[turbofan] inline %StringIteratorPrototype%.next in JSBuiltinReducer.

src/compiler/effect-control-linearizer.cc

Index: src/compiler/effect-control-linearizer.cc
diff --git a/src/compiler/effect-control-linearizer.cc b/src/compiler/effect-control-linearizer.cc
index b8693e11db79106383dfecccc6e2ac930e01343f..1209f948e0bc5969a025e9419d784a337a912036 100644
--- a/src/compiler/effect-control-linearizer.cc
+++ b/src/compiler/effect-control-linearizer.cc
@@ -719,6 +719,9 @@ bool EffectControlLinearizer::TryWireInStateEffect(Node* node,
     case IrOpcode::kStringFromCharCode:
       state = LowerStringFromCharCode(node, *effect, *control);
       break;
+    case IrOpcode::kStringFromCodePoint:
+      state = LowerStringFromCodePoint(node, *effect, *control);
+      break;
     case IrOpcode::kStringCharCodeAt:
       state = LowerStringCharCodeAt(node, *effect, *control);
       break;
@@ -2230,207 +2233,407 @@ EffectControlLinearizer::LowerArrayBufferWasNeutered(Node* node, Node* effect,
 EffectControlLinearizer::ValueEffectControl
 EffectControlLinearizer::LowerStringCharCodeAt(Node* node, Node* effect,

[Benedikt Meurer, 2016/09/29 13:04:27]

Can you hold off with changing the StringCharCodeAt operator? Let's keep it
simple first and use that one as-is.

[Benedikt Meurer, 2016/09/29 16:40:01]

I wonder how much the pre-flattening actually buys us. Can you measure with the
baseline version? If it doesn't buy us much, i.e. we just do the full
StringCharCodeAt in every iteration, then I'd prefer to not do it at all, and go
for the simple version (maximizing code sharing in this case).

[caitp, 2016/09/29 20:08:02]

Comparing these, it doesn't look like there's a significant performance
difference between:

```
tools/run_perf.py --arch x64 --outdir=out --outdir-no-patch=tf_stringiter/
test/js-perf-test/JSTests.json 
Spread_OneByteShort-StringIterators(Score): 151860
Spread_TwoByteShort-StringIterators(Score): 303680
Spread_WithSurrogatePairsShort-StringIterators(Score): 229080
ForOf_OneByteShort-StringIterators(Score): 261070
ForOf_TwoByteShort-StringIterators(Score): 572460
ForOf_WithSurrogatePairsShort-StringIterators(Score): 420630
ForOf_OneByteLong-StringIterators(Score): 2390
ForOf_TwoByteLong-StringIterators(Score): 2512
ForOf_WithSurrogatePairsLong-StringIterators(Score): 3776
Spread_OneByteShort-StringIterators(Score): 148900
Spread_TwoByteShort-StringIterators(Score): 296180
Spread_WithSurrogatePairsShort-StringIterators(Score): 234100
ForOf_OneByteShort-StringIterators(Score): 270310
ForOf_TwoByteShort-StringIterators(Score): 610690
ForOf_WithSurrogatePairsShort-StringIterators(Score): 430120
ForOf_OneByteLong-StringIterators(Score): 2250
ForOf_TwoByteLong-StringIterators(Score): 2361
ForOf_WithSurrogatePairsLong-StringIterators(Score): 3760
Spread_OneByteShort-StringIterators(Score): 141610
Spread_TwoByteShort-StringIterators(Score): 295680
Spread_WithSurrogatePairsShort-StringIterators(Score): 237640
ForOf_OneByteShort-StringIterators(Score): 275040
ForOf_TwoByteShort-StringIterators(Score): 604910
ForOf_WithSurrogatePairsShort-StringIterators(Score): 405770
ForOf_OneByteLong-StringIterators(Score): 2438
ForOf_TwoByteLong-StringIterators(Score): 2453
ForOf_WithSurrogatePairsLong-StringIterators(Score): 3730
Spread_OneByteShort-StringIterators(Score): 145840
Spread_TwoByteShort-StringIterators(Score): 299810
Spread_WithSurrogatePairsShort-StringIterators(Score): 236650
ForOf_OneByteShort-StringIterators(Score): 270420
ForOf_TwoByteShort-StringIterators(Score): 552390
ForOf_WithSurrogatePairsShort-StringIterators(Score): 420850
ForOf_OneByteLong-StringIterators(Score): 2380
ForOf_TwoByteLong-StringIterators(Score): 2428
ForOf_WithSurrogatePairsLong-StringIterators(Score): 3832
Spread_OneByteShort-StringIterators(Score): 150870
Spread_TwoByteShort-StringIterators(Score): 295960
Spread_WithSurrogatePairsShort-StringIterators(Score): 237950
ForOf_OneByteShort-StringIterators(Score): 274050
ForOf_TwoByteShort-StringIterators(Score): 591230
ForOf_WithSurrogatePairsShort-StringIterators(Score): 424490
ForOf_OneByteLong-StringIterators(Score): 2343
ForOf_TwoByteLong-StringIterators(Score): 2475
ForOf_WithSurrogatePairsLong-StringIterators(Score): 3776
Spread_OneByteShort-StringIterators(Score): 147860
Spread_TwoByteShort-StringIterators(Score): 304420
Spread_WithSurrogatePairsShort-StringIterators(Score): 233880
ForOf_OneByteShort-StringIterators(Score): 268870
ForOf_TwoByteShort-StringIterators(Score): 600230
ForOf_WithSurrogatePairsShort-StringIterators(Score): 436650
ForOf_OneByteLong-StringIterators(Score): 2353
ForOf_TwoByteLong-StringIterators(Score): 2430
ForOf_WithSurrogatePairsLong-StringIterators(Score): 3860
```

It's pretty close to neutral, so I don't mind sending a patch to switch to the
unflattening model

