[turbofan] Optimize JSToString on strings early on

This optimization addresses a case triggered by the Templates/Untagged
js-perf-test, in which template literals get compiled to a cascade of
JSAdd(JSAdd, JSToString) nodes.

Before the optimization in https://chromium-review.googlesource.com/c/v8/v8/+/1193342
JSToString no-ops used to get optimized away during typed lowering together
with constant folding of string concatenation. This change allows us to get
rid of a no-op JSToString call during native context specialization, thus
allowing for constant folding of JSAdd to kick in and CheckStringAdd nodes to
not be generated at all.

This change also removes the NumberToString optimization from typed
lowering, as it's being executed during earlier stage.

Bug: chromium:879083
Change-Id: I1d8155ed969b6959fbb86fca21e4714b88a2695a
Reviewed-on: https://chromium-review.googlesource.com/1202622
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55724}

src/compiler/js-native-context-specialization.cc

@@ -113,12 +113,41 @@ Reduction JSNativeContextSpecialization::Reduce(Node* node) {
       return ReduceJSStoreInArrayLiteral(node);
     case IrOpcode::kJSToObject:
       return ReduceJSToObject(node);
+    case IrOpcode::kJSToString:
+      return ReduceJSToString(node);
     default:
       break;
   }
   return NoChange();
 }
 
+Reduction JSNativeContextSpecialization::ReduceJSToString(Node* node) {
+  DCHECK_EQ(IrOpcode::kJSToString, node->opcode());
+  Node* const input = node->InputAt(0);
+  Reduction reduction;
+
+  HeapObjectMatcher matcher(input);
+  if (matcher.HasValue() && matcher.Value()->IsString()) {
+    reduction = Changed(input);  // JSToString(x:string) => x
+    ReplaceWithValue(node, reduction.replacement());
+    return reduction;
+  }
+
+  // TODO(turbofan): This optimization is weaker than what we used to have
+  // in js-typed-lowering for OrderedNumbers. We don't have types here though,
+  // so alternative approach should be designed if this causes performance
+  // regressions and the stronger optimization should be re-implemented.
+  NumberMatcher number_matcher(input);
+  if (number_matcher.HasValue()) {
+    reduction = Replace(jsgraph()->HeapConstant(factory()->NumberToString(
+        factory()->NewNumber(number_matcher.Value()))));
+    ReplaceWithValue(node, reduction.replacement());
+    return reduction;
+  }
+
+  return NoChange();
+}
+
 Reduction JSNativeContextSpecialization::ReduceJSAdd(Node* node) {
   // TODO(turbofan): This has to run together with the inlining and
   // native context specialization to be able to leverage the string

src/compiler/js-native-context-specialization.h

@@ -101,6 +101,7 @@ class JSNativeContextSpecialization final : public AdvancedReducer {
                                Node* index = nullptr);
 
   Reduction ReduceSoftDeoptimize(Node* node, DeoptimizeReason reason);
+  Reduction ReduceJSToString(Node* node);
 
   // A triple of nodes that represents a continuation.
   class ValueEffectControl final {

src/compiler/js-typed-lowering.cc

@@ -1061,20 +1061,6 @@ Reduction JSTypedLowering::ReduceJSToStringInput(Node* input) {
   if (input_type.Is(Type::NaN())) {
     return Replace(jsgraph()->HeapConstant(factory()->NaN_string()));
   }
-  if (input_type.Is(Type::OrderedNumber()) &&
-      input_type.Min() == input_type.Max()) {
-    // TODO(mslekova): get rid of these allows by doing either one of:
-    // 1. remove the optimization and check if it ruins the performance
-    // 2. allocate all the ToString's from numbers before the compilation
-    // 3. leave a placeholder and do the actual allocations once back on the MT
-    AllowHandleDereference allow_handle_dereference;
-    AllowHandleAllocation allow_handle_allocation;
-    AllowHeapAllocation allow_heap_allocation;
-    // Note that we can use Type::OrderedNumber(), since
-    // both 0 and -0 map to the String "0" in JavaScript.
-    return Replace(jsgraph()->HeapConstant(
-        factory()->NumberToString(factory()->NewNumber(input_type.Min()))));
-  }
   if (input_type.Is(Type::Number())) {
     return Replace(graph()->NewNode(simplified()->NumberToString(), input));
   }