[builtins] implement JSBuiltinReducer for ArrayIteratorNext()

src/code-stub-assembler.cc

 // Copyright 2016 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 #include "src/code-stub-assembler.h"
 #include "src/code-factory.h"
 #include "src/frames-inl.h"
 #include "src/frames.h"
 #include "src/ic/handler-configuration.h"
 #include "src/ic/stub-cache.h"
 
@@ skipping 8692 matching lines @@
     Branch(Word32Equal(array_type, Int32Constant(JS_TYPED_ARRAY_TYPE)),
            &if_istypedarray, &if_isgeneric);
 
     Bind(&if_isgeneric);
     {
       Label if_isfast(this), if_isslow(this);
       BranchIfFastJSArray(array, context, &if_isfast, &if_isslow);
 
       Bind(&if_isfast);
       {
-        Node* map_index =
-            IntPtrAdd(IntPtrConstant(kBaseMapIndex + kFastIteratorOffset),
-                      LoadMapElementsKind(array_map));
-        CSA_ASSERT(IntPtrGreaterThanOrEqual(
-            map_index, IntPtrConstant(kBaseMapIndex + kFastIteratorOffset)));
-        CSA_ASSERT(IntPtrLessThan(
-            map_index, IntPtrConstant(kBaseMapIndex + kSlowIteratorOffset)));
+        Label if_ispacked(this), if_isholey(this);
+        Node* elements_kind = LoadMapElementsKind(array_map);
+        Branch(Word32Equal(Word32And(elements_kind, Int32Constant(1)),
+                           Int32Constant(0)),
+               &if_ispacked, &if_isholey);

[Camillo Bruni, 2016/11/09 12:03:49]

Could you add a IsFastPackedElementsKind helper on the CodeStubAssembler with
the corresponding STATIC_ASSERT (same probably for BranchIfFastJSArray)

[caitp, 2016/11/09 17:40:16]

Done, 2 new helpers (CSA::IsFastElementsKind() and
CSA::IsHoleyFastElementsKind())

+        Bind(&if_isholey);
+        {
+          // Check the protector cell --- create a Generic iterator if invalid
+          Node* protector_cell = LoadRoot(Heap::kArrayProtectorRootIndex);
+          DCHECK(isolate()->heap()->array_protector()->IsPropertyCell());
+          GotoUnless(
+              WordEqual(
+                  LoadObjectField(protector_cell, PropertyCell::kValueOffset),
+                  SmiConstant(Smi::FromInt(Isolate::kArrayProtectorValid))),
+              &if_isslow);
 
-        var_map_index.Bind(map_index);
-        var_array_map.Bind(array_map);
-        Goto(&allocate_iterator);
+          // Otherwise, check that the prototype is a stable initial

[Benedikt Meurer, 2016/11/09 05:37:05]

Maybe it'd be sufficient to check for current contexts Array.prototype and
Object.prototype, but I don't have a strong opinion on this. You don't need the
stability checks on the maps tho, that's only required for optimized code, so
that we can use the code dependency mechanism.

Also can you add an explanation of why we have to do this dance?

[caitp, 2016/11/09 17:40:16]

Updated to only check the current context, and added a more detailed comment

+          // Array prototype
+          Node* prototype = LoadMapPrototype(array_map);
+          GotoUnless(IsAnyInitialArrayPrototype(prototype), &if_isslow);
+          GotoUnless(Word32Equal(DecodeWord32<Map::IsUnstable>(
+                                     LoadMapBitField3(array_map)),
+                                 Int32Constant(0)),
+                     &if_isslow);
+
+          // Check that the Object prototype is stable as well.
+          prototype = LoadMapPrototype(LoadMap(prototype));

[Camillo Bruni, 2016/11/09 12:03:49]

object_map = LoadMap(prototype); ...

+          GotoUnless(IsAnyInitialObjectPrototype(prototype), &if_isslow);
+          Branch(Word32Equal(
+                     DecodeWord32<Map::IsUnstable>(LoadMapBitField3(array_map)),

[Camillo Bruni, 2016/11/09 12:03:49]

You probably wanted to check the object_map here.

