[WIP] String.prototype.charCodeAt/charAt speculative.

src/compiler/js-builtin-reducer.cc

Index: src/compiler/js-builtin-reducer.cc
diff --git a/src/compiler/js-builtin-reducer.cc b/src/compiler/js-builtin-reducer.cc
index 9ca0c63eb957ace70efe69bbbdde5e7787bcc7bb..e8c7d5b33e8c81cd56685f487bb5e2fa4a2c47e7 100644
--- a/src/compiler/js-builtin-reducer.cc
+++ b/src/compiler/js-builtin-reducer.cc
@@ -1918,49 +1918,24 @@ Reduction JSBuiltinReducer::ReduceStringCharAt(Node* node) {
   // We need at least target, receiver and index parameters.
   if (node->op()->ValueInputCount() >= 3) {
     Node* index = NodeProperties::GetValueInput(node, 2);
-    Type* index_type = NodeProperties::GetType(index);
     Node* effect = NodeProperties::GetEffectInput(node);
     Node* control = NodeProperties::GetControlInput(node);
 
-    if (index_type->Is(Type::Integral32OrMinusZeroOrNaN())) {
-      if (Node* receiver = GetStringWitness(node)) {
-        if (!index_type->Is(Type::Unsigned32())) {
-          // Map -0 and NaN to 0 (as per ToInteger), and the values in
-          // the [-2^31,-1] range to the [2^31,2^32-1] range, which will
-          // be considered out-of-bounds as well, because of the maximal
-          // String length limit in V8.
-          STATIC_ASSERT(String::kMaxLength <= kMaxInt);
-          index = graph()->NewNode(simplified()->NumberToUint32(), index);
-        }
-
-        // Determine the {receiver} length.
-        Node* receiver_length = effect = graph()->NewNode(
-            simplified()->LoadField(AccessBuilder::ForStringLength()), receiver,
-            effect, control);
-
-        // Check if {index} is less than {receiver} length.
-        Node* check = graph()->NewNode(simplified()->NumberLessThan(), index,
-                                       receiver_length);
-        Node* branch = graph()->NewNode(common()->Branch(BranchHint::kTrue),
-                                        check, control);
-
-        // Return the character from the {receiver} as single character string.
-        Node* if_true = graph()->NewNode(common()->IfTrue(), branch);
-        Node* vtrue = graph()->NewNode(simplified()->StringCharAt(), receiver,
-                                       index, if_true);
-
-        // Return the empty string otherwise.
-        Node* if_false = graph()->NewNode(common()->IfFalse(), branch);
-        Node* vfalse = jsgraph()->EmptyStringConstant();
-
-        control = graph()->NewNode(common()->Merge(2), if_true, if_false);
-        Node* value =
-            graph()->NewNode(common()->Phi(MachineRepresentation::kTagged, 2),
-                             vtrue, vfalse, control);
-
-        ReplaceWithValue(node, value, effect, control);
-        return Replace(value);
-      }
+    if (Node* receiver = GetStringWitness(node)) {
+      // Determine the {receiver} length.
+      Node* length = effect = graph()->NewNode(
+          simplified()->LoadField(AccessBuilder::ForStringLength()), receiver,
+          effect, control);
+
+      // Check if {index} is less than {receiver} length.
+      index = effect = graph()->NewNode(simplified()->CheckBounds(), index,
+                                        length, effect, control);
+
+      // Load the character from the {receiver} as single character string.
+      Node* value = graph()->NewNode(simplified()->StringCharAt(), receiver,
+                                     index, control);
+      ReplaceWithValue(node, value, effect, control);
+      return Replace(value);
     }
   }
 
@@ -1972,49 +1947,24 @@ Reduction JSBuiltinReducer::ReduceStringCharCodeAt(Node* node) {
   // We need at least target, receiver and index parameters.
   if (node->op()->ValueInputCount() >= 3) {
     Node* index = NodeProperties::GetValueInput(node, 2);
-    Type* index_type = NodeProperties::GetType(index);
     Node* effect = NodeProperties::GetEffectInput(node);
     Node* control = NodeProperties::GetControlInput(node);
 
-    if (index_type->Is(Type::Integral32OrMinusZeroOrNaN())) {
-      if (Node* receiver = GetStringWitness(node)) {
-        if (!index_type->Is(Type::Unsigned32())) {
-          // Map -0 and NaN to 0 (as per ToInteger), and the values in
-          // the [-2^31,-1] range to the [2^31,2^32-1] range, which will
-          // be considered out-of-bounds as well, because of the maximal
-          // String length limit in V8.
-          STATIC_ASSERT(String::kMaxLength <= kMaxInt);
-          index = graph()->NewNode(simplified()->NumberToUint32(), index);
-        }
-
-        // Determine the {receiver} length.
-        Node* receiver_length = effect = graph()->NewNode(
-            simplified()->LoadField(AccessBuilder::ForStringLength()), receiver,
-            effect, control);
-
-        // Check if {index} is less than {receiver} length.
-        Node* check = graph()->NewNode(simplified()->NumberLessThan(), index,
-                                       receiver_length);
-        Node* branch = graph()->NewNode(common()->Branch(BranchHint::kTrue),
-                                        check, control);
-
-        // Load the character from the {receiver}.
-        Node* if_true = graph()->NewNode(common()->IfTrue(), branch);
-        Node* vtrue = graph()->NewNode(simplified()->StringCharCodeAt(),
-                                       receiver, index, if_true);
-
-        // Return NaN otherwise.
-        Node* if_false = graph()->NewNode(common()->IfFalse(), branch);
-        Node* vfalse = jsgraph()->NaNConstant();
-
-        control = graph()->NewNode(common()->Merge(2), if_true, if_false);
-        Node* value =
-            graph()->NewNode(common()->Phi(MachineRepresentation::kTagged, 2),
-                             vtrue, vfalse, control);
-
-        ReplaceWithValue(node, value, effect, control);
-        return Replace(value);
-      }
+    if (Node* receiver = GetStringWitness(node)) {
+      // Determine the {receiver} length.
+      Node* length = effect = graph()->NewNode(
+          simplified()->LoadField(AccessBuilder::ForStringLength()), receiver,
+          effect, control);
+
+      // Check if {index} is less than {receiver} length.
+      index = effect = graph()->NewNode(simplified()->CheckBounds(), index,
+                                        length, effect, control);
+
+      // Load the character from the {receiver}.
+      Node* value = graph()->NewNode(simplified()->StringCharCodeAt(), receiver,
+                                     index, control);
+      ReplaceWithValue(node, value, effect, control);
+      return Replace(value);
     }
   }