[turbofan] Move Number.isSafeInteger to JSCallReducer

This also introduces two new simplified operators, ObjectIsSafeInteger
and NumberIsSafeInteger.

Bug: v8:7340, v8:7250
Change-Id: I9a3028d844e6614ed248a03fe24b431fb54938f0
Reviewed-on: https://chromium-review.googlesource.com/973221
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52112}

src/compiler/effect-control-linearizer.cc

@@ -878,6 +878,12 @@ bool EffectControlLinearizer::TryWireInStateEffect(Node* node,
     case IrOpcode::kObjectIsInteger:
       result = LowerObjectIsInteger(node);
       break;
+    case IrOpcode::kNumberIsSafeInteger:
+      result = LowerNumberIsSafeInteger(node);
+      break;
+    case IrOpcode::kObjectIsSafeInteger:
+      result = LowerObjectIsSafeInteger(node);
+      break;
     case IrOpcode::kCheckFloat64Hole:
       result = LowerCheckFloat64Hole(node, frame_state);
       break;
@@ -2227,6 +2233,52 @@ Node* EffectControlLinearizer::LowerObjectIsInteger(Node* node) {
   return done.PhiAt(0);
 }
 
+Node* EffectControlLinearizer::LowerNumberIsSafeInteger(Node* node) {
+  Node* number = node->InputAt(0);
+  Node* zero = __ Int32Constant(0);
+  auto done = __ MakeLabel(MachineRepresentation::kBit);
+
+  Node* trunc = BuildFloat64RoundTruncate(number);
+  Node* diff = __ Float64Sub(number, trunc);
+  Node* check = __ Float64Equal(diff, __ Float64Constant(0));
+  __ GotoIfNot(check, &done, zero);
+  Node* in_range = __ Float64LessThanOrEqual(
+      __ Float64Abs(trunc), __ Float64Constant(kMaxSafeInteger));
+  __ Goto(&done, in_range);
+
+  __ Bind(&done);
+  return done.PhiAt(0);
+}
+
+Node* EffectControlLinearizer::LowerObjectIsSafeInteger(Node* node) {
+  Node* object = node->InputAt(0);
+  Node* zero = __ Int32Constant(0);
+  Node* one = __ Int32Constant(1);
+
+  auto done = __ MakeLabel(MachineRepresentation::kBit);
+
+  // Check if {object} is a Smi.
+  __ GotoIf(ObjectIsSmi(object), &done, one);
+
+  // Check if {object} is a HeapNumber.
+  Node* value_map = __ LoadField(AccessBuilder::ForMap(), object);
+  __ GotoIfNot(__ WordEqual(value_map, __ HeapNumberMapConstant()), &done,
+               zero);
+
+  // {object} is a HeapNumber.
+  Node* value = __ LoadField(AccessBuilder::ForHeapNumberValue(), object);
+  Node* trunc = BuildFloat64RoundTruncate(value);
+  Node* diff = __ Float64Sub(value, trunc);
+  Node* check = __ Float64Equal(diff, __ Float64Constant(0));
+  __ GotoIfNot(check, &done, zero);
+  Node* in_range = __ Float64LessThanOrEqual(
+      __ Float64Abs(trunc), __ Float64Constant(kMaxSafeInteger));
+  __ Goto(&done, in_range);
+
+  __ Bind(&done);
+  return done.PhiAt(0);
+}
+
 Node* EffectControlLinearizer::LowerObjectIsMinusZero(Node* node) {
   Node* value = node->InputAt(0);
   Node* zero = __ Int32Constant(0);

src/compiler/effect-control-linearizer.h

@@ -109,6 +109,8 @@ class V8_EXPORT_PRIVATE EffectControlLinearizer {
   Node* LowerObjectIsFiniteNumber(Node* node);
   Node* LowerNumberIsInteger(Node* node);
   Node* LowerObjectIsInteger(Node* node);
+  Node* LowerNumberIsSafeInteger(Node* node);
+  Node* LowerObjectIsSafeInteger(Node* node);
   Node* LowerArgumentsFrame(Node* node);
   Node* LowerArgumentsLength(Node* node);
   Node* LowerNewDoubleElements(Node* node);

src/compiler/js-builtin-reducer.cc

@@ -684,17 +684,6 @@ Reduction JSBuiltinReducer::ReduceGlobalIsNaN(Node* node) {
   return NoChange();
 }
 
