[turbofan] Lower unmapped arguments objects in inline frame.

src/compiler/js-typed-lowering.cc

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/code-factory.h"
 #include "src/compiler/access-builder.h"
 #include "src/compiler/js-graph.h"
 #include "src/compiler/js-typed-lowering.h"
 #include "src/compiler/linkage.h"
 #include "src/compiler/node-matchers.h"
 #include "src/compiler/node-properties.h"
 #include "src/compiler/operator-properties.h"
+#include "src/compiler/state-values-utils.h"
 #include "src/types.h"
 
 namespace v8 {
 namespace internal {
 namespace compiler {
 
 // TODO(turbofan): js-typed-lowering improvements possible
 // - immediately put in type bounds for all new nodes
 // - relax effects from generic but not-side-effecting operations
 
 
 JSTypedLowering::JSTypedLowering(Editor* editor, JSGraph* jsgraph, Zone* zone)
     : AdvancedReducer(editor), jsgraph_(jsgraph) {
   for (size_t k = 0; k < arraysize(shifted_int32_ranges_); ++k) {
     double min = kMinInt / (1 << k);
     double max = kMaxInt / (1 << k);
     shifted_int32_ranges_[k] = Type::Range(min, max, graph()->zone());
   }
 }
 
 
 // A helper class to construct inline allocations on the simplified operator
 // level. This keeps track of the effect chain for initial stores on a newly
 // allocated object and also provides helpers for commonly allocated objects.
 class AllocationBuilder final {
  public:
-  AllocationBuilder(JSGraph* jsgraph, SimplifiedOperatorBuilder* simplified,
-                    Node* effect, Node* control)
+  AllocationBuilder(JSGraph* jsgraph, Node* effect, Node* control)
       : jsgraph_(jsgraph),
-        simplified_(simplified),
         allocation_(nullptr),
         effect_(effect),
         control_(control) {}
 
   // Primitive allocation of static size.
   void Allocate(int size) {
-    effect_ = graph()->NewNode(jsgraph()->common()->BeginRegion(), effect_);
+    effect_ = graph()->NewNode(common()->BeginRegion(), effect_);
     allocation_ = graph()->NewNode(
         simplified()->Allocate(), jsgraph()->Constant(size), effect_, control_);
     effect_ = allocation_;
   }
 
   // Primitive store into a field.
   void Store(const FieldAccess& access, Node* value) {
     effect_ = graph()->NewNode(simplified()->StoreField(access), allocation_,
                                value, effect_, control_);
   }
 
   // Compound allocation of a FixedArray.
   void AllocateArray(int length, Handle<Map> map) {
     Allocate(FixedArray::SizeFor(length));
     Store(AccessBuilder::ForMap(), map);
     Store(AccessBuilder::ForFixedArrayLength(graph()->zone()),
           jsgraph()->Constant(length));
   }
 
   // Compound store of a constant into a field.
   void Store(const FieldAccess& access, Handle<Object> value) {
     Store(access, jsgraph()->Constant(value));
   }
 
-  void Finish(Node* node) {
+  void FinishAndChange(Node* node) {
     NodeProperties::SetType(allocation_, NodeProperties::GetType(node));
     node->ReplaceInput(0, allocation_);
     node->ReplaceInput(1, effect_);
     node->TrimInputCount(2);
-    NodeProperties::ChangeOp(node, jsgraph()->common()->FinishRegion());
+    NodeProperties::ChangeOp(node, common()->FinishRegion());
+  }
+
+  Node* Finish() {
+    return graph()->NewNode(common()->FinishRegion(), allocation_, effect_);
   }
 
  protected:
   JSGraph* jsgraph() { return jsgraph_; }
   Graph* graph() { return jsgraph_->graph(); }
-  SimplifiedOperatorBuilder* simplified() { return simplified_; }
+  CommonOperatorBuilder* common() { return jsgraph_->common(); }
+  SimplifiedOperatorBuilder* simplified() { return jsgraph_->simplified(); }
 
  private:
   JSGraph* const jsgraph_;
-  SimplifiedOperatorBuilder* simplified_;
   Node* allocation_;
   Node* effect_;
   Node* control_;
 };
 
