[WIP] NumberToString operator in TF.

src/compiler/js-builtin-reducer.cc

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/compiler/js-builtin-reducer.h"
 
 #include "src/compiler/access-builder.h"
 #include "src/compiler/js-graph.h"
 #include "src/compiler/node-matchers.h"
 #include "src/compiler/node-properties.h"
@@ skipping 511 matching lines @@
     // Number.parseInt(a:safe-integer) -> NumberToInt32(a)
     // Number.parseInt(a:safe-integer,b:#0\/undefined) -> NumberToInt32(a)
     // Number.parseInt(a:safe-integer,b:#10\/undefined) -> NumberToInt32(a)
     Node* input = r.GetJSCallInput(0);
     Node* value = graph()->NewNode(simplified()->NumberToInt32(), input);
     return Replace(value);
   }
   return NoChange();
 }
 
+namespace {
+
+Node* GetNumberWitness(Node* node) {
+  Node* receiver = NodeProperties::GetValueInput(node, 1);
+  Type* receiver_type = NodeProperties::GetType(receiver);
+  Node* effect = NodeProperties::GetEffectInput(node);
+  if (receiver_type->Is(Type::Number())) return receiver;
+  // Check if the {node} is dominated by a CheckNumber renaming for
+  // it's {receiver}, and if so use that renaming as {receiver} for
+  // the lowering below.
+  for (Node* dominator = effect;;) {
+    if (dominator->opcode() == IrOpcode::kCheckNumber &&
+        dominator->InputAt(0) == receiver) {
+      return dominator;
+    }
+    if (dominator->op()->EffectInputCount() != 1) {
+      // Didn't find any appropriate CheckNumber node.
+      return nullptr;
+    }
+    dominator = NodeProperties::GetEffectInput(dominator);
+  }
+}
+
+}  // namespace
+
+// 20.1.3.6 Number.prototype.toString ( [ radix ] )
+Reduction JSBuiltinReducer::ReduceNumberToString(Node* node) {
+  if (Node* receiver = GetNumberWitness(node)) {
+    // Determine the optional {radix} parameter.
+    Node* radix = node->op()->ValueInputCount() > 2
+                      ? NodeProperties::GetValueInput(node, 2)
+                      : jsgraph()->Constant(10);
+    Type* radix_type = NodeProperties::GetType(radix);
+    if (radix_type->Is(Type::Undefined())) {
+      radix = jsgraph()->Constant(10.0);
+      radix_type = type_cache_.kSingletonTen;
+    }
+    if (radix_type->Is(Type::Unsigned32())) {
+      if (radix_type->Min() >= 2.0 && radix_type->Max() <= 36.0) {
+        // Return the String representation of the Number {receiver}
+        // according to the given {radix}.
+        Node* value =
+            graph()->NewNode(simplified()->NumberToString(), receiver, radix);
+        return Replace(value);
+      }
+    }
+  }
+  return NoChange();
+}
+
 // ES6 section 21.1.2.1 String.fromCharCode ( ...codeUnits )
 Reduction JSBuiltinReducer::ReduceStringFromCharCode(Node* node) {
   JSCallReduction r(node);
   if (r.InputsMatchOne(Type::PlainPrimitive())) {
     // String.fromCharCode(a:plain-primitive) -> StringFromCharCode(a)
     Node* input = ToNumber(r.GetJSCallInput(0));
     Node* value = graph()->NewNode(simplified()->StringFromCharCode(), input);
     return Replace(value);
   }
   return NoChange();
@@ skipping 302 matching lines @@
       break;
     case kMathTanh:
       reduction = ReduceMathTanh(node);
       break;
     case kMathTrunc:
       reduction = ReduceMathTrunc(node);
       break;
     case kNumberParseInt:
       reduction = ReduceNumberParseInt(node);
       break;
+    case kNumberToString:
+      reduction = ReduceNumberToString(node);
+      break;
     case kStringFromCharCode:
       reduction = ReduceStringFromCharCode(node);
       break;
     case kStringCharAt:
       return ReduceStringCharAt(node);
     case kStringCharCodeAt:
       return ReduceStringCharCodeAt(node);
     case kDataViewByteLength:
       return ReduceArrayBufferViewAccessor(
           node, JS_DATA_VIEW_TYPE,
@@ skipping 48 matching lines @@
 }
 
 
 SimplifiedOperatorBuilder* JSBuiltinReducer::simplified() const {
   return jsgraph()->simplified();
 }
 
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8