPhase {
     LoadElimination load_elimination(&graph_reducer);
     JSBuiltinReducer builtin_reducer(&graph_reducer, data->jsgraph());
     JSTypedLowering typed_lowering(&graph_reducer, data->jsgraph(), temp_zone);
-    JSTypeFeedbackLowering type_feedback_lowering(
-        &graph_reducer, data->info()->is_deoptimization_enabled()
-                            ? JSTypeFeedbackLowering::kDeoptimizationEnabled
-                            : JSTypeFeedbackLowering::kNoFlags,
-        data->jsgraph());
     JSIntrinsicLowering intrinsic_lowering(
         &graph_reducer, data->jsgraph(),
         data->info()->is_deoptimization_enabled()
@@ -637,7 +591,6 @@ struct TypedLoweringPhase {
     AddReducer(data, &graph_reducer, &builtin_reducer);
     AddReducer(data, &graph_reducer, &typed_lowering);
     AddReducer(data, &graph_reducer, &intrinsic_lowering);
-    AddReducer(data, &graph_reducer, &type_feedback_lowering);
     AddReducer(data, &graph_reducer, &load_elimination);
     AddReducer(data, &graph_reducer, &common_reducer);
     graph_reducer.ReduceGraph();
@@ -1095,11 +1048,6 @@ Handle<Code> Pipeline::GenerateCode() {
   PipelineData data(&zone_pool, info(), pipeline_statistics.get());
   this->data_ = &data;
 
-  if (info()->is_type_feedback_enabled()) {
-    data.set_js_type_feedback(new (data.graph_zone())
-                                  JSTypeFeedbackTable(data.graph_zone()));
-  }
-
   BeginPhaseKind("graph creation");
 
   if (FLAG_trace_turbo) {
@@ -1166,11 +1114,6 @@ Handle<Code> Pipeline::GenerateCode() {
       RunPrintAndVerify("Loop peeled");
     }
 
-    if (info()->is_type_feedback_enabled()) {
-      Run<JSTypeFeedbackPhase>();
-      RunPrintAndVerify("JSType feedback");
-    }
-
     // Lower simplified operators and insert changes.
     Run<SimplifiedLoweringPhase>();
     RunPrintAndVerify("Lowered simplified");

src/flag-definitions.h

@@ -430,7 +430,6 @@ DEFINE_BOOL(turbo_verify, DEBUG_BOOL, "verify TurboFan graphs at each phase")
 DEFINE_BOOL(turbo_stats, false, "print TurboFan statistics")
 DEFINE_BOOL(turbo_splitting, true, "split nodes during scheduling in TurboFan")
 DEFINE_BOOL(turbo_types, true, "use typed lowering in TurboFan")
-DEFINE_BOOL(turbo_type_feedback, false, "use type feedback in TurboFan")
 DEFINE_BOOL(turbo_source_positions, false,
             "track source code positions when building TurboFan IR")
 DEFINE_IMPLICATION(trace_turbo, turbo_source_positions)

test/unittests/unittests.gyp

@@ -70,7 +70,6 @@
         'compiler/js-intrinsic-lowering-unittest.cc',
         'compiler/js-operator-unittest.cc',
         'compiler/js-typed-lowering-unittest.cc',
-        'compiler/js-type-feedback-unittest.cc',
         'compiler/linkage-tail-call-unittest.cc',
         'compiler/liveness-analyzer-unittest.cc',
         'compiler/live-range-unittest.cc',

tools/gyp/v8.gyp

@@ -534,10 +534,6 @@
         '../../src/compiler/js-native-context-specialization.h',
         '../../src/compiler/js-operator.cc',
         '../../src/compiler/js-operator.h',
-        '../../src/compiler/js-type-feedback.cc',
-        '../../src/compiler/js-type-feedback.h',
-        '../../src/compiler/js-type-feedback-lowering.cc',
-        '../../src/compiler/js-type-feedback-lowering.h',
         '../../src/compiler/js-typed-lowering.cc',
         '../../src/compiler/js-typed-lowering.h',
         '../../src/compiler/jump-threading.cc',