Add faster, but unsafe version of LoadInternalField.

src/fast-accessor-assembler.cc

 // Copyright 2015 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/fast-accessor-assembler.h"
 
 #include "src/base/logging.h"
 #include "src/code-stub-assembler.h"
 #include "src/code-stubs.h"  // For CallApiCallbackStub.
 #include "src/handles-inl.h"
@@ skipping 73 matching lines @@
   assembler_->Bind(&is_not_jsobject);
   Node* fail_value = assembler_->UndefinedConstant();
   result.Bind(fail_value);
   assembler_->Goto(&merge);
 
   // Return.
   assembler_->Bind(&merge);
   return FromRaw(result.value());
 }
 
+FastAccessorAssembler::ValueId FastAccessorAssembler::LoadInternalFieldUnsafe(

[vogelheim, 2016/07/27 09:50:56]

I briefly discussed handling the LoadInternalField[Unsafe] variants. How about
we change it like this:

1, we'll have both versions, LoadInternalFieldChecked and
LoadInternalFieldUnsafe.

2, There's a FLAG_debug_code, that we use elsewhere to instruct the compiler to
emit additional runtime checks (and crash if they fail). If this is set, we'll
still check the assumptions in the *Unsafe case. That way, users of *Unsafe
still have some reasonable means to guard themselves against errors.

(FLAG_debug_code is hugely helpful for testing, since it allows us to run our
entire test suite (+ all the fuzzers) and check some of the implicit
assumptions.)

So: LoadInternalFieldChecked does all the checks, and returns Undefined, as it
currently does. LoadInternalFieldUnchecked does - if FLAG_debug_code is true -
the same checks, but CRASH()es when they fail. (This is the signal that fuzzers
+ test infrastructure need.) And if !FLAG_debug_code, it would not do any
checks.

You'll probably want to factor out the actual generating code into suitable
methods.

[Alfonso, 2016/07/28 14:39:13]

The C++ counterpart returns NULL (instead of undefined) if the argument is not a
JSObject.
Refactoring into smaller composable parts.

+    ValueId value, int field_no) {
+  CHECK_EQ(kBuilding, state_);
+  Node* result = assembler_->LoadObjectField(
+      FromId(value), JSObject::kHeaderSize + kPointerSize * field_no,
+      MachineType::Pointer());
+  return FromRaw(result);
+}
+
 FastAccessorAssembler::ValueId FastAccessorAssembler::LoadValue(ValueId value,
                                                                 int offset) {
   CHECK_EQ(kBuilding, state_);
   return FromRaw(assembler_->LoadBufferObject(FromId(value), offset,
                                               MachineType::IntPtr()));
 }
 
 FastAccessorAssembler::ValueId FastAccessorAssembler::LoadObject(ValueId value,
                                                                  int offset) {
   CHECK_EQ(kBuilding, state_);
@@ skipping 125 matching lines @@
 void FastAccessorAssembler::Clear() {
   for (auto label : labels_) {
     delete label;
   }
   nodes_.clear();
   labels_.clear();
 }
 
 }  // namespace internal
 }  // namespace v8