[caitp, 2016/11/09 17:40:16]

good catch, but I guess we don't need stability checks for the baseline case

+                     Int32Constant(0)),
+                 &if_ispacked, &if_isslow);
+        }
+        Bind(&if_ispacked);
+        {
+          Node* map_index =
+              IntPtrAdd(IntPtrConstant(kBaseMapIndex + kFastIteratorOffset),
+                        LoadMapElementsKind(array_map));
+          CSA_ASSERT(IntPtrGreaterThanOrEqual(
+              map_index, IntPtrConstant(kBaseMapIndex + kFastIteratorOffset)));
+          CSA_ASSERT(IntPtrLessThan(
+              map_index, IntPtrConstant(kBaseMapIndex + kSlowIteratorOffset)));
+
+          var_map_index.Bind(map_index);
+          var_array_map.Bind(array_map);
+          Goto(&allocate_iterator);
+        }
       }
 
       Bind(&if_isslow);
       {
         Node* map_index = IntPtrAdd(IntPtrConstant(kBaseMapIndex),
                                     IntPtrConstant(kSlowIteratorOffset));
         var_map_index.Bind(map_index);
         var_array_map.Bind(UndefinedConstant());
         Goto(&allocate_iterator);
       }
@@ skipping 119 matching lines @@
       },
       -kPointerSize, CodeStubAssembler::IndexAdvanceMode::kPost);
 }
 
 void CodeStubArguments::PopAndReturn(compiler::Node* value) {
   assembler_->PopAndReturn(
       assembler_->IntPtrAddFoldConstants(argc_, assembler_->IntPtrConstant(1)),
       value);
 }
 
+// Implement Isolate::IsInAnyContext() in CodeStubAssembler form.
+compiler::Node* CodeStubAssembler::IsInAnyNativeContext(compiler::Node* object,
+                                                        uint32_t index) {
+  Variable var_context(this, MachineRepresentation::kTagged);
+  Variable var_found(this, MachineRepresentation::kWord32);
+  var_context.Bind(LoadFirstNativeContext());
+  var_found.Bind(Int32Constant(0));
+
+  Label loop(this, &var_context), done(this);
+  Branch(WordEqual(var_context.value(), UndefinedConstant()), &done, &loop);

[Camillo Bruni, 2016/11/09 12:03:49]

nit: IsUndefined(var_context.value())

+
+  // Loop while {context} is not undefined:
+  Bind(&loop);
+  {
+    Label continue_loop(this), break_loop(this);
+    Node* context = var_context.value();
+    Node* value = LoadContextElement(context, index);
+
+    Branch(WordEqual(value, object), &break_loop, &continue_loop);
+    Bind(&break_loop);
+    var_found.Bind(Int32Constant(1));
+    Goto(&done);
+
+    Bind(&continue_loop);
+    var_context.Bind(LoadContextElement(context, Context::NEXT_CONTEXT_LINK));
+    Branch(WordEqual(var_context.value(), UndefinedConstant()), &done, &loop);

[Camillo Bruni, 2016/11/09 12:03:49]

nit: IsUndefined(var_context.value())

+  }
+
+  Bind(&done);
+  Node* result = Word32NotEqual(var_found.value(), Int32Constant(0));
+  return result;
+}
+
+compiler::Node* CodeStubAssembler::IsAnyInitialArrayPrototype(
+    compiler::Node* object) {
+  return IsInAnyNativeContext(object, Context::INITIAL_ARRAY_PROTOTYPE_INDEX);
+}
+
+compiler::Node* CodeStubAssembler::IsAnyInitialObjectPrototype(
+    compiler::Node* object) {
+  return IsInAnyNativeContext(object, Context::INITIAL_OBJECT_PROTOTYPE_INDEX);
+}
+
 }  // namespace internal
 }  // namespace v8