[turbofan] Fix and enable property stores.

src/compiler/js-native-context-specialization.cc

 // Copyright 2015 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/compiler/js-native-context-specialization.h"
 
 #include "src/accessors.h"
 #include "src/compilation-dependencies.h"
 #include "src/compiler/access-builder.h"
 #include "src/compiler/js-graph.h"
@@ skipping 294 matching lines @@
          !map->is_access_check_needed();
 }
 
 }  // namespace
 
 
 bool JSNativeContextSpecialization::ComputePropertyAccessInfo(
     Handle<Map> map, Handle<Name> name, PropertyAccessMode access_mode,
     PropertyAccessInfo* access_info) {
   MaybeHandle<JSObject> holder;
-  Type* receiver_type = Type::Class(map, graph()->zone());
+  Handle<Map> receiver_map = map;
+  Type* receiver_type = Type::Class(receiver_map, graph()->zone());
   while (CanInlinePropertyAccess(map)) {
     // Check for special JSObject field accessors.
     int offset;
     if (Accessors::IsJSObjectFieldAccessor(map, name, &offset)) {
       // Don't bother optimizing stores to special JSObject field accessors.
       if (access_mode == kStore) {
         break;
       }
       FieldIndex field_index = FieldIndex::ForInObjectOffset(offset);
       Type* field_type = Type::Tagged();
@@ skipping 23 matching lines @@
       }
       *access_info = PropertyAccessInfo::DataField(receiver_type, field_index,
                                                    field_type, holder);
       return true;
     }
 
     // Lookup the named property on the {map}.
     Handle<DescriptorArray> descriptors(map->instance_descriptors(), isolate());
     int const number = descriptors->SearchWithCache(*name, *map);
     if (number != DescriptorArray::kNotFound) {
+      if (access_mode == kStore && !map.is_identical_to(receiver_map)) {
+        return false;
+      }
       PropertyDetails const details = descriptors->GetDetails(number);
       if (details.type() == DATA_CONSTANT) {
         *access_info = PropertyAccessInfo::DataConstant(
             receiver_type, handle(descriptors->GetValue(number), isolate()),
             holder);
         return true;
       } else if (details.type() == DATA) {
         // Don't bother optimizing stores to read-only properties.
-        if (access_mode == kStore) {
+        if (access_mode == kStore && details.IsReadOnly()) {
           break;
         }
         int index = descriptors->GetFieldIndex(number);
         Representation field_representation = details.representation();
         FieldIndex field_index = FieldIndex::ForPropertyIndex(
             *map, index, field_representation.IsDouble());
-        Type* field_type = Type::Any();
+        Type* field_type = Type::Tagged();
         if (field_representation.IsSmi()) {
           field_type = Type::Intersect(Type::SignedSmall(),
                                        Type::TaggedSigned(), graph()->zone());
         } else if (field_representation.IsDouble()) {
           if (access_mode == kStore) {
             // TODO(bmeurer): Add support for storing to double fields.
             break;
           }
           field_type = Type::Intersect(Type::Number(), Type::UntaggedFloat64(),
                                        graph()->zone());
@@ skipping 62 matching lines @@
   }
   return false;
 }
 
 
 bool JSNativeContextSpecialization::ComputePropertyAccessInfos(
     MapHandleList const& maps, Handle<Name> name,
     PropertyAccessMode access_mode,
     ZoneVector<PropertyAccessInfo>* access_infos) {
   for (Handle<Map> map : maps) {
-    PropertyAccessInfo access_info;
-    if (!ComputePropertyAccessInfo(map, name, access_mode, &access_info)) {
-      return false;
+    if (Map::TryUpdate(map).ToHandle(&map)) {
+      PropertyAccessInfo access_info;
+      if (!ComputePropertyAccessInfo(map, name, access_mode, &access_info)) {
+        return false;
+      }
+      access_infos->push_back(access_info);
     }
-    access_infos->push_back(access_info);
   }
   return true;
 }
 
 
 Reduction JSNativeContextSpecialization::ReduceJSLoadNamed(Node* node) {
   DCHECK_EQ(IrOpcode::kJSLoadNamed, node->opcode());
   NamedAccess const& p = NamedAccessOf(node->op());
   Handle<Name> name = p.name();
   Node* receiver = NodeProperties::GetValueInput(node, 0);
   Node* frame_state = NodeProperties::GetFrameStateInput(node, 1);
   Node* effect = NodeProperties::GetEffectInput(node);
   Node* control = NodeProperties::GetControlInput(node);
 
   // Not much we can do if deoptimization support is disabled.
   if (!(flags() & kDeoptimizationEnabled)) return NoChange();
 
   // Extract receiver maps from the LOAD_IC using the LoadICNexus.
   MapHandleList receiver_maps;
   if (!p.feedback().IsValid()) return NoChange();
   LoadICNexus nexus(p.feedback().vector(), p.feedback().slot());
   if (nexus.ExtractMaps(&receiver_maps) == 0) return NoChange();
   DCHECK_LT(0, receiver_maps.length());
 
   // Compute property access infos for the receiver maps.
   ZoneVector<PropertyAccessInfo> access_infos(zone());
   if (!ComputePropertyAccessInfos(receiver_maps, name, kLoad, &access_infos)) {
     return NoChange();
   }
-  DCHECK(!access_infos.empty());
+
+  // Nothing to do if we have no non-deprecated maps.
+  if (access_infos.empty()) return NoChange();
 
   // The final states for every polymorphic branch. We join them with
   // Merge+Phi+EffectPhi at the bottom.
   ZoneVector<Node*> values(zone());
   ZoneVector<Node*> effects(zone());
   ZoneVector<Node*> controls(zone());
 
   // The list of "exiting" controls, which currently go to a single deoptimize.
   // TODO(bmeurer): Consider using an IC as fallback.
   Node* const exit_effect = effect;
@@ skipping 263 matching lines @@
       this_control =
           (this_control_count == 1)
               ? this_controls.front()
               : graph()->NewNode(common()->Merge(this_control_count),
                                  this_control_count, &this_controls.front());
     }
 
     // Determine actual holder and perform prototype chain checks.
     Handle<JSObject> holder;
     if (access_info.holder().ToHandle(&holder)) {
-      this_receiver = jsgraph()->Constant(holder);
       for (auto i = access_info.receiver_type()->Classes(); !i.Done();
            i.Advance()) {
         Handle<Map> map = i.Current();
         PrototypeIterator j(map);
         while (true) {
           // Check that the {prototype} still has the same map. For stable
           // maps, we can add a stability dependency on the prototype map;
           // for everything else we need to perform a map check at runtime.
           Handle<JSReceiver> prototype =
               PrototypeIterator::GetCurrent<JSReceiver>(j);
@@ skipping 186 matching lines @@
 }
 
 
 SimplifiedOperatorBuilder* JSNativeContextSpecialization::simplified() const {
   return jsgraph()->simplified();
 }
 
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8