Support loads from primitive values.

src/hydrogen.cc

 // Copyright 2013 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 4906 matching lines @@
   Handle<JSFunction> closure = function_state()->compilation_info()->closure();
   Handle<FixedArray> literals(closure->literals());
   HRegExpLiteral* instr = New<HRegExpLiteral>(literals,
                                               expr->pattern(),
                                               expr->flags(),
                                               expr->literal_index());
   return ast_context()->ReturnInstruction(instr, expr->id());
 }
 
 
-static bool CanInlinePropertyAccess(Map* type) {
-  return type->IsJSObjectMap() &&
-      !type->is_dictionary_map() &&
-      !type->has_named_interceptor();
+static bool CanInlinePropertyAccess(Handle<HeapType> type) {
+  if (type->Is(HeapType::NumberOrString())) return true;
+  if (!type->IsClass()) return false;
+  Handle<Map> map = type->AsClass();
+  return map->IsJSObjectMap() &&
+      !map->is_dictionary_map() &&
+      !map->has_named_interceptor();
 }
 
 
 static void LookupInPrototypes(Handle<Map> map,
                                Handle<String> name,
                                LookupResult* lookup) {
   while (map->prototype()->IsJSObject()) {
     Handle<JSObject> holder(JSObject::cast(map->prototype()));
-    map = Handle<Map>(holder->map());
-    if (!CanInlinePropertyAccess(*map)) break;
+    map = handle(holder->map());
+    if (!CanInlinePropertyAccess(IC::MapToType(map))) break;
     map->LookupDescriptor(*holder, *name, lookup);
     if (lookup->IsFound()) return;
   }
   lookup->NotFound();
 }
 
 
 // Tries to find a JavaScript accessor of the given name in the prototype chain
 // starting at the given map. Return true iff there is one, including the
 // corresponding AccessorPair plus its holder (which could be null when the
@@ skipping 480 matching lines @@
                          function_strict_mode_flag());
 }
 
 
 // Sets the lookup result and returns true if the load/store can be inlined.
 static bool ComputeStoreField(Handle<Map> type,
                               Handle<String> name,
                               LookupResult* lookup,
                               bool lookup_transition = true) {
   ASSERT(!type->is_observed());
-  if (!CanInlinePropertyAccess(*type)) {
+  if (!CanInlinePropertyAccess(IC::MapToType(type))) {
     lookup->NotFound();
     return false;
   }
   // If we directly find a field, the access can be inlined.
   type->LookupDescriptor(NULL, *name, lookup);
   if (lookup->IsField()) return true;
 
   if (!lookup_transition) return false;
 
   type->LookupTransition(NULL, *name, lookup);
@@ skipping 14 matching lines @@
     return BuildStoreNamedField(checked_object, name, value, map, &lookup);
   }
 
   // No luck, do a generic store.
   return BuildStoreNamedGeneric(object, name, value);
 }
 
 
 bool HOptimizedGraphBuilder::PropertyAccessInfo::IsCompatibleForLoad(
     PropertyAccessInfo* info) {
-  if (!CanInlinePropertyAccess(*map_)) return false;
+  if (!CanInlinePropertyAccess(type_)) return false;
+
+  // Currently only handle HeapType::Number as a polymorphic case.
+  // TODO(verwaest): Support monomorphic handling of numbers with a HCheckNumber
+  // instruction.
+  if (type_->Is(HeapType::Number())) return false;
+
+  // Values are only compatible for monomorphic load if they all behave the same
+  // regarding value wrappers.
+  if (type_->Is(HeapType::NumberOrString())) {
+    if (!info->type_->Is(HeapType::NumberOrString())) return false;
+  } else {
+    if (info->type_->Is(HeapType::NumberOrString())) return false;
+  }
 
   if (!LookupDescriptor()) return false;
 
   if (!lookup_.IsFound()) {
     return (!info->lookup_.IsFound() || info->has_holder()) &&
-        map_->prototype() == info->map_->prototype();
+        map()->prototype() == info->map()->prototype();
   }
 
   // Mismatch if the other access info found the property in the prototype
   // chain.
   if (info->has_holder()) return false;
 
   if (lookup_.IsPropertyCallbacks()) {
     return accessor_.is_identical_to(info->accessor_);
   }
 
   if (lookup_.IsConstant()) {
     return constant_.is_identical_to(info->constant_);
   }
 
   ASSERT(lookup_.IsField());
   if (!info->lookup_.IsField()) return false;
 