                                                Node* control) {
+  StringOperationHint hint = StringOperationHintOf(node->op());
   Node* subject = node->InputAt(0);
   Node* index = node->InputAt(1);
+  Node* value = nullptr;
+
+  switch (hint) {
+    case StringOperationHint::kAny: {
+      // We may need to loop several times for ConsString/SlicedString
+      // {subject}s.
+      Node* loop = graph()->NewNode(common()->Loop(4), control, control,
+                                    control, control);
+      Node* lsubject =
+          graph()->NewNode(common()->Phi(MachineRepresentation::kTagged, 4),
+                           subject, subject, subject, subject, loop);
+      Node* lindex =
+          graph()->NewNode(common()->Phi(MachineRepresentation::kWord32, 4),
+                           index, index, index, index, loop);
+      Node* leffect = graph()->NewNode(common()->EffectPhi(4), effect, effect,
+                                       effect, effect, loop);
+
+      control = loop;
+      effect = leffect;
+
+      // Determine the instance type of {lsubject}.
+      Node* lsubject_map = effect =
+          graph()->NewNode(simplified()->LoadField(AccessBuilder::ForMap()),
+                           lsubject, effect, control);
+      Node* lsubject_instance_type = effect = graph()->NewNode(
+          simplified()->LoadField(AccessBuilder::ForMapInstanceType()),
+          lsubject_map, effect, control);
 
-  // We may need to loop several times for ConsString/SlicedString {subject}s.
-  Node* loop =
-      graph()->NewNode(common()->Loop(4), control, control, control, control);
-  Node* lsubject =
-      graph()->NewNode(common()->Phi(MachineRepresentation::kTagged, 4),
-                       subject, subject, subject, subject, loop);
-  Node* lindex =
-      graph()->NewNode(common()->Phi(MachineRepresentation::kWord32, 4), index,
-                       index, index, index, loop);
-  Node* leffect = graph()->NewNode(common()->EffectPhi(4), effect, effect,
-                                   effect, effect, loop);
-
-  control = loop;
-  effect = leffect;
-
-  // Determine the instance type of {lsubject}.
-  Node* lsubject_map = effect =
-      graph()->NewNode(simplified()->LoadField(AccessBuilder::ForMap()),
-                       lsubject, effect, control);
-  Node* lsubject_instance_type = effect = graph()->NewNode(
-      simplified()->LoadField(AccessBuilder::ForMapInstanceType()),
-      lsubject_map, effect, control);
-
-  // Check if {lsubject} is a SeqString.
-  Node* check0 = graph()->NewNode(
-      machine()->Word32Equal(),
-      graph()->NewNode(machine()->Word32And(), lsubject_instance_type,
-                       jsgraph()->Int32Constant(kStringRepresentationMask)),
-      jsgraph()->Int32Constant(kSeqStringTag));
-  Node* branch0 = graph()->NewNode(common()->Branch(), check0, control);
+      // Check if {lsubject} is a SeqString.
+      Node* check0 = graph()->NewNode(
+          machine()->Word32Equal(),
+          graph()->NewNode(machine()->Word32And(), lsubject_instance_type,
+                           jsgraph()->Int32Constant(kStringRepresentationMask)),
+          jsgraph()->Int32Constant(kSeqStringTag));
+      Node* branch0 = graph()->NewNode(common()->Branch(), check0, control);
 
-  Node* if_true0 = graph()->NewNode(common()->IfTrue(), branch0);
-  Node* etrue0 = effect;
-  Node* vtrue0;
-  {
-    // Check if the {lsubject} is a TwoByteSeqString or a OneByteSeqString.
-    Node* check1 = graph()->NewNode(
-        machine()->Word32Equal(),
-        graph()->NewNode(machine()->Word32And(), lsubject_instance_type,
-                         jsgraph()->Int32Constant(kStringEncodingMask)),
-        jsgraph()->Int32Constant(kTwoByteStringTag));
-    Node* branch1 = graph()->NewNode(common()->Branch(), check1, if_true0);
+      Node* if_true0 = graph()->NewNode(common()->IfTrue(), branch0);
+      Node* etrue0 = effect;
+      Node* vtrue0;
+      {
+        // Check if the {lsubject} is a TwoByteSeqString or a OneByteSeqString.
+        Node* check1 = graph()->NewNode(
+            machine()->Word32Equal(),
+            graph()->NewNode(machine()->Word32And(), lsubject_instance_type,
+                             jsgraph()->Int32Constant(kStringEncodingMask)),
+            jsgraph()->Int32Constant(kTwoByteStringTag));
+        Node* branch1 = graph()->NewNode(common()->Branch(), check1, if_true0);
+
+        Node* if_true1 = graph()->NewNode(common()->IfTrue(), branch1);
+        Node* etrue1 = etrue0;
+        Node* vtrue1 = etrue1 =
+            graph()->NewNode(simplified()->LoadElement(
+                                 AccessBuilder::ForSeqTwoByteStringCharacter()),
+                             lsubject, lindex, etrue1, if_true1);
+
+        Node* if_false1 = graph()->NewNode(common()->IfFalse(), branch1);
+        Node* efalse1 = etrue0;
+        Node* vfalse1 = efalse1 =
+            graph()->NewNode(simplified()->LoadElement(
+                                 AccessBuilder::ForSeqOneByteStringCharacter()),
+                             lsubject, lindex, efalse1, if_false1);
+
+        if_true0 = graph()->NewNode(common()->Merge(2), if_true1, if_false1);
+        etrue0 =
+            graph()->NewNode(common()->EffectPhi(2), etrue1, efalse1, if_true0);
+        vtrue0 =
+            graph()->NewNode(common()->Phi(MachineRepresentation::kWord32, 2),
+                             vtrue1, vfalse1, if_true0);
+      }
 
-    Node* if_true1 = graph()->NewNode(common()->IfTrue(), branch1);
-    Node* etrue1 = etrue0;
-    Node* vtrue1 = etrue1 =
-        graph()->NewNode(simplified()->LoadElement(
-                             AccessBuilder::ForSeqTwoByteStringCharacter()),
-                         lsubject, lindex, etrue1, if_true1);
+      Node* if_false0 = graph()->NewNode(common()->IfFalse(), branch0);
+      Node* efalse0 = effect;
+      Node* vfalse0;
+      {
+        // Check if the {lsubject} is a ConsString.
+        Node* check1 = graph()->NewNode(
+            machine()->Word32Equal(),
+            graph()->NewNode(
+                machine()->Word32And(), lsubject_instance_type,
+                jsgraph()->Int32Constant(kStringRepresentationMask)),
+            jsgraph()->Int32Constant(kConsStringTag));
+        Node* branch1 = graph()->NewNode(common()->Branch(), check1, if_false0);
 
