Array.prototype.map write error.

src/builtins/builtins-array-gen.cc

 // Copyright 2017 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/builtins/builtins-utils-gen.h"
 #include "src/builtins/builtins.h"
 #include "src/code-stub-assembler.h"
 
 namespace v8 {
 namespace internal {
 
 class ArrayBuiltinCodeStubAssembler : public CodeStubAssembler {
  public:
   explicit ArrayBuiltinCodeStubAssembler(compiler::CodeAssemblerState* state)
       : CodeStubAssembler(state),
         k_(this, MachineRepresentation::kTagged),
         a_(this, MachineRepresentation::kTagged),
-        to_(this, MachineRepresentation::kTagged, SmiConstant(0)) {}
+        to_(this, MachineRepresentation::kTagged, SmiConstant(0)),
+        fully_spec_compliant_(this, {&k_, &a_, &to_}) {}
 
-  typedef std::function<Node*(ArrayBuiltinCodeStubAssembler* masm)>
+  // A jump to label {slow_elements} allows the result generator to

[danno, 2017/05/02 10:58:31]

Is this label correct?

[mvstanton, 2017/05/03 12:19:36]

Outdated comment, thanks! Done.

+  // skip the fast path.
+  typedef std::function<void(ArrayBuiltinCodeStubAssembler* masm)>
       BuiltinResultGenerator;
 
-  typedef std::function<void(ArrayBuiltinCodeStubAssembler* masm)>
-      BuiltinResultIndexInitializer;
-
   typedef std::function<Node*(ArrayBuiltinCodeStubAssembler* masm,
                               Node* k_value, Node* k)>
       CallResultProcessor;
 
   typedef std::function<void(ArrayBuiltinCodeStubAssembler* masm)>
       PostLoopAction;
 
-  Node* ForEachResultGenerator() { return UndefinedConstant(); }
+  void ForEachResultGenerator() { a_.Bind(UndefinedConstant()); }
 
   Node* ForEachProcessor(Node* k_value, Node* k) {
     CallJS(CodeFactory::Call(isolate()), context(), callbackfn(), this_arg(),
            k_value, k, o());
     return a();
   }
 
-  Node* SomeResultGenerator() { return FalseConstant(); }
+  void SomeResultGenerator() { a_.Bind(FalseConstant()); }
 
   Node* SomeProcessor(Node* k_value, Node* k) {
     Node* value = CallJS(CodeFactory::Call(isolate()), context(), callbackfn(),
                          this_arg(), k_value, k, o());
     Label false_continue(this), return_true(this);
     BranchIfToBooleanIsTrue(value, &return_true, &false_continue);
     BIND(&return_true);
     ReturnFromBuiltin(TrueConstant());
     BIND(&false_continue);
     return a();
   }
 
-  Node* EveryResultGenerator() { return TrueConstant(); }
+  void EveryResultGenerator() { a_.Bind(TrueConstant()); }
 
   Node* EveryProcessor(Node* k_value, Node* k) {
     Node* value = CallJS(CodeFactory::Call(isolate()), context(), callbackfn(),
                          this_arg(), k_value, k, o());
     Label true_continue(this), return_false(this);
     BranchIfToBooleanIsTrue(value, &true_continue, &return_false);
     BIND(&return_false);
     ReturnFromBuiltin(FalseConstant());
     BIND(&true_continue);
     return a();
   }
 
-  Node* ReduceResultGenerator() { return this_arg(); }
+  void ReduceResultGenerator() { return a_.Bind(this_arg()); }
 
   Node* ReduceProcessor(Node* k_value, Node* k) {
     VARIABLE(result, MachineRepresentation::kTagged);
     Label done(this, {&result}), initial(this);
     GotoIf(WordEqual(a(), TheHoleConstant()), &initial);
     result.Bind(CallJS(CodeFactory::Call(isolate()), context(), callbackfn(),
                        UndefinedConstant(), a(), k_value, k, o()));
     Goto(&done);
 
     BIND(&initial);
     result.Bind(k_value);
     Goto(&done);
 
     BIND(&done);
     return result.value();
   }
 
   void ReducePostLoopAction() {
     Label ok(this);
     GotoIf(WordNotEqual(a(), TheHoleConstant()), &ok);
     CallRuntime(Runtime::kThrowTypeError, context(),
                 SmiConstant(MessageTemplate::kReduceNoInitial));
     Unreachable();
     BIND(&ok);
   }
 
-  Node* FilterResultGenerator() {
+  void FilterResultGenerator() {
     // 7. Let A be ArraySpeciesCreate(O, 0).
-    return ArraySpeciesCreate(context(), o(), SmiConstant(0));
+    a_.Bind(ArraySpeciesCreate(context(), o(), SmiConstant(0)));
   }
 
