[turbofan] Add support for fast elements access to sloppy/strict arguments.

src/compiler/js-native-context-specialization.cc

 // Copyright 2015 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/compiler/js-native-context-specialization.h"
 
 #include "src/accessors.h"
 #include "src/code-factory.h"
 #include "src/compilation-dependencies.h"
 #include "src/compiler/access-builder.h"
@@ skipping 534 matching lines @@
   Node* fallthrough_control = control;
   for (ElementAccessInfo const& access_info : access_infos) {
     Node* this_receiver = receiver;
     Node* this_value = value;
     Node* this_index = index;
     Node* this_effect = effect;
     Node* this_control;
 
     // Perform map check on {receiver}.
     Type* receiver_type = access_info.receiver_type();
+    bool receiver_is_jsarray = true;
     {
       ZoneVector<Node*> this_controls(zone());
       for (auto i = access_info.receiver_type()->Classes(); !i.Done();
            i.Advance()) {
         Handle<Map> map = i.Current();
         Node* check =
             graph()->NewNode(simplified()->ReferenceEqual(Type::Internal()),
                              receiver_map, jsgraph()->Constant(map));
         Node* branch =
             graph()->NewNode(common()->Branch(), check, fallthrough_control);
         this_controls.push_back(graph()->NewNode(common()->IfTrue(), branch));
         fallthrough_control = graph()->NewNode(common()->IfFalse(), branch);
+        if (!map->IsJSArrayMap()) receiver_is_jsarray = false;
       }
       int const this_control_count = static_cast<int>(this_controls.size());
       this_control =
           (this_control_count == 1)
               ? this_controls.front()
               : graph()->NewNode(common()->Merge(this_control_count),
                                  this_control_count, &this_controls.front());
     }
 
     // Certain stores need a prototype chain check because shape changes
@@ skipping 48 matching lines @@
       check = graph()->NewNode(
           simplified()->ReferenceEqual(Type::Any()), this_elements_map,
           jsgraph()->HeapConstant(factory()->fixed_array_map()));
       branch = graph()->NewNode(common()->Branch(BranchHint::kTrue), check,
                                 this_control);
       exit_controls.push_back(graph()->NewNode(common()->IfFalse(), branch));
       this_control = graph()->NewNode(common()->IfTrue(), branch);
     }
 
     // Load the length of the {receiver}.
-    FieldAccess length_access = {
-        kTaggedBase, JSArray::kLengthOffset, factory()->name_string(),
-        type_cache_.kJSArrayLengthType, kMachAnyTagged};
-    if (IsFastDoubleElementsKind(elements_kind)) {
-      length_access.type = type_cache_.kFixedDoubleArrayLengthType;
-    } else if (IsFastElementsKind(elements_kind)) {
-      length_access.type = type_cache_.kFixedArrayLengthType;
+    Node* this_length;
+    if (receiver_is_jsarray) {
+      FieldAccess length_access = {
+          kTaggedBase, JSArray::kLengthOffset, factory()->name_string(),
+          type_cache_.kJSArrayLengthType, kMachAnyTagged};
+      if (IsFastDoubleElementsKind(elements_kind)) {
+        length_access.type = type_cache_.kFixedDoubleArrayLengthType;
+      } else if (IsFastElementsKind(elements_kind)) {
+        length_access.type = type_cache_.kFixedArrayLengthType;
+      }
+      this_length = this_effect =
+          graph()->NewNode(simplified()->LoadField(length_access),
+                           this_receiver, this_effect, this_control);
+    } else {
+      this_length = this_effect = graph()->NewNode(
+          simplified()->LoadField(AccessBuilder::ForFixedArrayLength()),
+          this_elements, this_effect, this_control);
     }
-    Node* this_length = this_effect =
-        graph()->NewNode(simplified()->LoadField(length_access), this_receiver,
-                         this_effect, this_control);
 
     // Check that the {index} is in the valid range for the {receiver}.
     Node* check = graph()->NewNode(simplified()->NumberLessThan(), this_index,
                                    this_length);
     Node* branch = graph()->NewNode(common()->Branch(BranchHint::kTrue), check,
                                     this_control);
     exit_controls.push_back(graph()->NewNode(common()->IfFalse(), branch));
     this_control = graph()->NewNode(common()->IfTrue(), branch);
 
     // Compute the element access.
@@ skipping 233 matching lines @@
 }
 
 
 SimplifiedOperatorBuilder* JSNativeContextSpecialization::simplified() const {
   return jsgraph()->simplified();
 }
 
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8