LCOV - code coverage report
Current view: top level - src/compiler - simplified-lowering.cc (source / functions) Hit Total Coverage
Test: app.info Lines: 1283 1370 93.6 %
Date: 2017-04-26 Functions: 82 84 97.6 %

          Line data    Source code
       1             : // Copyright 2014 the V8 project authors. All rights reserved.
       2             : // Use of this source code is governed by a BSD-style license that can be
       3             : // found in the LICENSE file.
       4             : 
       5             : #include "src/compiler/simplified-lowering.h"
       6             : 
       7             : #include <limits>
       8             : 
       9             : #include "src/address-map.h"
      10             : #include "src/base/bits.h"
      11             : #include "src/code-factory.h"
      12             : #include "src/compiler/access-builder.h"
      13             : #include "src/compiler/common-operator.h"
      14             : #include "src/compiler/compiler-source-position-table.h"
      15             : #include "src/compiler/diamond.h"
      16             : #include "src/compiler/linkage.h"
      17             : #include "src/compiler/node-matchers.h"
      18             : #include "src/compiler/node-properties.h"
      19             : #include "src/compiler/operation-typer.h"
      20             : #include "src/compiler/operator-properties.h"
      21             : #include "src/compiler/representation-change.h"
      22             : #include "src/compiler/simplified-operator.h"
      23             : #include "src/compiler/type-cache.h"
      24             : #include "src/conversions-inl.h"
      25             : #include "src/objects.h"
      26             : 
      27             : namespace v8 {
      28             : namespace internal {
      29             : namespace compiler {
      30             : 
      31             : // Macro for outputting trace information from representation inference.
      32             : #define TRACE(...)                                      \
      33             :   do {                                                  \
      34             :     if (FLAG_trace_representation) PrintF(__VA_ARGS__); \
      35             :   } while (false)
      36             : 
      37             : // Representation selection and lowering of {Simplified} operators to machine
      38             : // operators are interwined. We use a fixpoint calculation to compute both the
      39             : // output representation and the best possible lowering for {Simplified} nodes.
      40             : // Representation change insertion ensures that all values are in the correct
      41             : // machine representation after this phase, as dictated by the machine
      42             : // operators themselves.
      43             : enum Phase {
      44             :   // 1.) PROPAGATE: Traverse the graph from the end, pushing usage information
      45             :   //     backwards from uses to definitions, around cycles in phis, according
      46             :   //     to local rules for each operator.
      47             :   //     During this phase, the usage information for a node determines the best
      48             :   //     possible lowering for each operator so far, and that in turn determines
      49             :   //     the output representation.
      50             :   //     Therefore, to be correct, this phase must iterate to a fixpoint before
      51             :   //     the next phase can begin.
      52             :   PROPAGATE,
      53             : 
      54             :   // 2.) RETYPE: Propagate types from type feedback forwards.
      55             :   RETYPE,
      56             : 
      57             :   // 3.) LOWER: perform lowering for all {Simplified} nodes by replacing some
      58             :   //     operators for some nodes, expanding some nodes to multiple nodes, or
      59             :   //     removing some (redundant) nodes.
      60             :   //     During this phase, use the {RepresentationChanger} to insert
      61             :   //     representation changes between uses that demand a particular
      62             :   //     representation and nodes that produce a different representation.
      63             :   LOWER
      64             : };
      65             : 
      66             : namespace {
      67             : 
      68       23199 : MachineRepresentation MachineRepresentationFromArrayType(
      69             :     ExternalArrayType array_type) {
      70       23199 :   switch (array_type) {
      71             :     case kExternalUint8Array:
      72             :     case kExternalUint8ClampedArray:
      73             :     case kExternalInt8Array:
      74             :       return MachineRepresentation::kWord8;
      75             :     case kExternalUint16Array:
      76             :     case kExternalInt16Array:
      77        3111 :       return MachineRepresentation::kWord16;
      78             :     case kExternalUint32Array:
      79             :     case kExternalInt32Array:
      80        4169 :       return MachineRepresentation::kWord32;
      81             :     case kExternalFloat32Array:
      82        6633 :       return MachineRepresentation::kFloat32;
      83             :     case kExternalFloat64Array:
      84        2103 :       return MachineRepresentation::kFloat64;
      85             :   }
      86           0 :   UNREACHABLE();
      87             :   return MachineRepresentation::kNone;
      88             : }
      89             : 
      90     1153798 : UseInfo CheckedUseInfoAsWord32FromHint(
      91             :     NumberOperationHint hint,
      92             :     IdentifyZeros identify_zeros = kDistinguishZeros) {
      93     1153798 :   switch (hint) {
      94             :     case NumberOperationHint::kSignedSmall:
      95             :       return UseInfo::CheckedSignedSmallAsWord32(identify_zeros);
      96             :     case NumberOperationHint::kSigned32:
      97             :       return UseInfo::CheckedSigned32AsWord32(identify_zeros);
      98             :     case NumberOperationHint::kNumber:
      99             :       return UseInfo::CheckedNumberAsWord32();
     100             :     case NumberOperationHint::kNumberOrOddball:
     101             :       return UseInfo::CheckedNumberOrOddballAsWord32();
     102             :   }
     103           0 :   UNREACHABLE();
     104             :   return UseInfo::None();
     105             : }
     106             : 
     107       35079 : UseInfo CheckedUseInfoAsFloat64FromHint(NumberOperationHint hint) {
     108       35079 :   switch (hint) {
     109             :     case NumberOperationHint::kSignedSmall:
     110             :     case NumberOperationHint::kSigned32:
     111             :       // Not used currently.
     112           0 :       UNREACHABLE();
     113             :       break;
     114             :     case NumberOperationHint::kNumber:
     115             :       return UseInfo::CheckedNumberAsFloat64();
     116             :     case NumberOperationHint::kNumberOrOddball:
     117             :       return UseInfo::CheckedNumberOrOddballAsFloat64();
     118             :   }
     119           0 :   UNREACHABLE();
     120             :   return UseInfo::None();
     121             : }
     122             : 
     123    18719642 : UseInfo TruncatingUseInfoFromRepresentation(MachineRepresentation rep) {
     124    18719642 :   switch (rep) {
     125             :     case MachineRepresentation::kTaggedSigned:
     126             :     case MachineRepresentation::kTaggedPointer:
     127             :     case MachineRepresentation::kTagged:
     128             :       return UseInfo::AnyTagged();
     129             :     case MachineRepresentation::kFloat64:
     130             :       return UseInfo::TruncatingFloat64();
     131             :     case MachineRepresentation::kFloat32:
     132             :       return UseInfo::Float32();
     133             :     case MachineRepresentation::kWord64:
     134             :       return UseInfo::TruncatingWord64();
     135             :     case MachineRepresentation::kWord8:
     136             :     case MachineRepresentation::kWord16:
     137             :     case MachineRepresentation::kWord32:
     138             :       return UseInfo::TruncatingWord32();
     139             :     case MachineRepresentation::kBit:
     140             :       return UseInfo::Bool();
     141             :     case MachineRepresentation::kSimd128:
     142             :     case MachineRepresentation::kSimd1x4:
     143             :     case MachineRepresentation::kSimd1x8:
     144             :     case MachineRepresentation::kSimd1x16:
     145             :     case MachineRepresentation::kNone:
     146             :       break;
     147             :   }
     148           0 :   UNREACHABLE();
     149             :   return UseInfo::None();
     150             : }
     151             : 
     152             : 
     153     2739697 : UseInfo UseInfoForBasePointer(const FieldAccess& access) {
     154     5571027 :   return access.tag() != 0 ? UseInfo::AnyTagged() : UseInfo::PointerInt();
     155             : }
     156             : 
     157             : 
     158      494881 : UseInfo UseInfoForBasePointer(const ElementAccess& access) {
     159      606662 :   return access.tag() != 0 ? UseInfo::AnyTagged() : UseInfo::PointerInt();
     160             : }
     161             : 
     162      368995 : void ReplaceEffectControlUses(Node* node, Node* effect, Node* control) {
     163     2379618 :   for (Edge edge : node->use_edges()) {
     164     1005310 :     if (NodeProperties::IsControlEdge(edge)) {
     165           0 :       edge.UpdateTo(control);
     166     1005315 :     } else if (NodeProperties::IsEffectEdge(edge)) {
     167      445511 :       edge.UpdateTo(effect);
     168             :     } else {
     169             :       DCHECK(NodeProperties::IsValueEdge(edge) ||
     170             :              NodeProperties::IsContextEdge(edge));
     171             :     }
     172             :   }
     173      368998 : }
     174             : 
     175      843821 : void ChangeToPureOp(Node* node, const Operator* new_op) {
     176             :   DCHECK(new_op->HasProperty(Operator::kPure));
     177      792850 :   if (node->op()->EffectInputCount() > 0) {
     178             :     DCHECK_LT(0, node->op()->ControlInputCount());
     179             :     // Disconnect the node from effect and control chains.
     180      223697 :     Node* control = NodeProperties::GetControlInput(node);
     181      223697 :     Node* effect = NodeProperties::GetEffectInput(node);
     182      223696 :     ReplaceEffectControlUses(node, effect, control);
     183      223700 :     node->TrimInputCount(new_op->ValueInputCount());
     184             :   } else {
     185             :     DCHECK_EQ(0, node->op()->ControlInputCount());
     186             :   }
     187      396429 :   NodeProperties::ChangeOp(node, new_op);
     188      396431 : }
     189             : 
     190             : #ifdef DEBUG
     191             : // Helpers for monotonicity checking.
     192             : class InputUseInfos {
     193             :  public:
     194             :   explicit InputUseInfos(Zone* zone) : input_use_infos_(zone) {}
     195             : 
     196             :   void SetAndCheckInput(Node* node, int index, UseInfo use_info) {
     197             :     if (input_use_infos_.empty()) {
     198             :       input_use_infos_.resize(node->InputCount(), UseInfo::None());
     199             :     }
     200             :     // Check that the new use informatin is a super-type of the old
     201             :     // one.
     202             :     CHECK(IsUseLessGeneral(input_use_infos_[index], use_info));
     203             :     input_use_infos_[index] = use_info;
     204             :   }
     205             : 
     206             :  private:
     207             :   ZoneVector<UseInfo> input_use_infos_;
     208             : 
     209             :   static bool IsUseLessGeneral(UseInfo use1, UseInfo use2) {
     210             :     return use1.truncation().IsLessGeneralThan(use2.truncation());
     211             :   }
     212             : };
     213             : 
     214             : #endif  // DEBUG
     215             : 
     216      309692 : bool CanOverflowSigned32(const Operator* op, Type* left, Type* right,
     217             :                          Zone* type_zone) {
     218             :   // We assume the inputs are checked Signed32 (or known statically
     219             :   // to be Signed32). Technically, theinputs could also be minus zero, but
     220             :   // that cannot cause overflow.
     221      154852 :   left = Type::Intersect(left, Type::Signed32(), type_zone);
     222      154852 :   right = Type::Intersect(right, Type::Signed32(), type_zone);
     223      309694 :   if (!left->IsInhabited() || !right->IsInhabited()) return false;
     224      154840 :   switch (op->opcode()) {
     225             :     case IrOpcode::kSpeculativeNumberAdd:
     226      133931 :       return (left->Max() + right->Max() > kMaxInt) ||
     227      133929 :              (left->Min() + right->Min() < kMinInt);
     228             : 
     229             :     case IrOpcode::kSpeculativeNumberSubtract:
     230       31485 :       return (left->Max() - right->Min() > kMaxInt) ||
     231       31485 :              (left->Min() - right->Max() < kMinInt);
     232             : 
     233             :     default:
     234           0 :       UNREACHABLE();
     235             :   }
     236             :   return true;
     237             : }
     238             : 
     239             : }  // namespace
     240             : 
     241             : class RepresentationSelector {
     242             :  public:
     243             :   // Information for each node tracked during the fixpoint.
     244      395303 :   class NodeInfo final {
     245             :    public:
     246             :     // Adds new use to the node. Returns true if something has changed
     247             :     // and the node has to be requeued.
     248    87734905 :     bool AddUse(UseInfo info) {
     249    87734905 :       Truncation old_truncation = truncation_;
     250    87734905 :       truncation_ = Truncation::Generalize(truncation_, info.truncation());
     251    87733895 :       return truncation_ != old_truncation;
     252             :     }
     253             : 
     254    35831300 :     void set_queued() { state_ = kQueued; }
     255    64517056 :     void set_visited() { state_ = kVisited; }
     256    28687087 :     void set_pushed() { state_ = kPushed; }
     257    47359822 :     void reset_state() { state_ = kUnvisited; }
     258             :     bool visited() const { return state_ == kVisited; }
     259             :     bool queued() const { return state_ == kQueued; }
     260             :     bool unvisited() const { return state_ == kUnvisited; }
     261             :     Truncation truncation() const { return truncation_; }
     262    33678023 :     void set_output(MachineRepresentation output) { representation_ = output; }
     263             : 
     264             :     MachineRepresentation representation() const { return representation_; }
     265             : 
     266             :     // Helpers for feedback typing.
     267    20716139 :     void set_feedback_type(Type* type) { feedback_type_ = type; }
     268             :     Type* feedback_type() const { return feedback_type_; }
     269      110857 :     void set_weakened() { weakened_ = true; }
     270             :     bool weakened() const { return weakened_; }
     271    28717654 :     void set_restriction_type(Type* type) { restriction_type_ = type; }
     272             :     Type* restriction_type() const { return restriction_type_; }
     273             : 
     274             :    private:
     275             :     enum State : uint8_t { kUnvisited, kPushed, kVisited, kQueued };
     276             :     State state_ = kUnvisited;
     277             :     MachineRepresentation representation_ =
     278             :         MachineRepresentation::kNone;             // Output representation.
     279             :     Truncation truncation_ = Truncation::None();  // Information about uses.
     280             : 
     281             :     Type* restriction_type_ = Type::Any();
     282             :     Type* feedback_type_ = nullptr;
     283             :     bool weakened_ = false;
     284             :   };
     285             : 
     286     1185909 :   RepresentationSelector(JSGraph* jsgraph, Zone* zone,
     287             :                          RepresentationChanger* changer,
     288      395303 :                          SourcePositionTable* source_positions)
     289             :       : jsgraph_(jsgraph),
     290             :         zone_(zone),
     291      395303 :         count_(jsgraph->graph()->NodeCount()),
     292             :         info_(count_, zone),
     293             : #ifdef DEBUG
     294             :         node_input_use_infos_(count_, InputUseInfos(zone), zone),
     295             : #endif
     296             :         nodes_(zone),
     297             :         replacements_(zone),
     298             :         phase_(PROPAGATE),
     299             :         changer_(changer),
     300             :         queue_(zone),
     301             :         typing_stack_(zone),
     302             :         source_positions_(source_positions),
     303      395303 :         type_cache_(TypeCache::Get()),
     304     1976515 :         op_typer_(jsgraph->isolate(), graph_zone()) {
     305      395303 :   }
     306             : 
     307             :   // Forward propagation of types from type feedback.
     308     1185903 :   void RunTypePropagationPhase() {
     309             :     // Run type propagation.
     310      395302 :     TRACE("--{Type propagation phase}--\n");
     311      395303 :     phase_ = RETYPE;
     312             :     ResetNodeInfoState();
     313             : 
     314             :     DCHECK(typing_stack_.empty());
     315      790601 :     typing_stack_.push({graph()->end(), 0});
     316      395298 :     GetInfo(graph()->end())->set_pushed();
     317    57371186 :     while (!typing_stack_.empty()) {
     318             :       NodeState& current = typing_stack_.top();
     319             : 
     320             :       // If there is an unvisited input, push it and continue.
     321             :       bool pushed_unvisited = false;
     322   280875285 :       while (current.input_index < current.node->InputCount()) {
     323             :         Node* input = current.node->InputAt(current.input_index);
     324    83265607 :         NodeInfo* input_info = GetInfo(input);
     325    83265607 :         current.input_index++;
     326    83265607 :         if (input_info->unvisited()) {
     327             :           input_info->set_pushed();
     328    56583963 :           typing_stack_.push({input, 0});
     329             :           pushed_unvisited = true;
     330    28292174 :           break;
     331             :         }
     332             :       }
     333    56976268 :       if (pushed_unvisited) continue;
     334             : 
     335             :       // Process the top of the stack.
     336    28686251 :       Node* node = current.node;
     337             :       typing_stack_.pop();
     338             :       NodeInfo* info = GetInfo(node);
     339             :       info->set_visited();
     340    28686251 :       bool updated = UpdateFeedbackType(node);
     341    28686134 :       TRACE(" visit #%d: %s\n", node->id(), node->op()->mnemonic());
     342    28686134 :       VisitNode(node, info->truncation(), nullptr);
     343    28685621 :       TRACE("  ==> output ");
     344    28685621 :       PrintOutputInfo(info);
     345    28685725 :       TRACE("\n");
     346    28685884 :       if (updated) {
     347   154598601 :         for (Node* const user : node->uses()) {
     348    67836816 :           if (GetInfo(user)->visited()) {
     349             :             GetInfo(user)->set_queued();
     350             :             queue_.push(user);
     351             :           }
     352             :         }
     353             :       }
     354             :     }
     355             : 
     356             :     // Process the revisit queue.
     357     6304181 :     while (!queue_.empty()) {
     358     5908879 :       Node* node = queue_.front();
     359             :       queue_.pop();
     360             :       NodeInfo* info = GetInfo(node);
     361             :       info->set_visited();
     362     5908880 :       bool updated = UpdateFeedbackType(node);
     363     5908894 :       TRACE(" visit #%d: %s\n", node->id(), node->op()->mnemonic());
     364     5908894 :       VisitNode(node, info->truncation(), nullptr);
     365     5908909 :       TRACE("  ==> output ");
     366     5908909 :       PrintOutputInfo(info);
     367     5908913 :       TRACE("\n");
     368     5908886 :       if (updated) {
     369    14450247 :         for (Node* const user : node->uses()) {
     370     6329772 :           if (GetInfo(user)->visited()) {
     371             :             GetInfo(user)->set_queued();
     372             :             queue_.push(user);
     373             :           }
     374             :         }
     375             :       }
     376             :     }
     377      395302 :   }
     378             : 
     379             :   void ResetNodeInfoState() {
     380             :     // Clean up for the next phase.
     381    47755125 :     for (NodeInfo& info : info_) {
     382             :       info.reset_state();
     383             :     }
     384             :   }
     385             : 
     386             :   Type* TypeOf(Node* node) {
     387    28321122 :     Type* type = GetInfo(node)->feedback_type();
     388    28321122 :     return type == nullptr ? NodeProperties::GetType(node) : type;
     389             :   }
     390             : 
     391             :   Type* FeedbackTypeOf(Node* node) {
     392     4441204 :     Type* type = GetInfo(node)->feedback_type();
     393     4441204 :     return type == nullptr ? Type::None() : type;
     394             :   }
     395             : 
     396     1035284 :   Type* TypePhi(Node* node) {
     397     1035284 :     int arity = node->op()->ValueInputCount();
     398             :     Type* type = FeedbackTypeOf(node->InputAt(0));
     399     2629896 :     for (int i = 1; i < arity; ++i) {
     400     1594618 :       type = op_typer_.Merge(type, FeedbackTypeOf(node->InputAt(i)));
     401             :     }
     402     1035278 :     return type;
     403             :   }
     404             : 
     405       10476 :   Type* TypeSelect(Node* node) {
     406             :     return op_typer_.Merge(FeedbackTypeOf(node->InputAt(1)),
     407       10476 :                            FeedbackTypeOf(node->InputAt(2)));
     408             :   }
     409             : 
     410    36956840 :   bool UpdateFeedbackType(Node* node) {
     411    34594251 :     if (node->op()->ValueOutputCount() == 0) return false;
     412             : 
     413    25530006 :     NodeInfo* info = GetInfo(node);
     414             :     Type* type = info->feedback_type();
     415             :     Type* new_type = type;
     416             : 
     417             :     // For any non-phi node just wait until we get all inputs typed. We only
     418             :     // allow untyped inputs for phi nodes because phis are the only places
     419             :     // where cycles need to be broken.
     420    25163264 :     if (node->opcode() != IrOpcode::kPhi) {
     421   133566754 :       for (int i = 0; i < node->op()->ValueInputCount(); i++) {
     422    56157631 :         if (GetInfo(node->InputAt(i))->feedback_type() == nullptr) {
     423             :           return false;
     424             :         }
     425             :       }
     426             :     }
     427             : 
     428    23725104 :     switch (node->opcode()) {
     429             : #define DECLARE_CASE(Name)                                       \
     430             :   case IrOpcode::k##Name: {                                      \
     431             :     new_type = op_typer_.Name(FeedbackTypeOf(node->InputAt(0)),  \
     432             :                               FeedbackTypeOf(node->InputAt(1))); \
     433             :     break;                                                       \
     434             :   }
     435      476241 :       SIMPLIFIED_NUMBER_BINOP_LIST(DECLARE_CASE)
     436             : #undef DECLARE_CASE
     437             : 
     438             : #define DECLARE_CASE(Name)                                                \
     439             :   case IrOpcode::k##Name: {                                               \
     440             :     new_type =                                                            \
     441             :         Type::Intersect(op_typer_.Name(FeedbackTypeOf(node->InputAt(0)),  \
     442             :                                        FeedbackTypeOf(node->InputAt(1))), \
     443             :                         info->restriction_type(), graph_zone());          \
     444             :     break;                                                                \
     445             :   }
     446      364013 :       SIMPLIFIED_SPECULATIVE_NUMBER_BINOP_LIST(DECLARE_CASE)
     447             : #undef DECLARE_CASE
     448             : 
     449             : #define DECLARE_CASE(Name)                                       \
     450             :   case IrOpcode::k##Name: {                                      \
     451             :     new_type = op_typer_.Name(FeedbackTypeOf(node->InputAt(0))); \
     452             :     break;                                                       \
     453             :   }
     454       67414 :       SIMPLIFIED_NUMBER_UNOP_LIST(DECLARE_CASE)
     455             : #undef DECLARE_CASE
     456             : 
     457             : #define DECLARE_CASE(Name)                                                \
     458             :   case IrOpcode::k##Name: {                                               \
     459             :     new_type =                                                            \
     460             :         Type::Intersect(op_typer_.Name(FeedbackTypeOf(node->InputAt(0))), \
     461             :                         info->restriction_type(), graph_zone());          \
     462             :     break;                                                                \
     463             :   }
     464        1453 :       SIMPLIFIED_SPECULATIVE_NUMBER_UNOP_LIST(DECLARE_CASE)
     465             : #undef DECLARE_CASE
     466             : 
     467             :       case IrOpcode::kPlainPrimitiveToNumber:
     468       16418 :         new_type = op_typer_.ToNumber(FeedbackTypeOf(node->InputAt(0)));
     469       16418 :         break;
     470             : 
     471             :       case IrOpcode::kCheckFloat64Hole:
     472             :         new_type = Type::Intersect(
     473             :             op_typer_.CheckFloat64Hole(FeedbackTypeOf(node->InputAt(0))),
     474         780 :             info->restriction_type(), graph_zone());
     475         780 :         break;
     476             : 
     477             :       case IrOpcode::kCheckNumber:
     478             :         new_type = Type::Intersect(
     479             :             op_typer_.CheckNumber(FeedbackTypeOf(node->InputAt(0))),
     480         496 :             info->restriction_type(), graph_zone());
     481         496 :         break;
     482             : 
     483             :       case IrOpcode::kPhi: {
     484     1035278 :         new_type = TypePhi(node);
     485     1035277 :         if (type != nullptr) {
     486      475974 :           new_type = Weaken(node, type, new_type);
     487             :         }
     488             :         break;
     489             :       }
     490             : 
     491             :       case IrOpcode::kTypeGuard: {
     492             :         new_type = op_typer_.TypeTypeGuard(node->op(),
     493       23281 :                                            FeedbackTypeOf(node->InputAt(0)));
     494       23281 :         break;
     495             :       }
     496             : 
     497             :       case IrOpcode::kSelect: {
     498       10476 :         new_type = TypeSelect(node);
     499       10476 :         break;
     500             :       }
     501             : 
     502             :       default:
     503             :         // Shortcut for operations that we do not handle.
     504    21729254 :         if (type == nullptr) {
     505             :           GetInfo(node)->set_feedback_type(NodeProperties::GetType(node));
     506    18919648 :           return true;
     507             :         }
     508             :         return false;
     509             :     }
     510             :     // We need to guarantee that the feedback type is a subtype of the upper
     511             :     // bound. Naively that should hold, but weakening can actually produce
     512             :     // a bigger type if we are unlucky with ordering of phi typing. To be
     513             :     // really sure, just intersect the upper bound with the feedback type.
     514     1995847 :     new_type = Type::Intersect(GetUpperBound(node), new_type, graph_zone());
     515             : 
     516     2824388 :     if (type != nullptr && new_type->Is(type)) return false;
     517             :     GetInfo(node)->set_feedback_type(new_type);
     518     1796491 :     if (FLAG_trace_representation) {
     519           0 :       PrintNodeFeedbackType(node);
     520             :     }
     521             :     return true;
     522             :   }
     523             : 
     524           0 :   void PrintNodeFeedbackType(Node* n) {
     525           0 :     OFStream os(stdout);
     526           0 :     os << "#" << n->id() << ":" << *n->op() << "(";
     527             :     int j = 0;
     528           0 :     for (Node* const i : n->inputs()) {
     529           0 :       if (j++ > 0) os << ", ";
     530           0 :       os << "#" << i->id() << ":" << i->op()->mnemonic();
     531             :     }
     532           0 :     os << ")";
     533           0 :     if (NodeProperties::IsTyped(n)) {
     534           0 :       os << "  [Static type: ";
     535             :       Type* static_type = NodeProperties::GetType(n);
     536           0 :       static_type->PrintTo(os);
     537           0 :       Type* feedback_type = GetInfo(n)->feedback_type();
     538           0 :       if (feedback_type != nullptr && feedback_type != static_type) {
     539           0 :         os << ", Feedback type: ";
     540           0 :         feedback_type->PrintTo(os);
     541             :       }
     542           0 :       os << "]";
     543             :     }
     544           0 :     os << std::endl;
     545           0 :   }
     546             : 
     547     1705615 :   Type* Weaken(Node* node, Type* previous_type, Type* current_type) {
     548             :     // If the types have nothing to do with integers, return the types.
