src/code-stubs-hydrogen.cc

   1 // Copyright 2012 the V8 project authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #include "src/v8.h"
   6
   7 #include "src/bailout-reason.h"
   8 #include "src/code-stubs.h"
   9 #include "src/field-index.h"
  10 #include "src/hydrogen.h"
  11 #include "src/ic/ic.h"
  12 #include "src/lithium.h"
  13
  14 namespace v8 {
  15 namespace internal {
  16
  17
  18 static LChunk* OptimizeGraph(HGraph* graph) {
  19   DisallowHeapAllocation no_allocation;
  20   DisallowHandleAllocation no_handles;
  21   DisallowHandleDereference no_deref;
  22
  23   DCHECK(graph != NULL);
  24   BailoutReason bailout_reason = kNoReason;
  25   if (!graph->Optimize(&bailout_reason)) {
  26     FATAL(GetBailoutReason(bailout_reason));
  27   }
  28   LChunk* chunk = LChunk::NewChunk(graph);
  29   if (chunk == NULL) {
  30     FATAL(GetBailoutReason(graph->info()->bailout_reason()));
  31   }
  32   return chunk;
  33 }
  34
  35
  36 class CodeStubGraphBuilderBase : public HGraphBuilder {
  37  public:
  38   explicit CodeStubGraphBuilderBase(CompilationInfo* info)
  39       : HGraphBuilder(info),
  40         arguments_length_(NULL),
  41         info_(info),
  42         descriptor_(info->code_stub()),
  43         context_(NULL) {
  44     int parameter_count = descriptor_.GetEnvironmentParameterCount();
  45     parameters_.Reset(new HParameter*[parameter_count]);
  46   }
  47   virtual bool BuildGraph();
  48
  49  protected:
  50   virtual HValue* BuildCodeStub() = 0;
  51   HParameter* GetParameter(int parameter) {
  52     DCHECK(parameter < descriptor_.GetEnvironmentParameterCount());
  53     return parameters_[parameter];
  54   }
  55   HValue* GetArgumentsLength() {
  56     // This is initialized in BuildGraph()
  57     DCHECK(arguments_length_ != NULL);
  58     return arguments_length_;
  59   }
  60   CompilationInfo* info() { return info_; }
  61   CodeStub* stub() { return info_->code_stub(); }
  62   HContext* context() { return context_; }
  63   Isolate* isolate() { return info_->isolate(); }
  64
  65   HLoadNamedField* BuildLoadNamedField(HValue* object,
  66                                        FieldIndex index);
  67   void BuildStoreNamedField(HValue* object, HValue* value, FieldIndex index,
  68                             Representation representation,
  69                             bool transition_to_field);
  70
  71   enum ArgumentClass {
  72     NONE,
  73     SINGLE,
  74     MULTIPLE
  75   };
  76
  77   HValue* UnmappedCase(HValue* elements, HValue* key, HValue* value);
  78   HValue* EmitKeyedSloppyArguments(HValue* receiver, HValue* key,
  79                                    HValue* value);
  80
  81   HValue* BuildArrayConstructor(ElementsKind kind,
  82                                 AllocationSiteOverrideMode override_mode,
  83                                 ArgumentClass argument_class);
  84   HValue* BuildInternalArrayConstructor(ElementsKind kind,
  85                                         ArgumentClass argument_class);
  86
  87   // BuildCheckAndInstallOptimizedCode emits code to install the optimized
  88   // function found in the optimized code map at map_index in js_function, if
  89   // the function at map_index matches the given native_context. Builder is
  90   // left in the "Then()" state after the install.
  91   void BuildCheckAndInstallOptimizedCode(HValue* js_function,
  92                                          HValue* native_context,
  93                                          IfBuilder* builder,
  94                                          HValue* optimized_map,
  95                                          HValue* map_index);
  96   void BuildInstallCode(HValue* js_function, HValue* shared_info);
  97
  98   HInstruction* LoadFromOptimizedCodeMap(HValue* optimized_map,
  99                                          HValue* iterator,
 100                                          int field_offset);
 101   void BuildInstallFromOptimizedCodeMap(HValue* js_function,
 102                                         HValue* shared_info,
 103                                         HValue* native_context);
 104
 105  private:
 106   HValue* BuildArraySingleArgumentConstructor(JSArrayBuilder* builder);
 107   HValue* BuildArrayNArgumentsConstructor(JSArrayBuilder* builder,
 108                                           ElementsKind kind);
 109
 110   SmartArrayPointer<HParameter*> parameters_;
 111   HValue* arguments_length_;
 112   CompilationInfo* info_;
 113   CodeStubDescriptor descriptor_;
 114   HContext* context_;
 115 };
 116
 117
 118 bool CodeStubGraphBuilderBase::BuildGraph() {
 119   // Update the static counter each time a new code stub is generated.
 120   isolate()->counters()->code_stubs()->Increment();
 121
 122   if (FLAG_trace_hydrogen_stubs) {
 123     const char* name = CodeStub::MajorName(stub()->MajorKey(), false);
 124     PrintF("-----------------------------------------------------------\n");
 125     PrintF("Compiling stub %s using hydrogen\n", name);
 126     isolate()->GetHTracer()->TraceCompilation(info());
 127   }
 128
 129   int param_count = descriptor_.GetEnvironmentParameterCount();
 130   HEnvironment* start_environment = graph()->start_environment();
 131   HBasicBlock* next_block = CreateBasicBlock(start_environment);
 132   Goto(next_block);
 133   next_block->SetJoinId(BailoutId::StubEntry());
 134   set_current_block(next_block);
 135
 136   bool runtime_stack_params = descriptor_.stack_parameter_count().is_valid();
 137   HInstruction* stack_parameter_count = NULL;
 138   for (int i = 0; i < param_count; ++i) {
 139     Representation r = descriptor_.GetEnvironmentParameterRepresentation(i);
 140     HParameter* param = Add<HParameter>(i,
 141                                         HParameter::REGISTER_PARAMETER, r);
 142     start_environment->Bind(i, param);
 143     parameters_[i] = param;
 144     if (descriptor_.IsEnvironmentParameterCountRegister(i)) {
 145       param->set_type(HType::Smi());
 146       stack_parameter_count = param;
 147       arguments_length_ = stack_parameter_count;
 148     }
 149   }
 150
 151   DCHECK(!runtime_stack_params || arguments_length_ != NULL);
 152   if (!runtime_stack_params) {
 153     stack_parameter_count = graph()->GetConstantMinus1();
 154     arguments_length_ = graph()->GetConstant0();
 155   }
 156
 157   context_ = Add<HContext>();
 158   start_environment->BindContext(context_);
 159
 160   Add<HSimulate>(BailoutId::StubEntry());
 161
 162   NoObservableSideEffectsScope no_effects(this);
 163
 164   HValue* return_value = BuildCodeStub();
 165
 166   // We might have extra expressions to pop from the stack in addition to the
 167   // arguments above.
 168   HInstruction* stack_pop_count = stack_parameter_count;
 169   if (descriptor_.function_mode() == JS_FUNCTION_STUB_MODE) {
 170     if (!stack_parameter_count->IsConstant() &&
 171         descriptor_.hint_stack_parameter_count() < 0) {
 172       HInstruction* constant_one = graph()->GetConstant1();
 173       stack_pop_count = AddUncasted<HAdd>(stack_parameter_count, constant_one);
 174       stack_pop_count->ClearFlag(HValue::kCanOverflow);
 175       // TODO(mvstanton): verify that stack_parameter_count+1 really fits in a
 176       // smi.
 177     } else {
 178       int count = descriptor_.hint_stack_parameter_count();
 179       stack_pop_count = Add<HConstant>(count);
 180     }
 181   }
 182
 183   if (current_block() != NULL) {
 184     HReturn* hreturn_instruction = New<HReturn>(return_value,
 185                                                 stack_pop_count);
 186     FinishCurrentBlock(hreturn_instruction);
 187   }
 188   return true;
 189 }
 190
 191
 192 template <class Stub>
 193 class CodeStubGraphBuilder: public CodeStubGraphBuilderBase {
 194  public:
 195   explicit CodeStubGraphBuilder(CompilationInfo* info)
 196       : CodeStubGraphBuilderBase(info) {}
 197
 198  protected:
 199   virtual HValue* BuildCodeStub() {
 200     if (casted_stub()->IsUninitialized()) {
 201       return BuildCodeUninitializedStub();
 202     } else {
 203       return BuildCodeInitializedStub();
 204     }
 205   }
 206
 207   virtual HValue* BuildCodeInitializedStub() {
 208     UNIMPLEMENTED();
 209     return NULL;
 210   }
 211
 212   virtual HValue* BuildCodeUninitializedStub() {
 213     // Force a deopt that falls back to the runtime.
 214     HValue* undefined = graph()->GetConstantUndefined();
 215     IfBuilder builder(this);
 216     builder.IfNot<HCompareObjectEqAndBranch, HValue*>(undefined, undefined);
 217     builder.Then();
 218     builder.ElseDeopt(Deoptimizer::kForcedDeoptToRuntime);
 219     return undefined;
 220   }
 221
 222   Stub* casted_stub() { return static_cast<Stub*>(stub()); }
 223 };
 224
 225
 226 Handle<Code> HydrogenCodeStub::GenerateLightweightMissCode(
 227     ExternalReference miss) {
 228   Factory* factory = isolate()->factory();
 229
 230   // Generate the new code.
 231   MacroAssembler masm(isolate(), NULL, 256);
 232
 233   {
 234     // Update the static counter each time a new code stub is generated.
 235     isolate()->counters()->code_stubs()->Increment();
 236
 237     // Generate the code for the stub.
 238     masm.set_generating_stub(true);
 239     // TODO(yangguo): remove this once we can serialize IC stubs.
 240     masm.enable_serializer();
 241     NoCurrentFrameScope scope(&masm);
 242     GenerateLightweightMiss(&masm, miss);
 243   }
 244
 245   // Create the code object.
 246   CodeDesc desc;
 247   masm.GetCode(&desc);
 248
 249   // Copy the generated code into a heap object.
 250   Code::Flags flags = Code::ComputeFlags(
 251       GetCodeKind(),
 252       GetICState(),
 253       GetExtraICState(),
 254       GetStubType());
 255   Handle<Code> new_object = factory->NewCode(
 256       desc, flags, masm.CodeObject(), NeedsImmovableCode());
 257   return new_object;
 258 }
 259
 260
 261 template <class Stub>
 262 static Handle<Code> DoGenerateCode(Stub* stub) {
 263   Isolate* isolate = stub->isolate();
 264   CodeStubDescriptor descriptor(stub);
 265
 266   // If we are uninitialized we can use a light-weight stub to enter
 267   // the runtime that is significantly faster than using the standard
 268   // stub-failure deopt mechanism.
 269   if (stub->IsUninitialized() && descriptor.has_miss_handler()) {
 270     DCHECK(!descriptor.stack_parameter_count().is_valid());
 271     return stub->GenerateLightweightMissCode(descriptor.miss_handler());
 272   }
 273   base::ElapsedTimer timer;
 274   if (FLAG_profile_hydrogen_code_stub_compilation) {
 275     timer.Start();
 276   }
 277   Zone zone;
 278   CompilationInfo info(stub, isolate, &zone);
 279   CodeStubGraphBuilder<Stub> builder(&info);
 280   LChunk* chunk = OptimizeGraph(builder.CreateGraph());
 281   Handle<Code> code = chunk->Codegen();
 282   if (FLAG_profile_hydrogen_code_stub_compilation) {
 283     OFStream os(stdout);
 284     os << "[Lazy compilation of " << stub << " took "
 285        << timer.Elapsed().InMillisecondsF() << " ms]" << std::endl;
 286   }
 287   return code;
 288 }
 289
 290
 291 template <>
 292 HValue* CodeStubGraphBuilder<NumberToStringStub>::BuildCodeStub() {
 293   info()->MarkAsSavesCallerDoubles();
 294   HValue* number = GetParameter(NumberToStringStub::kNumber);
 295   return BuildNumberToString(number, Type::Number(zone()));
 296 }
 297
 298
 299 Handle<Code> NumberToStringStub::GenerateCode() {
 300   return DoGenerateCode(this);
 301 }
 302
 303
 304 // Returns the type string of a value; see ECMA-262, 11.4.3 (p 47).