-// ES6 section 20.1.2.5 Number.isSafeInteger ( number )
-Reduction JSBuiltinReducer::ReduceNumberIsSafeInteger(Node* node) {
-  JSCallReduction r(node);
-  if (r.InputsMatchOne(type_cache_.kSafeInteger)) {
-    // Number.isInteger(x:safe-integer) -> #true
-    Node* value = jsgraph()->TrueConstant();
-    return Replace(value);
-  }
-  return NoChange();
-}
-
 // ES6 section 20.1.2.13 Number.parseInt ( string, radix )
 Reduction JSBuiltinReducer::ReduceNumberParseInt(Node* node) {
   JSCallReduction r(node);
@@ -877,9 +866,6 @@ Reduction JSBuiltinReducer::Reduce(Node* node) {
           node, OrderedHashMap::kEntrySize, factory()->empty_ordered_hash_map(),
           FIRST_MAP_ITERATOR_TYPE, LAST_MAP_ITERATOR_TYPE);
       break;
-    case kNumberIsSafeInteger:
-      reduction = ReduceNumberIsSafeInteger(node);
-      break;
     case kNumberParseInt:
       reduction = ReduceNumberParseInt(node);
       break;

src/compiler/js-builtin-reducer.h

@@ -55,7 +55,6 @@ class V8_EXPORT_PRIVATE JSBuiltinReducer final
   Reduction ReduceDateGetTime(Node* node);
   Reduction ReduceGlobalIsFinite(Node* node);
   Reduction ReduceGlobalIsNaN(Node* node);
-  Reduction ReduceNumberIsSafeInteger(Node* node);
   Reduction ReduceNumberParseInt(Node* node);
   Reduction ReduceObjectCreate(Node* node);
   Reduction ReduceArrayBufferIsView(Node* node);

src/compiler/js-call-reducer.cc

@@ -3428,6 +3428,8 @@ Reduction JSCallReducer::ReduceJSCall(Node* node,
       return ReduceNumberIsFinite(node);
     case Builtins::kNumberIsInteger:
       return ReduceNumberIsInteger(node);
+    case Builtins::kNumberIsSafeInteger:
+      return ReduceNumberIsSafeInteger(node);
     case Builtins::kNumberIsNaN:
       return ReduceNumberIsNaN(node);
     case Builtins::kMapPrototypeGet:
@@ -5915,6 +5917,19 @@ Reduction JSCallReducer::ReduceNumberIsInteger(Node* node) {
   return Replace(value);
 }
 
+// ES #sec-number.issafeinteger
+Reduction JSCallReducer::ReduceNumberIsSafeInteger(Node* node) {
+  if (node->op()->ValueInputCount() < 3) {
+    Node* value = jsgraph()->FalseConstant();
+    ReplaceWithValue(node, value);
+    return Replace(value);
+  }
+  Node* input = NodeProperties::GetValueInput(node, 2);
+  Node* value = graph()->NewNode(simplified()->ObjectIsSafeInteger(), input);
+  ReplaceWithValue(node, value);
+  return Replace(value);
+}
+
 // ES #sec-number.isnan
 Reduction JSCallReducer::ReduceNumberIsNaN(Node* node) {
   if (node->op()->ValueInputCount() < 3) {

src/compiler/js-call-reducer.h

@@ -152,6 +152,7 @@ class V8_EXPORT_PRIVATE JSCallReducer final : public AdvancedReducer {
 
   Reduction ReduceNumberIsFinite(Node* node);
   Reduction ReduceNumberIsInteger(Node* node);
+  Reduction ReduceNumberIsSafeInteger(Node* node);
   Reduction ReduceNumberIsNaN(Node* node);
 