   Representation r = access_.representation();
   if (!info->access_.representation().IsCompatibleForLoad(r)) return false;
   if (info->access_.offset() != access_.offset()) return false;
   if (info->access_.IsInobject() != access_.IsInobject()) return false;
   info->GeneralizeRepresentation(r);
   return true;
 }
 
 
 bool HOptimizedGraphBuilder::PropertyAccessInfo::LookupDescriptor() {
-  map_->LookupDescriptor(NULL, *name_, &lookup_);
-  return LoadResult(map_);
+  if (!type_->IsClass()) return true;
+  map()->LookupDescriptor(NULL, *name_, &lookup_);
+  return LoadResult(map());
 }
 
 
 bool HOptimizedGraphBuilder::PropertyAccessInfo::LoadResult(Handle<Map> map) {
   if (lookup_.IsField()) {
     access_ = HObjectAccess::ForField(map, &lookup_, name_);
   } else if (lookup_.IsPropertyCallbacks()) {
     Handle<Object> callback(lookup_.GetValueFromMap(*map), isolate());
     if (!callback->IsAccessorPair()) return false;
     Object* getter = Handle<AccessorPair>::cast(callback)->getter();
     if (!getter->IsJSFunction()) return false;
     Handle<JSFunction> accessor = handle(JSFunction::cast(getter));
     CallOptimization call_optimization(accessor);
     // TODO(dcarney): temporary hack unless crankshaft can handle api calls.
     if (call_optimization.is_simple_api_call()) return false;
     accessor_ = accessor;
   } else if (lookup_.IsConstant()) {
     constant_ = handle(lookup_.GetConstantFromMap(*map), isolate());
   }
 
   return true;
 }
 
 
 bool HOptimizedGraphBuilder::PropertyAccessInfo::LookupInPrototypes() {
-  Handle<Map> map = map_;
+  Handle<Map> map = this->map();
+
   while (map->prototype()->IsJSObject()) {
     holder_ = handle(JSObject::cast(map->prototype()));
     if (holder_->map()->is_deprecated()) {
       JSObject::TryMigrateInstance(holder_);
     }
     map = Handle<Map>(holder_->map());
-    if (!CanInlinePropertyAccess(*map)) {
+    if (!CanInlinePropertyAccess(IC::MapToType(map))) {
       lookup_.NotFound();
       return false;
     }
     map->LookupDescriptor(*holder_, *name_, &lookup_);
     if (lookup_.IsFound()) return LoadResult(map);
   }
   lookup_.NotFound();
   return true;
 }
 
 
 bool HOptimizedGraphBuilder::PropertyAccessInfo::CanLoadMonomorphic() {
-  if (!CanInlinePropertyAccess(*map_)) return IsStringLength();
+  if (!CanInlinePropertyAccess(type_)) return false;
   if (IsJSObjectFieldAccessor()) return true;
   if (!LookupDescriptor()) return false;
   if (lookup_.IsFound()) return true;
   return LookupInPrototypes();
 }
 
 
 bool HOptimizedGraphBuilder::PropertyAccessInfo::CanLoadAsMonomorphic(
     SmallMapList* types) {
-  ASSERT(map_.is_identical_to(types->first()));
+  ASSERT(type_->Is(IC::MapToType(types->first())));
   if (!CanLoadMonomorphic()) return false;
   if (types->length() > kMaxLoadPolymorphism) return false;
 
-  if (IsStringLength()) {
-    for (int i = 1; i < types->length(); ++i) {
-      if (types->at(i)->instance_type() >= FIRST_NONSTRING_TYPE) return false;
-    }
-    return true;
-  }
-
   if (IsArrayLength()) {
-    bool is_fast = IsFastElementsKind(map_->elements_kind());
+    bool is_fast = IsFastElementsKind(map()->elements_kind());
     for (int i = 1; i < types->length(); ++i) {
       Handle<Map> test_map = types->at(i);
       if (test_map->instance_type() != JS_ARRAY_TYPE) return false;
       if (IsFastElementsKind(test_map->elements_kind()) != is_fast) {
         return false;
       }
     }
     return true;
   }
 
-  if (IsJSObjectFieldAccessor()) {
-    InstanceType instance_type = map_->instance_type();
+  HObjectAccess access = HObjectAccess::ForMap();  // bogus default
+  if (GetJSObjectFieldAccess(&access)) {
     for (int i = 1; i < types->length(); ++i) {
-      if (types->at(i)->instance_type() != instance_type) return false;
+      PropertyAccessInfo test_info(
+          builder_, IC::MapToType(types->at(i)), name_);
+      HObjectAccess test_access = HObjectAccess::ForMap();  // bogus default
+      if (!test_info.GetJSObjectFieldAccess(&test_access)) return false;
+      if (!access.Equals(test_access)) return false;
     }
     return true;
   }
 