 305 // Possible optimizations: put the type string into the oddballs.
 306 template <>
 307 HValue* CodeStubGraphBuilder<TypeofStub>::BuildCodeStub() {
 308   Factory* factory = isolate()->factory();
 309   HConstant* number_string = Add<HConstant>(factory->number_string());
 310   HValue* object = GetParameter(TypeofStub::kObject);
 311
 312   IfBuilder is_smi(this);
 313   HValue* smi_check = is_smi.If<HIsSmiAndBranch>(object);
 314   is_smi.Then();
 315   { Push(number_string); }
 316   is_smi.Else();
 317   {
 318     IfBuilder is_number(this);
 319     is_number.If<HCompareMap>(object, isolate()->factory()->heap_number_map());
 320     is_number.Then();
 321     { Push(number_string); }
 322     is_number.Else();
 323     {
 324       HConstant* undefined_string = Add<HConstant>(factory->undefined_string());
 325       HValue* map = AddLoadMap(object, smi_check);
 326       HValue* instance_type = Add<HLoadNamedField>(
 327           map, nullptr, HObjectAccess::ForMapInstanceType());
 328       IfBuilder is_string(this);
 329       is_string.If<HCompareNumericAndBranch>(
 330           instance_type, Add<HConstant>(FIRST_NONSTRING_TYPE), Token::LT);
 331       is_string.Then();
 332       { Push(Add<HConstant>(factory->string_string())); }
 333       is_string.Else();
 334       {
 335         HConstant* object_string = Add<HConstant>(factory->object_string());
 336         IfBuilder is_oddball(this);
 337         is_oddball.If<HCompareNumericAndBranch>(
 338             instance_type, Add<HConstant>(ODDBALL_TYPE), Token::EQ);
 339         is_oddball.Then();
 340         {
 341           IfBuilder is_true_or_false(this);
 342           is_true_or_false.If<HCompareObjectEqAndBranch>(
 343               object, graph()->GetConstantTrue());
 344           is_true_or_false.OrIf<HCompareObjectEqAndBranch>(
 345               object, graph()->GetConstantFalse());
 346           is_true_or_false.Then();
 347           { Push(Add<HConstant>(factory->boolean_string())); }
 348           is_true_or_false.Else();
 349           {
 350             IfBuilder is_null(this);
 351             is_null.If<HCompareObjectEqAndBranch>(object,
 352                                                   graph()->GetConstantNull());
 353             is_null.Then();
 354             { Push(object_string); }
 355             is_null.Else();
 356             { Push(undefined_string); }
 357           }
 358           is_true_or_false.End();
 359         }
 360         is_oddball.Else();
 361         {
 362           IfBuilder is_symbol(this);
 363           is_symbol.If<HCompareNumericAndBranch>(
 364               instance_type, Add<HConstant>(SYMBOL_TYPE), Token::EQ);
 365           is_symbol.Then();
 366           { Push(Add<HConstant>(factory->symbol_string())); }
 367           is_symbol.Else();
 368           {
 369             IfBuilder is_function(this);
 370             HConstant* js_function = Add<HConstant>(JS_FUNCTION_TYPE);
 371             HConstant* js_function_proxy =
 372                 Add<HConstant>(JS_FUNCTION_PROXY_TYPE);
 373             is_function.If<HCompareNumericAndBranch>(instance_type, js_function,
 374                                                      Token::EQ);
 375             is_function.OrIf<HCompareNumericAndBranch>(
 376                 instance_type, js_function_proxy, Token::EQ);
 377             is_function.Then();
 378             { Push(Add<HConstant>(factory->function_string())); }
 379             is_function.Else();
 380             {
 381               // Is it an undetectable object?
 382               IfBuilder is_undetectable(this);
 383               is_undetectable.If<HIsUndetectableAndBranch>(object);
 384               is_undetectable.Then();
 385               {
 386                 // typeof an undetectable object is 'undefined'.
 387                 Push(undefined_string);
 388               }
 389               is_undetectable.Else();
 390               {
 391                 // For any kind of object not handled above, the spec rule for
 392                 // host objects gives that it is okay to return "object".
 393                 Push(object_string);
 394               }
 395             }
 396             is_function.End();
 397           }
 398           is_symbol.End();
 399         }
 400         is_oddball.End();
 401       }
 402       is_string.End();
 403     }
 404     is_number.End();
 405   }
 406   is_smi.End();
 407
 408   return environment()->Pop();
 409 }
 410
 411
 412 Handle<Code> TypeofStub::GenerateCode() { return DoGenerateCode(this); }
 413
 414
 415 template <>
 416 HValue* CodeStubGraphBuilder<FastCloneShallowArrayStub>::BuildCodeStub() {
 417   Factory* factory = isolate()->factory();
 418   HValue* undefined = graph()->GetConstantUndefined();
 419   AllocationSiteMode alloc_site_mode = casted_stub()->allocation_site_mode();
 420
 421   // This stub is very performance sensitive, the generated code must be tuned
 422   // so that it doesn't build and eager frame.
 423   info()->MarkMustNotHaveEagerFrame();
 424
 425   HInstruction* allocation_site =
 426       Add<HLoadKeyed>(GetParameter(0), GetParameter(1), nullptr, FAST_ELEMENTS);
 427   IfBuilder checker(this);
 428   checker.IfNot<HCompareObjectEqAndBranch, HValue*>(allocation_site,
 429                                                     undefined);
 430   checker.Then();
 431
 432   HObjectAccess access = HObjectAccess::ForAllocationSiteOffset(
 433       AllocationSite::kTransitionInfoOffset);
 434   HInstruction* boilerplate =
 435       Add<HLoadNamedField>(allocation_site, nullptr, access);
 436   HValue* elements = AddLoadElements(boilerplate);
 437   HValue* capacity = AddLoadFixedArrayLength(elements);
 438   IfBuilder zero_capacity(this);
 439   zero_capacity.If<HCompareNumericAndBranch>(capacity, graph()->GetConstant0(),
 440                                            Token::EQ);
 441   zero_capacity.Then();
 442   Push(BuildCloneShallowArrayEmpty(boilerplate,
 443                                    allocation_site,
 444                                    alloc_site_mode));
 445   zero_capacity.Else();
 446   IfBuilder if_fixed_cow(this);
 447   if_fixed_cow.If<HCompareMap>(elements, factory->fixed_cow_array_map());
 448   if_fixed_cow.Then();
 449   Push(BuildCloneShallowArrayCow(boilerplate,
 450                                  allocation_site,
 451                                  alloc_site_mode,
 452                                  FAST_ELEMENTS));
 453   if_fixed_cow.Else();
 454   IfBuilder if_fixed(this);
 455   if_fixed.If<HCompareMap>(elements, factory->fixed_array_map());
 456   if_fixed.Then();
 457   Push(BuildCloneShallowArrayNonEmpty(boilerplate,
 458                                       allocation_site,
 459                                       alloc_site_mode,
 460                                       FAST_ELEMENTS));
 461
 462   if_fixed.Else();
 463   Push(BuildCloneShallowArrayNonEmpty(boilerplate,
 464                                       allocation_site,
 465                                       alloc_site_mode,
 466                                       FAST_DOUBLE_ELEMENTS));
 467   if_fixed.End();
 468   if_fixed_cow.End();
 469   zero_capacity.End();
 470
 471   checker.ElseDeopt(Deoptimizer::kUninitializedBoilerplateLiterals);
 472   checker.End();
 473
 474   return environment()->Pop();
 475 }
 476
 477
 478 Handle<Code> FastCloneShallowArrayStub::GenerateCode() {
 479   return DoGenerateCode(this);
 480 }
 481
 482
 483 template <>
 484 HValue* CodeStubGraphBuilder<FastCloneShallowObjectStub>::BuildCodeStub() {
 485   HValue* undefined = graph()->GetConstantUndefined();
 486
 487   HInstruction* allocation_site =
 488       Add<HLoadKeyed>(GetParameter(0), GetParameter(1), nullptr, FAST_ELEMENTS);
 489
 490   IfBuilder checker(this);
 491   checker.IfNot<HCompareObjectEqAndBranch, HValue*>(allocation_site,
 492                                                     undefined);
 493   checker.And();
 494
 495   HObjectAccess access = HObjectAccess::ForAllocationSiteOffset(
 496       AllocationSite::kTransitionInfoOffset);
 497   HInstruction* boilerplate =
 498       Add<HLoadNamedField>(allocation_site, nullptr, access);
 499
 500   int length = casted_stub()->length();
 501   if (length == 0) {
 502     // Empty objects have some slack added to them.
 503     length = JSObject::kInitialGlobalObjectUnusedPropertiesCount;
 504   }
 505   int size = JSObject::kHeaderSize + length * kPointerSize;
 506   int object_size = size;
 507   if (FLAG_allocation_site_pretenuring) {
 508     size += AllocationMemento::kSize;
 509   }
 510
 511   HValue* boilerplate_map =
 512       Add<HLoadNamedField>(boilerplate, nullptr, HObjectAccess::ForMap());
 513   HValue* boilerplate_size = Add<HLoadNamedField>(
 514       boilerplate_map, nullptr, HObjectAccess::ForMapInstanceSize());
 515   HValue* size_in_words = Add<HConstant>(object_size >> kPointerSizeLog2);
 516   checker.If<HCompareNumericAndBranch>(boilerplate_size,
 517                                        size_in_words, Token::EQ);
 518   checker.Then();
 519
 520   HValue* size_in_bytes = Add<HConstant>(size);
 521
 522   HInstruction* object = Add<HAllocate>(size_in_bytes, HType::JSObject(),
 523       NOT_TENURED, JS_OBJECT_TYPE);
 524
 525   for (int i = 0; i < object_size; i += kPointerSize) {
 526     HObjectAccess access = HObjectAccess::ForObservableJSObjectOffset(i);
 527     Add<HStoreNamedField>(object, access,
 528                           Add<HLoadNamedField>(boilerplate, nullptr, access));
 529   }
 530
 531   DCHECK(FLAG_allocation_site_pretenuring || (size == object_size));
 532   if (FLAG_allocation_site_pretenuring) {
 533     BuildCreateAllocationMemento(
 534         object, Add<HConstant>(object_size), allocation_site);
 535   }
 536
 537   environment()->Push(object);
 538   checker.ElseDeopt(Deoptimizer::kUninitializedBoilerplateInFastClone);
 539   checker.End();
 540
 541   return environment()->Pop();
 542 }
 543
 544
 545 Handle<Code> FastCloneShallowObjectStub::GenerateCode() {
 546   return DoGenerateCode(this);
 547 }
 548
 549
 550 template <>
 551 HValue* CodeStubGraphBuilder<CreateAllocationSiteStub>::BuildCodeStub() {
 552   // This stub is performance sensitive, the generated code must be tuned
 553   // so that it doesn't build an eager frame.
 554   info()->MarkMustNotHaveEagerFrame();
 555
 556   HValue* size = Add<HConstant>(AllocationSite::kSize);
 557   HInstruction* object = Add<HAllocate>(size, HType::JSObject(), TENURED,
 558       JS_OBJECT_TYPE);
 559
 560   // Store the map
 561   Handle<Map> allocation_site_map = isolate()->factory()->allocation_site_map();
 562   AddStoreMapConstant(object, allocation_site_map);
 563
 564   // Store the payload (smi elements kind)
 565   HValue* initial_elements_kind = Add<HConstant>(GetInitialFastElementsKind());
 566   Add<HStoreNamedField>(object,
 567                         HObjectAccess::ForAllocationSiteOffset(
 568                             AllocationSite::kTransitionInfoOffset),
 569                         initial_elements_kind);
 570
 571   // Unlike literals, constructed arrays don't have nested sites
 572   Add<HStoreNamedField>(object,
 573                         HObjectAccess::ForAllocationSiteOffset(
 574                             AllocationSite::kNestedSiteOffset),
 575                         graph()->GetConstant0());
 576
 577   // Pretenuring calculation field.
 578   Add<HStoreNamedField>(object,
 579                         HObjectAccess::ForAllocationSiteOffset(
 580                             AllocationSite::kPretenureDataOffset),
 581                         graph()->GetConstant0());
 582
 583   // Pretenuring memento creation count field.
