[crankshaft] Loads and stores to typed arrays have to reference the backing store holder

src/crankshaft/hydrogen-instructions.h

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef V8_CRANKSHAFT_HYDROGEN_INSTRUCTIONS_H_
 #define V8_CRANKSHAFT_HYDROGEN_INSTRUCTIONS_H_
 
 #include <cstring>
 #include <iosfwd>
 
@@ skipping 908 matching lines @@
                 P3 p3, P4 p4, P5 p5) {                                       \
     return new (zone) I(p1, p2, p3, p4, p5);                                 \
   }
 
 #define DECLARE_INSTRUCTION_FACTORY_P6(I, P1, P2, P3, P4, P5, P6)            \
   static I* New(Isolate* isolate, Zone* zone, HValue* context, P1 p1, P2 p2, \
                 P3 p3, P4 p4, P5 p5, P6 p6) {                                \
     return new (zone) I(p1, p2, p3, p4, p5, p6);                             \
   }
 
+#define DECLARE_INSTRUCTION_FACTORY_P7(I, P1, P2, P3, P4, P5, P6, P7)        \
+  static I* New(Isolate* isolate, Zone* zone, HValue* context, P1 p1, P2 p2, \
+                P3 p3, P4 p4, P5 p5, P6 p6, P7 p7) {                         \
+    return new (zone) I(p1, p2, p3, p4, p5, p6, p7);                         \
+  }
+
 #define DECLARE_INSTRUCTION_WITH_CONTEXT_FACTORY_P0(I)           \
   static I* New(Isolate* isolate, Zone* zone, HValue* context) { \
     return new (zone) I(context);                                \
   }
 
 #define DECLARE_INSTRUCTION_WITH_CONTEXT_FACTORY_P1(I, P1)              \
   static I* New(Isolate* isolate, Zone* zone, HValue* context, P1 p1) { \
     return new (zone) I(context, p1);                                   \
   }
 
@@ skipping 5561 matching lines @@
 
 static const int kDefaultKeyedHeaderOffsetSentinel = -1;
 
 enum LoadKeyedHoleMode {
   NEVER_RETURN_HOLE,
   ALLOW_RETURN_HOLE,
   CONVERT_HOLE_TO_UNDEFINED
 };
 
 
-class HLoadKeyed final : public HTemplateInstruction<3>,
+class HLoadKeyed final : public HTemplateInstruction<4>,
                          public ArrayInstructionInterface {
  public:
-  DECLARE_INSTRUCTION_FACTORY_P4(HLoadKeyed, HValue*, HValue*, HValue*,
+  DECLARE_INSTRUCTION_FACTORY_P5(HLoadKeyed, HValue*, HValue*, HValue*, HValue*,
                                  ElementsKind);
-  DECLARE_INSTRUCTION_FACTORY_P5(HLoadKeyed, HValue*, HValue*, HValue*,
+  DECLARE_INSTRUCTION_FACTORY_P6(HLoadKeyed, HValue*, HValue*, HValue*, HValue*,
                                  ElementsKind, LoadKeyedHoleMode);
-  DECLARE_INSTRUCTION_FACTORY_P6(HLoadKeyed, HValue*, HValue*, HValue*,
+  DECLARE_INSTRUCTION_FACTORY_P7(HLoadKeyed, HValue*, HValue*, HValue*, HValue*,
                                  ElementsKind, LoadKeyedHoleMode, int);
 
   bool is_fixed_typed_array() const {
     return IsFixedTypedArrayElementsKind(elements_kind());
   }
   HValue* elements() const { return OperandAt(0); }
   HValue* key() const { return OperandAt(1); }
   HValue* dependency() const {
     DCHECK(HasDependency());
     return OperandAt(2);
   }
   bool HasDependency() const { return OperandAt(0) != OperandAt(2); }
+  HValue* backing_store_owner() const {
+    DCHECK(HasBackingStoreOwner());
+    return OperandAt(3);
+  }
+  bool HasBackingStoreOwner() const { return OperandAt(0) != OperandAt(3); }
   uint32_t base_offset() const { return BaseOffsetField::decode(bit_field_); }
   bool TryIncreaseBaseOffset(uint32_t increase_by_value) override;
   HValue* GetKey() override { return key(); }
   void SetKey(HValue* key) override { SetOperandAt(1, key); }
   bool IsDehoisted() const override {
     return IsDehoistedField::decode(bit_field_);
   }
   void SetDehoisted(bool is_dehoisted) override {
     bit_field_ = IsDehoistedField::update(bit_field_, is_dehoisted);
   }
@@ skipping 10 matching lines @@
     // kind_fixed_typed_array:    external[int32] (none)
     // kind_external:             external[int32] (none)
     if (index == 0) {
       return is_fixed_typed_array() ? Representation::External()
                                     : Representation::Tagged();
     }
     if (index == 1) {
       return ArrayInstructionInterface::KeyedAccessIndexRequirement(
           OperandAt(1)->representation());
     }
-    return Representation::None();
+    if (index == 2) {
+      return Representation::None();
+    }
+    DCHECK_EQ(3, index);
+    return HasBackingStoreOwner() ? Representation::Tagged()
+                                  : Representation::None();
   }
 
