[turbofan] Only lower to PoisonedLoads when --branch-load-poisoning is on.

Change-Id: I618e357ea0d00b64dd4d8a54e865bed716a460e8
Bug: chromium:798964
Reviewed-on: https://chromium-review.googlesource.com/947963Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51716}

src/compiler/arm/instruction-selector-arm.cc

@@ -460,8 +460,8 @@ void InstructionSelector::VisitLoad(Node* node) {
       UNREACHABLE();
       return;
   }
-  if (node->opcode() == IrOpcode::kPoisonedLoad &&
-      load_poisoning_ == LoadPoisoning::kDoPoison) {
+  if (node->opcode() == IrOpcode::kPoisonedLoad) {
+    CHECK_EQ(load_poisoning_, LoadPoisoning::kDoPoison);
     opcode |= MiscField::encode(kMemoryAccessPoisoned);
   }
 

src/compiler/arm64/instruction-selector-arm64.cc

@@ -629,8 +629,8 @@ void InstructionSelector::VisitLoad(Node* node) {
       UNREACHABLE();
       return;
   }
-  if (node->opcode() == IrOpcode::kPoisonedLoad &&
-      load_poisoning_ == LoadPoisoning::kDoPoison) {
+  if (node->opcode() == IrOpcode::kPoisonedLoad) {
+    CHECK_EQ(load_poisoning_, LoadPoisoning::kDoPoison);
     opcode |= MiscField::encode(kMemoryAccessPoisoned);
   }
 

src/compiler/common-operator.h

@@ -511,6 +511,10 @@ class V8_EXPORT_PRIVATE CommonOperatorBuilder final
   DISALLOW_COPY_AND_ASSIGN(CommonOperatorBuilder);
 };
 
+// This should go into some common compiler header, but we do not have such a
+// thing at the moment.
+enum class LoadPoisoning { kDoPoison, kDontPoison };
+
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8

src/compiler/ia32/instruction-selector-ia32.cc

@@ -287,8 +287,8 @@ void InstructionSelector::VisitLoad(Node* node) {
   AddressingMode mode =
       g.GetEffectiveAddressMemoryOperand(node, inputs, &input_count);
   InstructionCode code = opcode | AddressingModeField::encode(mode);
-  if (node->opcode() == IrOpcode::kPoisonedLoad &&
-      load_poisoning_ == LoadPoisoning::kDoPoison) {
+  if (node->opcode() == IrOpcode::kPoisonedLoad) {
+    CHECK_EQ(load_poisoning_, LoadPoisoning::kDoPoison);
     code |= MiscField::encode(kMemoryAccessPoisoned);
   }
   Emit(code, 1, outputs, input_count, inputs);

src/compiler/instruction.h

@@ -1664,8 +1664,6 @@ struct PrintableInstructionSequence {
 V8_EXPORT_PRIVATE std::ostream& operator<<(
     std::ostream& os, const PrintableInstructionSequence& code);
 
-enum class LoadPoisoning { kDoPoison, kDontPoison };
-
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8

src/compiler/memory-optimizer.cc

@@ -15,13 +15,15 @@ namespace v8 {
 namespace internal {
 namespace compiler {
 
-MemoryOptimizer::MemoryOptimizer(JSGraph* jsgraph, Zone* zone)
+MemoryOptimizer::MemoryOptimizer(JSGraph* jsgraph, Zone* zone,
+                                 LoadPoisoning load_poisoning)
     : jsgraph_(jsgraph),
       empty_state_(AllocationState::Empty(zone)),
       pending_(zone),
       tokens_(zone),
       zone_(zone),
-      graph_assembler_(jsgraph, nullptr, nullptr, zone) {}
+      graph_assembler_(jsgraph, nullptr, nullptr, zone),
+      load_poisoning_(load_poisoning) {}
 
 void MemoryOptimizer::Optimize() {
   EnqueueUses(graph()->start(), empty_state());
@@ -348,12 +350,13 @@ void MemoryOptimizer::VisitLoadElement(Node* node,
   ElementAccess const& access = ElementAccessOf(node->op());
   Node* index = node->InputAt(1);
   node->ReplaceInput(1, ComputeIndex(access, index));
-  if (access.machine_type.representation() ==
-      MachineRepresentation::kTaggedPointer) {
-    NodeProperties::ChangeOp(node, machine()->Load(access.machine_type));
-  } else {
+  if (load_poisoning_ == LoadPoisoning::kDoPoison &&
+      access.machine_type.representation() !=
+          MachineRepresentation::kTaggedPointer) {
     NodeProperties::ChangeOp(node,
                              machine()->PoisonedLoad(access.machine_type));
+  } else {
+    NodeProperties::ChangeOp(node, machine()->Load(access.machine_type));
   }
   EnqueueUses(node, state);
 }
@@ -363,12 +366,13 @@ void MemoryOptimizer::VisitLoadField(Node* node, AllocationState const* state) {
   FieldAccess const& access = FieldAccessOf(node->op());
   Node* offset = jsgraph()->IntPtrConstant(access.offset - access.tag());
   node->InsertInput(graph()->zone(), 1, offset);
-  if (access.machine_type.representation() ==
-      MachineRepresentation::kTaggedPointer) {
-    NodeProperties::ChangeOp(node, machine()->Load(access.machine_type));
-  } else {
+  if (load_poisoning_ == LoadPoisoning::kDoPoison &&
+      access.machine_type.representation() !=
+          MachineRepresentation::kTaggedPointer) {
     NodeProperties::ChangeOp(node,
                              machine()->PoisonedLoad(access.machine_type));
+  } else {
+    NodeProperties::ChangeOp(node, machine()->Load(access.machine_type));
   }
   EnqueueUses(node, state);
 }