 584   Add<HStoreNamedField>(object,
 585                         HObjectAccess::ForAllocationSiteOffset(
 586                             AllocationSite::kPretenureCreateCountOffset),
 587                         graph()->GetConstant0());
 588
 589   // Store an empty fixed array for the code dependency.
 590   HConstant* empty_fixed_array =
 591     Add<HConstant>(isolate()->factory()->empty_fixed_array());
 592   Add<HStoreNamedField>(
 593       object,
 594       HObjectAccess::ForAllocationSiteOffset(
 595           AllocationSite::kDependentCodeOffset),
 596       empty_fixed_array);
 597
 598   // Link the object to the allocation site list
 599   HValue* site_list = Add<HConstant>(
 600       ExternalReference::allocation_sites_list_address(isolate()));
 601   HValue* site = Add<HLoadNamedField>(site_list, nullptr,
 602                                       HObjectAccess::ForAllocationSiteList());
 603   // TODO(mvstanton): This is a store to a weak pointer, which we may want to
 604   // mark as such in order to skip the write barrier, once we have a unified
 605   // system for weakness. For now we decided to keep it like this because having
 606   // an initial write barrier backed store makes this pointer strong until the
 607   // next GC, and allocation sites are designed to survive several GCs anyway.
 608   Add<HStoreNamedField>(
 609       object,
 610       HObjectAccess::ForAllocationSiteOffset(AllocationSite::kWeakNextOffset),
 611       site);
 612   Add<HStoreNamedField>(site_list, HObjectAccess::ForAllocationSiteList(),
 613                         object);
 614
 615   HInstruction* feedback_vector = GetParameter(0);
 616   HInstruction* slot = GetParameter(1);
 617   Add<HStoreKeyed>(feedback_vector, slot, object, FAST_ELEMENTS,
 618                    INITIALIZING_STORE);
 619   return feedback_vector;
 620 }
 621
 622
 623 Handle<Code> CreateAllocationSiteStub::GenerateCode() {
 624   return DoGenerateCode(this);
 625 }
 626
 627
 628 template <>
 629 HValue* CodeStubGraphBuilder<CreateWeakCellStub>::BuildCodeStub() {
 630   // This stub is performance sensitive, the generated code must be tuned
 631   // so that it doesn't build an eager frame.
 632   info()->MarkMustNotHaveEagerFrame();
 633
 634   HValue* size = Add<HConstant>(WeakCell::kSize);
 635   HInstruction* object =
 636       Add<HAllocate>(size, HType::JSObject(), TENURED, JS_OBJECT_TYPE);
 637
 638   Handle<Map> weak_cell_map = isolate()->factory()->weak_cell_map();
 639   AddStoreMapConstant(object, weak_cell_map);
 640
 641   HInstruction* value = GetParameter(CreateWeakCellDescriptor::kValueIndex);
 642   Add<HStoreNamedField>(object, HObjectAccess::ForWeakCellValue(), value);
 643   Add<HStoreNamedField>(object, HObjectAccess::ForWeakCellNext(),
 644                         graph()->GetConstantUndefined());
 645
 646   HInstruction* feedback_vector =
 647       GetParameter(CreateWeakCellDescriptor::kVectorIndex);
 648   HInstruction* slot = GetParameter(CreateWeakCellDescriptor::kSlotIndex);
 649   Add<HStoreKeyed>(feedback_vector, slot, object, FAST_ELEMENTS,
 650                    INITIALIZING_STORE);
 651   return graph()->GetConstant0();
 652 }
 653
 654
 655 Handle<Code> CreateWeakCellStub::GenerateCode() { return DoGenerateCode(this); }
 656
 657
 658 template <>
 659 HValue* CodeStubGraphBuilder<LoadScriptContextFieldStub>::BuildCodeStub() {
 660   int context_index = casted_stub()->context_index();
 661   int slot_index = casted_stub()->slot_index();
 662
 663   HValue* script_context = BuildGetScriptContext(context_index);
 664   return Add<HLoadNamedField>(script_context, nullptr,
 665                               HObjectAccess::ForContextSlot(slot_index));
 666 }
 667
 668
 669 Handle<Code> LoadScriptContextFieldStub::GenerateCode() {
 670   return DoGenerateCode(this);
 671 }
 672
 673
 674 template <>
 675 HValue* CodeStubGraphBuilder<StoreScriptContextFieldStub>::BuildCodeStub() {
 676   int context_index = casted_stub()->context_index();
 677   int slot_index = casted_stub()->slot_index();
 678
 679   HValue* script_context = BuildGetScriptContext(context_index);
 680   Add<HStoreNamedField>(script_context,
 681                         HObjectAccess::ForContextSlot(slot_index),
 682                         GetParameter(2), STORE_TO_INITIALIZED_ENTRY);
 683   return GetParameter(2);
 684 }
 685
 686
 687 Handle<Code> StoreScriptContextFieldStub::GenerateCode() {
 688   return DoGenerateCode(this);
 689 }
 690
 691
 692 template <>
 693 HValue* CodeStubGraphBuilder<GrowArrayElementsStub>::BuildCodeStub() {
 694   ElementsKind kind = casted_stub()->elements_kind();
 695   if (IsFastDoubleElementsKind(kind)) {
 696     info()->MarkAsSavesCallerDoubles();
 697   }
 698
 699   HValue* object = GetParameter(GrowArrayElementsDescriptor::kObjectIndex);
 700   HValue* key = GetParameter(GrowArrayElementsDescriptor::kKeyIndex);
 701
 702   HValue* elements = AddLoadElements(object);
 703   HValue* current_capacity = Add<HLoadNamedField>(
 704       elements, nullptr, HObjectAccess::ForFixedArrayLength());
 705
 706   HValue* length =
 707       casted_stub()->is_js_array()
 708           ? Add<HLoadNamedField>(object, static_cast<HValue*>(NULL),
 709                                  HObjectAccess::ForArrayLength(kind))
 710           : current_capacity;
 711
 712   return BuildCheckAndGrowElementsCapacity(object, elements, kind, length,
 713                                            current_capacity, key);
 714 }
 715
 716
 717 Handle<Code> GrowArrayElementsStub::GenerateCode() {
 718   return DoGenerateCode(this);
 719 }
 720
 721
 722 template <>
 723 HValue* CodeStubGraphBuilder<LoadFastElementStub>::BuildCodeStub() {
 724   LoadKeyedHoleMode hole_mode = casted_stub()->convert_hole_to_undefined()
 725                                     ? CONVERT_HOLE_TO_UNDEFINED
 726                                     : NEVER_RETURN_HOLE;
 727
 728   HInstruction* load = BuildUncheckedMonomorphicElementAccess(
 729       GetParameter(LoadDescriptor::kReceiverIndex),
 730       GetParameter(LoadDescriptor::kNameIndex), NULL,
 731       casted_stub()->is_js_array(), casted_stub()->elements_kind(), LOAD,
 732       hole_mode, STANDARD_STORE);
 733   return load;
 734 }
 735
 736
 737 Handle<Code> LoadFastElementStub::GenerateCode() {
 738   return DoGenerateCode(this);
 739 }
 740
 741
 742 HLoadNamedField* CodeStubGraphBuilderBase::BuildLoadNamedField(
 743     HValue* object, FieldIndex index) {
 744   Representation representation = index.is_double()
 745       ? Representation::Double()
 746       : Representation::Tagged();
 747   int offset = index.offset();
 748   HObjectAccess access = index.is_inobject()
 749       ? HObjectAccess::ForObservableJSObjectOffset(offset, representation)
 750       : HObjectAccess::ForBackingStoreOffset(offset, representation);
 751   if (index.is_double() &&
 752       (!FLAG_unbox_double_fields || !index.is_inobject())) {
 753     // Load the heap number.
 754     object = Add<HLoadNamedField>(
 755         object, nullptr, access.WithRepresentation(Representation::Tagged()));
 756     // Load the double value from it.
 757     access = HObjectAccess::ForHeapNumberValue();
 758   }
 759   return Add<HLoadNamedField>(object, nullptr, access);
 760 }
 761
 762
 763 template<>
 764 HValue* CodeStubGraphBuilder<LoadFieldStub>::BuildCodeStub() {
 765   return BuildLoadNamedField(GetParameter(0), casted_stub()->index());
 766 }
 767
 768
 769 Handle<Code> LoadFieldStub::GenerateCode() {
 770   return DoGenerateCode(this);
 771 }
 772
 773
 774 template <>
 775 HValue* CodeStubGraphBuilder<ArrayBufferViewLoadFieldStub>::BuildCodeStub() {
 776   return BuildArrayBufferViewFieldAccessor(GetParameter(0), nullptr,
 777                                            casted_stub()->index());
 778 }
 779
 780
 781 Handle<Code> ArrayBufferViewLoadFieldStub::GenerateCode() {
 782   return DoGenerateCode(this);
 783 }
 784
 785
 786 template <>
 787 HValue* CodeStubGraphBuilder<LoadConstantStub>::BuildCodeStub() {
 788   HValue* map = AddLoadMap(GetParameter(0), NULL);
 789   HObjectAccess descriptors_access = HObjectAccess::ForObservableJSObjectOffset(
 790       Map::kDescriptorsOffset, Representation::Tagged());
 791   HValue* descriptors = Add<HLoadNamedField>(map, nullptr, descriptors_access);
 792   HObjectAccess value_access = HObjectAccess::ForObservableJSObjectOffset(
 793       DescriptorArray::GetValueOffset(casted_stub()->constant_index()));
 794   return Add<HLoadNamedField>(descriptors, nullptr, value_access);
 795 }
 796
 797
 798 Handle<Code> LoadConstantStub::GenerateCode() { return DoGenerateCode(this); }
 799
 800
 801 HValue* CodeStubGraphBuilderBase::UnmappedCase(HValue* elements, HValue* key,
 802                                                HValue* value) {
 803   HValue* result = NULL;
 804   HInstruction* backing_store =
 805       Add<HLoadKeyed>(elements, graph()->GetConstant1(), nullptr, FAST_ELEMENTS,
 806                       ALLOW_RETURN_HOLE);
 807   Add<HCheckMaps>(backing_store, isolate()->factory()->fixed_array_map());
 808   HValue* backing_store_length = Add<HLoadNamedField>(
 809       backing_store, nullptr, HObjectAccess::ForFixedArrayLength());
 810   IfBuilder in_unmapped_range(this);
 811   in_unmapped_range.If<HCompareNumericAndBranch>(key, backing_store_length,
 812                                                  Token::LT);
 813   in_unmapped_range.Then();
 814   {
 815     if (value == NULL) {
 816       result = Add<HLoadKeyed>(backing_store, key, nullptr, FAST_HOLEY_ELEMENTS,
 817                                NEVER_RETURN_HOLE);
 818     } else {
 819       Add<HStoreKeyed>(backing_store, key, value, FAST_HOLEY_ELEMENTS);
 820     }
 821   }
 822   in_unmapped_range.ElseDeopt(Deoptimizer::kOutsideOfRange);
 823   in_unmapped_range.End();
 824   return result;
 825 }
 826
 827
 828 HValue* CodeStubGraphBuilderBase::EmitKeyedSloppyArguments(HValue* receiver,
 829                                                            HValue* key,
 830                                                            HValue* value) {
 831   // Mapped arguments are actual arguments. Unmapped arguments are values added
 832   // to the arguments object after it was created for the call. Mapped arguments
 833   // are stored in the context at indexes given by elements[key + 2]. Unmapped
 834   // arguments are stored as regular indexed properties in the arguments array,
 835   // held at elements[1]. See NewSloppyArguments() in runtime.cc for a detailed
 836   // look at argument object construction.
 837   //
 838   // The sloppy arguments elements array has a special format:
 839   //
 840   // 0: context
 841   // 1: unmapped arguments array
 842   // 2: mapped_index0,
 843   // 3: mapped_index1,
 844   // ...
 845   //
 846   // length is 2 + min(number_of_actual_arguments, number_of_formal_arguments).
 847   // If key + 2 >= elements.length then attempt to look in the unmapped
 848   // arguments array (given by elements[1]) and return the value at key, missing
 849   // to the runtime if the unmapped arguments array is not a fixed array or if
 850   // key >= unmapped_arguments_array.length.