-    Node* if_false1 = graph()->NewNode(common()->IfFalse(), branch1);
-    Node* efalse1 = etrue0;
-    Node* vfalse1 = efalse1 =
-        graph()->NewNode(simplified()->LoadElement(
-                             AccessBuilder::ForSeqOneByteStringCharacter()),
-                         lsubject, lindex, efalse1, if_false1);
+        Node* if_true1 = graph()->NewNode(common()->IfTrue(), branch1);
+        Node* etrue1 = efalse0;
+        {
+          // Load the right hand side of the {lsubject} ConsString.
+          Node* lsubject_second = etrue1 = graph()->NewNode(
+              simplified()->LoadField(AccessBuilder::ForConsStringSecond()),
+              lsubject, etrue1, if_true1);
+
+          // Check whether the right hand side is the empty string (i.e. if
+          // this is really a flat string in a cons string). If that is not
+          // the case we flatten the string first.
+          Node* check2 =
+              graph()->NewNode(machine()->WordEqual(), lsubject_second,
+                               jsgraph()->EmptyStringConstant());
+          Node* branch2 = graph()->NewNode(common()->Branch(BranchHint::kTrue),
+                                           check2, if_true1);
+
+          Node* if_true2 = graph()->NewNode(common()->IfTrue(), branch2);
+          Node* etrue2 = etrue1;
+          Node* vtrue2 = etrue2 = graph()->NewNode(
+              simplified()->LoadField(AccessBuilder::ForConsStringFirst()),
+              lsubject, etrue2, if_true2);
+
+          Node* if_false2 = graph()->NewNode(common()->IfFalse(), branch2);
+          Node* efalse2 = etrue1;
+          Node* vfalse2;
+          {
+            // Flatten the {lsubject} ConsString first.
+            Operator::Properties properties =
+                Operator::kNoDeopt | Operator::kNoThrow;
+            Runtime::FunctionId id = Runtime::kFlattenString;
+            CallDescriptor const* desc = Linkage::GetRuntimeCallDescriptor(
+                graph()->zone(), id, 1, properties, CallDescriptor::kNoFlags);
+            vfalse2 = efalse2 = graph()->NewNode(
+                common()->Call(desc), jsgraph()->CEntryStubConstant(1),
+                lsubject,
+                jsgraph()->ExternalConstant(ExternalReference(id, isolate())),
+                jsgraph()->Int32Constant(1), jsgraph()->NoContextConstant(),
+                efalse2, if_false2);
+          }
 
-    if_true0 = graph()->NewNode(common()->Merge(2), if_true1, if_false1);
-    etrue0 =
-        graph()->NewNode(common()->EffectPhi(2), etrue1, efalse1, if_true0);
-    vtrue0 = graph()->NewNode(common()->Phi(MachineRepresentation::kWord32, 2),
-                              vtrue1, vfalse1, if_true0);
-  }
+          // Retry the {loop} with the new subject.
+          loop->ReplaceInput(1, if_true2);
+          lindex->ReplaceInput(1, lindex);
+          leffect->ReplaceInput(1, etrue2);
+          lsubject->ReplaceInput(1, vtrue2);
+          loop->ReplaceInput(2, if_false2);
+          lindex->ReplaceInput(2, lindex);
+          leffect->ReplaceInput(2, efalse2);
+          lsubject->ReplaceInput(2, vfalse2);
+        }
 
