Revert "[turbofan] Move String.* functions to JSCallReducer"

This reverts commit 3ff4b447.

Reason for revert: Does not handle V8_INTL_SUPPORT correctly

Original change's description:
> [turbofan] Move String.* functions to JSCallReducer
> 
> Bug: v8:7250, v8:7340
> Change-Id: Ibb8d5badf89c66bd9bcb6bb390256ae81d0e899c
> Reviewed-on: https://chromium-review.googlesource.com/913208
> Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
> Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#51505}

TBR=sigurds@chromium.org,bmeurer@chromium.org

Change-Id: I6efb3b758b0fcadc012a90c4175de3c1ebccee95
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:7250, v8:7340
Reviewed-on: https://chromium-review.googlesource.com/934267Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51507}

src/compiler/js-builtin-reducer.h

@@ -75,8 +75,13 @@ class V8_EXPORT_PRIVATE JSBuiltinReducer final
   Reduction ReduceNumberIsSafeInteger(Node* node);
   Reduction ReduceNumberParseInt(Node* node);
   Reduction ReduceObjectCreate(Node* node);
-  Reduction ReduceStringSlice(Node* node);
   Reduction ReduceStringConcat(Node* node);
+  Reduction ReduceStringFromCharCode(Node* node);
+  Reduction ReduceStringIterator(Node* node);
+  Reduction ReduceStringIteratorNext(Node* node);
+  Reduction ReduceStringSlice(Node* node);
+  Reduction ReduceStringToLowerCaseIntl(Node* node);
+  Reduction ReduceStringToUpperCaseIntl(Node* node);
   Reduction ReduceArrayBufferIsView(Node* node);
   Reduction ReduceArrayBufferViewAccessor(Node* node,
                                           InstanceType instance_type,

src/compiler/js-call-reducer.h

@@ -100,12 +100,6 @@ class V8_EXPORT_PRIVATE JSCallReducer final : public AdvancedReducer {
   Reduction ReduceStringPrototypeIndexOf(Node* node);
   Reduction ReduceStringPrototypeStringAt(
       const Operator* string_access_operator, Node* node);
-  Reduction ReduceStringPrototypeToLowerCaseIntl(Node* node);
-  Reduction ReduceStringPrototypeToUpperCaseIntl(Node* node);
-  Reduction ReduceStringFromCharCode(Node* node);
-  Reduction ReduceStringPrototypeIterator(Node* node);
-  Reduction ReduceStringIteratorPrototypeNext(Node* node);
-
   Reduction ReduceAsyncFunctionPromiseCreate(Node* node);
   Reduction ReduceAsyncFunctionPromiseRelease(Node* node);
   Reduction ReducePromiseCapabilityDefaultReject(Node* node);

src/compiler/js-create-lowering.cc

@@ -143,8 +143,6 @@ Reduction JSCreateLowering::Reduce(Node* node) {
       return ReduceJSCreateClosure(node);
     case IrOpcode::kJSCreateIterResultObject:
       return ReduceJSCreateIterResultObject(node);
-    case IrOpcode::kJSCreateStringIterator:
-      return ReduceJSCreateStringIterator(node);
     case IrOpcode::kJSCreateKeyValueArray:
       return ReduceJSCreateKeyValueArray(node);
     case IrOpcode::kJSCreatePromise:
@@ -984,28 +982,6 @@ Reduction JSCreateLowering::ReduceJSCreateIterResultObject(Node* node) {
   return Changed(node);
 }
 
-Reduction JSCreateLowering::ReduceJSCreateStringIterator(Node* node) {
-  DCHECK_EQ(IrOpcode::kJSCreateStringIterator, node->opcode());
-  Node* string = NodeProperties::GetValueInput(node, 0);
-  Node* effect = NodeProperties::GetEffectInput(node);
-
-  Node* map = jsgraph()->HeapConstant(
-      handle(native_context()->string_iterator_map(), isolate()));
-  // Allocate new iterator and attach the iterator to this string.
-  AllocationBuilder a(jsgraph(), effect, graph()->start());
-  a.Allocate(JSStringIterator::kSize, NOT_TENURED, Type::OtherObject());
-  a.Store(AccessBuilder::ForMap(), map);
-  a.Store(AccessBuilder::ForJSObjectPropertiesOrHash(),
-          jsgraph()->EmptyFixedArrayConstant());
-  a.Store(AccessBuilder::ForJSObjectElements(),
-          jsgraph()->EmptyFixedArrayConstant());
-  a.Store(AccessBuilder::ForJSStringIteratorString(), string);
-  a.Store(AccessBuilder::ForJSStringIteratorIndex(), jsgraph()->SmiConstant(0));
-  STATIC_ASSERT(JSIteratorResult::kSize == 5 * kPointerSize);
-  a.FinishAndChange(node);
-  return Changed(node);
-}
-
 Reduction JSCreateLowering::ReduceJSCreateKeyValueArray(Node* node) {
   DCHECK_EQ(IrOpcode::kJSCreateKeyValueArray, node->opcode());
   Node* key = NodeProperties::GetValueInput(node, 0);

