[stubs] Port builtin for Array.push fast-case from Crankshaft to TF

src/code-stub-assembler.cc

 // Copyright 2016 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 #include "src/code-stub-assembler.h"
 #include "src/code-factory.h"
 #include "src/frames-inl.h"
 #include "src/frames.h"
 #include "src/ic/handler-configuration.h"
 #include "src/ic/stub-cache.h"
 
@@ skipping 509 matching lines @@
 
   Bind(&return_result);
   return var_result.value();
 }
 
 Node* CodeStubAssembler::TaggedIsSmi(Node* a) {
   return WordEqual(WordAnd(BitcastTaggedToWord(a), IntPtrConstant(kSmiTagMask)),
                    IntPtrConstant(0));
 }
 
+Node* CodeStubAssembler::TaggedIsNotSmi(Node* a) {
+  return WordNotEqual(
+      WordAnd(BitcastTaggedToWord(a), IntPtrConstant(kSmiTagMask)),
+      IntPtrConstant(0));
+}
+
 Node* CodeStubAssembler::WordIsPositiveSmi(Node* a) {
   return WordEqual(WordAnd(a, IntPtrConstant(kSmiTagMask | kSmiSignMask)),
                    IntPtrConstant(0));
 }
 
 Node* CodeStubAssembler::WordIsWordAligned(Node* word) {
   return WordEqual(IntPtrConstant(0),
                    WordAnd(word, IntPtrConstant((1 << kPointerSizeLog2) - 1)));
 }
 
@@ skipping 108 matching lines @@
 
 void CodeStubAssembler::BranchIfJSObject(Node* object, Label* if_true,
                                          Label* if_false) {
   GotoIf(TaggedIsSmi(object), if_false);
   STATIC_ASSERT(LAST_JS_OBJECT_TYPE == LAST_TYPE);
   Branch(Int32GreaterThanOrEqual(LoadInstanceType(object),
                                  Int32Constant(FIRST_JS_OBJECT_TYPE)),
          if_true, if_false);
 }
 
-void CodeStubAssembler::BranchIfFastJSArray(Node* object, Node* context,
-                                            Label* if_true, Label* if_false) {
+void CodeStubAssembler::BranchIfFastJSArray(
+    Node* object, Node* context, CodeStubAssembler::FastJSArrayAccessMode mode,
+    Label* if_true, Label* if_false) {
   // Bailout if receiver is a Smi.
   GotoIf(TaggedIsSmi(object), if_false);
 
   Node* map = LoadMap(object);
 
   // Bailout if instance type is not JS_ARRAY_TYPE.
   GotoIf(WordNotEqual(LoadMapInstanceType(map), Int32Constant(JS_ARRAY_TYPE)),
          if_false);
 
   Node* elements_kind = LoadMapElementsKind(map);
 
   // Bailout if receiver has slow elements.
   GotoUnless(IsFastElementsKind(elements_kind), if_false);
 
   // Check prototype chain if receiver does not have packed elements.
-  GotoUnless(IsHoleyFastElementsKind(elements_kind), if_true);
-
+  if (mode == FastJSArrayAccessMode::INBOUNDS_READ) {
+    GotoUnless(IsHoleyFastElementsKind(elements_kind), if_true);
+  }
   BranchIfPrototypesHaveNoElements(map, if_true, if_false);
 }
 
 Node* CodeStubAssembler::AllocateRawUnaligned(Node* size_in_bytes,
                                               AllocationFlags flags,
                                               Node* top_address,
                                               Node* limit_address) {
   Node* top = Load(MachineType::Pointer(), top_address);
   Node* limit = Load(MachineType::Pointer(), limit_address);
 
@@ skipping 668 matching lines @@
 Node* CodeStubAssembler::StoreFixedDoubleArrayElement(
     Node* object, Node* index_node, Node* value, ParameterMode parameter_mode) {
   CSA_ASSERT(this, IsFixedDoubleArray(object));
   Node* offset =
       ElementOffsetFromIndex(index_node, FAST_DOUBLE_ELEMENTS, parameter_mode,
                              FixedArray::kHeaderSize - kHeapObjectTag);
   MachineRepresentation rep = MachineRepresentation::kFloat64;
   return StoreNoWriteBarrier(rep, object, offset, value);
 }
 
