[turbofan]: Add a context relaxation Reducer

In many cases, the context that TurboFan's ASTGraphBuilder or subsequent
reduction operations attaches to nodes does not need to be that exact
context, but rather only needs to be one with the same native context,
because it is used internally only to fetch the native context, e.g. for
creating and throwing exceptions.

This reducer recognizes common cases where the context that is specified
for a node can be relaxed to a canonical, less specific one. This
relaxed context can either be the enclosing function's context or a specific
Module or Script context that is explicitly created within the function.

This optimization is especially important for TurboFan-generated code stubs
which use context specialization and inlining to generate optimal code.
Without context relaxation, many extraneous moves are generated to pass
exactly the right context to internal functions like ToNumber and
AllocateHeapNumber, which only need the native context. By turning context
relaxation on, these moves disappear because all these common internal
context uses are unified to the context passed into the stub function, which
is typically already in the correct context register and remains there for
short stubs. It also eliminates the explicit use of a specialized context
constant in the code stub in these cases, which could cause memory leaks.

Review URL: https://codereview.chromium.org/1244583003

Cr-Commit-Position: refs/heads/master@{#29763}

BUILD.gn

@@ -715,6 +715,8 @@ source_set("v8_base") {
     "src/compiler/instruction.h",
     "src/compiler/js-builtin-reducer.cc",
     "src/compiler/js-builtin-reducer.h",
+    "src/compiler/js-context-relaxation.cc",
+    "src/compiler/js-context-relaxation.h",
     "src/compiler/js-context-specialization.cc",
     "src/compiler/js-context-specialization.h",
     "src/compiler/js-frame-specialization.cc",

src/code-stubs.cc

@@ -506,6 +506,7 @@ Handle<Code> TurboFanCodeStub::GenerateCode() {
   CompilationInfo info(&parse_info);
   info.SetFunctionType(GetCallInterfaceDescriptor().GetFunctionType());
   info.MarkAsContextSpecializing();
+  info.MarkAsDeoptimizationEnabled();
   info.SetStub(this);
   return info.GenerateCodeStub();
 }

src/compiler/ast-graph-builder.cc

@@ -449,9 +449,9 @@ AstGraphBuilder::AstGraphBuilder(Zone* local_zone, CompilationInfo* info,
       liveness_analyzer_(static_cast<size_t>(info->scope()->num_stack_slots()),
                          local_zone),
       frame_state_function_info_(common()->CreateFrameStateFunctionInfo(
-          FrameStateType::kJavaScriptFunction,
-          info->num_parameters_including_this(),
-          info->scope()->num_stack_slots(), info->shared_info())),
+          FrameStateType::kJavaScriptFunction, info->num_parameters() + 1,
+          info->scope()->num_stack_slots(), info->shared_info(),
+          CALL_MAINTAINS_NATIVE_CONTEXT)),
       js_type_feedback_(js_type_feedback) {
   InitializeAstVisitor(info->isolate(), local_zone);
 }

src/compiler/common-operator.cc

@@ -776,9 +776,11 @@ const Operator* CommonOperatorBuilder::ResizeMergeOrPhi(const Operator* op,
 const FrameStateFunctionInfo*
 CommonOperatorBuilder::CreateFrameStateFunctionInfo(
     FrameStateType type, int parameter_count, int local_count,
-    Handle<SharedFunctionInfo> shared_info) {
+    Handle<SharedFunctionInfo> shared_info,
+    ContextCallingMode context_calling_mode) {
   return new (zone()->New(sizeof(FrameStateFunctionInfo)))
-      FrameStateFunctionInfo(type, parameter_count, local_count, shared_info);
+      FrameStateFunctionInfo(type, parameter_count, local_count, shared_info,
+                             context_calling_mode);
 }
 
 }  // namespace compiler

src/compiler/common-operator.h

@@ -163,7 +163,8 @@ class CommonOperatorBuilder final : public ZoneObject {
   // Constructs function info for frame state construction.
   const FrameStateFunctionInfo* CreateFrameStateFunctionInfo(
       FrameStateType type, int parameter_count, int local_count,
-      Handle<SharedFunctionInfo> shared_info);
+      Handle<SharedFunctionInfo> shared_info,
+      ContextCallingMode context_calling_mode);
 
  private:
   Zone* zone() const { return zone_; }

src/compiler/frame-states.h

@@ -76,26 +76,38 @@ enum class FrameStateType {
 };
 