 851   //
 852   // Otherwise, t = elements[key + 2]. If t is the hole, then look up the value
 853   // in the unmapped arguments array, as described above. Otherwise, t is a Smi
 854   // index into the context array given at elements[0]. Return the value at
 855   // context[t].
 856
 857   bool is_load = value == NULL;
 858
 859   key = AddUncasted<HForceRepresentation>(key, Representation::Smi());
 860   IfBuilder positive_smi(this);
 861   positive_smi.If<HCompareNumericAndBranch>(key, graph()->GetConstant0(),
 862                                             Token::LT);
 863   positive_smi.ThenDeopt(Deoptimizer::kKeyIsNegative);
 864   positive_smi.End();
 865
 866   HValue* constant_two = Add<HConstant>(2);
 867   HValue* elements = AddLoadElements(receiver, nullptr);
 868   HValue* elements_length = Add<HLoadNamedField>(
 869       elements, nullptr, HObjectAccess::ForFixedArrayLength());
 870   HValue* adjusted_length = AddUncasted<HSub>(elements_length, constant_two);
 871   IfBuilder in_range(this);
 872   in_range.If<HCompareNumericAndBranch>(key, adjusted_length, Token::LT);
 873   in_range.Then();
 874   {
 875     HValue* index = AddUncasted<HAdd>(key, constant_two);
 876     HInstruction* mapped_index = Add<HLoadKeyed>(
 877         elements, index, nullptr, FAST_HOLEY_ELEMENTS, ALLOW_RETURN_HOLE);
 878
 879     IfBuilder is_valid(this);
 880     is_valid.IfNot<HCompareObjectEqAndBranch>(mapped_index,
 881                                               graph()->GetConstantHole());
 882     is_valid.Then();
 883     {
 884       // TODO(mvstanton): I'd like to assert from this point, that if the
 885       // mapped_index is not the hole that it is indeed, a smi. An unnecessary
 886       // smi check is being emitted.
 887       HValue* the_context = Add<HLoadKeyed>(elements, graph()->GetConstant0(),
 888                                             nullptr, FAST_ELEMENTS);
 889       STATIC_ASSERT(Context::kHeaderSize == FixedArray::kHeaderSize);
 890       if (is_load) {
 891         HValue* result = Add<HLoadKeyed>(the_context, mapped_index, nullptr,
 892                                          FAST_ELEMENTS, ALLOW_RETURN_HOLE);
 893         environment()->Push(result);
 894       } else {
 895         DCHECK(value != NULL);
 896         Add<HStoreKeyed>(the_context, mapped_index, value, FAST_ELEMENTS);
 897         environment()->Push(value);
 898       }
 899     }
 900     is_valid.Else();
 901     {
 902       HValue* result = UnmappedCase(elements, key, value);
 903       environment()->Push(is_load ? result : value);
 904     }
 905     is_valid.End();
 906   }
 907   in_range.Else();
 908   {
 909     HValue* result = UnmappedCase(elements, key, value);
 910     environment()->Push(is_load ? result : value);
 911   }
 912   in_range.End();
 913
 914   return environment()->Pop();
 915 }
 916
 917
 918 template <>
 919 HValue* CodeStubGraphBuilder<KeyedLoadSloppyArgumentsStub>::BuildCodeStub() {
 920   HValue* receiver = GetParameter(LoadDescriptor::kReceiverIndex);
 921   HValue* key = GetParameter(LoadDescriptor::kNameIndex);
 922
 923   return EmitKeyedSloppyArguments(receiver, key, NULL);
 924 }
 925
 926
 927 Handle<Code> KeyedLoadSloppyArgumentsStub::GenerateCode() {
 928   return DoGenerateCode(this);
 929 }
 930
 931
 932 template <>
 933 HValue* CodeStubGraphBuilder<KeyedStoreSloppyArgumentsStub>::BuildCodeStub() {
 934   HValue* receiver = GetParameter(StoreDescriptor::kReceiverIndex);
 935   HValue* key = GetParameter(StoreDescriptor::kNameIndex);
 936   HValue* value = GetParameter(StoreDescriptor::kValueIndex);
 937
 938   return EmitKeyedSloppyArguments(receiver, key, value);
 939 }
 940
 941
 942 Handle<Code> KeyedStoreSloppyArgumentsStub::GenerateCode() {
 943   return DoGenerateCode(this);
 944 }
 945
 946
 947 void CodeStubGraphBuilderBase::BuildStoreNamedField(
 948     HValue* object, HValue* value, FieldIndex index,
 949     Representation representation, bool transition_to_field) {
 950   DCHECK(!index.is_double() || representation.IsDouble());
 951   int offset = index.offset();
 952   HObjectAccess access =
 953       index.is_inobject()
 954           ? HObjectAccess::ForObservableJSObjectOffset(offset, representation)
 955           : HObjectAccess::ForBackingStoreOffset(offset, representation);
 956
 957   if (representation.IsDouble()) {
 958     if (!FLAG_unbox_double_fields || !index.is_inobject()) {
 959       HObjectAccess heap_number_access =
 960           access.WithRepresentation(Representation::Tagged());
 961       if (transition_to_field) {
 962         // The store requires a mutable HeapNumber to be allocated.
 963         NoObservableSideEffectsScope no_side_effects(this);
 964         HInstruction* heap_number_size = Add<HConstant>(HeapNumber::kSize);
 965
 966         // TODO(hpayer): Allocation site pretenuring support.
 967         HInstruction* heap_number =
 968             Add<HAllocate>(heap_number_size, HType::HeapObject(), NOT_TENURED,
 969                            MUTABLE_HEAP_NUMBER_TYPE);
 970         AddStoreMapConstant(heap_number,
 971                             isolate()->factory()->mutable_heap_number_map());
 972         Add<HStoreNamedField>(heap_number, HObjectAccess::ForHeapNumberValue(),
 973                               value);
 974         // Store the new mutable heap number into the object.
 975         access = heap_number_access;
 976         value = heap_number;
 977       } else {
 978         // Load the heap number.
 979         object = Add<HLoadNamedField>(object, nullptr, heap_number_access);
 980         // Store the double value into it.
 981         access = HObjectAccess::ForHeapNumberValue();
 982       }
 983     }
 984   } else if (representation.IsHeapObject()) {
 985     BuildCheckHeapObject(value);
 986   }
 987
 988   Add<HStoreNamedField>(object, access, value, INITIALIZING_STORE);
 989 }
 990
 991
 992 template <>
 993 HValue* CodeStubGraphBuilder<StoreFieldStub>::BuildCodeStub() {
 994   BuildStoreNamedField(GetParameter(0), GetParameter(2), casted_stub()->index(),
 995                        casted_stub()->representation(), false);
 996   return GetParameter(2);
 997 }
 998
 999
1000 Handle<Code> StoreFieldStub::GenerateCode() { return DoGenerateCode(this); }
1001
1002
1003 template <>
1004 HValue* CodeStubGraphBuilder<StoreTransitionStub>::BuildCodeStub() {
1005   HValue* object = GetParameter(StoreTransitionDescriptor::kReceiverIndex);
1006
1007   switch (casted_stub()->store_mode()) {
1008     case StoreTransitionStub::ExtendStorageAndStoreMapAndValue: {
1009       HValue* properties = Add<HLoadNamedField>(
1010           object, nullptr, HObjectAccess::ForPropertiesPointer());
1011       HValue* length = AddLoadFixedArrayLength(properties);
1012       HValue* delta =
1013           Add<HConstant>(static_cast<int32_t>(JSObject::kFieldsAdded));
1014       HValue* new_capacity = AddUncasted<HAdd>(length, delta);
1015
1016       // Grow properties array.
1017       ElementsKind kind = FAST_ELEMENTS;
1018       Add<HBoundsCheck>(new_capacity,
1019                         Add<HConstant>((Page::kMaxRegularHeapObjectSize -
1020                                         FixedArray::kHeaderSize) >>
1021                                        ElementsKindToShiftSize(kind)));
1022
1023       // Reuse this code for properties backing store allocation.
1024       HValue* new_properties =
1025           BuildAllocateAndInitializeArray(kind, new_capacity);
1026
1027       BuildCopyProperties(properties, new_properties, length, new_capacity);
1028
1029       Add<HStoreNamedField>(object, HObjectAccess::ForPropertiesPointer(),
1030                             new_properties);
1031     }
1032     // Fall through.
1033     case StoreTransitionStub::StoreMapAndValue:
1034       // Store the new value into the "extended" object.
1035       BuildStoreNamedField(
1036           object, GetParameter(StoreTransitionDescriptor::kValueIndex),
1037           casted_stub()->index(), casted_stub()->representation(), true);
1038     // Fall through.
1039
1040     case StoreTransitionStub::StoreMapOnly:
1041       // And finally update the map.
1042       Add<HStoreNamedField>(object, HObjectAccess::ForMap(),
1043                             GetParameter(StoreTransitionDescriptor::kMapIndex));
1044       break;
1045   }
1046   return GetParameter(StoreTransitionDescriptor::kValueIndex);
1047 }
1048
1049
1050 Handle<Code> StoreTransitionStub::GenerateCode() {
1051   return DoGenerateCode(this);
1052 }
1053
1054
1055 template <>
1056 HValue* CodeStubGraphBuilder<StringLengthStub>::BuildCodeStub() {
1057   HValue* string = BuildLoadNamedField(GetParameter(0),
1058       FieldIndex::ForInObjectOffset(JSValue::kValueOffset));
1059   return BuildLoadNamedField(string,
1060       FieldIndex::ForInObjectOffset(String::kLengthOffset));
1061 }
1062
1063
1064 Handle<Code> StringLengthStub::GenerateCode() {
1065   return DoGenerateCode(this);
1066 }
1067
1068
1069 template <>
1070 HValue* CodeStubGraphBuilder<StoreFastElementStub>::BuildCodeStub() {
1071   BuildUncheckedMonomorphicElementAccess(
1072       GetParameter(StoreDescriptor::kReceiverIndex),
1073       GetParameter(StoreDescriptor::kNameIndex),
1074       GetParameter(StoreDescriptor::kValueIndex), casted_stub()->is_js_array(),
1075       casted_stub()->elements_kind(), STORE, NEVER_RETURN_HOLE,
1076       casted_stub()->store_mode());
1077
1078   return GetParameter(2);
1079 }
1080
1081
1082 Handle<Code> StoreFastElementStub::GenerateCode() {
1083   return DoGenerateCode(this);
1084 }
1085
1086
1087 template <>
1088 HValue* CodeStubGraphBuilder<TransitionElementsKindStub>::BuildCodeStub() {
1089   info()->MarkAsSavesCallerDoubles();
1090
1091   BuildTransitionElementsKind(GetParameter(0),
1092                               GetParameter(1),
1093                               casted_stub()->from_kind(),
1094                               casted_stub()->to_kind(),
1095                               casted_stub()->is_js_array());
1096
1097   return GetParameter(0);
1098 }
1099
1100
1101 Handle<Code> TransitionElementsKindStub::GenerateCode() {
1102   return DoGenerateCode(this);
1103 }
1104
1105
1106 template <>
1107 HValue* CodeStubGraphBuilder<AllocateHeapNumberStub>::BuildCodeStub() {
1108   HValue* result =
1109       Add<HAllocate>(Add<HConstant>(HeapNumber::kSize), HType::HeapNumber(),
1110                      NOT_TENURED, HEAP_NUMBER_TYPE);
1111   AddStoreMapConstant(result, isolate()->factory()->heap_number_map());
1112   return result;
1113 }
1114
1115
1116 Handle<Code> AllocateHeapNumberStub::GenerateCode() {
1117   return DoGenerateCode(this);
1118 }
1119
1120
1121 HValue* CodeStubGraphBuilderBase::BuildArrayConstructor(
1122     ElementsKind kind,
1123     AllocationSiteOverrideMode override_mode,
1124     ArgumentClass argument_class) {
1125   HValue* constructor = GetParameter(ArrayConstructorStubBase::kConstructor);
1126   HValue* alloc_site = GetParameter(ArrayConstructorStubBase::kAllocationSite);
1127   JSArrayBuilder array_builder(this, kind, alloc_site, constructor,
1128                                override_mode);
1129   HValue* result = NULL;
1130   switch (argument_class) {
1131     case NONE:
1132       // This stub is very performance sensitive, the generated code must be
1133       // tuned so that it doesn't build and eager frame.