 
 // A helper class to simplify the process of reducing a single binop node with a
 // JSOperator. This class manages the rewriting of context, control, and effect
 // dependencies during lowering of a binop and contains numerous helper
 // functions for matching the types of inputs to an operation.
@@ skipping 1052 matching lines @@
     Node* parameter_pointer = graph()->NewNode(
         machine()->IntAdd(), graph()->NewNode(machine()->LoadFramePointer()),
         jsgraph()->IntPtrConstant(offset));
     node->InsertInput(graph()->zone(), 0, stub_code);
     node->InsertInput(graph()->zone(), 2, jsgraph()->Constant(parameter_count));
     node->InsertInput(graph()->zone(), 3, parameter_pointer);
     NodeProperties::ChangeOp(node, new_op);
     return Changed(node);
   }
 
+  // Use inline allocation for all unmapped arguments objects within inlined
+  // (i.e. non-outermost) frames, independent of the object size.
+  if (p.type() == CreateArgumentsParameters::kUnmappedArguments &&
+      outer_state->opcode() == IrOpcode::kFrameState) {
+    Node* const effect = NodeProperties::GetEffectInput(node);
+    Node* const control = NodeProperties::GetControlInput(node);
+    Node* const context = NodeProperties::GetContextInput(node);
+    FrameStateInfo outer_state_info = OpParameter<FrameStateInfo>(outer_state);
+    // Choose the correct frame state and frame state info depending on whether
+    // there conceptually is an arguments adaptor frame in the call chain.
+    Node* const args_state =
+        outer_state_info.type() == FrameStateType::kArgumentsAdaptor
+            ? outer_state
+            : frame_state;
+    FrameStateInfo args_state_info = OpParameter<FrameStateInfo>(args_state);
+    // Prepare element backing store to be used by arguments object.
+    Node* const elements = AllocateArguments(effect, control, args_state);
+    // Load the arguments object map from the current native context.
+    Node* const load_global_object = graph()->NewNode(
+        simplified()->LoadField(
+            AccessBuilder::ForContextSlot(Context::GLOBAL_OBJECT_INDEX)),
+        context, effect, control);
+    Node* const load_native_context = graph()->NewNode(
+        simplified()->LoadField(AccessBuilder::ForGlobalObjectNativeContext()),
+        load_global_object, effect, control);
+    Node* const load_arguments_map = graph()->NewNode(
+        simplified()->LoadField(
+            AccessBuilder::ForContextSlot(Context::STRICT_ARGUMENTS_MAP_INDEX)),
+        load_native_context, effect, control);
+    // Actually allocate and initialize the arguments object.
+    AllocationBuilder a(jsgraph(), effect, control);
+    Handle<Object> properties = factory()->empty_fixed_array();
+    int length = args_state_info.parameter_count() - 1;  // Minus receiver.
+    STATIC_ASSERT(Heap::kStrictArgumentsObjectSize == 4 * kPointerSize);
+    a.Allocate(Heap::kStrictArgumentsObjectSize);
+    a.Store(AccessBuilder::ForMap(), load_arguments_map);
+    a.Store(AccessBuilder::ForJSObjectProperties(), properties);
+    a.Store(AccessBuilder::ForJSObjectElements(), elements);
+    a.Store(AccessBuilder::ForArgumentsLength(), jsgraph()->Constant(length));
+    RelaxControls(node);
+    a.FinishAndChange(node);
+    return Changed(node);
+  }
+
   return NoChange();
 }
 
 
 Reduction JSTypedLowering::ReduceJSCreateClosure(Node* node) {
   DCHECK_EQ(IrOpcode::kJSCreateClosure, node->opcode());
   CreateClosureParameters const& p = CreateClosureParametersOf(node->op());
   Handle<SharedFunctionInfo> shared = p.shared_info();
 
