[turbofan] Remove four direct uses of InferReceiverMaps

... from JSNativeContextSpecialization.

Bug: v8:9197
Change-Id: I332ba27e78b0c10b3406cf39e9a2178c8c74fede
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1593339
Commit-Queue: Georg Neis <neis@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61201}

src/compiler/js-call-reducer.cc

@@ -416,7 +416,7 @@ Reduction JSCallReducer::ReduceFunctionPrototypeBind(Node* node) {
   // seen for the {receiver} so far indicate that {receiver} is
   // definitely a constructor or not a constructor.
   MapInference inference(broker(), receiver, effect);
-  if (!inference.HaveMaps()) return inference.NoChange();
+  if (!inference.HaveMaps()) return NoChange();
   MapHandles const& receiver_maps = inference.GetMaps();
 
   MapRef first_receiver_map(broker(), receiver_maps[0]);
@@ -576,7 +576,7 @@ Reduction JSCallReducer::ReduceObjectGetPrototype(Node* node, Node* object) {
 
   // Try to determine the {object} map.
   MapInference inference(broker(), object, effect);
-  if (!inference.HaveMaps()) return inference.NoChange();
+  if (!inference.HaveMaps()) return NoChange();
   MapHandles const& object_maps = inference.GetMaps();
 
   MapRef candidate_map(broker(), object_maps[0]);
@@ -729,7 +729,7 @@ Reduction JSCallReducer::ReduceObjectPrototypeIsPrototypeOf(Node* node) {
   // the ToObject step of Object.prototype.isPrototypeOf is a no-op).
   MapInference inference(broker(), receiver, effect);
   if (!inference.HaveMaps() || !inference.AllOfInstanceTypesAreJSReceiver()) {
-    return inference.NoChange();
+    return NoChange();
   }
 
   // We don't check whether {value} is a proper JSReceiver here explicitly,
@@ -1051,7 +1051,7 @@ Reduction JSCallReducer::ReduceArrayForEach(
 
   // Try to determine the {receiver} map.
   MapInference inference(broker(), receiver, effect);
-  if (!inference.HaveMaps()) return inference.NoChange();
+  if (!inference.HaveMaps()) return NoChange();
   MapHandles const& receiver_maps = inference.GetMaps();
 
   ElementsKind kind;
@@ -1215,7 +1215,7 @@ Reduction JSCallReducer::ReduceArrayReduce(
 
   // Try to determine the {receiver} map.
   MapInference inference(broker(), receiver, effect);
-  if (!inference.HaveMaps()) return inference.NoChange();
+  if (!inference.HaveMaps()) return NoChange();
   MapHandles const& receiver_maps = inference.GetMaps();
 
   ElementsKind kind;
@@ -1475,7 +1475,7 @@ Reduction JSCallReducer::ReduceArrayMap(Node* node,
 
   // Try to determine the {receiver} map.
   MapInference inference(broker(), receiver, effect);
-  if (!inference.HaveMaps()) return inference.NoChange();
+  if (!inference.HaveMaps()) return NoChange();
   MapHandles const& receiver_maps = inference.GetMaps();
 
   ElementsKind kind;
@@ -1667,7 +1667,7 @@ Reduction JSCallReducer::ReduceArrayFilter(
 
   // Try to determine the {receiver} map.
   MapInference inference(broker(), receiver, effect);
-  if (!inference.HaveMaps()) return inference.NoChange();
+  if (!inference.HaveMaps()) return NoChange();
   MapHandles const& receiver_maps = inference.GetMaps();
 
   ElementsKind kind;
@@ -1924,7 +1924,7 @@ Reduction JSCallReducer::ReduceArrayFind(Node* node, ArrayFindVariant variant,
 
   // Try to determine the {receiver} map.
   MapInference inference(broker(), receiver, effect);
-  if (!inference.HaveMaps()) return inference.NoChange();
+  if (!inference.HaveMaps()) return NoChange();
   MapHandles const& receiver_maps = inference.GetMaps();
 
   ElementsKind kind;
@@ -2221,7 +2221,7 @@ Reduction JSCallReducer::ReduceArrayEvery(Node* node,
 
   // Try to determine the {receiver} map.
   MapInference inference(broker(), receiver, effect);
-  if (!inference.HaveMaps()) return inference.NoChange();
+  if (!inference.HaveMaps()) return NoChange();
   MapHandles const& receiver_maps = inference.GetMaps();
 
