Reland "[turbofan] inline %StringIteratorPrototype%.next in JSBuiltinReducer"

src/compiler/simplified-operator.cc

Index: src/compiler/simplified-operator.cc
diff --git a/src/compiler/simplified-operator.cc b/src/compiler/simplified-operator.cc
index b7b230fc7b25ce02595684639a0bae1fc08aea49..a7bbae3493ce70fc555291f8a4c8f7a3e0f11282 100644
--- a/src/compiler/simplified-operator.cc
+++ b/src/compiler/simplified-operator.cc
@@ -336,6 +336,11 @@ PretenureFlag PretenureFlagOf(const Operator* op) {
   return OpParameter<PretenureFlag>(op);
 }
 
+UnicodeEncoding UnicodeEncodingOf(const Operator* op) {
+  DCHECK(op->opcode() == IrOpcode::kStringFromCodePoint);
+  return OpParameter<UnicodeEncoding>(op);

[adamk, 2016/10/07 21:49:04]

This call is failing under the CFI build:

../../src/compiler/operator.h:216:10: runtime error: control flow integrity
check for type 'v8::internal::compiler::Operator1<v8::internal::UnicodeEncoding,
v8::internal::compiler::OpEqualTo<v8::internal::UnicodeEncoding>,
v8::internal::compiler::OpHash<v8::internal::UnicodeEncoding> >' failed during
cast to unrelated type (vtable address 0x000000dff620)
0x000000dff620: note: vtable is of type
'v8::internal::compiler::SimplifiedOperatorGlobalCache::StringFromCodePointOperator<(v8::internal::UnicodeEncoding)0>'
 00 00 00 00  50 08 a8 00 00 00 00 00  b0 32 ad 00 00 00 00 00  80 08 a8 00 00
00 00 00  b0 08 a8 00
              ^ 
    #0 0xacc5d2 in v8::internal::UnicodeEncoding const&
v8::internal::compiler::OpParameter<v8::internal::UnicodeEncoding>(v8::internal::compiler::Operator
const*)
/b/build/slave/linux64-cfi/build/v8/out/Release/../../src/compiler/operator.h:217:9
    #1 0x4a82d8 in
v8::internal::compiler::UnicodeEncodingOf(v8::internal::compiler::Operator
const*)
/b/build/slave/linux64-cfi/build/v8/out/Release/../../src/compiler/simplified-operator.cc:341:10
[snip]

See
https://build.chromium.org/p/client.v8/builders/V8%20Linux64%20-%20cfi/builds...
for details. Unclear to me why this fails only for this case and not other calls
of OpParameter() calls, unless those failures are either suppressed or not
covered by tests.

[adamk, 2016/10/07 21:52:26]

Actually, this looks like we just need to make StringFromCodePoint subclass
Operator1 instead of Operator. Will see if I can throw together a fix.

+}
+
 #define PURE_OP_LIST(V)                                          \
   V(BooleanNot, Operator::kNoProperties, 1, 0)                   \
   V(NumberEqual, Operator::kCommutative, 2, 0)                   \
@@ -468,6 +473,17 @@ struct SimplifiedOperatorGlobalCache final {
   CHECKED_OP_LIST(CHECKED)
 #undef CHECKED
 
+  template <UnicodeEncoding kEncoding>
+  struct StringFromCodePointOperator final : public Operator {
+    StringFromCodePointOperator()
+        : Operator(IrOpcode::kStringFromCodePoint, Operator::kPure,
+                   "StringFromCodePoint", 1, 0, 0, 1, 0, 0) {}
+  };
+  StringFromCodePointOperator<UnicodeEncoding::UTF16>
+      kStringFromCodePointOperatorUTF16;
+  StringFromCodePointOperator<UnicodeEncoding::UTF32>
+      kStringFromCodePointOperatorUTF32;
+
   struct ArrayBufferWasNeuteredOperator final : public Operator {
     ArrayBufferWasNeuteredOperator()
         : Operator(IrOpcode::kArrayBufferWasNeutered, Operator::kEliminatable,
@@ -754,6 +770,18 @@ const Operator* SimplifiedOperatorBuilder::StoreBuffer(BufferAccess access) {
   return nullptr;
 }
 
+const Operator* SimplifiedOperatorBuilder::StringFromCodePoint(
+    UnicodeEncoding encoding) {
+  switch (encoding) {
+    case UnicodeEncoding::UTF16:
+      return &cache_.kStringFromCodePointOperatorUTF16;
+    case UnicodeEncoding::UTF32:
+      return &cache_.kStringFromCodePointOperatorUTF32;
+  }
+  UNREACHABLE();
+  return nullptr;
+}
+
 #define SPECULATIVE_NUMBER_BINOP(Name)                                        \
   const Operator* SimplifiedOperatorBuilder::Name(NumberOperationHint hint) { \
     switch (hint) {                                                           \