Preliminary lowering of typed array loads in TF.

src/compiler/js-typed-lowering.cc

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/compiler/graph-inl.h"
 #include "src/compiler/js-typed-lowering.h"
 #include "src/compiler/node-aux-data-inl.h"
 #include "src/compiler/node-properties-inl.h"
 #include "src/types.h"
 
@@ skipping 481 matching lines @@
     ReplaceEagerly(input, inv);
     // TODO(titzer): Ugly. ReplaceEagerly smashes all uses. Smash it back here.
     cmp->ReplaceInput(0, input);
     return Changed(inv);
   }
   // TODO(turbofan): js-typed-lowering of ToBoolean(string)
   return NoChange();
 }
 
 
+FieldAccess JSTypedLowering::FieldAccessForElements() {

[titzer, 2014/08/28 09:45:09]

Let's pull these out to an AccessHelper class.

[Michael Starzinger, 2014/08/28 10:38:40]

Done. I called it just "Access" but I am happy to change the name if you want.

[titzer, 2014/08/28 11:09:03]

Maybe AccessBuilder...to prevent confusion between the actual FieldAccess and
ElementAccess instances and the thing that makes them....

+  return {kTaggedBase, JSTypedArray::kElementsOffset,
+          graph()->zone()->isolate()->factory()->empty_string(),
+          Type::Internal(), kMachAnyTagged};
+}
+
+
+FieldAccess JSTypedLowering::FieldAccessForExternalPointer() {
+  return {kTaggedBase, ExternalArray::kExternalPointerOffset,
+          graph()->zone()->isolate()->factory()->empty_string(),
+          Type::UntaggedPtr(), kMachPtr};
+}
+
+
+static ElementAccess ElementAccessForTypedArray(BaseTaggedness taggedness,
+                                                ExternalArrayType type,
+                                                int header_size) {
+  switch (type) {
+    case kExternalInt8Array:
+      return {taggedness, header_size, Type::Signed32(), kMachInt8};
+    case kExternalUint8Array:
+    case kExternalUint8ClampedArray:
+      return {taggedness, header_size, Type::Unsigned32(), kMachUint8};
+    case kExternalInt16Array:
+      return {taggedness, header_size, Type::Signed32(), kMachInt16};
+    case kExternalUint16Array:
+      return {taggedness, header_size, Type::Unsigned32(), kMachUint16};
+    case kExternalInt32Array:
+      return {taggedness, header_size, Type::Signed32(), kMachInt32};
+    case kExternalUint32Array:
+      return {taggedness, header_size, Type::Unsigned32(), kMachUint32};
+    case kExternalFloat32Array:
+      return {taggedness, header_size, Type::Number(), kRepFloat32};
+    case kExternalFloat64Array:
+      return {taggedness, header_size, Type::Number(), kRepFloat64};
+  }
+  UNREACHABLE();
+  return {kUntaggedBase, 0, Type::None(), kMachNone};
+}
+
+
+Reduction JSTypedLowering::ReduceJSPropertyLoad(Node* node) {
+  Node* key = NodeProperties::GetValueInput(node, 1);
+  Node* base = NodeProperties::GetValueInput(node, 0);
+  Type* key_type = NodeProperties::GetBounds(key).upper;
+  Type* base_type = NodeProperties::GetBounds(base).upper;
+  // TODO(mstarzinger): This lowering is not correct if:
+  //   a) The typed array turns external (i.e. MaterializeArrayBuffer)
+  //   b) The typed array or it's buffer is neutered.
+  //   c) The index is out of bounds.
+  if (base_type->IsConstant() && key_type->Is(Type::Integral32()) &&
+      base_type->AsConstant()->Value()->IsJSTypedArray()) {
+    // JSLoadProperty(typed-array, int32)
+    JSTypedArray* array = JSTypedArray::cast(*base_type->AsConstant()->Value());
+    ElementsKind elements_kind = array->map()->elements_kind();
+    ExternalArrayType type = array->type();
+    ElementAccess element_access;
+    Node* elements =
+        graph()->NewNode(simplified()->LoadField(FieldAccessForElements()),
+                         base, NodeProperties::GetEffectInput(node));
+    if (IsExternalArrayElementsKind(elements_kind)) {
+      elements = graph()->NewNode(
+          simplified()->LoadField(FieldAccessForExternalPointer()), elements,
+          NodeProperties::GetEffectInput(node));
+      element_access = ElementAccessForTypedArray(kUntaggedBase, type, 0);

[titzer, 2014/08/28 09:45:10]

Maybe instead of passing the header size, you pass the externalness of the
elements kind to this method?

[Michael Starzinger, 2014/08/28 10:38:40]

Done.

+    } else {
+      DCHECK(IsFixedTypedArrayElementsKind(elements_kind));
+      int offset = FixedTypedArrayBase::kDataOffset;
+      element_access = ElementAccessForTypedArray(kTaggedBase, type, offset);
+    }
+    Node* value =
+        graph()->NewNode(simplified()->LoadElement(element_access), elements,
+                         key, NodeProperties::GetEffectInput(node));
+    return ReplaceEagerly(node, value);
+  }
+  return NoChange();
+}
+
+
 static Reduction ReplaceWithReduction(Node* node, Reduction reduction) {
   if (reduction.Changed()) {
     NodeProperties::ReplaceWithValue(node, reduction.replacement());
     return reduction;
   }
   return Reducer::NoChange();
 }
 
 
 Reduction JSTypedLowering::Reduce(Node* node) {
@@ skipping 54 matching lines @@
     }
     case IrOpcode::kJSToBoolean:
       return ReplaceWithReduction(node,
                                   ReduceJSToBooleanInput(node->InputAt(0)));
     case IrOpcode::kJSToNumber:
       return ReplaceWithReduction(node,
                                   ReduceJSToNumberInput(node->InputAt(0)));
     case IrOpcode::kJSToString:
       return ReplaceWithReduction(node,
                                   ReduceJSToStringInput(node->InputAt(0)));
+    case IrOpcode::kJSLoadProperty:
+      return ReduceJSPropertyLoad(node);
     default:
       break;
   }
   return NoChange();
 }
 }
 }
 }  // namespace v8::internal::compiler