1 files changed, 63 insertions, 37 deletions

diff --git a/deps/v8/src/compiler/simplified-lowering.cc b/deps/v8/src/compiler/simplified-lowering.cc
index d0f952a9ec..1691f1618f 100644
--- a/deps/v8/src/compiler/simplified-lowering.cc
+++ b/deps/v8/src/compiler/simplified-lowering.cc
@@ -1073,6 +1073,51 @@ class RepresentationSelector {
     SetOutput(node, MachineRepresentation::kTagged);
   }
 
+  void VisitFrameState(Node* node) {
+    DCHECK_EQ(5, node->op()->ValueInputCount());
+    DCHECK_EQ(1, OperatorProperties::GetFrameStateInputCount(node->op()));
+
+    ProcessInput(node, 0, UseInfo::AnyTagged());  // Parameters.
+    ProcessInput(node, 1, UseInfo::AnyTagged());  // Registers.
+
+    // Expression stack/accumulator.
+    if (node->InputAt(2)->opcode() == IrOpcode::kStateValues ||
+        node->InputAt(2)->opcode() == IrOpcode::kTypedStateValues) {
+      // TODO(turbofan): This should only be produced by AST graph builder.
+      // Remove once we switch to bytecode graph builder exclusively.
+      ProcessInput(node, 2, UseInfo::AnyTagged());
+    } else {
+      // Accumulator is a special flower - we need to remember its type in
+      // a singleton typed-state-values node (as if it was a singleton
+      // state-values node).
+      if (propagate()) {
+        EnqueueInput(node, 2, UseInfo::Any());
+      } else if (lower()) {
+        Zone* zone = jsgraph_->zone();
+        Node* accumulator = node->InputAt(2);
+        if (accumulator == jsgraph_->OptimizedOutConstant()) {
+          node->ReplaceInput(2, jsgraph_->SingleDeadTypedStateValues());
+        } else {
+          ZoneVector<MachineType>* types =
+              new (zone->New(sizeof(ZoneVector<MachineType>)))
+                  ZoneVector<MachineType>(1, zone);
+          (*types)[0] = DeoptMachineTypeOf(
+              GetInfo(accumulator)->representation(), TypeOf(accumulator));
+
+          node->ReplaceInput(2, jsgraph_->graph()->NewNode(
+                                    jsgraph_->common()->TypedStateValues(
+                                        types, SparseInputMask::Dense()),
+                                    accumulator));
+        }
+      }
+    }
+
+    ProcessInput(node, 3, UseInfo::AnyTagged());  // Context.
+    ProcessInput(node, 4, UseInfo::AnyTagged());  // Closure.
+    ProcessInput(node, 5, UseInfo::AnyTagged());  // Outer frame state.
+    return SetOutput(node, MachineRepresentation::kTagged);
+  }
+
   void VisitObjectState(Node* node) {
     if (propagate()) {
       for (int i = 0; i < node->InputCount(); i++) {
@@ -1402,30 +1447,6 @@ class RepresentationSelector {
     return;
   }
 