   Representation observed_input_representation(int index) override {
     return RequiredInputRepresentation(index);
   }
 
   std::ostream& PrintDataTo(std::ostream& os) const override;  // NOLINT
 
   bool UsesMustHandleHole() const;
   bool AllUsesCanTreatHoleAsNaN() const;
   bool RequiresHoleCheck() const;
 
   Range* InferRange(Zone* zone) override;
 
   DECLARE_CONCRETE_INSTRUCTION(LoadKeyed)
 
  protected:
   bool DataEquals(HValue* other) override {
     if (!other->IsLoadKeyed()) return false;
     HLoadKeyed* other_load = HLoadKeyed::cast(other);
 
     if (base_offset() != other_load->base_offset()) return false;
     return elements_kind() == other_load->elements_kind();
   }
 
  private:
   HLoadKeyed(HValue* obj, HValue* key, HValue* dependency,
-             ElementsKind elements_kind,
+             HValue* backing_store_owner, ElementsKind elements_kind,
              LoadKeyedHoleMode mode = NEVER_RETURN_HOLE,
              int offset = kDefaultKeyedHeaderOffsetSentinel)
       : bit_field_(0) {
     offset = offset == kDefaultKeyedHeaderOffsetSentinel
         ? GetDefaultHeaderSizeForElementsKind(elements_kind)
         : offset;
     bit_field_ = ElementsKindField::encode(elements_kind) |
         HoleModeField::encode(mode) |
         BaseOffsetField::encode(offset);
 
     SetOperandAt(0, obj);
     SetOperandAt(1, key);
-    SetOperandAt(2, dependency != NULL ? dependency : obj);
+    SetOperandAt(2, dependency != nullptr ? dependency : obj);
+    SetOperandAt(3, backing_store_owner != nullptr ? backing_store_owner : obj);
+    DCHECK_EQ(HasBackingStoreOwner(), is_fixed_typed_array());
 
     if (!is_fixed_typed_array()) {
       // I can detect the case between storing double (holey and fast) and
       // smi/object by looking at elements_kind_.
       DCHECK(IsFastSmiOrObjectElementsKind(elements_kind) ||
              IsFastDoubleElementsKind(elements_kind));
 
       if (IsFastSmiOrObjectElementsKind(elements_kind)) {
         if (IsFastSmiElementsKind(elements_kind) &&
             (!IsHoleyElementsKind(elements_kind) ||
@@ skipping 332 matching lines @@
   }
 
   Handle<Name> name_;
   Handle<TypeFeedbackVector> feedback_vector_;
   FeedbackVectorSlot slot_;
   LanguageMode language_mode_;
   InlineCacheState initialization_state_;
 };
 
 
-class HStoreKeyed final : public HTemplateInstruction<3>,
+class HStoreKeyed final : public HTemplateInstruction<4>,
                           public ArrayInstructionInterface {
  public:
-  DECLARE_INSTRUCTION_FACTORY_P4(HStoreKeyed, HValue*, HValue*, HValue*,
-                                 ElementsKind);
   DECLARE_INSTRUCTION_FACTORY_P5(HStoreKeyed, HValue*, HValue*, HValue*,
-                                 ElementsKind, StoreFieldOrKeyedMode);
+                                 HValue*, ElementsKind);
   DECLARE_INSTRUCTION_FACTORY_P6(HStoreKeyed, HValue*, HValue*, HValue*,
-                                 ElementsKind, StoreFieldOrKeyedMode, int);
+                                 HValue*, ElementsKind, StoreFieldOrKeyedMode);
+  DECLARE_INSTRUCTION_FACTORY_P7(HStoreKeyed, HValue*, HValue*, HValue*,
+                                 HValue*, ElementsKind, StoreFieldOrKeyedMode,
+                                 int);
 
   Representation RequiredInputRepresentation(int index) override {
     // kind_fast:               tagged[int32] = tagged
     // kind_double:             tagged[int32] = double
     // kind_smi   :             tagged[int32] = smi
     // kind_fixed_typed_array:  tagged[int32] = (double | int32)
     // kind_external:           external[int32] = (double | int32)
     if (index == 0) {
       return is_fixed_typed_array() ? Representation::External()
                                     : Representation::Tagged();
     } else if (index == 1) {
       return ArrayInstructionInterface::KeyedAccessIndexRequirement(
           OperandAt(1)->representation());
+    } else if (index == 2) {
+      return RequiredValueRepresentation(elements_kind(), store_mode());
     }
 