+  // Currently only handle HeapType::Number as a polymorphic case.
+  // TODO(verwaest): Support monomorphic handling of numbers with a HCheckNumber
+  // instruction.
+  if (type_->Is(HeapType::Number())) return false;
+
   for (int i = 1; i < types->length(); ++i) {
-    PropertyAccessInfo test_info(isolate(), types->at(i), name_);
+    PropertyAccessInfo test_info(builder_, IC::MapToType(types->at(i)), name_);
     if (!test_info.IsCompatibleForLoad(this)) return false;
   }
 
   return true;
 }
 
 
+static bool NeedsWrappingFor(Handle<HeapType> type, Handle<JSFunction> target) {
+  return type->Is(HeapType::NumberOrString()) &&
+      target->shared()->is_classic_mode() &&
+      !target->shared()->native();
+}
+
+
 HInstruction* HOptimizedGraphBuilder::BuildLoadMonomorphic(
     PropertyAccessInfo* info,
     HValue* object,
-    HInstruction* checked_object,
+    HValue* checked_object,
     BailoutId ast_id,
     BailoutId return_id,
     bool can_inline_accessor) {
 
   HObjectAccess access = HObjectAccess::ForMap();  // bogus default
   if (info->GetJSObjectFieldAccess(&access)) {
     return New<HLoadNamedField>(
         checked_object, static_cast<HValue*>(NULL), access);
   }
 
   HValue* checked_holder = checked_object;
   if (info->has_holder()) {
     Handle<JSObject> prototype(JSObject::cast(info->map()->prototype()));
     checked_holder = BuildCheckPrototypeMaps(prototype, info->holder());
   }
 
   if (!info->lookup()->IsFound()) return graph()->GetConstantUndefined();
 
   if (info->lookup()->IsField()) {
     return BuildLoadNamedField(checked_holder, info->access());
   }
 
   if (info->lookup()->IsPropertyCallbacks()) {
-    Push(checked_object);
-    if (FLAG_inline_accessors &&
-        can_inline_accessor &&
-        TryInlineGetter(info->accessor(), ast_id, return_id)) {
-      return NULL;
+    if (NeedsWrappingFor(info->type(), info->accessor())) {
+      return New<HLoadNamedGeneric>(checked_object, info->name());
+      // HValue* function = Add<HConstant>(info->accessor());
+      // Add<HPushArgument>(checked_object);
+      // return New<HCallFunction>(function, 1, WRAP_AND_CALL);
+    } else {
+      Push(checked_object);
+      if (FLAG_inline_accessors &&
+          can_inline_accessor &&
+          TryInlineGetter(info->accessor(), ast_id, return_id)) {
+        return NULL;
+      }
+      Add<HPushArgument>(Pop());
+      return BuildCallConstantFunction(info->accessor(), 1);
     }
-    Add<HPushArgument>(Pop());
-    return BuildCallConstantFunction(info->accessor(), 1);
   }
 
   ASSERT(info->lookup()->IsConstant());
   return New<HConstant>(info->constant());
 }
 
 
 void HOptimizedGraphBuilder::HandlePolymorphicLoadNamedField(
     BailoutId ast_id,
     BailoutId return_id,
     HValue* object,
     SmallMapList* types,
     Handle<String> name) {
   // Something did not match; must use a polymorphic load.
   int count = 0;
   HBasicBlock* join = NULL;
+  HBasicBlock* number_block = NULL;
+
+  bool handle_smi = false;
   for (int i = 0; i < types->length() && count < kMaxLoadPolymorphism; ++i) {
-    PropertyAccessInfo info(isolate(), types->at(i), name);
+    PropertyAccessInfo info(this, IC::MapToType(types->at(i)), name);
     if (info.CanLoadMonomorphic()) {
-      if (count == 0) {
-        BuildCheckHeapObject(object);
-        join = graph()->CreateBasicBlock();
+      count++;
+      if (info.type()->Is(HeapType::Number())) {
+        handle_smi = true;
+        break;
       }
-      ++count;
-      HBasicBlock* if_true = graph()->CreateBasicBlock();
-      HBasicBlock* if_false = graph()->CreateBasicBlock();
-      HCompareMap* compare = New<HCompareMap>(
-          object, info.map(),  if_true, if_false);
-      FinishCurrentBlock(compare);
-
-      set_current_block(if_true);
-
-      HInstruction* load = BuildLoadMonomorphic(
-          &info, object, compare, ast_id, return_id, FLAG_polymorphic_inlining);
-      if (load == NULL) {
-        if (HasStackOverflow()) return;
-      } else {
-        if (!load->IsLinked()) {
-          AddInstruction(load);
-        }
-        if (!ast_context()->IsEffect()) Push(load);
-      }
-
-      if (current_block() != NULL) Goto(join);
-      set_current_block(if_false);
     }
   }
 