   Node* FilterProcessor(Node* k_value, Node* k) {
     // ii. Let selected be ToBoolean(? Call(callbackfn, T, kValue, k, O)).
     Node* selected = CallJS(CodeFactory::Call(isolate()), context(),
                             callbackfn(), this_arg(), k_value, k, o());
     Label true_continue(this, &to_), false_continue(this);
     BranchIfToBooleanIsTrue(selected, &true_continue, &false_continue);
     BIND(&true_continue);
     // iii. If selected is true, then...
@@ skipping 48 matching lines @@
       {
         // 2. Increase to by 1.
         to_.Bind(NumberInc(to_.value()));
         Goto(&false_continue);
       }
     }
     BIND(&false_continue);
     return a();
   }
 
-  Node* MapResultGenerator() {
-    // 5. Let A be ? ArraySpeciesCreate(O, len).
-    return ArraySpeciesCreate(context(), o(), len_);
+  void MapResultGenerator() {

[danno, 2017/05/02 10:58:31]

Perhaps call this FastMapResultGenerator?

[mvstanton, 2017/05/03 12:19:36]

Done.

+    Label runtime(this), done(this, {&a_});
+    GotoIf(DoesntHaveInstanceType(o(), JS_ARRAY_TYPE), &runtime);
+    Node* o_map = LoadMap(o());
+    Node* const initial_array_prototype = LoadContextElement(
+        LoadNativeContext(context()), Context::INITIAL_ARRAY_PROTOTYPE_INDEX);
+    Node* proto = LoadMapPrototype(o_map);
+    GotoIf(WordNotEqual(proto, initial_array_prototype), &runtime);
+
+    Node* species_protector = SpeciesProtectorConstant();
+    Node* value = LoadObjectField(species_protector, Cell::kValueOffset);
+    Node* const protector_invalid = SmiConstant(Isolate::kProtectorInvalid);
+    GotoIf(WordEqual(value, protector_invalid), &runtime);
+
+    Node* const initial_array_constructor = LoadContextElement(
+        LoadNativeContext(context()), Context::ARRAY_FUNCTION_INDEX);
+    a_.Bind(ConstructJS(CodeFactory::Construct(isolate()), context(),
+                        initial_array_constructor, len_));
+    Goto(&done);
+
+    BIND(&runtime);
+    {
+      // 5. Let A be ? ArraySpeciesCreate(O, len).
+      Node* constructor =
+          CallRuntime(Runtime::kArraySpeciesConstructor, context(), o());
+      a_.Bind(ConstructJS(CodeFactory::Construct(isolate()), context(),
+                          constructor, len_));
+      Goto(&fully_spec_compliant_);
+    }
+    BIND(&done);
+  }
+
+  Node* SpecCompliantMapProcessor(Node* k_value, Node* k) {
+    //  i. Let kValue be ? Get(O, Pk). Performed by the caller of MapProcessor.
+    // ii. Let mappedValue be ? Call(callbackfn, T, kValue, k, O).
+    Node* mappedValue = CallJS(CodeFactory::Call(isolate()), context(),
+                               callbackfn(), this_arg(), k_value, k, o());
+
+    // iii. Perform ? CreateDataPropertyOrThrow(A, Pk, mappedValue).
+    CallRuntime(Runtime::kCreateDataProperty, context(), a(), k, mappedValue);
+    return a();
   }
 
   Node* MapProcessor(Node* k_value, Node* k) {
     //  i. Let kValue be ? Get(O, Pk). Performed by the caller of MapProcessor.
     // ii. Let mappedValue be ? Call(callbackfn, T, kValue, k, O).
     Node* mappedValue = CallJS(CodeFactory::Call(isolate()), context(),
                                callbackfn(), this_arg(), k_value, k, o());
 
     Label finished(this);
     Node* kind = nullptr;
     Node* elements = nullptr;
 
     // If a() is a JSArray, we can have a fast path.
     // mode is SMI_PARAMETERS because k has tagged representation.
+    Label runtime(this);
+    Label fast(this);

[danno, 2017/05/02 10:58:31]

nit: Any particular reason for this change?

[mvstanton, 2017/05/03 12:19:36]

Nope, just a rebase thing - I've restored the original.

     ParameterMode mode = SMI_PARAMETERS;
-    Label fast(this);
-    Label runtime(this);
     Label object_push_pre(this), object_push(this), double_push(this);
     BranchIfFastJSArray(a(), context(), FastJSArrayAccessMode::ANY_ACCESS,
                         &fast, &runtime);
 
     BIND(&fast);
     {
       kind = EnsureArrayPushable(a(), &runtime);
       elements = LoadElements(a());
       GotoIf(IsElementsKindGreaterThan(kind, FAST_HOLEY_SMI_ELEMENTS),
              &object_push_pre);
@@ skipping 66 matching lines @@
     callbackfn_ = callbackfn;
     this_arg_ = this_arg;
     argc_ = argc;
   }
 
   void GenerateIteratingArrayBuiltinBody(
       const char* name, const BuiltinResultGenerator& generator,
       const CallResultProcessor& processor, const PostLoopAction& action,
       const Callable& slow_case_continuation,
       ForEachDirection direction = ForEachDirection::kForward) {
-    Label non_array(this), slow(this, {&k_, &a_, &to_}),
-        array_changes(this, {&k_, &a_, &to_});
+    Label non_array(this), array_changes(this, {&k_, &a_, &to_});
 