     549      475974 :     Type* const integer = type_cache_.kInteger;
     550      475974 :     if (!previous_type->Maybe(integer)) {
     551             :       return current_type;
     552             :     }
     553             :     DCHECK(current_type->Maybe(integer));
     554             : 
     555             :     Type* current_integer =
     556      411931 :         Type::Intersect(current_type, integer, graph_zone());
     557             :     Type* previous_integer =
     558      411930 :         Type::Intersect(previous_type, integer, graph_zone());
     559             : 
     560             :     // Once we start weakening a node, we should always weaken.
     561      411931 :     if (!GetInfo(node)->weakened()) {
     562             :       // Only weaken if there is range involved; we should converge quickly
     563             :       // for all other types (the exception is a union of many constants,
     564             :       // but we currently do not increase the number of constants in unions).
     565      117008 :       Type* previous = previous_integer->GetRange();
     566      117009 :       Type* current = current_integer->GetRange();
     567      117009 :       if (current == nullptr || previous == nullptr) {
     568             :         return current_type;
     569             :       }
     570             :       // Range is involved => we are weakening.
     571             :       GetInfo(node)->set_weakened();
     572             :     }
     573             : 
     574             :     return Type::Union(current_type,
     575             :                        op_typer_.WeakenRange(previous_integer, current_integer),
     576      405780 :                        graph_zone());
     577             :   }
     578             : 
     579             :   // Backward propagation of truncations.
     580      395303 :   void RunTruncationPropagationPhase() {
     581             :     // Run propagation phase to a fixpoint.
     582      395303 :     TRACE("--{Propagation phase}--\n");
     583      395303 :     phase_ = PROPAGATE;
     584      395303 :     EnqueueInitial(jsgraph_->graph()->end());
     585             :     // Process nodes from the queue until it is empty.
     586    30712493 :     while (!queue_.empty()) {
     587    29921887 :       Node* node = queue_.front();
     588             :       NodeInfo* info = GetInfo(node);
     589             :       queue_.pop();
     590             :       info->set_visited();
     591    29921925 :       TRACE(" visit #%d: %s (trunc: %s)\n", node->id(), node->op()->mnemonic(),
     592             :             info->truncation().description());
     593    29921925 :       VisitNode(node, info->truncation(), nullptr);
     594             :     }
     595      395303 :   }
     596             : 
     597      395303 :   void Run(SimplifiedLowering* lowering) {
     598      395303 :     RunTruncationPropagationPhase();
     599             : 
     600      395303 :     RunTypePropagationPhase();
     601             : 
     602             :     // Run lowering and change insertion phase.
     603      395303 :     TRACE("--{Simplified lowering phase}--\n");
     604      395316 :     phase_ = LOWER;
     605             :     // Process nodes from the collected {nodes_} vector.
     606    29477498 :     for (NodeVector::iterator i = nodes_.begin(); i != nodes_.end(); ++i) {
     607    28686880 :       Node* node = *i;
     608             :       NodeInfo* info = GetInfo(node);
     609    28686880 :       TRACE(" visit #%d: %s\n", node->id(), node->op()->mnemonic());
     610             :       // Reuse {VisitNode()} so the representation rules are in one place.
     611             :       SourcePositionTable::Scope scope(
     612    28686880 :           source_positions_, source_positions_->GetSourcePosition(node));
     613    28686887 :       VisitNode(node, info->truncation(), lowering);
     614             :     }
     615             : 
     616             :     // Perform the final replacements.
     617     1041189 :     for (NodeVector::iterator i = replacements_.begin();
     618             :          i != replacements_.end(); ++i) {
     619      250585 :       Node* node = *i;
     620      250585 :       Node* replacement = *(++i);
     621      250585 :       node->ReplaceUses(replacement);
     622      250585 :       node->Kill();
     623             :       // We also need to replace the node in the rest of the vector.
     624    16603650 :       for (NodeVector::iterator j = i + 1; j != replacements_.end(); ++j) {
     625             :         ++j;
     626    16102480 :         if (*j == node) *j = replacement;
     627             :       }
     628             :     }
     629      395302 :   }
     630             : 
     631      395303 :   void EnqueueInitial(Node* node) {
     632      395303 :     NodeInfo* info = GetInfo(node);
     633             :     info->set_queued();
     634      395303 :     nodes_.push_back(node);
     635             :     queue_.push(node);
     636      395303 :   }
     637             : 
     638             :   // Enqueue {use_node}'s {index} input if the {use} contains new information
     639             :   // for that input node. Add the input to {nodes_} if this is the first time
     640             :   // it's been visited.
     641   139053108 :   void EnqueueInput(Node* use_node, int index,
     642             :                     UseInfo use_info = UseInfo::None()) {
     643   139053108 :     Node* node = use_node->InputAt(index);
     644   218655409 :     if (phase_ != PROPAGATE) return;
     645    89627641 :     NodeInfo* info = GetInfo(node);
     646             : #ifdef DEBUG
     647             :     // Check monotonicity of input requirements.
     648             :     node_input_use_infos_[use_node->id()].SetAndCheckInput(use_node, index,
     649             :                                                            use_info);
     650             : #endif  // DEBUG
     651    87742465 :     if (info->unvisited()) {
     652             :       // First visit of this node.
     653             :       info->set_queued();
     654    28291441 :       nodes_.push_back(node);
     655             :       queue_.push(node);
     656    28291449 :       TRACE("  initial #%i: ", node->id());
     657    28291449 :       info->AddUse(use_info);
     658    28291658 :       PrintTruncation(info->truncation());
     659    28291658 :       return;
     660             :     }
     661    59451024 :     TRACE("   queue #%i?: ", node->id());
     662    59451024 :     PrintTruncation(info->truncation());
     663    59451051 :     if (info->AddUse(use_info)) {
     664             :       // New usage information for the node is available.
     665     1885176 :       if (!info->queued()) {
     666             :         queue_.push(node);
     667             :         info->set_queued();
     668     1235545 :         TRACE("   added: ");
     669             :       } else {
     670      649621 :         TRACE(" inqueue: ");
     671             :       }
     672     1885166 :       PrintTruncation(info->truncation());
     673             :     }
     674             :   }
     675             : 
     676             :   bool lower() const { return phase_ == LOWER; }
     677             :   bool retype() const { return phase_ == RETYPE; }
     678             :   bool propagate() const { return phase_ == PROPAGATE; }
     679             : 
     680             :   void SetOutput(Node* node, MachineRepresentation representation,
     681             :                  Type* restriction_type = Type::Any()) {
     682             :     NodeInfo* const info = GetInfo(node);
     683    90281497 :     switch (phase_) {
     684             :       case PROPAGATE:
     685             :         info->set_restriction_type(restriction_type);
     686             :         break;
     687             :       case RETYPE:
     688             :         DCHECK(info->restriction_type()->Is(restriction_type));
     689             :         DCHECK(restriction_type->Is(info->restriction_type()));
     690             :         info->set_output(representation);
     691             :         break;
     692             :       case LOWER:
     693             :         DCHECK_EQ(info->representation(), representation);
     694             :         DCHECK(info->restriction_type()->Is(restriction_type));
     695             :         DCHECK(restriction_type->Is(info->restriction_type()));
     696             :         break;
     697             :     }
     698             :   }
     699             : 
     700             :   Type* GetUpperBound(Node* node) { return NodeProperties::GetType(node); }
     701             : 
     702       57990 :   bool InputCannotBe(Node* node, Type* type) {
     703             :     DCHECK_EQ(1, node->op()->ValueInputCount());
     704       57990 :     return !GetUpperBound(node->InputAt(0))->Maybe(type);
     705             :   }
     706             : 
     707      182725 :   bool InputIs(Node* node, Type* type) {
     708             :     DCHECK_EQ(1, node->op()->ValueInputCount());
     709      182725 :     return GetUpperBound(node->InputAt(0))->Is(type);
     710             :   }
     711             : 
     712             :   bool BothInputsAreSigned32(Node* node) {
     713       98429 :     return BothInputsAre(node, Type::Signed32());
     714             :   }
     715             : 
     716             :   bool BothInputsAreUnsigned32(Node* node) {
     717      107363 :     return BothInputsAre(node, Type::Unsigned32());
     718             :   }
     719             : 
     720     4496496 :   bool BothInputsAre(Node* node, Type* type) {
     721             :     DCHECK_EQ(2, node->op()->ValueInputCount());
     722     6311344 :     return GetUpperBound(node->InputAt(0))->Is(type) &&
     723     4496561 :            GetUpperBound(node->InputAt(1))->Is(type);
     724             :   }
     725             : 
     726             :   bool IsNodeRepresentationTagged(Node* node) {
     727       43195 :     MachineRepresentation representation = GetInfo(node)->representation();
     728             :     return IsAnyTagged(representation);
     729             :   }
     730             : 
     731        2883 :   bool OneInputCannotBe(Node* node, Type* type) {
     732             :     DCHECK_EQ(2, node->op()->ValueInputCount());
     733        5766 :     return !GetUpperBound(node->InputAt(0))->Maybe(type) ||
     734        5766 :            !GetUpperBound(node->InputAt(1))->Maybe(type);
     735             :   }
     736             : 
     737    64034643 :   void ConvertInput(Node* node, int index, UseInfo use) {
     738           0 :     Node* input = node->InputAt(index);
     739             :     // In the change phase, insert a change before the use if necessary.
     740    50818676 :     if (use.representation() == MachineRepresentation::kNone)
     741    50818698 :       return;  // No input requirement on the use.
     742             :     DCHECK_NOT_NULL(input);
     743    61660353 :     NodeInfo* input_info = GetInfo(input);
     744             :     MachineRepresentation input_rep = input_info->representation();
     745    83765195 :     if (input_rep != use.representation() ||
     746    35320815 :         use.type_check() != TypeCheckKind::kNone) {
     747             :       // Output representation doesn't match usage.
     748    13215956 :       TRACE("  change: #%d:%s(@%d #%d:%s) ", node->id(), node->op()->mnemonic(),
     749             :             index, input->id(), input->op()->mnemonic());
     750    13215969 :       TRACE(" from ");
     751    13215969 :       PrintOutputInfo(input_info);
     752    13215967 :       TRACE(" to ");
     753    13215967 :       PrintUseInfo(use);
     754    13215968 :       TRACE("\n");
     755             :       Node* n = changer_->GetRepresentationFor(
     756    13215973 :           input, input_info->representation(), TypeOf(input), node, use);
     757    13215988 :       node->ReplaceInput(index, n);
     758             :     }
     759             :   }
     760             : 
     761   167104634 :   void ProcessInput(Node* node, int index, UseInfo use) {
     762   167104634 :     switch (phase_) {
     763             :       case PROPAGATE:
     764    53708852 :         EnqueueInput(node, index, use);
     765    53707791 :         break;
     766             :       case RETYPE:
     767             :         break;
     768             :       case LOWER:
     769    50818479 :         ConvertInput(node, index, use);
     770    50818317 :         break;
     771             :     }
     772   167103411 :   }
     773             : 
     774    13084650 :   void ProcessRemainingInputs(Node* node, int index) {
     775             :     DCHECK_GE(index, NodeProperties::PastValueIndex(node));
     776             :     DCHECK_GE(index, NodeProperties::PastContextIndex(node));
     777    58002030 :     for (int i = std::max(index, NodeProperties::FirstEffectIndex(node));
     778    22458814 :          i < NodeProperties::PastEffectIndex(node); ++i) {
     779     9374147 :       EnqueueInput(node, i);  // Effect inputs: just visit
     780             :     }
     781    58136079 :     for (int i = std::max(index, NodeProperties::FirstControlIndex(node));
     782    22525887 :          i < NodeProperties::PastControlIndex(node); ++i) {
     783     9441481 :       EnqueueInput(node, i);  // Control inputs: just visit
     784             :     }
     785    13084536 :   }
     786             : 
     787             :   // The default, most general visitation case. For {node}, process all value,
     788             :   // context, frame state, effect, and control inputs, assuming that value
     789             :   // inputs should have {kRepTagged} representation and can observe all output
     790             :   // values {kTypeAny}.
     791    78641612 :   void VisitInputs(Node* node) {
     792    78641612 :     int tagged_count = node->op()->ValueInputCount() +
     793             :                        OperatorProperties::GetContextInputCount(node->op()) +
     794    39319389 :                        OperatorProperties::GetFrameStateInputCount(node->op());
     795             :     // Visit value, context and frame state inputs as tagged.
     796   149636153 :     for (int i = 0; i < tagged_count; i++) {
     797   110316237 :       ProcessInput(node, i, UseInfo::AnyTagged());
     798             :     }
     799             :     // Only enqueue other inputs (effects, control).
     800   136998344 :     for (int i = tagged_count; i < node->InputCount(); i++) {
     801    48838901 :       EnqueueInput(node, i);
     802             :     }
     803    39320229 :   }
     804             : 
     805     3188761 :   void VisitReturn(Node* node) {
     806     3188761 :     int tagged_limit = node->op()->ValueInputCount() +
     807             :                        OperatorProperties::GetContextInputCount(node->op()) +
     808     1594380 :                        OperatorProperties::GetFrameStateInputCount(node->op());
     809             :     // Visit integer slot count to pop
     810     1594380 :     ProcessInput(node, 0, UseInfo::TruncatingWord32());
     811             : 
     812             :     // Visit value, context and frame state inputs as tagged.
     813     3188754 :     for (int i = 1; i < tagged_limit; i++) {
     814     1594378 :       ProcessInput(node, i, UseInfo::AnyTagged());
     815             :     }
     816             :     // Only enqueue other inputs (effects, control).
     817     7971888 :     for (int i = tagged_limit; i < node->InputCount(); i++) {
     818     3188755 :       EnqueueInput(node, i);
     819             :     }
     820     1594377 :   }
     821             : 
     822             :   // Helper for an unused node.
     823     1703678 :   void VisitUnused(Node* node) {
     824     1135792 :     int value_count = node->op()->ValueInputCount() +
     825             :                       OperatorProperties::GetContextInputCount(node->op()) +
     826      567887 :                       OperatorProperties::GetFrameStateInputCount(node->op());
     827     1498805 :     for (int i = 0; i < value_count; i++) {
     828      930911 :       ProcessInput(node, i, UseInfo::None());
     829             :     }
     830      567894 :     ProcessRemainingInputs(node, value_count);
     831      567886 :     if (lower()) Kill(node);
     832      567886 :   }
     833             : 
     834             :   // Helper for no-op node.
     835         356 :   void VisitNoop(Node* node, Truncation truncation) {
     836         372 :     if (truncation.IsUnused()) return VisitUnused(node);
     837             :     MachineRepresentation representation =
     838         170 :         GetOutputInfoForPhi(node, TypeOf(node), truncation);
     839         170 :     VisitUnop(node, UseInfo(representation, truncation), representation);
     840         231 :     if (lower()) DeferReplacement(node, node->InputAt(0));
     841             :   }
     842             : 
     843             :   // Helper for binops of the R x L -> O variety.
     844     3720414 :   void VisitBinop(Node* node, UseInfo left_use, UseInfo right_use,
     845             :                   MachineRepresentation output,
     846             :                   Type* restriction_type = Type::Any()) {
     847             :     DCHECK_EQ(2, node->op()->ValueInputCount());
     848     3720414 :     ProcessInput(node, 0, left_use);
     849     3720309 :     ProcessInput(node, 1, right_use);
     850    14020462 :     for (int i = 2; i < node->InputCount(); i++) {
     851     3290052 :       EnqueueInput(node, i);
     852             :     }
     853             :     SetOutput(node, output, restriction_type);
     854     3720179 :   }
     855             : 
     856             :   // Helper for binops of the I x I -> O variety.
     857             :   void VisitBinop(Node* node, UseInfo input_use, MachineRepresentation output,
     858             :                   Type* restriction_type = Type::Any()) {
     859     2944373 :     VisitBinop(node, input_use, input_use, output, restriction_type);
     860             :   }
     861             : 
     862      114883 :   void VisitSpeculativeInt32Binop(Node* node) {
     863             :     DCHECK_EQ(2, node->op()->ValueInputCount());
     864       93383 :     if (BothInputsAre(node, Type::NumberOrOddball())) {
     865             :       return VisitBinop(node, UseInfo::TruncatingWord32(),
     866             :                         MachineRepresentation::kWord32);
     867             :     }
     868       21500 :     NumberOperationHint hint = NumberOperationHintOf(node->op());
     869             :     return VisitBinop(node, CheckedUseInfoAsWord32FromHint(hint),
     870       21499 :                       MachineRepresentation::kWord32);
     871             :   }
     872             : 
     873             :   // Helper for unops of the I -> O variety.
     874     6621655 :   void VisitUnop(Node* node, UseInfo input_use, MachineRepresentation output,
     875             :                  Type* restriction_type = Type::Any()) {
     876             :     DCHECK_EQ(1, node->op()->ValueInputCount());
     877     6621655 :     ProcessInput(node, 0, input_use);
     878     6621664 :     ProcessRemainingInputs(node, 1);
     879             :     SetOutput(node, output, restriction_type);
     880     6621642 :   }
     881             : 
     882             :   // Helper for leaf nodes.
     883             :   void VisitLeaf(Node* node, MachineRepresentation output) {
     884             :     DCHECK_EQ(0, node->InputCount());
     885             :     SetOutput(node, output);
     886             :   }
     887             : 
     888             :   // Helpers for specific types of binops.
     889      665643 :   void VisitFloat64Binop(Node* node) {
     890             :     VisitBinop(node, UseInfo::TruncatingFloat64(),
     891             :                MachineRepresentation::kFloat64);
     892      665644 :   }
     893      494513 :   void VisitWord32TruncatingBinop(Node* node) {
     894             :     VisitBinop(node, UseInfo::TruncatingWord32(),
     895             :                MachineRepresentation::kWord32);
     896      494484 :   }
     897             : 
     898             :   // Infer representation for phi-like nodes.
     899             :   // The {node} parameter is only used to decide on the int64 representation.
     900             :   // Once the type system supports an external pointer type, the {node}
     901             :   // parameter can be removed.
     902     2328644 :   MachineRepresentation GetOutputInfoForPhi(Node* node, Type* type,
     903     1728841 :                                             Truncation use) {
     904             :     // Compute the representation.
     905     2328635 :     if (type->Is(Type::None())) {
     906             :       return MachineRepresentation::kNone;
     907     4209532 :     } else if (type->Is(Type::Signed32()) || type->Is(Type::Unsigned32())) {
     908             :       return MachineRepresentation::kWord32;
     909     2727946 :     } else if (type->Is(Type::NumberOrOddball()) && use.IsUsedAsWord32()) {
     910             :       return MachineRepresentation::kWord32;
     911     1910967 :     } else if (type->Is(Type::Boolean())) {
     912             :       return MachineRepresentation::kBit;
     913     2515687 :     } else if (type->Is(Type::NumberOrOddball()) && use.IsUsedAsFloat64()) {
     914             :       return MachineRepresentation::kFloat64;
     915     1728831 :     } else if (type->Is(
     916     1728841 :                    Type::Union(Type::SignedSmall(), Type::NaN(), zone()))) {
     917             :       // TODO(turbofan): For Phis that return either NaN or some Smi, it's
     918             :       // beneficial to not go all the way to double, unless the uses are
     919             :       // double uses. For tagging that just means some potentially expensive
     920             :       // allocation code; we might want to do the same for -0 as well?
     921             :       return MachineRepresentation::kTagged;
     922     1728127 :     } else if (type->Is(Type::Number())) {
     923             :       return MachineRepresentation::kFloat64;
     924     1120356 :     } else if (type->Is(Type::ExternalPointer())) {
     925             :       return MachineType::PointerRepresentation();
     926             :     }
     927     1120356 :     return MachineRepresentation::kTagged;
     928             :   }
     929             : 
     930             :   // Helper for handling selects.
     931       43085 :   void VisitSelect(Node* node, Truncation truncation,
     932       32609 :                    SimplifiedLowering* lowering) {
     933             :     DCHECK(TypeOf(node->InputAt(0))->Is(Type::Boolean()));
     934       32609 :     ProcessInput(node, 0, UseInfo::Bool());
     935             : 
     936             :     MachineRepresentation output =
     937       32609 :         GetOutputInfoForPhi(node, TypeOf(node), truncation);
     938             :     SetOutput(node, output);
     939             : 
     940       32609 :     if (lower()) {
     941             :       // Update the select operator.
     942       10476 :       SelectParameters p = SelectParametersOf(node->op());
     943       10476 :       if (output != p.representation()) {
     944             :         NodeProperties::ChangeOp(node,
     945       10452 :                                  lowering->common()->Select(output, p.hint()));
     946             :       }
     947             :     }
     948             :     // Convert inputs to the output representation of this phi, pass the
     949             :     // truncation truncation along.
     950             :     UseInfo input_use(output, truncation);
     951       32609 :     ProcessInput(node, 1, input_use);
     952       32609 :     ProcessInput(node, 2, input_use);
     953       32609 :   }
     954             : 
     955             :   // Helper for handling phis.
     956     4457343 :   void VisitPhi(Node* node, Truncation truncation,
     957     2228662 :                 SimplifiedLowering* lowering) {
     958             :     MachineRepresentation output =
     959     2228681 :         GetOutputInfoForPhi(node, TypeOf(node), truncation);
     960             :     // Only set the output representation if not running with type
     961             :     // feedback. (Feedback typing will set the representation.)
     962             :     SetOutput(node, output);
     963             : 
     964     2228662 :     int values = node->op()->ValueInputCount();
     965     2228662 :     if (lower()) {
     966             :       // Update the phi operator.
     967      559323 :       if (output != PhiRepresentationOf(node->op())) {
     968      205904 :         NodeProperties::ChangeOp(node, lowering->common()->Phi(output, values));
     969             :       }
     970             :     }
     971             : 
     972             :     // Convert inputs to the output representation of this phi, pass the
     973             :     // truncation along.
     974             :     UseInfo input_use(output, truncation);
     975    20776996 :     for (int i = 0; i < node->InputCount(); i++) {
     976     8159818 :       ProcessInput(node, i, i < values ? input_use : UseInfo::None());
     977             :     }
     978     2228680 :   }
     979             : 
     980      454689 :   void VisitObjectIs(Node* node, Type* type, SimplifiedLowering* lowering) {
     981             :     Type* const input_type = TypeOf(node->InputAt(0));
     982      227069 :     if (input_type->Is(type)) {
     983         968 :       VisitUnop(node, UseInfo::None(), MachineRepresentation::kBit);
     984         968 :       if (lower()) {
     985         272 :         DeferReplacement(node, lowering->jsgraph()->Int32Constant(1));
     986             :       }
     987             :     } else {
     988      226101 :       VisitUnop(node, UseInfo::AnyTagged(), MachineRepresentation::kBit);
     989      226101 :       if (lower() && !input_type->Maybe(type)) {
     990         279 :         DeferReplacement(node, lowering->jsgraph()->Int32Constant(0));
     991             :       }
     992             :     }
     993      227069 :   }
     994             : 
     995     4465370 :   void VisitCall(Node* node, SimplifiedLowering* lowering) {
     996     4465363 :     const CallDescriptor* desc = CallDescriptorOf(node->op());
     997     2232687 :     int params = static_cast<int>(desc->ParameterCount());
     998     2232687 :     int value_input_count = node->op()->ValueInputCount();
     999             :     // Propagate representation information from call descriptor.
    1000    22140757 :     for (int i = 0; i < value_input_count; i++) {
    1001    19908071 :       if (i == 0) {
    1002             :         // The target of the call.
    1003     2232637 :         ProcessInput(node, i, UseInfo::Any());
    1004    17675434 :       } else if ((i - 1) < params) {
    1005             :         ProcessInput(node, i, TruncatingUseInfoFromRepresentation(
    1006    30919622 :                                   desc->GetInputType(i).representation()));
    1007             :       } else {
    1008     2215623 :         ProcessInput(node, i, UseInfo::AnyTagged());
    1009             :       }
    1010             :     }
    1011     2232686 :     ProcessRemainingInputs(node, value_input_count);
    1012             : 
    1013     2232680 :     if (desc->ReturnCount() > 0) {
    1014             :       SetOutput(node, desc->GetReturnType(0).representation());
    1015             :     } else {
    1016             :       SetOutput(node, MachineRepresentation::kTagged);
    1017             :     }
    1018     2232680 :   }
    1019             : 
    1020      525378 :   static MachineSemantic DeoptValueSemanticOf(Type* type) {
    1021             :     // We only need signedness to do deopt correctly.