-  Node* if_false0 = graph()->NewNode(common()->IfFalse(), branch0);
-  Node* efalse0 = effect;
-  Node* vfalse0;
-  {
-    // Check if the {lsubject} is a ConsString.
-    Node* check1 = graph()->NewNode(
-        machine()->Word32Equal(),
-        graph()->NewNode(machine()->Word32And(), lsubject_instance_type,
-                         jsgraph()->Int32Constant(kStringRepresentationMask)),
-        jsgraph()->Int32Constant(kConsStringTag));
-    Node* branch1 = graph()->NewNode(common()->Branch(), check1, if_false0);
+        Node* if_false1 = graph()->NewNode(common()->IfFalse(), branch1);
+        Node* efalse1 = efalse0;
+        Node* vfalse1;
+        {
+          // Check if the {lsubject} is an ExternalString.
+          Node* check2 = graph()->NewNode(
+              machine()->Word32Equal(),
+              graph()->NewNode(
+                  machine()->Word32And(), lsubject_instance_type,
+                  jsgraph()->Int32Constant(kStringRepresentationMask)),
+              jsgraph()->Int32Constant(kExternalStringTag));
+          Node* branch2 = graph()->NewNode(common()->Branch(BranchHint::kTrue),
+                                           check2, if_false1);
+
+          Node* if_true2 = graph()->NewNode(common()->IfTrue(), branch2);
+          Node* etrue2 = efalse1;
+          Node* vtrue2;
+          {
+            // Check if the {lsubject} is a short external string.
+            Node* check3 = graph()->NewNode(
+                machine()->Word32Equal(),
+                graph()->NewNode(
+                    machine()->Word32And(), lsubject_instance_type,
+                    jsgraph()->Int32Constant(kShortExternalStringMask)),
+                jsgraph()->Int32Constant(0));
+            Node* branch3 = graph()->NewNode(
+                common()->Branch(BranchHint::kTrue), check3, if_true2);
+
+            Node* if_true3 = graph()->NewNode(common()->IfTrue(), branch3);
+            Node* etrue3 = etrue2;
+            Node* vtrue3;
+            {
+              // Load the actual resource data from the {lsubject}.
+              Node* lsubject_resource_data = etrue3 = graph()->NewNode(
+                  simplified()->LoadField(
+                      AccessBuilder::ForExternalStringResourceData()),
+                  lsubject, etrue3, if_true3);
+
+              // Check if the {lsubject} is a TwoByteExternalString or a
+              // OneByteExternalString.
+              Node* check4 = graph()->NewNode(
+                  machine()->Word32Equal(),
+                  graph()->NewNode(
+                      machine()->Word32And(), lsubject_instance_type,
+                      jsgraph()->Int32Constant(kStringEncodingMask)),
+                  jsgraph()->Int32Constant(kTwoByteStringTag));
+              Node* branch4 =
+                  graph()->NewNode(common()->Branch(), check4, if_true3);
+
+              Node* if_true4 = graph()->NewNode(common()->IfTrue(), branch4);
+              Node* etrue4 = etrue3;
+              Node* vtrue4 = etrue4 = graph()->NewNode(
+                  simplified()->LoadElement(
+                      AccessBuilder::ForExternalTwoByteStringCharacter()),
+                  lsubject_resource_data, lindex, etrue4, if_true4);
+
+              Node* if_false4 = graph()->NewNode(common()->IfFalse(), branch4);
+              Node* efalse4 = etrue3;
+              Node* vfalse4 = efalse4 = graph()->NewNode(
+                  simplified()->LoadElement(
+                      AccessBuilder::ForExternalOneByteStringCharacter()),
+                  lsubject_resource_data, lindex, efalse4, if_false4);
+
+              if_true3 =
+                  graph()->NewNode(common()->Merge(2), if_true4, if_false4);
+              etrue3 = graph()->NewNode(common()->EffectPhi(2), etrue4, efalse4,
+                                        if_true3);
+              vtrue3 = graph()->NewNode(
+                  common()->Phi(MachineRepresentation::kWord32, 2), vtrue4,
+                  vfalse4, if_true3);
+            }
+
+            Node* if_false3 = graph()->NewNode(common()->IfFalse(), branch3);
+            Node* efalse3 = etrue2;
+            Node* vfalse3;
+            {
+              // The {lsubject} might be compressed, call the runtime.
+              Operator::Properties properties =
+                  Operator::kNoDeopt | Operator::kNoThrow;
+              Runtime::FunctionId id = Runtime::kExternalStringGetChar;
+              CallDescriptor const* desc = Linkage::GetRuntimeCallDescriptor(
+                  graph()->zone(), id, 2, properties, CallDescriptor::kNoFlags);
+              vfalse3 = efalse3 = graph()->NewNode(
+                  common()->Call(desc), jsgraph()->CEntryStubConstant(1),
+                  lsubject, ChangeInt32ToSmi(lindex),
+                  jsgraph()->ExternalConstant(ExternalReference(id, isolate())),
+                  jsgraph()->Int32Constant(2), jsgraph()->NoContextConstant(),
+                  efalse3, if_false3);
+              vfalse3 = ChangeSmiToInt32(vfalse3);
+            }
+
+            if_true2 =
+                graph()->NewNode(common()->Merge(2), if_true3, if_false3);
+            etrue2 = graph()->NewNode(common()->EffectPhi(2), etrue3, efalse3,
+                                      if_true2);
+            vtrue2 = graph()->NewNode(
+                common()->Phi(MachineRepresentation::kWord32, 2), vtrue3,
+                vfalse3, if_true2);
+          }
 
-    Node* if_true1 = graph()->NewNode(common()->IfTrue(), branch1);
-    Node* etrue1 = efalse0;
-    {
-      // Load the right hand side of the {lsubject} ConsString.
-      Node* lsubject_second = etrue1 = graph()->NewNode(
-          simplified()->LoadField(AccessBuilder::ForConsStringSecond()),
-          lsubject, etrue1, if_true1);
-
-      // Check whether the right hand side is the empty string (i.e. if
-      // this is really a flat string in a cons string). If that is not
-      // the case we flatten the string first.
-      Node* check2 = graph()->NewNode(machine()->WordEqual(), lsubject_second,
-                                      jsgraph()->EmptyStringConstant());
-      Node* branch2 = graph()->NewNode(common()->Branch(BranchHint::kTrue),
-                                       check2, if_true1);
+          Node* if_false2 = graph()->NewNode(common()->IfFalse(), branch2);
+          Node* efalse2 = efalse1;
+          {
+            // The {lsubject} is a SlicedString, continue with its parent.
+            Node* lsubject_parent = efalse2 = graph()->NewNode(
+                simplified()->LoadField(AccessBuilder::ForSlicedStringParent()),
+                lsubject, efalse2, if_false2);
+            Node* lsubject_offset = efalse2 = graph()->NewNode(
+                simplified()->LoadField(AccessBuilder::ForSlicedStringOffset()),
+                lsubject, efalse2, if_false2);
+            Node* lsubject_index =
+                graph()->NewNode(machine()->Int32Add(), lindex,
+                                 ChangeSmiToInt32(lsubject_offset));
+
+            // Retry the {loop} with the parent subject.
+            loop->ReplaceInput(3, if_false2);
+            leffect->ReplaceInput(3, efalse2);
+            lindex->ReplaceInput(3, lsubject_index);
+            lsubject->ReplaceInput(3, lsubject_parent);
+          }
 
-      Node* if_true2 = graph()->NewNode(common()->IfTrue(), branch2);
-      Node* etrue2 = etrue1;
-      Node* vtrue2 = etrue2 = graph()->NewNode(
-          simplified()->LoadField(AccessBuilder::ForConsStringFirst()),
-          lsubject, etrue2, if_true2);
+          if_false1 = if_true2;
+          efalse1 = etrue2;
+          vfalse1 = vtrue2;
+        }
 
