[turbofan] Add support for copy-on-write element stores.

src/compiler/load-elimination.cc

 // Copyright 2016 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/compiler/load-elimination.h"
 
+#include "src/compiler/js-graph.h"
 #include "src/compiler/node-properties.h"
 #include "src/compiler/simplified-operator.h"
 
 namespace v8 {
 namespace internal {
 namespace compiler {
 
 namespace {
 
 enum Aliasing { kNoAlias, kMayAlias, kMustAlias };
@@ skipping 29 matching lines @@
 bool MayAlias(Node* a, Node* b) { return QueryAlias(a, b) != kNoAlias; }
 
 bool MustAlias(Node* a, Node* b) { return QueryAlias(a, b) == kMustAlias; }
 
 }  // namespace
 
 Reduction LoadElimination::Reduce(Node* node) {
   switch (node->opcode()) {
     case IrOpcode::kCheckMaps:
       return ReduceCheckMaps(node);
+    case IrOpcode::kEnsureWritableFastElements:
+      return ReduceEnsureWritableFastElements(node);
     case IrOpcode::kTransitionElementsKind:
       return ReduceTransitionElementsKind(node);
     case IrOpcode::kLoadField:
       return ReduceLoadField(node);
     case IrOpcode::kStoreField:
       return ReduceStoreField(node);
     case IrOpcode::kLoadElement:
       return ReduceLoadElement(node);
     case IrOpcode::kStoreElement:
       return ReduceStoreElement(node);
@@ skipping 253 matching lines @@
       if (map == object_map) return Replace(effect);
     }
   }
   if (map_input_count == 1) {
     Node* const map0 = NodeProperties::GetValueInput(node, 1);
     state = state->AddField(object, 0, map0, zone());
   }
   return UpdateState(node, state);
 }
 
+Reduction LoadElimination::ReduceEnsureWritableFastElements(Node* node) {
+  Node* const object = NodeProperties::GetValueInput(node, 0);
+  Node* const elements = NodeProperties::GetValueInput(node, 1);
+  Node* const effect = NodeProperties::GetEffectInput(node);
+  AbstractState const* state = node_states_.Get(effect);
+  if (state == nullptr) return NoChange();
+  Node* fixed_array_map = jsgraph()->FixedArrayMapConstant();
+  if (Node* const elements_map = state->LookupField(elements, 0)) {
+    // Check if the {elements} already have the fixed array map.
+    if (elements_map == fixed_array_map) {
+      ReplaceWithValue(node, elements, effect);
+      return Replace(elements);
+    }
+  }
+  // We know that the resulting elements have the fixed array map.
+  state = state->AddField(node, 0, fixed_array_map, zone());
+  // Kill the previous elements on {object}.
+  state = state->KillField(object, 2, zone());
+  // Add the new elements on {object}.
+  state = state->AddField(object, 2, node, zone());
+  return UpdateState(node, state);
+}
+
 Reduction LoadElimination::ReduceTransitionElementsKind(Node* node) {
   Node* const object = NodeProperties::GetValueInput(node, 0);
   Node* const source_map = NodeProperties::GetValueInput(node, 1);
   Node* const target_map = NodeProperties::GetValueInput(node, 2);
   Node* const effect = NodeProperties::GetEffectInput(node);
   AbstractState const* state = node_states_.Get(effect);
   if (state == nullptr) return NoChange();
   if (Node* const object_map = state->LookupField(object, 0)) {
     state = state->KillField(object, 0, zone());
     if (source_map == object_map) {
@@ skipping 206 matching lines @@
   for (int i = 1; i < control->InputCount(); ++i) {
     queue.push(node->InputAt(i));
   }
   while (!queue.empty()) {
     Node* const current = queue.front();
     queue.pop();
     if (visited.find(current) == visited.end()) {
       visited.insert(current);
       if (!current->op()->HasProperty(Operator::kNoWrite)) {
         switch (current->opcode()) {
+          case IrOpcode::kEnsureWritableFastElements: {
+            Node* const object = NodeProperties::GetValueInput(current, 0);
+            Node* const elements = NodeProperties::GetValueInput(current, 1);
+            state = state->KillField(elements, 0, zone());
+            state = state->KillField(object, 2, zone());
+            break;
+          }
+          case IrOpcode::kTransitionElementsKind: {
+            Node* const object = NodeProperties::GetValueInput(current, 0);
+            state = state->KillField(object, 0, zone());
+            state = state->KillField(object, 2, zone());
+            break;
+          }
           case IrOpcode::kStoreField: {
             FieldAccess const& access = FieldAccessOf(current->op());
             Node* const object = NodeProperties::GetValueInput(current, 0);
             int field_index = FieldIndexOf(access);
             if (field_index < 0) return empty_state();
             state = state->KillField(object, field_index, zone());
             break;
           }
           case IrOpcode::kStoreElement: {
             Node* const object = NodeProperties::GetValueInput(current, 0);
             Node* const index = NodeProperties::GetValueInput(current, 1);
             state = state->KillElement(object, index, zone());
             break;
           }
+          case IrOpcode::kStoreBuffer:
+          case IrOpcode::kStoreTypedElement: {
+            // Doesn't affect anything we track with the state currently.
+            break;
+          }
           default:
             return empty_state();
         }
       }
       for (int i = 0; i < current->op()->EffectInputCount(); ++i) {
         queue.push(NodeProperties::GetEffectInput(current, i));
       }
     }
   }
   return state;
@@ skipping 27 matching lines @@
   DCHECK_EQ(kTaggedBase, access.base_is_tagged);
   DCHECK_EQ(0, access.offset % kPointerSize);
   int field_index = access.offset / kPointerSize;
   if (field_index >= static_cast<int>(kMaxTrackedFields)) return -1;
   return field_index;
 }
 
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8