[turbofan] Add support for transitioning stores to double fields.

src/compiler/property-access-info.cc

 // Copyright 2015 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include <ostream>
 
 #include "src/accessors.h"
 #include "src/compilation-dependencies.h"
 #include "src/compiler/property-access-info.h"
 #include "src/field-index-inl.h"
@@ skipping 69 matching lines @@
 
 
 bool PropertyAccessInfoFactory::ComputePropertyAccessInfo(
     Handle<Map> map, Handle<Name> name, PropertyAccessMode access_mode,
     PropertyAccessInfo* access_info) {
   // Check if it is safe to inline property access for the {map}.
   if (!CanInlinePropertyAccess(map)) return false;
 
   // Compute the receiver type.
   Handle<Map> receiver_map = map;
-  Type* receiver_type = Type::Class(receiver_map, zone());
 
   // We support fast inline cases for certain JSObject getters.
-  if (access_mode == PropertyAccessMode::kLoad) {
-    // Check for special JSObject field accessors.
-    int offset;
-    if (Accessors::IsJSObjectFieldAccessor(map, name, &offset)) {
-      FieldIndex field_index = FieldIndex::ForInObjectOffset(offset);
-      Type* field_type = Type::Tagged();
-      if (map->IsStringMap()) {
-        DCHECK(Name::Equals(factory()->length_string(), name));
-        // The String::length property is always a smi in the range
-        // [0, String::kMaxLength].
-        field_type = type_cache_.kStringLengthType;
-      } else if (map->IsJSArrayMap()) {
-        DCHECK(Name::Equals(factory()->length_string(), name));
-        // The JSArray::length property is a smi in the range
-        // [0, FixedDoubleArray::kMaxLength] in case of fast double
-        // elements, a smi in the range [0, FixedArray::kMaxLength]
-        // in case of other fast elements, and [0, kMaxUInt32] in
-        // case of other arrays.
-        if (IsFastDoubleElementsKind(map->elements_kind())) {
-          field_type = type_cache_.kFixedDoubleArrayLengthType;
-        } else if (IsFastElementsKind(map->elements_kind())) {
-          field_type = type_cache_.kFixedArrayLengthType;
-        } else {
-          field_type = type_cache_.kJSArrayLengthType;
-        }
-      }
-      *access_info =
-          PropertyAccessInfo::DataField(receiver_type, field_index, field_type);
-      return true;
-    }
+  if (access_mode == PropertyAccessMode::kLoad &&
+      LookupSpecialFieldAccessor(map, name, access_info)) {
+    return true;
   }
 
   MaybeHandle<JSObject> holder;
   while (true) {
     // Lookup the named property on the {map}.
     Handle<DescriptorArray> descriptors(map->instance_descriptors(), isolate());
     int const number = descriptors->SearchWithCache(*name, *map);
     if (number != DescriptorArray::kNotFound) {
       PropertyDetails const details = descriptors->GetDetails(number);
       if (access_mode == PropertyAccessMode::kStore) {
         // Don't bother optimizing stores to read-only properties.
         if (details.IsReadOnly()) {
           return false;
         }
         // Check for store to data property on a prototype.
         if (details.kind() == kData && !holder.is_null()) {
-          // We need to add the data field to the receiver. Leave the loop
-          // and check whether we already have a transition for this field.
+          // Store to property not found on the receiver but on a prototype, we
+          // need to transition to a new data property.
           // Implemented according to ES6 section 9.1.9 [[Set]] (P, V, Receiver)
-          break;
+          return LookupTransition(receiver_map, name, holder, access_info);
         }
       }
       if (details.type() == DATA_CONSTANT) {
         *access_info = PropertyAccessInfo::DataConstant(
-            receiver_type, handle(descriptors->GetValue(number), isolate()),
-            holder);
+            Type::Class(receiver_map, zone()),
+            handle(descriptors->GetValue(number), isolate()), holder);
         return true;
       } else if (details.type() == DATA) {
         int index = descriptors->GetFieldIndex(number);
         Representation field_representation = details.representation();
         FieldIndex field_index = FieldIndex::ForPropertyIndex(
             *map, index, field_representation.IsDouble());
         Type* field_type = Type::Tagged();
         if (field_representation.IsSmi()) {
           field_type = type_cache_.kSmi;
         } else if (field_representation.IsDouble()) {
@@ skipping 14 matching lines @@
             // TODO(bmeurer): It would be awesome to make this saner in the
             // runtime/GC interaction.
             field_type = Type::TaggedPointer();
           } else if (!Type::Any()->Is(field_type)) {
             // Add proper code dependencies in case of stable field map(s).
             Handle<Map> field_owner_map(map->FindFieldOwner(number), isolate());
             dependencies()->AssumeFieldType(field_owner_map);
           }
           DCHECK(field_type->Is(Type::TaggedPointer()));
         }
-        *access_info = PropertyAccessInfo::DataField(receiver_type, field_index,
-                                                     field_type, holder);
+        *access_info = PropertyAccessInfo::DataField(
+            Type::Class(receiver_map, zone()), field_index, field_type, holder);
         return true;
       } else {
         // TODO(bmeurer): Add support for accessors.
         return false;
       }
     }
 