   ElementsKind kind;
@@ -2464,7 +2464,7 @@ Reduction JSCallReducer::ReduceArrayIndexOfIncludes(
   Node* control = NodeProperties::GetControlInput(node);
 
   MapInference inference(broker(), receiver, effect);
-  if (!inference.HaveMaps()) return inference.NoChange();
+  if (!inference.HaveMaps()) return NoChange();
   MapHandles const& receiver_maps = inference.GetMaps();
 
   ElementsKind kind;
@@ -2546,7 +2546,7 @@ Reduction JSCallReducer::ReduceArraySome(Node* node,
 
   // Try to determine the {receiver} map.
   MapInference inference(broker(), receiver, effect);
-  if (!inference.HaveMaps()) return inference.NoChange();
+  if (!inference.HaveMaps()) return NoChange();
   MapHandles const& receiver_maps = inference.GetMaps();
 
   ElementsKind kind;
@@ -4241,7 +4241,7 @@ Reduction JSCallReducer::ReduceArrayPrototypePush(Node* node) {
   Node* control = NodeProperties::GetControlInput(node);
 
   MapInference inference(broker(), receiver, effect);
-  if (!inference.HaveMaps()) return inference.NoChange();
+  if (!inference.HaveMaps()) return NoChange();
   MapHandles const& receiver_maps = inference.GetMaps();
 
   ElementsKind kind;
@@ -4334,7 +4334,7 @@ Reduction JSCallReducer::ReduceArrayPrototypePop(Node* node) {
   Node* control = NodeProperties::GetControlInput(node);
 
   MapInference inference(broker(), receiver, effect);
-  if (!inference.HaveMaps()) return inference.NoChange();
+  if (!inference.HaveMaps()) return NoChange();
   MapHandles const& receiver_maps = inference.GetMaps();
 
   ElementsKind kind;
@@ -4432,7 +4432,7 @@ Reduction JSCallReducer::ReduceArrayPrototypeShift(Node* node) {
   Node* control = NodeProperties::GetControlInput(node);
 
   MapInference inference(broker(), receiver, effect);
-  if (!inference.HaveMaps()) return inference.NoChange();
+  if (!inference.HaveMaps()) return NoChange();
   MapHandles const& receiver_maps = inference.GetMaps();
 
   ElementsKind kind;
@@ -4621,7 +4621,7 @@ Reduction JSCallReducer::ReduceArrayPrototypeSlice(Node* node) {
   }
 
   MapInference inference(broker(), receiver, effect);
-  if (!inference.HaveMaps()) return inference.NoChange();
+  if (!inference.HaveMaps()) return NoChange();
   MapHandles const& receiver_maps = inference.GetMaps();
 
   // Check that the maps are of JSArray (and more).
@@ -4702,7 +4702,7 @@ Reduction JSCallReducer::ReduceArrayIterator(Node* node, IterationKind kind) {
   // Check if we know that {receiver} is a valid JSReceiver.
   MapInference inference(broker(), receiver, effect);
   if (!inference.HaveMaps() || !inference.AllOfInstanceTypesAreJSReceiver()) {
-    return inference.NoChange();
+    return NoChange();
   }
 
   // Morph the {node} into a JSCreateArrayIterator with the given {kind}.
@@ -4737,7 +4737,7 @@ Reduction JSCallReducer::ReduceArrayIteratorPrototypeNext(Node* node) {
   Node* iterator_effect = NodeProperties::GetEffectInput(iterator);
 
   MapInference inference(broker(), iterated_object, iterator_effect);
-  if (!inference.HaveMaps()) return inference.NoChange();
+  if (!inference.HaveMaps()) return NoChange();
   MapHandles const& iterated_object_maps = inference.GetMaps();
 
   // Check that various {iterated_object_maps} have compatible elements kinds.
@@ -5163,7 +5163,7 @@ Reduction JSCallReducer::ReduceStringIteratorPrototypeNext(Node* node) {
   MapInference inference(broker(), receiver, effect);
   if (!inference.HaveMaps() ||
       !inference.AllOfInstanceTypesAre(JS_STRING_ITERATOR_TYPE)) {
-    return inference.NoChange();
+    return NoChange();
   }
 
   Node* string = effect = graph()->NewNode(
@@ -5536,7 +5536,7 @@ Reduction JSCallReducer::ReducePromisePrototypeCatch(Node* node) {
   Node* control = NodeProperties::GetControlInput(node);
 
