From 66b616f450b6ff23e3933ac3d7959c4d848e047c Mon Sep 17 00:00:00 2001
From: Georg Neis <neis@chromium.org>
Date: Tue, 15 Jan 2019 14:23:46 +0100
Subject: [PATCH] [turbofan] Precompute array index represented by an
 internalized string

Bug: v8:7790
Change-Id: I223f01bc7f26de234b41e6ab249bb41f822c835f
Reviewed-on: https://chromium-review.googlesource.com/c/1411602
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58875}
---
 src/compiler/js-heap-broker.cc                | 36 +++++++++++++++++--
 src/compiler/js-heap-broker.h                 | 10 ++++++
 .../js-native-context-specialization.cc       | 21 +++++++----
 3 files changed, 58 insertions(+), 9 deletions(-)

diff --git a/src/compiler/js-heap-broker.cc b/src/compiler/js-heap-broker.cc
index 9085b6de20..6589e8209e 100644
--- a/src/compiler/js-heap-broker.cc
+++ b/src/compiler/js-heap-broker.cc
@@ -486,6 +486,12 @@ class StringData : public NameData {
   static constexpr int kMaxLengthForDoubleConversion = 23;
 };
 
+class SymbolData : public NameData {
+ public:
+  SymbolData(JSHeapBroker* broker, ObjectData** storage, Handle<Symbol> object)
+      : NameData(broker, storage, object) {}
+};
+
 StringData::StringData(JSHeapBroker* broker, ObjectData** storage,
                        Handle<String> object)
     : NameData(broker, storage, object),
@@ -502,10 +508,23 @@ StringData::StringData(JSHeapBroker* broker, ObjectData** storage,
 class InternalizedStringData : public StringData {
  public:
   InternalizedStringData(JSHeapBroker* broker, ObjectData** storage,
-                         Handle<InternalizedString> object)
-      : StringData(broker, storage, object) {}
+                         Handle<InternalizedString> object);
+
+  uint32_t array_index() const { return array_index_; }
+
+ private:
+  uint32_t array_index_;
 };
 
+InternalizedStringData::InternalizedStringData(
+    JSHeapBroker* broker, ObjectData** storage,
+    Handle<InternalizedString> object)
+    : StringData(broker, storage, object) {
+  if (!object->AsArrayIndex(&array_index_)) {
+    array_index_ = InternalizedStringRef::kNotAnArrayIndex;
+  }
+}
+
 namespace {
 
 bool IsFastLiteralHelper(Handle<JSObject> boilerplate, int max_depth,
@@ -2113,6 +2132,19 @@ base::Optional<double> StringRef::ToNumber() {
   return data()->AsString()->to_number();
 }
 
+uint32_t InternalizedStringRef::array_index() const {
+  if (broker()->mode() == JSHeapBroker::kDisabled) {
+    AllowHandleDereference allow_handle_dereference;
+    AllowHandleAllocation allow_handle_allocation;
+    uint32_t result;
+    if (!object()->AsArrayIndex(&result)) {
+      result = kNotAnArrayIndex;
+    }
+    return result;
+  }
+  return data()->AsInternalizedString()->array_index();
+}
+
 ObjectRef FixedArrayRef::get(int i) const {
   if (broker()->mode() == JSHeapBroker::kDisabled) {
     AllowHandleAllocation handle_allocation;
diff --git a/src/compiler/js-heap-broker.h b/src/compiler/js-heap-broker.h
index 24888b53df..8e2a6e7059 100644
--- a/src/compiler/js-heap-broker.h
+++ b/src/compiler/js-heap-broker.h
@@ -66,6 +66,7 @@ enum class OddballType : uint8_t {
   /* Subtypes of Name */           \
   V(InternalizedString)            \
   V(String)                        \
+  V(Symbol)                        \
   /* Subtypes of HeapObject */     \
   V(AllocationSite)                \
   V(Cell)                          \
@@ -549,6 +550,12 @@ class StringRef : public NameRef {
   bool IsExternalString() const;
 };
 
+class SymbolRef : public NameRef {
+ public:
+  using NameRef::NameRef;
+  Handle<Symbol> object() const;
+};
+
 class JSTypedArrayRef : public JSObjectRef {
  public:
   using JSObjectRef::JSObjectRef;
@@ -597,6 +604,9 @@ class InternalizedStringRef : public StringRef {
  public:
   using StringRef::StringRef;
   Handle<InternalizedString> object() const;
+
+  uint32_t array_index() const;
+  static const uint32_t kNotAnArrayIndex = -1;  // 2^32-1 is not a valid index.
 };
 
 class V8_EXPORT_PRIVATE JSHeapBroker : public NON_EXPORTED_BASE(ZoneObject) {
diff --git a/src/compiler/js-native-context-specialization.cc b/src/compiler/js-native-context-specialization.cc
index b62243c620..4767a06ac9 100644
--- a/src/compiler/js-native-context-specialization.cc
+++ b/src/compiler/js-native-context-specialization.cc
@@ -1802,13 +1802,20 @@ Reduction JSNativeContextSpecialization::ReduceKeyedAccess(
 
   // Optimize access for constant {index}.
   HeapObjectMatcher mindex(index);
-  if (mindex.HasValue() && mindex.Value()->IsUniqueName()) {
-    auto name = Handle<Name>::cast(mindex.Value());
-    uint32_t array_index;
-    if (name->AsArrayIndex(&array_index)) {
-      index = jsgraph()->Constant(static_cast<double>(array_index));
-    } else {
-      return ReduceNamedAccess(node, value, receiver_maps, name, access_mode);
+  if (mindex.HasValue()) {
+    ObjectRef name = mindex.Ref(broker());
+    if (name.IsSymbol()) {
+      return ReduceNamedAccess(node, value, receiver_maps,
+                               name.AsName().object(), access_mode);
+    }
+    if (name.IsInternalizedString()) {
+      uint32_t array_index = name.AsInternalizedString().array_index();
+      if (array_index != InternalizedStringRef::kNotAnArrayIndex) {
+        index = jsgraph()->Constant(static_cast<double>(array_index));
+      } else {
+        return ReduceNamedAccess(node, value, receiver_maps,
+                                 name.AsName().object(), access_mode);
+      }
     }
   }