   // Use the FastNewClosureStub that allocates in new space only for nested
@@ skipping 91 matching lines @@
       closure->opcode() != IrOpcode::kNumberConstant) {
     // JSCreateFunctionContext[slot_count < limit]](fun)
     Node* const effect = NodeProperties::GetEffectInput(node);
     Node* const control = NodeProperties::GetControlInput(node);
     Node* const context = NodeProperties::GetContextInput(node);
     Node* const extension = jsgraph()->ZeroConstant();
     Node* const load = graph()->NewNode(
         simplified()->LoadField(
             AccessBuilder::ForContextSlot(Context::GLOBAL_OBJECT_INDEX)),
         context, effect, control);
-    AllocationBuilder a(jsgraph(), simplified(), effect, control);
+    AllocationBuilder a(jsgraph(), effect, control);
     STATIC_ASSERT(Context::MIN_CONTEXT_SLOTS == 4);  // Ensure fully covered.
     int context_length = slot_count + Context::MIN_CONTEXT_SLOTS;
     a.AllocateArray(context_length, factory()->function_context_map());
     a.Store(AccessBuilder::ForContextSlot(Context::CLOSURE_INDEX), closure);
     a.Store(AccessBuilder::ForContextSlot(Context::PREVIOUS_INDEX), context);
     a.Store(AccessBuilder::ForContextSlot(Context::EXTENSION_INDEX), extension);
     a.Store(AccessBuilder::ForContextSlot(Context::GLOBAL_OBJECT_INDEX), load);
     for (int i = Context::MIN_CONTEXT_SLOTS; i < context_length; ++i) {
       a.Store(AccessBuilder::ForContextSlot(i), jsgraph()->UndefinedConstant());
     }
     RelaxControls(node);
-    a.Finish(node);
+    a.FinishAndChange(node);
     return Changed(node);
   }
 
   // Use the FastNewContextStub only for function contexts up maximum size.
   if (slot_count <= FastNewContextStub::kMaximumSlots) {
     Isolate* isolate = jsgraph()->isolate();
     Callable callable = CodeFactory::FastNewContext(isolate, slot_count);
     CallDescriptor* desc = Linkage::GetStubCallDescriptor(
         isolate, graph()->zone(), callable.descriptor(), 0,
         CallDescriptor::kNoFlags);
@@ skipping 22 matching lines @@
   if (input_type->Is(Type::Receiver()) &&
       closure->opcode() != IrOpcode::kNumberConstant) {
     // JSCreateWithContext(o:receiver, fun)
     Node* const effect = NodeProperties::GetEffectInput(node);
     Node* const control = NodeProperties::GetControlInput(node);
     Node* const context = NodeProperties::GetContextInput(node);
     Node* const load = graph()->NewNode(
         simplified()->LoadField(
             AccessBuilder::ForContextSlot(Context::GLOBAL_OBJECT_INDEX)),
         context, effect, control);
-    AllocationBuilder a(jsgraph(), simplified(), effect, control);
+    AllocationBuilder a(jsgraph(), effect, control);
     STATIC_ASSERT(Context::MIN_CONTEXT_SLOTS == 4);  // Ensure fully covered.
     a.AllocateArray(Context::MIN_CONTEXT_SLOTS, factory()->with_context_map());
     a.Store(AccessBuilder::ForContextSlot(Context::CLOSURE_INDEX), closure);
     a.Store(AccessBuilder::ForContextSlot(Context::PREVIOUS_INDEX), context);
     a.Store(AccessBuilder::ForContextSlot(Context::EXTENSION_INDEX), input);
     a.Store(AccessBuilder::ForContextSlot(Context::GLOBAL_OBJECT_INDEX), load);
     RelaxControls(node);
-    a.Finish(node);
+    a.FinishAndChange(node);
     return Changed(node);
   }
 
   return NoChange();
 }
 
 
 Reduction JSTypedLowering::ReduceJSCreateBlockContext(Node* node) {
   DCHECK_EQ(IrOpcode::kJSCreateBlockContext, node->opcode());
   Handle<ScopeInfo> scope_info = OpParameter<Handle<ScopeInfo>>(node);
   int context_length = scope_info->ContextLength();
   Node* const closure = NodeProperties::GetValueInput(node, 0);
 
   // The closure can be NumberConstant(0) if the closure is global code
   // (rather than a function). We exclude that case here.
   // TODO(jarin) Find a better way to check that the closure is a function.
 