1134       info()->MarkMustNotHaveEagerFrame();
1135       result = array_builder.AllocateEmptyArray();
1136       break;
1137     case SINGLE:
1138       result = BuildArraySingleArgumentConstructor(&array_builder);
1139       break;
1140     case MULTIPLE:
1141       result = BuildArrayNArgumentsConstructor(&array_builder, kind);
1142       break;
1143   }
1144
1145   return result;
1146 }
1147
1148
1149 HValue* CodeStubGraphBuilderBase::BuildInternalArrayConstructor(
1150     ElementsKind kind, ArgumentClass argument_class) {
1151   HValue* constructor = GetParameter(
1152       InternalArrayConstructorStubBase::kConstructor);
1153   JSArrayBuilder array_builder(this, kind, constructor);
1154
1155   HValue* result = NULL;
1156   switch (argument_class) {
1157     case NONE:
1158       // This stub is very performance sensitive, the generated code must be
1159       // tuned so that it doesn't build and eager frame.
1160       info()->MarkMustNotHaveEagerFrame();
1161       result = array_builder.AllocateEmptyArray();
1162       break;
1163     case SINGLE:
1164       result = BuildArraySingleArgumentConstructor(&array_builder);
1165       break;
1166     case MULTIPLE:
1167       result = BuildArrayNArgumentsConstructor(&array_builder, kind);
1168       break;
1169   }
1170   return result;
1171 }
1172
1173
1174 HValue* CodeStubGraphBuilderBase::BuildArraySingleArgumentConstructor(
1175     JSArrayBuilder* array_builder) {
1176   // Smi check and range check on the input arg.
1177   HValue* constant_one = graph()->GetConstant1();
1178   HValue* constant_zero = graph()->GetConstant0();
1179
1180   HInstruction* elements = Add<HArgumentsElements>(false);
1181   HInstruction* argument = Add<HAccessArgumentsAt>(
1182       elements, constant_one, constant_zero);
1183
1184   return BuildAllocateArrayFromLength(array_builder, argument);
1185 }
1186
1187
1188 HValue* CodeStubGraphBuilderBase::BuildArrayNArgumentsConstructor(
1189     JSArrayBuilder* array_builder, ElementsKind kind) {
1190   // Insert a bounds check because the number of arguments might exceed
1191   // the kInitialMaxFastElementArray limit. This cannot happen for code
1192   // that was parsed, but calling via Array.apply(thisArg, [...]) might
1193   // trigger it.
1194   HValue* length = GetArgumentsLength();
1195   HConstant* max_alloc_length =
1196       Add<HConstant>(JSObject::kInitialMaxFastElementArray);
1197   HValue* checked_length = Add<HBoundsCheck>(length, max_alloc_length);
1198
1199   // We need to fill with the hole if it's a smi array in the multi-argument
1200   // case because we might have to bail out while copying arguments into
1201   // the array because they aren't compatible with a smi array.
1202   // If it's a double array, no problem, and if it's fast then no
1203   // problem either because doubles are boxed.
1204   //
1205   // TODO(mvstanton): consider an instruction to memset fill the array
1206   // with zero in this case instead.
1207   JSArrayBuilder::FillMode fill_mode = IsFastSmiElementsKind(kind)
1208       ? JSArrayBuilder::FILL_WITH_HOLE
1209       : JSArrayBuilder::DONT_FILL_WITH_HOLE;
1210   HValue* new_object = array_builder->AllocateArray(checked_length,
1211                                                     max_alloc_length,
1212                                                     checked_length,
1213                                                     fill_mode);
1214   HValue* elements = array_builder->GetElementsLocation();
1215   DCHECK(elements != NULL);
1216
1217   // Now populate the elements correctly.
1218   LoopBuilder builder(this,
1219                       context(),
1220                       LoopBuilder::kPostIncrement);
1221   HValue* start = graph()->GetConstant0();
1222   HValue* key = builder.BeginBody(start, checked_length, Token::LT);
1223   HInstruction* argument_elements = Add<HArgumentsElements>(false);
1224   HInstruction* argument = Add<HAccessArgumentsAt>(
1225       argument_elements, checked_length, key);
1226
1227   Add<HStoreKeyed>(elements, key, argument, kind);
1228   builder.EndBody();
1229   return new_object;
1230 }
1231
1232
1233 template <>
1234 HValue* CodeStubGraphBuilder<ArrayNoArgumentConstructorStub>::BuildCodeStub() {
1235   ElementsKind kind = casted_stub()->elements_kind();
1236   AllocationSiteOverrideMode override_mode = casted_stub()->override_mode();
1237   return BuildArrayConstructor(kind, override_mode, NONE);
1238 }
1239
1240
1241 Handle<Code> ArrayNoArgumentConstructorStub::GenerateCode() {
1242   return DoGenerateCode(this);
1243 }
1244
1245
1246 template <>
1247 HValue* CodeStubGraphBuilder<ArraySingleArgumentConstructorStub>::
1248     BuildCodeStub() {
1249   ElementsKind kind = casted_stub()->elements_kind();
1250   AllocationSiteOverrideMode override_mode = casted_stub()->override_mode();
1251   return BuildArrayConstructor(kind, override_mode, SINGLE);
1252 }
1253
1254
1255 Handle<Code> ArraySingleArgumentConstructorStub::GenerateCode() {
1256   return DoGenerateCode(this);
1257 }
1258
1259
1260 template <>
1261 HValue* CodeStubGraphBuilder<ArrayNArgumentsConstructorStub>::BuildCodeStub() {
1262   ElementsKind kind = casted_stub()->elements_kind();
1263   AllocationSiteOverrideMode override_mode = casted_stub()->override_mode();
1264   return BuildArrayConstructor(kind, override_mode, MULTIPLE);
1265 }
1266
1267
1268 Handle<Code> ArrayNArgumentsConstructorStub::GenerateCode() {
1269   return DoGenerateCode(this);
1270 }
1271
1272
1273 template <>
1274 HValue* CodeStubGraphBuilder<InternalArrayNoArgumentConstructorStub>::
1275     BuildCodeStub() {
1276   ElementsKind kind = casted_stub()->elements_kind();
1277   return BuildInternalArrayConstructor(kind, NONE);
1278 }
1279
1280
1281 Handle<Code> InternalArrayNoArgumentConstructorStub::GenerateCode() {
1282   return DoGenerateCode(this);
1283 }
1284
1285
1286 template <>
1287 HValue* CodeStubGraphBuilder<InternalArraySingleArgumentConstructorStub>::
1288     BuildCodeStub() {
1289   ElementsKind kind = casted_stub()->elements_kind();
1290   return BuildInternalArrayConstructor(kind, SINGLE);
1291 }
1292
1293
1294 Handle<Code> InternalArraySingleArgumentConstructorStub::GenerateCode() {
1295   return DoGenerateCode(this);
1296 }
1297
1298
1299 template <>
1300 HValue* CodeStubGraphBuilder<InternalArrayNArgumentsConstructorStub>::
1301     BuildCodeStub() {
1302   ElementsKind kind = casted_stub()->elements_kind();
1303   return BuildInternalArrayConstructor(kind, MULTIPLE);
1304 }
1305
1306
1307 Handle<Code> InternalArrayNArgumentsConstructorStub::GenerateCode() {
1308   return DoGenerateCode(this);
1309 }
1310
1311
1312 template <>
1313 HValue* CodeStubGraphBuilder<CompareNilICStub>::BuildCodeInitializedStub() {
1314   Isolate* isolate = graph()->isolate();
1315   CompareNilICStub* stub = casted_stub();
1316   HIfContinuation continuation;
1317   Handle<Map> sentinel_map(isolate->heap()->meta_map());
1318   Type* type = stub->GetType(zone(), sentinel_map);
1319   BuildCompareNil(GetParameter(0), type, &continuation, kEmbedMapsViaWeakCells);
1320   IfBuilder if_nil(this, &continuation);
1321   if_nil.Then();
1322   if (continuation.IsFalseReachable()) {
1323     if_nil.Else();
1324     if_nil.Return(graph()->GetConstant0());
1325   }
1326   if_nil.End();
1327   return continuation.IsTrueReachable()
1328       ? graph()->GetConstant1()
1329       : graph()->GetConstantUndefined();
1330 }
1331
1332
1333 Handle<Code> CompareNilICStub::GenerateCode() {
1334   return DoGenerateCode(this);
1335 }
1336
1337
1338 template <>
1339 HValue* CodeStubGraphBuilder<BinaryOpICStub>::BuildCodeInitializedStub() {
1340   BinaryOpICState state = casted_stub()->state();
1341
1342   HValue* left = GetParameter(BinaryOpICStub::kLeft);
1343   HValue* right = GetParameter(BinaryOpICStub::kRight);
1344
1345   Type* left_type = state.GetLeftType(zone());
1346   Type* right_type = state.GetRightType(zone());
1347   Type* result_type = state.GetResultType(zone());
1348
1349   DCHECK(!left_type->Is(Type::None()) && !right_type->Is(Type::None()) &&
1350          (state.HasSideEffects() || !result_type->Is(Type::None())));
1351
1352   HValue* result = NULL;
1353   HAllocationMode allocation_mode(NOT_TENURED);
1354   if (state.op() == Token::ADD &&
1355       (left_type->Maybe(Type::String()) || right_type->Maybe(Type::String())) &&
1356       !left_type->Is(Type::String()) && !right_type->Is(Type::String())) {
1357     // For the generic add stub a fast case for string addition is performance
1358     // critical.
1359     if (left_type->Maybe(Type::String())) {
1360       IfBuilder if_leftisstring(this);
1361       if_leftisstring.If<HIsStringAndBranch>(left);
1362       if_leftisstring.Then();
1363       {
1364         Push(BuildBinaryOperation(state.op(), left, right, Type::String(zone()),
1365                                   right_type, result_type,
1366                                   state.fixed_right_arg(), allocation_mode,
1367                                   state.strength()));
1368       }
1369       if_leftisstring.Else();
1370       {
1371         Push(BuildBinaryOperation(
1372             state.op(), left, right, left_type, right_type, result_type,
1373             state.fixed_right_arg(), allocation_mode, state.strength()));
1374       }
1375       if_leftisstring.End();
1376       result = Pop();
1377     } else {
1378       IfBuilder if_rightisstring(this);
1379       if_rightisstring.If<HIsStringAndBranch>(right);
1380       if_rightisstring.Then();
1381       {
1382         Push(BuildBinaryOperation(state.op(), left, right, left_type,
1383                                   Type::String(zone()), result_type,
1384                                   state.fixed_right_arg(), allocation_mode,
1385                                   state.strength()));
1386       }
1387       if_rightisstring.Else();
1388       {
1389         Push(BuildBinaryOperation(
1390             state.op(), left, right, left_type, right_type, result_type,
1391             state.fixed_right_arg(), allocation_mode, state.strength()));
1392       }
1393       if_rightisstring.End();
1394       result = Pop();
1395     }
1396   } else {
1397     result = BuildBinaryOperation(
1398         state.op(), left, right, left_type, right_type, result_type,
1399         state.fixed_right_arg(), allocation_mode, state.strength());
1400   }
1401
1402   // If we encounter a generic argument, the number conversion is
1403   // observable, thus we cannot afford to bail out after the fact.
1404   if (!state.HasSideEffects()) {
1405     result = EnforceNumberType(result, result_type);
1406   }
1407
1408   return result;
1409 }
1410
1411
1412 Handle<Code> BinaryOpICStub::GenerateCode() {
1413   return DoGenerateCode(this);
1414 }
1415
1416
1417 template <>
1418 HValue* CodeStubGraphBuilder<BinaryOpWithAllocationSiteStub>::BuildCodeStub() {
1419   BinaryOpICState state = casted_stub()->state();
1420
1421   HValue* allocation_site = GetParameter(
1422       BinaryOpWithAllocationSiteStub::kAllocationSite);
1423   HValue* left = GetParameter(BinaryOpWithAllocationSiteStub::kLeft);
1424   HValue* right = GetParameter(BinaryOpWithAllocationSiteStub::kRight);
1425
1426   Type* left_type = state.GetLeftType(zone());
1427   Type* right_type = state.GetRightType(zone());
1428   Type* result_type = state.GetResultType(zone());
1429   HAllocationMode allocation_mode(allocation_site);
1430
1431   return BuildBinaryOperation(state.op(), left, right, left_type, right_type,
1432                               result_type, state.fixed_right_arg(),
1433                               allocation_mode, state.strength());
1434 }
1435
1436
1437 Handle<Code> BinaryOpWithAllocationSiteStub::GenerateCode() {
1438   return DoGenerateCode(this);
1439 }
1440
1441
1442 template <>
1443 HValue* CodeStubGraphBuilder<StringAddStub>::BuildCodeInitializedStub() {
1444   StringAddStub* stub = casted_stub();
1445   StringAddFlags flags = stub->flags();
1446   PretenureFlag pretenure_flag = stub->pretenure_flag();
1447
1448   HValue* left = GetParameter(StringAddStub::kLeft);
1449   HValue* right = GetParameter(StringAddStub::kRight);
1450
1451   // Make sure that both arguments are strings if not known in advance.
