[turbofan] Add support for %_IsSpecObject intrinsic lowering.

Now JSIntrinsicLowering can also lower %_IsSpecObject intrinsics to a
diamond.

R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/1436943005

Cr-Commit-Position: refs/heads/master@{#31960}

src/compiler/js-intrinsic-lowering.cc

@@ -59,6 +59,9 @@ Reduction JSIntrinsicLowering::Reduce(Node* node) {
       return ReduceIsInstanceType(node, JS_FUNCTION_TYPE);
     case Runtime::kInlineIsRegExp:
       return ReduceIsInstanceType(node, JS_REGEXP_TYPE);
+    case Runtime::kInlineIsSpecObject:
+      // TODO(bmeurer): Rename %_IsSpecObject to %_IsReceiver.
+      return ReduceIsSpecObject(node);
     case Runtime::kInlineIsSmi:
       return ReduceIsSmi(node);
     case Runtime::kInlineJSValueGetValue:
@@ -250,6 +253,47 @@ Reduction JSIntrinsicLowering::ReduceIsInstanceType(
 }
 
 
+Reduction JSIntrinsicLowering::ReduceIsSpecObject(Node* node) {
+  // if (%_IsSmi(value)) {
+  //   return false;
+  // } else {
+  //   return FIRST_JS_RECEIVER_TYPE <= %_GetInstanceType(%_GetMap(value))
+  // }
+  STATIC_ASSERT(LAST_TYPE == LAST_JS_RECEIVER_TYPE);
+  MachineType const type = static_cast<MachineType>(kTypeBool | kRepTagged);
+
+  Node* value = NodeProperties::GetValueInput(node, 0);
+  Node* effect = NodeProperties::GetEffectInput(node);
+  Node* control = NodeProperties::GetControlInput(node);
+
+  Node* check = graph()->NewNode(simplified()->ObjectIsSmi(), value);
+  Node* branch = graph()->NewNode(common()->Branch(), check, control);
+
+  Node* if_true = graph()->NewNode(common()->IfTrue(), branch);
+  Node* etrue = effect;
+  Node* vtrue = jsgraph()->FalseConstant();
+
+  Node* if_false = graph()->NewNode(common()->IfFalse(), branch);
+  Node* efalse = graph()->NewNode(
+      simplified()->LoadField(AccessBuilder::ForMapInstanceType()),
+      graph()->NewNode(simplified()->LoadField(AccessBuilder::ForMap()), value,
+                       effect, if_false),
+      effect, if_false);
+  Node* vfalse = graph()->NewNode(
+      machine()->Uint32LessThanOrEqual(),
+      jsgraph()->Int32Constant(FIRST_JS_RECEIVER_TYPE), efalse);
+
+  control = graph()->NewNode(common()->Merge(2), if_true, if_false);
+
+  // Replace all effect uses of {node} with the {ephi}.
+  effect = graph()->NewNode(common()->EffectPhi(2), etrue, efalse, control);
+  ReplaceWithValue(node, node, effect, control);
+
+  // Turn the {node} into a Phi.
+  return Change(node, common()->Phi(type, 2), vtrue, vfalse, control);
+}
+
+
 Reduction JSIntrinsicLowering::ReduceIsSmi(Node* node) {
   return Change(node, simplified()->ObjectIsSmi());
 }

src/compiler/js-intrinsic-lowering.h

@@ -46,6 +46,7 @@ class JSIntrinsicLowering final : public AdvancedReducer {
   Reduction ReduceIncrementStatsCounter(Node* node);
   Reduction ReduceIsMinusZero(Node* node);
   Reduction ReduceIsInstanceType(Node* node, InstanceType instance_type);
+  Reduction ReduceIsSpecObject(Node* node);
   Reduction ReduceIsSmi(Node* node);
   Reduction ReduceJSValueGetValue(Node* node);
   Reduction ReduceMapGetInstanceType(Node* node);

test/unittests/compiler/js-intrinsic-lowering-unittest.cc

@@ -283,6 +283,38 @@ TEST_F(JSIntrinsicLoweringTest, InlineIsRegExp) {
 }
 
 
+// -----------------------------------------------------------------------------
+// %_IsSpecObject
+
+
+TEST_F(JSIntrinsicLoweringTest, InlineIsSpecObject) {
+  Node* const input = Parameter(0);
+  Node* const context = Parameter(1);
+  Node* const effect = graph()->start();
+  Node* const control = graph()->start();
+  Reduction const r = Reduce(graph()->NewNode(
+      javascript()->CallRuntime(Runtime::kInlineIsSpecObject, 1), input,
+      context, effect, control));
+  ASSERT_TRUE(r.Changed());
+
+  Node* phi = r.replacement();
+  Capture<Node *> branch, if_false;
+  EXPECT_THAT(
+      phi,
+      IsPhi(
+          static_cast<MachineType>(kTypeBool | kRepTagged), IsFalseConstant(),
+          IsUint32LessThanOrEqual(
+              IsInt32Constant(FIRST_JS_RECEIVER_TYPE),
+              IsLoadField(AccessBuilder::ForMapInstanceType(),
+                          IsLoadField(AccessBuilder::ForMap(), input, effect,
+                                      CaptureEq(&if_false)),
+                          effect, _)),
+          IsMerge(IsIfTrue(AllOf(CaptureEq(&branch),
+                                 IsBranch(IsObjectIsSmi(input), control))),
+                  AllOf(CaptureEq(&if_false), IsIfFalse(CaptureEq(&branch))))));
+}
+
+
 // -----------------------------------------------------------------------------
 // %_JSValueGetValue