Call JS functions via native context instead of js builtins object.

src/hydrogen.cc

 // Copyright 2013 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/hydrogen.h"
 
 #include <sstream>
 
 #include "src/allocation-site-scopes.h"
 #include "src/ast-numbering.h"
@@ skipping 1547 matching lines @@
           IfBuilder internalized(this);
           internalized.If<HCompareNumericAndBranch>(not_internalized_bit,
                                                     graph()->GetConstant0(),
                                                     Token::EQ);
           internalized.Then();
           Push(key);
 
           internalized.Else();
           Add<HPushArguments>(key);
           HValue* intern_key = Add<HCallRuntime>(
-              isolate()->factory()->empty_string(),
               Runtime::FunctionForId(Runtime::kInternalizeString), 1);
           Push(intern_key);
 
           internalized.End();
           // Key guaranteed to be a unique string
         }
         string_index_if.JoinContinuation(join_continuation);
       }
       not_symbol_if.Else();
       {
@@ skipping 137 matching lines @@
       Add<HLoadKeyed>(elements, key_index, nullptr, FAST_ELEMENTS);
   IfBuilder if_undefined(this);
   if_undefined.If<HCompareObjectEqAndBranch>(candidate_key,
                                              graph()->GetConstantUndefined());
   if_undefined.Then();
   {
     // element == undefined means "not found". Call the runtime.
     // TODO(jkummerow): walk the prototype chain instead.
     Add<HPushArguments>(receiver, key);
     Push(Add<HCallRuntime>(
-        isolate()->factory()->empty_string(),
         Runtime::FunctionForId(is_strong(language_mode)
                                    ? Runtime::kKeyedGetPropertyStrong
                                    : Runtime::kKeyedGetProperty),
         2));
   }
   if_undefined.Else();
   {
     IfBuilder if_match(this);
     if_match.If<HCompareObjectEqAndBranch>(candidate_key, key);
     if_match.Then();
@@ skipping 42 matching lines @@
     details_compare.If<HCompareNumericAndBranch>(
         details, graph()->GetConstant0(), Token::EQ);
     details_compare.Then();
     HValue* result_index =
         AddUncasted<HAdd>(base_index, Add<HConstant>(start_offset + 1));
     result_index->ClearFlag(HValue::kCanOverflow);
     Push(Add<HLoadKeyed>(elements, result_index, nullptr, FAST_ELEMENTS));
     details_compare.Else();
     Add<HPushArguments>(receiver, key);
     Push(Add<HCallRuntime>(
-        isolate()->factory()->empty_string(),
         Runtime::FunctionForId(is_strong(language_mode)
                                    ? Runtime::kKeyedGetPropertyStrong
                                    : Runtime::kKeyedGetProperty),
         2));
     details_compare.End();
 
     found_key_match.Else();
     found_key_match.JoinContinuation(&return_or_loop_continuation);
   }
   if_undefined.JoinContinuation(&return_or_loop_continuation);
@@ skipping 213 matching lines @@
     HValue* key_index = Pop();
     HValue* value_index = AddUncasted<HAdd>(key_index, graph()->GetConstant1());
     Push(Add<HLoadKeyed>(number_string_cache, value_index, nullptr,
                          FAST_ELEMENTS, ALLOW_RETURN_HOLE));
   }
   if_found.Else();
   {
     // Cache miss, fallback to runtime.
     Add<HPushArguments>(object);
     Push(Add<HCallRuntime>(
-            isolate()->factory()->empty_string(),
             Runtime::FunctionForId(Runtime::kNumberToStringSkipCache),
             1));
   }
   if_found.End();
 
   return Pop();
 }
 
 
 HValue* HGraphBuilder::BuildToObject(HValue* receiver) {
@@ skipping 395 matching lines @@
       // Count the native string addition.
       AddIncrementCounter(isolate()->counters()->string_add_native());
 
