diff --git a/src/compiler/js-native-context-specialization.cc b/src/compiler/js-native-context-specialization.cc index b21209bcf8..af3ad1c785 100644 --- a/src/compiler/js-native-context-specialization.cc +++ b/src/compiler/js-native-context-specialization.cc @@ -432,8 +432,6 @@ Reduction JSNativeContextSpecialization::ReduceJSInstanceOf(Node* node) { kStartAtPrototype); // Monomorphic property access. - constructor = - access_builder.BuildCheckHeapObject(constructor, &effect, control); access_builder.BuildCheckMaps(constructor, &effect, control, access_info.receiver_maps()); @@ -1124,8 +1122,6 @@ Reduction JSNativeContextSpecialization::ReduceNamedAccess( effect = graph()->NewNode(common()->EffectPhi(2), etrue, efalse, control); } else { - receiver = - access_builder.BuildCheckHeapObject(receiver, &effect, control); access_builder.BuildCheckMaps(receiver, &effect, control, access_info.receiver_maps()); } @@ -1154,7 +1150,7 @@ Reduction JSNativeContextSpecialization::ReduceNamedAccess( } } - // Ensure that {receiver} is a heap object. + // Handle the case that {receiver} may be a number. Node* receiverissmi_control = nullptr; Node* receiverissmi_effect = effect; if (receiverissmi_possible) { @@ -1163,9 +1159,6 @@ Reduction JSNativeContextSpecialization::ReduceNamedAccess( control = graph()->NewNode(common()->IfFalse(), branch); receiverissmi_control = graph()->NewNode(common()->IfTrue(), branch); receiverissmi_effect = effect; - } else { - receiver = - access_builder.BuildCheckHeapObject(receiver, &effect, control); } // Generate code for the various different property access patterns. @@ -1547,10 +1540,6 @@ Reduction JSNativeContextSpecialization::ReduceElementAccess( } } - // Ensure that {receiver} is a heap object. - PropertyAccessBuilder access_builder(jsgraph(), broker(), dependencies()); - receiver = access_builder.BuildCheckHeapObject(receiver, &effect, control); - // Check if we have the necessary data for building element accesses. for (ElementAccessInfo const& access_info : access_infos) { if (!IsFixedTypedArrayElementsKind(access_info.elements_kind())) continue; @@ -1567,6 +1556,7 @@ Reduction JSNativeContextSpecialization::ReduceElementAccess( } // Check for the monomorphic case. + PropertyAccessBuilder access_builder(jsgraph(), broker(), dependencies()); if (access_infos.size() == 1) { ElementAccessInfo access_info = access_infos.front(); @@ -1915,8 +1905,6 @@ Reduction JSNativeContextSpecialization::ReduceNamedAccess( effect = graph()->NewNode(common()->EffectPhi(2), etrue, efalse, control); } else { - receiver = - access_builder.BuildCheckHeapObject(receiver, &effect, control); access_builder.BuildCheckMaps(receiver, &effect, control, access_info.receiver_maps()); } @@ -1945,7 +1933,7 @@ Reduction JSNativeContextSpecialization::ReduceNamedAccess( } } - // Ensure that {receiver} is a heap object. + // Handle the case that {receiver} may be a number. Node* receiverissmi_control = nullptr; Node* receiverissmi_effect = effect; if (receiverissmi_possible) { @@ -1954,9 +1942,6 @@ Reduction JSNativeContextSpecialization::ReduceNamedAccess( control = graph()->NewNode(common()->IfFalse(), branch); receiverissmi_control = graph()->NewNode(common()->IfTrue(), branch); receiverissmi_effect = effect; - } else { - receiver = - access_builder.BuildCheckHeapObject(receiver, &effect, control); } // Generate code for the various different property access patterns. @@ -2602,8 +2587,6 @@ JSNativeContextSpecialization::BuildPropertyStore( MachineRepresentation::kTaggedPointer || field_representation == MachineRepresentation::kCompressedPointer) { - // Ensure that {value} is a HeapObject. - value = access_builder.BuildCheckHeapObject(value, &effect, control); Handle field_map; if (access_info.field_map().ToHandle(&field_map)) { // Emit a map check for the value. @@ -2611,6 +2594,10 @@ JSNativeContextSpecialization::BuildPropertyStore( simplified()->CheckMaps(CheckMapsFlag::kNone, ZoneHandleSet(field_map)), value, effect, control); + } else { + // Ensure that {value} is a HeapObject. + value = effect = graph()->NewNode(simplified()->CheckHeapObject(), + value, effect, control); } field_access.write_barrier_kind = kPointerWriteBarrier; @@ -2721,7 +2708,6 @@ Reduction JSNativeContextSpecialization::ReduceJSStoreDataPropertyInLiteral( // Monomorphic property access. PropertyAccessBuilder access_builder(jsgraph(), broker(), dependencies()); - receiver = access_builder.BuildCheckHeapObject(receiver, &effect, control); access_builder.BuildCheckMaps(receiver, &effect, control, access_info.receiver_maps()); diff --git a/src/compiler/property-access-builder.cc b/src/compiler/property-access-builder.cc index 48b6cbdd70..49ecb1e526 