+  count = 0;
+  bool handled_string = false;
+  HControlInstruction* smi_check = NULL;
+
+  for (int i = 0; i < types->length() && count < kMaxLoadPolymorphism; ++i) {
+    PropertyAccessInfo info(this, IC::MapToType(types->at(i)), name);
+    if (info.type()->Is(HeapType::String())) {
+      if (handled_string) continue;
+      handled_string = true;
+    }
+    if (!info.CanLoadMonomorphic()) continue;
+
+    if (count == 0) {
+      join = graph()->CreateBasicBlock();
+      if (handle_smi) {
+        HBasicBlock* empty_smi_block = graph()->CreateBasicBlock();
+        HBasicBlock* not_smi_block = graph()->CreateBasicBlock();
+        number_block = graph()->CreateBasicBlock();
+        smi_check = New<HIsSmiAndBranch>(
+            object, empty_smi_block, not_smi_block);
+        FinishCurrentBlock(smi_check);
+        Goto(empty_smi_block, number_block);
+        set_current_block(not_smi_block);
+      } else {
+        BuildCheckHeapObject(object);
+      }
+    }
+    ++count;
+    HBasicBlock* if_true = graph()->CreateBasicBlock();
+    HBasicBlock* if_false = graph()->CreateBasicBlock();
+    HUnaryControlInstruction* compare;
+
+    HValue* dependency;
+    if (info.type()->Is(HeapType::Number())) {
+      Handle<Map> heap_number_map = isolate()->factory()->heap_number_map();
+      compare = New<HCompareMap>(object, heap_number_map, if_true, if_false);
+      dependency = smi_check;
+    } else if (info.type()->Is(HeapType::String())) {
+      compare = New<HIsStringAndBranch>(object, if_true, if_false);
+      dependency = compare;
+    } else {
+      compare = New<HCompareMap>(object, info.map(), if_true, if_false);
+      dependency = compare;
+    }
+    FinishCurrentBlock(compare);
+
+    if (info.type()->Is(HeapType::Number())) {
+      Goto(if_true, number_block);
+      if_true = number_block;
+      number_block->SetJoinId(ast_id);
+    }
+
+    set_current_block(if_true);
+
+    HInstruction* load = BuildLoadMonomorphic(
+        &info, object, dependency, ast_id,
+        return_id, FLAG_polymorphic_inlining);
+    if (load == NULL) {
+      if (HasStackOverflow()) return;
+    } else {
+      if (!load->IsLinked()) {
+        AddInstruction(load);
+      }
+      if (!ast_context()->IsEffect()) Push(load);
+    }
+
+    if (current_block() != NULL) Goto(join);
+    set_current_block(if_false);
+  }
+
   // Finish up.  Unconditionally deoptimize if we've handled all the maps we
   // know about and do not want to handle ones we've never seen.  Otherwise
   // use a generic IC.
   if (count == types->length() && FLAG_deoptimize_uncommon_cases) {
     // Because the deopt may be the only path in the polymorphic load, make sure
     // that the environment stack matches the depth on deopt that it otherwise
     // would have had after a successful load.
     if (!ast_context()->IsEffect()) Push(graph()->GetConstant0());
     FinishExitWithHardDeoptimization("Unknown map in polymorphic load", join);
   } else {
@@ skipping 161 matching lines @@
                                  HValue* receiver,
                                  SmallMapList** t) {
   SmallMapList* types = expr->GetReceiverTypes();
   *t = types;
   bool monomorphic = expr->IsMonomorphic();
   if (types != NULL && receiver->HasMonomorphicJSObjectType()) {
     Map* root_map = receiver->GetMonomorphicJSObjectMap()->FindRootMap();
     types->FilterForPossibleTransitions(root_map);
     monomorphic = types->length() == 1;
   }
-  return monomorphic && CanInlinePropertyAccess(*types->first());
+  return monomorphic && CanInlinePropertyAccess(IC::MapToType(types->first()));
 }
 
 
 void HOptimizedGraphBuilder::BuildStore(Expression* expr,
                                         Property* prop,
                                         BailoutId ast_id,
                                         BailoutId return_id,
                                         bool is_uninitialized) {
   HValue* value = environment()->ExpressionStackAt(0);
 
