[turbofan] Introduce MachineRepresentation to PropertyAccessInfo.

Increasingly, we avoid using the representation dimension of Type,
  and set it explicitly ourselves.

BUG=

Review-Url: https://codereview.chromium.org/2290233002
Cr-Commit-Position: refs/heads/master@{#39026}

src/compiler/access-builder.cc

@@ -333,7 +333,7 @@ FieldAccess AccessBuilder::ForFixedArrayLength() {
                         FixedArray::kLengthOffset,
                         MaybeHandle<Name>(),
                         TypeCache::Get().kFixedArrayLengthType,
-                        MachineType::AnyTagged(),
+                        MachineType::TaggedSigned(),
                         kNoWriteBarrier};
   return access;
 }
@@ -449,7 +449,7 @@ FieldAccess AccessBuilder::ForStringLength() {
                         String::kLengthOffset,
                         Handle<Name>(),
                         TypeCache::Get().kStringLengthType,
-                        MachineType::AnyTagged(),
+                        MachineType::TaggedSigned(),
                         kNoWriteBarrier};
   return access;
 }

src/compiler/access-info.h

@@ -8,6 +8,7 @@
 #include <iosfwd>
 
 #include "src/field-index.h"
+#include "src/machine-type.h"
 #include "src/objects.h"
 #include "src/zone-containers.h"
 
@@ -68,7 +69,8 @@ class PropertyAccessInfo final {
                                          Handle<Object> constant,
                                          MaybeHandle<JSObject> holder);
   static PropertyAccessInfo DataField(
-      MapList const& receiver_maps, FieldIndex field_index, Type* field_type,
+      MapList const& receiver_maps, FieldIndex field_index,
+      MachineRepresentation field_representation, Type* field_type,
       MaybeHandle<JSObject> holder = MaybeHandle<JSObject>(),
       MaybeHandle<Map> transition_map = MaybeHandle<Map>());
   static PropertyAccessInfo AccessorConstant(MapList const& receiver_maps,
@@ -92,6 +94,9 @@ class PropertyAccessInfo final {
   Handle<Object> constant() const { return constant_; }
   FieldIndex field_index() const { return field_index_; }
   Type* field_type() const { return field_type_; }
+  MachineRepresentation field_representation() const {
+    return field_representation_;
+  }
   MapList const& receiver_maps() const { return receiver_maps_; }
 
  private:
@@ -101,6 +106,7 @@ class PropertyAccessInfo final {
                      Handle<Object> constant, MapList const& receiver_maps);
   PropertyAccessInfo(MaybeHandle<JSObject> holder,
                      MaybeHandle<Map> transition_map, FieldIndex field_index,
+                     MachineRepresentation field_representation,
                      Type* field_type, MapList const& receiver_maps);
 
   Kind kind_;
@@ -109,6 +115,7 @@ class PropertyAccessInfo final {
   MaybeHandle<Map> transition_map_;
   MaybeHandle<JSObject> holder_;
   FieldIndex field_index_;
+  MachineRepresentation field_representation_;
   Type* field_type_;
 };
 

src/compiler/js-native-context-specialization.cc

@@ -881,6 +881,7 @@ JSNativeContextSpecialization::BuildPropertyAccess(
     DCHECK(access_info.IsDataField());
     FieldIndex const field_index = access_info.field_index();
     Type* const field_type = access_info.field_type();
+    MachineRepresentation const rep = access_info.field_representation();
     if (access_mode == AccessMode::kLoad &&
         access_info.holder().ToHandle(&holder)) {
       receiver = jsgraph()->Constant(holder);
@@ -895,12 +896,7 @@ JSNativeContextSpecialization::BuildPropertyAccess(
         kTaggedBase, field_index.offset(),     name,
         field_type,  MachineType::AnyTagged(), kFullWriteBarrier};
     if (access_mode == AccessMode::kLoad) {
-      if (field_type->Is(Type::UntaggedFloat64())) {
-        // TODO(turbofan): We remove the representation axis from the type to
-        // avoid uninhabited representation types. This is a workaround until
-        // the {PropertyAccessInfo} is using {MachineRepresentation} instead.
-        field_access.type = Type::Union(
-            field_type, Type::Representation(Type::Number(), zone()), zone());
+      if (rep == MachineRepresentation::kFloat64) {
         if (!field_index.is_inobject() || field_index.is_hidden_field() ||
             !FLAG_unbox_double_fields) {
           storage = effect = graph()->NewNode(
@@ -914,12 +910,7 @@ JSNativeContextSpecialization::BuildPropertyAccess(
                                         storage, effect, control);
     } else {
       DCHECK_EQ(AccessMode::kStore, access_mode);
-      if (field_type->Is(Type::UntaggedFloat64())) {
-        // TODO(turbofan): We remove the representation axis from the type to
-        // avoid uninhabited representation types. This is a workaround until
-        // the {PropertyAccessInfo} is using {MachineRepresentation} instead.
-        field_access.type = Type::Union(
-            field_type, Type::Representation(Type::Number(), zone()), zone());
+      if (rep == MachineRepresentation::kFloat64) {
         value = effect = graph()->NewNode(simplified()->CheckNumber(), value,
                                           effect, control);
 
