[WIP] String.prototype.charCodeAt/charAt speculative.

src/compiler/js-builtin-reducer.cc

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/compiler/js-builtin-reducer.h"
 
 #include "src/base/bits.h"
 #include "src/builtins/builtins-utils.h"
 #include "src/code-factory.h"
 #include "src/compilation-dependencies.h"
@@ skipping 1900 matching lines @@
   }
 }
 
 }  // namespace
 
 // ES6 section 21.1.3.1 String.prototype.charAt ( pos )
 Reduction JSBuiltinReducer::ReduceStringCharAt(Node* node) {
   // We need at least target, receiver and index parameters.
   if (node->op()->ValueInputCount() >= 3) {
     Node* index = NodeProperties::GetValueInput(node, 2);
-    Type* index_type = NodeProperties::GetType(index);
     Node* effect = NodeProperties::GetEffectInput(node);
     Node* control = NodeProperties::GetControlInput(node);
 
-    if (index_type->Is(Type::Integral32OrMinusZeroOrNaN())) {
-      if (Node* receiver = GetStringWitness(node)) {
-        if (!index_type->Is(Type::Unsigned32())) {
-          // Map -0 and NaN to 0 (as per ToInteger), and the values in
-          // the [-2^31,-1] range to the [2^31,2^32-1] range, which will
-          // be considered out-of-bounds as well, because of the maximal
-          // String length limit in V8.
-          STATIC_ASSERT(String::kMaxLength <= kMaxInt);
-          index = graph()->NewNode(simplified()->NumberToUint32(), index);
-        }
+    if (Node* receiver = GetStringWitness(node)) {
+      // Determine the {receiver} length.
+      Node* length = effect = graph()->NewNode(
+          simplified()->LoadField(AccessBuilder::ForStringLength()), receiver,
+          effect, control);
 
-        // Determine the {receiver} length.
-        Node* receiver_length = effect = graph()->NewNode(
-            simplified()->LoadField(AccessBuilder::ForStringLength()), receiver,
-            effect, control);
+      // Check if {index} is less than {receiver} length.
+      index = effect = graph()->NewNode(simplified()->CheckBounds(), index,
+                                        length, effect, control);
 
-        // Check if {index} is less than {receiver} length.
-        Node* check = graph()->NewNode(simplified()->NumberLessThan(), index,
-                                       receiver_length);
-        Node* branch = graph()->NewNode(common()->Branch(BranchHint::kTrue),
-                                        check, control);
-
-        // Return the character from the {receiver} as single character string.
-        Node* if_true = graph()->NewNode(common()->IfTrue(), branch);
-        Node* vtrue = graph()->NewNode(simplified()->StringCharAt(), receiver,
-                                       index, if_true);
-
-        // Return the empty string otherwise.
-        Node* if_false = graph()->NewNode(common()->IfFalse(), branch);
-        Node* vfalse = jsgraph()->EmptyStringConstant();
-
-        control = graph()->NewNode(common()->Merge(2), if_true, if_false);
-        Node* value =
-            graph()->NewNode(common()->Phi(MachineRepresentation::kTagged, 2),
-                             vtrue, vfalse, control);
-
-        ReplaceWithValue(node, value, effect, control);
-        return Replace(value);
-      }
+      // Load the character from the {receiver} as single character string.
+      Node* value = graph()->NewNode(simplified()->StringCharAt(), receiver,
+                                     index, control);
+      ReplaceWithValue(node, value, effect, control);
+      return Replace(value);
     }
   }
 
   return NoChange();
 }
 
 // ES6 section 21.1.3.2 String.prototype.charCodeAt ( pos )
 Reduction JSBuiltinReducer::ReduceStringCharCodeAt(Node* node) {
   // We need at least target, receiver and index parameters.
   if (node->op()->ValueInputCount() >= 3) {
     Node* index = NodeProperties::GetValueInput(node, 2);
-    Type* index_type = NodeProperties::GetType(index);
     Node* effect = NodeProperties::GetEffectInput(node);
     Node* control = NodeProperties::GetControlInput(node);
 
-    if (index_type->Is(Type::Integral32OrMinusZeroOrNaN())) {
-      if (Node* receiver = GetStringWitness(node)) {
-        if (!index_type->Is(Type::Unsigned32())) {
-          // Map -0 and NaN to 0 (as per ToInteger), and the values in
-          // the [-2^31,-1] range to the [2^31,2^32-1] range, which will
-          // be considered out-of-bounds as well, because of the maximal
-          // String length limit in V8.
-          STATIC_ASSERT(String::kMaxLength <= kMaxInt);
-          index = graph()->NewNode(simplified()->NumberToUint32(), index);
-        }
+    if (Node* receiver = GetStringWitness(node)) {
+      // Determine the {receiver} length.
+      Node* length = effect = graph()->NewNode(
+          simplified()->LoadField(AccessBuilder::ForStringLength()), receiver,
+          effect, control);
 
-        // Determine the {receiver} length.
-        Node* receiver_length = effect = graph()->NewNode(
-            simplified()->LoadField(AccessBuilder::ForStringLength()), receiver,
-            effect, control);
+      // Check if {index} is less than {receiver} length.
+      index = effect = graph()->NewNode(simplified()->CheckBounds(), index,
+                                        length, effect, control);
 
-        // Check if {index} is less than {receiver} length.
-        Node* check = graph()->NewNode(simplified()->NumberLessThan(), index,
-                                       receiver_length);
-        Node* branch = graph()->NewNode(common()->Branch(BranchHint::kTrue),
-                                        check, control);
-
-        // Load the character from the {receiver}.
-        Node* if_true = graph()->NewNode(common()->IfTrue(), branch);
-        Node* vtrue = graph()->NewNode(simplified()->StringCharCodeAt(),
-                                       receiver, index, if_true);
-
-        // Return NaN otherwise.
-        Node* if_false = graph()->NewNode(common()->IfFalse(), branch);
-        Node* vfalse = jsgraph()->NaNConstant();
-
-        control = graph()->NewNode(common()->Merge(2), if_true, if_false);
-        Node* value =
-            graph()->NewNode(common()->Phi(MachineRepresentation::kTagged, 2),
-                             vtrue, vfalse, control);
-
-        ReplaceWithValue(node, value, effect, control);
-        return Replace(value);
-      }
+      // Load the character from the {receiver}.
+      Node* value = graph()->NewNode(simplified()->StringCharCodeAt(), receiver,
+                                     index, control);
+      ReplaceWithValue(node, value, effect, control);
+      return Replace(value);
     }
   }
 
   return NoChange();
 }
 
 // ES6 String.prototype.concat(...args)
 // #sec-string.prototype.concat
 Reduction JSBuiltinReducer::ReduceStringConcat(Node* node) {
   if (Node* receiver = GetStringWitness(node)) {
@@ skipping 499 matching lines @@
   return jsgraph()->simplified();
 }
 
 JSOperatorBuilder* JSBuiltinReducer::javascript() const {
   return jsgraph()->javascript();
 }
 
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8