   Reduction ReduceMapPrototypeHas(Node* node);

src/compiler/opcodes.h

@@ -387,6 +387,8 @@
   V(NumberIsFinite)                     \
   V(ObjectIsFiniteNumber)               \
   V(NumberIsInteger)                    \
+  V(ObjectIsSafeInteger)                \
+  V(NumberIsSafeInteger)                \
   V(ObjectIsInteger)                    \
   V(ObjectIsArrayBufferView)            \
   V(ObjectIsBigInt)                     \

src/compiler/simplified-lowering.cc

@@ -2771,6 +2771,33 @@ class RepresentationSelector {
       case IrOpcode::kNumberIsFinite: {
         UNREACHABLE();
       }
+      case IrOpcode::kObjectIsSafeInteger: {
+        Type* const input_type = GetUpperBound(node->InputAt(0));
+        if (input_type->Is(type_cache_.kSafeInteger)) {
+          VisitUnop(node, UseInfo::None(), MachineRepresentation::kBit);
+          if (lower()) {
+            DeferReplacement(node, lowering->jsgraph()->Int32Constant(1));
+          }
+        } else if (!input_type->Maybe(Type::Number())) {
+          VisitUnop(node, UseInfo::Any(), MachineRepresentation::kBit);
+          if (lower()) {
+            DeferReplacement(node, lowering->jsgraph()->Int32Constant(0));
+          }
+        } else if (input_type->Is(Type::Number())) {
+          VisitUnop(node, UseInfo::TruncatingFloat64(),
+                    MachineRepresentation::kBit);
+          if (lower()) {
+            NodeProperties::ChangeOp(
+                node, lowering->simplified()->NumberIsSafeInteger());
+          }
+        } else {
+          VisitUnop(node, UseInfo::AnyTagged(), MachineRepresentation::kBit);
+        }
+        return;
+      }
+      case IrOpcode::kNumberIsSafeInteger: {
+        UNREACHABLE();
+      }
       case IrOpcode::kObjectIsInteger: {
         Type* const input_type = GetUpperBound(node->InputAt(0));
         if (input_type->Is(type_cache_.kSafeInteger)) {

src/compiler/simplified-operator.cc

@@ -712,6 +712,8 @@ bool operator==(CheckMinusZeroParameters const& lhs,
   V(NumberIsFinite, Operator::kNoProperties, 1, 0)               \
   V(ObjectIsFiniteNumber, Operator::kNoProperties, 1, 0)         \
   V(NumberIsInteger, Operator::kNoProperties, 1, 0)              \
+  V(ObjectIsSafeInteger, Operator::kNoProperties, 1, 0)          \
+  V(NumberIsSafeInteger, Operator::kNoProperties, 1, 0)          \
   V(ObjectIsInteger, Operator::kNoProperties, 1, 0)              \
   V(ConvertTaggedHoleToUndefined, Operator::kNoProperties, 1, 0) \
   V(SameValue, Operator::kCommutative, 2, 0)                     \

src/compiler/simplified-operator.h

@@ -658,6 +658,8 @@ class V8_EXPORT_PRIVATE SimplifiedOperatorBuilder final
   const Operator* NumberIsFinite();
   const Operator* ObjectIsFiniteNumber();
   const Operator* NumberIsInteger();
+  const Operator* ObjectIsSafeInteger();
+  const Operator* NumberIsSafeInteger();
   const Operator* ObjectIsInteger();
 
   const Operator* ArgumentsFrame();

src/compiler/typer.cc

@@ -2184,6 +2184,12 @@ Type* Typer::Visitor::TypeObjectIsFiniteNumber(Node* node) {
 
 Type* Typer::Visitor::TypeNumberIsInteger(Node* node) { UNREACHABLE(); }
 
+Type* Typer::Visitor::TypeObjectIsSafeInteger(Node* node) {
+  return Type::Boolean();
+}
+
+Type* Typer::Visitor::TypeNumberIsSafeInteger(Node* node) { UNREACHABLE(); }
+
 Type* Typer::Visitor::TypeObjectIsInteger(Node* node) {
   return Type::Boolean();
 }

src/compiler/verifier.cc

@@ -1178,6 +1178,14 @@ void Verifier::Visitor::Check(Node* node, const AllNodes& all) {
       CheckValueInputIs(node, 0, Type::Number());
       CheckTypeIs(node, Type::Boolean());
       break;
+    case IrOpcode::kObjectIsSafeInteger:
+      CheckValueInputIs(node, 0, Type::Any());
+      CheckTypeIs(node, Type::Boolean());
+      break;
+    case IrOpcode::kNumberIsSafeInteger:
+      CheckValueInputIs(node, 0, Type::Number());
+      CheckTypeIs(node, Type::Boolean());
+      break;
     case IrOpcode::kObjectIsInteger:
       CheckValueInputIs(node, 0, Type::Any());
       CheckTypeIs(node, Type::Boolean());