@@ -944,6 +935,7 @@ JSNativeContextSpecialization::BuildPropertyAccess(
                 graph()->NewNode(common()->FinishRegion(), box, effect);
 
             field_access.type = Type::TaggedPointer();
+            field_access.machine_type = MachineType::TaggedPointer();
           } else {
             // We just store directly to the MutableHeapNumber.
             storage = effect =
@@ -957,10 +949,10 @@ JSNativeContextSpecialization::BuildPropertyAccess(
           // Unboxed double field, we store directly to the field.
           field_access.machine_type = MachineType::Float64();
         }
-      } else if (field_type->Is(Type::TaggedSigned())) {
+      } else if (rep == MachineRepresentation::kTaggedSigned) {
         value = effect = graph()->NewNode(simplified()->CheckTaggedSigned(),
                                           value, effect, control);
-      } else if (field_type->Is(Type::TaggedPointer())) {
+      } else if (rep == MachineRepresentation::kTaggedPointer) {
         // Ensure that {value} is a HeapObject.
         value = effect = graph()->NewNode(simplified()->CheckTaggedPointer(),
                                           value, effect, control);
@@ -974,7 +966,8 @@ JSNativeContextSpecialization::BuildPropertyAccess(
           DCHECK_EQ(0, field_type->NumClasses());
         }
       } else {
-        DCHECK(field_type->Is(Type::Tagged()));
+        // DCHECK(field_type->Is(Type::Tagged()));
+        DCHECK(rep == MachineRepresentation::kTagged);
       }
       Handle<Map> transition_map;
       if (access_info.transition_map().ToHandle(&transition_map)) {
@@ -1168,6 +1161,7 @@ JSNativeContextSpecialization::BuildElementAccess(
       element_machine_type = MachineType::Float64();
     } else if (IsFastSmiElementsKind(elements_kind)) {
       element_type = type_cache_.kSmi;
+      element_machine_type = MachineType::TaggedSigned();
     }
     ElementAccess element_access = {kTaggedBase, FixedArray::kHeaderSize,
                                     element_type, element_machine_type,
@@ -1181,6 +1175,7 @@ JSNativeContextSpecialization::BuildElementAccess(
           elements_kind == FAST_HOLEY_SMI_ELEMENTS) {
         element_access.type =
             Type::Union(element_type, Type::Hole(), graph()->zone());
+        element_access.machine_type = MachineType::AnyTagged();
       }
       // Perform the actual backing store access.
       value = effect =

src/compiler/type-cache.h

@@ -23,25 +23,19 @@ class TypeCache final {
 
   TypeCache() : zone_(&allocator) {}
 
-  Type* const kInt8 =
-      CreateNative(CreateRange<int8_t>(), Type::UntaggedIntegral8());
-  Type* const kUint8 =
-      CreateNative(CreateRange<uint8_t>(), Type::UntaggedIntegral8());
+  Type* const kInt8 = CreateRange<int8_t>();
+  Type* const kUint8 = CreateRange<uint8_t>();
   Type* const kUint8Clamped = kUint8;
-  Type* const kInt16 =
-      CreateNative(CreateRange<int16_t>(), Type::UntaggedIntegral16());
-  Type* const kUint16 =
-      CreateNative(CreateRange<uint16_t>(), Type::UntaggedIntegral16());
-  Type* const kInt32 =
-      CreateNative(Type::Signed32(), Type::UntaggedIntegral32());
-  Type* const kUint32 =
-      CreateNative(Type::Unsigned32(), Type::UntaggedIntegral32());
-  Type* const kFloat32 = CreateNative(Type::Number(), Type::UntaggedFloat32());
-  Type* const kFloat64 = CreateNative(Type::Number(), Type::UntaggedFloat64());
-
-  Type* const kSmi = CreateNative(Type::SignedSmall(), Type::TaggedSigned());
+  Type* const kInt16 = CreateRange<int16_t>();
+  Type* const kUint16 = CreateRange<uint16_t>();
+  Type* const kInt32 = Type::Signed32();
+  Type* const kUint32 = Type::Unsigned32();
+  Type* const kFloat32 = Type::Number();
+  Type* const kFloat64 = Type::Number();
+
+  Type* const kSmi = Type::SignedSmall();
   Type* const kHoleySmi = Type::Union(kSmi, Type::Hole(), zone());
-  Type* const kHeapNumber = CreateNative(Type::Number(), Type::TaggedPointer());
+  Type* const kHeapNumber = Type::Number();
 
