[builtins] implement Array.prototype.includes in TurboFan

src/runtime/runtime-array.cc

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/runtime/runtime-utils.h"
 
 #include "src/arguments.h"
 #include "src/code-stubs.h"
 #include "src/conversions-inl.h"
 #include "src/elements.h"
@@ skipping 14 matching lines @@
   CHECK(length->IsSmi());
   CHECK(Smi::cast(length)->value() == 0);
   CHECK(prototype->HasFastSmiOrObjectElements());
   // This is necessary to enable fast checks for absence of elements
   // on Array.prototype and below.
   prototype->set_elements(isolate->heap()->empty_fixed_array());
   return Smi::FromInt(0);
 }
 
 static void InstallCode(Isolate* isolate, Handle<JSObject> holder,
-                        const char* name, Handle<Code> code) {
+                        const char* name, Handle<Code> code, int argc = -1) {
   Handle<String> key = isolate->factory()->InternalizeUtf8String(name);
   Handle<JSFunction> optimized =
       isolate->factory()->NewFunctionWithoutPrototype(key, code);
-  optimized->shared()->DontAdaptArguments();
+  if (argc < 0) {
+    optimized->shared()->DontAdaptArguments();
+  } else {
+    optimized->shared()->set_internal_formal_parameter_count(argc);
+  }
   JSObject::AddProperty(holder, key, optimized, NONE);
 }
 
 static void InstallBuiltin(Isolate* isolate, Handle<JSObject> holder,
-                           const char* name, Builtins::Name builtin_name) {
+                           const char* name, Builtins::Name builtin_name,
+                           int argc = -1) {
   InstallCode(isolate, holder, name,
-              handle(isolate->builtins()->builtin(builtin_name), isolate));
+              handle(isolate->builtins()->builtin(builtin_name), isolate),
+              argc);
 }
 
 RUNTIME_FUNCTION(Runtime_SpecialArrayFunctions) {
   HandleScope scope(isolate);
   DCHECK(args.length() == 0);
   Handle<JSObject> holder =
       isolate->factory()->NewJSObject(isolate->object_function());
 
   InstallBuiltin(isolate, holder, "pop", Builtins::kArrayPop);
   FastArrayPushStub stub(isolate);
   InstallCode(isolate, holder, "push", stub.GetCode());
   InstallBuiltin(isolate, holder, "shift", Builtins::kArrayShift);
   InstallBuiltin(isolate, holder, "unshift", Builtins::kArrayUnshift);
   InstallBuiltin(isolate, holder, "slice", Builtins::kArraySlice);
   InstallBuiltin(isolate, holder, "splice", Builtins::kArraySplice);
+  InstallBuiltin(isolate, holder, "includes", Builtins::kArrayIncludes, 2);
 
   return *holder;
 }
 
 
 RUNTIME_FUNCTION(Runtime_FixedArrayGet) {
   SealHandleScope shs(isolate);
   DCHECK(args.length() == 2);
   CONVERT_ARG_CHECKED(FixedArray, object, 0);
   CONVERT_SMI_ARG_CHECKED(index, 1);
@@ skipping 359 matching lines @@
 
 
 RUNTIME_FUNCTION(Runtime_ArraySpeciesConstructor) {
   HandleScope scope(isolate);
   DCHECK(args.length() == 1);
   CONVERT_ARG_HANDLE_CHECKED(Object, original_array, 0);
   RETURN_RESULT_OR_FAILURE(
       isolate, Object::ArraySpeciesConstructor(isolate, original_array));
 }
 