    1022      525377 :     if (type->Is(Type::Signed32())) {
    1023             :       return MachineSemantic::kInt32;
    1024      322728 :     } else if (type->Is(Type::Unsigned32())) {
    1025             :       return MachineSemantic::kUint32;
    1026             :     } else {
    1027      321952 :       return MachineSemantic::kAny;
    1028             :     }
    1029             :   }
    1030             : 
    1031     8874378 :   static MachineType DeoptMachineTypeOf(MachineRepresentation rep, Type* type) {
    1032     8874397 :     if (!type->IsInhabited()) {
    1033             :       return MachineType::None();
    1034             :     }
    1035             :     // TODO(turbofan): Special treatment for ExternalPointer here,
    1036             :     // to avoid incompatible truncations. We really need a story
    1037             :     // for the JSFunction::entry field.
    1038     8874399 :     if (type->Is(Type::ExternalPointer())) {
    1039             :       return MachineType::Pointer();
    1040             :     }
    1041             :     // Do not distinguish between various Tagged variations.
    1042     8874399 :     if (IsAnyTagged(rep)) {
    1043             :       return MachineType::AnyTagged();
    1044             :     }
    1045      525374 :     MachineType machine_type(rep, DeoptValueSemanticOf(type));
    1046             :     DCHECK(machine_type.representation() != MachineRepresentation::kWord32 ||
    1047             :            machine_type.semantic() == MachineSemantic::kInt32 ||
    1048             :            machine_type.semantic() == MachineSemantic::kUint32);
    1049             :     DCHECK(machine_type.representation() != MachineRepresentation::kBit ||
    1050             :            type->Is(Type::Boolean()));
    1051      525380 :     return machine_type;
    1052             :   }
    1053             : 
    1054    20424292 :   void VisitStateValues(Node* node) {
    1055    15899455 :     if (propagate()) {
    1056    22188015 :       for (int i = 0; i < node->InputCount(); i++) {
    1057     8831631 :         EnqueueInput(node, i, UseInfo::Any());
    1058             :       }
    1059    11374700 :     } else if (lower()) {
    1060     9049676 :       Zone* zone = jsgraph_->zone();
    1061             :       ZoneVector<MachineType>* types =
    1062             :           new (zone->New(sizeof(ZoneVector<MachineType>)))
    1063     4524838 :               ZoneVector<MachineType>(node->InputCount(), zone);
    1064    26712980 :       for (int i = 0; i < node->InputCount(); i++) {
    1065             :         Node* input = node->InputAt(i);
    1066     8831653 :         (*types)[i] =
    1067     8831653 :             DeoptMachineTypeOf(GetInfo(input)->representation(), TypeOf(input));
    1068             :       }
    1069     4524837 :       SparseInputMask mask = SparseInputMaskOf(node->op());
    1070             :       NodeProperties::ChangeOp(
    1071     9049676 :           node, jsgraph_->common()->TypedStateValues(types, mask));
    1072             :     }
    1073             :     SetOutput(node, MachineRepresentation::kTagged);
    1074    15899450 :   }
    1075             : 
    1076       27923 :   void VisitObjectState(Node* node) {
    1077       27923 :     if (propagate()) {
    1078       94286 :       for (int i = 0; i < node->InputCount(); i++) {
    1079             :         Node* input = node->InputAt(i);
    1080             :         Type* input_type = TypeOf(input);
    1081             :         // TODO(turbofan): Special treatment for ExternalPointer here,
    1082             :         // to avoid incompatible truncations. We really need a story
    1083             :         // for the JSFunction::entry field.
    1084       42726 :         UseInfo use_info = UseInfo::None();
    1085       42726 :         if (input_type->IsInhabited()) {
    1086       42726 :           if (input_type->Is(Type::ExternalPointer())) {
    1087           0 :             use_info = UseInfo::PointerInt();
    1088             :           } else {
    1089       42726 :             use_info = UseInfo::Any();
    1090             :           }
    1091             :         }
    1092       42726 :         EnqueueInput(node, i, use_info);
    1093             :       }
    1094       19089 :     } else if (lower()) {
    1095       17668 :       Zone* zone = jsgraph_->zone();
    1096             :       ZoneVector<MachineType>* types =
    1097             :           new (zone->New(sizeof(ZoneVector<MachineType>)))
    1098        8834 :               ZoneVector<MachineType>(node->InputCount(), zone);
    1099      103120 :       for (int i = 0; i < node->InputCount(); i++) {
    1100             :         Node* input = node->InputAt(i);
    1101       42726 :         (*types)[i] =
    1102       42726 :             DeoptMachineTypeOf(GetInfo(input)->representation(), TypeOf(input));
    1103             :       }
    1104             :       NodeProperties::ChangeOp(node,
    1105       17668 :                                jsgraph_->common()->TypedObjectState(types));
    1106             :     }
    1107             :     SetOutput(node, MachineRepresentation::kTagged);
    1108       27923 :   }
    1109             : 
    1110      259611 :   const Operator* Int32Op(Node* node) {
    1111      259611 :     return changer_->Int32OperatorFor(node->opcode());
    1112             :   }
    1113             : 
    1114      150537 :   const Operator* Int32OverflowOp(Node* node) {
    1115      150537 :     return changer_->Int32OverflowOperatorFor(node->opcode());
    1116             :   }
    1117             : 
    1118       69110 :   const Operator* Uint32Op(Node* node) {
    1119       69110 :     return changer_->Uint32OperatorFor(node->opcode());
    1120             :   }
    1121             : 
    1122         177 :   const Operator* Uint32OverflowOp(Node* node) {
    1123         177 :     return changer_->Uint32OverflowOperatorFor(node->opcode());
    1124             :   }
    1125             : 
    1126      183535 :   const Operator* Float64Op(Node* node) {
    1127      183535 :     return changer_->Float64OperatorFor(node->opcode());
    1128             :   }
    1129             : 
    1130     2949753 :   WriteBarrierKind WriteBarrierKindFor(
    1131             :       BaseTaggedness base_taggedness,
    1132             :       MachineRepresentation field_representation, Type* field_type,
    1133             :       MachineRepresentation value_representation, Node* value) {
    1134     5775056 :     if (base_taggedness == kTaggedBase &&
    1135             :         CanBeTaggedPointer(field_representation)) {
    1136             :       Type* value_type = NodeProperties::GetType(value);
    1137     5054172 :       if (field_representation == MachineRepresentation::kTaggedSigned ||
    1138     2527086 :           value_representation == MachineRepresentation::kTaggedSigned) {
    1139             :         // Write barriers are only for stores of heap objects.
    1140             :         return kNoWriteBarrier;
    1141             :       }
    1142     5029097 :       if (field_type->Is(Type::BooleanOrNullOrUndefined()) ||
    1143             :           value_type->Is(Type::BooleanOrNullOrUndefined())) {
    1144             :         // Write barriers are not necessary when storing true, false, null or
    1145             :         // undefined, because these special oddballs are always in the root set.
    1146             :         return kNoWriteBarrier;
    1147             :       }
    1148     2233235 :       if (value_type->IsHeapConstant()) {
    1149             :         Heap::RootListIndex root_index;
    1150      814169 :         Heap* heap = jsgraph_->isolate()->heap();
    1151      814169 :         if (heap->IsRootHandle(value_type->AsHeapConstant()->Value(),
    1152             :                                &root_index)) {
    1153      438069 :           if (heap->RootIsImmortalImmovable(root_index)) {
    1154             :             // Write barriers are unnecessary for immortal immovable roots.
    1155             :             return kNoWriteBarrier;
    1156             :           }
    1157             :         }
    1158             :       }
    1159     3590362 :       if (field_representation == MachineRepresentation::kTaggedPointer ||
    1160     1795181 :           value_representation == MachineRepresentation::kTaggedPointer) {
    1161             :         // Write barriers for heap objects are cheaper.
    1162             :         return kPointerWriteBarrier;
    1163             :       }
    1164             :       NumberMatcher m(value);
    1165     1404563 :       if (m.HasValue()) {
    1166      552476 :         if (IsSmiDouble(m.Value())) {
    1167             :           // Storing a smi doesn't need a write barrier.
    1168             :           return kNoWriteBarrier;
    1169             :         }
    1170             :         // The NumberConstant will be represented as HeapNumber.
    1171         621 :         return kPointerWriteBarrier;
    1172             :       }
    1173             :       return kFullWriteBarrier;
    1174             :     }
    1175             :     return kNoWriteBarrier;
    1176             :   }
    1177             : 
    1178             :   WriteBarrierKind WriteBarrierKindFor(
    1179             :       BaseTaggedness base_taggedness,
    1180             :       MachineRepresentation field_representation, int field_offset,
    1181             :       Type* field_type, MachineRepresentation value_representation,
    1182             :       Node* value) {
    1183     5479460 :     if (base_taggedness == kTaggedBase &&
    1184     2739730 :         field_offset == HeapObject::kMapOffset) {
    1185             :       return kMapWriteBarrier;
    1186             :     }
    1187             :     return WriteBarrierKindFor(base_taggedness, field_representation,
    1188     2454871 :                                field_type, value_representation, value);
    1189             :   }
    1190             : 
    1191      790601 :   Graph* graph() const { return jsgraph_->graph(); }
    1192             :   CommonOperatorBuilder* common() const { return jsgraph_->common(); }
    1193             :   SimplifiedOperatorBuilder* simplified() const {
    1194       15489 :     return jsgraph_->simplified();
    1195             :   }
    1196             : 
    1197        7143 :   void LowerToCheckedInt32Mul(Node* node, Truncation truncation,
    1198        7143 :                               Type* input0_type, Type* input1_type) {
    1199             :     // If one of the inputs is positive and/or truncation is being applied,
    1200             :     // there is no need to return -0.
    1201             :     CheckForMinusZeroMode mz_mode =
    1202        5469 :         truncation.IdentifiesZeroAndMinusZero() ||
    1203        1675 :                 (input0_type->Is(Type::OrderedNumber()) &&
    1204        7125 :                  input0_type->Min() > 0) ||
    1205        5350 :                 (input1_type->Is(Type::OrderedNumber()) &&
    1206        5350 :                  input1_type->Min() > 0)
    1207             :             ? CheckForMinusZeroMode::kDontCheckForMinusZero
    1208        7143 :             : CheckForMinusZeroMode::kCheckForMinusZero;
    1209             : 
    1210        7143 :     NodeProperties::ChangeOp(node, simplified()->CheckedInt32Mul(mz_mode));
    1211        7143 :   }
    1212             : 
    1213      150537 :   void ChangeToInt32OverflowOp(Node* node) {
    1214      150537 :     NodeProperties::ChangeOp(node, Int32OverflowOp(node));
    1215      150537 :   }
    1216             : 
    1217         177 :   void ChangeToUint32OverflowOp(Node* node) {
    1218         177 :     NodeProperties::ChangeOp(node, Uint32OverflowOp(node));
    1219         177 :   }
    1220             : 
    1221     2041074 :   void VisitSpeculativeAdditiveOp(Node* node, Truncation truncation,
    1222     1036441 :                                   SimplifiedLowering* lowering) {
    1223             :     // ToNumber(x) can throw if x is either a Receiver or a Symbol, so we can
    1224             :     // only eliminate an unused speculative number operation if we know that
    1225             :     // the inputs are PlainPrimitive, which excludes everything that's might
    1226             :     // have side effects or throws during a ToNumber conversion. We are only
    1227             :     // allowed to perform a number addition if neither input is a String, even
    1228             :     // if the value is never used, so we further limit to NumberOrOddball in
    1229             :     // order to explicitly exclude String inputs.
    1230      857112 :     if (BothInputsAre(node, Type::NumberOrOddball())) {
    1231      564347 :       if (truncation.IsUnused()) return VisitUnused(node);
    1232             :     }
    1233             : 
    1234     1936560 :     if (BothInputsAre(node, type_cache_.kAdditiveSafeIntegerOrMinusZero) &&
    1235       45390 :         (GetUpperBound(node)->Is(Type::Signed32()) ||
    1236       45381 :          GetUpperBound(node)->Is(Type::Unsigned32()) ||
    1237             :          truncation.IsUsedAsWord32())) {
    1238             :       // => Int32Add/Sub
    1239      274077 :       VisitWord32TruncatingBinop(node);
    1240      338181 :       if (lower()) ChangeToPureOp(node, Int32Op(node));
    1241             :       return;
    1242             :     }
    1243             : 
    1244             :     // Try to use type feedback.
    1245      536358 :     NumberOperationHint hint = NumberOperationHintOf(node->op());
    1246             : 
    1247      536357 :     if (hint == NumberOperationHint::kSignedSmall ||
    1248             :         hint == NumberOperationHint::kSigned32) {
    1249             :       Type* left_feedback_type = TypeOf(node->InputAt(0));
    1250             :       Type* right_feedback_type = TypeOf(node->InputAt(1));
    1251             :       // Handle the case when no int32 checks on inputs are necessary (but
    1252             :       // an overflow check is needed on the output).
    1253             :       // TODO(jarin) We should not look at the upper bound because the typer
    1254             :       // could have already baked in some feedback into the upper bound.
    1255     1558335 :       if (BothInputsAre(node, Type::Signed32()) ||
    1256      492723 :           (BothInputsAre(node, Type::Signed32OrMinusZero()) &&
    1257           0 :            GetUpperBound(node)->Is(type_cache_.kSafeInteger))) {
    1258             :         VisitBinop(node, UseInfo::TruncatingWord32(),
    1259             :                    MachineRepresentation::kWord32, Type::Signed32());
    1260             :       } else {
    1261             :         // If the output's truncation is identify-zeros, we can pass it
    1262             :         // along. Moreover, if the operation is addition and we know the
    1263             :         // right-hand side is not minus zero, we do not have to distinguish
    1264             :         // between 0 and -0.
    1265      492752 :         IdentifyZeros left_identify_zeros = truncation.identify_zeros();
    1266      928087 :         if (node->opcode() == IrOpcode::kSpeculativeNumberAdd &&
    1267      435366 :             !right_feedback_type->Maybe(Type::MinusZero())) {
    1268             :           left_identify_zeros = kIdentifyZeros;
    1269             :         }
    1270             :         UseInfo left_use =
    1271      492721 :             CheckedUseInfoAsWord32FromHint(hint, left_identify_zeros);
    1272             :         // For CheckedInt32Add and CheckedInt32Sub, we don't need to do
    1273             :         // a minus zero check for the right hand side, since we already
    1274             :         // know that the left hand side is a proper Signed32 value,
    1275             :         // potentially guarded by a check.
    1276             :         UseInfo right_use =
    1277      492722 :             CheckedUseInfoAsWord32FromHint(hint, kIdentifyZeros);
    1278             :         VisitBinop(node, left_use, right_use, MachineRepresentation::kWord32,
    1279      492728 :                    Type::Signed32());
    1280             :       }
    1281      532798 :       if (lower()) {
    1282      154852 :         if (CanOverflowSigned32(node->op(), left_feedback_type,
    1283             :                                 right_feedback_type, graph_zone())) {
    1284      148866 :           ChangeToInt32OverflowOp(node);
    1285             :         } else {
    1286        5982 :           ChangeToPureOp(node, Int32Op(node));
    1287             :         }
    1288             :       }
    1289             :       return;
    1290             :     }
    1291             : 
    1292             :     // default case => Float64Add/Sub
    1293             :     VisitBinop(node, UseInfo::CheckedNumberOrOddballAsFloat64(),
    1294             :                MachineRepresentation::kFloat64, Type::Number());
    1295        3586 :     if (lower()) {
    1296        1042 :       ChangeToPureOp(node, Float64Op(node));
    1297             :     }
    1298             :     return;
    1299             :   }
    1300             : 
    1301       22717 :   void VisitSpeculativeNumberModulus(Node* node, Truncation truncation,
    1302       15006 :                                      SimplifiedLowering* lowering) {
    1303             :     // ToNumber(x) can throw if x is either a Receiver or a Symbol, so we
    1304             :     // can only eliminate an unused speculative number operation if we know
    1305             :     // that the inputs are PlainPrimitive, which excludes everything that's
    1306             :     // might have side effects or throws during a ToNumber conversion.
    1307       15108 :     if (BothInputsAre(node, Type::PlainPrimitive())) {
    1308        9328 :       if (truncation.IsUnused()) return VisitUnused(node);
    1309             :     }
    1310       30764 :     if (BothInputsAre(node, Type::Unsigned32OrMinusZeroOrNaN()) &&
    1311         252 :         (truncation.IsUsedAsWord32() ||
    1312             :          NodeProperties::GetType(node)->Is(Type::Unsigned32()))) {
    1313             :       // => unsigned Uint32Mod
    1314         803 :       VisitWord32TruncatingBinop(node);
    1315         803 :       if (lower()) DeferReplacement(node, lowering->Uint32Mod(node));
    1316             :       return;
    1317             :     }
    1318       36108 :     if (BothInputsAre(node, Type::Signed32OrMinusZeroOrNaN()) &&
    1319        1531 :         (truncation.IsUsedAsWord32() ||
    1320             :          NodeProperties::GetType(node)->Is(Type::Signed32()))) {
    1321             :       // => signed Int32Mod
    1322        6453 :       VisitWord32TruncatingBinop(node);
    1323        6453 :       if (lower()) DeferReplacement(node, lowering->Int32Mod(node));
    1324             :       return;
    1325             :     }
    1326             : 
    1327             :     // Try to use type feedback.
    1328        7609 :     NumberOperationHint hint = NumberOperationHintOf(node->op());
    1329             : 
    1330             :     // Handle the case when no uint32 checks on inputs are necessary
    1331             :     // (but an overflow check is needed on the output).
    1332        7609 :     if (BothInputsAreUnsigned32(node)) {
    1333         231 :       if (hint == NumberOperationHint::kSignedSmall ||
    1334             :           hint == NumberOperationHint::kSigned32) {
    1335             :         VisitBinop(node, UseInfo::TruncatingWord32(),
    1336             :                    MachineRepresentation::kWord32, Type::Unsigned32());
    1337         231 :         if (lower()) ChangeToUint32OverflowOp(node);
    1338             :         return;
    1339             :       }
    1340             :     }
    1341             : 
    1342             :     // Handle the case when no int32 checks on inputs are necessary
    1343             :     // (but an overflow check is needed on the output).
    1344        7378 :     if (BothInputsAre(node, Type::Signed32())) {
    1345             :       // If both the inputs the feedback are int32, use the overflow op.
    1346        1300 :       if (hint == NumberOperationHint::kSignedSmall ||
    1347             :           hint == NumberOperationHint::kSigned32) {
    1348             :         VisitBinop(node, UseInfo::TruncatingWord32(),
    1349             :                    MachineRepresentation::kWord32, Type::Signed32());
    1350        1300 :         if (lower()) ChangeToInt32OverflowOp(node);
    1351             :         return;
    1352             :       }
    1353             :     }
    1354             : 
    1355        6078 :     if (hint == NumberOperationHint::kSignedSmall ||
    1356             :         hint == NumberOperationHint::kSigned32) {
    1357             :       // If the result is truncated, we only need to check the inputs.
    1358        5516 :       if (truncation.IsUsedAsWord32()) {
    1359             :         VisitBinop(node, CheckedUseInfoAsWord32FromHint(hint),
    1360        1147 :                    MachineRepresentation::kWord32);
    1361        1147 :         if (lower()) DeferReplacement(node, lowering->Int32Mod(node));
    1362        4369 :       } else if (BothInputsAre(node, Type::Unsigned32OrMinusZeroOrNaN())) {
    1363             :         VisitBinop(node, CheckedUseInfoAsWord32FromHint(hint),
    1364           0 :                    MachineRepresentation::kWord32, Type::Unsigned32());
    1365           0 :         if (lower()) DeferReplacement(node, lowering->Uint32Mod(node));
    1366             :       } else {
    1367             :         VisitBinop(node, CheckedUseInfoAsWord32FromHint(hint),
    1368        4369 :                    MachineRepresentation::kWord32, Type::Signed32());
    1369        4369 :         if (lower()) ChangeToInt32OverflowOp(node);
    1370             :       }
    1371             :       return;
    1372             :     }
    1373             : 
    1374         616 :     if (TypeOf(node->InputAt(0))->Is(Type::Unsigned32()) &&
    1375         562 :         TypeOf(node->InputAt(1))->Is(Type::Unsigned32()) &&
    1376           0 :         (truncation.IsUsedAsWord32() ||
    1377             :          NodeProperties::GetType(node)->Is(Type::Unsigned32()))) {
    1378             :       // We can only promise Float64 truncation here, as the decision is
    1379             :       // based on the feedback types of the inputs.
    1380             :       VisitBinop(node,
    1381             :                  UseInfo(MachineRepresentation::kWord32, Truncation::Float64()),
    1382             :                  MachineRepresentation::kWord32, Type::Number());
    1383           0 :       if (lower()) DeferReplacement(node, lowering->Uint32Mod(node));
    1384             :       return;
    1385             :     }
    1386         674 :     if (TypeOf(node->InputAt(0))->Is(Type::Signed32()) &&
    1387         576 :         TypeOf(node->InputAt(1))->Is(Type::Signed32()) &&
    1388           0 :         (truncation.IsUsedAsWord32() ||
    1389             :          NodeProperties::GetType(node)->Is(Type::Signed32()))) {
    1390             :       // We can only promise Float64 truncation here, as the decision is
    1391             :       // based on the feedback types of the inputs.
    1392             :       VisitBinop(node,
    1393             :                  UseInfo(MachineRepresentation::kWord32, Truncation::Float64()),
    1394             :                  MachineRepresentation::kWord32, Type::Number());
    1395          14 :       if (lower()) DeferReplacement(node, lowering->Int32Mod(node));
    1396             :       return;
    1397             :     }
    1398             :     // default case => Float64Mod
    1399             :     VisitBinop(node, UseInfo::CheckedNumberOrOddballAsFloat64(),
    1400             :                MachineRepresentation::kFloat64, Type::Number());
    1401         689 :     if (lower()) ChangeToPureOp(node, Float64Op(node));
    1402             :     return;
    1403             :   }
    1404             : 
    1405      501198 :   void VisitOsrGuard(Node* node) {
    1406      167066 :     VisitInputs(node);
    1407             : 
    1408             :     // Insert a dynamic check for the OSR value type if necessary.
    1409      167066 :     switch (OsrGuardTypeOf(node->op())) {
    1410             :       case OsrGuardType::kUninitialized:
    1411             :         // At this point, we should always have a type for the OsrValue.
    1412           0 :         UNREACHABLE();
    1413             :         break;
    1414             :       case OsrGuardType::kSignedSmall:
    1415           0 :         if (lower()) {
    1416             :           NodeProperties::ChangeOp(node,
    1417           0 :                                    simplified()->CheckedTaggedToTaggedSigned());
    1418             :         }
    1419             :         return SetOutput(node, MachineRepresentation::kTaggedSigned);
    1420             :       case OsrGuardType::kAny:  // Nothing to check.
    1421      167066 :         if (lower()) {
    1422       53845 :           DeferReplacement(node, node->InputAt(0));
    1423             :         }
    1424             :         return SetOutput(node, MachineRepresentation::kTagged);
    1425             :     }
    1426           0 :     UNREACHABLE();
    1427             :   }
    1428             : 
    1429             :   // Dispatching routine for visiting the node {node} with the usage {use}.
    1430             :   // Depending on the operator, propagate new usage info to the inputs.
    1431    93527234 :   void VisitNode(Node* node, Truncation truncation,
    1432     7228821 :                  SimplifiedLowering* lowering) {
    1433             :     // Unconditionally eliminate unused pure nodes (only relevant if there's
    1434             :     // a pure operation in between two effectful ones, where the last one
    1435             :     // is unused).
    1436             :     // Note: We must not do this for constants, as they are cached and we
    1437             :     // would thus kill the cached {node} during lowering (i.e. replace all
    1438             :     // uses with Dead), but at that point some node lowering might have
    1439             :     // already taken the constant {node} from the cache (while it was in
    1440             :     // a sane state still) and we would afterwards replace that use with
    1441             :     // Dead as well.
    1442   242707651 :     if (node->op()->ValueInputCount() > 0 &&
    1443             :         node->op()->HasProperty(Operator::kPure)) {
    1444    36032678 :       if (truncation.IsUnused()) return VisitUnused(node);
    1445             :     }
    1446    93036826 :     switch (node->opcode()) {
    1447             :       //------------------------------------------------------------------
    1448             :       // Common operators.
    1449             :       //------------------------------------------------------------------
    1450             :       case IrOpcode::kStart:
    1451             :         // We use Start as a terminator for the frame state chain, so even
    1452             :         // tho Start doesn't really produce a value, we have to say Tagged
    1453             :         // here, otherwise the input conversion will fail.
    1454             :         return VisitLeaf(node, MachineRepresentation::kTagged);
    1455             :       case IrOpcode::kParameter:
    1456             :         // TODO(titzer): use representation from linkage.