   // Use inline allocation for block contexts up to a size limit.
   if (context_length < kBlockContextAllocationLimit &&
       closure->opcode() != IrOpcode::kNumberConstant) {
     // JSCreateBlockContext[scope[length < limit]](fun)
     Node* const effect = NodeProperties::GetEffectInput(node);
     Node* const control = NodeProperties::GetControlInput(node);
     Node* const context = NodeProperties::GetContextInput(node);
     Node* const extension = jsgraph()->Constant(scope_info);
     Node* const load = graph()->NewNode(
         simplified()->LoadField(
             AccessBuilder::ForContextSlot(Context::GLOBAL_OBJECT_INDEX)),
         context, effect, control);
-    AllocationBuilder a(jsgraph(), simplified(), effect, control);
+    AllocationBuilder a(jsgraph(), effect, control);
     STATIC_ASSERT(Context::MIN_CONTEXT_SLOTS == 4);  // Ensure fully covered.
     a.AllocateArray(context_length, factory()->block_context_map());
     a.Store(AccessBuilder::ForContextSlot(Context::CLOSURE_INDEX), closure);
     a.Store(AccessBuilder::ForContextSlot(Context::PREVIOUS_INDEX), context);
     a.Store(AccessBuilder::ForContextSlot(Context::EXTENSION_INDEX), extension);
     a.Store(AccessBuilder::ForContextSlot(Context::GLOBAL_OBJECT_INDEX), load);
     for (int i = Context::MIN_CONTEXT_SLOTS; i < context_length; ++i) {
       a.Store(AccessBuilder::ForContextSlot(i), jsgraph()->TheHoleConstant());
     }
     RelaxControls(node);
-    a.Finish(node);
+    a.FinishAndChange(node);
     return Changed(node);
   }
 
   return NoChange();
 }
 
 
 Reduction JSTypedLowering::ReduceJSCallFunction(Node* node) {
   DCHECK_EQ(IrOpcode::kJSCallFunction, node->opcode());
   CallFunctionParameters const& p = CallFunctionParametersOf(node->op());
@@ skipping 418 matching lines @@
 }
 
 
 Node* JSTypedLowering::Word32Shl(Node* const lhs, int32_t const rhs) {
   if (rhs == 0) return lhs;
   return graph()->NewNode(machine()->Word32Shl(), lhs,
                           jsgraph()->Int32Constant(rhs));
 }
 
 
+// Helper that allocates a FixedArray holding argument values recorded in the
+// given {frame_state}. Serves as backing store for JSCreateArguments nodes.
+Node* JSTypedLowering::AllocateArguments(Node* effect, Node* control,
+                                         Node* frame_state) {
+  FrameStateInfo state_info = OpParameter<FrameStateInfo>(frame_state);
+  int length = state_info.parameter_count() - 1;  // Minus receiver argument.
+  if (length == 0) return jsgraph()->Constant(factory()->empty_fixed_array());
+  Node* const parameters = frame_state->InputAt(kFrameStateParametersInput);
+  StateValuesAccess parameters_access(parameters);
+  auto paratemers_it = ++parameters_access.begin();
+  AllocationBuilder a(jsgraph(), effect, control);
+  a.AllocateArray(length, factory()->fixed_array_map());
+  for (int i = 0; i < length; ++i, ++paratemers_it) {
+    a.Store(AccessBuilder::ForFixedArraySlot(i), (*paratemers_it).node);
+  }
+  return a.Finish();
+}
+
+
 Factory* JSTypedLowering::factory() const { return jsgraph()->factory(); }
 
 
 Graph* JSTypedLowering::graph() const { return jsgraph()->graph(); }
 
 
 Isolate* JSTypedLowering::isolate() const { return jsgraph()->isolate(); }
 
 
 JSOperatorBuilder* JSTypedLowering::javascript() const {
@@ skipping 11 matching lines @@
 }
 
 
 MachineOperatorBuilder* JSTypedLowering::machine() const {
   return jsgraph()->machine();
 }
 
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8