 
+enum ContextCallingMode {
+  CALL_MAINTAINS_NATIVE_CONTEXT,
+  CALL_CHANGES_NATIVE_CONTEXT
+};
+
+
 class FrameStateFunctionInfo {
  public:
   FrameStateFunctionInfo(FrameStateType type, int parameter_count,
                          int local_count,
-                         Handle<SharedFunctionInfo> shared_info)
+                         Handle<SharedFunctionInfo> shared_info,
+                         ContextCallingMode context_calling_mode)
       : type_(type),
         parameter_count_(parameter_count),
         local_count_(local_count),
-        shared_info_(shared_info) {}
+        shared_info_(shared_info),
+        context_calling_mode_(context_calling_mode) {}
 
   int local_count() const { return local_count_; }
   int parameter_count() const { return parameter_count_; }
   Handle<SharedFunctionInfo> shared_info() const { return shared_info_; }
   FrameStateType type() const { return type_; }
+  ContextCallingMode context_calling_mode() const {
+    return context_calling_mode_;
+  }
 
  private:
   FrameStateType const type_;
   int const parameter_count_;
   int const local_count_;
   Handle<SharedFunctionInfo> const shared_info_;
+  ContextCallingMode context_calling_mode_;
 };
 
 

src/compiler/js-context-relaxation.cc

+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "src/compiler/frame-states.h"
+#include "src/compiler/js-context-relaxation.h"
+#include "src/compiler/js-operator.h"
+#include "src/compiler/node.h"
+#include "src/compiler/node-properties.h"
+
+namespace v8 {
+namespace internal {
+namespace compiler {
+
+Reduction JSContextRelaxation::Reduce(Node* node) {
+  switch (node->opcode()) {
+    case IrOpcode::kJSCallFunction:
+    case IrOpcode::kJSToNumber: {
+      Node* frame_state = NodeProperties::GetFrameStateInput(node, 0);
+      Node* outer_frame = frame_state;
+      Node* original_context = NodeProperties::GetContextInput(node);
+      Node* candidate_new_context = original_context;
+      do {
+        FrameStateInfo frame_state_info(
+            OpParameter<FrameStateInfo>(outer_frame->op()));
+        const FrameStateFunctionInfo* function_info =
+            frame_state_info.function_info();
+        if (function_info == nullptr ||
+            (function_info->context_calling_mode() ==
+             CALL_CHANGES_NATIVE_CONTEXT)) {
+          break;
+        }
+        candidate_new_context = outer_frame->InputAt(kFrameStateContextInput);
+        outer_frame = outer_frame->InputAt(kFrameStateOuterStateInput);
+      } while (outer_frame->opcode() == IrOpcode::kFrameState);
+
+      while (true) {
+        switch (candidate_new_context->opcode()) {
+          case IrOpcode::kParameter:
+          case IrOpcode::kJSCreateModuleContext:
+          case IrOpcode::kJSCreateScriptContext:
+            if (candidate_new_context != original_context) {
+              NodeProperties::ReplaceContextInput(node, candidate_new_context);
+              return Changed(node);
+            } else {
+              return NoChange();
+            }
+          case IrOpcode::kJSCreateCatchContext:
+          case IrOpcode::kJSCreateWithContext:
+          case IrOpcode::kJSCreateBlockContext:
+            candidate_new_context =
+                NodeProperties::GetContextInput(candidate_new_context);
+            break;
+          default:
+            return NoChange();
+        }
+      }
+    }
+    default:
+      break;
+  }
+  return NoChange();
+}
+
+}  // namespace compiler
+}  // namespace internal
+}  // namespace v8

src/compiler/js-context-relaxation.h

+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef V8_COMPILER_JS_CONTEXT_RELAXATION_H_
+#define V8_COMPILER_JS_CONTEXT_RELAXATION_H_
+
+#include "src/compiler/graph-reducer.h"
+
+namespace v8 {
+namespace internal {
+namespace compiler {
+
+// Ensures that operations that only need to access the native context use the
+// outer-most context rather than the specific context given by the AST graph
+// builder. This makes it possible to use these operations with context
+// specialization (e.g. for generating stubs) without forcing inner contexts to
+// be embedded in generated code thus causing leaks and potentially using the
+// wrong native context (i.e. stubs are shared between native contexts).
+class JSContextRelaxation final : public Reducer {
+ public:
+  JSContextRelaxation() {}
+  ~JSContextRelaxation() final {}
+
+  Reduction Reduce(Node* node) final;
+};
+
+}  // namespace compiler
+}  // namespace internal
+}  // namespace v8
+
+#endif  // V8_COMPILER_JS_CONTEXT_RELAXATION_H_

