[turbofan] Extend early lowering to store operations.

This extends the existing insertion of soft deopts during early lowering
from loads to stores (both named and keyed). It now covers all property
access operations. Next we will handle monomorphic type feedback when
applicable.

R=bmeurer@chromium.org

Change-Id: I6138744682cdbdbdb7274851aa81fb075229c309
Reviewed-on: https://chromium-review.googlesource.com/459482
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44198}

src/compiler/bytecode-graph-builder.cc

@@ -1118,7 +1118,16 @@ void BytecodeGraphBuilder::BuildNamedStore(LanguageMode language_mode,
               language_mode);
     op = javascript()->StoreNamed(language_mode, name, feedback);
   }
-  Node* node = NewNode(op, object, value);
+
+  Node* node = nullptr;
+  if (Node* simplified =
+          TryBuildSimplifiedStoreNamed(op, object, value, feedback.slot())) {
+    if (environment() == nullptr) return;
+    node = simplified;
+  } else {
+    node = NewNode(op, object, value);
+  }
+
   environment()->RecordAfterState(node, Environment::kAttachFrameState);
 }
 
@@ -1143,10 +1152,18 @@ void BytecodeGraphBuilder::BuildKeyedStore(LanguageMode language_mode) {
       environment()->LookupRegister(bytecode_iterator().GetRegisterOperand(1));
   VectorSlotPair feedback =
       CreateVectorSlotPair(bytecode_iterator().GetIndexOperand(2));
-
   DCHECK_EQ(feedback.vector()->GetLanguageMode(feedback.slot()), language_mode);
   const Operator* op = javascript()->StoreProperty(language_mode, feedback);
-  Node* node = NewNode(op, object, key, value);
+
+  Node* node = nullptr;
+  if (Node* simplified = TryBuildSimplifiedStoreKeyed(op, object, key, value,
+                                                      feedback.slot())) {
+    if (environment() == nullptr) return;
+    node = simplified;
+  } else {
+    node = NewNode(op, object, key, value);
+  }
+
   environment()->RecordAfterState(node, Environment::kAttachFrameState);
 }
 
@@ -2446,6 +2463,44 @@ Node* BytecodeGraphBuilder::TryBuildSimplifiedLoadKeyed(const Operator* op,
   return nullptr;
 }
 
+Node* BytecodeGraphBuilder::TryBuildSimplifiedStoreNamed(const Operator* op,
+                                                         Node* receiver,
+                                                         Node* value,
+                                                         FeedbackSlot slot) {
+  // TODO(mstarzinger,6112): This is a workaround for OSR loop entries being
+  // pruned from the graph by a soft-deopt. It can happen that a LoadIC that
+  // control-dominates the OSR entry is still in "uninitialized" state.
+  if (!osr_ast_id_.IsNone()) return nullptr;
+  Node* effect = environment()->GetEffectDependency();
+  Node* control = environment()->GetControlDependency();
+  Reduction early_reduction = type_hint_lowering().ReduceStoreNamedOperation(
+      op, receiver, value, effect, control, slot);
+  if (early_reduction.Changed()) {
+    ApplyEarlyReduction(early_reduction);
+    return early_reduction.replacement();
+  }
+  return nullptr;
+}
+
+Node* BytecodeGraphBuilder::TryBuildSimplifiedStoreKeyed(const Operator* op,
+                                                         Node* receiver,
+                                                         Node* key, Node* value,
+                                                         FeedbackSlot slot) {
+  // TODO(mstarzinger,6112): This is a workaround for OSR loop entries being
+  // pruned from the graph by a soft-deopt. It can happen that a LoadIC that
+  // control-dominates the OSR entry is still in "uninitialized" state.
+  if (!osr_ast_id_.IsNone()) return nullptr;
+  Node* effect = environment()->GetEffectDependency();
+  Node* control = environment()->GetControlDependency();
+  Reduction early_reduction = type_hint_lowering().ReduceStoreKeyedOperation(
+      op, receiver, key, value, effect, control, slot);
+  if (early_reduction.Changed()) {
+    ApplyEarlyReduction(early_reduction);
+    return early_reduction.replacement();
+  }
+  return nullptr;
+}
+
 void BytecodeGraphBuilder::ApplyEarlyReduction(Reduction reduction) {
   Node* node = reduction.replacement();
   DCHECK(node->op()->HasProperty(Operator::kNoWrite));

src/compiler/bytecode-graph-builder.h

@@ -184,6 +184,10 @@ class BytecodeGraphBuilder {
                                     FeedbackSlot slot);
   Node* TryBuildSimplifiedLoadKeyed(const Operator* op, Node* receiver,
                                     Node* key, FeedbackSlot slot);
+  Node* TryBuildSimplifiedStoreNamed(const Operator* op, Node* receiver,
+                                     Node* value, FeedbackSlot slot);
+  Node* TryBuildSimplifiedStoreKeyed(const Operator* op, Node* receiver,
+                                     Node* key, Node* value, FeedbackSlot slot);
 
   // Applies the given early reduction onto the current environment.
   void ApplyEarlyReduction(Reduction reduction);

src/compiler/js-type-hint-lowering.cc

@@ -256,6 +256,35 @@ Reduction JSTypeHintLowering::ReduceLoadKeyedOperation(
   return Reduction();
 }
 
+Reduction JSTypeHintLowering::ReduceStoreNamedOperation(
+    const Operator* op, Node* obj, Node* val, Node* effect, Node* control,
+    FeedbackSlot slot) const {
+  DCHECK(op->opcode() == IrOpcode::kJSStoreNamed ||
+         op->opcode() == IrOpcode::kJSStoreNamedOwn);
+  DCHECK(!slot.IsInvalid());
+  StoreICNexus nexus(feedback_vector(), slot);
+  if (Node* node = TryBuildSoftDeopt(
+          nexus, effect, control,
+          DeoptimizeReason::kInsufficientTypeFeedbackForGenericNamedAccess)) {
+    return Reduction(node);
+  }
+  return Reduction();
+}
+
+Reduction JSTypeHintLowering::ReduceStoreKeyedOperation(
+    const Operator* op, Node* obj, Node* key, Node* val, Node* effect,
+    Node* control, FeedbackSlot slot) const {
+  DCHECK_EQ(IrOpcode::kJSStoreProperty, op->opcode());
+  DCHECK(!slot.IsInvalid());
+  KeyedStoreICNexus nexus(feedback_vector(), slot);
+  if (Node* node = TryBuildSoftDeopt(
+          nexus, effect, control,
+          DeoptimizeReason::kInsufficientTypeFeedbackForGenericKeyedAccess)) {
+    return Reduction(node);
+  }
+  return Reduction();
+}
+
 Node* JSTypeHintLowering::TryBuildSoftDeopt(FeedbackNexus& nexus, Node* effect,
                                             Node* control,
                                             DeoptimizeReason reason) const {

src/compiler/js-type-hint-lowering.h

@@ -62,6 +62,12 @@ class JSTypeHintLowering {
   Reduction ReduceLoadKeyedOperation(const Operator* op, Node* obj, Node* key,
                                      Node* effect, Node* control,
                                      FeedbackSlot slot) const;
+  Reduction ReduceStoreNamedOperation(const Operator* op, Node* obj, Node* val,
+                                      Node* effect, Node* control,
+                                      FeedbackSlot slot) const;
+  Reduction ReduceStoreKeyedOperation(const Operator* op, Node* obj, Node* key,
+                                      Node* val, Node* effect, Node* control,
+                                      FeedbackSlot slot) const;
 
  private:
   friend class JSSpeculativeBinopBuilder;