[turbofan] Utilize UNINITIALIZED state of CompareIC and BinaryOpIC.

In the BytecodeGraphBuilder we insert a SOFT deopt whenever we see an
IC whose state is UNINITIALIZED, i.e. a LOAD_IC or a STORE_IC. This
greatly reduces the size of the generated graphs (and also helps to
improve generated code quality). However for COMPARE_IC and BINARY_OP_IC
we used to stick in the generic JavaScript node instead, which does
generate code and might block optimizations because its sitting in
the effect chain. This is changed now to always SOFT deopt for
UNINITIALIZED instead, consistently with the other ICs.

Bug: v8:6760
Change-Id: I2ac7469fa86512a2fd909fdde2c6425977694811
Reviewed-on: https://chromium-review.googlesource.com/645858
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47771}

src/compiler/bytecode-graph-builder.cc

@@ -2005,6 +2005,7 @@ void BytecodeGraphBuilder::BuildBinaryOp(const Operator* op) {
       bytecode_iterator().GetIndexOperand(kBinaryOperationHintIndex));
   JSTypeHintLowering::LoweringResult lowering =
       TryBuildSimplifiedBinaryOp(op, left, right, slot);
+  if (lowering.IsExit()) return;
 
   Node* node = nullptr;
   if (lowering.IsSideEffectFree()) {
@@ -2114,6 +2115,8 @@ void BytecodeGraphBuilder::BuildBinaryOpWithImmediate(const Operator* op) {
       bytecode_iterator().GetIndexOperand(kBinaryOperationSmiHintIndex));
   JSTypeHintLowering::LoweringResult lowering =
       TryBuildSimplifiedBinaryOp(op, left, right, slot);
+  if (lowering.IsExit()) return;
+
   Node* node = nullptr;
   if (lowering.IsSideEffectFree()) {
     node = lowering.value();
@@ -2181,6 +2184,8 @@ void BytecodeGraphBuilder::VisitInc() {
       bytecode_iterator().GetIndexOperand(kCountOperationHintIndex));
   JSTypeHintLowering::LoweringResult lowering =
       TryBuildSimplifiedBinaryOp(op, left, right, slot);
+  if (lowering.IsExit()) return;
+
   Node* node = nullptr;
   if (lowering.IsSideEffectFree()) {
     node = lowering.value();
@@ -2201,6 +2206,8 @@ void BytecodeGraphBuilder::VisitDec() {
       bytecode_iterator().GetIndexOperand(kCountOperationHintIndex));
   JSTypeHintLowering::LoweringResult lowering =
       TryBuildSimplifiedBinaryOp(op, left, right, slot);
+  if (lowering.IsExit()) return;
+
   Node* node = nullptr;
   if (lowering.IsSideEffectFree()) {
     node = lowering.value();
@@ -2265,6 +2272,8 @@ void BytecodeGraphBuilder::BuildCompareOp(const Operator* op) {
   FeedbackSlot slot = feedback_vector()->ToSlot(slot_index);
   JSTypeHintLowering::LoweringResult lowering =
       TryBuildSimplifiedBinaryOp(op, left, right, slot);
+  if (lowering.IsExit()) return;
+
   Node* node = nullptr;
   if (lowering.IsSideEffectFree()) {
     node = lowering.value();

