[turbofan] Add support for accessor inlining.

src/compiler/js-native-context-specialization.cc

 // Copyright 2015 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/compiler/js-native-context-specialization.h"
 
 #include "src/accessors.h"
 #include "src/code-factory.h"
 #include "src/compilation-dependencies.h"
 #include "src/compiler/access-builder.h"
@@ skipping 92 matching lines @@
 
 Reduction JSNativeContextSpecialization::ReduceNamedAccess(
     Node* node, Node* value, MapHandleList const& receiver_maps,
     Handle<Name> name, AccessMode access_mode, LanguageMode language_mode,
     Node* index) {
   DCHECK(node->opcode() == IrOpcode::kJSLoadNamed ||
          node->opcode() == IrOpcode::kJSStoreNamed ||
          node->opcode() == IrOpcode::kJSLoadProperty ||
          node->opcode() == IrOpcode::kJSStoreProperty);
   Node* receiver = NodeProperties::GetValueInput(node, 0);
+  Node* context = NodeProperties::GetContextInput(node);
+  Node* frame_state_eager = NodeProperties::FindFrameStateBefore(node);
+  Node* frame_state_lazy = NodeProperties::GetFrameStateInput(node, 0);
   Node* effect = NodeProperties::GetEffectInput(node);
   Node* control = NodeProperties::GetControlInput(node);
 
   // Not much we can do if deoptimization support is disabled.
   if (!(flags() & kDeoptimizationEnabled)) return NoChange();
 
   // Retrieve the native context from the given {node}.
   Handle<Context> native_context;
   if (!GetNativeContext(node).ToHandle(&native_context)) return NoChange();
 
@@ skipping 32 matching lines @@
       receiver = effect = graph()->NewNode(simplified()->CheckNumber(),
                                            receiver, effect, control);
     } else {
       // Monomorphic property access.
       effect = BuildCheckTaggedPointer(receiver, effect, control);
       effect = BuildCheckMaps(receiver, effect, control,
                               access_info.receiver_maps());
     }
 
     // Generate the actual property access.
-    ValueEffectControl continuation =
-        BuildPropertyAccess(receiver, value, effect, control, name,
-                            native_context, access_info, access_mode);
+    ValueEffectControl continuation = BuildPropertyAccess(
+        receiver, value, context, frame_state_lazy, effect, control, name,
+        native_context, access_info, access_mode);
     value = continuation.value();
     effect = continuation.effect();
     control = continuation.control();
   } else {
     // The final states for every polymorphic branch. We join them with
     // Merge+Phi+EffectPhi at the bottom.
     ZoneVector<Node*> values(zone());
     ZoneVector<Node*> effects(zone());
     ZoneVector<Node*> controls(zone());
 
@@ skipping 65 matching lines @@
         // The Number case requires special treatment to also deal with Smis.
         if (HasNumberMaps(receiver_maps)) {
           // Join this check with the "receiver is smi" check above.
           DCHECK_NOT_NULL(receiverissmi_effect);
           DCHECK_NOT_NULL(receiverissmi_control);
           this_effects.push_back(receiverissmi_effect);
           this_controls.push_back(receiverissmi_control);
           receiverissmi_effect = receiverissmi_control = nullptr;
         }
 
-        // Create dominating Merge+EffectPhi for this {receiver} type.
+        // Create single chokepoint for the control.
         int const this_control_count = static_cast<int>(this_controls.size());
-        this_control =
-            (this_control_count == 1)
-                ? this_controls.front()
-                : graph()->NewNode(common()->Merge(this_control_count),
-                                   this_control_count, &this_controls.front());
-        this_effects.push_back(this_control);
-        int const this_effect_count = static_cast<int>(this_effects.size());
-        this_effect =
-            (this_control_count == 1)
-                ? this_effects.front()
-                : graph()->NewNode(common()->EffectPhi(this_control_count),
-                                   this_effect_count, &this_effects.front());
+        if (this_control_count == 1) {
+          this_control = this_controls.front();
+          this_effect = this_effects.front();
+        } else {
+          this_control =
+              graph()->NewNode(common()->Merge(this_control_count),
+                               this_control_count, &this_controls.front());
+          this_effects.push_back(this_control);
+          this_effect =
+              graph()->NewNode(common()->EffectPhi(this_control_count),
+                               this_control_count + 1, &this_effects.front());
+
+          // TODO(turbofan): The effect/control linearization will not find a
+          // FrameState after the EffectPhi that is generated above.
+          this_effect =
+              graph()->NewNode(common()->Checkpoint(), frame_state_eager,
+                               this_effect, this_control);
+        }
       }
 
       // Generate the actual property access.
       ValueEffectControl continuation = BuildPropertyAccess(
-          this_receiver, this_value, this_effect, this_control, name,
-          native_context, access_info, access_mode);
+          this_receiver, this_value, context, frame_state_lazy, this_effect,
+          this_control, name, native_context, access_info, access_mode);
       values.push_back(continuation.value());
       effects.push_back(continuation.effect());
       controls.push_back(continuation.control());
     }
 
     DCHECK_NULL(fallthrough_control);
 
     // Generate the final merge point for all (polymorphic) branches.
     int const control_count = static_cast<int>(controls.size());
     if (control_count == 0) {
@@ skipping 265 matching lines @@
         } else {
           this_control =
               graph()->NewNode(common()->Merge(this_control_count),
                                this_control_count, &this_controls.front());
           this_effects.push_back(this_control);
           this_effect =
               graph()->NewNode(common()->EffectPhi(this_control_count),
                                this_control_count + 1, &this_effects.front());
 