-      Node* if_false2 = graph()->NewNode(common()->IfFalse(), branch2);
-      Node* efalse2 = etrue1;
-      Node* vfalse2;
-      {
-        // Flatten the {lsubject} ConsString first.
-        Operator::Properties properties =
-            Operator::kNoDeopt | Operator::kNoThrow;
-        Runtime::FunctionId id = Runtime::kFlattenString;
-        CallDescriptor const* desc = Linkage::GetRuntimeCallDescriptor(
-            graph()->zone(), id, 1, properties, CallDescriptor::kNoFlags);
-        vfalse2 = efalse2 = graph()->NewNode(
-            common()->Call(desc), jsgraph()->CEntryStubConstant(1), lsubject,
-            jsgraph()->ExternalConstant(ExternalReference(id, isolate())),
-            jsgraph()->Int32Constant(1), jsgraph()->NoContextConstant(),
-            efalse2, if_false2);
+        if_false0 = if_false1;
+        efalse0 = efalse1;
+        vfalse0 = vfalse1;
       }
 
-      // Retry the {loop} with the new subject.
-      loop->ReplaceInput(1, if_true2);
-      lindex->ReplaceInput(1, lindex);
-      leffect->ReplaceInput(1, etrue2);
-      lsubject->ReplaceInput(1, vtrue2);
-      loop->ReplaceInput(2, if_false2);
-      lindex->ReplaceInput(2, lindex);
-      leffect->ReplaceInput(2, efalse2);
-      lsubject->ReplaceInput(2, vfalse2);
-    }
+      control = graph()->NewNode(common()->Merge(2), if_true0, if_false0);
+      effect =
+          graph()->NewNode(common()->EffectPhi(2), etrue0, efalse0, control);
+      value = graph()->NewNode(common()->Phi(MachineRepresentation::kWord32, 2),
+                               vtrue0, vfalse0, control);
+    } break;
+    case StringOperationHint::kSeqStringOrExternalString: {
+      // We may need to loop several times for ConsString/SlicedString
+      // {subject}s.
+      Node* loop = graph()->NewNode(common()->Loop(4), control, control,
+                                    control, control);
+      Node* lsubject =
+          graph()->NewNode(common()->Phi(MachineRepresentation::kTagged, 4),
+                           subject, subject, subject, subject, loop);
+      Node* lindex =
+          graph()->NewNode(common()->Phi(MachineRepresentation::kWord32, 4),
+                           index, index, index, index, loop);
+      Node* leffect = graph()->NewNode(common()->EffectPhi(4), effect, effect,
+                                       effect, effect, loop);
+
+      control = loop;
+      effect = leffect;
+
+      // Determine the instance type of {lsubject}.
+      Node* lsubject_map = effect =
+          graph()->NewNode(simplified()->LoadField(AccessBuilder::ForMap()),
+                           lsubject, effect, control);
+      Node* lsubject_instance_type = effect = graph()->NewNode(
+          simplified()->LoadField(AccessBuilder::ForMapInstanceType()),
+          lsubject_map, effect, control);
 
-    Node* if_false1 = graph()->NewNode(common()->IfFalse(), branch1);
-    Node* efalse1 = efalse0;
-    Node* vfalse1;
-    {
-      // Check if the {lsubject} is an ExternalString.
-      Node* check2 = graph()->NewNode(
+      // Check if {lsubject} is a SeqString.
+      Node* check0 = graph()->NewNode(
           machine()->Word32Equal(),
           graph()->NewNode(machine()->Word32And(), lsubject_instance_type,
                            jsgraph()->Int32Constant(kStringRepresentationMask)),
-          jsgraph()->Int32Constant(kExternalStringTag));
-      Node* branch2 = graph()->NewNode(common()->Branch(BranchHint::kTrue),
-                                       check2, if_false1);
+          jsgraph()->Int32Constant(kSeqStringTag));
+      Node* branch0 = graph()->NewNode(common()->Branch(), check0, control);
 
-      Node* if_true2 = graph()->NewNode(common()->IfTrue(), branch2);
-      Node* etrue2 = efalse1;
-      Node* vtrue2;
+      Node* if_true0 = graph()->NewNode(common()->IfTrue(), branch0);
+      Node* etrue0 = effect;
+      Node* vtrue0;
+      {
+        // Check if the {lsubject} is a TwoByteSeqString or a OneByteSeqString.
+        Node* check1 = graph()->NewNode(
+            machine()->Word32Equal(),
+            graph()->NewNode(machine()->Word32And(), lsubject_instance_type,
+                             jsgraph()->Int32Constant(kStringEncodingMask)),
+            jsgraph()->Int32Constant(kTwoByteStringTag));
+        Node* branch1 = graph()->NewNode(common()->Branch(), check1, if_true0);
+
+        Node* if_true1 = graph()->NewNode(common()->IfTrue(), branch1);
+        Node* etrue1 = etrue0;
+        Node* vtrue1 = etrue1 =
+            graph()->NewNode(simplified()->LoadElement(
+                                 AccessBuilder::ForSeqTwoByteStringCharacter()),
+                             lsubject, lindex, etrue1, if_true1);
+
+        Node* if_false1 = graph()->NewNode(common()->IfFalse(), branch1);
+        Node* efalse1 = etrue0;
+        Node* vfalse1 = efalse1 =
+            graph()->NewNode(simplified()->LoadElement(
+                                 AccessBuilder::ForSeqOneByteStringCharacter()),
+                             lsubject, lindex, efalse1, if_false1);
+
+        if_true0 = graph()->NewNode(common()->Merge(2), if_true1, if_false1);
+        etrue0 =
+            graph()->NewNode(common()->EffectPhi(2), etrue1, efalse1, if_true0);
+        vtrue0 =
+            graph()->NewNode(common()->Phi(MachineRepresentation::kWord32, 2),
+                             vtrue1, vfalse1, if_true0);
+      }
+
+      Node* if_false0 = graph()->NewNode(common()->IfFalse(), branch0);
+      Node* efalse0 = effect;
+      Node* vfalse0;
       {
         // Check if the {lsubject} is a short external string.
-        Node* check3 = graph()->NewNode(
+        Node* check1 = graph()->NewNode(
             machine()->Word32Equal(),
             graph()->NewNode(
                 machine()->Word32And(), lsubject_instance_type,
                 jsgraph()->Int32Constant(kShortExternalStringMask)),
             jsgraph()->Int32Constant(0));
-        Node* branch3 = graph()->NewNode(common()->Branch(BranchHint::kTrue),
-                                         check3, if_true2);
+        Node* branch1 = graph()->NewNode(common()->Branch(BranchHint::kTrue),
+                                         check1, if_false0);
 
