[turbofan] Remove four direct uses of InferReceiverMaps

... from JSNativeContextSpecialization.

Bug: v8:9197
Change-Id: I332ba27e78b0c10b3406cf39e9a2178c8c74fede
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1593339
Commit-Queue: Georg Neis <neis@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61201}

src/compiler/js-native-context-specialization.cc

@@ -14,6 +14,7 @@
 #include "src/compiler/js-graph.h"
 #include "src/compiler/js-operator.h"
 #include "src/compiler/linkage.h"
+#include "src/compiler/map-inference.h"
 #include "src/compiler/node-matchers.h"
 #include "src/compiler/property-access-builder.h"
 #include "src/compiler/type-cache.h"
@@ -669,16 +670,11 @@ Reduction JSNativeContextSpecialization::ReduceJSPromiseResolve(Node* node) {
     return NoChange();
   }
 
-  // Check if we know something about the {value}.
-  ZoneHandleSet<Map> value_maps;
-  NodeProperties::InferReceiverMapsResult result =
-      NodeProperties::InferReceiverMaps(broker(), value, effect, &value_maps);
-  if (result == NodeProperties::kNoReceiverMaps) return NoChange();
-  DCHECK_NE(0, value_maps.size());
-
-  // Check that the {value} cannot be a JSPromise.
-  for (Handle<Map> const value_map : value_maps) {
-    if (value_map->IsJSPromiseMap()) return NoChange();
+  // Only optimize if {value} cannot be a JSPromise.
+  MapInference inference(broker(), value, effect);
+  if (!inference.HaveMaps() ||
+      inference.AnyOfInstanceTypesAre(JS_PROMISE_TYPE)) {
+    return NoChange();
   }
 
   if (!dependencies()->DependOnPromiseHookProtector()) return NoChange();
@@ -702,20 +698,9 @@ Reduction JSNativeContextSpecialization::ReduceJSResolvePromise(Node* node) {
   Node* control = NodeProperties::GetControlInput(node);
 
   // Check if we know something about the {resolution}.
-  ZoneHandleSet<Map> resolution_maps;
-  NodeProperties::InferReceiverMapsResult result =
-      NodeProperties::InferReceiverMaps(broker(), resolution, effect,
-                                        &resolution_maps);
-  if (result == NodeProperties::kNoReceiverMaps) return NoChange();
-  DCHECK_NE(0, resolution_maps.size());
-
-  // When the {resolution_maps} information is unreliable, we can
-  // still optimize if all individual {resolution_maps} are stable.
-  if (result == NodeProperties::kUnreliableReceiverMaps) {
-    for (Handle<Map> resolution_map : resolution_maps) {
-      if (!resolution_map->is_stable()) return NoChange();
-    }
-  }
+  MapInference inference(broker(), resolution, effect);
+  if (!inference.HaveMaps()) return NoChange();
+  MapHandles const& resolution_maps = inference.GetMaps();
 
   // Compute property access info for "then" on {resolution}.
   PropertyAccessInfo access_info;
@@ -724,21 +709,22 @@ Reduction JSNativeContextSpecialization::ReduceJSResolvePromise(Node* node) {
     AccessInfoFactory access_info_factory(broker(), dependencies(),
                                           graph()->zone());
     access_info_factory.ComputePropertyAccessInfos(
-        MapHandles(resolution_maps.begin(), resolution_maps.end()),
-        factory()->then_string(), AccessMode::kLoad, &access_infos);
+        resolution_maps, factory()->then_string(), AccessMode::kLoad,
+        &access_infos);
     access_info = access_info_factory.FinalizePropertyAccessInfosAsOne(
         access_infos, AccessMode::kLoad);
   }
-  if (access_info.IsInvalid()) return NoChange();
+  if (access_info.IsInvalid()) return inference.NoChange();
+
+  // Only optimize when {resolution} definitely doesn't have a "then" property.
+  if (!access_info.IsNotFound()) return inference.NoChange();
 