     // TODO(danno): Seriously? Do we really need to throw the exact error
     // message on null and undefined so that the webkit tests pass?
     Label throw_null_undefined_exception(this, Label::kDeferred);
     GotoIf(WordEqual(receiver(), NullConstant()),
            &throw_null_undefined_exception);
     GotoIf(WordEqual(receiver(), UndefinedConstant()),
            &throw_null_undefined_exception);
 
     // By the book: taken directly from the ECMAScript 2015 specification
@@ skipping 46 matching lines @@
     // 6. If thisArg was supplied, let T be thisArg; else let T be undefined.
     // [Already done by the arguments adapter]
 
     if (direction == ForEachDirection::kForward) {
       // 7. Let k be 0.
       k_.Bind(SmiConstant(0));
     } else {
       k_.Bind(NumberDec(len()));
     }
 
-    a_.Bind(generator(this));
+    generator(this);
 
-    HandleFastElements(processor, action, &slow, direction);
+    HandleFastElements(processor, action, &fully_spec_compliant_, direction);
 
-    BIND(&slow);
+    BIND(&fully_spec_compliant_);
 
     Node* result =
         CallStub(slow_case_continuation, context(), receiver(), callbackfn(),
                  this_arg(), a_.value(), o(), k_.value(), len(), to_.value());
     ReturnFromBuiltin(result);
   }
 
   void InitIteratingArrayBuiltinLoopContinuation(Node* context, Node* receiver,
                                                  Node* callbackfn,
                                                  Node* this_arg, Node* a,
@@ skipping 79 matching lines @@
       label_ptrs.push_back(&label);
     }
 
     BIND(&distinguish_types);
 
     if (direction == ForEachDirection::kForward) {
       k_.Bind(SmiConstant(0));
     } else {
       k_.Bind(NumberDec(len()));
     }
-    a_.Bind(generator(this));
+    generator(this);
     Node* elements_type = LoadInstanceType(LoadElements(o_));
     Switch(elements_type, &unexpected_instance_type, instance_types.data(),
            label_ptrs.data(), labels.size());
 
     for (size_t i = 0; i < labels.size(); ++i) {
       BIND(&labels[i]);
       Label done(this);
       // TODO(tebbi): Silently cancelling the loop on buffer detachment is a
       // spec violation. Should go to &detached and throw a TypeError instead.
       VisitAllTypedArrayElements(
@@ skipping 229 matching lines @@
   Node* o_ = nullptr;
   Node* this_arg_ = nullptr;
   Node* len_ = nullptr;
   Node* context_ = nullptr;
   Node* receiver_ = nullptr;
   Node* new_target_ = nullptr;
   Node* argc_ = nullptr;
   Variable k_;
   Variable a_;
   Variable to_;
+  Label fully_spec_compliant_;
 };
 
 TF_BUILTIN(FastArrayPush, CodeStubAssembler) {
   VARIABLE(arg_index, MachineType::PointerRepresentation());
   Label default_label(this, &arg_index);
   Label smi_transition(this);
   Label object_push_pre(this);
   Label object_push(this, &arg_index);
   Label double_push(this, &arg_index);
   Label double_transition(this);
@@ skipping 458 matching lines @@
   Node* object = Parameter(Descriptor::kObject);
   Node* initial_k = Parameter(Descriptor::kInitialK);
   Node* len = Parameter(Descriptor::kLength);
   Node* to = Parameter(Descriptor::kTo);
 
   InitIteratingArrayBuiltinLoopContinuation(context, receiver, callbackfn,
                                             this_arg, array, object, initial_k,
                                             len, to);
 
   GenerateIteratingArrayBuiltinLoopContinuation(
-      &ArrayBuiltinCodeStubAssembler::MapProcessor,
+      &ArrayBuiltinCodeStubAssembler::SpecCompliantMapProcessor,
       &ArrayBuiltinCodeStubAssembler::NullPostLoopAction);
 }
 
 TF_BUILTIN(ArrayMap, ArrayBuiltinCodeStubAssembler) {
   Node* argc =
       ChangeInt32ToIntPtr(Parameter(BuiltinDescriptor::kArgumentsCount));
   CodeStubArguments args(this, argc);
   Node* context = Parameter(BuiltinDescriptor::kContext);
   Node* new_target = Parameter(BuiltinDescriptor::kNewTarget);
   Node* receiver = args.GetReceiver();
@@ skipping 1064 matching lines @@
   {
     Node* message = SmiConstant(MessageTemplate::kDetachedOperation);
     CallRuntime(Runtime::kThrowTypeError, context, message,
                 HeapConstant(operation));
     Unreachable();
   }
 }
 
 }  // namespace internal
 }  // namespace v8