Add machinery to support arguments escaping to safe builtins

src/hydrogen.cc

 // Copyright 2013 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/hydrogen.h"
 
 #include <algorithm>
 
 #include "src/v8.h"
 #include "src/allocation-site-scopes.h"
@@ skipping 4155 matching lines @@
 
 
 void HOptimizedGraphBuilder::VisitExpressions(
     ZoneList<Expression*>* exprs) {
   for (int i = 0; i < exprs->length(); ++i) {
     CHECK_ALIVE(VisitForValue(exprs->at(i)));
   }
 }
 
 
+void HOptimizedGraphBuilder::VisitCallArguments(ZoneList<Expression*>* args,
+                                                HValue* function,
+                                                bool* args_contain_arguments) {
+  Handle<JSFunction> known_function;
+  ArgumentsAllowedFlag is_arguments_allowed = ARGUMENTS_NOT_ALLOWED;
+  if (function->IsConstant() &&
+      HConstant::cast(function)->handle(isolate())->IsJSFunction()) {
+    known_function = Handle<JSFunction>::cast(
+        HConstant::cast(function)->handle(isolate()));
+
+    if (known_function->shared()->CanHandleArgumentsSafely()) {
+      ASSERT(known_function->shared()->HasBuiltinFunctionId());
+      is_arguments_allowed = ARGUMENTS_ALLOWED;
+    }
+  }
+
+  bool found_arguments = false;
+  for (int i = 0; i < args->length(); i++) {
+    CHECK_ALIVE(VisitForValue(args->at(i), is_arguments_allowed));
+    if (!found_arguments)
+      found_arguments = Top()->CheckFlag(HValue::kIsArguments);
+  }
+  *args_contain_arguments = found_arguments;
+  if (found_arguments) ASSERT(is_arguments_allowed == ARGUMENTS_ALLOWED);
+}
+
+
 bool HOptimizedGraphBuilder::BuildGraph() {
   if (current_info()->function()->is_generator()) {
     Bailout(kFunctionIsAGenerator);
     return false;
   }
   Scope* scope = current_info()->scope();
   if (scope->HasIllegalRedeclaration()) {
     Bailout(kFunctionWithIllegalRedeclaration);
     return false;
   }
@@ skipping 4174 matching lines @@
       return true;
     }
     default:
       // Not yet supported for inlining.
       break;
   }
   return false;
 }
 
 
+void HOptimizedGraphBuilder::InlineBuiltinWithArguments(
+    Call* expr,
+    HValue* function,
+    Handle<Map> receiver_map,
+    int args_count_no_receiver) {
+  ASSERT(function->IsConstant() &&
+      HConstant::cast(function)->handle(isolate())->IsJSFunction());
+  Handle<JSFunction> known_function = Handle<JSFunction>::cast(
+      HConstant::cast(function)->handle(isolate()));
+  ASSERT(known_function->shared()->CanHandleArgumentsSafely());
+  ASSERT(known_function->shared()->HasBuiltinFunctionId());
+  if (TryInlineBuiltinMethodCall(expr, known_function, receiver_map,
+                                 args_count_no_receiver)) {
+    if (FLAG_trace_inlining) {
+      PrintF("Inlining builtin ");
+      known_function->ShortPrint();
+      PrintF("\n");
+    }
+  } else {
+    Bailout(kBadValueContextForArgumentsValue);
+  }
+}
+
+
 bool HOptimizedGraphBuilder::TryInlineApiFunctionCall(Call* expr,
                                                       HValue* receiver) {
   Handle<JSFunction> function = expr->target();
   int argc = expr->arguments()->length();
   SmallMapList receiver_maps;
   return TryInlineApiCall(function,
                           receiver,
                           &receiver_maps,
                           argc,
                           expr->id(),
@@ skipping 273 matching lines @@
 
 
 // f.call(...)
 void HOptimizedGraphBuilder::BuildFunctionCall(Call* expr) {
   HValue* function = Pop();  // f
   HValue* receiver;
   ZoneList<Expression*>* args = expr->arguments();
   int args_length = args->length();
   Drop(1);  // call
 
+  Push(function);
+  bool have_arguments = false;
   if (args_length == 0) {
-    receiver = graph()->GetConstantUndefined();
+    receiver = BuildWrapReceiver(graph()->GetConstantUndefined(), function);
     args_length = 1;
+    Push(receiver);
   } else {
-    CHECK_ALIVE(VisitForValue(args->at(0)));
-    receiver = Pop();
+    CHECK_ALIVE(VisitCallArguments(args, function, &have_arguments));
+    receiver = BuildWrapReceiver(
+        environment()->ExpressionStackAt(args_length - 1), function);
+    environment()->SetExpressionStackAt(args_length - 1, receiver);
   }
-  receiver = BuildWrapReceiver(receiver, function);
 
-  Push(function);
-  Push(receiver);
-  for (int i = 1; i < args_length; i++) {
-    CHECK_ALIVE(VisitForValue(args->at(i)));
+  if (have_arguments) {
+    Handle<Map> map;
+    CHECK_BAILOUT(InlineBuiltinWithArguments(expr, function, map,
+                                             args_length - 1));
   }
+  ASSERT(!have_arguments);
   HandleIndirectCall(expr, function, args_length);
 }
 
 
 HValue* HOptimizedGraphBuilder::ImplicitReceiverFor(HValue* function,
                                                     Handle<JSFunction> target) {
   SharedFunctionInfo* shared = target->shared();
   if (shared->strict_mode() == SLOPPY && !shared->native()) {
     // Cannot embed a direct reference to the global proxy
     // as is it dropped on deserialization.
@@ skipping 246 matching lines @@
 
     Push(receiver);
 
     if (function->IsConstant() &&
         HConstant::cast(function)->handle(isolate())->IsJSFunction()) {
       Handle<JSFunction> known_function = Handle<JSFunction>::cast(
           HConstant::cast(function)->handle(isolate()));
       expr->set_target(known_function);
 
       if (TryIndirectCall(expr)) return;
-      CHECK_ALIVE(VisitExpressions(expr->arguments()));
+      bool have_arguments = false;
+      CHECK_ALIVE(VisitCallArguments(expr->arguments(), function,
+                                     &have_arguments));
 
       Handle<Map> map = types->length() == 1 ? types->first() : Handle<Map>();
+      if (have_arguments) {
+        CHECK_BAILOUT(InlineBuiltinWithArguments(expr,
+                                                 function,
+                                                 map,
+                                                 expr->arguments()->length()));
+      }
+      ASSERT(!have_arguments);
       if (TryInlineBuiltinMethodCall(expr, known_function, map,
                                      expr->arguments()->length())) {
         if (FLAG_trace_inlining) {
           PrintF("Inlining builtin ");
           known_function->ShortPrint();
           PrintF("\n");
         }
         return;
       }
       if (TryInlineApiMethodCall(expr, receiver, types)) return;
@@ skipping 3461 matching lines @@
   if (ShouldProduceTraceOutput()) {
     isolate()->GetHTracer()->TraceHydrogen(name(), graph_);
   }
 
 #ifdef DEBUG
   graph_->Verify(false);  // No full verify.
 #endif
 }
 
 } }  // namespace v8::internal