   Type* const kSingletonZero = CreateRange(0.0, 0.0);
   Type* const kSingletonOne = CreateRange(1.0, 1.0);
@@ -81,28 +75,24 @@ class TypeCache final {
 
   // The FixedArray::length property always containts a smi in the range
   // [0, FixedArray::kMaxLength].
-  Type* const kFixedArrayLengthType = CreateNative(
-      CreateRange(0.0, FixedArray::kMaxLength), Type::TaggedSigned());
+  Type* const kFixedArrayLengthType = CreateRange(0.0, FixedArray::kMaxLength);
 
   // The FixedDoubleArray::length property always containts a smi in the range
   // [0, FixedDoubleArray::kMaxLength].
-  Type* const kFixedDoubleArrayLengthType = CreateNative(
-      CreateRange(0.0, FixedDoubleArray::kMaxLength), Type::TaggedSigned());
+  Type* const kFixedDoubleArrayLengthType =
+      CreateRange(0.0, FixedDoubleArray::kMaxLength);
 
   // The JSArray::length property always contains a tagged number in the range
   // [0, kMaxUInt32].
-  Type* const kJSArrayLengthType =
-      CreateNative(Type::Unsigned32(), Type::Tagged());
+  Type* const kJSArrayLengthType = Type::Unsigned32();
 
   // The JSTyped::length property always contains a tagged number in the range
   // [0, kMaxSmiValue].
-  Type* const kJSTypedArrayLengthType =
-      CreateNative(Type::UnsignedSmall(), Type::TaggedSigned());
+  Type* const kJSTypedArrayLengthType = Type::UnsignedSmall();
 
   // The String::length property always contains a smi in the range
   // [0, String::kMaxLength].
-  Type* const kStringLengthType =
-      CreateNative(CreateRange(0.0, String::kMaxLength), Type::TaggedSigned());
+  Type* const kStringLengthType = CreateRange(0.0, String::kMaxLength);
 
   // The JSDate::day property always contains a tagged number in the range
   // [1, 31] or NaN.
@@ -159,10 +149,6 @@ class TypeCache final {
     return Type::Function(array, arg1, arg2, arg3, zone());
   }
 
-  Type* CreateNative(Type* semantic, Type* representation) {
-    return Type::Intersect(semantic, representation, zone());
-  }
-
   template <typename T>
   Type* CreateRange() {
     return CreateRange(std::numeric_limits<T>::min(),

src/compiler/verifier.cc

@@ -361,8 +361,6 @@ void Verifier::Visitor::Check(Node* node) {
     case IrOpcode::kHeapConstant:
       // Constants have no inputs.
       CHECK_EQ(0, input_count);
-      // Type can be anything represented as a heap pointer.
-      CheckTypeIs(node, Type::TaggedPointer());
       break;
     case IrOpcode::kExternalConstant:
       // Constants have no inputs.
@@ -861,7 +859,6 @@ void Verifier::Visitor::Check(Node* node) {
       break;
     case IrOpcode::kAllocate:
       CheckValueInputIs(node, 0, Type::PlainNumber());
-      CheckTypeIs(node, Type::TaggedPointer());
       break;
     case IrOpcode::kEnsureWritableFastElements:
       CheckValueInputIs(node, 0, Type::Any());
@@ -1018,11 +1015,9 @@ void Verifier::Visitor::Check(Node* node) {
       break;
     case IrOpcode::kCheckTaggedSigned:
       CheckValueInputIs(node, 0, Type::Any());
-      CheckTypeIs(node, Type::TaggedSigned());
       break;
     case IrOpcode::kCheckTaggedPointer:
       CheckValueInputIs(node, 0, Type::Any());
-      CheckTypeIs(node, Type::TaggedPointer());
       break;
 
     case IrOpcode::kCheckedInt32Add:

src/machine-type.h

@@ -169,7 +169,7 @@ class MachineType {
     return MachineType(MachineRepresentation::kBit, MachineSemantic::kNone);
   }
 
-  static MachineType TypeForRepresentation(MachineRepresentation& rep,
+  static MachineType TypeForRepresentation(const MachineRepresentation& rep,
                                            bool isSigned = true) {
     switch (rep) {
       case MachineRepresentation::kNone:
@@ -192,6 +192,10 @@ class MachineType {
         return MachineType::Simd128();
       case MachineRepresentation::kTagged:
         return MachineType::AnyTagged();
+      case MachineRepresentation::kTaggedSigned:
+        return MachineType::TaggedSigned();
+      case MachineRepresentation::kTaggedPointer:
+        return MachineType::TaggedPointer();
       default:
         UNREACHABLE();
         return MachineType::None();