   MapInference inference(broker(), receiver, effect);
-  if (!inference.HaveMaps()) return inference.NoChange();
+  if (!inference.HaveMaps()) return NoChange();
   MapHandles const& receiver_maps = inference.GetMaps();
 
   // Check whether all {receiver_maps} are JSPromise maps and
@@ -5589,7 +5589,7 @@ Reduction JSCallReducer::ReducePromisePrototypeFinally(Node* node) {
   }
 
   MapInference inference(broker(), receiver, effect);
-  if (!inference.HaveMaps()) return inference.NoChange();
+  if (!inference.HaveMaps()) return NoChange();
   MapHandles const& receiver_maps = inference.GetMaps();
 
   // Check whether all {receiver_maps} are JSPromise maps and
@@ -5728,7 +5728,7 @@ Reduction JSCallReducer::ReducePromisePrototypeThen(Node* node) {
   Node* frame_state = NodeProperties::GetFrameStateInput(node);
 
   MapInference inference(broker(), receiver, effect);
-  if (!inference.HaveMaps()) return inference.NoChange();
+  if (!inference.HaveMaps()) return NoChange();
   MapHandles const& receiver_maps = inference.GetMaps();
 
   // Check whether all {receiver_maps} are JSPromise maps and
@@ -5801,7 +5801,7 @@ Reduction JSCallReducer::ReducePromiseResolveTrampoline(Node* node) {
   // Only reduce when the receiver is guaranteed to be a JSReceiver.
   MapInference inference(broker(), receiver, effect);
   if (!inference.HaveMaps() || !inference.AllOfInstanceTypesAreJSReceiver()) {
-    return inference.NoChange();
+    return NoChange();
   }
 
   // Morph the {node} into a JSPromiseResolve operation.
@@ -5990,7 +5990,7 @@ Reduction JSCallReducer::ReduceMapPrototypeGet(Node* node) {
 
   MapInference inference(broker(), receiver, effect);
   if (!inference.HaveMaps() || !inference.AllOfInstanceTypesAre(JS_MAP_TYPE)) {
-    return inference.NoChange();
+    return NoChange();
   }
 
   Node* table = effect = graph()->NewNode(
@@ -6036,7 +6036,7 @@ Reduction JSCallReducer::ReduceMapPrototypeHas(Node* node) {
 
   MapInference inference(broker(), receiver, effect);
   if (!inference.HaveMaps() || !inference.AllOfInstanceTypesAre(JS_MAP_TYPE)) {
-    return inference.NoChange();
+    return NoChange();
   }
 
   Node* table = effect = graph()->NewNode(
@@ -6079,7 +6079,7 @@ Reduction JSCallReducer::ReduceCollectionIteration(
   InstanceType type = InstanceTypeForCollectionKind(collection_kind);
   MapInference inference(broker(), receiver, effect);
   if (!inference.HaveMaps() || !inference.AllOfInstanceTypesAre(type)) {
-    return inference.NoChange();
+    return NoChange();
   }
 
   Node* js_create_iterator = effect = graph()->NewNode(
@@ -6099,7 +6099,7 @@ Reduction JSCallReducer::ReduceCollectionPrototypeSize(
   InstanceType type = InstanceTypeForCollectionKind(collection_kind);
   MapInference inference(broker(), receiver, effect);
   if (!inference.HaveMaps() || !inference.AllOfInstanceTypesAre(type)) {
-    return inference.NoChange();
+    return NoChange();
   }
 
   Node* table = effect = graph()->NewNode(
@@ -6138,7 +6138,7 @@ Reduction JSCallReducer::ReduceCollectionIteratorPrototypeNext(
   InstanceType receiver_instance_type;
   {
     MapInference inference(broker(), receiver, effect);
-    if (!inference.HaveMaps()) return inference.NoChange();
+    if (!inference.HaveMaps()) return NoChange();
     MapHandles const& receiver_maps = inference.GetMaps();
     receiver_instance_type = receiver_maps[0]->instance_type();
     for (size_t i = 1; i < receiver_maps.size(); ++i) {
@@ -6423,7 +6423,7 @@ Reduction JSCallReducer::ReduceArrayBufferViewAccessor(
   MapInference inference(broker(), receiver, effect);
   if (!inference.HaveMaps() ||
       !inference.AllOfInstanceTypesAre(instance_type)) {
-    return inference.NoChange();
+    return NoChange();
   }
 
