[turbofan] Add support for storing to double fields.

src/compiler/js-native-context-specialization.cc

 // Copyright 2015 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/compiler/js-native-context-specialization.h"
 
 #include "src/accessors.h"
 #include "src/compilation-dependencies.h"
 #include "src/compiler/access-builder.h"
 #include "src/compiler/js-graph.h"
@@ skipping 390 matching lines @@
         return true;
       } else if (details.type() == DATA) {
         int index = descriptors->GetFieldIndex(number);
         Representation field_representation = details.representation();
         FieldIndex field_index = FieldIndex::ForPropertyIndex(
             *map, index, field_representation.IsDouble());
         Type* field_type = Type::Tagged();
         if (field_representation.IsSmi()) {
           field_type = type_cache_.kSmi;
         } else if (field_representation.IsDouble()) {
-          if (access_mode == kStore) {
-            // TODO(bmeurer): Add support for storing to double fields.
-            return false;
-          }
           field_type = type_cache_.kFloat64;
         } else if (field_representation.IsHeapObject()) {
           // Extract the field type from the property details (make sure its
           // representation is TaggedPointer to reflect the heap object case).
           field_type = Type::Intersect(
               Type::Convert<HeapType>(
                   handle(descriptors->GetFieldType(number), isolate()),
                   graph()->zone()),
               Type::TaggedPointer(), graph()->zone());
           if (field_type->Is(Type::None())) {
@@ skipping 249 matching lines @@
         this_receiver = jsgraph()->Constant(holder);
       }
       Node* this_storage = this_receiver;
       if (!field_index.is_inobject()) {
         this_storage = this_effect = graph()->NewNode(
             simplified()->LoadField(AccessBuilder::ForJSObjectProperties()),
             this_storage, this_effect, this_control);
       }
       FieldAccess field_access = {kTaggedBase, field_index.offset(), name,
                                   field_type, kMachAnyTagged};
+      if (field_type->Is(Type::UntaggedFloat64())) {
+        if (!field_index.is_inobject() || field_index.is_hidden_field() ||
+            !FLAG_unbox_double_fields) {
+          this_storage = this_effect =
+              graph()->NewNode(simplified()->LoadField(field_access),
+                               this_storage, this_effect, this_control);
+          field_access.offset = HeapNumber::kValueOffset;
+          field_access.name = MaybeHandle<Name>();

[Jarin, 2015/10/30 10:05:12]

I am confused, are we going to store into heap number here?

[Benedikt Meurer, 2015/10/30 10:07:19]

Yes, when double field unboxing is disabled, we allocate MutableHeapNumbers for
double fields and store directly to them.

[Jarin, 2015/10/30 10:11:05]

Ok, I will trust you that we will not store into a normal HeapNumber, then.

+        }
+        field_access.machine_type = kMachFloat64;
+      }
       if (access_mode == kLoad) {
-        if (field_type->Is(Type::UntaggedFloat64())) {
-          if (!field_index.is_inobject() || field_index.is_hidden_field() ||
-              !FLAG_unbox_double_fields) {
-            this_storage = this_effect =
-                graph()->NewNode(simplified()->LoadField(field_access),
-                                 this_storage, this_effect, this_control);
-            field_access.offset = HeapNumber::kValueOffset;
-            field_access.name = MaybeHandle<Name>();
-          }
-          field_access.machine_type = kMachFloat64;
-        }
         this_value = this_effect =
             graph()->NewNode(simplified()->LoadField(field_access),
                              this_storage, this_effect, this_control);
       } else {
         DCHECK_EQ(kStore, access_mode);
-        if (field_type->Is(Type::TaggedSigned())) {
-          Node* check = graph()->NewNode(simplified()->ObjectIsSmi(), value);
+        if (field_type->Is(Type::UntaggedFloat64())) {
+          Node* check =
+              graph()->NewNode(simplified()->ObjectIsNumber(), this_value);
+          Node* branch = graph()->NewNode(common()->Branch(BranchHint::kTrue),
+                                          check, this_control);
+          exit_controls.push_back(
+              graph()->NewNode(common()->IfFalse(), branch));
+          this_control = graph()->NewNode(common()->IfTrue(), branch);
+          this_value = graph()->NewNode(common()->Guard(Type::Number()),
+                                        this_value, this_control);
+        } else if (field_type->Is(Type::TaggedSigned())) {
+          Node* check =
+              graph()->NewNode(simplified()->ObjectIsSmi(), this_value);
           Node* branch = graph()->NewNode(common()->Branch(BranchHint::kTrue),
                                           check, this_control);
           exit_controls.push_back(
               graph()->NewNode(common()->IfFalse(), branch));
           this_control = graph()->NewNode(common()->IfTrue(), branch);
         } else if (field_type->Is(Type::TaggedPointer())) {
-          Node* check = graph()->NewNode(simplified()->ObjectIsSmi(), value);
+          Node* check =
+              graph()->NewNode(simplified()->ObjectIsSmi(), this_value);
           Node* branch = graph()->NewNode(common()->Branch(BranchHint::kFalse),
                                           check, this_control);
           exit_controls.push_back(graph()->NewNode(common()->IfTrue(), branch));
           this_control = graph()->NewNode(common()->IfFalse(), branch);
           if (field_type->NumClasses() > 0) {
             // Emit a (sequence of) map checks for the value.
             ZoneVector<Node*> this_controls(zone());
-            Node* value_map = this_effect = graph()->NewNode(
-                simplified()->LoadField(AccessBuilder::ForMap()), value,
+            Node* this_value_map = this_effect = graph()->NewNode(
+                simplified()->LoadField(AccessBuilder::ForMap()), this_value,
                 this_effect, this_control);
             for (auto i = field_type->Classes(); !i.Done(); i.Advance()) {
               Handle<Map> field_map(i.Current());
               check = graph()->NewNode(
-                  simplified()->ReferenceEqual(Type::Internal()), value_map,
-                  jsgraph()->Constant(field_map));
+                  simplified()->ReferenceEqual(Type::Internal()),
+                  this_value_map, jsgraph()->Constant(field_map));
               branch = graph()->NewNode(common()->Branch(BranchHint::kTrue),
                                         check, this_control);
               this_control = graph()->NewNode(common()->IfFalse(), branch);
               this_controls.push_back(
                   graph()->NewNode(common()->IfTrue(), branch));
             }
             exit_controls.push_back(this_control);
             int const this_control_count =
                 static_cast<int>(this_controls.size());
             this_control =
@@ skipping 195 matching lines @@
 }
 
 
 SimplifiedOperatorBuilder* JSNativeContextSpecialization::simplified() const {
   return jsgraph()->simplified();
 }
 
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8