1452   if ((flags & STRING_ADD_CHECK_LEFT) == STRING_ADD_CHECK_LEFT) {
1453     left = BuildCheckString(left);
1454   }
1455   if ((flags & STRING_ADD_CHECK_RIGHT) == STRING_ADD_CHECK_RIGHT) {
1456     right = BuildCheckString(right);
1457   }
1458
1459   return BuildStringAdd(left, right, HAllocationMode(pretenure_flag));
1460 }
1461
1462
1463 Handle<Code> StringAddStub::GenerateCode() {
1464   return DoGenerateCode(this);
1465 }
1466
1467
1468 template <>
1469 HValue* CodeStubGraphBuilder<ToBooleanStub>::BuildCodeInitializedStub() {
1470   ToBooleanStub* stub = casted_stub();
1471   HValue* true_value = NULL;
1472   HValue* false_value = NULL;
1473
1474   switch (stub->mode()) {
1475     case ToBooleanStub::RESULT_AS_SMI:
1476       true_value = graph()->GetConstant1();
1477       false_value = graph()->GetConstant0();
1478       break;
1479     case ToBooleanStub::RESULT_AS_ODDBALL:
1480       true_value = graph()->GetConstantTrue();
1481       false_value = graph()->GetConstantFalse();
1482       break;
1483     case ToBooleanStub::RESULT_AS_INVERSE_ODDBALL:
1484       true_value = graph()->GetConstantFalse();
1485       false_value = graph()->GetConstantTrue();
1486       break;
1487   }
1488
1489   IfBuilder if_true(this);
1490   if_true.If<HBranch>(GetParameter(0), stub->types());
1491   if_true.Then();
1492   if_true.Return(true_value);
1493   if_true.Else();
1494   if_true.End();
1495   return false_value;
1496 }
1497
1498
1499 Handle<Code> ToBooleanStub::GenerateCode() {
1500   return DoGenerateCode(this);
1501 }
1502
1503
1504 template <>
1505 HValue* CodeStubGraphBuilder<StoreGlobalStub>::BuildCodeInitializedStub() {
1506   StoreGlobalStub* stub = casted_stub();
1507   HParameter* value = GetParameter(StoreDescriptor::kValueIndex);
1508   if (stub->check_global()) {
1509     // Check that the map of the global has not changed: use a placeholder map
1510     // that will be replaced later with the global object's map.
1511     HParameter* proxy = GetParameter(StoreDescriptor::kReceiverIndex);
1512     HValue* proxy_map =
1513         Add<HLoadNamedField>(proxy, nullptr, HObjectAccess::ForMap());
1514     HValue* global =
1515         Add<HLoadNamedField>(proxy_map, nullptr, HObjectAccess::ForPrototype());
1516     HValue* map_cell = Add<HConstant>(isolate()->factory()->NewWeakCell(
1517         StoreGlobalStub::global_map_placeholder(isolate())));
1518     HValue* expected_map = Add<HLoadNamedField>(
1519         map_cell, nullptr, HObjectAccess::ForWeakCellValue());
1520     HValue* map =
1521         Add<HLoadNamedField>(global, nullptr, HObjectAccess::ForMap());
1522     IfBuilder map_check(this);
1523     map_check.IfNot<HCompareObjectEqAndBranch>(expected_map, map);
1524     map_check.ThenDeopt(Deoptimizer::kUnknownMap);
1525     map_check.End();
1526   }
1527
1528   HValue* weak_cell = Add<HConstant>(isolate()->factory()->NewWeakCell(
1529       StoreGlobalStub::property_cell_placeholder(isolate())));
1530   HValue* cell = Add<HLoadNamedField>(weak_cell, nullptr,
1531                                       HObjectAccess::ForWeakCellValue());
1532   Add<HCheckHeapObject>(cell);
1533   HObjectAccess access = HObjectAccess::ForPropertyCellValue();
1534   // Load the payload of the global parameter cell. A hole indicates that the
1535   // cell has been invalidated and that the store must be handled by the
1536   // runtime.
1537   HValue* cell_contents = Add<HLoadNamedField>(cell, nullptr, access);
1538
1539   auto cell_type = stub->cell_type();
1540   if (cell_type == PropertyCellType::kConstant ||
1541       cell_type == PropertyCellType::kUndefined) {
1542     // This is always valid for all states a cell can be in.
1543     IfBuilder builder(this);
1544     builder.If<HCompareObjectEqAndBranch>(cell_contents, value);
1545     builder.Then();
1546     builder.ElseDeopt(
1547         Deoptimizer::kUnexpectedCellContentsInConstantGlobalStore);
1548     builder.End();
1549   } else {
1550     IfBuilder builder(this);
1551     HValue* hole_value = graph()->GetConstantHole();
1552     builder.If<HCompareObjectEqAndBranch>(cell_contents, hole_value);
1553     builder.Then();
1554     builder.Deopt(Deoptimizer::kUnexpectedCellContentsInGlobalStore);
1555     builder.Else();
1556     // When dealing with constant types, the type may be allowed to change, as
1557     // long as optimized code remains valid.
1558     if (cell_type == PropertyCellType::kConstantType) {
1559       switch (stub->constant_type()) {
1560         case PropertyCellConstantType::kSmi:
1561           access = access.WithRepresentation(Representation::Smi());
1562           break;
1563         case PropertyCellConstantType::kStableMap: {
1564           // It is sufficient here to check that the value and cell contents
1565           // have identical maps, no matter if they are stable or not or if they
1566           // are the maps that were originally in the cell or not. If optimized
1567           // code will deopt when a cell has a unstable map and if it has a
1568           // dependency on a stable map, it will deopt if the map destabilizes.
1569           Add<HCheckHeapObject>(value);
1570           Add<HCheckHeapObject>(cell_contents);
1571           HValue* expected_map = Add<HLoadNamedField>(cell_contents, nullptr,
1572                                                       HObjectAccess::ForMap());
1573           HValue* map =
1574               Add<HLoadNamedField>(value, nullptr, HObjectAccess::ForMap());
1575           IfBuilder map_check(this);
1576           map_check.IfNot<HCompareObjectEqAndBranch>(expected_map, map);
1577           map_check.ThenDeopt(Deoptimizer::kUnknownMap);
1578           map_check.End();
1579           access = access.WithRepresentation(Representation::HeapObject());
1580           break;
1581         }
1582       }
1583     }
1584     Add<HStoreNamedField>(cell, access, value);
1585     builder.End();
1586   }
1587
1588   return value;
1589 }
1590
1591
1592 Handle<Code> StoreGlobalStub::GenerateCode() {
1593   return DoGenerateCode(this);
1594 }
1595
1596
1597 template<>
1598 HValue* CodeStubGraphBuilder<ElementsTransitionAndStoreStub>::BuildCodeStub() {
1599   HValue* value = GetParameter(ElementsTransitionAndStoreStub::kValueIndex);
1600   HValue* map = GetParameter(ElementsTransitionAndStoreStub::kMapIndex);
1601   HValue* key = GetParameter(ElementsTransitionAndStoreStub::kKeyIndex);
1602   HValue* object = GetParameter(ElementsTransitionAndStoreStub::kObjectIndex);
1603
1604   if (FLAG_trace_elements_transitions) {
1605     // Tracing elements transitions is the job of the runtime.
1606     Add<HDeoptimize>(Deoptimizer::kTracingElementsTransitions,
1607                      Deoptimizer::EAGER);
1608   } else {
1609     info()->MarkAsSavesCallerDoubles();
1610
1611     BuildTransitionElementsKind(object, map,
1612                                 casted_stub()->from_kind(),
1613                                 casted_stub()->to_kind(),
1614                                 casted_stub()->is_jsarray());
1615
1616     BuildUncheckedMonomorphicElementAccess(object, key, value,
1617                                            casted_stub()->is_jsarray(),
1618                                            casted_stub()->to_kind(),
1619                                            STORE, ALLOW_RETURN_HOLE,
1620                                            casted_stub()->store_mode());
1621   }
1622
1623   return value;
1624 }
1625
1626
1627 Handle<Code> ElementsTransitionAndStoreStub::GenerateCode() {
1628   return DoGenerateCode(this);
1629 }
1630
1631
1632 void CodeStubGraphBuilderBase::BuildCheckAndInstallOptimizedCode(
1633     HValue* js_function,
1634     HValue* native_context,
1635     IfBuilder* builder,
1636     HValue* optimized_map,
1637     HValue* map_index) {
1638   HValue* osr_ast_id_none = Add<HConstant>(BailoutId::None().ToInt());
1639   HValue* context_slot = LoadFromOptimizedCodeMap(
1640       optimized_map, map_index, SharedFunctionInfo::kContextOffset);
1641   HValue* osr_ast_slot = LoadFromOptimizedCodeMap(
1642       optimized_map, map_index, SharedFunctionInfo::kOsrAstIdOffset);
1643   builder->If<HCompareObjectEqAndBranch>(native_context,
1644                                          context_slot);
1645   builder->AndIf<HCompareObjectEqAndBranch>(osr_ast_slot, osr_ast_id_none);
1646   builder->Then();
1647   HValue* code_object = LoadFromOptimizedCodeMap(optimized_map,
1648       map_index, SharedFunctionInfo::kCachedCodeOffset);
1649   // and the literals
1650   HValue* literals = LoadFromOptimizedCodeMap(optimized_map,
1651       map_index, SharedFunctionInfo::kLiteralsOffset);
1652
1653   Counters* counters = isolate()->counters();
1654   AddIncrementCounter(counters->fast_new_closure_install_optimized());
1655
1656   // TODO(fschneider): Idea: store proper code pointers in the optimized code
1657   // map and either unmangle them on marking or do nothing as the whole map is
1658   // discarded on major GC anyway.
1659   Add<HStoreCodeEntry>(js_function, code_object);
1660   Add<HStoreNamedField>(js_function, HObjectAccess::ForLiteralsPointer(),
1661                         literals);
1662
1663   // Now link a function into a list of optimized functions.
1664   HValue* optimized_functions_list = Add<HLoadNamedField>(
1665       native_context, nullptr,
1666       HObjectAccess::ForContextSlot(Context::OPTIMIZED_FUNCTIONS_LIST));
1667   Add<HStoreNamedField>(js_function,
1668                         HObjectAccess::ForNextFunctionLinkPointer(),
1669                         optimized_functions_list);
1670
1671   // This store is the only one that should have a write barrier.
1672   Add<HStoreNamedField>(native_context,
1673            HObjectAccess::ForContextSlot(Context::OPTIMIZED_FUNCTIONS_LIST),
1674            js_function);
1675
1676   // The builder continues in the "then" after this function.
1677 }
1678
1679
1680 void CodeStubGraphBuilderBase::BuildInstallCode(HValue* js_function,
1681                                                 HValue* shared_info) {
1682   Add<HStoreNamedField>(js_function,
1683                         HObjectAccess::ForNextFunctionLinkPointer(),
1684                         graph()->GetConstantUndefined());
1685   HValue* code_object = Add<HLoadNamedField>(shared_info, nullptr,
1686                                              HObjectAccess::ForCodeOffset());
1687   Add<HStoreCodeEntry>(js_function, code_object);
1688 }
1689
1690
1691 HInstruction* CodeStubGraphBuilderBase::LoadFromOptimizedCodeMap(
1692     HValue* optimized_map,
1693     HValue* iterator,
1694     int field_offset) {
1695   // By making sure to express these loads in the form [<hvalue> + constant]
1696   // the keyed load can be hoisted.