    1457     3075466 :         return VisitUnop(node, UseInfo::None(), MachineRepresentation::kTagged);
    1458             :       case IrOpcode::kInt32Constant:
    1459             :         return VisitLeaf(node, MachineRepresentation::kWord32);
    1460             :       case IrOpcode::kInt64Constant:
    1461             :         return VisitLeaf(node, MachineRepresentation::kWord64);
    1462             :       case IrOpcode::kExternalConstant:
    1463             :         return VisitLeaf(node, MachineType::PointerRepresentation());
    1464             :       case IrOpcode::kNumberConstant:
    1465             :         return VisitLeaf(node, MachineRepresentation::kTagged);
    1466             :       case IrOpcode::kHeapConstant:
    1467             :         return VisitLeaf(node, MachineRepresentation::kTaggedPointer);
    1468             :       case IrOpcode::kPointerConstant: {
    1469             :         VisitLeaf(node, MachineType::PointerRepresentation());
    1470        4256 :         if (lower()) {
    1471        1334 :           intptr_t const value = OpParameter<intptr_t>(node);
    1472        1334 :           DeferReplacement(node, lowering->jsgraph()->IntPtrConstant(value));
    1473             :         }
    1474             :         return;
    1475             :       }
    1476             : 
    1477             :       case IrOpcode::kBranch: {
    1478             :         DCHECK(TypeOf(node->InputAt(0))->Is(Type::Boolean()));
    1479     2345441 :         ProcessInput(node, 0, UseInfo::Bool());
    1480     2345418 :         EnqueueInput(node, NodeProperties::FirstControlIndex(node));
    1481     2345422 :         return;
    1482             :       }
    1483             :       case IrOpcode::kSwitch:
    1484           0 :         ProcessInput(node, 0, UseInfo::TruncatingWord32());
    1485           0 :         EnqueueInput(node, NodeProperties::FirstControlIndex(node));
    1486           0 :         return;
    1487             :       case IrOpcode::kSelect:
    1488       32609 :         return VisitSelect(node, truncation, lowering);
    1489             :       case IrOpcode::kPhi:
    1490     2228683 :         return VisitPhi(node, truncation, lowering);
    1491             :       case IrOpcode::kCall:
    1492     2232683 :         return VisitCall(node, lowering);
    1493             : 
    1494             :       //------------------------------------------------------------------
    1495             :       // JavaScript operators.
    1496             :       //------------------------------------------------------------------
    1497             :       case IrOpcode::kJSToBoolean: {
    1498      532072 :         if (truncation.IsUsedAsBool()) {
    1499      261887 :           ProcessInput(node, 0, UseInfo::Bool());
    1500      261887 :           ProcessInput(node, 1, UseInfo::None());
    1501             :           SetOutput(node, MachineRepresentation::kBit);
    1502      344810 :           if (lower()) DeferReplacement(node, node->InputAt(0));
    1503             :         } else {
    1504        4149 :           VisitInputs(node);
    1505             :           SetOutput(node, MachineRepresentation::kTaggedPointer);
    1506             :         }
    1507             :         return;
    1508             :       }
    1509             :       case IrOpcode::kJSToNumber: {
    1510       17899 :         VisitInputs(node);
    1511             :         // TODO(bmeurer): Optimize somewhat based on input type?
    1512       35798 :         if (truncation.IsUsedAsWord32()) {
    1513             :           SetOutput(node, MachineRepresentation::kWord32);
    1514        9526 :           if (lower()) lowering->DoJSToNumberTruncatesToWord32(node, this);
    1515       16746 :         } else if (truncation.IsUsedAsFloat64()) {
    1516             :           SetOutput(node, MachineRepresentation::kFloat64);
    1517         661 :           if (lower()) lowering->DoJSToNumberTruncatesToFloat64(node, this);
    1518             :         } else {
    1519             :           SetOutput(node, MachineRepresentation::kTagged);
    1520             :         }
    1521             :         return;
    1522             :       }
    1523             : 
    1524             :       //------------------------------------------------------------------
    1525             :       // Simplified operators.
    1526             :       //------------------------------------------------------------------
    1527             :       case IrOpcode::kBooleanNot: {
    1528       31388 :         if (lower()) {
    1529        9771 :           NodeInfo* input_info = GetInfo(node->InputAt(0));
    1530        9771 :           if (input_info->representation() == MachineRepresentation::kBit) {
    1531             :             // BooleanNot(x: kRepBit) => Word32Equal(x, #0)
    1532      602627 :             node->AppendInput(jsgraph_->zone(), jsgraph_->Int32Constant(0));
    1533        9082 :             NodeProperties::ChangeOp(node, lowering->machine()->Word32Equal());
    1534             :           } else {
    1535             :             DCHECK(CanBeTaggedPointer(input_info->representation()));
    1536             :             // BooleanNot(x: kRepTagged) => WordEqual(x, #false)
    1537        1378 :             node->AppendInput(jsgraph_->zone(), jsgraph_->FalseConstant());
    1538         689 :             NodeProperties::ChangeOp(node, lowering->machine()->WordEqual());
    1539             :           }
    1540             :         } else {
    1541             :           // No input representation requirement; adapt during lowering.
    1542       21617 :           ProcessInput(node, 0, UseInfo::AnyTruncatingToBool());
    1543             :           SetOutput(node, MachineRepresentation::kBit);
    1544             :         }
    1545             :         return;
    1546             :       }
    1547             :       case IrOpcode::kNumberEqual: {
    1548             :         Type* const lhs_type = TypeOf(node->InputAt(0));
    1549             :         Type* const rhs_type = TypeOf(node->InputAt(1));
    1550             :         // Number comparisons reduce to integer comparisons for integer inputs.
    1551      407687 :         if ((lhs_type->Is(Type::Unsigned32()) &&
    1552      419167 :              rhs_type->Is(Type::Unsigned32())) ||
    1553        1231 :             (lhs_type->Is(Type::Unsigned32OrMinusZeroOrNaN()) &&
    1554         977 :              rhs_type->Is(Type::Unsigned32OrMinusZeroOrNaN()) &&
    1555         977 :              OneInputCannotBe(node, type_cache_.kZeroish))) {
    1556             :           // => unsigned Int32Cmp
    1557             :           VisitBinop(node, UseInfo::TruncatingWord32(),
    1558             :                      MachineRepresentation::kBit);
    1559      174370 :           if (lower()) NodeProperties::ChangeOp(node, Uint32Op(node));
    1560             :           return;
    1561             :         }
    1562      245388 :         if ((lhs_type->Is(Type::Signed32()) &&
    1563      185219 :              rhs_type->Is(Type::Signed32())) ||
    1564        2040 :             (lhs_type->Is(Type::Signed32OrMinusZeroOrNaN()) &&
    1565        1906 :              rhs_type->Is(Type::Signed32OrMinusZeroOrNaN()) &&
    1566        1906 :              OneInputCannotBe(node, type_cache_.kZeroish))) {
    1567             :           // => signed Int32Cmp
    1568             :           VisitBinop(node, UseInfo::TruncatingWord32(),
    1569             :                      MachineRepresentation::kBit);
    1570      134971 :           if (lower()) NodeProperties::ChangeOp(node, Int32Op(node));
    1571             :           return;
    1572             :         }
    1573             :         // => Float64Cmp
    1574             :         VisitBinop(node, UseInfo::TruncatingFloat64(),
    1575             :                    MachineRepresentation::kBit);
    1576       53371 :         if (lower()) NodeProperties::ChangeOp(node, Float64Op(node));
    1577             :         return;
    1578             :       }
    1579             :       case IrOpcode::kNumberLessThan:
    1580             :       case IrOpcode::kNumberLessThanOrEqual: {
    1581             :         // Number comparisons reduce to integer comparisons for integer inputs.
    1582      250142 :         if (TypeOf(node->InputAt(0))->Is(Type::Unsigned32()) &&
    1583             :             TypeOf(node->InputAt(1))->Is(Type::Unsigned32())) {
    1584             :           // => unsigned Int32Cmp
    1585             :           VisitBinop(node, UseInfo::TruncatingWord32(),
    1586             :                      MachineRepresentation::kBit);
    1587      118970 :           if (lower()) NodeProperties::ChangeOp(node, Uint32Op(node));
    1588       74315 :         } else if (TypeOf(node->InputAt(0))->Is(Type::Signed32()) &&
    1589             :                    TypeOf(node->InputAt(1))->Is(Type::Signed32())) {
    1590             :           // => signed Int32Cmp
    1591             :           VisitBinop(node, UseInfo::TruncatingWord32(),
    1592             :                      MachineRepresentation::kBit);
    1593       19888 :           if (lower()) NodeProperties::ChangeOp(node, Int32Op(node));
    1594             :         } else {
    1595             :           // => Float64Cmp
    1596             :           VisitBinop(node, UseInfo::TruncatingFloat64(),
    1597             :                      MachineRepresentation::kBit);
    1598       32139 :           if (lower()) NodeProperties::ChangeOp(node, Float64Op(node));
    1599             :         }
    1600             :         return;
    1601             :       }
    1602             : 
    1603             :       case IrOpcode::kSpeculativeNumberAdd:
    1604             :       case IrOpcode::kSpeculativeNumberSubtract:
    1605      857104 :         return VisitSpeculativeAdditiveOp(node, truncation, lowering);
    1606             : 
    1607             :       case IrOpcode::kSpeculativeNumberLessThan:
    1608             :       case IrOpcode::kSpeculativeNumberLessThanOrEqual:
    1609             :       case IrOpcode::kSpeculativeNumberEqual: {
    1610             :         // ToNumber(x) can throw if x is either a Receiver or a Symbol, so we
    1611             :         // can only eliminate an unused speculative number operation if we know
    1612             :         // that the inputs are PlainPrimitive, which excludes everything that's
    1613             :         // might have side effects or throws during a ToNumber conversion.
    1614      427084 :         if (BothInputsAre(node, Type::PlainPrimitive())) {
    1615      310238 :           if (truncation.IsUnused()) return VisitUnused(node);
    1616             :         }
    1617             :         // Number comparisons reduce to integer comparisons for integer inputs.
    1618      656282 :         if (TypeOf(node->InputAt(0))->Is(Type::Unsigned32()) &&
    1619             :             TypeOf(node->InputAt(1))->Is(Type::Unsigned32())) {
    1620             :           // => unsigned Int32Cmp
    1621             :           VisitBinop(node, UseInfo::TruncatingWord32(),
    1622             :                      MachineRepresentation::kBit);
    1623        8645 :           if (lower()) ChangeToPureOp(node, Uint32Op(node));
    1624             :           return;
    1625      655506 :         } else if (TypeOf(node->InputAt(0))->Is(Type::Signed32()) &&
    1626             :                    TypeOf(node->InputAt(1))->Is(Type::Signed32())) {
    1627             :           // => signed Int32Cmp
    1628             :           VisitBinop(node, UseInfo::TruncatingWord32(),
    1629             :                      MachineRepresentation::kBit);
    1630      252821 :           if (lower()) ChangeToPureOp(node, Int32Op(node));
    1631             :           return;
    1632             :         }
    1633             :         // Try to use type feedback.
    1634      200886 :         NumberOperationHint hint = NumberOperationHintOf(node->op());
    1635      200886 :         switch (hint) {
    1636             :           case NumberOperationHint::kSignedSmall:
    1637             :           case NumberOperationHint::kSigned32: {
    1638      165807 :             if (propagate()) {
    1639             :               VisitBinop(node, CheckedUseInfoAsWord32FromHint(hint),
    1640      107418 :                          MachineRepresentation::kBit);
    1641       58389 :             } else if (retype()) {
    1642             :               SetOutput(node, MachineRepresentation::kBit, Type::Any());
    1643             :             } else {
    1644             :               DCHECK(lower());
    1645             :               Node* lhs = node->InputAt(0);
    1646             :               Node* rhs = node->InputAt(1);
    1647       43195 :               if (IsNodeRepresentationTagged(lhs) &&
    1648             :                   IsNodeRepresentationTagged(rhs)) {
    1649             :                 VisitBinop(node, UseInfo::CheckedSignedSmallAsTaggedSigned(),
    1650             :                            MachineRepresentation::kBit);
    1651             :                 ChangeToPureOp(
    1652       19708 :                     node, changer_->TaggedSignedOperatorFor(node->opcode()));
    1653             : 
    1654             :               } else {
    1655             :                 VisitBinop(node, CheckedUseInfoAsWord32FromHint(hint),
    1656        2824 :                            MachineRepresentation::kBit);
    1657        2824 :                 ChangeToPureOp(node, Int32Op(node));
    1658             :               }
    1659             :             }
    1660             :             return;
    1661             :           }
    1662             :           case NumberOperationHint::kNumberOrOddball:
    1663             :             // Abstract and strict equality don't perform ToNumber conversions
    1664             :             // on Oddballs, so make sure we don't accidentially sneak in a
    1665             :             // hint with Oddball feedback here.
    1666             :             DCHECK_NE(IrOpcode::kSpeculativeNumberEqual, node->opcode());
    1667             :           // Fallthrough
    1668             :           case NumberOperationHint::kNumber:
    1669             :             VisitBinop(node, CheckedUseInfoAsFloat64FromHint(hint),
    1670       35079 :                        MachineRepresentation::kBit);
    1671       44082 :             if (lower()) ChangeToPureOp(node, Float64Op(node));
    1672             :             return;
    1673             :         }
    1674           0 :         UNREACHABLE();
    1675             :         return;
    1676             :       }
    1677             : 
    1678             :       case IrOpcode::kNumberAdd:
    1679             :       case IrOpcode::kNumberSubtract: {
    1680     1402458 :         if (BothInputsAre(node, type_cache_.kAdditiveSafeIntegerOrMinusZero) &&
    1681       90515 :             (GetUpperBound(node)->Is(Type::Signed32()) ||
    1682       90305 :              GetUpperBound(node)->Is(Type::Unsigned32()) ||
    1683       90305 :              truncation.IsUsedAsWord32())) {
    1684             :           // => Int32Add/Sub
    1685       74845 :           VisitWord32TruncatingBinop(node);
    1686       96104 :           if (lower()) ChangeToPureOp(node, Int32Op(node));
    1687             :         } else {
    1688             :           // => Float64Add/Sub
    1689      566062 :           VisitFloat64Binop(node);
    1690      657344 :           if (lower()) ChangeToPureOp(node, Float64Op(node));
    1691             :         }
    1692             :         return;
    1693             :       }
    1694             :       case IrOpcode::kSpeculativeNumberMultiply: {
    1695             :         // ToNumber(x) can throw if x is either a Receiver or a Symbol, so we
    1696             :         // can only eliminate an unused speculative number operation if we know
    1697             :         // that the inputs are PlainPrimitive, which excludes everything that's
    1698             :         // might have side effects or throws during a ToNumber conversion.
    1699       65023 :         if (BothInputsAre(node, Type::PlainPrimitive())) {
    1700       18200 :           if (truncation.IsUnused()) return VisitUnused(node);
    1701             :         }
    1702      133146 :         if (BothInputsAre(node, Type::Integral32()) &&
    1703        2230 :             (NodeProperties::GetType(node)->Is(Type::Signed32()) ||
    1704        2227 :              NodeProperties::GetType(node)->Is(Type::Unsigned32()) ||
    1705        2360 :              (truncation.IsUsedAsWord32() &&
    1706             :               NodeProperties::GetType(node)->Is(
    1707         133 :                   type_cache_.kSafeIntegerOrMinusZero)))) {
    1708             :           // Multiply reduces to Int32Mul if the inputs are integers, and
    1709             :           // (a) the output is either known to be Signed32, or
    1710             :           // (b) the output is known to be Unsigned32, or
    1711             :           // (c) the uses are truncating and the result is in the safe
    1712             :           //     integer range.
    1713        1626 :           VisitWord32TruncatingBinop(node);
    1714        2054 :           if (lower()) ChangeToPureOp(node, Int32Op(node));
    1715             :           return;
    1716             :         }
    1717             :         // Try to use type feedback.
    1718       63063 :         NumberOperationHint hint = NumberOperationHintOf(node->op());
    1719             :         Type* input0_type = TypeOf(node->InputAt(0));
    1720             :         Type* input1_type = TypeOf(node->InputAt(1));
    1721             : 
    1722             :         // Handle the case when no int32 checks on inputs are necessary
    1723             :         // (but an overflow check is needed on the output).
    1724       63063 :         if (BothInputsAre(node, Type::Signed32())) {
    1725             :           // If both the inputs the feedback are int32, use the overflow op.
    1726        2142 :           if (hint == NumberOperationHint::kSignedSmall ||
    1727             :               hint == NumberOperationHint::kSigned32) {
    1728             :             VisitBinop(node, UseInfo::TruncatingWord32(),
    1729             :                        MachineRepresentation::kWord32, Type::Signed32());
    1730        2142 :             if (lower()) {
    1731             :               LowerToCheckedInt32Mul(node, truncation, input0_type,
    1732         665 :                                      input1_type);
    1733             :             }
    1734             :             return;
    1735             :           }
    1736             :         }
    1737             : 
    1738       60921 :         if (hint == NumberOperationHint::kSignedSmall ||
    1739             :             hint == NumberOperationHint::kSigned32) {
    1740             :           VisitBinop(node, CheckedUseInfoAsWord32FromHint(hint),
    1741       21181 :                      MachineRepresentation::kWord32, Type::Signed32());
    1742       21181 :           if (lower()) {
    1743        6478 :             LowerToCheckedInt32Mul(node, truncation, input0_type, input1_type);
    1744             :           }
    1745             :           return;
    1746             :         }
    1747             : 
    1748             :         // Checked float64 x float64 => float64
    1749             :         VisitBinop(node, UseInfo::CheckedNumberOrOddballAsFloat64(),
    1750             :                    MachineRepresentation::kFloat64, Type::Number());
    1751       51798 :         if (lower()) ChangeToPureOp(node, Float64Op(node));
    1752             :         return;
    1753             :       }
    1754             :       case IrOpcode::kNumberMultiply: {
    1755      135519 :         if (BothInputsAre(node, Type::Integral32()) &&
    1756       12783 :             (NodeProperties::GetType(node)->Is(Type::Signed32()) ||
    1757       12461 :              NodeProperties::GetType(node)->Is(Type::Unsigned32()) ||
    1758       19418 :              (truncation.IsUsedAsWord32() &&
    1759             :               NodeProperties::GetType(node)->Is(
    1760        6957 :                   type_cache_.kSafeIntegerOrMinusZero)))) {
    1761             :           // Multiply reduces to Int32Mul if the inputs are integers, and
    1762             :           // (a) the output is either known to be Signed32, or
    1763             :           // (b) the output is known to be Unsigned32, or
    1764             :           // (c) the uses are truncating and the result is in the safe
    1765             :           //     integer range.
    1766        7303 :           VisitWord32TruncatingBinop(node);
    1767        9203 :           if (lower()) ChangeToPureOp(node, Int32Op(node));
    1768             :           return;
    1769             :         }
    1770             :         // Number x Number => Float64Mul
    1771       53876 :         VisitFloat64Binop(node);
    1772       69315 :         if (lower()) ChangeToPureOp(node, Float64Op(node));
    1773             :         return;
    1774             :       }
    1775             :       case IrOpcode::kSpeculativeNumberDivide: {
    1776             :         // ToNumber(x) can throw if x is either a Receiver or a Symbol, so we
    1777             :         // can only eliminate an unused speculative number operation if we know
    1778             :         // that the inputs are PlainPrimitive, which excludes everything that's
    1779             :         // might have side effects or throws during a ToNumber conversion.
    1780       26045 :         if (BothInputsAre(node, Type::PlainPrimitive())) {
    1781        1537 :           if (truncation.IsUnused()) return VisitUnused(node);
    1782             :         }
    1783       26053 :         if (BothInputsAreUnsigned32(node) && truncation.IsUsedAsWord32()) {
    1784             :           // => unsigned Uint32Div
    1785           0 :           VisitWord32TruncatingBinop(node);
    1786           0 :           if (lower()) DeferReplacement(node, lowering->Uint32Div(node));
    1787             :           return;
    1788             :         }
    1789       25470 :         if (BothInputsAreSigned32(node)) {
    1790         628 :           if (NodeProperties::GetType(node)->Is(Type::Signed32())) {
    1791             :             // => signed Int32Div
    1792           0 :             VisitWord32TruncatingBinop(node);
    1793           0 :             if (lower()) DeferReplacement(node, lowering->Int32Div(node));
    1794             :             return;
    1795             :           }
    1796        1256 :           if (truncation.IsUsedAsWord32()) {
    1797             :             // => signed Int32Div
    1798          45 :             VisitWord32TruncatingBinop(node);
    1799          45 :             if (lower()) DeferReplacement(node, lowering->Int32Div(node));
    1800             :             return;
    1801             :           }
    1802             :         }
    1803             : 
    1804             :         // Try to use type feedback.
    1805       25425 :         NumberOperationHint hint = NumberOperationHintOf(node->op());
    1806             : 
    1807             :         // Handle the case when no uint32 checks on inputs are necessary
    1808             :         // (but an overflow check is needed on the output).
    1809       25425 :         if (BothInputsAreUnsigned32(node)) {
    1810         583 :           if (hint == NumberOperationHint::kSignedSmall ||
    1811             :               hint == NumberOperationHint::kSigned32) {
    1812             :             VisitBinop(node, UseInfo::TruncatingWord32(),
    1813             :                        MachineRepresentation::kWord32, Type::Unsigned32());
    1814         469 :             if (lower()) ChangeToUint32OverflowOp(node);
    1815             :             return;
    1816             :           }
    1817             :         }
    1818             : 
    1819             :         // Handle the case when no int32 checks on inputs are necessary
    1820             :         // (but an overflow check is needed on the output).
    1821       24956 :         if (BothInputsAreSigned32(node)) {
    1822             :           // If both the inputs the feedback are int32, use the overflow op.
    1823         114 :           if (hint == NumberOperationHint::kSignedSmall ||
    1824             :               hint == NumberOperationHint::kSigned32) {
    1825             :             VisitBinop(node, UseInfo::TruncatingWord32(),
    1826             :                        MachineRepresentation::kWord32, Type::Signed32());
    1827           0 :             if (lower()) ChangeToInt32OverflowOp(node);
    1828             :             return;
    1829             :           }
    1830             :         }
    1831             : 
    1832       24956 :         if (hint == NumberOperationHint::kSignedSmall ||
    1833             :             hint == NumberOperationHint::kSigned32) {
    1834             :           // If the result is truncated, we only need to check the inputs.
    1835        1720 :           if (truncation.IsUsedAsWord32()) {
    1836             :             VisitBinop(node, CheckedUseInfoAsWord32FromHint(hint),
    1837         108 :                        MachineRepresentation::kWord32);
    1838         108 :             if (lower()) DeferReplacement(node, lowering->Int32Div(node));
    1839             :           } else {
    1840             :             VisitBinop(node, CheckedUseInfoAsWord32FromHint(hint),
    1841         752 :                        MachineRepresentation::kWord32, Type::Signed32());
    1842         752 :             if (lower()) ChangeToInt32OverflowOp(node);
    1843             :           }
    1844             :           return;
    1845             :         }
    1846             : 
    1847             :         // default case => Float64Div
    1848             :         VisitBinop(node, UseInfo::CheckedNumberOrOddballAsFloat64(),
    1849             :                    MachineRepresentation::kFloat64, Type::Number());
    1850       30947 :         if (lower()) ChangeToPureOp(node, Float64Op(node));
    1851             :         return;
    1852             :       }
    1853             :       case IrOpcode::kNumberDivide: {
    1854       58234 :         if (BothInputsAreUnsigned32(node) && truncation.IsUsedAsWord32()) {
    1855             :           // => unsigned Uint32Div
    1856         856 :           VisitWord32TruncatingBinop(node);
    1857         856 :           if (lower()) DeferReplacement(node, lowering->Uint32Div(node));
    1858             :           return;
    1859             :         }
    1860       48003 :         if (BothInputsAreSigned32(node)) {
    1861       21839 :           if (NodeProperties::GetType(node)->Is(Type::Signed32())) {
    1862             :             // => signed Int32Div
    1863           0 :             VisitWord32TruncatingBinop(node);
    1864           0 :             if (lower()) DeferReplacement(node, lowering->Int32Div(node));
    1865             :             return;
    1866             :           }
    1867       43678 :           if (truncation.IsUsedAsWord32()) {
    1868             :             // => signed Int32Div
    1869        8762 :             VisitWord32TruncatingBinop(node);
    1870        8762 :             if (lower()) DeferReplacement(node, lowering->Int32Div(node));
    1871             :             return;
    1872             :           }
    1873             :         }
    1874             :         // Number x Number => Float64Div
    1875       39241 :         VisitFloat64Binop(node);
    1876       50308 :         if (lower()) ChangeToPureOp(node, Float64Op(node));
    1877             :         return;
    1878             :       }
    1879             :       case IrOpcode::kSpeculativeNumberModulus:
    1880       15108 :         return VisitSpeculativeNumberModulus(node, truncation, lowering);
    1881             :       case IrOpcode::kNumberModulus: {
    1882       19774 :         if (BothInputsAre(node, Type::Unsigned32OrMinusZeroOrNaN()) &&
    1883        1145 :             (truncation.IsUsedAsWord32() ||
    1884             :              NodeProperties::GetType(node)->Is(Type::Unsigned32()))) {
    1885             :           // => unsigned Uint32Mod
    1886         913 :           VisitWord32TruncatingBinop(node);
    1887         913 :           if (lower()) DeferReplacement(node, lowering->Uint32Mod(node));
    1888             :           return;
    1889             :         }
    1890       20222 :         if (BothInputsAre(node, Type::Signed32OrMinusZeroOrNaN()) &&
    1891        4030 :             (truncation.IsUsedAsWord32() ||
    1892             :              NodeProperties::GetType(node)->Is(Type::Signed32()))) {
    1893             :           // => signed Int32Mod
    1894        2521 :           VisitWord32TruncatingBinop(node);
    1895        2521 :           if (lower()) DeferReplacement(node, lowering->Int32Mod(node));
    1896             :           return;
    1897             :         }
    1898        6522 :         if (TypeOf(node->InputAt(0))->Is(Type::Unsigned32()) &&
    1899        6101 :             TypeOf(node->InputAt(1))->Is(Type::Unsigned32()) &&
    1900         260 :             (truncation.IsUsedAsWord32() ||
    1901             :              NodeProperties::GetType(node)->Is(Type::Unsigned32()))) {
    1902             :           // We can only promise Float64 truncation here, as the decision is
    1903             :           // based on the feedback types of the inputs.