-        Node* if_true3 = graph()->NewNode(common()->IfTrue(), branch3);
-        Node* etrue3 = etrue2;
-        Node* vtrue3;
+        Node* if_true1 = graph()->NewNode(common()->IfTrue(), branch1);
+        Node* etrue1 = efalse0;
+        Node* vtrue1;
         {
           // Load the actual resource data from the {lsubject}.
-          Node* lsubject_resource_data = etrue3 = graph()->NewNode(
+          Node* lsubject_resource_data = etrue1 = graph()->NewNode(
               simplified()->LoadField(
                   AccessBuilder::ForExternalStringResourceData()),
-              lsubject, etrue3, if_true3);
+              lsubject, etrue1, if_true1);
 
           // Check if the {lsubject} is a TwoByteExternalString or a
           // OneByteExternalString.
-          Node* check4 = graph()->NewNode(
+          Node* check2 = graph()->NewNode(
               machine()->Word32Equal(),
               graph()->NewNode(machine()->Word32And(), lsubject_instance_type,
                                jsgraph()->Int32Constant(kStringEncodingMask)),
               jsgraph()->Int32Constant(kTwoByteStringTag));
-          Node* branch4 =
-              graph()->NewNode(common()->Branch(), check4, if_true3);
+          Node* branch2 =
+              graph()->NewNode(common()->Branch(), check2, if_true1);
 
-          Node* if_true4 = graph()->NewNode(common()->IfTrue(), branch4);
-          Node* etrue4 = etrue3;
-          Node* vtrue4 = etrue4 = graph()->NewNode(
+          Node* if_true2 = graph()->NewNode(common()->IfTrue(), branch2);
+          Node* etrue2 = etrue1;
+          Node* vtrue2 = etrue2 = graph()->NewNode(
               simplified()->LoadElement(
                   AccessBuilder::ForExternalTwoByteStringCharacter()),
-              lsubject_resource_data, lindex, etrue4, if_true4);
+              lsubject_resource_data, index, etrue2, if_true2);
 
-          Node* if_false4 = graph()->NewNode(common()->IfFalse(), branch4);
-          Node* efalse4 = etrue3;
-          Node* vfalse4 = efalse4 = graph()->NewNode(
+          Node* if_false2 = graph()->NewNode(common()->IfFalse(), branch2);
+          Node* efalse2 = etrue1;
+          Node* vfalse2 = efalse2 = graph()->NewNode(
               simplified()->LoadElement(
                   AccessBuilder::ForExternalOneByteStringCharacter()),
-              lsubject_resource_data, lindex, efalse4, if_false4);
+              lsubject_resource_data, index, efalse2, if_false2);
 
-          if_true3 = graph()->NewNode(common()->Merge(2), if_true4, if_false4);
-          etrue3 = graph()->NewNode(common()->EffectPhi(2), etrue4, efalse4,
-                                    if_true3);
-          vtrue3 =
+          if_true1 = graph()->NewNode(common()->Merge(2), if_true2, if_false2);
+          etrue1 = graph()->NewNode(common()->EffectPhi(2), etrue2, efalse2,
+                                    if_true1);
+          vtrue1 =
               graph()->NewNode(common()->Phi(MachineRepresentation::kWord32, 2),
-                               vtrue4, vfalse4, if_true3);
+                               vtrue2, vfalse2, if_true1);
         }
 
-        Node* if_false3 = graph()->NewNode(common()->IfFalse(), branch3);
-        Node* efalse3 = etrue2;
-        Node* vfalse3;
+        Node* if_false1 = graph()->NewNode(common()->IfFalse(), branch1);
+        Node* efalse1 = efalse0;
+        Node* vfalse1;
         {
           // The {lsubject} might be compressed, call the runtime.
           Operator::Properties properties =
@@ -2438,59 +2641,32 @@ EffectControlLinearizer::LowerStringCharCodeAt(Node* node, Node* effect,
           Runtime::FunctionId id = Runtime::kExternalStringGetChar;
           CallDescriptor const* desc = Linkage::GetRuntimeCallDescriptor(
               graph()->zone(), id, 2, properties, CallDescriptor::kNoFlags);
-          vfalse3 = efalse3 = graph()->NewNode(
+          vfalse1 = efalse1 = graph()->NewNode(
               common()->Call(desc), jsgraph()->CEntryStubConstant(1), lsubject,
-              ChangeInt32ToSmi(lindex),
+              ChangeInt32ToSmi(index),
               jsgraph()->ExternalConstant(ExternalReference(id, isolate())),
               jsgraph()->Int32Constant(2), jsgraph()->NoContextConstant(),
-              efalse3, if_false3);
-          vfalse3 = ChangeSmiToInt32(vfalse3);
+              efalse1, if_false1);
+          vfalse1 = ChangeSmiToInt32(vfalse1);
         }
 
-        if_true2 = graph()->NewNode(common()->Merge(2), if_true3, if_false3);
-        etrue2 =
-            graph()->NewNode(common()->EffectPhi(2), etrue3, efalse3, if_true2);
-        vtrue2 =
+        if_false0 = graph()->NewNode(common()->Merge(2), if_true1, if_false1);
+        efalse0 = graph()->NewNode(common()->EffectPhi(2), etrue1, efalse1,
+                                   if_false0);
+        vfalse0 =
             graph()->NewNode(common()->Phi(MachineRepresentation::kWord32, 2),
-                             vtrue3, vfalse3, if_true2);
+                             vtrue1, vfalse1, if_false0);
       }
 
