[turbofan] Extend Array.prototype.pop lowering to support FAST_DOUBLE_ELEMENTS.

So far the Array.prototype.pop lowering in the JSBuiltinReducer was
limited to (holey) fast or fast-smi elements. But it can be made to
work easily to also handle fast-double elements, so allow that as
well.

R=jarin@chromium.org
BUG=v8:5267,v8:6338

Review-Url: https://codereview.chromium.org/2861443006
Cr-Commit-Position: refs/heads/master@{#45090}
This commit is contained in:
bmeurer 2017-05-04 05:35:58 -07:00 committed by Commit bot
parent 418926e010
commit 5c433ec500

View File

@ -842,11 +842,11 @@ Reduction JSBuiltinReducer::ReduceArrayPop(Node* node) {
Node* receiver = NodeProperties::GetValueInput(node, 1);
Node* effect = NodeProperties::GetEffectInput(node);
Node* control = NodeProperties::GetControlInput(node);
// TODO(turbofan): Extend this to also handle fast (holey) double elements
// TODO(turbofan): Extend this to also handle fast holey double elements
// once we got the hole NaN mess sorted out in TurboFan/V8.
if (GetMapWitness(node).ToHandle(&receiver_map) &&
CanInlineArrayResizeOperation(receiver_map) &&
IsFastSmiOrObjectElementsKind(receiver_map->elements_kind())) {
receiver_map->elements_kind() != FAST_HOLEY_DOUBLE_ELEMENTS) {
// Install code dependencies on the {receiver} prototype maps and the
// global array protector cell.
dependencies()->AssumePropertyCell(factory()->array_protector());
@ -878,9 +878,11 @@ Reduction JSBuiltinReducer::ReduceArrayPop(Node* node) {
receiver, efalse, if_false);
// Ensure that we aren't popping from a copy-on-write backing store.
elements = efalse =
graph()->NewNode(simplified()->EnsureWritableFastElements(), receiver,
elements, efalse, if_false);
if (IsFastSmiOrObjectElementsKind(receiver_map->elements_kind())) {
elements = efalse =
graph()->NewNode(simplified()->EnsureWritableFastElements(),
receiver, elements, efalse, if_false);
}
// Compute the new {length}.
length = graph()->NewNode(simplified()->NumberSubtract(), length,