src/compiler/js-create-lowering.h

@@ -53,7 +53,6 @@ class V8_EXPORT_PRIVATE JSCreateLowering final
   Reduction ReduceJSCreateBoundFunction(Node* node);
   Reduction ReduceJSCreateClosure(Node* node);
   Reduction ReduceJSCreateIterResultObject(Node* node);
-  Reduction ReduceJSCreateStringIterator(Node* node);
   Reduction ReduceJSCreateKeyValueArray(Node* node);
   Reduction ReduceJSCreatePromise(Node* node);
   Reduction ReduceJSCreateLiteralArrayOrObject(Node* node);

src/compiler/js-generic-lowering.cc

@@ -418,10 +418,6 @@ void JSGenericLowering::LowerJSCreateIterResultObject(Node* node) {
   UNREACHABLE();  // Eliminated in typed lowering.
 }
 
-void JSGenericLowering::LowerJSCreateStringIterator(Node* node) {
-  UNREACHABLE();  // Eliminated in typed lowering.
-}
-
 void JSGenericLowering::LowerJSCreateKeyValueArray(Node* node) {
   UNREACHABLE();  // Eliminated in typed lowering.
 }

src/compiler/js-operator.cc

@@ -569,7 +569,6 @@ CompareOperationHint CompareOperationHintOf(const Operator* op) {
   V(ToString, Operator::kNoProperties, 1, 1)                           \
   V(Create, Operator::kNoProperties, 2, 1)                             \
   V(CreateIterResultObject, Operator::kEliminatable, 2, 1)             \
-  V(CreateStringIterator, Operator::kEliminatable, 1, 1)               \
   V(CreateKeyValueArray, Operator::kEliminatable, 2, 1)                \
   V(CreatePromise, Operator::kEliminatable, 0, 1)                      \
   V(HasProperty, Operator::kNoProperties, 2, 1)                        \

src/compiler/js-operator.h

@@ -658,7 +658,6 @@ class V8_EXPORT_PRIVATE JSOperatorBuilder final
                                 Handle<FeedbackCell> feedback_cell,
                                 PretenureFlag pretenure = NOT_TENURED);
   const Operator* CreateIterResultObject();
-  const Operator* CreateStringIterator();
   const Operator* CreateKeyValueArray();
   const Operator* CreatePromise();
   const Operator* CreateLiteralArray(Handle<ConstantElementsPair> constant,

src/compiler/node-properties.cc

@@ -515,27 +515,6 @@ MaybeHandle<Map> NodeProperties::GetMapWitness(Node* node) {
   return MaybeHandle<Map>();
 }
 
-// static
-bool NodeProperties::HasInstanceTypeWitness(Node* receiver, Node* effect,
-                                            InstanceType instance_type) {
-  ZoneHandleSet<Map> receiver_maps;
-  NodeProperties::InferReceiverMapsResult result =
-      NodeProperties::InferReceiverMaps(receiver, effect, &receiver_maps);
-  switch (result) {
-    case NodeProperties::kUnreliableReceiverMaps:
-    case NodeProperties::kReliableReceiverMaps:
-      DCHECK_NE(0, receiver_maps.size());
-      for (size_t i = 0; i < receiver_maps.size(); ++i) {
-        if (receiver_maps[i]->instance_type() != instance_type) return false;
-      }
-      return true;
-
-    case NodeProperties::kNoReceiverMaps:
-      return false;
-  }
-  UNREACHABLE();
-}
-
 // static
 bool NodeProperties::NoObservableSideEffectBetween(Node* effect,
                                                    Node* dominator) {

src/compiler/node-properties.h

@@ -155,8 +155,6 @@ class V8_EXPORT_PRIVATE NodeProperties final {
       Node* receiver, Node* effect, ZoneHandleSet<Map>* maps_return);
 
   static MaybeHandle<Map> GetMapWitness(Node* node);
-  static bool HasInstanceTypeWitness(Node* receiver, Node* effect,
-                                     InstanceType instance_type);
 
