[turbofan] Specialize to closure with function context specialization.

R=jarin@chromium.org
BUG=v8:5267,v8:6181

Review-Url: https://codereview.chromium.org/2792553002
Cr-Commit-Position: refs/heads/master@{#44305}

src/compiler/js-context-specialization.cc

@@ -7,6 +7,7 @@
 #include "src/compiler/common-operator.h"
 #include "src/compiler/js-graph.h"
 #include "src/compiler/js-operator.h"
+#include "src/compiler/linkage.h"
 #include "src/compiler/node-matchers.h"
 #include "src/compiler/node-properties.h"
 #include "src/contexts.h"
@@ -18,6 +19,8 @@ namespace compiler {
 
 Reduction JSContextSpecialization::Reduce(Node* node) {
   switch (node->opcode()) {
+    case IrOpcode::kParameter:
+      return ReduceParameter(node);
     case IrOpcode::kJSLoadContext:
       return ReduceJSLoadContext(node);
     case IrOpcode::kJSStoreContext:
@@ -28,6 +31,20 @@ Reduction JSContextSpecialization::Reduce(Node* node) {
   return NoChange();
 }
 
+Reduction JSContextSpecialization::ReduceParameter(Node* node) {
+  DCHECK_EQ(IrOpcode::kParameter, node->opcode());
+  int const index = ParameterIndexOf(node->op());
+  if (index == Linkage::kJSCallClosureParamIndex) {
+    // Constant-fold the function parameter {node}.
+    Handle<JSFunction> function;
+    if (closure().ToHandle(&function)) {
+      Node* value = jsgraph()->HeapConstant(function);
+      return Replace(value);
+    }
+  }
+  return NoChange();
+}
+
 Reduction JSContextSpecialization::SimplifyJSLoadContext(Node* node,
                                                          Node* new_context,
                                                          size_t new_depth) {

src/compiler/js-context-specialization.h

@@ -21,12 +21,17 @@ class JSOperatorBuilder;
 class JSContextSpecialization final : public AdvancedReducer {
  public:
   JSContextSpecialization(Editor* editor, JSGraph* jsgraph,
-                          MaybeHandle<Context> context)
+                          MaybeHandle<Context> context,
-      : AdvancedReducer(editor), jsgraph_(jsgraph), context_(context) {}
+                          MaybeHandle<JSFunction> closure)
+      : AdvancedReducer(editor),
+        jsgraph_(jsgraph),
+        context_(context),
+        closure_(closure) {}
 
   Reduction Reduce(Node* node) final;
 
  private:
+  Reduction ReduceParameter(Node* node);
   Reduction ReduceJSLoadContext(Node* node);
   Reduction ReduceJSStoreContext(Node* node);
 
@@ -39,9 +44,11 @@ class JSContextSpecialization final : public AdvancedReducer {
   JSOperatorBuilder* javascript() const;
   JSGraph* jsgraph() const { return jsgraph_; }
   MaybeHandle<Context> context() const { return context_; }
+  MaybeHandle<JSFunction> closure() const { return closure_; }
 
   JSGraph* const jsgraph_;
   MaybeHandle<Context> context_;
+  MaybeHandle<JSFunction> closure_;
 
   DISALLOW_COPY_AND_ASSIGN(JSContextSpecialization);
 };

src/compiler/pipeline.cc

@@ -799,7 +799,10 @@ struct InliningPhase {
         &graph_reducer, data->jsgraph(),
         data->info()->is_function_context_specializing()
             ? handle(data->info()->context())
-            : MaybeHandle<Context>());
+            : MaybeHandle<Context>(),
+        data->info()->is_function_context_specializing()
+            ? data->info()->closure()
+            : MaybeHandle<JSFunction>());
     JSFrameSpecialization frame_specialization(
         &graph_reducer, data->info()->osr_frame(), data->jsgraph());
     JSNativeContextSpecialization::Flags flags =

test/cctest/compiler/test-js-context-specialization.cc

@@ -30,7 +30,7 @@ class ContextSpecializationTester : public HandleAndZoneScope {
         jsgraph_(main_isolate(), graph(), common(), &javascript_, &simplified_,
                  &machine_),
         reducer_(main_zone(), graph()),
-        spec_(&reducer_, jsgraph(), context) {}
+        spec_(&reducer_, jsgraph(), context, MaybeHandle<JSFunction>()) {}
 
   JSContextSpecialization* spec() { return &spec_; }
   Factory* factory() { return main_isolate()->factory(); }