+Node* CodeStubAssembler::BuildAppendJSArray(ElementsKind kind, Node* context,
+                                            Node* array,
+                                            CodeStubArguments& args,
+                                            Variable& arg_index,
+                                            Label* bailout) {
+  Comment("BuildAppendJSArray: %s", ElementsKindToString(kind));
+  Label pre_bailout(this);
+  Label success(this);
+  Variable elements(this, MachineRepresentation::kTagged);
+  ParameterMode mode = OptimalParameterMode();
+  Variable capacity(this, OptimalParameterRepresentation());
+  Variable length(this, OptimalParameterRepresentation());
+  length.Bind(UntagParameter(LoadJSArrayLength(array), mode));
+  elements.Bind(LoadElements(array));
+  capacity.Bind(

[Jakob Kummerow, 2016/11/23 17:17:06]

I think |capacity| could simply be a Node*, I see no reason why it needs to be a
Variable.

[danno, 2016/11/29 14:39:59]

Done.

+      UntagParameter(LoadFixedArrayBaseLength(elements.value()), mode));
+
+  // Resize the capacity of the fixed array if it doesn't fit.
+  CodeStubAssembler::VariableList grow_vars({&capacity, &elements}, zone());
+  Label fits(this, grow_vars);
+  Node* first = arg_index.value();
+  Node* growth = IntPtrSubFoldConstants(args.GetLength(), first);
+  Node* new_length = IntPtrAdd(
+      mode == INTPTR_PARAMETERS ? growth : SmiTag(growth), length.value());
+  GotoUnless(IntPtrGreaterThanOrEqual(new_length, capacity.value()), &fits);
+  Node* new_capacity = CalculateNewElementsCapacity(
+      IntPtrAdd(new_length, IntPtrOrSmiConstant(1, mode)), mode);
+  elements.Bind(GrowElementsCapacity(array, elements.value(), kind, kind,
+                                     capacity.value(), new_capacity, mode,
+                                     &pre_bailout));
+  Goto(&fits);
+  Bind(&fits);
+
+  // Push each argument onto the end of the array now that there is enough
+  // capacity.
+  CodeStubAssembler::VariableList push_vars({&length, &elements}, zone());
+  args.ForEach(
+      push_vars,
+      [kind, array, context, mode, &length, &elements, &pre_bailout](

[Jakob Kummerow, 2016/11/23 17:17:06]

nit: |array| and |context| appear to be unused, drop them

[danno, 2016/11/29 14:39:59]

Done.

+          CodeStubAssembler* assembler, Node* arg) {
+        if (IsFastSmiElementsKind(kind)) {
+          assembler->GotoUnless(assembler->TaggedIsSmi(arg), &pre_bailout);

[Jakob Kummerow, 2016/11/23 17:17:05]

nit: now that you have TaggedIsNotSmi, you could use it here

[danno, 2016/11/29 14:39:59]

Done.

+        } else if (IsFastDoubleElementsKind(kind)) {
+          assembler->GotoIfNotNumber(arg, &pre_bailout);
+        }
+        if (IsFastDoubleElementsKind(kind)) {
+          assembler->StoreFixedDoubleArrayElement(
+              elements.value(), length.value(),
+              assembler->ChangeNumberToFloat64(arg), mode);
+        } else {
+          WriteBarrierMode barrier_mode = IsFastSmiElementsKind(kind)
+                                              ? SKIP_WRITE_BARRIER
+                                              : UPDATE_WRITE_BARRIER;
+          assembler->StoreFixedArrayElement(elements.value(), length.value(),
+                                            arg, barrier_mode, mode);
+        }
+        assembler->Increment(length, 1, mode);
+      },
+      first, nullptr);
+  length.Bind(TagParameter(length.value(), mode));
+  StoreObjectFieldNoWriteBarrier(array, JSArray::kLengthOffset, length.value());
+  Goto(&success);
+
+  Bind(&pre_bailout);
+  length.Bind(TagParameter(length.value(), mode));
+  Node* diff = SmiSub(length.value(), LoadJSArrayLength(array));
+  StoreObjectFieldNoWriteBarrier(array, JSArray::kLengthOffset, length.value());
+  arg_index.Bind(IntPtrAdd(arg_index.value(), SmiUntag(diff)));
+  Goto(bailout);
+
+  Bind(&success);
+  return length.value();
+}
+
 Node* CodeStubAssembler::AllocateHeapNumber(MutableMode mode) {
   Node* result = Allocate(HeapNumber::kSize, kNone);
   Heap::RootListIndex heap_map_index =
       mode == IMMUTABLE ? Heap::kHeapNumberMapRootIndex
                         : Heap::kMutableHeapNumberMapRootIndex;
   Node* map = LoadRoot(heap_map_index);
   StoreMapNoWriteBarrier(result, map);
   return result;
 }
 
