[turbofan] Avoid some unnecessary write barriers.

Use the type specified for StoreField and StoreElement to check whether
we are storing a TaggedSigned value, and skip the write barrier for the
write completely in that case.  Also make sure to set that field type
appropriately for JSGlobalObjectSpecialization.

R=jarin@chromium.org
BUG=v8:4470
LOG=n

Review URL: https://codereview.chromium.org/1410743009

Cr-Commit-Position: refs/heads/master@{#31772}

src/compiler/js-global-object-specialization.cc

@@ -195,7 +195,9 @@ Reduction JSGlobalObjectSpecialization::ReduceJSStoreGlobal(Node* node) {
       if (!(flags() & kDeoptimizationEnabled)) return NoChange();
       dependencies()->AssumePropertyCell(property_cell);
       Node* check = graph()->NewNode(simplified()->ObjectIsSmi(), value);
+      Type* property_cell_value_type = Type::TaggedSigned();
       if (property_cell_value->IsHeapObject()) {
+        // Deoptimize if the {value} is a Smi.
         Node* branch = graph()->NewNode(common()->Branch(BranchHint::kFalse),
                                         check, control);
         Node* if_true = graph()->NewNode(common()->IfTrue(), branch);
@@ -204,7 +206,9 @@ Reduction JSGlobalObjectSpecialization::ReduceJSStoreGlobal(Node* node) {
         // TODO(bmeurer): This should be on the AdvancedReducer somehow.
         NodeProperties::MergeControlToEnd(graph(), common(), deoptimize);
         control = graph()->NewNode(common()->IfFalse(), branch);
-        Node* value_map =
+
+        // Load the {value} map check against the {property_cell} map.
+        Node* value_map = effect =
             graph()->NewNode(simplified()->LoadField(AccessBuilder::ForMap()),
                              value, effect, control);
         Handle<Map> property_cell_value_map(
@@ -212,6 +216,7 @@ Reduction JSGlobalObjectSpecialization::ReduceJSStoreGlobal(Node* node) {
         check = graph()->NewNode(
             simplified()->ReferenceEqual(Type::Any()), value_map,
             jsgraph()->HeapConstant(property_cell_value_map));
+        property_cell_value_type = Type::TaggedPointer();
       }
       Node* branch =
           graph()->NewNode(common()->Branch(BranchHint::kTrue), check, control);
@@ -222,7 +227,8 @@ Reduction JSGlobalObjectSpecialization::ReduceJSStoreGlobal(Node* node) {
       NodeProperties::MergeControlToEnd(graph(), common(), deoptimize);
       control = graph()->NewNode(common()->IfTrue(), branch);
       effect = graph()->NewNode(
-          simplified()->StoreField(AccessBuilder::ForPropertyCellValue()),
+          simplified()->StoreField(
+              AccessBuilder::ForPropertyCellValue(property_cell_value_type)),
           jsgraph()->HeapConstant(property_cell), value, effect, control);
       break;
     }

src/compiler/simplified-lowering.cc

@@ -1171,8 +1171,9 @@ namespace {
 
 WriteBarrierKind ComputeWriteBarrierKind(BaseTaggedness base_is_tagged,
                                          MachineType representation,
-                                         Type* type) {
-  if (type->Is(Type::TaggedSigned())) {
+                                         Type* field_type, Type* input_type) {
+  if (field_type->Is(Type::TaggedSigned()) ||
+      input_type->Is(Type::TaggedSigned())) {
     // Write barriers are only for writes of heap objects.
     return kNoWriteBarrier;
   }
@@ -1229,8 +1230,8 @@ void SimplifiedLowering::DoLoadField(Node* node) {
 void SimplifiedLowering::DoStoreField(Node* node) {
   const FieldAccess& access = FieldAccessOf(node->op());
   Type* type = NodeProperties::GetType(node->InputAt(1));
-  WriteBarrierKind kind =
-      ComputeWriteBarrierKind(access.base_is_tagged, access.machine_type, type);
+  WriteBarrierKind kind = ComputeWriteBarrierKind(
+      access.base_is_tagged, access.machine_type, access.type, type);
   Node* offset = jsgraph()->IntPtrConstant(access.offset - access.tag());
   node->InsertInput(graph()->zone(), 1, offset);
   NodeProperties::ChangeOp(
@@ -1338,10 +1339,11 @@ void SimplifiedLowering::DoStoreElement(Node* node) {
   Type* type = NodeProperties::GetType(node->InputAt(2));
   node->ReplaceInput(1, ComputeIndex(access, node->InputAt(1)));
   NodeProperties::ChangeOp(
-      node, machine()->Store(StoreRepresentation(
-                access.machine_type,
-                ComputeWriteBarrierKind(access.base_is_tagged,
-                                        access.machine_type, type))));
+      node,
+      machine()->Store(StoreRepresentation(
+          access.machine_type,
+          ComputeWriteBarrierKind(access.base_is_tagged, access.machine_type,
+                                  access.type, type))));
 }