-  // We can further optimize the case where {resolution}
-  // definitely doesn't have a "then" property.
-  if (!access_info.IsNotFound()) return NoChange();
+  if (!inference.RelyOnMapsViaStability(dependencies())) {
+    return inference.NoChange();
+  }
 
-  dependencies()->DependOnStablePrototypeChains(
-      access_info.receiver_maps(),
-      result == NodeProperties::kUnreliableReceiverMaps ? kStartAtReceiver
-                                                        : kStartAtPrototype);
+  dependencies()->DependOnStablePrototypeChains(access_info.receiver_maps(),
+                                                kStartAtPrototype);
 
   // Simply fulfill the {promise} with the {resolution}.
   Node* value = effect =
@@ -2528,14 +2514,9 @@ Reduction JSNativeContextSpecialization::ReduceJSToObject(Node* node) {
   Node* receiver = NodeProperties::GetValueInput(node, 0);
   Node* effect = NodeProperties::GetEffectInput(node);
 
-  ZoneHandleSet<Map> receiver_maps;
-  NodeProperties::InferReceiverMapsResult result =
-      NodeProperties::InferReceiverMaps(broker(), receiver, effect,
-                                        &receiver_maps);
-  if (result == NodeProperties::kNoReceiverMaps) return NoChange();
-
-  for (size_t i = 0; i < receiver_maps.size(); ++i) {
-    if (!receiver_maps[i]->IsJSReceiverMap()) return NoChange();
+  MapInference inference(broker(), receiver, effect);
+  if (!inference.HaveMaps() || !inference.AllOfInstanceTypesAreJSReceiver()) {
+    return NoChange();
   }
 
   ReplaceWithValue(node, receiver, effect);

src/compiler/map-inference.cc

@@ -52,6 +52,12 @@ bool MapInference::AllOfInstanceTypesAre(InstanceType type) const {
       [type](InstanceType other) { return type == other; });
 }
 
+bool MapInference::AnyOfInstanceTypesAre(InstanceType type) const {
+  CHECK(!InstanceTypeChecker::IsString(type));
+  return AnyOfInstanceTypesUnsafe(
+      [type](InstanceType other) { return type == other; });
+}
+
 bool MapInference::AllOfInstanceTypes(std::function<bool(InstanceType)> f) {
   SetNeedGuardIfUnreliable();
   return AllOfInstanceTypesUnsafe(f);
@@ -64,6 +70,13 @@ bool MapInference::AllOfInstanceTypesUnsafe(
                      [f](Handle<Map> map) { return f(map->instance_type()); });
 }
 
+bool MapInference::AnyOfInstanceTypesUnsafe(
+    std::function<bool(InstanceType)> f) const {
+  CHECK(HaveMaps());
+  return std::any_of(maps_.begin(), maps_.end(),
+                     [f](Handle<Map> map) { return f(map->instance_type()); });
+}
+
 MapHandles const& MapInference::GetMaps() {
   SetNeedGuardIfUnreliable();
   return maps_;

src/compiler/map-inference.h

@@ -48,6 +48,7 @@ class MapInference {
   V8_WARN_UNUSED_RESULT bool AllOfInstanceTypesAreJSReceiver() const;
   // Here, {type} must not be a String type.
   V8_WARN_UNUSED_RESULT bool AllOfInstanceTypesAre(InstanceType type) const;
+  V8_WARN_UNUSED_RESULT bool AnyOfInstanceTypesAre(InstanceType type) const;
 
   // These queries require a guard. (Even instance types are generally not
   // reliable because of how the representation of a string can change.)
@@ -93,6 +94,8 @@ class MapInference {
 
   V8_WARN_UNUSED_RESULT bool AllOfInstanceTypesUnsafe(
       std::function<bool(InstanceType)> f) const;
+  V8_WARN_UNUSED_RESULT bool AnyOfInstanceTypesUnsafe(
+      std::function<bool(InstanceType)> f) const;
   V8_WARN_UNUSED_RESULT bool RelyOnMapsHelper(
       CompilationDependencies* dependencies, JSGraph* jsgraph, Node** effect,
       Node* control, const VectorSlotPair& feedback);