[turbofan] Make StringRef::ToNumber optional.

Don't compute the ToNumber conversion of long strings as it is
expensive.

Bug: v8:7790
Change-Id: Ief104f9229f7f633e31d26c98ed24b08a161525b
Reviewed-on: https://chromium-review.googlesource.com/1177719
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55168}

src/compiler/js-create-lowering.cc

@@ -473,26 +473,6 @@ Reduction JSCreateLowering::ReduceJSCreateGeneratorObject(Node* node) {
   return NoChange();
 }
 
-// TODO(neis): Move this elsewhere.
-#define ASSIGN_RETURN_NO_CHANGE_IF_DATA_MISSING(something_var,          \
-                                                optionally_something)   \
-  auto optionally_something_ = optionally_something;                    \
-  if (!optionally_something_)                                           \
-    return NoChangeBecauseOfMissingData(js_heap_broker(), __FUNCTION__, \
-                                        __LINE__);                      \
-  something_var = *optionally_something_;
-
-namespace {
-Reduction NoChangeBecauseOfMissingData(JSHeapBroker* broker,
-                                       const char* function, int line) {
-  if (FLAG_trace_heap_broker) {
-    PrintF("[%p] Skipping optimization in %s at line %d due to missing data\n",
-           broker, function, line);
-  }
-  return AdvancedReducer::NoChange();
-}
-}  // namespace
-
 // Constructs an array with a variable {length} when no upper bound
 // is known for the capacity.
 Reduction JSCreateLowering::ReduceNewArray(
@@ -1844,8 +1824,6 @@ NativeContextRef JSCreateLowering::native_context_ref() const {
   return NativeContextRef(js_heap_broker(), native_context());
 }
 
-#undef ASSIGN_RETURN_NO_CHANGE_IF_DATA_MISSING
-
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8

src/compiler/js-heap-broker.cc

@@ -4,6 +4,7 @@
 
 #include "src/compiler/js-heap-broker.h"
 
+#include "src/compiler/graph-reducer.h"
 #include "src/objects-inl.h"
 #include "src/objects/js-array-inl.h"
 #include "src/objects/js-regexp-inl.h"
@@ -142,13 +143,18 @@ class StringData : public NameData {
         length(object->length()),
         first_char(length > 0 ? object->Get(0) : 0) {
     int flags = ALLOW_HEX | ALLOW_OCTAL | ALLOW_BINARY;
-    to_number = StringToDouble(
-        broker->isolate(), broker->isolate()->unicode_cache(), object, flags);
+    if (length <= kMaxLengthForDoubleConversion) {
+      to_number = StringToDouble(
+          broker->isolate(), broker->isolate()->unicode_cache(), object, flags);
+    }
   }
 
-  int length;
-  uint16_t first_char;
-  double to_number;
+  int const length;
+  uint16_t const first_char;
+  base::Optional<double> to_number;
+
+ private:
+  static constexpr int kMaxLengthForDoubleConversion = 23;
 };
 
 class InternalizedStringData : public StringData {
@@ -701,7 +707,7 @@ uint16_t StringRef::GetFirstChar() {
   }
 }
 
-double StringRef::ToNumber() {
+base::Optional<double> StringRef::ToNumber() {
   if (broker()->mode() == JSHeapBroker::kDisabled) {
     AllowHandleDereference allow_handle_dereference;
     AllowHandleAllocation allow_handle_allocation;
@@ -997,6 +1003,15 @@ JSHeapBroker* ObjectRef::broker() const { return data_->broker; }
 
 ObjectData* ObjectRef::data() const { return data_; }
 
+Reduction NoChangeBecauseOfMissingData(JSHeapBroker* broker,
+                                       const char* function, int line) {
+  if (FLAG_trace_heap_broker) {
+    PrintF("[%p] Skipping optimization in %s at line %d due to missing data\n",
+           broker, function, line);
+  }
+  return AdvancedReducer::NoChange();
+}
+
 #undef BIMODAL_ACCESSOR
 #undef BIMODAL_ACCESSOR_
 #undef BIMODAL_ACCESSOR_B

src/compiler/js-heap-broker.h

@@ -371,7 +371,7 @@ class StringRef : public NameRef {
 
   int length() const;
   uint16_t GetFirstChar();
-  double ToNumber();
+  base::Optional<double> ToNumber();
 };
 
 class ModuleRef : public HeapObjectRef {
@@ -443,6 +443,18 @@ class V8_EXPORT_PRIVATE JSHeapBroker : public NON_EXPORTED_BASE(ZoneObject) {
   BrokerMode mode_;
 };
 
+#define ASSIGN_RETURN_NO_CHANGE_IF_DATA_MISSING(something_var,          \
+                                                optionally_something)   \
+  auto optionally_something_ = optionally_something;                    \
+  if (!optionally_something_)                                           \
+    return NoChangeBecauseOfMissingData(js_heap_broker(), __FUNCTION__, \
+                                        __LINE__);                      \
+  something_var = *optionally_something_;
+
+class Reduction;
+Reduction NoChangeBecauseOfMissingData(JSHeapBroker* broker,
+                                       const char* function, int line);
+
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8

src/compiler/js-typed-lowering.cc

@@ -990,7 +990,9 @@ Reduction JSTypedLowering::ReduceJSToNumberOrNumericInput(Node* input) {
     HeapObjectMatcher m(input);
     if (m.HasValue() && m.Ref(js_heap_broker()).IsString()) {
       StringRef input_value = m.Ref(js_heap_broker()).AsString();
-      return Replace(jsgraph()->Constant(input_value.ToNumber()));
+      double number;
+      ASSIGN_RETURN_NO_CHANGE_IF_DATA_MISSING(number, input_value.ToNumber());
+      return Replace(jsgraph()->Constant(number));
     }
   }
   if (input_type.IsHeapConstant()) {