[turbofan] Lower access to special JSObject field accessors.

src/compiler/js-native-context-specialization.cc

 // Copyright 2015 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/compiler/js-native-context-specialization.h"
 
+#include "src/accessors.h"
 #include "src/compilation-dependencies.h"
 #include "src/compiler/access-builder.h"
 #include "src/compiler/js-graph.h"
 #include "src/compiler/js-operator.h"
 #include "src/contexts.h"
 #include "src/field-index-inl.h"
 #include "src/lookup.h"
 #include "src/objects-inl.h"  // TODO(mstarzinger): Temporary cycle breaker!
 #include "src/type-feedback-vector.h"
 
@@ skipping 225 matching lines @@
  public:
   enum Kind { kInvalid, kData, kDataConstant };
 
   static PropertyAccessInfo DataConstant(Type* receiver_type,
                                          Handle<Object> constant,
                                          MaybeHandle<JSObject> holder) {
     return PropertyAccessInfo(holder, constant, receiver_type);
   }
   static PropertyAccessInfo Data(Type* receiver_type, FieldIndex field_index,
                                  Representation field_representation,
+                                 Type* field_type,
                                  MaybeHandle<JSObject> holder) {
     return PropertyAccessInfo(holder, field_index, field_representation,
-                              receiver_type);
+                              field_type, receiver_type);
   }
 
   PropertyAccessInfo() : kind_(kInvalid) {}
   PropertyAccessInfo(MaybeHandle<JSObject> holder, Handle<Object> constant,
                      Type* receiver_type)
       : kind_(kDataConstant),
         receiver_type_(receiver_type),
         constant_(constant),
         holder_(holder) {}
   PropertyAccessInfo(MaybeHandle<JSObject> holder, FieldIndex field_index,
-                     Representation field_representation, Type* receiver_type)
+                     Representation field_representation, Type* field_type,
+                     Type* receiver_type)
       : kind_(kData),
         receiver_type_(receiver_type),
         holder_(holder),
         field_index_(field_index),
-        field_representation_(field_representation) {}
+        field_representation_(field_representation),
+        field_type_(field_type) {}
 
   bool IsDataConstant() const { return kind() == kDataConstant; }
   bool IsData() const { return kind() == kData; }
 
   Kind kind() const { return kind_; }
   MaybeHandle<JSObject> holder() const { return holder_; }
   Handle<Object> constant() const { return constant_; }
   FieldIndex field_index() const { return field_index_; }
   Representation field_representation() const { return field_representation_; }
+  Type* field_type() const { return field_type_; }
   Type* receiver_type() const { return receiver_type_; }
 
  private:
   Kind kind_;
   Type* receiver_type_;
   Handle<Object> constant_;
   MaybeHandle<JSObject> holder_;
   FieldIndex field_index_;
   Representation field_representation_;
+  Type* field_type_ = Type::Any();
 };
 
 
 namespace {
 
 bool CanInlinePropertyAccess(Handle<Map> map) {
   // TODO(bmeurer): Do something about the number stuff.
   if (map->instance_type() == HEAP_NUMBER_TYPE) return false;
   if (map->instance_type() < FIRST_NONSTRING_TYPE) return true;
   return map->IsJSObjectMap() && !map->is_dictionary_map() &&
          !map->has_named_interceptor() &&
          // TODO(verwaest): Whitelist contexts to which we have access.
          !map->is_access_check_needed();
 }
 