           // TODO(turbofan): The effect/control linearization will not find a
-          // FrameState after the StoreField or Call that is generated for the
-          // elements kind transition above. This is because those operators
-          // don't have the kNoWrite flag on it, even though they are not
-          // observable by JavaScript.
+          // FrameState after the EffectPhi that is generated above.
           this_effect = graph()->NewNode(common()->Checkpoint(), frame_state,
                                          this_effect, this_control);
         }
       }
 
       // Certain stores need a prototype chain check because shape changes
       // could allow callbacks on elements in the prototype chain that are
       // not compatible with (monomorphic) keyed stores.
       Handle<JSObject> holder;
       if (access_info.holder().ToHandle(&holder)) {
@@ skipping 155 matching lines @@
   // Extract the keyed access store mode from the KEYED_STORE_IC.
   KeyedAccessStoreMode store_mode = nexus.GetKeyedAccessStoreMode();
 
   // Try to lower the keyed access based on the {nexus}.
   return ReduceKeyedAccess(node, index, value, nexus, AccessMode::kStore,
                            p.language_mode(), store_mode);
 }
 
 JSNativeContextSpecialization::ValueEffectControl
 JSNativeContextSpecialization::BuildPropertyAccess(
-    Node* receiver, Node* value, Node* effect, Node* control, Handle<Name> name,
-    Handle<Context> native_context, PropertyAccessInfo const& access_info,
-    AccessMode access_mode) {
+    Node* receiver, Node* value, Node* context, Node* frame_state, Node* effect,
+    Node* control, Handle<Name> name, Handle<Context> native_context,
+    PropertyAccessInfo const& access_info, AccessMode access_mode) {
   // Determine actual holder and perform prototype chain checks.
   Handle<JSObject> holder;
   if (access_info.holder().ToHandle(&holder)) {
     AssumePrototypesStable(access_info.receiver_maps(), native_context, holder);
   }
 
   // Generate the actual property access.
   if (access_info.IsNotFound()) {
     DCHECK_EQ(AccessMode::kLoad, access_mode);
     value = jsgraph()->UndefinedConstant();
   } else if (access_info.IsDataConstant()) {
     value = jsgraph()->Constant(access_info.constant());
     if (access_mode == AccessMode::kStore) {
       Node* check = graph()->NewNode(
           simplified()->ReferenceEqual(Type::Tagged()), value, value);
       effect =
           graph()->NewNode(simplified()->CheckIf(), check, effect, control);
     }
+  } else if (access_info.IsAccessorConstant()) {
+    // TODO(bmeurer): Properly rewire the IfException edge here if there's any.
+    Node* target = jsgraph()->Constant(access_info.constant());
+    FrameStateInfo const& frame_info = OpParameter<FrameStateInfo>(frame_state);
+    Handle<SharedFunctionInfo> shared_info =
+        frame_info.shared_info().ToHandleChecked();
+    switch (access_mode) {
+      case AccessMode::kLoad: {
+        // We need a FrameState for the getter stub to restore the correct
+        // context before returning to fullcodegen.
+        FrameStateFunctionInfo const* frame_info0 =
+            common()->CreateFrameStateFunctionInfo(FrameStateType::kGetterStub,
+                                                   1, 0, shared_info);
+        Node* frame_state0 = graph()->NewNode(
+            common()->FrameState(BailoutId::None(),
+                                 OutputFrameStateCombine::Ignore(),
+                                 frame_info0),
+            graph()->NewNode(common()->StateValues(1), receiver),
+            jsgraph()->EmptyStateValues(), jsgraph()->EmptyStateValues(),
+            context, target, frame_state);
+
+        // Introduce the call to the getter function.
+        value = effect = graph()->NewNode(
+            javascript()->CallFunction(
+                2, VectorSlotPair(), ConvertReceiverMode::kNotNullOrUndefined),
+            target, receiver, context, frame_state0, effect, control);
+        control = graph()->NewNode(common()->IfSuccess(), value);
+        break;
+      }
+      case AccessMode::kStore: {
+        // We need a FrameState for the setter stub to restore the correct
+        // context and return the appropriate value to fullcodegen.
+        FrameStateFunctionInfo const* frame_info0 =
+            common()->CreateFrameStateFunctionInfo(FrameStateType::kSetterStub,
+                                                   2, 0, shared_info);
+        Node* frame_state0 = graph()->NewNode(
+            common()->FrameState(BailoutId::None(),
+                                 OutputFrameStateCombine::Ignore(),
+                                 frame_info0),
+            graph()->NewNode(common()->StateValues(2), receiver, value),
+            jsgraph()->EmptyStateValues(), jsgraph()->EmptyStateValues(),
+            context, target, frame_state);
+
+        // Introduce the call to the setter function.
+        effect = graph()->NewNode(
+            javascript()->CallFunction(
+                3, VectorSlotPair(), ConvertReceiverMode::kNotNullOrUndefined),
+            target, receiver, value, context, frame_state0, effect, control);
+        control = graph()->NewNode(common()->IfSuccess(), effect);
+        break;
+      }
+    }
   } else {
     DCHECK(access_info.IsDataField());
     FieldIndex const field_index = access_info.field_index();
     Type* const field_type = access_info.field_type();
     if (access_mode == AccessMode::kLoad &&
         access_info.holder().ToHandle(&holder)) {
       receiver = jsgraph()->Constant(holder);
     }
     Node* storage = receiver;
     if (!field_index.is_inobject()) {
@@ skipping 425 matching lines @@
 }
 
 
 SimplifiedOperatorBuilder* JSNativeContextSpecialization::simplified() const {
   return jsgraph()->simplified();
 }
 
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8