       // Return the sequential string.
       Push(result);
     }
     if_sameencodingandsequential.Else();
     {
       // Fallback to the runtime to add the two strings.
       Add<HPushArguments>(left, right);
-      Push(Add<HCallRuntime>(isolate()->factory()->empty_string(),
-                             Runtime::FunctionForId(Runtime::kStringAdd), 2));
+      Push(Add<HCallRuntime>(Runtime::FunctionForId(Runtime::kStringAdd), 2));
     }
     if_sameencodingandsequential.End();
   }
   if_createcons.End();
 
   return Pop();
 }
 
 
 HValue* HGraphBuilder::BuildStringAdd(
@@ skipping 2841 matching lines @@
     Add<HSimulate>(stmt->PrepareId());
     {
       NoObservableSideEffectsScope no_effects(this);
       BuildJSObjectCheck(enumerable, 0);
     }
     Add<HSimulate>(stmt->ToObjectId());
 
     map = graph()->GetConstant1();
     Runtime::FunctionId function_id = Runtime::kGetPropertyNamesFast;
     Add<HPushArguments>(enumerable);
-    array = Add<HCallRuntime>(isolate()->factory()->empty_string(),
-                              Runtime::FunctionForId(function_id), 1);
+    array = Add<HCallRuntime>(Runtime::FunctionForId(function_id), 1);
     Push(array);
     Add<HSimulate>(stmt->EnumId());
     Drop(1);
     Handle<Map> array_map = isolate()->factory()->fixed_array_map();
     HValue* check = Add<HCheckMaps>(array, array_map);
     enum_length = AddLoadFixedArrayLength(array, check);
   }
 
   HInstruction* start_index = Add<HConstant>(0);
 
@@ skipping 34 matching lines @@
                       index, index, FAST_ELEMENTS);
 
   if (fast) {
     // Check if the expected map still matches that of the enumerable.
     // If not just deoptimize.
     Add<HCheckMapValue>(enumerable, environment()->ExpressionStackAt(3));
     Bind(each_var, key);
   } else {
     Add<HPushArguments>(enumerable, key);
     Runtime::FunctionId function_id = Runtime::kForInFilter;
-    key = Add<HCallRuntime>(isolate()->factory()->empty_string(),
-                            Runtime::FunctionForId(function_id), 2);
+    key = Add<HCallRuntime>(Runtime::FunctionForId(function_id), 2);
     Push(key);
     Add<HSimulate>(stmt->FilterId());
     key = Pop();
     Bind(each_var, key);
     IfBuilder if_undefined(this);
     if_undefined.If<HCompareObjectEqAndBranch>(key,
                                                graph()->GetConstantUndefined());
     if_undefined.ThenDeopt(Deoptimizer::kUndefined);
     if_undefined.End();
     Add<HSimulate>(stmt->AssignmentId());
@@ skipping 463 matching lines @@
     Handle<FixedArray> constant_properties = expr->constant_properties();
     int literal_index = expr->literal_index();
     int flags = expr->ComputeFlags(true);
 
     Add<HPushArguments>(Add<HConstant>(closure_literals),
                         Add<HConstant>(literal_index),
                         Add<HConstant>(constant_properties),
                         Add<HConstant>(flags));
 
     Runtime::FunctionId function_id = Runtime::kCreateObjectLiteral;
-    literal = Add<HCallRuntime>(isolate()->factory()->empty_string(),
-                                Runtime::FunctionForId(function_id),
-                                4);
+    literal = Add<HCallRuntime>(Runtime::FunctionForId(function_id), 4);
   }
 
   // The object is expected in the bailout environment during computation
   // of the property values and is the value of the entire expression.
   Push(literal);
   int store_slot_index = 0;
   for (int i = 0; i < expr->properties()->length(); i++) {
     ObjectLiteral::Property* property = expr->properties()->at(i);
     if (property->is_computed_name()) return Bailout(kComputedPropertyName);
     if (property->IsCompileTimeValue()) continue;
@@ skipping 148 matching lines @@
     Handle<FixedArray> constants = isolate()->factory()->empty_fixed_array();
     int literal_index = expr->literal_index();
     int flags = expr->ComputeFlags(true);
 
     Add<HPushArguments>(Add<HConstant>(literals),
                         Add<HConstant>(literal_index),
                         Add<HConstant>(constants),
                         Add<HConstant>(flags));
 
     Runtime::FunctionId function_id = Runtime::kCreateArrayLiteral;
-    literal = Add<HCallRuntime>(isolate()->factory()->empty_string(),
-                                Runtime::FunctionForId(function_id),
-                                4);
+    literal = Add<HCallRuntime>(Runtime::FunctionForId(function_id), 4);
 
     // Register to deopt if the boilerplate ElementsKind changes.
     top_info()->dependencies()->AssumeTransitionStable(site);
   }
 