-      Node* if_false2 = graph()->NewNode(common()->IfFalse(), branch2);
-      Node* efalse2 = efalse1;
-      {
-        // The {lsubject} is a SlicedString, continue with its parent.
-        Node* lsubject_parent = efalse2 = graph()->NewNode(
-            simplified()->LoadField(AccessBuilder::ForSlicedStringParent()),
-            lsubject, efalse2, if_false2);
-        Node* lsubject_offset = efalse2 = graph()->NewNode(
-            simplified()->LoadField(AccessBuilder::ForSlicedStringOffset()),
-            lsubject, efalse2, if_false2);
-        Node* lsubject_index = graph()->NewNode(
-            machine()->Int32Add(), lindex, ChangeSmiToInt32(lsubject_offset));
-
-        // Retry the {loop} with the parent subject.
-        loop->ReplaceInput(3, if_false2);
-        leffect->ReplaceInput(3, efalse2);
-        lindex->ReplaceInput(3, lsubject_index);
-        lsubject->ReplaceInput(3, lsubject_parent);
-      }
-
-      if_false1 = if_true2;
-      efalse1 = etrue2;
-      vfalse1 = vtrue2;
+      control = graph()->NewNode(common()->Merge(2), if_true0, if_false0);
+      effect =
+          graph()->NewNode(common()->EffectPhi(2), etrue0, efalse0, control);
+      value = graph()->NewNode(common()->Phi(MachineRepresentation::kWord32, 2),
+                               vtrue0, vfalse0, control);
+      break;
     }
-
-    if_false0 = if_false1;
-    efalse0 = efalse1;
-    vfalse0 = vfalse1;
   }
 
-  control = graph()->NewNode(common()->Merge(2), if_true0, if_false0);
-  effect = graph()->NewNode(common()->EffectPhi(2), etrue0, efalse0, control);
-  Node* value =
-      graph()->NewNode(common()->Phi(MachineRepresentation::kWord32, 2), vtrue0,
-                       vfalse0, control);
-
   return ValueEffectControl(value, effect, control);
 }
 
@@ -2521,8 +2697,9 @@ EffectControlLinearizer::LowerStringFromCharCode(Node* node, Node* effect,
 
     // Compute the {cache} index for {code}.
     Node* index =
-        machine()->Is32() ? code : graph()->NewNode(
-                                       machine()->ChangeUint32ToUint64(), code);
+        machine()->Is32()
+            ? code
+            : graph()->NewNode(machine()->ChangeUint32ToUint64(), code);
 
     // Check if we have an entry for the {code} in the single character string
     // cache already.
@@ -2614,6 +2791,197 @@ EffectControlLinearizer::LowerStringFromCharCode(Node* node, Node* effect,
 }
 
