[turbofan] Record instance type for CheckMaps, MapGuard and CompareMaps nodes.

Bug: v8:6396
Change-Id: I73a686bc5dc4849ca3f0addca513f7a0173ce0b3
Reviewed-on: https://chromium-review.googlesource.com/730710
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48788}

src/compiler/common-operator.cc

@@ -297,11 +297,6 @@ RegionObservability RegionObservabilityOf(Operator const* op) {
   return OpParameter<RegionObservability>(op);
 }
 
-ZoneHandleSet<Map> MapGuardMapsOf(Operator const* op) {
-  DCHECK_EQ(IrOpcode::kMapGuard, op->opcode());
-  return OpParameter<ZoneHandleSet<Map>>(op);
-}
-
 Type* TypeGuardTypeOf(Operator const* op) {
   DCHECK_EQ(IrOpcode::kTypeGuard, op->opcode());
   return OpParameter<Type*>(op);
@@ -1130,14 +1125,6 @@ const Operator* CommonOperatorBuilder::Phi(MachineRepresentation rep,
       rep);                                              // parameter
 }
 
-const Operator* CommonOperatorBuilder::MapGuard(ZoneHandleSet<Map> maps) {
-  return new (zone()) Operator1<ZoneHandleSet<Map>>(  // --
-      IrOpcode::kMapGuard, Operator::kEliminatable,   // opcode
-      "MapGuard",                                     // name
-      1, 1, 1, 0, 1, 0,                               // counts
-      maps);                                          // parameter
-}
-
 const Operator* CommonOperatorBuilder::TypeGuard(Type* type) {
   return new (zone()) Operator1<Type*>(       // --
       IrOpcode::kTypeGuard, Operator::kPure,  // opcode

src/compiler/common-operator.h

@@ -304,8 +304,6 @@ RegionObservability RegionObservabilityOf(Operator const*) WARN_UNUSED_RESULT;
 std::ostream& operator<<(std::ostream& os,
                          const ZoneVector<MachineType>* types);
 
-ZoneHandleSet<Map> MapGuardMapsOf(Operator const*) WARN_UNUSED_RESULT;
-
 Type* TypeGuardTypeOf(Operator const*) WARN_UNUSED_RESULT;
 
 int OsrValueIndexOf(Operator const*);
@@ -419,7 +417,6 @@ class V8_EXPORT_PRIVATE CommonOperatorBuilder final
   const Operator* TailCall(const CallDescriptor* descriptor);
   const Operator* Projection(size_t index);
   const Operator* Retain();
-  const Operator* MapGuard(ZoneHandleSet<Map> maps);
   const Operator* TypeGuard(Type* type);
 
   // Constructs a new merge or phi operator with the same opcode as {op}, but

src/compiler/effect-control-linearizer.cc

@@ -1339,7 +1339,7 @@ void EffectControlLinearizer::LowerCheckMaps(Node* node, Node* frame_state) {
 }
 
 Node* EffectControlLinearizer::LowerCompareMaps(Node* node) {
-  ZoneHandleSet<Map> const& maps = CompareMapsParametersOf(node->op());
+  ZoneHandleSet<Map> const& maps = CompareMapsParametersOf(node->op()).maps();
   size_t const map_count = maps.size();
   Node* value = node->InputAt(0);
 