src/compiler/js-inlining.cc

@@ -214,7 +214,8 @@ Node* JSInliner::CreateArgumentsAdaptorFrameState(
   const FrameStateFunctionInfo* state_info =
       jsgraph_->common()->CreateFrameStateFunctionInfo(
           FrameStateType::kArgumentsAdaptor,
-          static_cast<int>(call->formal_arguments()) + 1, 0, shared_info);
+          static_cast<int>(call->formal_arguments()) + 1, 0, shared_info,
+          CALL_MAINTAINS_NATIVE_CONTEXT);
 
   const Operator* op = jsgraph_->common()->FrameState(
       BailoutId(-1), OutputFrameStateCombine::Ignore(), state_info);

src/compiler/pipeline.cc

@@ -25,6 +25,7 @@
 #include "src/compiler/instruction.h"
 #include "src/compiler/instruction-selector.h"
 #include "src/compiler/js-builtin-reducer.h"
+#include "src/compiler/js-context-relaxation.h"
 #include "src/compiler/js-context-specialization.h"
 #include "src/compiler/js-frame-specialization.h"
 #include "src/compiler/js-generic-lowering.h"
@@ -704,6 +705,7 @@ struct GenericLoweringPhase {
 
   void Run(PipelineData* data, Zone* temp_zone) {
     JSGraphReducer graph_reducer(data->jsgraph(), temp_zone);
+    JSContextRelaxation context_relaxing;
     DeadCodeElimination dead_code_elimination(&graph_reducer, data->graph(),
                                               data->common());
     CommonOperatorReducer common_reducer(&graph_reducer, data->graph(),
@@ -713,6 +715,7 @@ struct GenericLoweringPhase {
     SelectLowering select_lowering(data->jsgraph()->graph(),
                                    data->jsgraph()->common());
     TailCallOptimization tco(data->common(), data->graph());
+    AddReducer(data, &graph_reducer, &context_relaxing);
     AddReducer(data, &graph_reducer, &dead_code_elimination);
     AddReducer(data, &graph_reducer, &common_reducer);
     AddReducer(data, &graph_reducer, &generic_lowering);

test/unittests/compiler/instruction-selector-unittest.cc

@@ -153,7 +153,7 @@ InstructionSelectorTest::StreamBuilder::GetFrameStateFunctionInfo(
     int parameter_count, int local_count) {
   return common()->CreateFrameStateFunctionInfo(
       FrameStateType::kJavaScriptFunction, parameter_count, local_count,
-      Handle<SharedFunctionInfo>());
+      Handle<SharedFunctionInfo>(), CALL_MAINTAINS_NATIVE_CONTEXT);
 }
 
 

test/unittests/compiler/liveness-analyzer-unittest.cc

@@ -60,7 +60,7 @@ class LivenessAnalysisTest : public GraphTest {
     const FrameStateFunctionInfo* state_info =
         common()->CreateFrameStateFunctionInfo(
             FrameStateType::kJavaScriptFunction, 0, locals_count_,
-            Handle<SharedFunctionInfo>());
+            Handle<SharedFunctionInfo>(), CALL_MAINTAINS_NATIVE_CONTEXT);
 
     const Operator* op = common()->FrameState(
         BailoutId(ast_num), OutputFrameStateCombine::Ignore(), state_info);

test/unittests/unittests.gyp

@@ -60,6 +60,7 @@
         'compiler/instruction-sequence-unittest.cc',
         'compiler/instruction-sequence-unittest.h',
         'compiler/js-builtin-reducer-unittest.cc',
+        'compiler/js-context-relaxation-unittest.cc',
         'compiler/js-intrinsic-lowering-unittest.cc',
         'compiler/js-operator-unittest.cc',
         'compiler/js-typed-lowering-unittest.cc',

tools/gyp/v8.gyp

@@ -507,6 +507,8 @@
         '../../src/compiler/instruction.h',
         '../../src/compiler/js-builtin-reducer.cc',
         '../../src/compiler/js-builtin-reducer.h',
+        '../../src/compiler/js-context-relaxation.cc',
+        '../../src/compiler/js-context-relaxation.h',
         '../../src/compiler/js-context-specialization.cc',
         '../../src/compiler/js-context-specialization.h',
         '../../src/compiler/js-frame-specialization.cc',