100644 --- a/src/compiler/property-access-builder.cc +++ b/src/compiler/property-access-builder.cc @@ -81,60 +81,6 @@ bool PropertyAccessBuilder::TryBuildNumberCheck( return false; } -namespace { - -bool NeedsCheckHeapObject(Node* receiver) { - switch (receiver->opcode()) { - case IrOpcode::kConvertReceiver: - case IrOpcode::kHeapConstant: - case IrOpcode::kJSCloneObject: - case IrOpcode::kJSConstruct: - case IrOpcode::kJSConstructForwardVarargs: - case IrOpcode::kJSConstructWithArrayLike: - case IrOpcode::kJSConstructWithSpread: - case IrOpcode::kJSCreate: - case IrOpcode::kJSCreateArguments: - case IrOpcode::kJSCreateArray: - case IrOpcode::kJSCreateArrayFromIterable: - case IrOpcode::kJSCreateArrayIterator: - case IrOpcode::kJSCreateAsyncFunctionObject: - case IrOpcode::kJSCreateBoundFunction: - case IrOpcode::kJSCreateClosure: - case IrOpcode::kJSCreateCollectionIterator: - case IrOpcode::kJSCreateEmptyLiteralArray: - case IrOpcode::kJSCreateEmptyLiteralObject: - case IrOpcode::kJSCreateGeneratorObject: - case IrOpcode::kJSCreateIterResultObject: - case IrOpcode::kJSCreateKeyValueArray: - case IrOpcode::kJSCreateLiteralArray: - case IrOpcode::kJSCreateLiteralObject: - case IrOpcode::kJSCreateLiteralRegExp: - case IrOpcode::kJSCreateObject: - case IrOpcode::kJSCreatePromise: - case IrOpcode::kJSCreateStringIterator: - case IrOpcode::kJSCreateTypedArray: - case IrOpcode::kJSGetSuperConstructor: - case IrOpcode::kJSToName: - case IrOpcode::kJSToObject: - case IrOpcode::kJSToString: - case IrOpcode::kTypeOf: - return false; - default: - return true; - } -} - -} // namespace - -Node* PropertyAccessBuilder::BuildCheckHeapObject(Node* receiver, Node** effect, - Node* control) { - if (NeedsCheckHeapObject(receiver)) { - receiver = *effect = graph()->NewNode(simplified()->CheckHeapObject(), - receiver, *effect, control); - } - return receiver; -} - void PropertyAccessBuilder::BuildCheckMaps( Node* receiver, Node** effect, Node* control, ZoneVector> const& receiver_maps) { diff --git a/src/compiler/property-access-builder.h b/src/compiler/property-access-builder.h index 62b629d5ed..dd489328ea 100644 --- a/src/compiler/property-access-builder.h +++ b/src/compiler/property-access-builder.h @@ -41,7 +41,6 @@ class PropertyAccessBuilder { ZoneVector> const& maps, Node** receiver, Node** effect, Node* control); - Node* BuildCheckHeapObject(Node* receiver, Node** effect, Node* control); void BuildCheckMaps(Node* receiver, Node** effect, Node* control, ZoneVector> const& receiver_maps); Node* BuildCheckValue(Node* receiver, Node** effect, Node* control, diff --git a/src/compiler/simplified-lowering.cc b/src/compiler/simplified-lowering.cc index 163e7b6fdb..6e134f7414 100644 --- a/src/compiler/simplified-lowering.cc +++ b/src/compiler/simplified-lowering.cc @@ -3281,14 +3281,21 @@ class RepresentationSelector { case IrOpcode::kMapGuard: // Eliminate MapGuard nodes here. return VisitUnused(node); - case IrOpcode::kCheckMaps: + case IrOpcode::kCheckMaps: { + CheckMapsParameters const& p = CheckMapsParametersOf(node->op()); + return VisitUnop( + node, UseInfo::CheckedHeapObjectAsTaggedPointer(p.feedback()), + MachineRepresentation::kNone); + } case IrOpcode::kTransitionElementsKind: { - VisitInputs(node); - return SetOutput(node, MachineRepresentation::kNone); + return VisitUnop( + node, UseInfo::CheckedHeapObjectAsTaggedPointer(VectorSlotPair()), + MachineRepresentation::kNone); } case IrOpcode::kCompareMaps: - return VisitUnop(node, UseInfo::AnyTagged(), - MachineRepresentation::kBit); + return VisitUnop( + node, UseInfo::CheckedHeapObjectAsTaggedPointer(VectorSlotPair()), + MachineRepresentation::kBit); case IrOpcode::kEnsureWritableFastElements: return VisitBinop(node, UseInfo::AnyTagged(), MachineRepresentation::kTaggedPointer); diff --git a/src/compiler/simplified-operator.cc b/src/compiler/simplified-operator.cc index dfdff4cebc..815c8f5ee4 100644 --- a/src/compiler/simplified-operator.cc +++ b/src/compiler/simplified-operator.cc @@ -1377,7 +1377,7 @@ const Operator* SimplifiedOperatorBuilder::CompareMaps( DCHECK_LT(0, maps.size()); return new (zone()) Operator1>( // -- IrOpcode::kCompareMaps, // opcode - Operator::kEliminatable, // flags + Operator::kNoThrow | Operator::kNoWrite, // flags "CompareMaps", // name 1, 1, 1, 1, 1, 0, // counts maps); // parameter @@ -1462,7 +1462,7 @@ const Operator* SimplifiedOperatorBuilder::TransitionElementsKind( ElementsTransition transition) { return new (zone()) Operator1( // -- IrOpcode::kTransitionElementsKind, // opcode - Operator::kNoDeopt | Operator::kNoThrow, // flags + Operator::kNoThrow, // flags "TransitionElementsKind", // name 1, 1, 1, 0, 1, 0, // counts transition); // parameter