src/compiler/memory-optimizer.h

@@ -31,7 +31,7 @@ typedef uint32_t NodeId;
 // implicitly.
 class MemoryOptimizer final {
  public:
-  MemoryOptimizer(JSGraph* jsgraph, Zone* zone);
+  MemoryOptimizer(JSGraph* jsgraph, Zone* zone, LoadPoisoning load_poisoning);
   ~MemoryOptimizer() {}
 
   void Optimize();
@@ -142,6 +142,7 @@ class MemoryOptimizer final {
   ZoneQueue<Token> tokens_;
   Zone* const zone_;
   GraphAssembler graph_assembler_;
+  LoadPoisoning load_poisoning_;
 
   DISALLOW_IMPLICIT_CONSTRUCTORS(MemoryOptimizer);
 };

src/compiler/mips/instruction-selector-mips.cc

@@ -296,8 +296,8 @@ void InstructionSelector::VisitLoad(Node* node) {
       UNREACHABLE();
       return;
   }
-  if (node->opcode() == IrOpcode::kPoisonedLoad &&
-      load_poisoning_ == LoadPoisoning::kDoPoison) {
+  if (node->opcode() == IrOpcode::kPoisonedLoad) {
+    CHECK_EQ(load_poisoning_, LoadPoisoning::kDoPoison);
     opcode |= MiscField::encode(kMemoryAccessPoisoned);
   }
 

src/compiler/mips64/instruction-selector-mips64.cc

@@ -410,8 +410,8 @@ void InstructionSelector::VisitLoad(Node* node) {
       UNREACHABLE();
       return;
   }
-  if (node->opcode() == IrOpcode::kPoisonedLoad &&
-      load_poisoning_ == LoadPoisoning::kDoPoison) {
+  if (node->opcode() == IrOpcode::kPoisonedLoad) {
+    CHECK_EQ(load_poisoning_, LoadPoisoning::kDoPoison);
     opcode |= MiscField::encode(kMemoryAccessPoisoned);
   }
 

src/compiler/pipeline.cc

@@ -1472,7 +1472,10 @@ struct MemoryOptimizationPhase {
     trimmer.TrimGraph(roots.begin(), roots.end());
 
     // Optimize allocations and load/store operations.
-    MemoryOptimizer optimizer(data->jsgraph(), temp_zone);
+    MemoryOptimizer optimizer(data->jsgraph(), temp_zone,
+                              data->info()->is_poison_loads()
+                                  ? LoadPoisoning::kDoPoison
+                                  : LoadPoisoning::kDontPoison);
     optimizer.Optimize();
   }
 };

src/compiler/s390/instruction-selector-s390.cc

@@ -727,8 +727,8 @@ void InstructionSelector::VisitLoad(Node* node) {
   AddressingMode mode =
       g.GetEffectiveAddressMemoryOperand(node, inputs, &input_count);
   opcode |= AddressingModeField::encode(mode);
-  if (node->opcode() == IrOpcode::kPoisonedLoad &&
-      load_poisoning_ == LoadPoisoning::kDoPoison) {
+  if (node->opcode() == IrOpcode::kPoisonedLoad) {
+    CHECK_EQ(load_poisoning_, LoadPoisoning::kDoPoison);
     opcode |= MiscField::encode(kMemoryAccessPoisoned);
   }
 

src/compiler/x64/instruction-selector-x64.cc

@@ -308,8 +308,8 @@ void InstructionSelector::VisitLoad(Node* node) {
   InstructionCode code = opcode | AddressingModeField::encode(mode);
   if (node->opcode() == IrOpcode::kProtectedLoad) {
     code |= MiscField::encode(kMemoryAccessProtected);
-  } else if (node->opcode() == IrOpcode::kPoisonedLoad &&
-             load_poisoning_ == LoadPoisoning::kDoPoison) {
+  } else if (node->opcode() == IrOpcode::kPoisonedLoad) {
+    CHECK_EQ(load_poisoning_, LoadPoisoning::kDoPoison);
     code |= MiscField::encode(kMemoryAccessPoisoned);
   }
   Emit(code, 1, outputs, input_count, inputs);