+// ES7 22.1.3.11 Array.prototype.includes
+RUNTIME_FUNCTION(Runtime_ArrayIncludes_Slow) {
+  HandleScope shs(isolate);
+  DCHECK(args.length() == 3);
+  CONVERT_ARG_HANDLE_CHECKED(Object, search_element, 1);
+  CONVERT_ARG_HANDLE_CHECKED(Object, from_index_, 2);
+
+  // 1. Let O be ? ToObject(this value).
+  Handle<JSReceiver> object;
+  ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
+      isolate, object, Object::ToObject(isolate, handle(args[0], isolate)));
+
+  // 2. Let len be ? ToLength(? Get(O, "length")).
+  Handle<Object> len_;
+  Handle<String> length_string =
+      handle(isolate->heap()->length_string(), isolate);
+  ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
+      isolate, len_, Object::GetProperty(object, length_string));
+  ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, len_,
+                                     Object::ToLength(isolate, len_));
+  int64_t len = static_cast<int64_t>(len_->Number());
+  DCHECK_EQ(len, len_->Number());
+
+  // 3. If len is 0, return false.
+  if (len == 0) return isolate->heap()->false_value();
+
+  // 4. Let n be ? ToInteger(fromIndex). (If fromIndex is undefined,
+  //    this step produces the value 0.)
+  ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, from_index_,
+                                     Object::ToInteger(isolate, from_index_));
+  if (std::isinf(from_index_->Number()) && from_index_->Number() > 0.0) {
+    return isolate->heap()->false_value();
+  }
+  int64_t from_index = static_cast<int64_t>(from_index_->Number());
+
+  int64_t k;
+  if (from_index >= 0) {
+    k = from_index;
+  } else {
+    k = len + from_index;
+    if (k < 0) {
+      k = 0;
+    }
+  }
+

[Camillo Bruni, 2016/07/19 12:08:38]

Maybe let's postpone this to a followup CL: 
With your CL you will hit a performance cliff for dictionary-elements JSArrays
since you will try to do a full lookup for all the dict elements. This has two
disadvantages, 1. dictionaries are sparse, so you will do more lookups than
necessary, 2. for each lookup you will instantiate a lookup iterator.

I'd suggest to add a prototype-check for the receiver to see whether it has a
valid JSArray prototype and then implement the fast-path in elements.cc to only
perform a minimal amount of fast lookups.

The slow path below would still stay and deal with all sorts of exotic
array-like objects.

+  if (IsFastPackedElementsKind(object->map()->elements_kind()) &&
+      len < std::numeric_limits<uint32_t>::max()) {

[Camillo Bruni, 2016/07/19 12:08:38]

this "fast-path" is not needed, see comments below.

+    uint32_t i = static_cast<uint32_t>(k);
+    for (; i < static_cast<uint32_t>(len); ++i) {
+      Handle<Object> element_k;
+      ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
+          isolate, element_k, Object::GetElement(isolate, object, i));
+      if (search_element->SameValueZero(*element_k)) {
+        return isolate->heap()->true_value();
+      }
+    }
+    return isolate->heap()->false_value();
+  }
+
+  bool stable = !object->IsJSProxy() &&
+                IsFastElementsKind(object->map()->elements_kind());

[Camillo Bruni, 2016/07/19 12:08:38]

- the stable bool is not necessary GetElement (LookupIterator) will convert the
index to name if it finds a proxy.
- The LookupIterator will just work fine for dictionary elements (it will avoid
the toString conversion for k for valid element indices on arrays, which are the
ones handled by the elements backing store).

I hope I didn't miss anything here...

[caitp, 2016/07/20 16:07:55]

Acknowledged. Will shrink the runtime version a lot then =)

+  Handle<Map> original_map = handle(object->map(), isolate);
+  for (; k < len; ++k) {
+    Handle<Object> element_k;
+    if (stable && k < std::numeric_limits<uint32_t>::max()) {
+      uint32_t index = static_cast<uint32_t>(k);
+      ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
+          isolate, element_k, Object::GetElement(isolate, object, index));

[Camillo Bruni, 2016/07/19 12:08:38]

Nit: JSReceiver::GetElement (doesn't change anything, but makes the implication
that  `object` is a JSReceiver clear)

+      stable = object->map() == *original_map;
+    } else {
+      Handle<String> name;
+      Handle<Object> num =
+          isolate->factory()->NewNumber(static_cast<double>(k));
+      ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, name,
+                                         Object::ToString(isolate, num));
+      ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
+          isolate, element_k, Object::GetPropertyOrElement(object, name));
+    }
+
+    if (search_element->SameValueZero(*element_k)) {
+      return isolate->heap()->true_value();
+    }
+  }
+  return isolate->heap()->false_value();
+}
+
 }  // namespace internal
 }  // namespace v8