[turbofan] escape analysis supports arguments object and rest elements

src/compiler/js-create-lowering.cc

 // Copyright 2016 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/compiler/js-create-lowering.h"
 
 #include "src/allocation-site-scopes.h"
 #include "src/code-factory.h"
 #include "src/compilation-dependencies.h"
 #include "src/compiler/access-builder.h"
@@ skipping 292 matching lines @@
         // arguments objects, so that we always have a shared_info here.
         Handle<SharedFunctionInfo> shared_info;
         if (state_info.shared_info().ToHandle(&shared_info)) {
           // TODO(mstarzinger): Duplicate parameters are not handled yet.
           if (shared_info->has_duplicate_parameters()) return NoChange();
           // If there is no aliasing, the arguments object elements are not
           // special in any way, we can just return an unmapped backing store.
           if (shared_info->internal_formal_parameter_count() == 0) {
             Node* const callee = NodeProperties::GetValueInput(node, 0);
             Node* effect = NodeProperties::GetEffectInput(node);
+            Node* const arguments_frame =
+                graph()->NewNode(simplified()->ArgumentsFrame());
+            Node* const arguments_length = graph()->NewNode(
+                simplified()->ArgumentsLength(0, false), arguments_frame);
             // Allocate the elements backing store.
-            Node* const elements = effect = graph()->NewNode(
-                simplified()->NewUnmappedArgumentsElements(0), effect);
-            Node* const length = effect = graph()->NewNode(
-                simplified()->LoadField(AccessBuilder::ForFixedArrayLength()),
-                elements, effect, control);
+            Node* const elements = effect =
+                graph()->NewNode(simplified()->NewUnmappedArgumentsElements(),
+                                 arguments_frame, arguments_length, effect);
             // Load the arguments object map.
             Node* const arguments_map = jsgraph()->HeapConstant(
                 handle(native_context()->sloppy_arguments_map(), isolate()));
             // Actually allocate and initialize the arguments object.
             AllocationBuilder a(jsgraph(), effect, control);
             Node* properties = jsgraph()->EmptyFixedArrayConstant();
             STATIC_ASSERT(JSSloppyArgumentsObject::kSize == 5 * kPointerSize);
             a.Allocate(JSSloppyArgumentsObject::kSize);
             a.Store(AccessBuilder::ForMap(), arguments_map);
             a.Store(AccessBuilder::ForJSObjectProperties(), properties);
             a.Store(AccessBuilder::ForJSObjectElements(), elements);
-            a.Store(AccessBuilder::ForArgumentsLength(), length);
+            a.Store(AccessBuilder::ForArgumentsLength(), arguments_length);
             a.Store(AccessBuilder::ForArgumentsCallee(), callee);
             RelaxControls(node);
             a.FinishAndChange(node);
           } else {
             Callable callable = CodeFactory::FastNewSloppyArguments(isolate());
             Operator::Properties properties = node->op()->properties();
             CallDescriptor* desc = Linkage::GetStubCallDescriptor(
                 isolate(), graph()->zone(), callable.descriptor(), 0,
                 CallDescriptor::kNoFlags, properties);
             const Operator* new_op = common()->Call(desc);
             Node* stub_code = jsgraph()->HeapConstant(callable.code());
             node->InsertInput(graph()->zone(), 0, stub_code);
             node->RemoveInput(3);  // Remove the frame state.
             NodeProperties::ChangeOp(node, new_op);
           }
           return Changed(node);
         }
         return NoChange();
       }
       case CreateArgumentsType::kUnmappedArguments: {
         Handle<SharedFunctionInfo> shared_info;
         if (state_info.shared_info().ToHandle(&shared_info)) {
           Node* effect = NodeProperties::GetEffectInput(node);
+          Node* const arguments_frame =
+              graph()->NewNode(simplified()->ArgumentsFrame());
+          Node* const arguments_length = graph()->NewNode(
+              simplified()->ArgumentsLength(
+                  shared_info->internal_formal_parameter_count(), false),
+              arguments_frame);
           // Allocate the elements backing store.
-          Node* const elements = effect = graph()->NewNode(
-              simplified()->NewUnmappedArgumentsElements(
-                  shared_info->internal_formal_parameter_count()),
-              effect);
-          Node* const length = effect = graph()->NewNode(
-              simplified()->LoadField(AccessBuilder::ForFixedArrayLength()),
-              elements, effect, control);
+          Node* const elements = effect =
