[turbofan] Speculatively optimize string character access.

src/compiler/js-builtin-reducer.cc

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/compiler/js-builtin-reducer.h"
 
 #include "src/base/bits.h"
 #include "src/builtins/builtins-utils.h"
 #include "src/code-factory.h"
 #include "src/compilation-dependencies.h"
@@ skipping 1904 matching lines @@
 
 // ES6 section 21.1.3.1 String.prototype.charAt ( pos )
 Reduction JSBuiltinReducer::ReduceStringCharAt(Node* node) {
   // We need at least target, receiver and index parameters.
   if (node->op()->ValueInputCount() >= 3) {
     Node* index = NodeProperties::GetValueInput(node, 2);
     Type* index_type = NodeProperties::GetType(index);
     Node* effect = NodeProperties::GetEffectInput(node);
     Node* control = NodeProperties::GetControlInput(node);
 
-    if (index_type->Is(Type::Integral32OrMinusZeroOrNaN())) {
-      if (Node* receiver = GetStringWitness(node)) {
+    if (Node* receiver = GetStringWitness(node)) {
+      if (isolate()->IsStringBoundsCheckIntact()) {
+        // Determine the {receiver} length.
+        Node* receiver_length = effect = graph()->NewNode(
+            simplified()->LoadField(AccessBuilder::ForStringLength()), receiver,
+            effect, control);
+
+        // Check that the {index} is within the range of {receiver}.
+        index = effect = graph()->NewNode(simplified()->CheckBounds(), index,
+                                          receiver_length, effect, control);
+
+        // Return the character from the {receiver} as single character string.
+        Node* value = graph()->NewNode(simplified()->StringCharAt(), receiver,
+                                       index, control);
+
+        ReplaceWithValue(node, value, effect, control);
+        return Replace(value);
+      }
+
+      if (index_type->Is(Type::Integral32OrMinusZeroOrNaN())) {
         if (!index_type->Is(Type::Unsigned32())) {
           // Map -0 and NaN to 0 (as per ToInteger), and the values in
           // the [-2^31,-1] range to the [2^31,2^32-1] range, which will
           // be considered out-of-bounds as well, because of the maximal
           // String length limit in V8.
           STATIC_ASSERT(String::kMaxLength <= kMaxInt);
           index = graph()->NewNode(simplified()->NumberToUint32(), index);
         }
 
         // Determine the {receiver} length.
@@ skipping 32 matching lines @@
 
 // ES6 section 21.1.3.2 String.prototype.charCodeAt ( pos )
 Reduction JSBuiltinReducer::ReduceStringCharCodeAt(Node* node) {
   // We need at least target, receiver and index parameters.
   if (node->op()->ValueInputCount() >= 3) {
     Node* index = NodeProperties::GetValueInput(node, 2);
     Type* index_type = NodeProperties::GetType(index);
     Node* effect = NodeProperties::GetEffectInput(node);
     Node* control = NodeProperties::GetControlInput(node);
 
-    if (index_type->Is(Type::Integral32OrMinusZeroOrNaN())) {
-      if (Node* receiver = GetStringWitness(node)) {
+    if (Node* receiver = GetStringWitness(node)) {
+      if (isolate()->IsStringBoundsCheckIntact()) {
+        // Determine the {receiver} length.
+        Node* receiver_length = effect = graph()->NewNode(
+            simplified()->LoadField(AccessBuilder::ForStringLength()), receiver,
+            effect, control);
+
+        // Check that the {index} is within the range of {receiver}.
+        index = effect = graph()->NewNode(simplified()->CheckBounds(), index,
+                                          receiver_length, effect, control);
+
+        // Return the character from the {receiver} as character code.
+        Node* value = graph()->NewNode(simplified()->StringCharCodeAt(),
+                                       receiver, index, control);
+
+        ReplaceWithValue(node, value, effect, control);
+        return Replace(value);
+      }
+
+      if (index_type->Is(Type::Integral32OrMinusZeroOrNaN())) {
         if (!index_type->Is(Type::Unsigned32())) {
           // Map -0 and NaN to 0 (as per ToInteger), and the values in
           // the [-2^31,-1] range to the [2^31,2^32-1] range, which will
           // be considered out-of-bounds as well, because of the maximal
           // String length limit in V8.
           STATIC_ASSERT(String::kMaxLength <= kMaxInt);
           index = graph()->NewNode(simplified()->NumberToUint32(), index);
         }
 
         // Determine the {receiver} length.
@@ skipping 536 matching lines @@
   return jsgraph()->simplified();
 }
 
 JSOperatorBuilder* JSBuiltinReducer::javascript() const {
   return jsgraph()->javascript();
 }
 
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8