src/compiler/escape-analysis.cc

@@ -661,8 +661,8 @@ void ReduceNode(const Operator* op, EscapeAnalysisTracker::Scope* current,
         if (Node* map = current->Get(map_field)) {
           Type* const map_type = NodeProperties::GetType(map);
           if (map_type->IsHeapConstant() &&
-              params.maps().contains(ZoneHandleSet<Map>(bit_cast<Handle<Map>>(
-                  map_type->AsHeapConstant()->Value())))) {
+              params.maps().contains(
+                  bit_cast<Handle<Map>>(map_type->AsHeapConstant()->Value()))) {
             current->MarkForDeletion();
             break;
           }
@@ -683,7 +683,7 @@ void ReduceNode(const Operator* op, EscapeAnalysisTracker::Scope* current,
           vobject->FieldAt(HeapObject::kMapOffset).To(&map_field)) {
         if (Node* object_map = current->Get(map_field)) {
           current->SetReplacement(LowerCompareMapsWithoutLoad(
-              object_map, CompareMapsParametersOf(op), jsgraph));
+              object_map, CompareMapsParametersOf(op).maps(), jsgraph));
           break;
         } else {
           // If the variable has no value, we have not reached the fixed-point

src/compiler/js-native-context-specialization.cc

@@ -832,7 +832,7 @@ Reduction JSNativeContextSpecialization::ReduceNamedAccess(
           for (auto receiver_map : receiver_maps) {
             maps.insert(receiver_map, graph()->zone());
           }
-          this_effect = graph()->NewNode(common()->MapGuard(maps), receiver,
+          this_effect = graph()->NewNode(simplified()->MapGuard(maps), receiver,
                                          this_effect, this_control);
         }
       }
@@ -1188,7 +1188,7 @@ Reduction JSNativeContextSpecialization::ReduceElementAccess(
           this_control = graph()->NewNode(common()->IfTrue(), branch);
 
           // Introduce a MapGuard to learn from this on the effect chain.
-          this_effect = graph()->NewNode(common()->MapGuard(maps), receiver,
+          this_effect = graph()->NewNode(simplified()->MapGuard(maps), receiver,
                                          this_effect, this_control);
         }
 

src/compiler/load-elimination.cc

@@ -738,7 +738,7 @@ Reduction LoadElimination::ReduceArrayBufferWasNeutered(Node* node) {
 }
 
 Reduction LoadElimination::ReduceMapGuard(Node* node) {
-  ZoneHandleSet<Map> const maps = MapGuardMapsOf(node->op());
+  ZoneHandleSet<Map> const maps = MapGuardMapsOf(node->op()).maps();
   Node* const object = NodeProperties::GetValueInput(node, 0);
   Node* const effect = NodeProperties::GetEffectInput(node);
   AbstractState const* state = node_states_.Get(effect);
@@ -768,7 +768,7 @@ Reduction LoadElimination::ReduceCheckMaps(Node* node) {
 }
 
 Reduction LoadElimination::ReduceCompareMaps(Node* node) {
-  ZoneHandleSet<Map> const maps = CompareMapsParametersOf(node->op());
+  ZoneHandleSet<Map> const maps = CompareMapsParametersOf(node->op()).maps();
   Node* const object = NodeProperties::GetValueInput(node, 0);
   Node* const effect = NodeProperties::GetEffectInput(node);
   AbstractState const* state = node_states_.Get(effect);

src/compiler/node-properties.cc

@@ -362,7 +362,7 @@ NodeProperties::InferReceiverMapsResult NodeProperties::InferReceiverMaps(
       case IrOpcode::kMapGuard: {
         Node* const object = GetValueInput(effect, 0);
         if (IsSame(receiver, object)) {
-          *maps_return = MapGuardMapsOf(effect->op());
+          *maps_return = MapGuardMapsOf(effect->op()).maps();
           return result;
         }
         break;

src/compiler/simplified-operator.cc

@@ -179,6 +179,40 @@ std::ostream& operator<<(std::ostream& os, CheckMapsFlags flags) {
   return os;
 }
 