   // Load the {receiver}s field.
@@ -6506,7 +6506,7 @@ Reduction JSCallReducer::ReduceDataViewAccess(Node* node, DataViewAccess access,
   MapInference inference(broker(), receiver, effect);
   if (!inference.HaveMaps() ||
       !inference.AllOfInstanceTypesAre(JS_DATA_VIEW_TYPE)) {
-    return inference.NoChange();
+    return NoChange();
   }
 
   Node* byte_offset;
@@ -6677,7 +6677,7 @@ Reduction JSCallReducer::ReduceDatePrototypeGetTime(Node* node) {
 
   MapInference inference(broker(), receiver, effect);
   if (!inference.HaveMaps() || !inference.AllOfInstanceTypesAre(JS_DATE_TYPE)) {
-    return inference.NoChange();
+    return NoChange();
   }
 
   Node* value = effect =

src/compiler/js-native-context-specialization.cc

@@ -14,6 +14,7 @@
 #include "src/compiler/js-graph.h"
 #include "src/compiler/js-operator.h"
 #include "src/compiler/linkage.h"
+#include "src/compiler/map-inference.h"
 #include "src/compiler/node-matchers.h"
 #include "src/compiler/property-access-builder.h"
 #include "src/compiler/type-cache.h"
@@ -669,16 +670,11 @@ Reduction JSNativeContextSpecialization::ReduceJSPromiseResolve(Node* node) {
     return NoChange();
   }
 
-  // Check if we know something about the {value}.
-  ZoneHandleSet<Map> value_maps;
-  NodeProperties::InferReceiverMapsResult result =
-      NodeProperties::InferReceiverMaps(broker(), value, effect, &value_maps);
-  if (result == NodeProperties::kNoReceiverMaps) return NoChange();
-  DCHECK_NE(0, value_maps.size());
-
-  // Check that the {value} cannot be a JSPromise.
-  for (Handle<Map> const value_map : value_maps) {
-    if (value_map->IsJSPromiseMap()) return NoChange();
+  // Only optimize if {value} cannot be a JSPromise.
+  MapInference inference(broker(), value, effect);
+  if (!inference.HaveMaps() ||
+      inference.AnyOfInstanceTypesAre(JS_PROMISE_TYPE)) {
+    return NoChange();
   }
 
   if (!dependencies()->DependOnPromiseHookProtector()) return NoChange();
@@ -702,20 +698,9 @@ Reduction JSNativeContextSpecialization::ReduceJSResolvePromise(Node* node) {
   Node* control = NodeProperties::GetControlInput(node);
 
   // Check if we know something about the {resolution}.
-  ZoneHandleSet<Map> resolution_maps;
-  NodeProperties::InferReceiverMapsResult result =
-      NodeProperties::InferReceiverMaps(broker(), resolution, effect,
-                                        &resolution_maps);
-  if (result == NodeProperties::kNoReceiverMaps) return NoChange();
-  DCHECK_NE(0, resolution_maps.size());
-
-  // When the {resolution_maps} information is unreliable, we can
-  // still optimize if all individual {resolution_maps} are stable.
-  if (result == NodeProperties::kUnreliableReceiverMaps) {
-    for (Handle<Map> resolution_map : resolution_maps) {
-      if (!resolution_map->is_stable()) return NoChange();
-    }
-  }
+  MapInference inference(broker(), resolution, effect);
+  if (!inference.HaveMaps()) return NoChange();
+  MapHandles const& resolution_maps = inference.GetMaps();
 
   // Compute property access info for "then" on {resolution}.
   PropertyAccessInfo access_info;
@@ -724,21 +709,22 @@ Reduction JSNativeContextSpecialization::ReduceJSResolvePromise(Node* node) {
     AccessInfoFactory access_info_factory(broker(), dependencies(),
                                           graph()->zone());
     access_info_factory.ComputePropertyAccessInfos(
-        MapHandles(resolution_maps.begin(), resolution_maps.end()),
-        factory()->then_string(), AccessMode::kLoad, &access_infos);
+        resolution_maps, factory()->then_string(), AccessMode::kLoad,
+        &access_infos);
     access_info = access_info_factory.FinalizePropertyAccessInfosAsOne(
         access_infos, AccessMode::kLoad);
   }
-  if (access_info.IsInvalid()) return NoChange();
+  if (access_info.IsInvalid()) return inference.NoChange();
+
+  // Only optimize when {resolution} definitely doesn't have a "then" property.
+  if (!access_info.IsNotFound()) return inference.NoChange();
 