@@ skipping 26 matching lines @@
   HInstruction* instr = NULL;
 
   SmallMapList* types;
   bool monomorphic = ComputeReceiverTypes(expr, object, &types);
 
   if (monomorphic) {
     Handle<Map> map = types->first();
     Handle<JSFunction> setter;
     Handle<JSObject> holder;
     if (LookupSetter(map, name, &setter, &holder)) {
-      AddCheckConstantFunction(holder, object, map);
-      if (FLAG_inline_accessors &&
-          TryInlineSetter(setter, ast_id, return_id, value)) {
+      AddCheckMap(object, map);
+      AddCheckPrototypeMaps(holder, map);
+      bool needs_wrapping = NeedsWrappingFor(IC::MapToType(map), setter);
+      bool try_inline = FLAG_inline_accessors && !needs_wrapping;
+      if (try_inline && TryInlineSetter(setter, ast_id, return_id, value)) {
         return;
       }
       Drop(2);
-      Add<HPushArgument>(object);
-      Add<HPushArgument>(value);
-      instr = BuildCallConstantFunction(setter, 2);
+      if (needs_wrapping) {
+        instr = BuildStoreNamedGeneric(object, name, value);
+      } else {
+        Add<HPushArgument>(object);
+        Add<HPushArgument>(value);
+        instr = BuildCallConstantFunction(setter, 2);
+      }
     } else {
       Drop(2);
       CHECK_ALIVE(instr = BuildStoreNamedMonomorphic(object,
                                                      name,
                                                      value,
                                                      map));
     }
   } else if (types != NULL && types->length() > 1) {
     Drop(2);
     return HandlePolymorphicStoreNamedField(ast_id, object, value, types, name);
@@ skipping 832 matching lines @@
 
   } else if (expr->key()->IsPropertyName()) {
     Handle<String> name = expr->key()->AsLiteral()->AsPropertyName();
     HValue* object = Pop();
 
     SmallMapList* types;
     ComputeReceiverTypes(expr, object, &types);
     ASSERT(types != NULL);
 
     if (types->length() > 0) {
-      PropertyAccessInfo info(isolate(), types->first(), name);
+      PropertyAccessInfo info(this, IC::MapToType(types->first()), name);
       if (!info.CanLoadAsMonomorphic(types)) {
         return HandlePolymorphicLoadNamedField(
             ast_id, expr->LoadId(), object, types, name);
       }
 
+      HValue* checked_object;
+      // HeapType::Number() is only supported by polymorphic load/call handling.
+      ASSERT(!info.type()->Is(HeapType::Number()));
       BuildCheckHeapObject(object);
-      HInstruction* checked_object;
       if (AreStringTypes(types)) {
         checked_object =
             Add<HCheckInstanceType>(object, HCheckInstanceType::IS_STRING);
       } else {
         checked_object = Add<HCheckMaps>(object, types);
       }
       instr = BuildLoadMonomorphic(
           &info, object, checked_object, ast_id, expr->LoadId());
       if (instr == NULL) return;
       if (instr->IsLinked()) return ast_context()->ReturnValue(instr);
@@ skipping 206 matching lines @@
 }
 
 
 bool HOptimizedGraphBuilder::TryCallPolymorphicAsMonomorphic(
     Call* expr,
     HValue* receiver,
     SmallMapList* types,
     Handle<String> name) {
   if (types->length() > kMaxCallPolymorphism) return false;
 
-  PropertyAccessInfo info(isolate(), types->at(0), name);
+  PropertyAccessInfo info(this, IC::MapToType(types->at(0)), name);
   if (!info.CanLoadAsMonomorphic(types)) return false;
   if (!expr->ComputeTarget(info.map(), name)) return false;
 
   BuildCheckHeapObject(receiver);
   Add<HCheckMaps>(receiver, types);
   AddCheckPrototypeMaps(expr->holder(), info.map());
   if (FLAG_trace_inlining) {
     Handle<JSFunction> caller = current_info()->closure();
     SmartArrayPointer<char> caller_name =
         caller->shared()->DebugName()->ToCString();
@@ skipping 4237 matching lines @@
   if (ShouldProduceTraceOutput()) {
     isolate()->GetHTracer()->TraceHydrogen(name(), graph_);
   }
 
 #ifdef DEBUG
   graph_->Verify(false);  // No full verify.
 #endif
 }
 
 } }  // namespace v8::internal