   // The array is expected in the bailout environment during computation
   // of the property values and is the value of the entire expression.
   Push(literal);
   // The literal index is on the stack, too.
   Push(Add<HConstant>(expr->literal_index()));
@@ skipping 468 matching lines @@
   HValue* checked_holder = checked_object;
   if (info->has_holder()) {
     Handle<JSObject> prototype(JSObject::cast(info->map()->prototype()));
     checked_holder = BuildCheckPrototypeMaps(prototype, info->holder());
   }
 
   if (!info->IsFound()) {
     DCHECK(info->IsLoad());
     if (is_strong(function_language_mode())) {
       return New<HCallRuntime>(
-          isolate()->factory()->empty_string(),
           Runtime::FunctionForId(Runtime::kThrowStrongModeImplicitConversion),
           0);
     } else {
       return graph()->GetConstantUndefined();
     }
   }
 
   if (info->IsData()) {
     if (info->IsLoad()) {
       return BuildLoadNamedField(info, checked_holder);
@@ skipping 635 matching lines @@
     // The parser turns invalid left-hand sides in assignments into throw
     // statements, which may not be in effect contexts. We might still try
     // to optimize such functions; bail out now if we do.
     return Bailout(kInvalidLeftHandSideInAssignment);
   }
   CHECK_ALIVE(VisitForValue(expr->exception()));
 
   HValue* value = environment()->Pop();
   if (!top_info()->is_tracking_positions()) SetSourcePosition(expr->position());
   Add<HPushArguments>(value);
-  Add<HCallRuntime>(isolate()->factory()->empty_string(),
-                    Runtime::FunctionForId(Runtime::kThrow), 1);
+  Add<HCallRuntime>(Runtime::FunctionForId(Runtime::kThrow), 1);
   Add<HSimulate>(expr->id());
 
   // If the throw definitely exits the function, we can finish with a dummy
   // control flow at this point.  This is not the case if the throw is inside
   // an inlined function which may be replaced.
   if (call_context() == NULL) {
     FinishExitCurrentBlock(New<HAbnormalExit>());
   }
 }
 
@@ skipping 3104 matching lines @@
   if (!is_zero_byte_offset) {
     byte_offset_smi.Else();
     { //  byte_offset is not Smi.
       Push(obj);
       CHECK_ALIVE(VisitForValue(arguments->at(kArrayIdArg)));
       Push(buffer);
       Push(byte_offset);
       Push(byte_length);
       CHECK_ALIVE(VisitForValue(arguments->at(kInitializeArg)));
       PushArgumentsFromEnvironment(kArgsLength);
-      Add<HCallRuntime>(expr->name(), expr->function(), kArgsLength);
+      Add<HCallRuntime>(expr->function(), kArgsLength);
     }
   }
   byte_offset_smi.End();
 }
 
 
 void HOptimizedGraphBuilder::GenerateMaxSmi(CallRuntime* expr) {
   DCHECK(expr->arguments()->length() == 0);
   HConstant* max_smi = New<HConstant>(static_cast<int32_t>(Smi::kMaxValue));
   return ast_context()->ReturnInstruction(max_smi, expr->id());
@@ skipping 70 matching lines @@
   const Runtime::Function* function = expr->function();
   DCHECK(function != NULL);
   switch (function->function_id) {
 #define CALL_INTRINSIC_GENERATOR(Name) \
   case Runtime::kInline##Name:         \
     return Generate##Name(expr);
 
     FOR_EACH_HYDROGEN_INTRINSIC(CALL_INTRINSIC_GENERATOR)
 #undef CALL_INTRINSIC_GENERATOR
     default: {
-      Handle<String> name = expr->name();
       int argument_count = expr->arguments()->length();
       CHECK_ALIVE(VisitExpressions(expr->arguments()));
       PushArgumentsFromEnvironment(argument_count);
-      HCallRuntime* call = New<HCallRuntime>(name, function, argument_count);
+      HCallRuntime* call = New<HCallRuntime>(function, argument_count);
       return ast_context()->ReturnInstruction(call, expr->id());
     }
   }
 }
 