@@ skipping 748 matching lines @@
                       to_index_smi == from_index_smi));
   BuildFastLoop(vars, MachineType::PointerRepresentation(), from_offset,
                 limit_offset,
                 [from_string, to_string, &current_to_offset, to_increment, type,
                  rep, index_same](CodeStubAssembler* assembler, Node* offset) {
                   Node* value = assembler->Load(type, from_string, offset);
                   assembler->StoreNoWriteBarrier(
                       rep, to_string,
                       index_same ? offset : current_to_offset.value(), value);
                   if (!index_same) {
-                    current_to_offset.Bind(assembler->IntPtrAdd(
-                        current_to_offset.value(),
-                        assembler->IntPtrConstant(to_increment)));
+                    assembler->Increment(current_to_offset, to_increment,
+                                         INTPTR_PARAMETERS);

[Jakob Kummerow, 2016/11/23 17:17:05]

nit: INTPTR_PARAMETERS is the default, no need to specify it explicitly

[danno, 2016/11/29 14:39:59]

Done.

                   }
                 },
                 from_increment, IndexAdvanceMode::kPost);
 }
 
 Node* CodeStubAssembler::LoadElementAndPrepareForStore(Node* array,
                                                        Node* offset,
                                                        ElementsKind from_kind,
                                                        ElementsKind to_kind,
                                                        Label* if_hole) {
@@ skipping 401 matching lines @@
   {
     // The {value} is a Smi, convert it to a String.
     Callable callable = CodeFactory::NumberToString(isolate());
     var_value.Bind(CallStub(callable, context, value));
     Goto(&if_valueisstring);
   }
   Bind(&if_valueisstring);
   return var_value.value();
 }
 
+Node* CodeStubAssembler::ChangeNumberToFloat64(compiler::Node* value) {
+  Variable result(this, MachineRepresentation::kFloat64);
+  Label smi(this);
+  Label done(this, &result);
+  GotoIf(TaggedIsSmi(value), &smi);
+  result.Bind(
+      LoadObjectField(value, HeapNumber::kValueOffset, MachineType::Float64()));

[Jakob Kummerow, 2016/11/23 17:17:05]

This doesn't canonicalize the hole NaN. Use Float64SilenceNaN(Node*
double_value).

You can use a variant of mjsunit/compiler/regress-store-holey-double-array.js to
test for this case.

[danno, 2016/11/29 14:39:59]

Done.

+  Goto(&done);
+
+  Bind(&smi);
+  {
+    result.Bind(ChangeInt32ToFloat64(SmiUntag(value)));
+    Goto(&done);
+  }
+
+  Bind(&done);
+  return result.value();
+}
+
 Node* CodeStubAssembler::ToThisValue(Node* context, Node* value,
                                      PrimitiveType primitive_type,
                                      char const* method_name) {
   // We might need to loop once due to JSValue unboxing.
   Variable var_value(this, MachineRepresentation::kTagged);
   Label loop(this, &var_value), done_loop(this),
       done_throw(this, Label::kDeferred);
   var_value.Bind(value);
   Goto(&loop);
   Bind(&loop);
@@ skipping 1396 matching lines @@
 void CodeStubAssembler::DecrementCounter(StatsCounter* counter, int delta) {
   DCHECK(delta > 0);
   if (FLAG_native_code_counters && counter->Enabled()) {
     Node* counter_address = ExternalConstant(ExternalReference(counter));
     Node* value = Load(MachineType::Int32(), counter_address);
     value = Int32Sub(value, Int32Constant(delta));
     StoreNoWriteBarrier(MachineRepresentation::kWord32, counter_address, value);
   }
 }
 