    1904             :           VisitBinop(node, UseInfo(MachineRepresentation::kWord32,
    1905             :                                    Truncation::Float64()),
    1906             :                      MachineRepresentation::kWord32);
    1907          24 :           if (lower()) DeferReplacement(node, lowering->Uint32Mod(node));
    1908             :           return;
    1909             :         }
    1910        7764 :         if (TypeOf(node->InputAt(0))->Is(Type::Signed32()) &&
    1911        6724 :             TypeOf(node->InputAt(1))->Is(Type::Signed32()) &&
    1912        1578 :             (truncation.IsUsedAsWord32() ||
    1913             :              NodeProperties::GetType(node)->Is(Type::Signed32()))) {
    1914             :           // We can only promise Float64 truncation here, as the decision is
    1915             :           // based on the feedback types of the inputs.
    1916             :           VisitBinop(node, UseInfo(MachineRepresentation::kWord32,
    1917             :                                    Truncation::Float64()),
    1918             :                      MachineRepresentation::kWord32);
    1919           0 :           if (lower()) DeferReplacement(node, lowering->Int32Mod(node));
    1920             :           return;
    1921             :         }
    1922             :         // default case => Float64Mod
    1923        5935 :         VisitFloat64Binop(node);
    1924        7653 :         if (lower()) ChangeToPureOp(node, Float64Op(node));
    1925             :         return;
    1926             :       }
    1927             :       case IrOpcode::kNumberBitwiseOr:
    1928             :       case IrOpcode::kNumberBitwiseXor:
    1929             :       case IrOpcode::kNumberBitwiseAnd: {
    1930      115912 :         VisitWord32TruncatingBinop(node);
    1931      151626 :         if (lower()) NodeProperties::ChangeOp(node, Int32Op(node));
    1932             :         return;
    1933             :       }
    1934             :       case IrOpcode::kSpeculativeNumberBitwiseOr:
    1935             :       case IrOpcode::kSpeculativeNumberBitwiseXor:
    1936             :       case IrOpcode::kSpeculativeNumberBitwiseAnd:
    1937       93381 :         VisitSpeculativeInt32Binop(node);
    1938       93384 :         if (lower()) {
    1939       25054 :           ChangeToPureOp(node, Int32Op(node));
    1940             :         }
    1941             :         return;
    1942             :       case IrOpcode::kNumberShiftLeft: {
    1943             :         Type* rhs_type = GetUpperBound(node->InputAt(1));
    1944             :         VisitBinop(node, UseInfo::TruncatingWord32(),
    1945       42283 :                    UseInfo::TruncatingWord32(), MachineRepresentation::kWord32);
    1946       42281 :         if (lower()) {
    1947       12984 :           lowering->DoShift(node, lowering->machine()->Word32Shl(), rhs_type);
    1948             :         }
    1949             :         return;
    1950             :       }
    1951             :       case IrOpcode::kSpeculativeNumberShiftLeft: {
    1952             :         // ToNumber(x) can throw if x is either a Receiver or a Symbol, so we
    1953             :         // can only eliminate an unused speculative number operation if we know
    1954             :         // that the inputs are PlainPrimitive, which excludes everything that's
    1955             :         // might have side effects or throws during a ToNumber conversion.
    1956       10050 :         if (BothInputsAre(node, Type::PlainPrimitive())) {
    1957        9182 :           if (truncation.IsUnused()) return VisitUnused(node);
    1958             :         }
    1959        9986 :         if (BothInputsAre(node, Type::NumberOrOddball())) {
    1960             :           Type* rhs_type = GetUpperBound(node->InputAt(1));
    1961             :           VisitBinop(node, UseInfo::TruncatingWord32(),
    1962             :                      UseInfo::TruncatingWord32(),
    1963        9094 :                      MachineRepresentation::kWord32);
    1964        9094 :           if (lower()) {
    1965        2101 :             lowering->DoShift(node, lowering->machine()->Word32Shl(), rhs_type);
    1966             :           }
    1967             :           return;
    1968             :         }
    1969         892 :         NumberOperationHint hint = NumberOperationHintOf(node->op());
    1970             :         Type* rhs_type = GetUpperBound(node->InputAt(1));
    1971             :         VisitBinop(node, CheckedUseInfoAsWord32FromHint(hint),
    1972         892 :                    MachineRepresentation::kWord32, Type::Signed32());
    1973         892 :         if (lower()) {
    1974         282 :           lowering->DoShift(node, lowering->machine()->Word32Shl(), rhs_type);
    1975             :         }
    1976             :         return;
    1977             :       }
    1978             :       case IrOpcode::kNumberShiftRight: {
    1979             :         Type* rhs_type = GetUpperBound(node->InputAt(1));
    1980             :         VisitBinop(node, UseInfo::TruncatingWord32(),
    1981       34835 :                    UseInfo::TruncatingWord32(), MachineRepresentation::kWord32);
    1982       34833 :         if (lower()) {
    1983       10796 :           lowering->DoShift(node, lowering->machine()->Word32Sar(), rhs_type);
    1984             :         }
    1985             :         return;
    1986             :       }
    1987             :       case IrOpcode::kSpeculativeNumberShiftRight: {
    1988             :         // ToNumber(x) can throw if x is either a Receiver or a Symbol, so we
    1989             :         // can only eliminate an unused speculative number operation if we know
    1990             :         // that the inputs are PlainPrimitive, which excludes everything that's
    1991             :         // might have side effects or throws during a ToNumber conversion.
    1992       25741 :         if (BothInputsAre(node, Type::PlainPrimitive())) {
    1993       24371 :           if (truncation.IsUnused()) return VisitUnused(node);
    1994             :         }
    1995       25594 :         if (BothInputsAre(node, Type::NumberOrOddball())) {
    1996             :           Type* rhs_type = GetUpperBound(node->InputAt(1));
    1997             :           VisitBinop(node, UseInfo::TruncatingWord32(),
    1998             :                      UseInfo::TruncatingWord32(),
    1999       24200 :                      MachineRepresentation::kWord32);
    2000       24200 :           if (lower()) {
    2001        5339 :             lowering->DoShift(node, lowering->machine()->Word32Sar(), rhs_type);
    2002             :           }
    2003             :           return;
    2004             :         }
    2005        1394 :         NumberOperationHint hint = NumberOperationHintOf(node->op());
    2006             :         Type* rhs_type = GetUpperBound(node->InputAt(1));
    2007             :         VisitBinop(node, CheckedUseInfoAsWord32FromHint(hint),
    2008        1394 :                    MachineRepresentation::kWord32, Type::Signed32());
    2009        1394 :         if (lower()) {
    2010         402 :           lowering->DoShift(node, lowering->machine()->Word32Sar(), rhs_type);
    2011             :         }
    2012             :         return;
    2013             :       }
    2014             :       case IrOpcode::kNumberShiftRightLogical: {
    2015             :         Type* rhs_type = GetUpperBound(node->InputAt(1));
    2016             :         VisitBinop(node, UseInfo::TruncatingWord32(),
    2017       19541 :                    UseInfo::TruncatingWord32(), MachineRepresentation::kWord32);
    2018       19540 :         if (lower()) {
    2019        6299 :           lowering->DoShift(node, lowering->machine()->Word32Shr(), rhs_type);
    2020             :         }
    2021             :         return;
    2022             :       }
    2023             :       case IrOpcode::kSpeculativeNumberShiftRightLogical: {
    2024             :         // ToNumber(x) can throw if x is either a Receiver or a Symbol, so we
    2025             :         // can only eliminate an unused speculative number operation if we know
    2026             :         // that the inputs are PlainPrimitive, which excludes everything that's
    2027             :         // might have side effects or throws during a ToNumber conversion.
    2028        7405 :         if (BothInputsAre(node, Type::PlainPrimitive())) {
    2029        5994 :           if (truncation.IsUnused()) return VisitUnused(node);
    2030             :         }
    2031        7041 :         NumberOperationHint hint = NumberOperationHintOf(node->op());
    2032             :         Type* rhs_type = GetUpperBound(node->InputAt(1));
    2033       16892 :         if (rhs_type->Is(type_cache_.kZeroish) &&
    2034             :             (hint == NumberOperationHint::kSignedSmall ||
    2035        7580 :              hint == NumberOperationHint::kSigned32) &&
    2036         539 :             !truncation.IsUsedAsWord32()) {
    2037             :           // The SignedSmall or Signed32 feedback means that the results that we
    2038             :           // have seen so far were of type Unsigned31.  We speculate that this
    2039             :           // will continue to hold.  Moreover, since the RHS is 0, the result
    2040             :           // will just be the (converted) LHS.
    2041             :           VisitBinop(node, CheckedUseInfoAsWord32FromHint(hint),
    2042         259 :                      MachineRepresentation::kWord32, Type::Unsigned31());
    2043         259 :           if (lower()) {
    2044          70 :             node->RemoveInput(1);
    2045             :             NodeProperties::ChangeOp(node,
    2046          70 :                                      simplified()->CheckedUint32ToInt32());
    2047             :           }
    2048             :           return;
    2049             :         }
    2050        6782 :         if (BothInputsAre(node, Type::NumberOrOddball())) {
    2051             :           VisitBinop(node, UseInfo::TruncatingWord32(),
    2052             :                      UseInfo::TruncatingWord32(),
    2053        5480 :                      MachineRepresentation::kWord32);
    2054        5480 :           if (lower()) {
    2055        1590 :             lowering->DoShift(node, lowering->machine()->Word32Shr(), rhs_type);
    2056             :           }
    2057             :           return;
    2058             :         }
    2059             :         VisitBinop(node, CheckedUseInfoAsWord32FromHint(hint),
    2060        1302 :                    MachineRepresentation::kWord32, Type::Unsigned32());
    2061        1302 :         if (lower()) {
    2062         387 :           lowering->DoShift(node, lowering->machine()->Word32Shr(), rhs_type);
    2063             :         }
    2064             :         return;
    2065             :       }
    2066             :       case IrOpcode::kNumberAbs: {
    2067         240 :         if (TypeOf(node->InputAt(0))->Is(Type::Unsigned32())) {
    2068             :           VisitUnop(node, UseInfo::TruncatingWord32(),
    2069           0 :                     MachineRepresentation::kWord32);
    2070           0 :           if (lower()) DeferReplacement(node, node->InputAt(0));
    2071         240 :         } else if (TypeOf(node->InputAt(0))->Is(Type::Signed32())) {
    2072             :           VisitUnop(node, UseInfo::TruncatingWord32(),
    2073          99 :                     MachineRepresentation::kWord32);
    2074          99 :           if (lower()) DeferReplacement(node, lowering->Int32Abs(node));
    2075         141 :         } else if (TypeOf(node->InputAt(0))
    2076         141 :                        ->Is(type_cache_.kPositiveIntegerOrMinusZeroOrNaN)) {
    2077             :           VisitUnop(node, UseInfo::TruncatingFloat64(),
    2078           0 :                     MachineRepresentation::kFloat64);
    2079           0 :           if (lower()) DeferReplacement(node, node->InputAt(0));
    2080             :         } else {
    2081             :           VisitUnop(node, UseInfo::TruncatingFloat64(),
    2082         141 :                     MachineRepresentation::kFloat64);
    2083         184 :           if (lower()) NodeProperties::ChangeOp(node, Float64Op(node));
    2084             :         }
    2085             :         return;
    2086             :       }
    2087             :       case IrOpcode::kNumberClz32: {
    2088             :         VisitUnop(node, UseInfo::TruncatingWord32(),
    2089          81 :                   MachineRepresentation::kWord32);
    2090         108 :         if (lower()) NodeProperties::ChangeOp(node, Uint32Op(node));
    2091             :         return;
    2092             :       }
    2093             :       case IrOpcode::kNumberImul: {
    2094             :         VisitBinop(node, UseInfo::TruncatingWord32(),
    2095         187 :                    UseInfo::TruncatingWord32(), MachineRepresentation::kWord32);
    2096         241 :         if (lower()) NodeProperties::ChangeOp(node, Uint32Op(node));
    2097             :         return;
    2098             :       }
    2099             :       case IrOpcode::kNumberFround: {
    2100             :         VisitUnop(node, UseInfo::TruncatingFloat64(),
    2101        2004 :                   MachineRepresentation::kFloat32);
    2102        2666 :         if (lower()) NodeProperties::ChangeOp(node, Float64Op(node));
    2103             :         return;
    2104             :       }
    2105             :       case IrOpcode::kNumberMax: {
    2106             :         // It is safe to use the feedback types for left and right hand side
    2107             :         // here, since we can only narrow those types and thus we can only
    2108             :         // promise a more specific truncation.
    2109             :         Type* const lhs_type = TypeOf(node->InputAt(0));
    2110             :         Type* const rhs_type = TypeOf(node->InputAt(1));
    2111         570 :         if (lhs_type->Is(Type::Unsigned32()) &&
    2112             :             rhs_type->Is(Type::Unsigned32())) {
    2113          21 :           VisitWord32TruncatingBinop(node);
    2114          21 :           if (lower()) {
    2115             :             lowering->DoMax(node, lowering->machine()->Uint32LessThan(),
    2116           7 :                             MachineRepresentation::kWord32);
    2117             :           }
    2118         672 :         } else if (lhs_type->Is(Type::Signed32()) &&
    2119             :                    rhs_type->Is(Type::Signed32())) {
    2120         184 :           VisitWord32TruncatingBinop(node);
    2121         184 :           if (lower()) {
    2122             :             lowering->DoMax(node, lowering->machine()->Int32LessThan(),
    2123          64 :                             MachineRepresentation::kWord32);
    2124             :           }
    2125         406 :         } else if (lhs_type->Is(Type::PlainNumber()) &&
    2126             :                    rhs_type->Is(Type::PlainNumber())) {
    2127         150 :           VisitFloat64Binop(node);
    2128         150 :           if (lower()) {
    2129             :             lowering->DoMax(node, lowering->machine()->Float64LessThan(),
    2130          50 :                             MachineRepresentation::kFloat64);
    2131             :           }
    2132             :         } else {
    2133          65 :           VisitFloat64Binop(node);
    2134          84 :           if (lower()) NodeProperties::ChangeOp(node, Float64Op(node));
    2135             :         }
    2136             :         return;
    2137             :       }
    2138             :       case IrOpcode::kNumberMin: {
    2139             :         // It is safe to use the feedback types for left and right hand side
    2140             :         // here, since we can only narrow those types and thus we can only
    2141             :         // promise a more specific truncation.
    2142             :         Type* const lhs_type = TypeOf(node->InputAt(0));
    2143             :         Type* const rhs_type = TypeOf(node->InputAt(1));
    2144         665 :         if (lhs_type->Is(Type::Unsigned32()) &&
    2145             :             rhs_type->Is(Type::Unsigned32())) {
    2146          21 :           VisitWord32TruncatingBinop(node);
    2147          21 :           if (lower()) {
    2148             :             lowering->DoMin(node, lowering->machine()->Uint32LessThan(),
    2149           7 :                             MachineRepresentation::kWord32);
    2150             :           }
    2151         806 :         } else if (lhs_type->Is(Type::Signed32()) &&
    2152             :                    rhs_type->Is(Type::Signed32())) {
    2153         197 :           VisitWord32TruncatingBinop(node);
    2154         197 :           if (lower()) {
    2155             :             lowering->DoMin(node, lowering->machine()->Int32LessThan(),
    2156          68 :                             MachineRepresentation::kWord32);
    2157             :           }
    2158         472 :         } else if (lhs_type->Is(Type::PlainNumber()) &&
    2159             :                    rhs_type->Is(Type::PlainNumber())) {
    2160         126 :           VisitFloat64Binop(node);
    2161         126 :           if (lower()) {
    2162             :             lowering->DoMin(node, lowering->machine()->Float64LessThan(),
    2163          42 :                             MachineRepresentation::kFloat64);
    2164             :           }
    2165             :         } else {
    2166         187 :           VisitFloat64Binop(node);
    2167         247 :           if (lower()) NodeProperties::ChangeOp(node, Float64Op(node));
    2168             :         }
    2169             :         return;
    2170             :       }
    2171             :       case IrOpcode::kNumberAtan2:
    2172             :       case IrOpcode::kNumberPow: {
    2173             :         VisitBinop(node, UseInfo::TruncatingFloat64(),
    2174             :                    MachineRepresentation::kFloat64);
    2175        3724 :         if (lower()) NodeProperties::ChangeOp(node, Float64Op(node));
    2176             :         return;
    2177             :       }
    2178             :       case IrOpcode::kNumberAcos:
    2179             :       case IrOpcode::kNumberAcosh:
    2180             :       case IrOpcode::kNumberAsin:
    2181             :       case IrOpcode::kNumberAsinh:
    2182             :       case IrOpcode::kNumberAtan:
    2183             :       case IrOpcode::kNumberAtanh:
    2184             :       case IrOpcode::kNumberCeil:
    2185             :       case IrOpcode::kNumberCos:
    2186             :       case IrOpcode::kNumberCosh:
    2187             :       case IrOpcode::kNumberExp:
    2188             :       case IrOpcode::kNumberExpm1:
    2189             :       case IrOpcode::kNumberFloor:
    2190             :       case IrOpcode::kNumberLog:
    2191             :       case IrOpcode::kNumberLog1p:
    2192             :       case IrOpcode::kNumberLog2:
    2193             :       case IrOpcode::kNumberLog10:
    2194             :       case IrOpcode::kNumberCbrt:
    2195             :       case IrOpcode::kNumberSin:
    2196             :       case IrOpcode::kNumberSinh:
    2197             :       case IrOpcode::kNumberTan:
    2198             :       case IrOpcode::kNumberTanh:
    2199             :       case IrOpcode::kNumberTrunc: {
    2200             :         VisitUnop(node, UseInfo::TruncatingFloat64(),
    2201       50237 :                   MachineRepresentation::kFloat64);
    2202       66627 :         if (lower()) NodeProperties::ChangeOp(node, Float64Op(node));
    2203             :         return;
    2204             :       }
    2205             :       case IrOpcode::kNumberRound: {
    2206             :         VisitUnop(node, UseInfo::TruncatingFloat64(),
    2207         201 :                   MachineRepresentation::kFloat64);
    2208         201 :         if (lower()) DeferReplacement(node, lowering->Float64Round(node));
    2209             :         return;
    2210             :       }
    2211             :       case IrOpcode::kNumberSign: {
    2212          63 :         if (InputIs(node, Type::Signed32())) {
    2213             :           VisitUnop(node, UseInfo::TruncatingWord32(),
    2214          21 :                     MachineRepresentation::kWord32);
    2215          21 :           if (lower()) DeferReplacement(node, lowering->Int32Sign(node));
    2216             :         } else {
    2217             :           VisitUnop(node, UseInfo::TruncatingFloat64(),
    2218          42 :                     MachineRepresentation::kFloat64);
    2219          42 :           if (lower()) DeferReplacement(node, lowering->Float64Sign(node));
    2220             :         }
    2221             :         return;
    2222             :       }
    2223             :       case IrOpcode::kNumberSqrt: {
    2224             :         VisitUnop(node, UseInfo::TruncatingFloat64(),
    2225         180 :                   MachineRepresentation::kFloat64);
    2226         239 :         if (lower()) NodeProperties::ChangeOp(node, Float64Op(node));
    2227             :         return;
    2228             :       }
    2229             :       case IrOpcode::kNumberToBoolean: {
    2230             :         Type* const input_type = TypeOf(node->InputAt(0));
    2231        1086 :         if (input_type->Is(Type::Integral32())) {
    2232             :           VisitUnop(node, UseInfo::TruncatingWord32(),
    2233         327 :                     MachineRepresentation::kBit);
    2234         327 :           if (lower()) lowering->DoIntegral32ToBit(node);
    2235         759 :         } else if (input_type->Is(Type::OrderedNumber())) {
    2236             :           VisitUnop(node, UseInfo::TruncatingFloat64(),
    2237           0 :                     MachineRepresentation::kBit);
    2238           0 :           if (lower()) lowering->DoOrderedNumberToBit(node);
    2239             :         } else {
    2240             :           VisitUnop(node, UseInfo::TruncatingFloat64(),
    2241         759 :                     MachineRepresentation::kBit);
    2242         759 :           if (lower()) lowering->DoNumberToBit(node);
    2243             :         }
    2244             :         return;
    2245             :       }
    2246             :       case IrOpcode::kNumberToInt32: {
    2247             :         // Just change representation if necessary.
    2248             :         VisitUnop(node, UseInfo::TruncatingWord32(),
    2249      108467 :                   MachineRepresentation::kWord32);
    2250      141328 :         if (lower()) DeferReplacement(node, node->InputAt(0));
    2251             :         return;
    2252             :       }
    2253             :       case IrOpcode::kNumberToUint32: {
    2254             :         // Just change representation if necessary.
    2255             :         VisitUnop(node, UseInfo::TruncatingWord32(),
    2256       32238 :                   MachineRepresentation::kWord32);
    2257       42529 :         if (lower()) DeferReplacement(node, node->InputAt(0));
    2258             :         return;
    2259             :       }
    2260             :       case IrOpcode::kNumberToUint8Clamped: {
    2261             :         Type* const input_type = TypeOf(node->InputAt(0));
    2262        2976 :         if (input_type->Is(type_cache_.kUint8OrMinusZeroOrNaN)) {
    2263             :           VisitUnop(node, UseInfo::TruncatingWord32(),
    2264          54 :                     MachineRepresentation::kWord32);
    2265          72 :           if (lower()) DeferReplacement(node, node->InputAt(0));
    2266        1434 :         } else if (input_type->Is(Type::Unsigned32OrMinusZeroOrNaN())) {
    2267             :           VisitUnop(node, UseInfo::TruncatingWord32(),
    2268         236 :                     MachineRepresentation::kWord32);
    2269         236 :           if (lower()) lowering->DoUnsigned32ToUint8Clamped(node);
    2270        1198 :         } else if (input_type->Is(Type::Signed32OrMinusZeroOrNaN())) {
    2271             :           VisitUnop(node, UseInfo::TruncatingWord32(),
    2272         211 :                     MachineRepresentation::kWord32);
    2273         211 :           if (lower()) lowering->DoSigned32ToUint8Clamped(node);
    2274        1974 :         } else if (input_type->Is(type_cache_.kIntegerOrMinusZeroOrNaN)) {
    2275             :           VisitUnop(node, UseInfo::TruncatingFloat64(),
    2276          87 :                     MachineRepresentation::kFloat64);
    2277          87 :           if (lower()) lowering->DoIntegerToUint8Clamped(node);
    2278             :         } else {
    2279             :           VisitUnop(node, UseInfo::TruncatingFloat64(),
    2280         900 :                     MachineRepresentation::kFloat64);
    2281         900 :           if (lower()) lowering->DoNumberToUint8Clamped(node);
    2282             :         }
    2283             :         return;
    2284             :       }
    2285             :       case IrOpcode::kReferenceEqual: {
    2286             :         VisitBinop(node, UseInfo::AnyTagged(), MachineRepresentation::kBit);
    2287      670460 :         if (lower()) {
    2288      220083 :           NodeProperties::ChangeOp(node, lowering->machine()->WordEqual());
    2289             :         }
    2290             :         return;
    2291             :       }
    2292             :       case IrOpcode::kStringEqual:
    2293             :       case IrOpcode::kStringLessThan:
    2294             :       case IrOpcode::kStringLessThanOrEqual: {
    2295             :         return VisitBinop(node, UseInfo::AnyTagged(),
    2296             :                           MachineRepresentation::kTaggedPointer);
    2297             :       }
    2298             :       case IrOpcode::kStringCharAt: {
    2299             :         VisitBinop(node, UseInfo::AnyTagged(), UseInfo::TruncatingWord32(),
    2300        1022 :                    MachineRepresentation::kTaggedPointer);
    2301        1022 :         return;
    2302             :       }
    2303             :       case IrOpcode::kStringCharCodeAt: {
    2304             :         // TODO(turbofan): Allow builtins to return untagged values.
    2305             :         VisitBinop(node, UseInfo::AnyTagged(), UseInfo::TruncatingWord32(),
    2306        1236 :                    MachineRepresentation::kTaggedSigned);
    2307        1236 :         return;
    2308             :       }
    2309             :       case IrOpcode::kStringFromCharCode: {
    2310             :         VisitUnop(node, UseInfo::TruncatingWord32(),
    2311        2372 :                   MachineRepresentation::kTaggedPointer);
    2312        2372 :         return;
    2313             :       }
    2314             :       case IrOpcode::kStringFromCodePoint: {
    2315             :         VisitUnop(node, UseInfo::TruncatingWord32(),
    2316         185 :                   MachineRepresentation::kTaggedPointer);
    2317         185 :         return;
    2318             :       }
    2319             :       case IrOpcode::kStringIndexOf: {
    2320         511 :         ProcessInput(node, 0, UseInfo::AnyTagged());
    2321         511 :         ProcessInput(node, 1, UseInfo::AnyTagged());
    2322         511 :         ProcessInput(node, 2, UseInfo::TaggedSigned());
    2323             :         SetOutput(node, MachineRepresentation::kTaggedSigned);
    2324             :         return;
    2325             :       }
    2326             : 
    2327             :       case IrOpcode::kCheckBounds: {
    2328             :         Type* index_type = TypeOf(node->InputAt(0));
    2329             :         Type* length_type = TypeOf(node->InputAt(1));
    2330      114388 :         if (index_type->Is(Type::Integral32OrMinusZero())) {
    2331             :           // Map -0 to 0, and the values in the [-2^31,-1] range to the
    2332             :           // [2^31,2^32-1] range, which will be considered out-of-bounds
    2333             :           // as well, because the {length_type} is limited to Unsigned31.