-  // We can further optimize the case where {resolution}
-  // definitely doesn't have a "then" property.
-  if (!access_info.IsNotFound()) return NoChange();
+  if (!inference.RelyOnMapsViaStability(dependencies())) {
+    return inference.NoChange();
+  }
 
-  dependencies()->DependOnStablePrototypeChains(
-      access_info.receiver_maps(),
-      result == NodeProperties::kUnreliableReceiverMaps ? kStartAtReceiver
-                                                        : kStartAtPrototype);
+  dependencies()->DependOnStablePrototypeChains(access_info.receiver_maps(),
+                                                kStartAtPrototype);
 
   // Simply fulfill the {promise} with the {resolution}.
   Node* value = effect =
@@ -2528,14 +2514,9 @@ Reduction JSNativeContextSpecialization::ReduceJSToObject(Node* node) {
   Node* receiver = NodeProperties::GetValueInput(node, 0);
   Node* effect = NodeProperties::GetEffectInput(node);
 
-  ZoneHandleSet<Map> receiver_maps;
-  NodeProperties::InferReceiverMapsResult result =
-      NodeProperties::InferReceiverMaps(broker(), receiver, effect,
-                                        &receiver_maps);
-  if (result == NodeProperties::kNoReceiverMaps) return NoChange();
-
-  for (size_t i = 0; i < receiver_maps.size(); ++i) {
-    if (!receiver_maps[i]->IsJSReceiverMap()) return NoChange();
+  MapInference inference(broker(), receiver, effect);
+  if (!inference.HaveMaps() || !inference.AllOfInstanceTypesAreJSReceiver()) {
+    return NoChange();
   }
 
   ReplaceWithValue(node, receiver, effect);

src/compiler/map-inference.cc

@@ -52,6 +52,12 @@ bool MapInference::AllOfInstanceTypesAre(InstanceType type) const {
       [type](InstanceType other) { return type == other; });
 }
 
+bool MapInference::AnyOfInstanceTypesAre(InstanceType type) const {
+  CHECK(!InstanceTypeChecker::IsString(type));
+  return AnyOfInstanceTypesUnsafe(
+      [type](InstanceType other) { return type == other; });
+}
+
 bool MapInference::AllOfInstanceTypes(std::function<bool(InstanceType)> f) {
   SetNeedGuardIfUnreliable();
   return AllOfInstanceTypesUnsafe(f);
@@ -64,6 +70,13 @@ bool MapInference::AllOfInstanceTypesUnsafe(
                      [f](Handle<Map> map) { return f(map->instance_type()); });
 }
 
+bool MapInference::AnyOfInstanceTypesUnsafe(
+    std::function<bool(InstanceType)> f) const {
+  CHECK(HaveMaps());
+  return std::any_of(maps_.begin(), maps_.end(),
+                     [f](Handle<Map> map) { return f(map->instance_type()); });
+}
+
 MapHandles const& MapInference::GetMaps() {
   SetNeedGuardIfUnreliable();
   return maps_;

src/compiler/map-inference.h

@@ -48,6 +48,7 @@ class MapInference {
   V8_WARN_UNUSED_RESULT bool AllOfInstanceTypesAreJSReceiver() const;
   // Here, {type} must not be a String type.
   V8_WARN_UNUSED_RESULT bool AllOfInstanceTypesAre(InstanceType type) const;
+  V8_WARN_UNUSED_RESULT bool AnyOfInstanceTypesAre(InstanceType type) const;
 
   // These queries require a guard. (Even instance types are generally not
   // reliable because of how the representation of a string can change.)
@@ -93,6 +94,8 @@ class MapInference {
 
   V8_WARN_UNUSED_RESULT bool AllOfInstanceTypesUnsafe(
       std::function<bool(InstanceType)> f) const;
+  V8_WARN_UNUSED_RESULT bool AnyOfInstanceTypesUnsafe(
+      std::function<bool(InstanceType)> f) const;
   V8_WARN_UNUSED_RESULT bool RelyOnMapsHelper(
       CompilationDependencies* dependencies, JSGraph* jsgraph, Node** effect,
       Node* control, const VectorSlotPair& feedback);