+void CodeStubAssembler::Increment(Variable& variable, int value,
+                                  ParameterMode mode) {
+  DCHECK_IMPLIES(mode == INTPTR_PARAMETERS,
+                 variable.rep() == MachineType::PointerRepresentation());
+  DCHECK_IMPLIES(mode == SMI_PARAMETERS,
+                 variable.rep() == MachineRepresentation::kTagged ||
+                     variable.rep() == MachineRepresentation::kTaggedSigned);
+  variable.Bind(IntPtrAdd(variable.value(), IntPtrOrSmiConstant(value, mode)));
+}
+
 void CodeStubAssembler::Use(Label* label) {
   GotoIf(Word32Equal(Int32Constant(0), Int32Constant(1)), label);
 }
 
 void CodeStubAssembler::TryToName(Node* key, Label* if_keyisindex,
                                   Variable* var_index, Label* if_keyisunique,
                                   Label* if_bailout) {
   DCHECK_EQ(MachineType::PointerRepresentation(), var_index->rep());
   Comment("TryToName");
 
@@ skipping 90 matching lines @@
 
   Variable var_count(this, MachineType::PointerRepresentation());
   Variable var_entry(this, MachineType::PointerRepresentation());
   Variable* loop_vars[] = {&var_count, &var_entry, var_name_index};
   Label loop(this, 3, loop_vars);
   var_count.Bind(count);
   var_entry.Bind(entry);
   Goto(&loop);
   Bind(&loop);
   {
-    Node* count = var_count.value();
     Node* entry = var_entry.value();
 
     Node* index = EntryToIndex<Dictionary>(entry);
     var_name_index->Bind(index);
 
     Node* current =
         LoadFixedArrayElement(dictionary, index, 0, INTPTR_PARAMETERS);
     GotoIf(WordEqual(current, undefined), if_not_found);
     GotoIf(WordEqual(current, unique_name), if_found);
 
     // See Dictionary::NextProbe().
-    count = IntPtrAdd(count, IntPtrConstant(1));
-    entry = WordAnd(IntPtrAdd(entry, count), mask);
+    Increment(var_count);
+    entry = WordAnd(IntPtrAdd(entry, var_count.value()), mask);
 
-    var_count.Bind(count);
     var_entry.Bind(entry);
     Goto(&loop);
   }
 }
 
 // Instantiate template methods to workaround GCC compilation issue.
 template void CodeStubAssembler::NameDictionaryLookup<NameDictionary>(
     Node*, Node*, Label*, Variable*, Label*, int);
 template void CodeStubAssembler::NameDictionaryLookup<GlobalDictionary>(
     Node*, Node*, Label*, Variable*, Label*, int);
@@ skipping 44 matching lines @@
   Node* the_hole = TheHoleConstant();
 
   Variable var_count(this, MachineType::PointerRepresentation());
   Variable* loop_vars[] = {&var_count, var_entry};
   Label loop(this, 2, loop_vars);
   var_count.Bind(count);
   var_entry->Bind(entry);
   Goto(&loop);
   Bind(&loop);
   {
-    Node* count = var_count.value();
     Node* entry = var_entry->value();
 
     Node* index = EntryToIndex<Dictionary>(entry);
     Node* current =
         LoadFixedArrayElement(dictionary, index, 0, INTPTR_PARAMETERS);
     GotoIf(WordEqual(current, undefined), if_not_found);
     Label next_probe(this);
     {
       Label if_currentissmi(this), if_currentisnotsmi(this);
       Branch(TaggedIsSmi(current), &if_currentissmi, &if_currentisnotsmi);
       Bind(&if_currentissmi);
       {
         Node* current_value = SmiUntag(current);
         Branch(WordEqual(current_value, intptr_index), if_found, &next_probe);
       }
       Bind(&if_currentisnotsmi);
       {
         GotoIf(WordEqual(current, the_hole), &next_probe);
         // Current must be the Number.
         Node* current_value = LoadHeapNumberValue(current);
         Branch(Float64Equal(current_value, key_as_float64), if_found,
                &next_probe);
       }
     }
 
     Bind(&next_probe);
     // See Dictionary::NextProbe().
-    count = IntPtrAdd(count, IntPtrConstant(1));
-    entry = WordAnd(IntPtrAdd(entry, count), mask);
+    Increment(var_count);
+    entry = WordAnd(IntPtrAdd(entry, var_count.value()), mask);
 