-  void VisitOsrGuard(Node* node) {
-    VisitInputs(node);
-
-    // Insert a dynamic check for the OSR value type if necessary.
-    switch (OsrGuardTypeOf(node->op())) {
-      case OsrGuardType::kUninitialized:
-        // At this point, we should always have a type for the OsrValue.
-        UNREACHABLE();
-        break;
-      case OsrGuardType::kSignedSmall:
-        if (lower()) {
-          NodeProperties::ChangeOp(node,
-                                   simplified()->CheckedTaggedToTaggedSigned());
-        }
-        return SetOutput(node, MachineRepresentation::kTaggedSigned);
-      case OsrGuardType::kAny:  // Nothing to check.
-        if (lower()) {
-          DeferReplacement(node, node->InputAt(0));
-        }
-        return SetOutput(node, MachineRepresentation::kTagged);
-    }
-    UNREACHABLE();
-  }
-
   // Dispatching routine for visiting the node {node} with the usage {use}.
   // Depending on the operator, propagate new usage info to the inputs.
   void VisitNode(Node* node, Truncation truncation,
@@ -1531,11 +1552,14 @@ class RepresentationSelector {
             // BooleanNot(x: kRepBit) => Word32Equal(x, #0)
             node->AppendInput(jsgraph_->zone(), jsgraph_->Int32Constant(0));
             NodeProperties::ChangeOp(node, lowering->machine()->Word32Equal());
-          } else {
-            DCHECK(CanBeTaggedPointer(input_info->representation()));
+          } else if (CanBeTaggedPointer(input_info->representation())) {
             // BooleanNot(x: kRepTagged) => WordEqual(x, #false)
             node->AppendInput(jsgraph_->zone(), jsgraph_->FalseConstant());
             NodeProperties::ChangeOp(node, lowering->machine()->WordEqual());
+          } else {
+            DCHECK_EQ(MachineRepresentation::kNone,
+                      input_info->representation());
+            DeferReplacement(node, lowering->jsgraph()->Int32Constant(0));
           }
         } else {
           // No input representation requirement; adapt during lowering.
@@ -2700,11 +2724,7 @@ class RepresentationSelector {
           switch (mode) {
             case CheckFloat64HoleMode::kAllowReturnHole:
               if (truncation.IsUnused()) return VisitUnused(node);
-              if (truncation.IsUsedAsWord32()) {
-                VisitUnop(node, UseInfo::TruncatingWord32(),
-                          MachineRepresentation::kWord32);
-                if (lower()) DeferReplacement(node, node->InputAt(0));
-              } else if (truncation.IsUsedAsFloat64()) {
+              if (truncation.IsUsedAsFloat64()) {
                 VisitUnop(node, UseInfo::TruncatingFloat64(),
                           MachineRepresentation::kFloat64);
                 if (lower()) DeferReplacement(node, node->InputAt(0));
@@ -2775,6 +2795,8 @@ class RepresentationSelector {
                   MachineRepresentation::kFloat64);
         if (lower()) NodeProperties::ChangeOp(node, Float64Op(node));
         return;
+      case IrOpcode::kFrameState:
+        return VisitFrameState(node);
       case IrOpcode::kStateValues:
         return VisitStateValues(node);
       case IrOpcode::kObjectState:
@@ -2783,16 +2805,19 @@ class RepresentationSelector {
         // We just get rid of the sigma here. In principle, it should be
         // possible to refine the truncation and representation based on
         // the sigma's type.
-        MachineRepresentation output =
+        MachineRepresentation representation =
             GetOutputInfoForPhi(node, TypeOf(node->InputAt(0)), truncation);
-        VisitUnop(node, UseInfo(output, truncation), output);
+
+        // For now, we just handle specially the impossible case.
+        MachineRepresentation output = TypeOf(node)->IsInhabited()
+                                           ? representation
+                                           : MachineRepresentation::kNone;
+
+        VisitUnop(node, UseInfo(representation, truncation), output);
         if (lower()) DeferReplacement(node, node->InputAt(0));
         return;
       }
 
-      case IrOpcode::kOsrGuard:
-        return VisitOsrGuard(node);
-
       case IrOpcode::kFinishRegion:
         VisitInputs(node);
         // Assume the output is tagged pointer.
@@ -2810,10 +2835,11 @@ class RepresentationSelector {
       case IrOpcode::kIfException:
       case IrOpcode::kIfTrue:
       case IrOpcode::kIfFalse:
+      case IrOpcode::kIfValue:
+      case IrOpcode::kIfDefault:
       case IrOpcode::kDeoptimize:
       case IrOpcode::kEffectPhi:
       case IrOpcode::kTerminate:
-      case IrOpcode::kFrameState:
       case IrOpcode::kCheckpoint:
       case IrOpcode::kLoop:
       case IrOpcode::kMerge: