[stubs] KeyedLoadGeneric: support loading properties from strings

src/ic/accessor-assembler.cc

 // Copyright 2016 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/ic/accessor-assembler.h"
 
 #include "src/code-factory.h"
 #include "src/code-stubs.h"
 #include "src/ic/handler-configuration.h"
 #include "src/ic/stub-cache.h"
@@ skipping 1391 matching lines @@
   Variable var_details(this, MachineRepresentation::kWord32);
   Variable var_value(this, MachineRepresentation::kTagged);
   Label if_index(this), if_unique_name(this), if_element_hole(this),
       if_oob(this), slow(this), stub_cache_miss(this),
       if_property_dictionary(this), if_found_on_receiver(this);
 
   Node* receiver = p->receiver;
   GotoIf(TaggedIsSmi(receiver), &slow);
   Node* receiver_map = LoadMap(receiver);
   Node* instance_type = LoadMapInstanceType(receiver_map);
-  // Receivers requiring non-standard element accesses (interceptors, access
-  // checks, strings and string wrappers, proxies) are handled in the runtime.
-  GotoIf(Int32LessThanOrEqual(instance_type,
-                              Int32Constant(LAST_CUSTOM_ELEMENTS_RECEIVER)),
-         &slow);
 
   TryToName(p->name, &if_index, &var_index, &if_unique_name, &var_unique,
             &slow);
 
   Bind(&if_index);
   {
     Comment("integer index");
+    // Receivers requiring non-standard element accesses (interceptors, access
+    // checks, strings and string wrappers, proxies) are handled in the runtime.
+    GotoIf(Int32LessThanOrEqual(instance_type,
+                                Int32Constant(LAST_CUSTOM_ELEMENTS_RECEIVER)),
+           &slow);
     Node* index = var_index.value();
     Node* elements = LoadElements(receiver);
     Node* elements_kind = LoadMapElementsKind(receiver_map);
     Node* is_jsarray_condition =
         Word32Equal(instance_type, Int32Constant(JS_ARRAY_TYPE));
     Variable var_double_value(this, MachineRepresentation::kFloat64);
     Label rebox_double(this, &var_double_value);
 
     // Unimplemented elements kinds fall back to a runtime call.
     Label* unimplemented_elements_kind = &slow;
@@ skipping 24 matching lines @@
     BranchIfPrototypesHaveNoElements(receiver_map, &return_undefined, &slow);
 
     Bind(&return_undefined);
     Return(UndefinedConstant());
   }
 
   Node* properties = nullptr;
   Bind(&if_unique_name);
   {
     Comment("key is unique name");
+
+    // Receivers requiring non-standard accesses (interceptors, access
+    // checks, string wrappers, proxies) are handled in the runtime.
+    // We special-case strings here, to support loading <Symbol.split> etc.
+    Variable var_receiver(this, MachineRepresentation::kTagged);
+    Label normal_receiver(this, &var_receiver);
+    var_receiver.Bind(receiver);
+    GotoIf(Int32GreaterThan(instance_type,
+                            Int32Constant(LAST_SPECIAL_RECEIVER_TYPE)),
+           &normal_receiver);
+    GotoIf(Int32GreaterThanOrEqual(instance_type,
+                                   Int32Constant(FIRST_NONSTRING_TYPE)),
+           &slow);
+    CSA_ASSERT(this, WordEqual(LoadMapConstructorFunctionIndex(receiver_map),
+                               IntPtrConstant(Context::STRING_FUNCTION_INDEX)));
+    Node* native_context = LoadNativeContext(p->context);
+    Node* constructor_function =
+        LoadContextElement(native_context, Context::STRING_FUNCTION_INDEX);
+    Node* initial_map = LoadObjectField(
+        constructor_function, JSFunction::kPrototypeOrInitialMapOffset);
+    var_receiver.Bind(LoadMapPrototype(initial_map));
+    Goto(&normal_receiver);
+
+    Bind(&normal_receiver);
+    receiver = var_receiver.value();

[Igor Sheludko, 2017/01/27 08:04:07]

Here we are potentially changing the receiver but receiver_map and instance_type
still correspond to original receiver. Well the latter is not used afterwards
but the former is.

[Jakob Kummerow, 2017/01/28 04:30:12]

Oops, good point. Done.

     Node* key = var_unique.value();

[Igor Sheludko, 2017/01/27 08:13:42]

Moreover, we are lucky that the elements handling code is located above the
receiver node modification, otherwise CSA will complain about bad graph. Maybe
it would be cleaner if we move if_index and if_unique_name cases to separate
methods.

[Jakob Kummerow, 2017/01/28 04:30:12]

Done.

     // Check if the receiver has fast or slow properties.
     properties = LoadProperties(receiver);
     Node* properties_map = LoadMap(properties);
     GotoIf(WordEqual(properties_map, LoadRoot(Heap::kHashTableMapRootIndex)),
            &if_property_dictionary);
 
     // Try looking up the property on the receiver; if unsuccessful, look
     // for a handler in the stub cache.
     Comment("DescriptorArray lookup");
 
@@ skipping 25 matching lines @@
       Comment("stub cache probe for fast property load");
       Variable var_handler(this, MachineRepresentation::kTagged);
       Label found_handler(this, &var_handler), stub_cache_miss(this);
       TryProbeStubCache(isolate()->load_stub_cache(), receiver, key,
                         &found_handler, &var_handler, &stub_cache_miss);
       Bind(&found_handler);
       { HandleLoadICHandlerCase(p, var_handler.value(), &slow); }
 
       Bind(&stub_cache_miss);
       {
+        // TODO(jkummerow): Check if the property exists on the prototype
+        // chain. If it doesn't, then there's no point in missing.
         Comment("KeyedLoadGeneric_miss");
         TailCallRuntime(Runtime::kKeyedLoadIC_Miss, p->context, p->receiver,
                         p->name, p->slot, p->vector);
       }
     }
   }
 
   Bind(&if_property_dictionary);
   {
     Comment("dictionary property load");
@@ skipping 359 matching lines @@
   Node* slot = Parameter(Descriptor::kSlot);
   Node* context = Parameter(Descriptor::kContext);
   Node* vector = LoadTypeFeedbackVectorForStub();
 
   StoreICParameters p(context, receiver, name, value, slot, vector);
   KeyedStoreIC(&p, language_mode);
 }
 
 }  // namespace internal
 }  // namespace v8