[turbofan] Add initial support for growing stores.

src/compiler/load-elimination.cc

 // Copyright 2016 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/compiler/load-elimination.h"
 
 #include "src/compiler/js-graph.h"
 #include "src/compiler/node-properties.h"
 #include "src/compiler/simplified-operator.h"
 
@@ skipping 38 matching lines @@
 bool MustAlias(Node* a, Node* b) { return QueryAlias(a, b) == kMustAlias; }
 
 }  // namespace
 
 Reduction LoadElimination::Reduce(Node* node) {
   switch (node->opcode()) {
     case IrOpcode::kCheckMaps:
       return ReduceCheckMaps(node);
     case IrOpcode::kEnsureWritableFastElements:
       return ReduceEnsureWritableFastElements(node);
+    case IrOpcode::kMaybeGrowFastElements:
+      return ReduceMaybeGrowFastElements(node);
     case IrOpcode::kTransitionElementsKind:
       return ReduceTransitionElementsKind(node);
     case IrOpcode::kLoadField:
       return ReduceLoadField(node);
     case IrOpcode::kStoreField:
       return ReduceStoreField(node);
     case IrOpcode::kLoadElement:
       return ReduceLoadElement(node);
     case IrOpcode::kStoreElement:
       return ReduceStoreElement(node);
@@ skipping 276 matching lines @@
   }
   // We know that the resulting elements have the fixed array map.
   state = state->AddField(node, 0, fixed_array_map, zone());
   // Kill the previous elements on {object}.
   state = state->KillField(object, 2, zone());
   // Add the new elements on {object}.
   state = state->AddField(object, 2, node, zone());
   return UpdateState(node, state);
 }
 
+Reduction LoadElimination::ReduceMaybeGrowFastElements(Node* node) {
+  GrowFastElementsFlags flags = GrowFastElementsFlagsOf(node->op());
+  Node* const object = NodeProperties::GetValueInput(node, 0);
+  Node* const effect = NodeProperties::GetEffectInput(node);
+  AbstractState const* state = node_states_.Get(effect);
+  if (state == nullptr) return NoChange();
+  if (flags & GrowFastElementsFlag::kDoubleElements) {
+    // We know that the resulting elements have the fixed double array map.
+    Node* fixed_double_array_map = jsgraph()->FixedDoubleArrayMapConstant();
+    state = state->AddField(node, 0, fixed_double_array_map, zone());
+  } else {
+    // We know that the resulting elements have the fixed array map.
+    Node* fixed_array_map = jsgraph()->FixedArrayMapConstant();
+    state = state->AddField(node, 0, fixed_array_map, zone());
+  }
+  if (flags & GrowFastElementsFlag::kArrayObject) {
+    // Kill the previous Array::length on {object}.
+    state = state->KillField(object, 3, zone());
+  }
+  // Kill the previous elements on {object}.
+  state = state->KillField(object, 2, zone());
+  // Add the new elements on {object}.
+  state = state->AddField(object, 2, node, zone());
+  return UpdateState(node, state);
+}
+
 Reduction LoadElimination::ReduceTransitionElementsKind(Node* node) {
   Node* const object = NodeProperties::GetValueInput(node, 0);
   Node* const source_map = NodeProperties::GetValueInput(node, 1);
   Node* const target_map = NodeProperties::GetValueInput(node, 2);
   Node* const effect = NodeProperties::GetEffectInput(node);
   AbstractState const* state = node_states_.Get(effect);
   if (state == nullptr) return NoChange();
   if (Node* const object_map = state->LookupField(object, 0)) {
     state = state->KillField(object, 0, zone());
     if (source_map == object_map) {
@@ skipping 208 matching lines @@
   }
   while (!queue.empty()) {
     Node* const current = queue.front();
     queue.pop();
     if (visited.find(current) == visited.end()) {
       visited.insert(current);
       if (!current->op()->HasProperty(Operator::kNoWrite)) {
         switch (current->opcode()) {
           case IrOpcode::kEnsureWritableFastElements: {
             Node* const object = NodeProperties::GetValueInput(current, 0);
-            Node* const elements = NodeProperties::GetValueInput(current, 1);
-            state = state->KillField(elements, 0, zone());
             state = state->KillField(object, 2, zone());
             break;
           }
+          case IrOpcode::kMaybeGrowFastElements: {
+            GrowFastElementsFlags flags =
+                GrowFastElementsFlagsOf(current->op());
+            Node* const object = NodeProperties::GetValueInput(current, 0);
+            state = state->KillField(object, 2, zone());

[Jarin, 2016/08/08 08:03:47]

Should not the magic numbers (like 2 here and 3 below) have some human readable
names? (Especially when there are no nearby comments explaining this .)

[Benedikt Meurer, 2016/08/08 08:12:55]

Acknowledged. On the TODO list.

+            if (flags & GrowFastElementsFlag::kArrayObject) {
+              state = state->KillField(object, 3, zone());
+            }
+            break;
+          }
           case IrOpcode::kTransitionElementsKind: {
             Node* const object = NodeProperties::GetValueInput(current, 0);
             state = state->KillField(object, 0, zone());
             state = state->KillField(object, 2, zone());
             break;
           }
           case IrOpcode::kStoreField: {
             FieldAccess const& access = FieldAccessOf(current->op());
             Node* const object = NodeProperties::GetValueInput(current, 0);
             int field_index = FieldIndexOf(access);
@@ skipping 52 matching lines @@
   DCHECK_EQ(kTaggedBase, access.base_is_tagged);
   DCHECK_EQ(0, access.offset % kPointerSize);
   int field_index = access.offset / kPointerSize;
   if (field_index >= static_cast<int>(kMaxTrackedFields)) return -1;
   return field_index;
 }
 
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8