src/compiler/js-type-hint-lowering.cc

@@ -216,13 +216,30 @@ JSTypeHintLowering::LoweringResult JSTypeHintLowering::ReduceBinaryOperation(
     const Operator* op, Node* left, Node* right, Node* effect, Node* control,
     FeedbackSlot slot) const {
   switch (op->opcode()) {
-    case IrOpcode::kJSStrictEqual:
+    case IrOpcode::kJSStrictEqual: {
+      DCHECK(!slot.IsInvalid());
+      CompareICNexus nexus(feedback_vector(), slot);
+      if (Node* node = TryBuildSoftDeopt(
+              nexus, effect, control,
+              DeoptimizeReason::kInsufficientTypeFeedbackForCompareOperation)) {
+        return LoweringResult::Exit(node);
+      }
+      // TODO(turbofan): Should we generally support early lowering of
+      // JSStrictEqual operators here?
       break;
+    }
     case IrOpcode::kJSEqual:
     case IrOpcode::kJSLessThan:
     case IrOpcode::kJSGreaterThan:
     case IrOpcode::kJSLessThanOrEqual:
     case IrOpcode::kJSGreaterThanOrEqual: {
+      DCHECK(!slot.IsInvalid());
+      CompareICNexus nexus(feedback_vector(), slot);
+      if (Node* node = TryBuildSoftDeopt(
+              nexus, effect, control,
+              DeoptimizeReason::kInsufficientTypeFeedbackForCompareOperation)) {
+        return LoweringResult::Exit(node);
+      }
       JSSpeculativeBinopBuilder b(this, op, left, right, effect, control, slot);
       if (Node* node = b.TryBuildNumberCompare()) {
         return LoweringResult::SideEffectFree(node, node, control);
@@ -240,6 +257,13 @@ JSTypeHintLowering::LoweringResult JSTypeHintLowering::ReduceBinaryOperation(
     case IrOpcode::kJSMultiply:
     case IrOpcode::kJSDivide:
     case IrOpcode::kJSModulus: {
+      DCHECK(!slot.IsInvalid());
+      BinaryOpICNexus nexus(feedback_vector(), slot);
+      if (Node* node = TryBuildSoftDeopt(
+              nexus, effect, control,
+              DeoptimizeReason::kInsufficientTypeFeedbackForBinaryOperation)) {
+        return LoweringResult::Exit(node);
+      }
       JSSpeculativeBinopBuilder b(this, op, left, right, effect, control, slot);
       if (Node* node = b.TryBuildNumberBinop()) {
         return LoweringResult::SideEffectFree(node, node, control);

src/deoptimize-reason.h

@@ -28,16 +28,14 @@ namespace internal {
     "Insufficient type feedback for construct")                                \
   V(FastPathFailed, "Falling off the fast path")                               \
   V(InsufficientTypeFeedbackForForIn, "Insufficient type feedback for for-in") \
-  V(InsufficientTypeFeedbackForCombinedTypeOfBinaryOperation,                  \
-    "Insufficient type feedback for combined type of binary operation")        \
+  V(InsufficientTypeFeedbackForBinaryOperation,                                \
+    "Insufficient type feedback for binary operation")                         \
+  V(InsufficientTypeFeedbackForCompareOperation,                               \
+    "Insufficient type feedback for compare operation")                        \
   V(InsufficientTypeFeedbackForGenericNamedAccess,                             \
     "Insufficient type feedback for generic named access")                     \
   V(InsufficientTypeFeedbackForGenericKeyedAccess,                             \
     "Insufficient type feedback for generic keyed access")                     \
-  V(InsufficientTypeFeedbackForLHSOfBinaryOperation,                           \
-    "Insufficient type feedback for LHS of binary operation")                  \
-  V(InsufficientTypeFeedbackForRHSOfBinaryOperation,                           \
-    "Insufficient type feedback for RHS of binary operation")                  \
   V(KeyIsNegative, "key is negative")                                          \
   V(LostPrecision, "lost precision")                                           \
   V(LostPrecisionOrNaN, "lost precision or NaN")                               \
@@ -68,7 +66,6 @@ namespace internal {
   V(UnexpectedCellContentsInGlobalStore,                                       \
     "Unexpected cell contents in global store")                                \
   V(UnexpectedObject, "unexpected object")                                     \
-  V(UnexpectedRHSOfBinaryOperation, "Unexpected RHS of binary operation")      \
   V(UnknownMapInPolymorphicAccess, "Unknown map in polymorphic access")        \
   V(UnknownMapInPolymorphicCall, "Unknown map in polymorphic call")            \
   V(UnknownMapInPolymorphicElementAccess,                                      \