+MapsParameterInfo::MapsParameterInfo(ZoneHandleSet<Map> const& maps)
+    : maps_(maps), instance_type_(Nothing<InstanceType>()) {
+  DCHECK_LT(0, maps.size());
+  instance_type_ = Just(maps.at(0)->instance_type());
+  for (size_t i = 1; i < maps.size(); ++i) {
+    if (instance_type_.FromJust() != maps.at(i)->instance_type()) {
+      instance_type_ = Nothing<InstanceType>();
+      break;
+    }
+  }
+}
+
+std::ostream& operator<<(std::ostream& os, MapsParameterInfo const& p) {
+  ZoneHandleSet<Map> const& maps = p.maps();
+  InstanceType instance_type;
+  if (p.instance_type().To(&instance_type)) {
+    os << ", " << instance_type;
+  }
+  for (size_t i = 0; i < maps.size(); ++i) {
+    os << ", " << Brief(*maps[i]);
+  }
+  return os;
+}
+
+bool operator==(MapsParameterInfo const& lhs, MapsParameterInfo const& rhs) {
+  return lhs.maps() == rhs.maps();
+}
+
+bool operator!=(MapsParameterInfo const& lhs, MapsParameterInfo const& rhs) {
+  return !(lhs == rhs);
+}
+
+size_t hash_value(MapsParameterInfo const& p) { return hash_value(p.maps()); }
+
 bool operator==(CheckMapsParameters const& lhs,
                 CheckMapsParameters const& rhs) {
   return lhs.flags() == rhs.flags() && lhs.maps() == rhs.maps();
@@ -189,12 +223,7 @@ size_t hash_value(CheckMapsParameters const& p) {
 }
 
 std::ostream& operator<<(std::ostream& os, CheckMapsParameters const& p) {
-  ZoneHandleSet<Map> const& maps = p.maps();
-  os << p.flags();
-  for (size_t i = 0; i < maps.size(); ++i) {
-    os << ", " << Brief(*maps[i]);
-  }
-  return os;
+  return os << p.flags() << p.maps_info();
 }
 
 CheckMapsParameters const& CheckMapsParametersOf(Operator const* op) {
@@ -202,9 +231,14 @@ CheckMapsParameters const& CheckMapsParametersOf(Operator const* op) {
   return OpParameter<CheckMapsParameters>(op);
 }
 
-ZoneHandleSet<Map> const& CompareMapsParametersOf(Operator const* op) {
+MapsParameterInfo const& CompareMapsParametersOf(Operator const* op) {
   DCHECK_EQ(IrOpcode::kCompareMaps, op->opcode());
-  return OpParameter<ZoneHandleSet<Map>>(op);
+  return OpParameter<MapsParameterInfo>(op);
+}
+
+MapsParameterInfo const& MapGuardMapsOf(Operator const* op) {
+  DCHECK_EQ(IrOpcode::kMapGuard, op->opcode());
+  return OpParameter<MapsParameterInfo>(op);
 }
 
 size_t hash_value(CheckTaggedInputMode mode) {
@@ -975,14 +1009,22 @@ const Operator* SimplifiedOperatorBuilder::CheckMaps(CheckMapsFlags flags,
       parameters);                                     // parameter
 }
 
+const Operator* SimplifiedOperatorBuilder::MapGuard(ZoneHandleSet<Map> maps) {
+  return new (zone()) Operator1<MapsParameterInfo>(  // --
+      IrOpcode::kMapGuard, Operator::kEliminatable,  // opcode
+      "MapGuard",                                    // name
+      1, 1, 1, 0, 1, 0,                              // counts
+      MapsParameterInfo(maps));                      // parameter
+}
+
 const Operator* SimplifiedOperatorBuilder::CompareMaps(
     ZoneHandleSet<Map> maps) {
-  return new (zone()) Operator1<ZoneHandleSet<Map>>(  // --
-      IrOpcode::kCompareMaps,                         // opcode
-      Operator::kEliminatable,                        // flags
-      "CompareMaps",                                  // name
-      1, 1, 1, 1, 1, 0,                               // counts
-      maps);                                          // parameter
+  return new (zone()) Operator1<MapsParameterInfo>(  // --
+      IrOpcode::kCompareMaps,                        // opcode
+      Operator::kEliminatable,                       // flags
+      "CompareMaps",                                 // name
+      1, 1, 1, 1, 1, 0,                              // counts
+      MapsParameterInfo(maps));                      // parameter
 }
 
 const Operator* SimplifiedOperatorBuilder::CheckFloat64Hole(

src/compiler/simplified-operator.h

@@ -133,18 +133,38 @@ DEFINE_OPERATORS_FOR_FLAGS(CheckMapsFlags)
 
 std::ostream& operator<<(std::ostream&, CheckMapsFlags);
 