1697   DCHECK(field_offset >= 0 && field_offset < SharedFunctionInfo::kEntryLength);
1698   HValue* field_slot = iterator;
1699   if (field_offset > 0) {
1700     HValue* field_offset_value = Add<HConstant>(field_offset);
1701     field_slot = AddUncasted<HAdd>(iterator, field_offset_value);
1702   }
1703   HInstruction* field_entry =
1704       Add<HLoadKeyed>(optimized_map, field_slot, nullptr, FAST_ELEMENTS);
1705   return field_entry;
1706 }
1707
1708
1709 void CodeStubGraphBuilderBase::BuildInstallFromOptimizedCodeMap(
1710     HValue* js_function,
1711     HValue* shared_info,
1712     HValue* native_context) {
1713   Counters* counters = isolate()->counters();
1714   IfBuilder is_optimized(this);
1715   HInstruction* optimized_map = Add<HLoadNamedField>(
1716       shared_info, nullptr, HObjectAccess::ForOptimizedCodeMap());
1717   HValue* null_constant = Add<HConstant>(0);
1718   is_optimized.If<HCompareObjectEqAndBranch>(optimized_map, null_constant);
1719   is_optimized.Then();
1720   {
1721     BuildInstallCode(js_function, shared_info);
1722   }
1723   is_optimized.Else();
1724   {
1725     AddIncrementCounter(counters->fast_new_closure_try_optimized());
1726     // optimized_map points to fixed array of 3-element entries
1727     // (native context, optimized code, literals).
1728     // Map must never be empty, so check the first elements.
1729     HValue* first_entry_index =
1730         Add<HConstant>(SharedFunctionInfo::kEntriesStart);
1731     IfBuilder already_in(this);
1732     BuildCheckAndInstallOptimizedCode(js_function, native_context, &already_in,
1733                                       optimized_map, first_entry_index);
1734     already_in.Else();
1735     {
1736       // Iterate through the rest of map backwards. Do not double check first
1737       // entry. After the loop, if no matching optimized code was found,
1738       // install unoptimized code.
1739       // for(i = map.length() - SharedFunctionInfo::kEntryLength;
1740       //     i > SharedFunctionInfo::kEntriesStart;
1741       //     i -= SharedFunctionInfo::kEntryLength) { .. }
1742       HValue* shared_function_entry_length =
1743           Add<HConstant>(SharedFunctionInfo::kEntryLength);
1744       LoopBuilder loop_builder(this,
1745                                context(),
1746                                LoopBuilder::kPostDecrement,
1747                                shared_function_entry_length);
1748       HValue* array_length = Add<HLoadNamedField>(
1749           optimized_map, nullptr, HObjectAccess::ForFixedArrayLength());
1750       HValue* start_pos = AddUncasted<HSub>(array_length,
1751                                             shared_function_entry_length);
1752       HValue* slot_iterator = loop_builder.BeginBody(start_pos,
1753                                                      first_entry_index,
1754                                                      Token::GT);
1755       {
1756         IfBuilder done_check(this);
1757         BuildCheckAndInstallOptimizedCode(js_function, native_context,
1758                                           &done_check,
1759                                           optimized_map,
1760                                           slot_iterator);
1761         // Fall out of the loop
1762         loop_builder.Break();
1763       }
1764       loop_builder.EndBody();
1765
1766       // If slot_iterator equals first entry index, then we failed to find and
1767       // install optimized code
1768       IfBuilder no_optimized_code_check(this);
1769       no_optimized_code_check.If<HCompareNumericAndBranch>(
1770           slot_iterator, first_entry_index, Token::EQ);
1771       no_optimized_code_check.Then();
1772       {
1773         // Store the unoptimized code
1774         BuildInstallCode(js_function, shared_info);
1775       }
1776     }
1777   }
1778 }
1779
1780
1781 template<>
1782 HValue* CodeStubGraphBuilder<FastNewClosureStub>::BuildCodeStub() {
1783   Counters* counters = isolate()->counters();
1784   Factory* factory = isolate()->factory();
1785   HInstruction* empty_fixed_array =
1786       Add<HConstant>(factory->empty_fixed_array());
1787   HValue* shared_info = GetParameter(0);
1788
1789   AddIncrementCounter(counters->fast_new_closure_total());
1790
1791   // Create a new closure from the given function info in new space
1792   HValue* size = Add<HConstant>(JSFunction::kSize);
1793   HInstruction* js_function =
1794       Add<HAllocate>(size, HType::JSObject(), NOT_TENURED, JS_FUNCTION_TYPE);
1795
1796   int map_index = Context::FunctionMapIndex(casted_stub()->language_mode(),
1797                                             casted_stub()->kind());
1798
1799   // Compute the function map in the current native context and set that
1800   // as the map of the allocated object.
1801   HInstruction* native_context = BuildGetNativeContext();
1802   HInstruction* map_slot_value = Add<HLoadNamedField>(
1803       native_context, nullptr, HObjectAccess::ForContextSlot(map_index));
1804   Add<HStoreNamedField>(js_function, HObjectAccess::ForMap(), map_slot_value);
1805
1806   // Initialize the rest of the function.
1807   Add<HStoreNamedField>(js_function, HObjectAccess::ForPropertiesPointer(),
1808                         empty_fixed_array);
1809   Add<HStoreNamedField>(js_function, HObjectAccess::ForElementsPointer(),
1810                         empty_fixed_array);
1811   Add<HStoreNamedField>(js_function, HObjectAccess::ForLiteralsPointer(),
1812                         empty_fixed_array);
1813   Add<HStoreNamedField>(js_function, HObjectAccess::ForPrototypeOrInitialMap(),
1814                         graph()->GetConstantHole());
1815   Add<HStoreNamedField>(
1816       js_function, HObjectAccess::ForSharedFunctionInfoPointer(), shared_info);
1817   Add<HStoreNamedField>(js_function, HObjectAccess::ForFunctionContextPointer(),
1818                         context());
1819
1820   // Initialize the code pointer in the function to be the one
1821   // found in the shared function info object.
1822   // But first check if there is an optimized version for our context.
1823   if (FLAG_cache_optimized_code) {
1824     BuildInstallFromOptimizedCodeMap(js_function, shared_info, native_context);
1825   } else {
1826     BuildInstallCode(js_function, shared_info);
1827   }
1828
1829   return js_function;
1830 }
1831
1832
1833 Handle<Code> FastNewClosureStub::GenerateCode() {
1834   return DoGenerateCode(this);
1835 }
1836
1837
1838 template<>
1839 HValue* CodeStubGraphBuilder<FastNewContextStub>::BuildCodeStub() {
1840   int length = casted_stub()->slots() + Context::MIN_CONTEXT_SLOTS;
1841
1842   // Get the function.
1843   HParameter* function = GetParameter(FastNewContextStub::kFunction);
1844
1845   // Allocate the context in new space.
1846   HAllocate* function_context = Add<HAllocate>(
1847       Add<HConstant>(length * kPointerSize + FixedArray::kHeaderSize),
1848       HType::HeapObject(), NOT_TENURED, FIXED_ARRAY_TYPE);
1849
1850   // Set up the object header.
1851   AddStoreMapConstant(function_context,
1852                       isolate()->factory()->function_context_map());
1853   Add<HStoreNamedField>(function_context,
1854                         HObjectAccess::ForFixedArrayLength(),
1855                         Add<HConstant>(length));
1856
1857   // Set up the fixed slots.
1858   Add<HStoreNamedField>(function_context,
1859                         HObjectAccess::ForContextSlot(Context::CLOSURE_INDEX),
1860                         function);
1861   Add<HStoreNamedField>(function_context,
1862                         HObjectAccess::ForContextSlot(Context::PREVIOUS_INDEX),
1863                         context());
1864   Add<HStoreNamedField>(function_context,
1865                         HObjectAccess::ForContextSlot(Context::EXTENSION_INDEX),
1866                         graph()->GetConstant0());
1867
1868   // Copy the global object from the previous context.
1869   HValue* global_object = Add<HLoadNamedField>(
1870       context(), nullptr,
1871       HObjectAccess::ForContextSlot(Context::GLOBAL_OBJECT_INDEX));
1872   Add<HStoreNamedField>(function_context,
1873                         HObjectAccess::ForContextSlot(
1874                             Context::GLOBAL_OBJECT_INDEX),
1875                         global_object);
1876
1877   // Initialize the rest of the slots to undefined.
1878   for (int i = Context::MIN_CONTEXT_SLOTS; i < length; ++i) {
1879     Add<HStoreNamedField>(function_context,
1880                           HObjectAccess::ForContextSlot(i),
1881                           graph()->GetConstantUndefined());
1882   }
1883
1884   return function_context;
1885 }
1886
1887
1888 Handle<Code> FastNewContextStub::GenerateCode() {
1889   return DoGenerateCode(this);
1890 }
1891
1892
1893 template <>
1894 HValue* CodeStubGraphBuilder<LoadDictionaryElementStub>::BuildCodeStub() {
1895   HValue* receiver = GetParameter(LoadDescriptor::kReceiverIndex);
1896   HValue* key = GetParameter(LoadDescriptor::kNameIndex);
1897
1898   Add<HCheckSmi>(key);
1899
1900   HValue* elements = AddLoadElements(receiver);
1901
1902   HValue* hash = BuildElementIndexHash(key);
1903
1904   return BuildUncheckedDictionaryElementLoad(receiver, elements, key, hash);
1905 }
1906
1907
1908 Handle<Code> LoadDictionaryElementStub::GenerateCode() {
1909   return DoGenerateCode(this);
1910 }
1911
1912
1913 template<>
1914 HValue* CodeStubGraphBuilder<RegExpConstructResultStub>::BuildCodeStub() {
1915   // Determine the parameters.
1916   HValue* length = GetParameter(RegExpConstructResultStub::kLength);
1917   HValue* index = GetParameter(RegExpConstructResultStub::kIndex);
1918   HValue* input = GetParameter(RegExpConstructResultStub::kInput);
1919
1920   info()->MarkMustNotHaveEagerFrame();
1921
1922   return BuildRegExpConstructResult(length, index, input);
1923 }
1924
1925
1926 Handle<Code> RegExpConstructResultStub::GenerateCode() {
1927   return DoGenerateCode(this);
1928 }
1929
1930
1931 template <>
1932 class CodeStubGraphBuilder<KeyedLoadGenericStub>
1933     : public CodeStubGraphBuilderBase {
1934  public:
1935   explicit CodeStubGraphBuilder(CompilationInfo* info)
1936       : CodeStubGraphBuilderBase(info) {}
1937
1938  protected:
1939   virtual HValue* BuildCodeStub();
1940
1941   void BuildElementsKindLimitCheck(HGraphBuilder::IfBuilder* if_builder,
1942                                    HValue* bit_field2,
1943                                    ElementsKind kind);
1944
1945   void BuildFastElementLoad(HGraphBuilder::IfBuilder* if_builder,
1946                             HValue* receiver,
1947                             HValue* key,
1948                             HValue* instance_type,
1949                             HValue* bit_field2,
1950                             ElementsKind kind);
1951
1952   void BuildExternalElementLoad(HGraphBuilder::IfBuilder* if_builder,
1953                                 HValue* receiver,
1954                                 HValue* key,
1955                                 HValue* instance_type,
1956                                 HValue* bit_field2,
1957                                 ElementsKind kind);
1958
1959   KeyedLoadGenericStub* casted_stub() {
1960     return static_cast<KeyedLoadGenericStub*>(stub());
1961   }
1962 };
1963
1964
1965 void CodeStubGraphBuilder<KeyedLoadGenericStub>::BuildElementsKindLimitCheck(
1966     HGraphBuilder::IfBuilder* if_builder, HValue* bit_field2,
1967     ElementsKind kind) {
1968   ElementsKind next_kind = static_cast<ElementsKind>(kind + 1);
1969   HValue* kind_limit = Add<HConstant>(
1970       static_cast<int>(Map::ElementsKindBits::encode(next_kind)));
1971
1972   if_builder->If<HCompareNumericAndBranch>(bit_field2, kind_limit, Token::LT);
1973   if_builder->Then();
1974 }
1975
1976
1977 void CodeStubGraphBuilder<KeyedLoadGenericStub>::BuildFastElementLoad(
1978     HGraphBuilder::IfBuilder* if_builder, HValue* receiver, HValue* key,
1979     HValue* instance_type, HValue* bit_field2, ElementsKind kind) {
1980   DCHECK(!IsExternalArrayElementsKind(kind));
1981
1982   BuildElementsKindLimitCheck(if_builder, bit_field2, kind);
1983
1984   IfBuilder js_array_check(this);
1985   js_array_check.If<HCompareNumericAndBranch>(
1986       instance_type, Add<HConstant>(JS_ARRAY_TYPE), Token::EQ);
1987   js_array_check.Then();
1988   Push(BuildUncheckedMonomorphicElementAccess(receiver, key, NULL,
1989                                               true, kind,
1990                                               LOAD, NEVER_RETURN_HOLE,
1991                                               STANDARD_STORE));
1992   js_array_check.Else();
1993   Push(BuildUncheckedMonomorphicElementAccess(receiver, key, NULL,
1994                                               false, kind,
1995                                               LOAD, NEVER_RETURN_HOLE,
1996                                               STANDARD_STORE));
1997   js_array_check.End();
1998 }
1999
2000
2001 void CodeStubGraphBuilder<KeyedLoadGenericStub>::BuildExternalElementLoad(
2002     HGraphBuilder::IfBuilder* if_builder, HValue* receiver, HValue* key,
2003     HValue* instance_type, HValue* bit_field2, ElementsKind kind) {
2004   DCHECK(IsExternalArrayElementsKind(kind));
2005
2006   BuildElementsKindLimitCheck(if_builder, bit_field2, kind);
2007
2008   Push(BuildUncheckedMonomorphicElementAccess(receiver, key, NULL,
2009                                               false, kind,
2010                                               LOAD, NEVER_RETURN_HOLE,
2011                                               STANDARD_STORE));
2012 }
2013
2014
2015 HValue* CodeStubGraphBuilder<KeyedLoadGenericStub>::BuildCodeStub() {
2016   HValue* receiver = GetParameter(LoadDescriptor::kReceiverIndex);
2017   HValue* key = GetParameter(LoadDescriptor::kNameIndex);
2018
2019   // Split into a smi/integer case and unique string case.