test/unittests/compiler/js-builtin-reducer-unittest.cc

@@ -195,28 +195,6 @@ TEST_F(JSBuiltinReducerTest, GlobalIsNaNWithPlainPrimitive) {
                                          IsPlainPrimitiveToNumber(p0))));
 }
 
-// -----------------------------------------------------------------------------
-// Number.isSafeInteger
-
-TEST_F(JSBuiltinReducerTest, NumberIsSafeIntegerWithIntegral32) {
-  Node* function = NumberFunction("isSafeInteger");
-
-  Node* effect = graph()->start();
-  Node* control = graph()->start();
-  Node* context = UndefinedConstant();
-  Node* frame_state = graph()->start();
-  TRACED_FOREACH(Type*, t0, kIntegral32Types) {
-    Node* p0 = Parameter(t0, 0);
-    Node* call =
-        graph()->NewNode(javascript()->Call(3), function, UndefinedConstant(),
-                         p0, context, frame_state, effect, control);
-    Reduction r = Reduce(call);
-
-    ASSERT_TRUE(r.Changed());
-    EXPECT_THAT(r.replacement(), IsTrueConstant());
-  }
-}
-
 // -----------------------------------------------------------------------------
 // Number.parseInt
 

test/unittests/compiler/js-call-reducer-unittest.cc

@@ -511,6 +511,26 @@ TEST_F(JSCallReducerTest, NumberIsNaNWithNumber) {
   EXPECT_THAT(r.replacement(), IsObjectIsNaN(p0));
 }
 
+// -----------------------------------------------------------------------------
+// Number.isSafeInteger
+
+TEST_F(JSCallReducerTest, NumberIsSafeIntegerWithIntegral32) {
+  Node* function = NumberFunction("isSafeInteger");
+
+  Node* effect = graph()->start();
+  Node* control = graph()->start();
+  Node* context = UndefinedConstant();
+  Node* frame_state = graph()->start();
+  Node* p0 = Parameter(Type::Any(), 0);
+  Node* call =
+      graph()->NewNode(javascript()->Call(3), function, UndefinedConstant(), p0,
+                       context, frame_state, effect, control);
+  Reduction r = Reduce(call);
+
+  ASSERT_TRUE(r.Changed());
+  EXPECT_THAT(r.replacement(), IsObjectIsSafeInteger(p0));
+}
+
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8

test/unittests/compiler/node-test-utils.cc

@@ -2182,6 +2182,7 @@ IS_UNOP_MATCHER(NumberToUint32)
 IS_UNOP_MATCHER(PlainPrimitiveToNumber)
 IS_UNOP_MATCHER(ObjectIsFiniteNumber)
 IS_UNOP_MATCHER(ObjectIsInteger)
+IS_UNOP_MATCHER(ObjectIsSafeInteger)
 IS_UNOP_MATCHER(ObjectIsNaN)
 IS_UNOP_MATCHER(ObjectIsReceiver)
 IS_UNOP_MATCHER(ObjectIsSmi)

test/unittests/compiler/node-test-utils.h

@@ -313,6 +313,7 @@ Matcher<Node*> IsStoreElement(const Matcher<ElementAccess>& access_matcher,
 
 Matcher<Node*> IsObjectIsFiniteNumber(const Matcher<Node*>& value_matcher);
 Matcher<Node*> IsObjectIsInteger(const Matcher<Node*>& value_matcher);
+Matcher<Node*> IsObjectIsSafeInteger(const Matcher<Node*>& value_matcher);
 Matcher<Node*> IsObjectIsNaN(const Matcher<Node*>& value_matcher);
 Matcher<Node*> IsObjectIsReceiver(const Matcher<Node*>& value_matcher);
 Matcher<Node*> IsObjectIsSmi(const Matcher<Node*>& value_matcher);