[builtins] Add String.prototype.indexOf fast path in TF

src/compiler/js-builtin-reducer.cc

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/compiler/js-builtin-reducer.h"
 
 #include "src/base/bits.h"
+#include "src/code-factory.h"
 #include "src/compilation-dependencies.h"
 #include "src/compiler/access-builder.h"
 #include "src/compiler/js-graph.h"
+#include "src/compiler/linkage.h"
 #include "src/compiler/node-matchers.h"
 #include "src/compiler/node-properties.h"
 #include "src/compiler/simplified-operator.h"
 #include "src/compiler/type-cache.h"
 #include "src/compiler/types.h"
 #include "src/objects-inl.h"
 
 namespace v8 {
 namespace internal {
 namespace compiler {
@@ skipping 1582 matching lines @@
   if (r.InputsMatchOne(Type::PlainPrimitive())) {
     // String.fromCharCode(a:plain-primitive) -> StringFromCharCode(a)
     Node* input = ToNumber(r.GetJSCallInput(0));
     Node* value = graph()->NewNode(simplified()->StringFromCharCode(), input);
     return Replace(value);
   }
   return NoChange();
 }
 
 namespace {
-
-Node* GetStringWitness(Node* node) {
-  Node* receiver = NodeProperties::GetValueInput(node, 1);
-  Type* receiver_type = NodeProperties::GetType(receiver);
+Node* GetInputStringWitness(Node* node, int input_index) {
+  Node* input = NodeProperties::GetValueInput(node, input_index);
+  Type* input_type = NodeProperties::GetType(input);
   Node* effect = NodeProperties::GetEffectInput(node);
-  if (receiver_type->Is(Type::String())) return receiver;
+  if (input_type->Is(Type::String())) return input;
   // Check if the {node} is dominated by a CheckString renaming for
-  // it's {receiver}, and if so use that renaming as {receiver} for
+  // it's {input}, and if so use that renaming as {input} for
   // the lowering below.
   for (Node* dominator = effect;;) {
     if (dominator->opcode() == IrOpcode::kCheckString &&
-        IsSame(dominator->InputAt(0), receiver)) {
+        IsSame(dominator->InputAt(0), input)) {
       return dominator;
     }
     if (dominator->op()->EffectInputCount() != 1) {
       // Didn't find any appropriate CheckString node.
       return nullptr;
     }
     dominator = NodeProperties::GetEffectInput(dominator);
   }
 }
 
+Node* GetStringWitness(Node* node) { return GetInputStringWitness(node, 1); }
 }  // namespace
 
 // ES6 section 21.1.3.1 String.prototype.charAt ( pos )
 Reduction JSBuiltinReducer::ReduceStringCharAt(Node* node) {
   // We need at least target, receiver and index parameters.
   if (node->op()->ValueInputCount() >= 3) {
     Node* index = NodeProperties::GetValueInput(node, 2);
     Type* index_type = NodeProperties::GetType(index);
     Node* effect = NodeProperties::GetEffectInput(node);
     Node* control = NodeProperties::GetControlInput(node);
@@ skipping 90 matching lines @@
 
         ReplaceWithValue(node, value, effect, control);
         return Replace(value);
       }
     }
   }
 
   return NoChange();
 }
 
+// ES6 String.prototype.indexOf(searchString [, position])
+// #sec-string.prototype.indexof
+Reduction JSBuiltinReducer::ReduceStringIndexOf(Node* node) {
+  int arg_count = node->op()->ValueInputCount();
+  if (arg_count != 3 && arg_count != 4) return NoChange();
+  Node* receiver;
+  if (!(receiver = GetStringWitness(node))) return NoChange();
+  Node* search_string;
+  if (!(search_string = GetInputStringWitness(node, 2))) return NoChange();

[Benedikt Meurer, 2017/01/18 18:10:40]

I'm not convinced this is beneficial; can we limit the first version to check
the type of the first parameter against Type::String instead of searching for
witness. I think in 99% of the cases we won't find one and just waste time
searching in the effect chain.

[Camillo Bruni, 2017/01/24 15:51:43]

ack. replaced by simple type check,

+  // Replace the current JSFunctionCall to String.prototype.indexOf with a
+  // simple Call to the unchecked StringIndexOf builtin.
+  Callable callable = CodeFactory::StringIndexOf(isolate());
+  const CallInterfaceDescriptor& descriptor = callable.descriptor();
+  CallDescriptor::Flags flags = CallDescriptor::kNeedsFrameState;

[Benedikt Meurer, 2017/01/18 18:10:40]

StringIndexOf builtin cannot deopt, so you don't need a frame state here. Will
require some massaging of inputs.

[Camillo Bruni, 2017/01/24 15:51:43]

done.

+  CallDescriptor* desc = Linkage::GetStubCallDescriptor(
+      isolate(), graph()->zone(), descriptor,
+      descriptor.GetStackParameterCount(), flags, node->op()->properties());

[Benedikt Meurer, 2017/01/18 18:10:40]

Also it doesn't have a side effect, so it should use Operator::kEliminatable
here for the properties.

[Camillo Bruni, 2017/01/24 15:51:43]

done.

+  Node* stub_code = jsgraph()->HeapConstant(callable.code());
+  // Replace the JSFunction from the JSFunctionCall node with the CodeStub.
+  node->ReplaceInput(0, stub_code);
+  if (arg_count == 3) {
+    // Insert the missing position argument.
+    node->InsertInput(graph()->zone(), 3, jsgraph()->ZeroConstant());
+  }
+  NodeProperties::ChangeOp(node, common()->Call(desc));
+  return Changed(node);
+}
+
 Reduction JSBuiltinReducer::ReduceStringIterator(Node* node) {
   if (Node* receiver = GetStringWitness(node)) {
     Node* effect = NodeProperties::GetEffectInput(node);
     Node* control = NodeProperties::GetControlInput(node);
 
     Node* map = jsgraph()->HeapConstant(
         handle(native_context()->string_iterator_map(), isolate()));
 
     // allocate new iterator
     effect = graph()->NewNode(
@@ skipping 350 matching lines @@
     case kObjectCreate:
       reduction = ReduceObjectCreate(node);
       break;
     case kStringFromCharCode:
       reduction = ReduceStringFromCharCode(node);
       break;
     case kStringCharAt:
       return ReduceStringCharAt(node);
     case kStringCharCodeAt:
       return ReduceStringCharCodeAt(node);
+    case kStringIndexOf:
+      return ReduceStringIndexOf(node);
     case kStringIterator:
       return ReduceStringIterator(node);
     case kStringIteratorNext:
       return ReduceStringIteratorNext(node);
     case kDataViewByteLength:
       return ReduceArrayBufferViewAccessor(
           node, JS_DATA_VIEW_TYPE,
           AccessBuilder::ForJSArrayBufferViewByteLength());
     case kDataViewByteOffset:
       return ReduceArrayBufferViewAccessor(
@@ skipping 56 matching lines @@
   return jsgraph()->simplified();
 }
 
 JSOperatorBuilder* JSBuiltinReducer::javascript() const {
   return jsgraph()->javascript();
 }
 
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8