 }  // namespace
 
 
 bool JSNativeContextSpecialization::ComputePropertyAccessInfo(
     Handle<Map> map, Handle<Name> name, PropertyAccessInfo* access_info) {
   MaybeHandle<JSObject> holder;
-  Type* receiver_type = Type::Class(map, graph()->zone());
+  Handle<Map> receiver_map = map;
+  Type* receiver_type = Type::Class(receiver_map, graph()->zone());
   while (CanInlinePropertyAccess(map)) {
+    // Check for special JSObject field accessors.
+    int offset;
+    if (Accessors::IsJSObjectFieldAccessor(map, name, &offset)) {
+      FieldIndex field_index = FieldIndex::ForInObjectOffset(offset);
+      Representation field_representation = Representation::Tagged();
+      Type* field_type = Type::Tagged();
+      if (receiver_type->Is(Type::String())) {
+        DCHECK(Name::Equals(factory()->length_string(), name));
+        // The String::length property is always a smi in the range
+        // [0, String::kMaxLength].
+        field_representation = Representation::Smi();
+        field_type = Type::Intersect(
+            Type::Range(0.0, String::kMaxLength, graph()->zone()),
+            Type::TaggedSigned(), graph()->zone());
+      } else if (receiver_map->IsJSArrayMap()) {
+        DCHECK(Name::Equals(factory()->length_string(), name));
+        // The JSArray::length property is a smi in the range
+        // [0, FixedDoubleArray::kMaxLength] in case of fast double
+        // elements, a smi in the range [0, FixedArray::kMaxLength]
+        // in case of other fast elements, and [0, kMaxUInt32-1] in
+        // case of other arrays.
+        double field_type_upper = kMaxUInt32 - 1;
+        if (IsFastElementsKind(receiver_map->elements_kind())) {
+          field_representation = Representation::Smi();
+          field_type_upper =
+              IsFastDoubleElementsKind(receiver_map->elements_kind())
+                  ? FixedDoubleArray::kMaxLength
+                  : FixedArray::kMaxLength;
+        }
+        field_type =
+            Type::Intersect(Type::Range(0.0, field_type_upper, graph()->zone()),
+                            Type::TaggedSigned(), graph()->zone());
+      }
+      *access_info = PropertyAccessInfo::Data(
+          receiver_type, field_index, field_representation, field_type, holder);
+      return true;
+    }
+
     // Lookup the named property on the {map}.
     Handle<DescriptorArray> descriptors(map->instance_descriptors(), isolate());
     int const number = descriptors->SearchWithCache(*name, *map);
     if (number != DescriptorArray::kNotFound) {
       PropertyDetails const details = descriptors->GetDetails(number);
       if (details.type() == DATA_CONSTANT) {
         *access_info = PropertyAccessInfo::DataConstant(
             receiver_type, handle(descriptors->GetValue(number), isolate()),
             holder);
         return true;
       } else if (details.type() == DATA) {
         int index = descriptors->GetFieldIndex(number);
         Representation field_representation = details.representation();
         FieldIndex field_index = FieldIndex::ForPropertyIndex(
             *map, index, field_representation.IsDouble());
-        *access_info = PropertyAccessInfo::Data(receiver_type, field_index,
-                                                field_representation, holder);
+        Type* field_type = Type::Any();
+        if (field_representation.IsSmi()) {
+          field_type = Type::Intersect(Type::SignedSmall(),
+                                       Type::TaggedSigned(), graph()->zone());
+        } else if (field_representation.IsDouble()) {
+          field_type = Type::Intersect(Type::Number(), Type::UntaggedFloat64(),
+                                       graph()->zone());
+        } else if (field_representation.IsHeapObject()) {
+          field_type = Type::TaggedPointer();
+        }
+        *access_info =
+            PropertyAccessInfo::Data(receiver_type, field_index,
+                                     field_representation, field_type, holder);
         return true;
       } else {
         // TODO(bmeurer): Add support for accessors.
         break;
       }
     }
 
     // Don't search on the prototype chain for special indices in case of
     // integer indexed exotic objects (see ES6 section 9.4.5).
     if (map->IsJSTypedArrayMap() && name->IsString() &&
@@ skipping 164 matching lines @@
     // Generate the actual property access.
     if (access_info.IsDataConstant()) {
       this_value = jsgraph()->Constant(access_info.constant());
     } else {
       // TODO(bmeurer): This is sort of adhoc, and must be refactored into some
       // common code once we also have support for stores.
       DCHECK(access_info.IsData());
       FieldIndex const field_index = access_info.field_index();
       Representation const field_representation =
           access_info.field_representation();
+      Type* const field_type = access_info.field_type();
       if (!field_index.is_inobject()) {
         this_value = this_effect = graph()->NewNode(
             simplified()->LoadField(AccessBuilder::ForJSObjectProperties()),
             this_value, this_effect, this_control);
       }
       FieldAccess field_access;
       field_access.base_is_tagged = kTaggedBase;
       field_access.offset = field_index.offset();
       field_access.name = name;
-      field_access.type = Type::Any();
+      field_access.type = field_type;
       field_access.machine_type = kMachAnyTagged;
-      if (field_representation.IsSmi()) {
-        field_access.type = Type::Intersect(
-            Type::SignedSmall(), Type::TaggedSigned(), graph()->zone());
-      } else if (field_representation.IsDouble()) {
+      if (field_representation.IsDouble()) {
         if (!field_index.is_inobject() || field_index.is_hidden_field() ||
             !FLAG_unbox_double_fields) {
           this_value = this_effect =
               graph()->NewNode(simplified()->LoadField(field_access),
                                this_value, this_effect, this_control);
           field_access.offset = HeapNumber::kValueOffset;
           field_access.name = MaybeHandle<Name>();
         }
-        field_access.type = Type::Intersect(
-            Type::Number(), Type::UntaggedFloat64(), graph()->zone());
         field_access.machine_type = kMachFloat64;
-      } else if (field_representation.IsHeapObject()) {
-        field_access.type = Type::TaggedPointer();
       }
       this_value = this_effect =
           graph()->NewNode(simplified()->LoadField(field_access), this_value,
                            this_effect, this_control);
     }
 
     // Remember the final state for this property access.
     values.push_back(this_value);
     effects.push_back(this_effect);
     controls.push_back(this_control);
@@ skipping 82 matching lines @@
 Graph* JSNativeContextSpecialization::graph() const {
   return jsgraph()->graph();
 }
 
 
 Isolate* JSNativeContextSpecialization::isolate() const {
   return jsgraph()->isolate();
 }
 
 
+Factory* JSNativeContextSpecialization::factory() const {
+  return isolate()->factory();
+}
+
+
 MachineOperatorBuilder* JSNativeContextSpecialization::machine() const {
   return jsgraph()->machine();
 }
 
 
 CommonOperatorBuilder* JSNativeContextSpecialization::common() const {
   return jsgraph()->common();
 }
 
 
 JSOperatorBuilder* JSNativeContextSpecialization::javascript() const {
   return jsgraph()->javascript();
 }
 
 
 SimplifiedOperatorBuilder* JSNativeContextSpecialization::simplified() const {
   return jsgraph()->simplified();
 }
 
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8