2020   HIfContinuation index_name_split_continuation(graph()->CreateBasicBlock(),
2021                                                 graph()->CreateBasicBlock());
2022
2023   BuildKeyedIndexCheck(key, &index_name_split_continuation);
2024
2025   IfBuilder index_name_split(this, &index_name_split_continuation);
2026   index_name_split.Then();
2027   {
2028     // Key is an index (number)
2029     key = Pop();
2030
2031     int bit_field_mask = (1 << Map::kIsAccessCheckNeeded) |
2032       (1 << Map::kHasIndexedInterceptor);
2033     BuildJSObjectCheck(receiver, bit_field_mask);
2034
2035     HValue* map =
2036         Add<HLoadNamedField>(receiver, nullptr, HObjectAccess::ForMap());
2037
2038     HValue* instance_type =
2039         Add<HLoadNamedField>(map, nullptr, HObjectAccess::ForMapInstanceType());
2040
2041     HValue* bit_field2 =
2042         Add<HLoadNamedField>(map, nullptr, HObjectAccess::ForMapBitField2());
2043
2044     IfBuilder kind_if(this);
2045     BuildFastElementLoad(&kind_if, receiver, key, instance_type, bit_field2,
2046                          FAST_HOLEY_ELEMENTS);
2047
2048     kind_if.Else();
2049     {
2050       BuildFastElementLoad(&kind_if, receiver, key, instance_type, bit_field2,
2051                            FAST_HOLEY_DOUBLE_ELEMENTS);
2052     }
2053     kind_if.Else();
2054
2055     // The DICTIONARY_ELEMENTS check generates a "kind_if.Then"
2056     BuildElementsKindLimitCheck(&kind_if, bit_field2, DICTIONARY_ELEMENTS);
2057     {
2058       HValue* elements = AddLoadElements(receiver);
2059
2060       HValue* hash = BuildElementIndexHash(key);
2061
2062       Push(BuildUncheckedDictionaryElementLoad(receiver, elements, key, hash));
2063     }
2064     kind_if.Else();
2065
2066     // The SLOPPY_ARGUMENTS_ELEMENTS check generates a "kind_if.Then"
2067     BuildElementsKindLimitCheck(&kind_if, bit_field2,
2068                                 SLOPPY_ARGUMENTS_ELEMENTS);
2069     // Non-strict elements are not handled.
2070     Add<HDeoptimize>(Deoptimizer::kNonStrictElementsInKeyedLoadGenericStub,
2071                      Deoptimizer::EAGER);
2072     Push(graph()->GetConstant0());
2073
2074     kind_if.Else();
2075     BuildExternalElementLoad(&kind_if, receiver, key, instance_type, bit_field2,
2076                              EXTERNAL_INT8_ELEMENTS);
2077
2078     kind_if.Else();
2079     BuildExternalElementLoad(&kind_if, receiver, key, instance_type, bit_field2,
2080                              EXTERNAL_UINT8_ELEMENTS);
2081
2082     kind_if.Else();
2083     BuildExternalElementLoad(&kind_if, receiver, key, instance_type, bit_field2,
2084                              EXTERNAL_INT16_ELEMENTS);
2085
2086     kind_if.Else();
2087     BuildExternalElementLoad(&kind_if, receiver, key, instance_type, bit_field2,
2088                              EXTERNAL_UINT16_ELEMENTS);
2089
2090     kind_if.Else();
2091     BuildExternalElementLoad(&kind_if, receiver, key, instance_type, bit_field2,
2092                              EXTERNAL_INT32_ELEMENTS);
2093
2094     kind_if.Else();
2095     BuildExternalElementLoad(&kind_if, receiver, key, instance_type, bit_field2,
2096                              EXTERNAL_UINT32_ELEMENTS);
2097
2098     kind_if.Else();
2099     BuildExternalElementLoad(&kind_if, receiver, key, instance_type, bit_field2,
2100                              EXTERNAL_FLOAT32_ELEMENTS);
2101
2102     kind_if.Else();
2103     BuildExternalElementLoad(&kind_if, receiver, key, instance_type, bit_field2,
2104                              EXTERNAL_FLOAT64_ELEMENTS);
2105
2106     kind_if.Else();
2107     BuildExternalElementLoad(&kind_if, receiver, key, instance_type, bit_field2,
2108                              EXTERNAL_UINT8_CLAMPED_ELEMENTS);
2109
2110     kind_if.ElseDeopt(
2111         Deoptimizer::kElementsKindUnhandledInKeyedLoadGenericStub);
2112
2113     kind_if.End();
2114   }
2115   index_name_split.Else();
2116   {
2117     // Key is a unique string.
2118     key = Pop();
2119
2120     int bit_field_mask = (1 << Map::kIsAccessCheckNeeded) |
2121         (1 << Map::kHasNamedInterceptor);
2122     BuildJSObjectCheck(receiver, bit_field_mask);
2123
2124     HIfContinuation continuation;
2125     BuildTestForDictionaryProperties(receiver, &continuation);
2126     IfBuilder if_dict_properties(this, &continuation);
2127     if_dict_properties.Then();
2128     {
2129       //  Key is string, properties are dictionary mode
2130       BuildNonGlobalObjectCheck(receiver);
2131
2132       HValue* properties = Add<HLoadNamedField>(
2133           receiver, nullptr, HObjectAccess::ForPropertiesPointer());
2134
2135       HValue* hash =
2136           Add<HLoadNamedField>(key, nullptr, HObjectAccess::ForNameHashField());
2137
2138       hash = AddUncasted<HShr>(hash, Add<HConstant>(Name::kHashShift));
2139
2140       HValue* value = BuildUncheckedDictionaryElementLoad(receiver,
2141                                                           properties,
2142                                                           key,
2143                                                           hash);
2144       Push(value);
2145     }
2146     if_dict_properties.Else();
2147     {
2148       // TODO(dcarney): don't use keyed lookup cache, but convert to use
2149       // megamorphic stub cache.
2150       UNREACHABLE();
2151       //  Key is string, properties are fast mode
2152       HValue* hash = BuildKeyedLookupCacheHash(receiver, key);
2153
2154       ExternalReference cache_keys_ref =
2155           ExternalReference::keyed_lookup_cache_keys(isolate());
2156       HValue* cache_keys = Add<HConstant>(cache_keys_ref);
2157
2158       HValue* map =
2159           Add<HLoadNamedField>(receiver, nullptr, HObjectAccess::ForMap());
2160       HValue* base_index = AddUncasted<HMul>(hash, Add<HConstant>(2));
2161       base_index->ClearFlag(HValue::kCanOverflow);
2162
2163       HIfContinuation inline_or_runtime_continuation(
2164           graph()->CreateBasicBlock(), graph()->CreateBasicBlock());
2165       {
2166         IfBuilder lookup_ifs[KeyedLookupCache::kEntriesPerBucket];
2167         for (int probe = 0; probe < KeyedLookupCache::kEntriesPerBucket;
2168              ++probe) {
2169           IfBuilder* lookup_if = &lookup_ifs[probe];
2170           lookup_if->Initialize(this);
2171           int probe_base = probe * KeyedLookupCache::kEntryLength;
2172           HValue* map_index = AddUncasted<HAdd>(
2173               base_index,
2174               Add<HConstant>(probe_base + KeyedLookupCache::kMapIndex));
2175           map_index->ClearFlag(HValue::kCanOverflow);
2176           HValue* key_index = AddUncasted<HAdd>(
2177               base_index,
2178               Add<HConstant>(probe_base + KeyedLookupCache::kKeyIndex));
2179           key_index->ClearFlag(HValue::kCanOverflow);
2180           HValue* map_to_check =
2181               Add<HLoadKeyed>(cache_keys, map_index, nullptr, FAST_ELEMENTS,
2182                               NEVER_RETURN_HOLE, 0);
2183           lookup_if->If<HCompareObjectEqAndBranch>(map_to_check, map);
2184           lookup_if->And();
2185           HValue* key_to_check =
2186               Add<HLoadKeyed>(cache_keys, key_index, nullptr, FAST_ELEMENTS,
2187                               NEVER_RETURN_HOLE, 0);
2188           lookup_if->If<HCompareObjectEqAndBranch>(key_to_check, key);
2189           lookup_if->Then();
2190           {
2191             ExternalReference cache_field_offsets_ref =
2192                 ExternalReference::keyed_lookup_cache_field_offsets(isolate());
2193             HValue* cache_field_offsets =
2194                 Add<HConstant>(cache_field_offsets_ref);
2195             HValue* index = AddUncasted<HAdd>(hash, Add<HConstant>(probe));
2196             index->ClearFlag(HValue::kCanOverflow);
2197             HValue* property_index =
2198                 Add<HLoadKeyed>(cache_field_offsets, index, nullptr,
2199                                 EXTERNAL_INT32_ELEMENTS, NEVER_RETURN_HOLE, 0);
2200             Push(property_index);
2201           }
2202           lookup_if->Else();
2203         }
2204         for (int i = 0; i < KeyedLookupCache::kEntriesPerBucket; ++i) {
2205           lookup_ifs[i].JoinContinuation(&inline_or_runtime_continuation);
2206         }
2207       }
2208
2209       IfBuilder inline_or_runtime(this, &inline_or_runtime_continuation);
2210       inline_or_runtime.Then();
2211       {
2212         // Found a cached index, load property inline.
2213         Push(Add<HLoadFieldByIndex>(receiver, Pop()));
2214       }
2215       inline_or_runtime.Else();
2216       {
2217         // KeyedLookupCache miss; call runtime.
2218         Add<HPushArguments>(receiver, key);
2219         Push(Add<HCallRuntime>(
2220             isolate()->factory()->empty_string(),
2221             Runtime::FunctionForId(Runtime::kKeyedGetProperty), 2));
2222       }
2223       inline_or_runtime.End();
2224     }
2225     if_dict_properties.End();
2226   }
2227   index_name_split.End();
2228
2229   return Pop();
2230 }
2231
2232
2233 Handle<Code> KeyedLoadGenericStub::GenerateCode() {
2234   return DoGenerateCode(this);
2235 }
2236
2237 }  // namespace internal
2238 }  // namespace v8