[turbofan] Add initial support for growing stores.

src/compiler/js-native-context-specialization.cc

 // Copyright 2015 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/compiler/js-native-context-specialization.h"
 
 #include "src/accessors.h"
 #include "src/code-factory.h"
 #include "src/compilation-dependencies.h"
 #include "src/compiler/access-builder.h"
@@ skipping 408 matching lines @@
   DCHECK(node->opcode() == IrOpcode::kJSLoadProperty ||
          node->opcode() == IrOpcode::kJSStoreProperty);
   Node* receiver = NodeProperties::GetValueInput(node, 0);
   Node* effect = NodeProperties::GetEffectInput(node);
   Node* control = NodeProperties::GetControlInput(node);
   Node* frame_state = NodeProperties::FindFrameStateBefore(node);
 
   // Not much we can do if deoptimization support is disabled.
   if (!(flags() & kDeoptimizationEnabled)) return NoChange();
 
-  // TODO(bmeurer): Add support for non-standard stores.
-  if (store_mode != STANDARD_STORE &&
-      store_mode != STORE_NO_TRANSITION_HANDLE_COW &&
-      store_mode != STORE_NO_TRANSITION_IGNORE_OUT_OF_BOUNDS) {
-    return NoChange();
-  }
-
   // Retrieve the native context from the given {node}.
   Handle<Context> native_context;
   if (!GetNativeContext(node).ToHandle(&native_context)) return NoChange();
 
   // Compute element access infos for the receiver maps.
   AccessInfoFactory access_info_factory(dependencies(), native_context,
                                         graph()->zone());
   ZoneVector<ElementAccessInfo> access_infos(zone());
   if (!access_info_factory.ComputeElementAccessInfos(receiver_maps, access_mode,
                                                      &access_infos)) {
@@ skipping 615 matching lines @@
           // Perform the actual store
           DCHECK_EQ(STANDARD_STORE, store_mode);
           effect = graph()->NewNode(
               simplified()->StoreTypedElement(external_array_type), buffer,
               base_pointer, external_pointer, index, value, effect, control);
         }
         break;
       }
     }
   } else {
-    // TODO(turbofan): Add support for additional store modes.
-    DCHECK(store_mode == STANDARD_STORE ||
-           store_mode == STORE_NO_TRANSITION_HANDLE_COW);
+    // Check if the {receiver} is a JSArray.
+    bool receiver_is_jsarray = HasOnlyJSArrayMaps(receiver_maps);
 
     // Load the length of the {receiver}.
     Node* length = effect =
-        HasOnlyJSArrayMaps(receiver_maps)
+        receiver_is_jsarray
             ? graph()->NewNode(
                   simplified()->LoadField(
                       AccessBuilder::ForJSArrayLength(elements_kind)),
                   receiver, effect, control)
             : graph()->NewNode(
                   simplified()->LoadField(AccessBuilder::ForFixedArrayLength()),
                   elements, effect, control);
 
-    // Check that the {index} is in the valid range for the {receiver}.
-    index = effect = graph()->NewNode(simplified()->CheckBounds(), index,
-                                      length, effect, control);
+    // Check if we might need to grow the {elements} backing store.
+    if (IsGrowStoreMode(store_mode)) {
+      DCHECK_EQ(AccessMode::kStore, access_mode);
+
+      // Check that the {index} is a valid array index; the actual checking
+      // happens below right before the element store.
+      index = effect = graph()->NewNode(simplified()->CheckBounds(), index,
+                                        jsgraph()->Constant(Smi::kMaxValue),
+                                        effect, control);
+    } else {
+      // Check that the {index} is in the valid range for the {receiver}.
+      index = effect = graph()->NewNode(simplified()->CheckBounds(), index,
+                                        length, effect, control);
+    }
 
     // Compute the element access.
     Type* element_type = Type::Any();
     MachineType element_machine_type = MachineType::AnyTagged();
     if (IsFastDoubleElementsKind(elements_kind)) {
       element_type = Type::Number();
       element_machine_type = MachineType::Float64();
     } else if (IsFastSmiElementsKind(elements_kind)) {
       element_type = type_cache_.kSmi;
     }
@@ skipping 51 matching lines @@
         // Make sure we do not store signalling NaNs into double arrays.
         value = graph()->NewNode(simplified()->NumberSilenceNaN(), value);
       }
 
       // Ensure that copy-on-write backing store is writable.
       if (IsFastSmiOrObjectElementsKind(elements_kind) &&
           store_mode == STORE_NO_TRANSITION_HANDLE_COW) {
         elements = effect =
             graph()->NewNode(simplified()->EnsureWritableFastElements(),
                              receiver, elements, effect, control);
+      } else if (IsGrowStoreMode(store_mode)) {
+        // Grow {elements} backing store if necessary. Also updates the
+        // "length" property for JSArray {receiver}s, hence there must
+        // not be any other check after this operation, as the write
+        // to the "length" property is observable.
+        GrowFastElementsFlags flags = GrowFastElementsFlag::kNone;
+        if (receiver_is_jsarray) {
+          flags |= GrowFastElementsFlag::kArrayObject;
+        }
+        if (IsHoleyElementsKind(elements_kind)) {
+          flags |= GrowFastElementsFlag::kHoleyElements;
+        }
+        if (IsFastDoubleElementsKind(elements_kind)) {
+          flags |= GrowFastElementsFlag::kDoubleElements;
+        }
+        elements = effect = graph()->NewNode(
+            simplified()->MaybeGrowFastElements(flags), receiver, elements,
+            index, length, effect, control);
       }
 
       // Perform the actual element access.
       effect = graph()->NewNode(simplified()->StoreElement(element_access),
                                 elements, index, value, effect, control);
     }
   }
 
   return ValueEffectControl(value, effect, control);
 }
@@ skipping 226 matching lines @@
 }
 
 
 SimplifiedOperatorBuilder* JSNativeContextSpecialization::simplified() const {
   return jsgraph()->simplified();
 }
 
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8