     // Don't search on the prototype chain for special indices in case of
     // integer indexed exotic objects (see ES6 section 9.4.5).
     if (map->IsJSTypedArrayMap() && name->IsString() &&
@@ skipping 11 matching lines @@
       Handle<JSFunction> constructor;
       if (Map::GetConstructorFunction(map, native_context())
               .ToHandle(&constructor)) {
         map = handle(constructor->initial_map(), isolate());
         DCHECK(map->prototype()->IsJSObject());
       } else if (map->prototype()->IsNull()) {
         // Store to property not found on the receiver or any prototype, we need
         // to transition to a new data property.
         // Implemented according to ES6 section 9.1.9 [[Set]] (P, V, Receiver)
         if (access_mode == PropertyAccessMode::kStore) {
-          break;
+          return LookupTransition(receiver_map, name, holder, access_info);
         }
         // TODO(bmeurer): Handle the not found case if the prototype is null.
         return false;
       } else {
         return false;
       }
     }
     Handle<JSObject> map_prototype(JSObject::cast(map->prototype()), isolate());
     if (map_prototype->map()->is_deprecated()) {
       // Try to migrate the prototype object so we don't embed the deprecated
       // map into the optimized code.
       JSObject::TryMigrateInstance(map_prototype);
     }
     map = handle(map_prototype->map(), isolate());
     holder = map_prototype;
 
     // Check if it is safe to inline property access for the {map}.
     if (!CanInlinePropertyAccess(map)) return false;
   }
-  DCHECK_EQ(PropertyAccessMode::kStore, access_mode);
+  return false;
+}
 