+              graph()->NewNode(simplified()->NewUnmappedArgumentsElements(),
+                               arguments_frame, arguments_length, effect);
           // Load the arguments object map.
           Node* const arguments_map = jsgraph()->HeapConstant(
               handle(native_context()->strict_arguments_map(), isolate()));
           // Actually allocate and initialize the arguments object.
           AllocationBuilder a(jsgraph(), effect, control);
           Node* properties = jsgraph()->EmptyFixedArrayConstant();
           STATIC_ASSERT(JSStrictArgumentsObject::kSize == 4 * kPointerSize);
           a.Allocate(JSStrictArgumentsObject::kSize);
           a.Store(AccessBuilder::ForMap(), arguments_map);
           a.Store(AccessBuilder::ForJSObjectProperties(), properties);
           a.Store(AccessBuilder::ForJSObjectElements(), elements);
-          a.Store(AccessBuilder::ForArgumentsLength(), length);
+          a.Store(AccessBuilder::ForArgumentsLength(), arguments_length);
           RelaxControls(node);
           a.FinishAndChange(node);
         } else {
           Callable callable = CodeFactory::FastNewStrictArguments(isolate());
           Operator::Properties properties = node->op()->properties();
           CallDescriptor* desc = Linkage::GetStubCallDescriptor(
               isolate(), graph()->zone(), callable.descriptor(), 0,
               CallDescriptor::kNeedsFrameState, properties);
           const Operator* new_op = common()->Call(desc);
           Node* stub_code = jsgraph()->HeapConstant(callable.code());
           node->InsertInput(graph()->zone(), 0, stub_code);
           NodeProperties::ChangeOp(node, new_op);
         }
         return Changed(node);
       }
       case CreateArgumentsType::kRestParameter: {
         Handle<SharedFunctionInfo> shared_info;
         if (state_info.shared_info().ToHandle(&shared_info)) {
           Node* effect = NodeProperties::GetEffectInput(node);
-          // Allocate the elements backing store.
-          Node* const elements = effect = graph()->NewNode(
-              simplified()->NewRestParameterElements(
-                  shared_info->internal_formal_parameter_count()),
-              effect);
-          Node* const length = effect = graph()->NewNode(
-              simplified()->LoadField(AccessBuilder::ForFixedArrayLength()),
-              elements, effect, control);
+          Node* const arguments_frame =
+              graph()->NewNode(simplified()->ArgumentsFrame());
+          int formal_parameter_count =
+              shared_info->internal_formal_parameter_count();
+          Node* const rest_length = graph()->NewNode(
+              simplified()->ArgumentsLength(formal_parameter_count, true),
+              arguments_frame);
+          // Allocate the elements backing store. Since
+          // NewUnmappedArgumentsElements copies from the end of the arguments
+          // adapter frame, this is a suffix of the actual arguments.
+          Node* const elements = effect =
+              graph()->NewNode(simplified()->NewUnmappedArgumentsElements(),
+                               arguments_frame, rest_length, effect);
           // Load the JSArray object map.
           Node* const jsarray_map = jsgraph()->HeapConstant(handle(
               native_context()->js_array_fast_elements_map_index(), isolate()));
           // Actually allocate and initialize the jsarray.
           AllocationBuilder a(jsgraph(), effect, control);
           Node* properties = jsgraph()->EmptyFixedArrayConstant();
           STATIC_ASSERT(JSArray::kSize == 4 * kPointerSize);
           a.Allocate(JSArray::kSize);
           a.Store(AccessBuilder::ForMap(), jsarray_map);
           a.Store(AccessBuilder::ForJSObjectProperties(), properties);
           a.Store(AccessBuilder::ForJSObjectElements(), elements);
-          a.Store(AccessBuilder::ForJSArrayLength(FAST_ELEMENTS), length);
+          a.Store(AccessBuilder::ForJSArrayLength(FAST_ELEMENTS), rest_length);
           RelaxControls(node);
           a.FinishAndChange(node);
         } else {
           Callable callable = CodeFactory::FastNewRestParameter(isolate());
           Operator::Properties properties = node->op()->properties();
           CallDescriptor* desc = Linkage::GetStubCallDescriptor(
               isolate(), graph()->zone(), callable.descriptor(), 0,
               CallDescriptor::kNeedsFrameState, properties);
           const Operator* new_op = common()->Call(desc);
           Node* stub_code = jsgraph()->HeapConstant(callable.code());
@@ skipping 925 matching lines @@
   return jsgraph()->simplified();
 }
 
 MachineOperatorBuilder* JSCreateLowering::machine() const {
   return jsgraph()->machine();
 }
 
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8