-    var_count.Bind(count);
     var_entry->Bind(entry);
     Goto(&loop);
   }
 }
 
 void CodeStubAssembler::DescriptorLookupLinear(Node* unique_name,
                                                Node* descriptors, Node* nof,
                                                Label* if_found,
                                                Variable* var_name_index,
                                                Label* if_not_found) {
@@ skipping 3035 matching lines @@
   // loop that helps turbofan generate better code. If there's only a single
   // check, then the CodeStubAssembler forces it to be at the beginning of the
   // loop requiring a backwards branch at the end of the loop (it's not possible
   // to force the loop header check at the end of the loop and branch forward to
   // it from the pre-header). The extra branch is slower in the case that the
   // loop actually iterates.
   Branch(WordEqual(var.value(), end_index), &after_loop, &loop);
   Bind(&loop);
   {
     if (mode == IndexAdvanceMode::kPre) {
-      var.Bind(IntPtrAdd(var.value(), IntPtrConstant(increment)));
+      Increment(var, increment);
     }
     body(this, var.value());
     if (mode == IndexAdvanceMode::kPost) {
-      var.Bind(IntPtrAdd(var.value(), IntPtrConstant(increment)));
+      Increment(var, increment);
     }
     Branch(WordNotEqual(var.value(), end_index), &loop, &after_loop);
   }
   Bind(&after_loop);
 }
 
 void CodeStubAssembler::BuildFastFixedArrayForEach(
     compiler::Node* fixed_array, ElementsKind kind,
     compiler::Node* first_element_inclusive,
     compiler::Node* last_element_exclusive,
@@ skipping 1641 matching lines @@
     Node* one = Float64Constant(1.0);
     Node* finc_result = Float64Add(finc_value, one);
     var_result.Bind(AllocateHeapNumberWithValue(finc_result));
     Goto(&end);
   }
 
   Bind(&end);
   return var_result.value();
 }
 
+void CodeStubAssembler::GotoIfNotNumber(compiler::Node* input,
+                                        Label* is_not_number) {
+  Label is_number(this);
+  GotoIf(TaggedIsSmi(input), &is_number);
+  Node* input_map = LoadMap(input);
+  Branch(Word32NotEqual(input_map, HeapNumberMapConstant()), is_not_number,

[Jakob Kummerow, 2016/11/23 17:17:06]

Maps are words, not word32s! Even better:

Branch(IsHeapNumberMap(input_map), ...)

[danno, 2016/11/29 14:39:59]

Done.

+         &is_number);
+  Bind(&is_number);
+}
+
+void CodeStubAssembler::GotoIfNumber(compiler::Node* input, Label* is_number) {
+  GotoIf(TaggedIsSmi(input), is_number);
+  Node* input_map = LoadMap(input);
+  GotoIf(Word32Equal(input_map, HeapNumberMapConstant()), is_number);

[Jakob Kummerow, 2016/11/23 17:17:06]

Same here

[danno, 2016/11/29 14:39:59]

Done.

+}
+
 compiler::Node* CodeStubAssembler::CreateArrayIterator(
     compiler::Node* array, compiler::Node* array_map,
     compiler::Node* array_type, compiler::Node* context, IterationKind mode) {
   int kBaseMapIndex = 0;
   switch (mode) {
     case IterationKind::kKeys:
       kBaseMapIndex = Context::TYPED_ARRAY_KEY_ITERATOR_MAP_INDEX;
       break;
     case IterationKind::kValues:
       kBaseMapIndex = Context::UINT8_ARRAY_VALUE_ITERATOR_MAP_INDEX;
@@ skipping 36 matching lines @@
     // the receiver is a TypedArray or not.
 