-    DCHECK_EQ(index, 2);
-    return RequiredValueRepresentation(elements_kind(), store_mode());
+    DCHECK_EQ(3, index);
+    return HasBackingStoreOwner() ? Representation::Tagged()
+                                  : Representation::None();
   }
 
   static Representation RequiredValueRepresentation(
       ElementsKind kind, StoreFieldOrKeyedMode mode) {
     if (IsDoubleOrFloatElementsKind(kind)) {
       return Representation::Double();
     }
 
     if (kind == FAST_SMI_ELEMENTS && SmiValuesAre32Bits() &&
         mode == STORE_TO_INITIALIZED_ENTRY) {
       return Representation::Integer32();
     }
 
     if (IsFastSmiElementsKind(kind)) {
       return Representation::Smi();
     }
 
     if (IsFixedTypedArrayElementsKind(kind)) {
       return Representation::Integer32();
     }
     return Representation::Tagged();
   }
 
   bool is_fixed_typed_array() const {
     return IsFixedTypedArrayElementsKind(elements_kind());
   }
 
   Representation observed_input_representation(int index) override {
-    if (index < 2) return RequiredInputRepresentation(index);
+    if (index != 2) return RequiredInputRepresentation(index);
     if (IsUninitialized()) {
       return Representation::None();
     }
     Representation r =
         RequiredValueRepresentation(elements_kind(), store_mode());
     // For fast object elements kinds, don't assume anything.
     if (r.IsTagged()) return Representation::None();
     return r;
   }
 
   HValue* elements() const { return OperandAt(0); }
   HValue* key() const { return OperandAt(1); }
   HValue* value() const { return OperandAt(2); }
+  HValue* backing_store_owner() const {
+    DCHECK(HasBackingStoreOwner());
+    return OperandAt(3);
+  }
+  bool HasBackingStoreOwner() const { return OperandAt(0) != OperandAt(3); }
   bool value_is_smi() const { return IsFastSmiElementsKind(elements_kind()); }
   StoreFieldOrKeyedMode store_mode() const {
     return StoreModeField::decode(bit_field_);
   }
   ElementsKind elements_kind() const override {
     return ElementsKindField::decode(bit_field_);
   }
   uint32_t base_offset() const { return base_offset_; }
   bool TryIncreaseBaseOffset(uint32_t increase_by_value) override;
   HValue* GetKey() override { return key(); }
@@ skipping 35 matching lines @@
     return PointersToHereCheckForObject(value(), dominator());
   }
 
   bool NeedsCanonicalization();
 
   std::ostream& PrintDataTo(std::ostream& os) const override;  // NOLINT
 
   DECLARE_CONCRETE_INSTRUCTION(StoreKeyed)
 
  private:
-  HStoreKeyed(HValue* obj, HValue* key, HValue* val, ElementsKind elements_kind,
+  HStoreKeyed(HValue* obj, HValue* key, HValue* val,
+              HValue* backing_store_owner, ElementsKind elements_kind,
               StoreFieldOrKeyedMode store_mode = INITIALIZING_STORE,
               int offset = kDefaultKeyedHeaderOffsetSentinel)
       : base_offset_(offset == kDefaultKeyedHeaderOffsetSentinel
                          ? GetDefaultHeaderSizeForElementsKind(elements_kind)
                          : offset),
         bit_field_(IsDehoistedField::encode(false) |
                    IsUninitializedField::encode(false) |
                    StoreModeField::encode(store_mode) |
                    ElementsKindField::encode(elements_kind)),
         dominator_(NULL) {
     SetOperandAt(0, obj);
     SetOperandAt(1, key);
     SetOperandAt(2, val);
+    SetOperandAt(3, backing_store_owner != nullptr ? backing_store_owner : obj);
+    DCHECK_EQ(HasBackingStoreOwner(), is_fixed_typed_array());
 
     if (IsFastObjectElementsKind(elements_kind)) {
       SetFlag(kTrackSideEffectDominators);
       SetDependsOnFlag(kNewSpacePromotion);
     }
     if (IsFastDoubleElementsKind(elements_kind)) {
       SetChangesFlag(kDoubleArrayElements);
     } else if (IsFastSmiElementsKind(elements_kind)) {
       SetChangesFlag(kArrayElements);
     } else if (is_fixed_typed_array()) {
@@ skipping 710 matching lines @@
 
 
 
 #undef DECLARE_INSTRUCTION
 #undef DECLARE_CONCRETE_INSTRUCTION
 
 }  // namespace internal
 }  // namespace v8
 
 #endif  // V8_CRANKSHAFT_HYDROGEN_INSTRUCTIONS_H_