[turbofan] Add support for copy-on-write element stores.

src/compiler/js-native-context-specialization.cc

 // Copyright 2015 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/compiler/js-native-context-specialization.h"
 
 #include "src/accessors.h"
 #include "src/code-factory.h"
 #include "src/compilation-dependencies.h"
 #include "src/compiler/access-builder.h"
@@ skipping 410 matching lines @@
   Node* receiver = NodeProperties::GetValueInput(node, 0);
   Node* effect = NodeProperties::GetEffectInput(node);
   Node* control = NodeProperties::GetControlInput(node);
   Node* frame_state = NodeProperties::FindFrameStateBefore(node);
 
   // Not much we can do if deoptimization support is disabled.
   if (!(flags() & kDeoptimizationEnabled)) return NoChange();
 
   // TODO(bmeurer): Add support for non-standard stores.
   if (store_mode != STANDARD_STORE &&
+      store_mode != STORE_NO_TRANSITION_HANDLE_COW &&
       store_mode != STORE_NO_TRANSITION_IGNORE_OUT_OF_BOUNDS) {
     return NoChange();
   }
 
   // Retrieve the native context from the given {node}.
   Handle<Context> native_context;
   if (!GetNativeContext(node).ToHandle(&native_context)) return NoChange();
 
   // Compute element access infos for the receiver maps.
   AccessInfoFactory access_info_factory(dependencies(), native_context,
@@ skipping 512 matching lines @@
   ElementsKind elements_kind = access_info.elements_kind();
   MapList const& receiver_maps = access_info.receiver_maps();
 
   // Load the elements for the {receiver}.
   Node* elements = effect = graph()->NewNode(
       simplified()->LoadField(AccessBuilder::ForJSObjectElements()), receiver,
       effect, control);
 
   // Don't try to store to a copy-on-write backing store.
   if (access_mode == AccessMode::kStore &&
-      IsFastSmiOrObjectElementsKind(elements_kind)) {
-    effect = graph()->NewNode(
-        simplified()->CheckMaps(1), elements,
-        jsgraph()->HeapConstant(factory()->fixed_array_map()), effect, control);
+      IsFastSmiOrObjectElementsKind(elements_kind) &&
+      store_mode != STORE_NO_TRANSITION_HANDLE_COW) {
+    effect =
+        graph()->NewNode(simplified()->CheckMaps(1), elements,
+                         jsgraph()->FixedArrayMapConstant(), effect, control);
   }
 
   if (IsFixedTypedArrayElementsKind(elements_kind)) {
     // Load the {receiver}s length.
     Node* length = effect = graph()->NewNode(
         simplified()->LoadField(AccessBuilder::ForJSTypedArrayLength()),
         receiver, effect, control);
 
     // Check if the {receiver}s buffer was neutered.
     Node* buffer = effect = graph()->NewNode(
@@ skipping 83 matching lines @@
           DCHECK_EQ(STANDARD_STORE, store_mode);
           effect = graph()->NewNode(
               simplified()->StoreTypedElement(external_array_type), buffer,
               base_pointer, external_pointer, index, value, effect, control);
         }
         break;
       }
     }
   } else {
     // TODO(turbofan): Add support for additional store modes.
-    DCHECK_EQ(STANDARD_STORE, store_mode);
+    DCHECK(store_mode == STANDARD_STORE ||
+           store_mode == STORE_NO_TRANSITION_HANDLE_COW);
 
     // Load the length of the {receiver}.
     Node* length = effect =
         HasOnlyJSArrayMaps(receiver_maps)
             ? graph()->NewNode(
                   simplified()->LoadField(
                       AccessBuilder::ForJSArrayLength(elements_kind)),
                   receiver, effect, control)
             : graph()->NewNode(
                   simplified()->LoadField(AccessBuilder::ForFixedArrayLength()),
@@ skipping 59 matching lines @@
       DCHECK_EQ(AccessMode::kStore, access_mode);
       if (IsFastSmiElementsKind(elements_kind)) {
         value = effect = graph()->NewNode(simplified()->CheckTaggedSigned(),
                                           value, effect, control);
       } else if (IsFastDoubleElementsKind(elements_kind)) {
         value = effect = graph()->NewNode(simplified()->CheckNumber(), value,
                                           effect, control);
         // Make sure we do not store signalling NaNs into double arrays.
         value = graph()->NewNode(simplified()->NumberSilenceNaN(), value);
       }
+
+      // Ensure that copy-on-write backing store is writable.
+      if (IsFastSmiOrObjectElementsKind(elements_kind) &&
+          store_mode == STORE_NO_TRANSITION_HANDLE_COW) {
+        elements = effect =
+            graph()->NewNode(simplified()->EnsureWritableFastElements(),
+                             receiver, elements, effect, control);
+      }
+
+      // Perform the actual element access.
       effect = graph()->NewNode(simplified()->StoreElement(element_access),
                                 elements, index, value, effect, control);
     }
   }
 
   return ValueEffectControl(value, effect, control);
 }
 
 Node* JSNativeContextSpecialization::BuildCheckMaps(
     Node* receiver, Node* effect, Node* control,
@@ skipping 223 matching lines @@
 }
 
 
 SimplifiedOperatorBuilder* JSNativeContextSpecialization::simplified() const {
   return jsgraph()->simplified();
 }
 
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8