+class MapsParameterInfo {
+ public:
+  explicit MapsParameterInfo(ZoneHandleSet<Map> const& maps);
+
+  Maybe<InstanceType> instance_type() const { return instance_type_; }
+  ZoneHandleSet<Map> const& maps() const { return maps_; }
+
+ private:
+  ZoneHandleSet<Map> const maps_;
+  Maybe<InstanceType> instance_type_;
+};
+
+std::ostream& operator<<(std::ostream&, MapsParameterInfo const&);
+
+bool operator==(MapsParameterInfo const&, MapsParameterInfo const&);
+bool operator!=(MapsParameterInfo const&, MapsParameterInfo const&);
+
+size_t hash_value(MapsParameterInfo const&);
+
 // A descriptor for map checks.
 class CheckMapsParameters final {
  public:
   CheckMapsParameters(CheckMapsFlags flags, ZoneHandleSet<Map> const& maps)
-      : flags_(flags), maps_(maps) {}
+      : flags_(flags), maps_info_(maps) {}
 
   CheckMapsFlags flags() const { return flags_; }
-  ZoneHandleSet<Map> const& maps() const { return maps_; }
+  ZoneHandleSet<Map> const& maps() const { return maps_info_.maps(); }
+  MapsParameterInfo const& maps_info() const { return maps_info_; }
 
  private:
   CheckMapsFlags const flags_;
-  ZoneHandleSet<Map> const maps_;
+  MapsParameterInfo const maps_info_;
 };
 
 bool operator==(CheckMapsParameters const&, CheckMapsParameters const&);
@@ -156,8 +176,10 @@ std::ostream& operator<<(std::ostream&, CheckMapsParameters const&);
 CheckMapsParameters const& CheckMapsParametersOf(Operator const*)
     WARN_UNUSED_RESULT;
 
+MapsParameterInfo const& MapGuardMapsOf(Operator const*) WARN_UNUSED_RESULT;
+
 // Parameters for CompareMaps operator.
-ZoneHandleSet<Map> const& CompareMapsParametersOf(Operator const*)
+MapsParameterInfo const& CompareMapsParametersOf(Operator const*)
     WARN_UNUSED_RESULT;
 
 // A descriptor for growing elements backing stores.
@@ -416,6 +438,7 @@ class V8_EXPORT_PRIVATE SimplifiedOperatorBuilder final
   const Operator* CheckBounds();
   const Operator* CheckMaps(CheckMapsFlags, ZoneHandleSet<Map>);
   const Operator* CompareMaps(ZoneHandleSet<Map>);
+  const Operator* MapGuard(ZoneHandleSet<Map> maps);
 
   const Operator* CheckHeapObject();
   const Operator* CheckInternalizedString();

src/zone/zone-handle-set.h

@@ -96,6 +96,15 @@ class ZoneHandleSet final {
     return true;
   }
 
+  bool contains(Handle<T> other) const {
+    if (data_ == kEmptyTag) return false;
+    if ((data_ & kTagMask) == kSingletonTag) {
+      return singleton() == bit_cast<T**>(other.address());
+    }
+    DCHECK_EQ(kListTag, data_ & kTagMask);
+    return list()->Contains(bit_cast<T**>(other.address()));
+  }
+
   void remove(Handle<T> handle, Zone* zone) {
     // TODO(bmeurer): Optimize this case.
     ZoneHandleSet<T> that;