 
 void HOptimizedGraphBuilder::VisitUnaryOperation(UnaryOperation* expr) {
   DCHECK(!HasStackOverflow());
   DCHECK(current_block() != NULL);
   DCHECK(current_block()->HasPredecessor());
@@ skipping 10 matching lines @@
 void HOptimizedGraphBuilder::VisitDelete(UnaryOperation* expr) {
   Property* prop = expr->expression()->AsProperty();
   VariableProxy* proxy = expr->expression()->AsVariableProxy();
   if (prop != NULL) {
     CHECK_ALIVE(VisitForValue(prop->obj()));
     CHECK_ALIVE(VisitForValue(prop->key()));
     HValue* key = Pop();
     HValue* obj = Pop();
     Add<HPushArguments>(obj, key);
     HInstruction* instr = New<HCallRuntime>(
-        isolate()->factory()->empty_string(),
         Runtime::FunctionForId(is_strict(function_language_mode())
                                    ? Runtime::kDeleteProperty_Strict
                                    : Runtime::kDeleteProperty_Sloppy),
         2);
     return ast_context()->ReturnInstruction(instr, expr->id());
   } else if (proxy != NULL) {
     Variable* var = proxy->var();
     if (var->IsUnallocatedOrGlobalSlot()) {
       Bailout(kDeleteWithGlobalVariable);
     } else if (var->IsStackAllocated() || var->IsContextSlot()) {
@@ skipping 586 matching lines @@
   } else {
     if (is_strong(strength) && Token::IsBitOp(op)) {
       // TODO(conradw): This is not efficient, but is necessary to prevent
       // conversion of oddball values to numbers in strong mode. It would be
       // better to prevent the conversion rather than adding a runtime check.
       IfBuilder if_builder(this);
       if_builder.If<HHasInstanceTypeAndBranch>(left, ODDBALL_TYPE);
       if_builder.OrIf<HHasInstanceTypeAndBranch>(right, ODDBALL_TYPE);
       if_builder.Then();
       Add<HCallRuntime>(
-          isolate()->factory()->empty_string(),
           Runtime::FunctionForId(Runtime::kThrowStrongModeImplicitConversion),
           0);
       if (!graph()->info()->IsStub()) {
         Add<HSimulate>(opt_id, REMOVABLE_SIMULATE);
       }
       if_builder.End();
     }
     switch (op) {
       case Token::ADD:
         instr = AddUncasted<HAdd>(left, right, strength);
@@ skipping 77 matching lines @@
 
 
 // Check for the form (%_ClassOf(foo) === 'BarClass').
 static bool IsClassOfTest(CompareOperation* expr) {
   if (expr->op() != Token::EQ_STRICT) return false;
   CallRuntime* call = expr->left()->AsCallRuntime();
   if (call == NULL) return false;
   Literal* literal = expr->right()->AsLiteral();
   if (literal == NULL) return false;
   if (!literal->value()->IsString()) return false;
-  if (!call->name()->IsOneByteEqualTo(STATIC_CHAR_VECTOR("_ClassOf"))) {
-    return false;
-  }
+  if (call->function()->function_id != Runtime::kInlineClassOf) return false;

[Michael Starzinger, 2015/08/26 09:43:21]

Is "call" guaranteed to point to a runtime function here or do we need a
"!call->is_jsruntime()" here to guard that? Because ClusterFuzz will find that
one for sure. :)

[Yang, 2015/08/26 10:27:30]

Done.

   DCHECK(call->arguments()->length() == 1);
   return true;
 }
 
 
 void HOptimizedGraphBuilder::VisitBinaryOperation(BinaryOperation* expr) {
   DCHECK(!HasStackOverflow());
   DCHECK(current_block() != NULL);
   DCHECK(current_block()->HasPredecessor());
   switch (expr->op()) {
@@ skipping 1656 matching lines @@
   {
     IfBuilder needs_runtime(this);
     needs_runtime.If<HCompareNumericAndBranch>(
         is_access_check_needed_test, graph()->GetConstant0(), Token::NE);
     needs_runtime.OrIf<HCompareNumericAndBranch>(
         is_hidden_prototype_test, graph()->GetConstant0(), Token::NE);
 
     needs_runtime.Then();
     {
       Add<HPushArguments>(object);
-      Push(Add<HCallRuntime>(
-          call->name(), Runtime::FunctionForId(Runtime::kGetPrototype), 1));
+      Push(
+          Add<HCallRuntime>(Runtime::FunctionForId(Runtime::kGetPrototype), 1));
     }
 
     needs_runtime.Else();
     Push(proto);
   }
   return ast_context()->ReturnValue(Pop());
 }
 
 
 #undef CHECK_BAILOUT
@@ skipping 623 matching lines @@
     isolate()->GetHTracer()->TraceHydrogen(name(), graph_);
   }
 
 #ifdef DEBUG
   graph_->Verify(false);  // No full verify.
 #endif
 }
 
 }  // namespace internal
 }  // namespace v8