    2334             :           VisitBinop(node, UseInfo::TruncatingWord32(),
    2335             :                      MachineRepresentation::kWord32);
    2336       92392 :           if (lower()) {
    2337       47666 :             if (index_type->Min() >= 0.0 &&
    2338       21728 :                 index_type->Max() < length_type->Min()) {
    2339             :               // The bounds check is redundant if we already know that
    2340             :               // the index is within the bounds of [0.0, length[.
    2341        3293 :               DeferReplacement(node, node->InputAt(0));
    2342             :             }
    2343             :           }
    2344             :         } else {
    2345             :           VisitBinop(node, UseInfo::CheckedSigned32AsWord32(kIdentifyZeros),
    2346             :                      UseInfo::TruncatingWord32(),
    2347       21996 :                      MachineRepresentation::kWord32);
    2348             :         }
    2349             :         return;
    2350             :       }
    2351             :       case IrOpcode::kCheckHeapObject: {
    2352       57990 :         if (InputCannotBe(node, Type::SignedSmall())) {
    2353             :           VisitUnop(node, UseInfo::AnyTagged(),
    2354         510 :                     MachineRepresentation::kTaggedPointer);
    2355             :         } else {
    2356             :           VisitUnop(node, UseInfo::CheckedHeapObjectAsTaggedPointer(),
    2357       57480 :                     MachineRepresentation::kTaggedPointer);
    2358             :         }
    2359       75954 :         if (lower()) DeferReplacement(node, node->InputAt(0));
    2360             :         return;
    2361             :       }
    2362             :       case IrOpcode::kCheckIf: {
    2363       91837 :         ProcessInput(node, 0, UseInfo::Bool());
    2364       91837 :         ProcessRemainingInputs(node, 1);
    2365             :         SetOutput(node, MachineRepresentation::kNone);
    2366             :         return;
    2367             :       }
    2368             :       case IrOpcode::kCheckInternalizedString: {
    2369        7273 :         if (InputIs(node, Type::InternalizedString())) {
    2370             :           VisitUnop(node, UseInfo::AnyTagged(),
    2371         332 :                     MachineRepresentation::kTaggedPointer);
    2372         417 :           if (lower()) DeferReplacement(node, node->InputAt(0));
    2373             :         } else {
    2374             :           VisitUnop(node, UseInfo::CheckedHeapObjectAsTaggedPointer(),
    2375        6941 :                     MachineRepresentation::kTaggedPointer);
    2376             :         }
    2377             :         return;
    2378             :       }
    2379             :       case IrOpcode::kCheckNumber: {
    2380             :         Type* const input_type = TypeOf(node->InputAt(0));
    2381        1473 :         if (input_type->Is(Type::Number())) {
    2382          42 :           VisitNoop(node, truncation);
    2383             :         } else {
    2384        1431 :           VisitUnop(node, UseInfo::AnyTagged(), MachineRepresentation::kTagged);
    2385             :         }
    2386             :         return;
    2387             :       }
    2388             :       case IrOpcode::kCheckReceiver: {
    2389        1630 :         if (InputIs(node, Type::Receiver())) {
    2390             :           VisitUnop(node, UseInfo::AnyTagged(),
    2391          12 :                     MachineRepresentation::kTaggedPointer);
    2392          16 :           if (lower()) DeferReplacement(node, node->InputAt(0));
    2393             :         } else {
    2394             :           VisitUnop(node, UseInfo::CheckedHeapObjectAsTaggedPointer(),
    2395        1618 :                     MachineRepresentation::kTaggedPointer);
    2396             :         }
    2397             :         return;
    2398             :       }
    2399             :       case IrOpcode::kCheckSmi: {
    2400       89122 :         if (SmiValuesAre32Bits() && truncation.IsUsedAsWord32()) {
    2401             :           VisitUnop(node,
    2402             :                     UseInfo::CheckedSignedSmallAsWord32(kDistinguishZeros),
    2403        1320 :                     MachineRepresentation::kWord32);
    2404             :         } else {
    2405             :           VisitUnop(node, UseInfo::CheckedSignedSmallAsTaggedSigned(),
    2406       43241 :                     MachineRepresentation::kTaggedSigned);
    2407             :         }
    2408       58308 :         if (lower()) DeferReplacement(node, node->InputAt(0));
    2409             :         return;
    2410             :       }
    2411             :       case IrOpcode::kCheckString: {
    2412        4082 :         if (InputIs(node, Type::String())) {
    2413             :           VisitUnop(node, UseInfo::AnyTagged(),
    2414           0 :                     MachineRepresentation::kTaggedPointer);
    2415           0 :           if (lower()) DeferReplacement(node, node->InputAt(0));
    2416             :         } else {
    2417             :           VisitUnop(node, UseInfo::CheckedHeapObjectAsTaggedPointer(),
    2418        4082 :                     MachineRepresentation::kTaggedPointer);
    2419             :         }
    2420             :         return;
    2421             :       }
    2422             : 
    2423             :       case IrOpcode::kAllocate: {
    2424      272071 :         ProcessInput(node, 0, UseInfo::TruncatingWord32());
    2425      272071 :         ProcessRemainingInputs(node, 1);
    2426             :         SetOutput(node, MachineRepresentation::kTaggedPointer);
    2427             :         return;
    2428             :       }
    2429             :       case IrOpcode::kLoadField: {
    2430     3140293 :         if (truncation.IsUnused()) return VisitUnused(node);
    2431     2831329 :         FieldAccess access = FieldAccessOf(node->op());
    2432             :         MachineRepresentation const representation =
    2433             :             access.machine_type.representation();
    2434     2831330 :         VisitUnop(node, UseInfoForBasePointer(access), representation);
    2435             :         return;
    2436             :       }
    2437             :       case IrOpcode::kStoreField: {
    2438     2739711 :         FieldAccess access = FieldAccessOf(node->op());
    2439     2739730 :         NodeInfo* input_info = GetInfo(node->InputAt(1));
    2440             :         WriteBarrierKind write_barrier_kind = WriteBarrierKindFor(
    2441             :             access.base_is_tagged, access.machine_type.representation(),
    2442             :             access.offset, access.type, input_info->representation(),
    2443     2739730 :             node->InputAt(1));
    2444     2739697 :         ProcessInput(node, 0, UseInfoForBasePointer(access));
    2445             :         ProcessInput(node, 1, TruncatingUseInfoFromRepresentation(
    2446     2739683 :                                   access.machine_type.representation()));
    2447     2739625 :         ProcessRemainingInputs(node, 2);
    2448             :         SetOutput(node, MachineRepresentation::kNone);
    2449     2739608 :         if (lower()) {
    2450      907509 :           if (write_barrier_kind < access.write_barrier_kind) {
    2451      437366 :             access.write_barrier_kind = write_barrier_kind;
    2452             :             NodeProperties::ChangeOp(
    2453      874732 :                 node, jsgraph_->simplified()->StoreField(access));
    2454             :           }
    2455             :         }
    2456             :         return;
    2457             :       }
    2458             :       case IrOpcode::kLoadBuffer: {
    2459       24542 :         if (truncation.IsUnused()) return VisitUnused(node);
    2460       20316 :         BufferAccess access = BufferAccessOf(node->op());
    2461       20316 :         ProcessInput(node, 0, UseInfo::PointerInt());        // buffer
    2462       20316 :         ProcessInput(node, 1, UseInfo::TruncatingWord32());  // offset
    2463       20316 :         ProcessInput(node, 2, UseInfo::TruncatingWord32());  // length
    2464       20318 :         ProcessRemainingInputs(node, 3);
    2465             : 
    2466             :         MachineRepresentation output;
    2467       20318 :         if (truncation.IdentifiesUndefinedAndNaNAndZero()) {
    2468       19523 :           if (truncation.IdentifiesNaNAndZero()) {
    2469             :             // If undefined is truncated to a non-NaN number, we can use
    2470             :             // the load's representation.
    2471       14412 :             output = access.machine_type().representation();
    2472             :           } else {
    2473             :             // If undefined is truncated to a number, but the use can
    2474             :             // observe NaN, we need to output at least the float32
    2475             :             // representation.
    2476        5111 :             if (access.machine_type().representation() ==
    2477             :                 MachineRepresentation::kFloat32) {
    2478        4678 :               output = access.machine_type().representation();
    2479             :             } else {
    2480             :               output = MachineRepresentation::kFloat64;
    2481             :             }
    2482             :           }
    2483             :         } else {
    2484             :           // If undefined is not truncated away, we need to have the tagged
    2485             :           // representation.
    2486             :           output = MachineRepresentation::kTagged;
    2487             :         }
    2488             :         SetOutput(node, output);
    2489       20318 :         if (lower()) lowering->DoLoadBuffer(node, output, changer_);
    2490             :         return;
    2491             :       }
    2492             :       case IrOpcode::kStoreBuffer: {
    2493       14219 :         BufferAccess access = BufferAccessOf(node->op());
    2494       14219 :         ProcessInput(node, 0, UseInfo::PointerInt());        // buffer
    2495       14219 :         ProcessInput(node, 1, UseInfo::TruncatingWord32());  // offset
    2496       14219 :         ProcessInput(node, 2, UseInfo::TruncatingWord32());  // length
    2497             :         ProcessInput(node, 3,
    2498             :                      TruncatingUseInfoFromRepresentation(
    2499       14219 :                          access.machine_type().representation()));  // value
    2500       14219 :         ProcessRemainingInputs(node, 4);
    2501             :         SetOutput(node, MachineRepresentation::kNone);
    2502       14219 :         if (lower()) lowering->DoStoreBuffer(node);
    2503             :         return;
    2504             :       }
    2505             :       case IrOpcode::kLoadElement: {
    2506      116995 :         if (truncation.IsUnused()) return VisitUnused(node);
    2507      111781 :         ElementAccess access = ElementAccessOf(node->op());
    2508             :         VisitBinop(node, UseInfoForBasePointer(access),
    2509             :                    UseInfo::TruncatingWord32(),
    2510      111781 :                    access.machine_type.representation());
    2511      111781 :         return;
    2512             :       }
    2513             :       case IrOpcode::kStoreElement: {
    2514      494881 :         ElementAccess access = ElementAccessOf(node->op());
    2515      494881 :         NodeInfo* input_info = GetInfo(node->InputAt(2));
    2516             :         WriteBarrierKind write_barrier_kind = WriteBarrierKindFor(
    2517             :             access.base_is_tagged, access.machine_type.representation(),
    2518      494881 :             access.type, input_info->representation(), node->InputAt(2));
    2519      494881 :         ProcessInput(node, 0, UseInfoForBasePointer(access));  // base
    2520      494881 :         ProcessInput(node, 1, UseInfo::TruncatingWord32());    // index
    2521             :         ProcessInput(node, 2,
    2522             :                      TruncatingUseInfoFromRepresentation(
    2523      494881 :                          access.machine_type.representation()));  // value
    2524      494881 :         ProcessRemainingInputs(node, 3);
    2525             :         SetOutput(node, MachineRepresentation::kNone);
    2526      494881 :         if (lower()) {
    2527      162650 :           if (write_barrier_kind < access.write_barrier_kind) {
    2528      147080 :             access.write_barrier_kind = write_barrier_kind;
    2529             :             NodeProperties::ChangeOp(
    2530      294160 :                 node, jsgraph_->simplified()->StoreElement(access));
    2531             :           }
    2532             :         }
    2533             :         return;
    2534             :       }
    2535             :       case IrOpcode::kLoadTypedElement: {
    2536             :         MachineRepresentation const rep =
    2537       12166 :             MachineRepresentationFromArrayType(ExternalArrayTypeOf(node->op()));
    2538       12166 :         ProcessInput(node, 0, UseInfo::AnyTagged());         // buffer
    2539       12166 :         ProcessInput(node, 1, UseInfo::AnyTagged());         // base pointer
    2540       12166 :         ProcessInput(node, 2, UseInfo::PointerInt());        // external pointer
    2541       12166 :         ProcessInput(node, 3, UseInfo::TruncatingWord32());  // index
    2542       12166 :         ProcessRemainingInputs(node, 4);
    2543             :         SetOutput(node, rep);
    2544             :         return;
    2545             :       }
    2546             :       case IrOpcode::kStoreTypedElement: {
    2547             :         MachineRepresentation const rep =
    2548       11033 :             MachineRepresentationFromArrayType(ExternalArrayTypeOf(node->op()));
    2549       11033 :         ProcessInput(node, 0, UseInfo::AnyTagged());         // buffer
    2550       11033 :         ProcessInput(node, 1, UseInfo::AnyTagged());         // base pointer
    2551       11033 :         ProcessInput(node, 2, UseInfo::PointerInt());        // external pointer
    2552       11033 :         ProcessInput(node, 3, UseInfo::TruncatingWord32());  // index
    2553             :         ProcessInput(node, 4,
    2554       11033 :                      TruncatingUseInfoFromRepresentation(rep));  // value
    2555       11033 :         ProcessRemainingInputs(node, 5);
    2556             :         SetOutput(node, MachineRepresentation::kNone);
    2557             :         return;
    2558             :       }
    2559             :       case IrOpcode::kPlainPrimitiveToNumber: {
    2560       51994 :         if (InputIs(node, Type::Boolean())) {
    2561        1224 :           VisitUnop(node, UseInfo::Bool(), MachineRepresentation::kWord32);
    2562        1604 :           if (lower()) DeferReplacement(node, node->InputAt(0));
    2563       50771 :         } else if (InputIs(node, Type::String())) {
    2564        1746 :           VisitUnop(node, UseInfo::AnyTagged(), MachineRepresentation::kTagged);
    2565        1746 :           if (lower()) lowering->DoStringToNumber(node);
    2566       98046 :         } else if (truncation.IsUsedAsWord32()) {
    2567       35500 :           if (InputIs(node, Type::NumberOrOddball())) {
    2568             :             VisitUnop(node, UseInfo::TruncatingWord32(),
    2569       14722 :                       MachineRepresentation::kWord32);
    2570       19187 :             if (lower()) DeferReplacement(node, node->InputAt(0));
    2571             :           } else {
    2572             :             VisitUnop(node, UseInfo::AnyTagged(),
    2573       20777 :                       MachineRepresentation::kWord32);
    2574       20777 :             if (lower()) {
    2575             :               NodeProperties::ChangeOp(node,
    2576        6380 :                                        simplified()->PlainPrimitiveToWord32());
    2577             :             }
    2578             :           }
    2579       27046 :         } else if (truncation.IsUsedAsFloat64()) {
    2580       13415 :           if (InputIs(node, Type::NumberOrOddball())) {
    2581             :             VisitUnop(node, UseInfo::TruncatingFloat64(),
    2582        6188 :                       MachineRepresentation::kFloat64);
    2583        8109 :             if (lower()) DeferReplacement(node, node->InputAt(0));
    2584             :           } else {
    2585             :             VisitUnop(node, UseInfo::AnyTagged(),
    2586        7227 :                       MachineRepresentation::kFloat64);
    2587        7227 :             if (lower()) {
    2588             :               NodeProperties::ChangeOp(node,
    2589        1896 :                                        simplified()->PlainPrimitiveToFloat64());
    2590             :             }
    2591             :           }
    2592             :         } else {
    2593         108 :           VisitUnop(node, UseInfo::AnyTagged(), MachineRepresentation::kTagged);
    2594             :         }
    2595             :         return;
    2596             :       }
    2597             :       case IrOpcode::kSpeculativeToNumber: {
    2598        5303 :         NumberOperationHint const hint = NumberOperationHintOf(node->op());
    2599        5303 :         switch (hint) {
    2600             :           case NumberOperationHint::kSigned32:
    2601             :           case NumberOperationHint::kSignedSmall:
    2602             :             VisitUnop(node, CheckedUseInfoAsWord32FromHint(hint),
    2603        5303 :                       MachineRepresentation::kWord32, Type::Signed32());
    2604        5303 :             break;
    2605             :           case NumberOperationHint::kNumber:
    2606             :           case NumberOperationHint::kNumberOrOddball:
    2607             :             VisitUnop(node, CheckedUseInfoAsFloat64FromHint(hint),
    2608           0 :                       MachineRepresentation::kFloat64);
    2609           0 :             break;
    2610             :         }
    2611        6735 :         if (lower()) DeferReplacement(node, node->InputAt(0));
    2612             :         return;
    2613             :       }
    2614             :       case IrOpcode::kObjectIsDetectableCallable: {
    2615       52968 :         VisitObjectIs(node, Type::DetectableCallable(), lowering);
    2616       52968 :         return;
    2617             :       }
    2618             :       case IrOpcode::kObjectIsNaN: {
    2619             :         Type* const input_type = GetUpperBound(node->InputAt(0));
    2620        9028 :         if (input_type->Is(Type::NaN())) {
    2621           0 :           VisitUnop(node, UseInfo::None(), MachineRepresentation::kBit);
    2622           0 :           if (lower()) {
    2623           0 :             DeferReplacement(node, lowering->jsgraph()->Int32Constant(1));
    2624             :           }
    2625        9028 :         } else if (!input_type->Maybe(Type::NaN())) {
    2626          24 :           VisitUnop(node, UseInfo::Any(), MachineRepresentation::kBit);
    2627          24 :           if (lower()) {
    2628           8 :             DeferReplacement(node, lowering->jsgraph()->Int32Constant(0));
    2629             :           }
    2630        9004 :         } else if (input_type->Is(Type::Number())) {
    2631             :           VisitUnop(node, UseInfo::TruncatingFloat64(),
    2632          51 :                     MachineRepresentation::kBit);
    2633          51 :           if (lower()) {
    2634             :             // ObjectIsNaN(x:kRepFloat64) => Word32Equal(Float64Equal(x,x),#0)
    2635             :             Node* const input = node->InputAt(0);
    2636             :             node->ReplaceInput(
    2637             :                 0, jsgraph_->graph()->NewNode(
    2638          34 :                        lowering->machine()->Float64Equal(), input, input));
    2639          34 :             node->AppendInput(jsgraph_->zone(), jsgraph_->Int32Constant(0));
    2640          17 :             NodeProperties::ChangeOp(node, lowering->machine()->Word32Equal());
    2641             :           }
    2642             :         } else {
    2643        8953 :           VisitUnop(node, UseInfo::AnyTagged(), MachineRepresentation::kBit);
    2644             :         }
    2645             :         return;
    2646             :       }
    2647             :       case IrOpcode::kObjectIsNonCallable: {
    2648       25811 :         VisitObjectIs(node, Type::NonCallable(), lowering);
    2649       25811 :         return;
    2650             :       }
    2651             :       case IrOpcode::kObjectIsNumber: {
    2652       34827 :         VisitObjectIs(node, Type::Number(), lowering);
    2653       34827 :         return;
    2654             :       }
    2655             :       case IrOpcode::kObjectIsReceiver: {
    2656       69269 :         VisitObjectIs(node, Type::Receiver(), lowering);
    2657       69269 :         return;
    2658             :       }
    2659             :       case IrOpcode::kObjectIsSmi: {
    2660             :         // TODO(turbofan): Optimize based on input representation.
    2661       10683 :         VisitUnop(node, UseInfo::AnyTagged(), MachineRepresentation::kBit);
    2662       10683 :         return;
    2663             :       }
    2664             :       case IrOpcode::kObjectIsString: {
    2665       14653 :         VisitObjectIs(node, Type::String(), lowering);
    2666       14653 :         return;
    2667             :       }
    2668             :       case IrOpcode::kObjectIsSymbol: {
    2669        1995 :         VisitObjectIs(node, Type::Symbol(), lowering);
    2670        1995 :         return;
    2671             :       }
    2672             :       case IrOpcode::kObjectIsUndetectable: {
    2673       27546 :         VisitObjectIs(node, Type::Undetectable(), lowering);
    2674       27546 :         return;
    2675             :       }
    2676             :       case IrOpcode::kArgumentsFrame: {
    2677             :         SetOutput(node, MachineType::PointerRepresentation());
    2678             :         return;
    2679             :       }
    2680             :       case IrOpcode::kArgumentsLength: {
    2681             :         VisitUnop(node, UseInfo::PointerInt(),
    2682       12084 :                   MachineRepresentation::kTaggedSigned);
    2683       12084 :         return;
    2684             :       }
    2685             :       case IrOpcode::kNewUnmappedArgumentsElements: {
    2686             :         VisitBinop(node, UseInfo::PointerInt(), UseInfo::TaggedSigned(),
    2687       12299 :                    MachineRepresentation::kTaggedPointer);
    2688       12299 :         return;
    2689             :       }
    2690             :       case IrOpcode::kArrayBufferWasNeutered: {
    2691        1035 :         VisitUnop(node, UseInfo::AnyTagged(), MachineRepresentation::kBit);
    2692        1035 :         return;
    2693             :       }
    2694             :       case IrOpcode::kCheckFloat64Hole: {
    2695             :         Type* const input_type = TypeOf(node->InputAt(0));
    2696        2442 :         if (input_type->Is(Type::Number())) {
    2697         144 :           VisitNoop(node, truncation);
    2698             :         } else {
    2699        2298 :           CheckFloat64HoleMode mode = CheckFloat64HoleModeOf(node->op());
    2700        2298 :           switch (mode) {
    2701             :             case CheckFloat64HoleMode::kAllowReturnHole:
    2702        2083 :               if (truncation.IsUnused()) return VisitUnused(node);
    2703        1970 :               if (truncation.IsUsedAsFloat64()) {
    2704             :                 VisitUnop(node, UseInfo::TruncatingFloat64(),
    2705         195 :                           MachineRepresentation::kFloat64);
    2706         260 :                 if (lower()) DeferReplacement(node, node->InputAt(0));
    2707             :               } else {
    2708             :                 VisitUnop(
    2709             :                     node,
    2710             :                     UseInfo(MachineRepresentation::kFloat64, Truncation::Any()),
    2711        1775 :                     MachineRepresentation::kFloat64, Type::Number());
    2712             :               }
    2713             :               break;
    2714             :             case CheckFloat64HoleMode::kNeverReturnHole:
    2715             :               VisitUnop(
    2716             :                   node,
    2717             :                   UseInfo(MachineRepresentation::kFloat64, Truncation::Any()),
    2718         215 :                   MachineRepresentation::kFloat64, Type::Number());
    2719         215 :               break;
    2720             :           }
    2721             :         }
    2722             :         return;
    2723             :       }
    2724             :       case IrOpcode::kCheckTaggedHole: {
    2725        3612 :         VisitUnop(node, UseInfo::AnyTagged(), MachineRepresentation::kTagged);
    2726        3612 :         return;
    2727             :       }
    2728             :       case IrOpcode::kConvertTaggedHoleToUndefined: {
    2729        8560 :         if (InputIs(node, Type::NumberOrOddball()) &&
    2730        2080 :             truncation.IsUsedAsWord32()) {
    2731             :           // Propagate the Word32 truncation.
    2732             :           VisitUnop(node, UseInfo::TruncatingWord32(),
    2733         680 :                     MachineRepresentation::kWord32);
    2734         852 :           if (lower()) DeferReplacement(node, node->InputAt(0));
    2735        7200 :         } else if (InputIs(node, Type::NumberOrOddball()) &&
    2736        1400 :                    truncation.IsUsedAsFloat64()) {
    2737             :           // Propagate the Float64 truncation.
    2738             :           VisitUnop(node, UseInfo::TruncatingFloat64(),
    2739          75 :                     MachineRepresentation::kFloat64);
    2740         100 :           if (lower()) DeferReplacement(node, node->InputAt(0));
    2741        5725 :         } else if (InputIs(node, Type::NonInternal())) {
    2742          75 :           VisitUnop(node, UseInfo::AnyTagged(), MachineRepresentation::kTagged);
    2743         100 :           if (lower()) DeferReplacement(node, node->InputAt(0));
    2744             :         } else {
    2745             :           // TODO(turbofan): Add a (Tagged) truncation that identifies hole
    2746             :           // and undefined, i.e. for a[i] === obj cases.
    2747        5650 :           VisitUnop(node, UseInfo::AnyTagged(), MachineRepresentation::kTagged);
    2748             :         }
    2749             :         return;
    2750             :       }
    2751             :       case IrOpcode::kCheckMaps:
    2752             :       case IrOpcode::kTransitionElementsKind: {
    2753      153856 :         VisitInputs(node);
    2754             :         return SetOutput(node, MachineRepresentation::kNone);
    2755             :       }
    2756             :       case IrOpcode::kEnsureWritableFastElements:
    2757             :         return VisitBinop(node, UseInfo::AnyTagged(),
    2758             :                           MachineRepresentation::kTaggedPointer);
    2759             :       case IrOpcode::kMaybeGrowFastElements: {
    2760        6415 :         ProcessInput(node, 0, UseInfo::AnyTagged());         // object
    2761        6415 :         ProcessInput(node, 1, UseInfo::AnyTagged());         // elements
    2762        6415 :         ProcessInput(node, 2, UseInfo::TruncatingWord32());  // index
    2763        6415 :         ProcessInput(node, 3, UseInfo::TruncatingWord32());  // length
    2764        6415 :         ProcessRemainingInputs(node, 4);
    2765             :         SetOutput(node, MachineRepresentation::kTaggedPointer);
    2766             :         return;
    2767             :       }
    2768             : 
    2769             :       case IrOpcode::kNumberSilenceNaN:
    2770             :         VisitUnop(node, UseInfo::TruncatingFloat64(),
    2771        2260 :                   MachineRepresentation::kFloat64);
    2772        2986 :         if (lower()) NodeProperties::ChangeOp(node, Float64Op(node));
    2773             :         return;
    2774             :       case IrOpcode::kStateValues:
    2775    15899439 :         return VisitStateValues(node);
    2776             :       case IrOpcode::kObjectState:
    2777       27923 :         return VisitObjectState(node);
    2778             :       case IrOpcode::kTypeGuard: {
    2779             :         // We just get rid of the sigma here. In principle, it should be
    2780             :         // possible to refine the truncation and representation based on
    2781             :         // the sigma's type.
    2782             :         MachineRepresentation output =
    2783       67185 :             GetOutputInfoForPhi(node, TypeOf(node->InputAt(0)), truncation);
    2784       67185 :         VisitUnop(node, UseInfo(output, truncation), output);
    2785       82911 :         if (lower()) DeferReplacement(node, node->InputAt(0));
    2786             :         return;
    2787             :       }
    2788             : 
    2789             :       case IrOpcode::kOsrGuard:
    2790      167066 :         return VisitOsrGuard(node);
    2791             : 
    2792             :       case IrOpcode::kFinishRegion:
    2793      302215 :         VisitInputs(node);
    2794             :         // Assume the output is tagged pointer.
    2795             :         return SetOutput(node, MachineRepresentation::kTaggedPointer);
    2796             : 
    2797             :       case IrOpcode::kReturn:
    2798     1594381 :         VisitReturn(node);
    2799             :         // Assume the output is tagged.
    2800             :         return SetOutput(node, MachineRepresentation::kTagged);
    2801             : 
    2802             :       // Operators with all inputs tagged and no or tagged output have uniform
    2803             :       // handling.
    2804             :       case IrOpcode::kEnd:
    2805             :       case IrOpcode::kIfSuccess:
    2806             :       case IrOpcode::kIfException:
    2807             :       case IrOpcode::kIfTrue:
    2808             :       case IrOpcode::kIfFalse:
    2809             :       case IrOpcode::kDeoptimize:
    2810             :       case IrOpcode::kEffectPhi:
    2811             :       case IrOpcode::kTerminate:
    2812             :       case IrOpcode::kFrameState:
    2813             :       case IrOpcode::kCheckpoint:
    2814             :       case IrOpcode::kLoop:
    2815             :       case IrOpcode::kMerge:
    2816             :       case IrOpcode::kThrow:
    2817             :       case IrOpcode::kBeginRegion:
    2818             :       case IrOpcode::kProjection:
    2819             :       case IrOpcode::kOsrValue:
    2820             :       case IrOpcode::kArgumentsElementsState:
    2821             :       case IrOpcode::kArgumentsLengthState:
    2822             : // All JavaScript operators except JSToNumber have uniform handling.
    2823             : #define OPCODE_CASE(name) case IrOpcode::k##name:
    2824             :         JS_SIMPLE_BINOP_LIST(OPCODE_CASE)
    2825             :         JS_OTHER_UNOP_LIST(OPCODE_CASE)
    2826             :         JS_OBJECT_OP_LIST(OPCODE_CASE)
    2827             :         JS_CONTEXT_OP_LIST(OPCODE_CASE)
    2828             :         JS_OTHER_OP_LIST(OPCODE_CASE)
    2829             : #undef OPCODE_CASE
    2830             :       case IrOpcode::kJSToInteger:
    2831             :       case IrOpcode::kJSToLength:
    2832             :       case IrOpcode::kJSToName:
    2833             :       case IrOpcode::kJSToObject:
    2834             :       case IrOpcode::kJSToString:
    2835    38675795 :         VisitInputs(node);
    2836             :         // Assume the output is tagged.
    2837             :         return SetOutput(node, MachineRepresentation::kTagged);
    2838             : 
    2839             :       default:
    2840             :         V8_Fatal(
    2841             :             __FILE__, __LINE__,
    2842             :             "Representation inference: unsupported opcode %i (%s), node #%i\n.",
    2843           0 :             node->opcode(), node->op()->mnemonic(), node->id());
    2844             :         break;
    2845             :     }
    2846             :     UNREACHABLE();
    2847             :   }
    2848             : 
    2849      250582 :   void DeferReplacement(Node* node, Node* replacement) {
    2850      596652 :     TRACE("defer replacement #%d:%s with #%d:%s\n", node->id(),
    2851             :           node->op()->mnemonic(), replacement->id(),
    2852             :           replacement->op()->mnemonic());
    2853             : 
    2854             :     // Disconnect the node from effect and control chains, if necessary.
    2855      751752 :     if (node->op()->EffectInputCount() > 0) {
    2856             :       DCHECK_LT(0, node->op()->ControlInputCount());
    2857             :       // Disconnect the node from effect and control chains.
    2858       95486 :       Node* control = NodeProperties::GetControlInput(node);
    2859       95486 :       Node* effect = NodeProperties::GetEffectInput(node);
    2860      190972 :       ReplaceEffectControlUses(node, effect, control);
    2861             :     }
    2862             : 
    2863      250584 :     replacements_.push_back(node);
    2864      250583 :     replacements_.push_back(replacement);
    2865             : 
    2866      250580 :     node->NullAllInputs();  // Node is now dead.
    2867      250581 :   }
    2868             : 
    2869      149482 :   void Kill(Node* node) {
    2870       49835 :     TRACE("killing #%d:%s\n", node->id(), node->op()->mnemonic());
    2871             : 
    2872       49835 :     if (node->op()->EffectInputCount() == 1) {
    2873             :       DCHECK_LT(0, node->op()->ControlInputCount());
    2874             :       // Disconnect the node from effect and control chains.
    2875       49812 :       Node* control = NodeProperties::GetControlInput(node);
    2876       49812 :       Node* effect = NodeProperties::GetEffectInput(node);
    2877       49812 :       ReplaceEffectControlUses(node, effect, control);
    2878             :     } else {
    2879             :       DCHECK_EQ(0, node->op()->EffectInputCount());
    2880             :       DCHECK_EQ(0, node->op()->ControlOutputCount());
    2881             :       DCHECK_EQ(0, node->op()->EffectOutputCount());
    2882             :     }
    2883             : 
    2884       49835 :     node->ReplaceUses(jsgraph_->Dead());
    2885             : 
    2886       49835 :     node->NullAllInputs();  // The {node} is now dead.
    2887       49835 :   }
    2888             : 
    2889    47806905 :   void PrintOutputInfo(NodeInfo* info) {
    2890    47806905 :     if (FLAG_trace_representation) {
    2891           0 :       OFStream os(stdout);
    2892           0 :       os << info->representation();
    2893             :     }
    2894    47806905 :   }
    2895             : 
    2896             :   void PrintRepresentation(MachineRepresentation rep) {
    2897             :     if (FLAG_trace_representation) {
    2898             :       OFStream os(stdout);
    2899             :       os << rep;
    2900             :     }
    2901             :   }
    2902             : 
    2903    89619387 :   void PrintTruncation(Truncation truncation) {
    2904    89619387 :     if (FLAG_trace_representation) {
    2905           0 :       OFStream os(stdout);
    2906           0 :       os << truncation.description() << std::endl;
    2907             :     }
    2908    89619387 :   }
    2909             : 
    2910    13215964 :   void PrintUseInfo(UseInfo info) {
    2911    13215964 :     if (FLAG_trace_representation) {
    2912           0 :       OFStream os(stdout);
    2913           0 :       os << info.representation() << ":" << info.truncation().description();
    2914             :     }
    2915    13215964 :   }
    2916             : 
    2917             :  private:
    2918             :   JSGraph* jsgraph_;
    2919             :   Zone* zone_;                      // Temporary zone.
    2920             :   size_t const count_;              // number of nodes in the graph
    2921             :   ZoneVector<NodeInfo> info_;       // node id -> usage information
    2922             : #ifdef DEBUG
    2923             :   ZoneVector<InputUseInfos> node_input_use_infos_;  // Debug information about
    2924             :                                                     // requirements on inputs.
    2925             : #endif                                              // DEBUG
    2926             :   NodeVector nodes_;                // collected nodes
    2927             :   NodeVector replacements_;         // replacements to be done after lowering
    2928             :   Phase phase_;                     // current phase of algorithm
    2929             :   RepresentationChanger* changer_;  // for inserting representation changes
    2930             :   ZoneQueue<Node*> queue_;          // queue for traversing the graph
    2931             : 
    2932             :   struct NodeState {
    2933             :     Node* node;
    2934             :     int input_index;
    2935             :   };
    2936             :   ZoneStack<NodeState> typing_stack_;  // stack for graph typing.
    2937             :   // TODO(danno): RepresentationSelector shouldn't know anything about the
    2938             :   // source positions table, but must for now since there currently is no other
    2939             :   // way to pass down source position information to nodes created during
    2940             :   // lowering. Once this phase becomes a vanilla reducer, it should get source
    2941             :   // position information via the SourcePositionWrapper like all other reducers.
    2942             :   SourcePositionTable* source_positions_;
    2943             :   TypeCache const& type_cache_;
    2944             :   OperationTyper op_typer_;  // helper for the feedback typer
    2945             : 
    2946   593864934 :   NodeInfo* GetInfo(Node* node) {
    2947             :     DCHECK(node->id() < count_);
    2948   597585113 :     return &info_[node->id()];
    2949             :   }
    2950             :   Zone* zone() { return zone_; }
    2951             :   Zone* graph_zone() { return jsgraph_->zone(); }
    2952             : };
    2953             : 
    2954      395303 : SimplifiedLowering::SimplifiedLowering(JSGraph* jsgraph, Zone* zone,
    2955             :                                        SourcePositionTable* source_positions)
    2956             :     : jsgraph_(jsgraph),
    2957             :       zone_(zone),
    2958      395303 :       type_cache_(TypeCache::Get()),
    2959     1185909 :       source_positions_(source_positions) {}
    2960             : 
    2961      395303 : void SimplifiedLowering::LowerAllNodes() {
    2962      395303 :   RepresentationChanger changer(jsgraph(), jsgraph()->isolate());
    2963             :   RepresentationSelector selector(jsgraph(), zone_, &changer,
    2964      395303 :                                   source_positions_);
    2965      395303 :   selector.Run(this);
    2966      395302 : }
    2967             : 
    2968         162 : void SimplifiedLowering::DoJSToNumberTruncatesToFloat64(
    2969             :     Node* node, RepresentationSelector* selector) {
    2970             :   DCHECK_EQ(IrOpcode::kJSToNumber, node->opcode());
    2971             :   Node* value = node->InputAt(0);
    2972             :   Node* context = node->InputAt(1);
    2973             :   Node* frame_state = node->InputAt(2);
    2974             :   Node* effect = node->InputAt(3);
    2975             :   Node* control = node->InputAt(4);
    2976             : 
    2977         162 :   Node* check0 = graph()->NewNode(simplified()->ObjectIsSmi(), value);
    2978             :   Node* branch0 =
    2979         162 :       graph()->NewNode(common()->Branch(BranchHint::kTrue), check0, control);
    2980             : 
    2981         162 :   Node* if_true0 = graph()->NewNode(common()->IfTrue(), branch0);
    2982             :   Node* etrue0 = effect;
    2983             :   Node* vtrue0;
    2984             :   {
    2985         162 :     vtrue0 = graph()->NewNode(simplified()->ChangeTaggedSignedToInt32(), value);
    2986         162 :     vtrue0 = graph()->NewNode(machine()->ChangeInt32ToFloat64(), vtrue0);
    2987             :   }
    2988             : 
    2989         162 :   Node* if_false0 = graph()->NewNode(common()->IfFalse(), branch0);
    2990             :   Node* efalse0 = effect;
    2991             :   Node* vfalse0;
    2992             :   {
    2993             :     vfalse0 = efalse0 = if_false0 =
    2994             :         graph()->NewNode(ToNumberOperator(), ToNumberCode(), value, context,
    2995         162 :                          frame_state, efalse0, if_false0);
    2996             : 
    2997             :     // Update potential {IfException} uses of {node} to point to the above
    2998             :     // {ToNumber} stub call node instead.
    2999         162 :     Node* on_exception = nullptr;
    3000         162 :     if (NodeProperties::IsExceptionalCall(node, &on_exception)) {
    3001           0 :       NodeProperties::ReplaceControlInput(on_exception, vfalse0);
    3002           0 :       NodeProperties::ReplaceEffectInput(on_exception, efalse0);
    3003           0 :       if_false0 = graph()->NewNode(common()->IfSuccess(), vfalse0);
    3004             :     }
    3005             : 
    3006         162 :     Node* check1 = graph()->NewNode(simplified()->ObjectIsSmi(), vfalse0);
    3007         162 :     Node* branch1 = graph()->NewNode(common()->Branch(), check1, if_false0);
    3008             : 
    3009         162 :     Node* if_true1 = graph()->NewNode(common()->IfTrue(), branch1);
    3010             :     Node* etrue1 = efalse0;
    3011             :     Node* vtrue1;
    3012             :     {
    3013             :       vtrue1 =
    3014         162 :           graph()->NewNode(simplified()->ChangeTaggedSignedToInt32(), vfalse0);
    3015         162 :       vtrue1 = graph()->NewNode(machine()->ChangeInt32ToFloat64(), vtrue1);
    3016             :     }
    3017             : 
    3018         162 :     Node* if_false1 = graph()->NewNode(common()->IfFalse(), branch1);
    3019             :     Node* efalse1 = efalse0;
    3020             :     Node* vfalse1;
    3021             :     {
    3022             :       vfalse1 = efalse1 = graph()->NewNode(
    3023             :           simplified()->LoadField(AccessBuilder::ForHeapNumberValue()), efalse0,
    3024         486 :           efalse1, if_false1);
    3025             :     }
    3026             : 
    3027         162 :     if_false0 = graph()->NewNode(common()->Merge(2), if_true1, if_false1);
    3028             :     efalse0 =
    3029         162 :         graph()->NewNode(common()->EffectPhi(2), etrue1, efalse1, if_false0);
    3030             :     vfalse0 =
    3031             :         graph()->NewNode(common()->Phi(MachineRepresentation::kFloat64, 2),
    3032         162 :                          vtrue1, vfalse1, if_false0);
    3033             :   }
    3034             : 
    3035         162 :   control = graph()->NewNode(common()->Merge(2), if_true0, if_false0);
    3036         162 :   effect = graph()->NewNode(common()->EffectPhi(2), etrue0, efalse0, control);
    3037             :   value = graph()->NewNode(common()->Phi(MachineRepresentation::kFloat64, 2),
    3038         162 :                            vtrue0, vfalse0, control);
    3039             : 
    3040             :   // Replace effect and control uses appropriately.
    3041        1740 :   for (Edge edge : node->use_edges()) {
    3042         789 :     if (NodeProperties::IsControlEdge(edge)) {
    3043        1077 :       if (edge.from()->opcode() == IrOpcode::kIfSuccess) {
    3044           0 :         edge.from()->ReplaceUses(control);
    3045           0 :         edge.from()->Kill();
    3046             :       } else {
    3047             :         DCHECK(edge.from()->opcode() != IrOpcode::kIfException);
    3048         359 :         edge.UpdateTo(control);
    3049             :       }
    3050         430 :     } else if (NodeProperties::IsEffectEdge(edge)) {
    3051         238 :       edge.UpdateTo(effect);
    3052             :     }
    3053             :   }
    3054             : 
    3055         162 :   selector->DeferReplacement(node, value);
    3056         162 : }
    3057             : 
    3058        2350 : void SimplifiedLowering::DoJSToNumberTruncatesToWord32(
    3059             :     Node* node, RepresentationSelector* selector) {
    3060             :   DCHECK_EQ(IrOpcode::kJSToNumber, node->opcode());
    3061             :   Node* value = node->InputAt(0);
    3062             :   Node* context = node->InputAt(1);
    3063             :   Node* frame_state = node->InputAt(2);
    3064             :   Node* effect = node->InputAt(3);
    3065             :   Node* control = node->InputAt(4);
    3066             : 
    3067        2350 :   Node* check0 = graph()->NewNode(simplified()->ObjectIsSmi(), value);
    3068             :   Node* branch0 =
    3069        2350 :       graph()->NewNode(common()->Branch(BranchHint::kTrue), check0, control);
    3070             : 
    3071        2350 :   Node* if_true0 = graph()->NewNode(common()->IfTrue(), branch0);
    3072             :   Node* etrue0 = effect;
    3073             :   Node* vtrue0 =
    3074        2350 :       graph()->NewNode(simplified()->ChangeTaggedSignedToInt32(), value);
    3075             : 
    3076        2350 :   Node* if_false0 = graph()->NewNode(common()->IfFalse(), branch0);
    3077             :   Node* efalse0 = effect;
    3078             :   Node* vfalse0;
    3079             :   {
    3080             :     vfalse0 = efalse0 = if_false0 =
    3081             :         graph()->NewNode(ToNumberOperator(), ToNumberCode(), value, context,
    3082        2350 :                          frame_state, efalse0, if_false0);
    3083             : 
    3084             :     // Update potential {IfException} uses of {node} to point to the above
    3085             :     // {ToNumber} stub call node instead.
    3086        2350 :     Node* on_exception = nullptr;
    3087        2350 :     if (NodeProperties::IsExceptionalCall(node, &on_exception)) {
    3088           0 :       NodeProperties::ReplaceControlInput(on_exception, vfalse0);
    3089           0 :       NodeProperties::ReplaceEffectInput(on_exception, efalse0);
    3090           0 :       if_false0 = graph()->NewNode(common()->IfSuccess(), vfalse0);
    3091             :     }
    3092             : 
    3093        2350 :     Node* check1 = graph()->NewNode(simplified()->ObjectIsSmi(), vfalse0);
    3094        2350 :     Node* branch1 = graph()->NewNode(common()->Branch(), check1, if_false0);
    3095             : 
    3096        2350 :     Node* if_true1 = graph()->NewNode(common()->IfTrue(), branch1);
    3097             :     Node* etrue1 = efalse0;
    3098             :     Node* vtrue1 =
    3099        2350 :         graph()->NewNode(simplified()->ChangeTaggedSignedToInt32(), vfalse0);
    3100             : 
    3101        2350 :     Node* if_false1 = graph()->NewNode(common()->IfFalse(), branch1);
    3102             :     Node* efalse1 = efalse0;
    3103             :     Node* vfalse1;
    3104             :     {
    3105             :       vfalse1 = efalse1 = graph()->NewNode(
    3106             :           simplified()->LoadField(AccessBuilder::ForHeapNumberValue()), efalse0,
    3107        7050 :           efalse1, if_false1);
    3108        2350 :       vfalse1 = graph()->NewNode(machine()->TruncateFloat64ToWord32(), vfalse1);
    3109             :     }
    3110             : 
    3111        2350 :     if_false0 = graph()->NewNode(common()->Merge(2), if_true1, if_false1);
    3112             :     efalse0 =
    3113        2350 :         graph()->NewNode(common()->EffectPhi(2), etrue1, efalse1, if_false0);
    3114             :     vfalse0 = graph()->NewNode(common()->Phi(MachineRepresentation::kWord32, 2),
    3115        2350 :                                vtrue1, vfalse1, if_false0);
    3116             :   }
    3117             : 
    3118        2350 :   control = graph()->NewNode(common()->Merge(2), if_true0, if_false0);
    3119        2350 :   effect = graph()->NewNode(common()->EffectPhi(2), etrue0, efalse0, control);
    3120             :   value = graph()->NewNode(common()->Phi(MachineRepresentation::kWord32, 2),
    3121        2350 :                            vtrue0, vfalse0, control);
    3122             : 
    3123             :   // Replace effect and control uses appropriately.
    3124       25832 :   for (Edge edge : node->use_edges()) {
    3125       11741 :     if (NodeProperties::IsControlEdge(edge)) {
    3126       17391 :       if (edge.from()->opcode() == IrOpcode::kIfSuccess) {
    3127           0 :         edge.from()->ReplaceUses(control);
    3128           0 :         edge.from()->Kill();
    3129             :       } else {
    3130             :         DCHECK(edge.from()->opcode() != IrOpcode::kIfException);
    3131        5797 :         edge.UpdateTo(control);
    3132             :       }
    3133        5944 :     } else if (NodeProperties::IsEffectEdge(edge)) {
    3134        3717 :       edge.UpdateTo(effect);
    3135             :     }
    3136             :   }
    3137             : 
    3138        2350 :   selector->DeferReplacement(node, value);
    3139        2350 : }
    3140             : 
    3141        5912 : void SimplifiedLowering::DoLoadBuffer(Node* node,
    3142             :                                       MachineRepresentation output_rep,
    3143         616 :                                       RepresentationChanger* changer) {
    3144             :   DCHECK_EQ(IrOpcode::kLoadBuffer, node->opcode());
    3145             :   DCHECK_NE(MachineRepresentation::kNone, output_rep);
    3146        5912 :   MachineType const access_type = BufferAccessOf(node->op()).machine_type();
    3147        5912 :   if (output_rep != access_type.representation()) {
    3148             :     Node* const buffer = node->InputAt(0);
    3149             :     Node* const offset = node->InputAt(1);
    3150             :     Node* const length = node->InputAt(2);
    3151             :     Node* const effect = node->InputAt(3);
    3152             :     Node* const control = node->InputAt(4);
    3153             :     Node* const index =
    3154             :         machine()->Is64()
    3155         308 :             ? graph()->NewNode(machine()->ChangeUint32ToUint64(), offset)
    3156         308 :             : offset;
    3157             : 
    3158         308 :     Node* check = graph()->NewNode(machine()->Uint32LessThan(), offset, length);
    3159             :     Node* branch =
    3160         308 :         graph()->NewNode(common()->Branch(BranchHint::kTrue), check, control);
    3161             : 
    3162         308 :     Node* if_true = graph()->NewNode(common()->IfTrue(), branch);
    3163             :     Node* etrue = graph()->NewNode(machine()->Load(access_type), buffer, index,
    3164         308 :                                    effect, if_true);
    3165             :     Type* element_type =
    3166         308 :         Type::Intersect(NodeProperties::GetType(node), Type::Number(), zone());
    3167             :     Node* vtrue = changer->GetRepresentationFor(
    3168             :         etrue, access_type.representation(), element_type, node,
    3169         308 :         UseInfo(output_rep, Truncation::None()));
    3170             : 
    3171         308 :     Node* if_false = graph()->NewNode(common()->IfFalse(), branch);
    3172             :     Node* efalse = effect;
    3173             :     Node* vfalse;
    3174         308 :     if (output_rep == MachineRepresentation::kTagged) {
    3175         206 :       vfalse = jsgraph()->UndefinedConstant();
    3176         102 :     } else if (output_rep == MachineRepresentation::kFloat64) {
    3177             :       vfalse =
    3178         102 :           jsgraph()->Float64Constant(std::numeric_limits<double>::quiet_NaN());
    3179           0 :     } else if (output_rep == MachineRepresentation::kFloat32) {
    3180             :       vfalse =
    3181           0 :           jsgraph()->Float32Constant(std::numeric_limits<float>::quiet_NaN());
    3182             :     } else {
    3183           0 :       vfalse = jsgraph()->Int32Constant(0);
    3184             :     }
    3185             : 
    3186         308 :     Node* merge = graph()->NewNode(common()->Merge(2), if_true, if_false);
    3187         308 :     Node* ephi = graph()->NewNode(common()->EffectPhi(2), etrue, efalse, merge);
    3188             : 
    3189             :     // Replace effect uses of {node} with the {ephi}.
    3190         308 :     NodeProperties::ReplaceUses(node, node, ephi);
    3191             : 
    3192             :     // Turn the {node} into a Phi.
    3193         308 :     node->ReplaceInput(0, vtrue);
    3194         308 :     node->ReplaceInput(1, vfalse);
    3195         308 :     node->ReplaceInput(2, merge);
    3196         308 :     node->TrimInputCount(3);
    3197         308 :     NodeProperties::ChangeOp(node, common()->Phi(output_rep, 2));
    3198             :   } else {
    3199        5604 :     NodeProperties::ChangeOp(node, machine()->CheckedLoad(access_type));
    3200             :   }
    3201        5912 : }
    3202             : 
    3203             : 
    3204        4111 : void SimplifiedLowering::DoStoreBuffer(Node* node) {
    3205             :   DCHECK_EQ(IrOpcode::kStoreBuffer, node->opcode());
    3206             :   MachineRepresentation const rep =
    3207        4111 :       BufferAccessOf(node->op()).machine_type().representation();
    3208        4111 :   NodeProperties::ChangeOp(node, machine()->CheckedStore(rep));
    3209        4111 : }
    3210             : 
    3211         124 : Node* SimplifiedLowering::Float64Round(Node* const node) {
    3212          62 :   Node* const one = jsgraph()->Float64Constant(1.0);
    3213          62 :   Node* const one_half = jsgraph()->Float64Constant(0.5);
    3214             :   Node* const input = node->InputAt(0);
    3215             : 
    3216             :   // Round up towards Infinity, and adjust if the difference exceeds 0.5.
    3217             :   Node* result = graph()->NewNode(machine()->Float64RoundUp().placeholder(),
    3218         124 :                                   node->InputAt(0));
    3219             :   return graph()->NewNode(
    3220             :       common()->Select(MachineRepresentation::kFloat64),
    3221             :       graph()->NewNode(
    3222             :           machine()->Float64LessThanOrEqual(),
    3223             :           graph()->NewNode(machine()->Float64Sub(), result, one_half), input),
    3224         310 :       result, graph()->NewNode(machine()->Float64Sub(), result, one));
    3225             : }
    3226             : 
    3227          42 : Node* SimplifiedLowering::Float64Sign(Node* const node) {
    3228          14 :   Node* const minus_one = jsgraph()->Float64Constant(-1.0);
    3229          14 :   Node* const zero = jsgraph()->Float64Constant(0.0);
    3230          14 :   Node* const one = jsgraph()->Float64Constant(1.0);
    3231             : 
    3232             :   Node* const input = node->InputAt(0);
    3233             : 
    3234             :   return graph()->NewNode(
    3235             :       common()->Select(MachineRepresentation::kFloat64),
    3236             :       graph()->NewNode(machine()->Float64LessThan(), input, zero), minus_one,
    3237             :       graph()->NewNode(
    3238             :           common()->Select(MachineRepresentation::kFloat64),
    3239             :           graph()->NewNode(machine()->Float64LessThan(), zero, input), one,
    3240          70 :           input));
    3241             : }
    3242             : 
    3243          66 : Node* SimplifiedLowering::Int32Abs(Node* const node) {
    3244             :   Node* const input = node->InputAt(0);
    3245             : 
    3246             :   // Generate case for absolute integer value.
    3247             :   //
    3248             :   //    let sign = input >> 31 in
    3249             :   //    (input ^ sign) - sign
    3250             : 
    3251             :   Node* sign = graph()->NewNode(machine()->Word32Sar(), input,
    3252          66 :                                 jsgraph()->Int32Constant(31));
    3253             :   return graph()->NewNode(machine()->Int32Sub(),
    3254             :                           graph()->NewNode(machine()->Word32Xor(), input, sign),
    3255          99 :                           sign);
    3256             : }
    3257             : 
    3258        8901 : Node* SimplifiedLowering::Int32Div(Node* const node) {
    3259        2967 :   Int32BinopMatcher m(node);
    3260        2967 :   Node* const zero = jsgraph()->Int32Constant(0);
    3261        2967 :   Node* const minus_one = jsgraph()->Int32Constant(-1);
    3262             :   Node* const lhs = m.left().node();
    3263             :   Node* const rhs = m.right().node();
    3264             : 
    3265        2967 :   if (m.right().Is(-1)) {
    3266          42 :     return graph()->NewNode(machine()->Int32Sub(), zero, lhs);
    3267        2946 :   } else if (m.right().Is(0)) {
    3268             :     return rhs;
    3269        2933 :   } else if (machine()->Int32DivIsSafe() || m.right().HasValue()) {
    3270        5676 :     return graph()->NewNode(machine()->Int32Div(), lhs, rhs, graph()->start());
    3271             :   }
    3272             : 
    3273             :   // General case for signed integer division.
    3274             :   //
    3275             :   //    if 0 < rhs then
    3276             :   //      lhs / rhs
    3277             :   //    else
    3278             :   //      if rhs < -1 then
    3279             :   //        lhs / rhs
    3280             :   //      else if rhs == 0 then
    3281             :   //        0
    3282             :   //      else
    3283             :   //        0 - lhs
    3284             :   //
    3285             :   // Note: We do not use the Diamond helper class here, because it really hurts
    3286             :   // readability with nested diamonds.
    3287          95 :   const Operator* const merge_op = common()->Merge(2);
    3288             :   const Operator* const phi_op =
    3289          95 :       common()->Phi(MachineRepresentation::kWord32, 2);
    3290             : 
    3291          95 :   Node* check0 = graph()->NewNode(machine()->Int32LessThan(), zero, rhs);
    3292             :   Node* branch0 = graph()->NewNode(common()->Branch(BranchHint::kTrue), check0,
    3293         190 :                                    graph()->start());
    3294             : 
    3295          95 :   Node* if_true0 = graph()->NewNode(common()->IfTrue(), branch0);
    3296          95 :   Node* true0 = graph()->NewNode(machine()->Int32Div(), lhs, rhs, if_true0);
    3297             : 
    3298          95 :   Node* if_false0 = graph()->NewNode(common()->IfFalse(), branch0);
    3299             :   Node* false0;
    3300             :   {
    3301          95 :     Node* check1 = graph()->NewNode(machine()->Int32LessThan(), rhs, minus_one);
    3302          95 :     Node* branch1 = graph()->NewNode(common()->Branch(), check1, if_false0);
    3303             : 
    3304          95 :     Node* if_true1 = graph()->NewNode(common()->IfTrue(), branch1);
    3305          95 :     Node* true1 = graph()->NewNode(machine()->Int32Div(), lhs, rhs, if_true1);
    3306             : 
    3307          95 :     Node* if_false1 = graph()->NewNode(common()->IfFalse(), branch1);
    3308             :     Node* false1;
    3309             :     {
    3310          95 :       Node* check2 = graph()->NewNode(machine()->Word32Equal(), rhs, zero);
    3311          95 :       Node* branch2 = graph()->NewNode(common()->Branch(), check2, if_false1);
    3312             : 
    3313          95 :       Node* if_true2 = graph()->NewNode(common()->IfTrue(), branch2);
    3314             :       Node* true2 = zero;
    3315             : 
    3316          95 :       Node* if_false2 = graph()->NewNode(common()->IfFalse(), branch2);
    3317          95 :       Node* false2 = graph()->NewNode(machine()->Int32Sub(), zero, lhs);
    3318             : 
    3319             :       if_false1 = graph()->NewNode(merge_op, if_true2, if_false2);
    3320             :       false1 = graph()->NewNode(phi_op, true2, false2, if_false1);
    3321             :     }
    3322             : 
    3323             :     if_false0 = graph()->NewNode(merge_op, if_true1, if_false1);
    3324             :     false0 = graph()->NewNode(phi_op, true1, false1, if_false0);
    3325             :   }
    3326             : 
    3327             :   Node* merge0 = graph()->NewNode(merge_op, if_true0, if_false0);
    3328          95 :   return graph()->NewNode(phi_op, true0, false0, merge0);
    3329             : }
    3330             : 
    3331             : 
    3332        9006 : Node* SimplifiedLowering::Int32Mod(Node* const node) {
    3333        3002 :   Int32BinopMatcher m(node);
    3334        3002 :   Node* const zero = jsgraph()->Int32Constant(0);
    3335        3002 :   Node* const minus_one = jsgraph()->Int32Constant(-1);
    3336             :   Node* const lhs = m.left().node();
    3337             :   Node* const rhs = m.right().node();
    3338             : 
    3339        5989 :   if (m.right().Is(-1) || m.right().Is(0)) {
    3340             :     return zero;
    3341        2987 :   } else if (m.right().HasValue()) {
    3342        8574 :     return graph()->NewNode(machine()->Int32Mod(), lhs, rhs, graph()->start());
    3343             :   }
    3344             : 
    3345             :   // General case for signed integer modulus, with optimization for (unknown)
    3346             :   // power of 2 right hand side.
    3347             :   //
    3348             :   //   if 0 < rhs then
    3349             :   //     msk = rhs - 1
    3350             :   //     if rhs & msk != 0 then
    3351             :   //       lhs % rhs
    3352             :   //     else
    3353             :   //       if lhs < 0 then
    3354             :   //         -(-lhs & msk)
    3355             :   //       else
    3356             :   //         lhs & msk
    3357             :   //   else
    3358             :   //     if rhs < -1 then
    3359             :   //       lhs % rhs
    3360             :   //     else
    3361             :   //       zero
    3362             :   //
    3363             :   // Note: We do not use the Diamond helper class here, because it really hurts
    3364             :   // readability with nested diamonds.
    3365         129 :   const Operator* const merge_op = common()->Merge(2);
    3366             :   const Operator* const phi_op =
    3367         129 :       common()->Phi(MachineRepresentation::kWord32, 2);
    3368             : 
    3369         129 :   Node* check0 = graph()->NewNode(machine()->Int32LessThan(), zero, rhs);
    3370             :   Node* branch0 = graph()->NewNode(common()->Branch(BranchHint::kTrue), check0,
    3371         258 :                                    graph()->start());
    3372             : 
    3373         129 :   Node* if_true0 = graph()->NewNode(common()->IfTrue(), branch0);
    3374             :   Node* true0;
    3375             :   {
    3376         129 :     Node* msk = graph()->NewNode(machine()->Int32Add(), rhs, minus_one);
    3377             : 
    3378         129 :     Node* check1 = graph()->NewNode(machine()->Word32And(), rhs, msk);
    3379         129 :     Node* branch1 = graph()->NewNode(common()->Branch(), check1, if_true0);
    3380             : 
    3381         129 :     Node* if_true1 = graph()->NewNode(common()->IfTrue(), branch1);
    3382         129 :     Node* true1 = graph()->NewNode(machine()->Int32Mod(), lhs, rhs, if_true1);
    3383             : 
    3384         129 :     Node* if_false1 = graph()->NewNode(common()->IfFalse(), branch1);
    3385             :     Node* false1;
    3386             :     {
    3387         129 :       Node* check2 = graph()->NewNode(machine()->Int32LessThan(), lhs, zero);
    3388             :       Node* branch2 = graph()->NewNode(common()->Branch(BranchHint::kFalse),
    3389         129 :                                        check2, if_false1);
    3390             : 
    3391         129 :       Node* if_true2 = graph()->NewNode(common()->IfTrue(), branch2);
    3392             :       Node* true2 = graph()->NewNode(
    3393             :           machine()->Int32Sub(), zero,
    3394             :           graph()->NewNode(machine()->Word32And(),
    3395             :                            graph()->NewNode(machine()->Int32Sub(), zero, lhs),
    3396         387 :                            msk));
    3397             : 
    3398         129 :       Node* if_false2 = graph()->NewNode(common()->IfFalse(), branch2);
    3399         129 :       Node* false2 = graph()->NewNode(machine()->Word32And(), lhs, msk);
    3400             : 
    3401             :       if_false1 = graph()->NewNode(merge_op, if_true2, if_false2);
    3402             :       false1 = graph()->NewNode(phi_op, true2, false2, if_false1);
    3403             :     }
    3404             : 
    3405             :     if_true0 = graph()->NewNode(merge_op, if_true1, if_false1);
    3406             :     true0 = graph()->NewNode(phi_op, true1, false1, if_true0);
    3407             :   }
    3408             : 
    3409         129 :   Node* if_false0 = graph()->NewNode(common()->IfFalse(), branch0);
    3410             :   Node* false0;
    3411             :   {
    3412         129 :     Node* check1 = graph()->NewNode(machine()->Int32LessThan(), rhs, minus_one);
    3413             :     Node* branch1 = graph()->NewNode(common()->Branch(BranchHint::kTrue),
    3414         129 :                                      check1, if_false0);
    3415             : 
    3416         129 :     Node* if_true1 = graph()->NewNode(common()->IfTrue(), branch1);
    3417         129 :     Node* true1 = graph()->NewNode(machine()->Int32Mod(), lhs, rhs, if_true1);
    3418             : 
    3419         129 :     Node* if_false1 = graph()->NewNode(common()->IfFalse(), branch1);
    3420             :     Node* false1 = zero;
    3421             : 
    3422             :     if_false0 = graph()->NewNode(merge_op, if_true1, if_false1);
    3423             :     false0 = graph()->NewNode(phi_op, true1, false1, if_false0);
    3424             :   }
    3425             : 
    3426             :   Node* merge0 = graph()->NewNode(merge_op, if_true0, if_false0);
    3427         129 :   return graph()->NewNode(phi_op, true0, false0, merge0);
    3428             : }
    3429             : 
    3430          21 : Node* SimplifiedLowering::Int32Sign(Node* const node) {
    3431           7 :   Node* const minus_one = jsgraph()->Int32Constant(-1);
    3432           7 :   Node* const zero = jsgraph()->Int32Constant(0);
    3433           7 :   Node* const one = jsgraph()->Int32Constant(1);
    3434             : 
    3435             :   Node* const input = node->InputAt(0);
    3436             : 
    3437             :   return graph()->NewNode(
    3438             :       common()->Select(MachineRepresentation::kWord32),
    3439             :       graph()->NewNode(machine()->Int32LessThan(), input, zero), minus_one,
    3440             :       graph()->NewNode(
    3441             :           common()->Select(MachineRepresentation::kWord32),
    3442             :           graph()->NewNode(machine()->Int32LessThan(), zero, input), one,
    3443          35 :           zero));
    3444             : }
    3445             : 
    3446         562 : Node* SimplifiedLowering::Uint32Div(Node* const node) {
    3447         281 :   Uint32BinopMatcher m(node);
    3448             :   Node* const zero = jsgraph()->Uint32Constant(0);
    3449             :   Node* const lhs = m.left().node();
    3450             :   Node* const rhs = m.right().node();
    3451             : 
    3452         281 :   if (m.right().Is(0)) {
    3453             :     return zero;
    3454         261 :   } else if (machine()->Uint32DivIsSafe() || m.right().HasValue()) {
    3455         420 :     return graph()->NewNode(machine()->Uint32Div(), lhs, rhs, graph()->start());
    3456             :   }
    3457             : 
    3458          51 :   Node* check = graph()->NewNode(machine()->Word32Equal(), rhs, zero);
    3459          51 :   Diamond d(graph(), common(), check, BranchHint::kFalse);
    3460         102 :   Node* div = graph()->NewNode(machine()->Uint32Div(), lhs, rhs, d.if_false);
    3461          51 :   return d.Phi(MachineRepresentation::kWord32, zero, div);
    3462             : }
    3463             : 
    3464             : 
    3465        1518 : Node* SimplifiedLowering::Uint32Mod(Node* const node) {
    3466         506 :   Uint32BinopMatcher m(node);
    3467         506 :   Node* const minus_one = jsgraph()->Int32Constant(-1);
    3468             :   Node* const zero = jsgraph()->Uint32Constant(0);
    3469             :   Node* const lhs = m.left().node();
    3470             :   Node* const rhs = m.right().node();
    3471             : 
    3472         506 :   if (m.right().Is(0)) {
    3473             :     return zero;
    3474         506 :   } else if (m.right().HasValue()) {
    3475        1374 :     return graph()->NewNode(machine()->Uint32Mod(), lhs, rhs, graph()->start());
    3476             :   }
    3477             : 
    3478             :   // General case for unsigned integer modulus, with optimization for (unknown)
    3479             :   // power of 2 right hand side.
    3480             :   //
    3481             :   //   if rhs then
    3482             :   //     msk = rhs - 1
    3483             :   //     if rhs & msk != 0 then
    3484             :   //       lhs % rhs
    3485             :   //     else
    3486             :   //       lhs & msk
    3487             :   //   else
    3488             :   //     zero
    3489             :   //
    3490             :   // Note: We do not use the Diamond helper class here, because it really hurts
    3491             :   // readability with nested diamonds.
    3492          48 :   const Operator* const merge_op = common()->Merge(2);
    3493             :   const Operator* const phi_op =
    3494          48 :       common()->Phi(MachineRepresentation::kWord32, 2);
    3495             : 
    3496             :   Node* branch0 = graph()->NewNode(common()->Branch(BranchHint::kTrue), rhs,
    3497          96 :                                    graph()->start());
    3498             : 
    3499          48 :   Node* if_true0 = graph()->NewNode(common()->IfTrue(), branch0);
    3500             :   Node* true0;
    3501             :   {
    3502          48 :     Node* msk = graph()->NewNode(machine()->Int32Add(), rhs, minus_one);
    3503             : 
    3504          48 :     Node* check1 = graph()->NewNode(machine()->Word32And(), rhs, msk);
    3505          48 :     Node* branch1 = graph()->NewNode(common()->Branch(), check1, if_true0);
    3506             : 
    3507          48 :     Node* if_true1 = graph()->NewNode(common()->IfTrue(), branch1);
    3508          48 :     Node* true1 = graph()->NewNode(machine()->Uint32Mod(), lhs, rhs, if_true1);
    3509             : 
    3510          48 :     Node* if_false1 = graph()->NewNode(common()->IfFalse(), branch1);
    3511          48 :     Node* false1 = graph()->NewNode(machine()->Word32And(), lhs, msk);
    3512             : 
    3513             :     if_true0 = graph()->NewNode(merge_op, if_true1, if_false1);
    3514             :     true0 = graph()->NewNode(phi_op, true1, false1, if_true0);
    3515             :   }
    3516             : 
    3517          48 :   Node* if_false0 = graph()->NewNode(common()->IfFalse(), branch0);
    3518             :   Node* false0 = zero;
    3519             : 
    3520             :   Node* merge0 = graph()->NewNode(merge_op, if_true0, if_false0);
    3521          48 :   return graph()->NewNode(phi_op, true0, false0, merge0);
    3522             : }
    3523             : 
    3524         121 : void SimplifiedLowering::DoMax(Node* node, Operator const* op,
    3525             :                                MachineRepresentation rep) {
    3526             :   Node* const lhs = node->InputAt(0);
    3527             :   Node* const rhs = node->InputAt(1);
    3528             : 
    3529         121 :   node->ReplaceInput(0, graph()->NewNode(op, lhs, rhs));
    3530             :   DCHECK_EQ(rhs, node->InputAt(1));
    3531         121 :   node->AppendInput(graph()->zone(), lhs);
    3532         121 :   NodeProperties::ChangeOp(node, common()->Select(rep));
    3533         121 : }
    3534             : 
    3535         117 : void SimplifiedLowering::DoMin(Node* node, Operator const* op,
    3536             :                                MachineRepresentation rep) {
    3537             :   Node* const lhs = node->InputAt(0);
    3538             :   Node* const rhs = node->InputAt(1);
    3539             : 
    3540         117 :   node->InsertInput(graph()->zone(), 0, graph()->NewNode(op, lhs, rhs));
    3541             :   DCHECK_EQ(lhs, node->InputAt(1));
    3542             :   DCHECK_EQ(rhs, node->InputAt(2));
    3543         117 :   NodeProperties::ChangeOp(node, common()->Select(rep));
    3544         117 : }
    3545             : 
    3546       40180 : void SimplifiedLowering::DoShift(Node* node, Operator const* op,
    3547        5076 :                                  Type* rhs_type) {
    3548       80360 :   if (!rhs_type->Is(type_cache_.kZeroToThirtyOne)) {
    3549        5076 :     Node* const rhs = NodeProperties::GetValueInput(node, 1);
    3550             :     node->ReplaceInput(1, graph()->NewNode(machine()->Word32And(), rhs,
    3551       15228 :                                            jsgraph()->Int32Constant(0x1f)));
    3552             :   }
    3553       40180 :   ChangeToPureOp(node, op);
    3554       40180 : }
    3555             : 
    3556        2284 : void SimplifiedLowering::DoStringToNumber(Node* node) {
    3557             :   Operator::Properties properties = Operator::kEliminatable;
    3558         571 :   Callable callable = CodeFactory::StringToNumber(isolate());
    3559             :   CallDescriptor::Flags flags = CallDescriptor::kNoFlags;
    3560             :   CallDescriptor* desc = Linkage::GetStubCallDescriptor(
    3561        1713 :       isolate(), graph()->zone(), callable.descriptor(), 0, flags, properties);
    3562             :   node->InsertInput(graph()->zone(), 0,
    3563        1142 :                     jsgraph()->HeapConstant(callable.code()));
    3564         571 :   node->AppendInput(graph()->zone(), jsgraph()->NoContextConstant());
    3565         571 :   node->AppendInput(graph()->zone(), graph()->start());
    3566         571 :   NodeProperties::ChangeOp(node, common()->Call(desc));
    3567         571 : }
    3568             : 
    3569         326 : void SimplifiedLowering::DoIntegral32ToBit(Node* node) {
    3570             :   Node* const input = node->InputAt(0);
    3571         163 :   Node* const zero = jsgraph()->Int32Constant(0);
    3572         163 :   Operator const* const op = machine()->Word32Equal();
    3573             : 
    3574         163 :   node->ReplaceInput(0, graph()->NewNode(op, input, zero));
    3575         163 :   node->AppendInput(graph()->zone(), zero);
    3576         163 :   NodeProperties::ChangeOp(node, op);
    3577         163 : }
    3578             : 
    3579           0 : void SimplifiedLowering::DoOrderedNumberToBit(Node* node) {
    3580             :   Node* const input = node->InputAt(0);
    3581             : 
    3582             :   node->ReplaceInput(0, graph()->NewNode(machine()->Float64Equal(), input,
    3583           0 :                                          jsgraph()->Float64Constant(0.0)));
    3584           0 :   node->AppendInput(graph()->zone(), jsgraph()->Int32Constant(0));
    3585           0 :   NodeProperties::ChangeOp(node, machine()->Word32Equal());
    3586           0 : }
    3587             : 
    3588         394 : void SimplifiedLowering::DoNumberToBit(Node* node) {
    3589             :   Node* const input = node->InputAt(0);
    3590             : 
    3591         197 :   node->ReplaceInput(0, jsgraph()->Float64Constant(0.0));
    3592             :   node->AppendInput(graph()->zone(),
    3593         394 :                     graph()->NewNode(machine()->Float64Abs(), input));
    3594         197 :   NodeProperties::ChangeOp(node, machine()->Float64LessThan());
    3595         197 : }
    3596             : 
    3597          72 : void SimplifiedLowering::DoIntegerToUint8Clamped(Node* node) {
    3598             :   Node* const input = node->InputAt(0);
    3599          24 :   Node* const min = jsgraph()->Float64Constant(0.0);
    3600          24 :   Node* const max = jsgraph()->Float64Constant(255.0);
    3601             : 
    3602             :   node->ReplaceInput(
    3603          48 :       0, graph()->NewNode(machine()->Float64LessThan(), min, input));
    3604             :   node->AppendInput(
    3605             :       graph()->zone(),
    3606             :       graph()->NewNode(
    3607             :           common()->Select(MachineRepresentation::kFloat64),
    3608             :           graph()->NewNode(machine()->Float64LessThan(), input, max), input,
    3609          72 :           max));
    3610          24 :   node->AppendInput(graph()->zone(), min);
    3611             :   NodeProperties::ChangeOp(node,
    3612          24 :                            common()->Select(MachineRepresentation::kFloat64));
    3613          24 : }
    3614             : 
    3615         900 : void SimplifiedLowering::DoNumberToUint8Clamped(Node* node) {
    3616             :   Node* const input = node->InputAt(0);
    3617         300 :   Node* const min = jsgraph()->Float64Constant(0.0);
    3618         300 :   Node* const max = jsgraph()->Float64Constant(255.0);
    3619             : 
    3620             :   node->ReplaceInput(
    3621             :       0, graph()->NewNode(
    3622             :              common()->Select(MachineRepresentation::kFloat64),
    3623             :              graph()->NewNode(machine()->Float64LessThan(), min, input),
    3624             :              graph()->NewNode(
    3625             :                  common()->Select(MachineRepresentation::kFloat64),
    3626             :                  graph()->NewNode(machine()->Float64LessThan(), input, max),
    3627             :                  input, max),
    3628        1500 :              min));
    3629             :   NodeProperties::ChangeOp(node,
    3630         300 :                            machine()->Float64RoundTiesEven().placeholder());
    3631         300 : }
    3632             : 
    3633         186 : void SimplifiedLowering::DoSigned32ToUint8Clamped(Node* node) {
    3634             :   Node* const input = node->InputAt(0);
    3635          62 :   Node* const min = jsgraph()->Int32Constant(0);
    3636          62 :   Node* const max = jsgraph()->Int32Constant(255);
    3637             : 
    3638             :   node->ReplaceInput(
    3639         124 :       0, graph()->NewNode(machine()->Int32LessThanOrEqual(), input, max));
    3640             :   node->AppendInput(
    3641             :       graph()->zone(),
    3642             :       graph()->NewNode(common()->Select(MachineRepresentation::kWord32),
    3643             :                        graph()->NewNode(machine()->Int32LessThan(), input, min),
    3644         186 :                        min, input));
    3645          62 :   node->AppendInput(graph()->zone(), max);
    3646             :   NodeProperties::ChangeOp(node,
    3647          62 :                            common()->Select(MachineRepresentation::kWord32));
    3648          62 : }
    3649             : 
    3650         144 : void SimplifiedLowering::DoUnsigned32ToUint8Clamped(Node* node) {
    3651             :   Node* const input = node->InputAt(0);
    3652             :   Node* const max = jsgraph()->Uint32Constant(255u);
    3653             : 
    3654             :   node->ReplaceInput(
    3655         144 :       0, graph()->NewNode(machine()->Uint32LessThanOrEqual(), input, max));
    3656          72 :   node->AppendInput(graph()->zone(), input);
    3657          72 :   node->AppendInput(graph()->zone(), max);
    3658             :   NodeProperties::ChangeOp(node,
    3659          72 :                            common()->Select(MachineRepresentation::kWord32));
    3660          72 : }
    3661             : 
    3662        5872 : Node* SimplifiedLowering::ToNumberCode() {
    3663        2512 :   if (!to_number_code_.is_set()) {
    3664        1680 :     Callable callable = CodeFactory::ToNumber(isolate());
    3665        3360 :     to_number_code_.set(jsgraph()->HeapConstant(callable.code()));
    3666             :   }
    3667        2512 :   return to_number_code_.get();
    3668             : }
    3669             : 
    3670        4192 : Operator const* SimplifiedLowering::ToNumberOperator() {
    3671        2512 :   if (!to_number_operator_.is_set()) {
    3672        1680 :     Callable callable = CodeFactory::ToNumber(isolate());
    3673             :     CallDescriptor::Flags flags = CallDescriptor::kNeedsFrameState;
    3674             :     CallDescriptor* desc = Linkage::GetStubCallDescriptor(
    3675             :         isolate(), graph()->zone(), callable.descriptor(), 0, flags,
    3676        5040 :         Operator::kNoProperties);
    3677        1680 :     to_number_operator_.set(common()->Call(desc));
    3678             :   }
    3679        2512 :   return to_number_operator_.get();
    3680             : }
    3681             : 
    3682             : }  // namespace compiler
    3683             : }  // namespace internal
    3684             : }  // namespace v8

Generated by: LCOV version 1.10