-  // Check if the {receiver_map} has a data transition with the given {name}.
-  if (receiver_map->unused_property_fields() == 0) return false;
-  if (Map* transition = TransitionArray::SearchTransition(*receiver_map, kData,
-                                                          *name, NONE)) {
-    Handle<Map> transition_map(transition, isolate());
+
+bool PropertyAccessInfoFactory::LookupSpecialFieldAccessor(
+    Handle<Map> map, Handle<Name> name, PropertyAccessInfo* access_info) {
+  // Check for special JSObject field accessors.
+  int offset;
+  if (Accessors::IsJSObjectFieldAccessor(map, name, &offset)) {
+    FieldIndex field_index = FieldIndex::ForInObjectOffset(offset);
+    Type* field_type = Type::Tagged();
+    if (map->IsStringMap()) {
+      DCHECK(Name::Equals(factory()->length_string(), name));
+      // The String::length property is always a smi in the range
+      // [0, String::kMaxLength].
+      field_type = type_cache_.kStringLengthType;
+    } else if (map->IsJSArrayMap()) {
+      DCHECK(Name::Equals(factory()->length_string(), name));
+      // The JSArray::length property is a smi in the range
+      // [0, FixedDoubleArray::kMaxLength] in case of fast double
+      // elements, a smi in the range [0, FixedArray::kMaxLength]
+      // in case of other fast elements, and [0, kMaxUInt32] in
+      // case of other arrays.
+      if (IsFastDoubleElementsKind(map->elements_kind())) {
+        field_type = type_cache_.kFixedDoubleArrayLengthType;
+      } else if (IsFastElementsKind(map->elements_kind())) {
+        field_type = type_cache_.kFixedArrayLengthType;
+      } else {
+        field_type = type_cache_.kJSArrayLengthType;
+      }
+    }
+    *access_info = PropertyAccessInfo::DataField(Type::Class(map, zone()),
+                                                 field_index, field_type);
+    return true;
+  }
+  return false;
+}
+
+
+bool PropertyAccessInfoFactory::LookupTransition(
+    Handle<Map> map, Handle<Name> name, MaybeHandle<JSObject> holder,
+    PropertyAccessInfo* access_info) {
+  // Check if the {map} has a data transition with the given {name}.
+  if (map->unused_property_fields() == 0) return false;
+  Handle<Map> transition_map;
+  if (TransitionArray::SearchTransition(map, kData, name, NONE)
+          .ToHandle(&transition_map)) {
     int const number = transition_map->LastAdded();
     PropertyDetails const details =
         transition_map->instance_descriptors()->GetDetails(number);
     // Don't bother optimizing stores to read-only properties.
     if (details.IsReadOnly()) return false;
     // TODO(bmeurer): Handle transition to data constant?
     if (details.type() != DATA) return false;
     int const index = details.field_index();
     Representation field_representation = details.representation();
     FieldIndex field_index = FieldIndex::ForPropertyIndex(
         *transition_map, index, field_representation.IsDouble());
     Type* field_type = Type::Tagged();
     if (field_representation.IsSmi()) {
       field_type = type_cache_.kSmi;
     } else if (field_representation.IsDouble()) {
-      // TODO(bmeurer): Add support for storing to double fields.
-      return false;
+      field_type = type_cache_.kFloat64;
     } else if (field_representation.IsHeapObject()) {
       // Extract the field type from the property details (make sure its
       // representation is TaggedPointer to reflect the heap object case).
       field_type = Type::Intersect(
           Type::Convert<HeapType>(
               handle(
                   transition_map->instance_descriptors()->GetFieldType(number),
                   isolate()),
               zone()),
           Type::TaggedPointer(), zone());
       if (field_type->Is(Type::None())) {
         // Store is not safe if the field type was cleared.
         return false;
       } else if (!Type::Any()->Is(field_type)) {
         // Add proper code dependencies in case of stable field map(s).
         Handle<Map> field_owner_map(transition_map->FindFieldOwner(number),
                                     isolate());
         dependencies()->AssumeFieldType(field_owner_map);
       }
       DCHECK(field_type->Is(Type::TaggedPointer()));
     }
     dependencies()->AssumeMapNotDeprecated(transition_map);
-    *access_info = PropertyAccessInfo::DataField(
-        receiver_type, field_index, field_type, holder, transition_map);
+    *access_info =
+        PropertyAccessInfo::DataField(Type::Class(map, zone()), field_index,
+                                      field_type, holder, transition_map);
     return true;
   }
   return false;
 }
 
 
 bool PropertyAccessInfoFactory::ComputePropertyAccessInfos(
     MapHandleList const& maps, Handle<Name> name,
     PropertyAccessMode access_mode,
     ZoneVector<PropertyAccessInfo>* access_infos) {
@@ skipping 10 matching lines @@
 }
 
 
 Factory* PropertyAccessInfoFactory::factory() const {
   return isolate()->factory();
 }
 
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8