Reviewers: dcarney,
Description:
[turbofan] Fix pushing of JSToBooleans into Phis.
Now we actually implement it the way it is meant to be, that is:
JSToBoolean(Phi(x1,...,xn):primitive)
=> Phi(JSToBoolean(x1),...,JSToBoolean(xn)):boolean
This also fixes the endless recursion within JSTypedLowering when
the GraphReducer does all possible reductions instead of using the
generic algorithm.
[email protected]
Please review this at https://codereview.chromium.org/730043002/
Base URL: https://chromium.googlesource.com/v8/v8.git@master
Affected files (+46, -28 lines):
M src/compiler/js-typed-lowering.h
M src/compiler/js-typed-lowering.cc
Index: src/compiler/js-typed-lowering.cc
diff --git a/src/compiler/js-typed-lowering.cc
b/src/compiler/js-typed-lowering.cc
index
fc13eb95e15ac66ad87079f7176e3c99ee238960..d84fc10acf0461dd0a01e40821e034348aea540f
100644
--- a/src/compiler/js-typed-lowering.cc
+++ b/src/compiler/js-typed-lowering.cc
@@ -527,7 +527,7 @@ Reduction JSTypedLowering::ReduceJSToStringInput(Node*
input) {
Reduction JSTypedLowering::ReduceJSToBooleanInput(Node* input) {
if (input->opcode() == IrOpcode::kJSToBoolean) {
// Recursively try to reduce the input first.
- Reduction result = ReduceJSToBooleanInput(input->InputAt(0));
+ Reduction result = ReduceJSToBoolean(input);
if (result.Changed()) {
RelaxEffects(input);
return result;
@@ -571,37 +571,55 @@ Reduction
JSTypedLowering::ReduceJSToBooleanInput(Node* input) {
Node* inv = graph()->NewNode(simplified()->BooleanNot(), cmp);
return ReplaceWith(inv);
}
- // TODO(turbofan): We need some kinda of PrimitiveToBoolean simplified
- // operator, then we can do the pushing in the SimplifiedOperatorReducer
- // and do not need to protect against stack overflow (because of
backedges
- // in phis) below.
- if (input->opcode() == IrOpcode::kPhi &&
- input_type->Is(
- Type::Union(Type::Boolean(), Type::OrderedNumber(), zone()))) {
- // JSToBoolean(phi(x1,...,xn):ordered-number|boolean)
- // => phi(JSToBoolean(x1),...,JSToBoolean(xn))
- int input_count = input->InputCount() - 1;
- Node** inputs = zone()->NewArray<Node*>(input_count + 1);
+ return NoChange();
+}
+
+
+Reduction JSTypedLowering::ReduceJSToBoolean(Node* node) {
+ // Try to reduce the input first.
+ Node* const input = node->InputAt(0);
+ Reduction reduction = ReduceJSToBooleanInput(input);
+ if (reduction.Changed()) {
+ NodeProperties::ReplaceWithValue(node, reduction.replacement());
+ return reduction;
+ }
+ Type* const input_type = NodeProperties::GetBounds(input).upper;
+ if (input->opcode() == IrOpcode::kPhi &&
input_type->Is(Type::Primitive())) {
+ // JSToBoolean(phi(x1,...,xn):primitive)
+ // => phi(JSToBoolean(x1),...,JSToBoolean(xn)):boolean
+ RelaxEffects(node);
+ int const input_count = input->InputCount() - 1;
+ Node* const merge = input->InputAt(input_count);
+ DCHECK_LE(0, input_count);
+ DCHECK_EQ(input_count, merge->InputCount());
+ DCHECK_EQ(IrOpcode::kMerge, merge->opcode());
+ DCHECK(NodeProperties::GetBounds(node).upper->Is(Type::Boolean()));
+ DCHECK(!NodeProperties::GetBounds(input).upper->Is(Type::Boolean()));
+ node->set_op(common()->Phi(kMachAnyTagged, input_count));
for (int i = 0; i < input_count; ++i) {
Node* value = input->InputAt(i);
- Type* value_type = NodeProperties::GetBounds(value).upper;
// Recursively try to reduce the value first.
- Reduction result = (value_type->Is(Type::Boolean()) ||
- value_type->Is(Type::OrderedNumber()))
- ? ReduceJSToBooleanInput(value)
- : NoChange();
- if (result.Changed()) {
- inputs[i] = result.replacement();
+ Reduction reduction = ReduceJSToBooleanInput(value);
+ if (reduction.Changed()) {
+ value = reduction.replacement();
+ } else {
+ value = graph()->NewNode(javascript()->ToBoolean(), value,
+ jsgraph()->ZeroConstant(),
graph()->start(),
+ graph()->start());
+ }
+ if (i < node->InputCount()) {
+ node->ReplaceInput(i, value);
} else {
- inputs[i] = graph()->NewNode(javascript()->ToBoolean(), value,
- jsgraph()->ZeroConstant(),
- graph()->start(), graph()->start());
+ node->AppendInput(graph()->zone(), value);
}
}
- inputs[input_count] = input->InputAt(input_count);
- Node* phi = graph()->NewNode(common()->Phi(kMachAnyTagged,
input_count),
- input_count + 1, inputs);
- return ReplaceWith(phi);
+ if (input_count < node->InputCount()) {
+ node->ReplaceInput(input_count, merge);
+ } else {
+ node->AppendInput(graph()->zone(), merge);
+ }
+ node->TrimInputCount(input_count + 1);
+ return Changed(node);
}
return NoChange();
}
@@ -753,8 +771,7 @@ Reduction JSTypedLowering::Reduce(Node* node) {
}
}
case IrOpcode::kJSToBoolean:
- return ReplaceWithReduction(node,
-
ReduceJSToBooleanInput(node->InputAt(0)));
+ return ReduceJSToBoolean(node);
case IrOpcode::kJSToNumber:
return ReplaceWithReduction(node,
ReduceJSToNumberInput(node->InputAt(0)));
Index: src/compiler/js-typed-lowering.h
diff --git a/src/compiler/js-typed-lowering.h
b/src/compiler/js-typed-lowering.h
index
add5cf83d740020d067c1095e2bc018219170084..ba160c491faa9b9acb0391c896c716976dda996b
100644
--- a/src/compiler/js-typed-lowering.h
+++ b/src/compiler/js-typed-lowering.h
@@ -43,6 +43,7 @@ class JSTypedLowering FINAL : public Reducer {
Reduction ReduceJSToNumberInput(Node* input);
Reduction ReduceJSToStringInput(Node* input);
Reduction ReduceJSToBooleanInput(Node* input);
+ Reduction ReduceJSToBoolean(Node* node);
Reduction ReduceNumberBinop(Node* node, const Operator* numberOp);
Reduction ReduceI32Binop(Node* node, bool left_signed, bool right_signed,
const Operator* intOp);
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