 EffectControlLinearizer::ValueEffectControl
+EffectControlLinearizer::LowerStringFromCodePoint(Node* node, Node* effect,
+                                                  Node* control) {
+  Node* value = node->InputAt(0);
+  Node* code = value;
+
+  Node* etrue0 = effect;
+  Node* vtrue0;
+
+  // Check if the {code} is a single code unit
+  Node* check0 = graph()->NewNode(machine()->Uint32LessThanOrEqual(), code,
+                                  jsgraph()->Uint32Constant(0xFFFF));
+  Node* branch0 =
+      graph()->NewNode(common()->Branch(BranchHint::kTrue), check0, control);
+
+  Node* if_true0 = graph()->NewNode(common()->IfTrue(), branch0);
+
+  // Check if the {code} is a one byte character
+  Node* check1 =
+      graph()->NewNode(machine()->Uint32LessThanOrEqual(), code,
+                       jsgraph()->Uint32Constant(String::kMaxOneByteCharCode));
+  Node* branch1 =
+      graph()->NewNode(common()->Branch(BranchHint::kTrue), check1, if_true0);
+
+  Node* if_true1 = graph()->NewNode(common()->IfTrue(), branch1);
+  Node* etrue1 = etrue0;
+  Node* vtrue1;
+  {
+    // Load the isolate wide single character string cache.
+    Node* cache =
+        jsgraph()->HeapConstant(factory()->single_character_string_cache());
+
+    // Compute the {cache} index for {code}.
+    Node* index =
+        machine()->Is32()
+            ? code
+            : graph()->NewNode(machine()->ChangeUint32ToUint64(), code);
+
+    // Check if we have an entry for the {code} in the single character string
+    // cache already.
+    Node* entry = etrue1 = graph()->NewNode(
+        simplified()->LoadElement(AccessBuilder::ForFixedArrayElement()), cache,
+        index, etrue1, if_true1);
+
+    Node* check2 = graph()->NewNode(machine()->WordEqual(), entry,
+                                    jsgraph()->UndefinedConstant());
+    Node* branch2 = graph()->NewNode(common()->Branch(BranchHint::kFalse),
+                                     check2, if_true1);
+
+    Node* if_true2 = graph()->NewNode(common()->IfTrue(), branch2);
+    Node* etrue2 = etrue1;
+    Node* vtrue2;
+    {
+      // Allocate a new SeqOneByteString for {code}.
+      vtrue2 = etrue2 = graph()->NewNode(
+          simplified()->Allocate(NOT_TENURED),
+          jsgraph()->Int32Constant(SeqOneByteString::SizeFor(1)), etrue2,
+          if_true2);
+      etrue2 = graph()->NewNode(
+          simplified()->StoreField(AccessBuilder::ForMap()), vtrue2,
+          jsgraph()->HeapConstant(factory()->one_byte_string_map()), etrue2,
+          if_true2);
+      etrue2 = graph()->NewNode(
+          simplified()->StoreField(AccessBuilder::ForNameHashField()), vtrue2,
+          jsgraph()->IntPtrConstant(Name::kEmptyHashField), etrue2, if_true2);
+      etrue2 = graph()->NewNode(
+          simplified()->StoreField(AccessBuilder::ForStringLength()), vtrue2,
+          jsgraph()->SmiConstant(1), etrue2, if_true2);
+      etrue2 = graph()->NewNode(
+          machine()->Store(StoreRepresentation(MachineRepresentation::kWord8,
+                                               kNoWriteBarrier)),
+          vtrue2, jsgraph()->IntPtrConstant(SeqOneByteString::kHeaderSize -
+                                            kHeapObjectTag),
+          code, etrue2, if_true2);
+
+      // Remember it in the {cache}.
+      etrue2 = graph()->NewNode(
+          simplified()->StoreElement(AccessBuilder::ForFixedArrayElement()),
+          cache, index, vtrue2, etrue2, if_true2);
+    }
+
+    // Use the {entry} from the {cache}.
+    Node* if_false2 = graph()->NewNode(common()->IfFalse(), branch2);
+    Node* efalse2 = etrue0;
+    Node* vfalse2 = entry;
+
+    if_true1 = graph()->NewNode(common()->Merge(2), if_true2, if_false2);
+    etrue1 =
+        graph()->NewNode(common()->EffectPhi(2), etrue2, efalse2, if_true1);
+    vtrue1 = graph()->NewNode(common()->Phi(MachineRepresentation::kTagged, 2),
+                              vtrue2, vfalse2, if_true1);
+  }
+
+  Node* if_false1 = graph()->NewNode(common()->IfFalse(), branch1);
+  Node* efalse1 = effect;
+  Node* vfalse1;
+  {
+    // Allocate a new SeqTwoByteString for {code}.
+    vfalse1 = efalse1 =
+        graph()->NewNode(simplified()->Allocate(NOT_TENURED),
+                         jsgraph()->Int32Constant(SeqTwoByteString::SizeFor(1)),
+                         efalse1, if_false1);
+    efalse1 = graph()->NewNode(
+        simplified()->StoreField(AccessBuilder::ForMap()), vfalse1,
+        jsgraph()->HeapConstant(factory()->string_map()), efalse1, if_false1);
+    efalse1 = graph()->NewNode(
+        simplified()->StoreField(AccessBuilder::ForNameHashField()), vfalse1,
+        jsgraph()->IntPtrConstant(Name::kEmptyHashField), efalse1, if_false1);
+    efalse1 = graph()->NewNode(
+        simplified()->StoreField(AccessBuilder::ForStringLength()), vfalse1,
+        jsgraph()->SmiConstant(1), efalse1, if_false1);
+    efalse1 = graph()->NewNode(
+        machine()->Store(StoreRepresentation(MachineRepresentation::kWord16,
+                                             kNoWriteBarrier)),
+        vfalse1, jsgraph()->IntPtrConstant(SeqTwoByteString::kHeaderSize -
+                                           kHeapObjectTag),
+        code, efalse1, if_false1);
+  }
+
+  if_true0 = graph()->NewNode(common()->Merge(2), if_true1, if_false1);
+  etrue0 = graph()->NewNode(common()->EffectPhi(2), etrue1, efalse1, if_true0);
+  vtrue0 = graph()->NewNode(common()->Phi(MachineRepresentation::kTagged, 2),
+                            vtrue1, vfalse1, control);
+
+  // Generate surrogate pair string
+  Node* if_false0 = graph()->NewNode(common()->IfTrue(), branch0);
+  Node* efalse0 = effect;
+  Node* vfalse0;
+  {
+    switch (UnicodeEncodingOf(node->op())) {
+      case UnicodeEncoding::UTF16:
+        break;
+
+      case UnicodeEncoding::UTF32: {
+        // Convert UTF32 to UTF16 code units, and store as a 32 bit word.
+        Node* lead_offset = jsgraph()->Int32Constant(0xD800 - (0x10000 >> 10));
+
+        // lead = (codepoint >> 10) + LEAD_OFFSET
+        Node* lead =
+            graph()->NewNode(machine()->Int32Add(),
+                             graph()->NewNode(machine()->Word32Shr(), code,
+                                              jsgraph()->Int32Constant(10)),
+                             lead_offset);
+
+        // trail = (codepoint & 0x3FF) + 0xDC00;
+        Node* trail =
+            graph()->NewNode(machine()->Int32Add(),
+                             graph()->NewNode(machine()->Word32And(), code,
+                                              jsgraph()->Int32Constant(0x3FF)),
+                             jsgraph()->Int32Constant(0xDC00));
+
+        // codpoint = (trail << 16) | lead;
+        code = efalse1 =
+            graph()->NewNode(machine()->Word32Or(),
+                             graph()->NewNode(machine()->Word32Shl(), trail,
+                                              jsgraph()->Int32Constant(16)),
+                             lead);
+        break;
+      }
+    }
+
+    // Allocate a new SeqTwoByteString for {code}.
+    vfalse0 = efalse0 =
+        graph()->NewNode(simplified()->Allocate(NOT_TENURED),
+                         jsgraph()->Int32Constant(SeqTwoByteString::SizeFor(2)),
+                         efalse0, if_false0);
+    efalse0 = graph()->NewNode(
+        simplified()->StoreField(AccessBuilder::ForMap()), vfalse0,
+        jsgraph()->HeapConstant(factory()->string_map()), efalse0, if_false0);
+    efalse0 = graph()->NewNode(
+        simplified()->StoreField(AccessBuilder::ForNameHashField()), vfalse0,
+        jsgraph()->IntPtrConstant(Name::kEmptyHashField), efalse0, if_false1);
+    efalse0 = graph()->NewNode(
+        simplified()->StoreField(AccessBuilder::ForStringLength()), vfalse0,
+        jsgraph()->SmiConstant(2), efalse0, if_false0);
+    efalse0 = graph()->NewNode(
+        machine()->Store(StoreRepresentation(MachineRepresentation::kWord32,
+                                             kNoWriteBarrier)),
+        vfalse0, jsgraph()->IntPtrConstant(SeqTwoByteString::kHeaderSize -
+                                           kHeapObjectTag),
+        code, efalse0, if_false0);
+  }
+
+  control = graph()->NewNode(common()->Merge(2), if_true0, if_false0);
+  effect = graph()->NewNode(common()->EffectPhi(2), etrue0, efalse0, control);
+  value = graph()->NewNode(common()->Phi(MachineRepresentation::kTagged, 2),
+                           vtrue0, vfalse0, control);
+
+  return ValueEffectControl(value, effect, control);
+}
+
+EffectControlLinearizer::ValueEffectControl
 EffectControlLinearizer::LowerStringComparison(Callable const& callable,
                                                Node* node, Node* effect,
                                                Node* control) {