[builtins] Improve performance of array.prototype.filter and map

src/code-stub-assembler.h

 // Copyright 2016 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef V8_CODE_STUB_ASSEMBLER_H_
 #define V8_CODE_STUB_ASSEMBLER_H_
 
 #include <functional>
 
 #include "src/compiler/code-assembler.h"
@@ skipping 480 matching lines @@
   Node* StoreFixedArrayElement(
       Node* object, Node* index, Node* value,
       WriteBarrierMode barrier_mode = UPDATE_WRITE_BARRIER,
       int additional_offset = 0,
       ParameterMode parameter_mode = INTPTR_PARAMETERS);
 
   Node* StoreFixedDoubleArrayElement(
       Node* object, Node* index, Node* value,
       ParameterMode parameter_mode = INTPTR_PARAMETERS);
 
-  Node* BuildAppendJSArray(ElementsKind kind, Node* context, Node* array,
+  // EnsureArrayPushable verifies that receiver is:
+  //   1. Is not a prototype.
+  //   2. Is not a dictionary.
+  //   3. Has a writeable length property.
+  // It returns ElementsKind as a node for further division into cases.
+  Node* EnsureArrayPushable(Node* receiver, Label* bailout);
+
+  void TryStoreArrayElement(ElementsKind kind, ParameterMode mode,
+                            Label* bailout, Node* elements, Node* index,
+                            Node* value);
+  Node* BuildAppendJSArray(ElementsKind kind, Node* array,
                            CodeStubArguments& args, Variable& arg_index,
                            Label* bailout);
+  Node* BuildAppendJSArray(ElementsKind kind, Node* array, Node* value,
+                           Label* bailout);
 
   void StoreFieldsNoWriteBarrier(Node* start_address, Node* end_address,
                                  Node* value);
 
   // Allocate a HeapNumber without initializing its value.
   Node* AllocateHeapNumber(MutableMode mode = IMMUTABLE);
   // Allocate a HeapNumber with a specific value.
   Node* AllocateHeapNumberWithValue(Node* value, MutableMode mode = IMMUTABLE);
   // Allocate a SeqOneByteString with the given length.
   Node* AllocateSeqOneByteString(int length, AllocationFlags flags = kNone);
@@ skipping 139 matching lines @@
   Node* TryGrowElementsCapacity(Node* object, Node* elements, ElementsKind kind,
                                 Node* key, Node* capacity, ParameterMode mode,
                                 Label* bailout);
 
   // Grows elements capacity of given object. Returns new elements.
   Node* GrowElementsCapacity(Node* object, Node* elements,
                              ElementsKind from_kind, ElementsKind to_kind,
                              Node* capacity, Node* new_capacity,
                              ParameterMode mode, Label* bailout);
 
+  // Given a need to grow by |growth|, allocate an appropriate new capacity
+  // and return a new elements FixedArray object. Label |bailout| is
+  // followed for allocation failure. Label |fits| is followed if current
+  // capacity is sufficient.
+  Node* PossiblyGrowElementsCapacity(ParameterMode mode, ElementsKind kind,
+                                     Node* array, Node* length, Node* elements,
+                                     Node* growth, Label* fits, Label* bailout);
+
   // Allocation site manipulation
   void InitializeAllocationMemento(Node* base_allocation,
                                    int base_allocation_size,
                                    Node* allocation_site);
 
   Node* TryTaggedToFloat64(Node* value, Label* if_valueisnotnumber);
   Node* TruncateTaggedToFloat64(Node* context, Node* value);
   Node* TruncateTaggedToWord32(Node* context, Node* value);
   // Truncate the floating point value of a HeapNumber to an Int32.
   Node* TruncateHeapNumberValueToWord32(Node* object);
@@ skipping 58 matching lines @@
   Node* IsDictionary(Node* object);
   Node* IsUnseededNumberDictionary(Node* object);
   Node* IsConstructorMap(Node* map);
   Node* IsJSFunction(Node* object);
   Node* IsJSTypedArray(Node* object);
   Node* IsFixedTypedArray(Node* object);
 
   // ElementsKind helpers:
   Node* IsFastElementsKind(Node* elements_kind);
   Node* IsHoleyFastElementsKind(Node* elements_kind);
+  Node* IsElementsKindGreaterThan(Node* target_kind,
+                                  ElementsKind reference_kind);
 
   // String helpers.
   // Load a character from a String (might flatten a ConsString).
   Node* StringCharCodeAt(Node* string, Node* index,
                          ParameterMode parameter_mode = SMI_PARAMETERS);
   // Return the single character string with only {code}.
   Node* StringFromCharCode(Node* code);
   // Return a new string object which holds a substring containing the range
   // [from,to[ of string.  |from| and |to| are expected to be tagged.
   Node* SubString(Node* context, Node* string, Node* from, Node* to);
@@ skipping 735 matching lines @@
   }
 #else
 #define CSA_SLOW_ASSERT(csa, x) ((void)0)
 #endif
 
 DEFINE_OPERATORS_FOR_FLAGS(CodeStubAssembler::AllocationFlags);
 
 }  // namespace internal
 }  // namespace v8
 #endif  // V8_CODE_STUB_ASSEMBLER_H_