     Label if_istypedarray(this), if_isgeneric(this);
 
     Branch(Word32Equal(array_type, Int32Constant(JS_TYPED_ARRAY_TYPE)),
            &if_istypedarray, &if_isgeneric);
 
     Bind(&if_isgeneric);
     {
       Label if_isfast(this), if_isslow(this);
-      BranchIfFastJSArray(array, context, &if_isfast, &if_isslow);
+      BranchIfFastJSArray(array, context, FastJSArrayAccessMode::INBOUNDS_READ,
+                          &if_isfast, &if_isslow);
 
       Bind(&if_isfast);
       {
         var_map_index.Bind(
             IntPtrConstant(Context::FAST_ARRAY_KEY_ITERATOR_MAP_INDEX));
         var_array_map.Bind(array_map);
         Goto(&allocate_iterator);
       }
 
       Bind(&if_isslow);
@@ skipping 13 matching lines @@
       Goto(&allocate_iterator);
     }
   } else {
     Label if_istypedarray(this), if_isgeneric(this);
     Branch(Word32Equal(array_type, Int32Constant(JS_TYPED_ARRAY_TYPE)),
            &if_istypedarray, &if_isgeneric);
 
     Bind(&if_isgeneric);
     {
       Label if_isfast(this), if_isslow(this);
-      BranchIfFastJSArray(array, context, &if_isfast, &if_isslow);
+      BranchIfFastJSArray(
+          array, context,
+          CodeStubAssembler::FastJSArrayAccessMode::INBOUNDS_READ, &if_isfast,

[Jakob Kummerow, 2016/11/23 17:17:06]

nit: s/CodeStubAssembler:://

[danno, 2016/11/29 14:39:59]

Done.

+          &if_isslow);
 
       Bind(&if_isfast);
       {
         Label if_ispacked(this), if_isholey(this);
         Node* elements_kind = LoadMapElementsKind(array_map);
         Branch(IsHoleyFastElementsKind(elements_kind), &if_isholey,
                &if_ispacked);
 
         Bind(&if_isholey);
         {
@@ skipping 123 matching lines @@
       argc_, FAST_ELEMENTS, mode,
       (StandardFrameConstants::kFixedSlotCountAboveFp - 1) * kPointerSize);
   arguments_ = assembler_->IntPtrAddFoldConstants(fp_, offset);
   if (mode == CodeStubAssembler::INTEGER_PARAMETERS) {
     argc_ = assembler->ChangeInt32ToIntPtr(argc_);
   } else if (mode == CodeStubAssembler::SMI_PARAMETERS) {
     argc_ = assembler->SmiUntag(argc_);
   }
 }
 
-compiler::Node* CodeStubArguments::GetReceiver() {
+compiler::Node* CodeStubArguments::GetReceiver() const {
   return assembler_->Load(MachineType::AnyTagged(), arguments_,
                           assembler_->IntPtrConstant(kPointerSize));
 }
 
 compiler::Node* CodeStubArguments::AtIndex(
-    compiler::Node* index, CodeStubAssembler::ParameterMode mode) {
+    compiler::Node* index, CodeStubAssembler::ParameterMode mode) const {
   typedef compiler::Node Node;
   Node* negated_index = assembler_->IntPtrSubFoldConstants(
       assembler_->IntPtrOrSmiConstant(0, mode), index);
   Node* offset =
       assembler_->ElementOffsetFromIndex(negated_index, FAST_ELEMENTS, mode, 0);
   return assembler_->Load(MachineType::AnyTagged(), arguments_, offset);
 }
 
-compiler::Node* CodeStubArguments::AtIndex(int index) {
+compiler::Node* CodeStubArguments::AtIndex(int index) const {
   return AtIndex(assembler_->IntPtrConstant(index));
 }
 
 void CodeStubArguments::ForEach(const CodeStubAssembler::VariableList& vars,
                                 CodeStubArguments::ForEachBodyFunction body,
                                 compiler::Node* first, compiler::Node* last,
                                 CodeStubAssembler::ParameterMode mode) {
   assembler_->Comment("CodeStubArguments::ForEach");
   DCHECK_IMPLIES(first == nullptr || last == nullptr,
                  mode == CodeStubAssembler::INTPTR_PARAMETERS);
@@ skipping 38 matching lines @@
   STATIC_ASSERT(FAST_HOLEY_ELEMENTS == (FAST_ELEMENTS | 1));
   STATIC_ASSERT(FAST_HOLEY_DOUBLE_ELEMENTS == (FAST_DOUBLE_ELEMENTS | 1));
 
   // Check prototype chain if receiver does not have packed elements.
   Node* holey_elements = Word32And(elements_kind, Int32Constant(1));
   return Word32Equal(holey_elements, Int32Constant(1));
 }
 
 }  // namespace internal
 }  // namespace v8