[turbofan] Speculatively optimize string character access.

src/builtins/builtins-string-gen.cc

 // Copyright 2017 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/builtins/builtins-string-gen.h"
 
 #include "src/builtins/builtins-regexp-gen.h"
 #include "src/builtins/builtins-utils-gen.h"
 #include "src/builtins/builtins.h"
 #include "src/code-factory.h"
@@ skipping 638 matching lines @@
 
     // Determine the actual length of the {receiver} String.
     Node* receiver_length = LoadObjectField(receiver, String::kLengthOffset);
 
     // Return "" if the Smi {position} is outside the bounds of the {receiver}.
     Label if_positioninbounds(this);
     Branch(SmiAboveOrEqual(position, receiver_length), &return_emptystring,
            &if_positioninbounds);
 
     BIND(&return_emptystring);
-    Return(EmptyStringConstant());
+    {
+      // Invalidate the "String Bounds Check" protector.
+      Node* invalid = SmiConstant(Isolate::kProtectorInvalid);
+      Node* cell = LoadRoot(Heap::kStringBoundsCheckProtectorRootIndex);
+      StoreObjectFieldNoWriteBarrier(cell, Cell::kValueOffset, invalid);
+      Return(EmptyStringConstant());
+    }
 
     BIND(&if_positioninbounds);
   }
 
   // Load the character code at the {position} from the {receiver}.
   Node* code = StringCharCodeAt(receiver, position);
 
   // And return the single character string with only that {code}.
   Node* result = StringFromCharCode(code);
   Return(result);
@@ skipping 18 matching lines @@
 
     // Determine the actual length of the {receiver} String.
     Node* receiver_length = LoadObjectField(receiver, String::kLengthOffset);
 
     // Return NaN if the Smi {position} is outside the bounds of the {receiver}.
     Label if_positioninbounds(this);
     Branch(SmiAboveOrEqual(position, receiver_length), &return_nan,
            &if_positioninbounds);
 
     BIND(&return_nan);
-    Return(NaNConstant());
+    {
+      // Invalidate the "String Bounds Check" protector.
+      Node* invalid = SmiConstant(Isolate::kProtectorInvalid);
+      Node* cell = LoadRoot(Heap::kStringBoundsCheckProtectorRootIndex);
+      StoreObjectFieldNoWriteBarrier(cell, Cell::kValueOffset, invalid);
+      Return(NaNConstant());
+    }
 
     BIND(&if_positioninbounds);
   }
 
   // Load the character at the {position} from the {receiver}.
   Node* value = StringCharCodeAt(receiver, position);
   Node* result = SmiFromWord32(value);
   Return(result);
 }
 
@@ skipping 1112 matching lines @@
     CallRuntime(Runtime::kThrowIncompatibleMethodReceiver, context,
                 HeapConstant(factory()->NewStringFromAsciiChecked(
                     "String Iterator.prototype.next", TENURED)),
                 iterator);
     Unreachable();
   }
 }
 
 }  // namespace internal
 }  // namespace v8