   // Walks up the {effect} chain to check that there's no observable side-effect
   // between the {effect} and it's {dominator}. Aborts the walk if there's join

src/compiler/opcodes.h

@@ -140,7 +140,6 @@
   V(JSCreateClosure)            \
   V(JSCreateGeneratorObject)    \
   V(JSCreateIterResultObject)   \
-  V(JSCreateStringIterator)     \
   V(JSCreateKeyValueArray)      \
   V(JSCreatePromise)            \
   V(JSCreateLiteralArray)       \

src/compiler/typer.cc

@@ -1225,10 +1225,6 @@ Type* Typer::Visitor::TypeJSCreateIterResultObject(Node* node) {
   return Type::OtherObject();
 }
 
-Type* Typer::Visitor::TypeJSCreateStringIterator(Node* node) {
-  return Type::OtherObject();
-}
-
 Type* Typer::Visitor::TypeJSCreateKeyValueArray(Node* node) {
   return Type::OtherObject();
 }
@@ -1962,13 +1958,9 @@ Type* Typer::Visitor::StringFromCodePointTyper(Type* type, Typer* t) {
 
 Type* Typer::Visitor::TypeStringCharAt(Node* node) { return Type::String(); }
 
-Type* Typer::Visitor::TypeStringToLowerCaseIntl(Node* node) {
-  return Type::String();
-}
+Type* Typer::Visitor::TypeStringToLowerCaseIntl(Node* node) { UNREACHABLE(); }
 
-Type* Typer::Visitor::TypeStringToUpperCaseIntl(Node* node) {
-  return Type::String();
-}
+Type* Typer::Visitor::TypeStringToUpperCaseIntl(Node* node) { UNREACHABLE(); }
 
 Type* Typer::Visitor::TypeStringCharCodeAt(Node* node) {
   return typer_->cache_.kUint16;

src/compiler/verifier.cc

@@ -677,10 +677,6 @@ void Verifier::Visitor::Check(Node* node, const AllNodes& all) {
       // Type is OtherObject.
       CheckTypeIs(node, Type::OtherObject());
       break;
-    case IrOpcode::kJSCreateStringIterator:
-      // Type is OtherObject.
-      CheckTypeIs(node, Type::OtherObject());
-      break;
     case IrOpcode::kJSCreateKeyValueArray:
       // Type is OtherObject.
       CheckTypeIs(node, Type::OtherObject());

test/mjsunit/string-deopt.js

-// Copyright 2018 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license
-// that can be found in the LICENSE file.
-
-// Flags: --allow-natives-syntax --opt --no-always-opt
-
-(()=> {
-  function f(a, b, c) {
-    return a.indexOf(b, c);
-  }
-  f("abc", "de", 1);
-  f("abc", "de", 1);
-  %OptimizeFunctionOnNextCall(f);
-  f("abc", "de", {});
-  %OptimizeFunctionOnNextCall(f);
-  f("abc", "de", {});
-  assertOptimized(f);
-})();
-
-(()=> {
-  function f(a, b, c) {
-    return a.indexOf(b, c);
-  }
-  f("abc", "de", 1);
-  f("abc", "de", 1);
-  %OptimizeFunctionOnNextCall(f);
-  f("abc", {}, 1);
-  %OptimizeFunctionOnNextCall(f);
-  f("abc", {}, 1);
-  assertOptimized(f);
-})();

test/unittests/compiler/js-builtin-reducer-unittest.cc

@@ -328,6 +328,46 @@ TEST_F(JSBuiltinReducerTest, NumberParseIntWithIntegral32AndUndefined) {
   }
 }
 
+// -----------------------------------------------------------------------------
+// String.fromCharCode
+
+TEST_F(JSBuiltinReducerTest, StringFromCharCodeWithNumber) {
+  Node* function = StringFunction("fromCharCode");
+
+  Node* effect = graph()->start();
+  Node* control = graph()->start();
+  Node* context = UndefinedConstant();
+  Node* frame_state = graph()->start();
+  TRACED_FOREACH(Type*, t0, kNumberTypes) {
+    Node* p0 = Parameter(t0, 0);
+    Node* call =
+        graph()->NewNode(javascript()->Call(3), function, UndefinedConstant(),
+                         p0, context, frame_state, effect, control);
+    Reduction r = Reduce(call);
+
+    ASSERT_TRUE(r.Changed());
+    EXPECT_THAT(r.replacement(), IsStringFromCharCode(p0));
+  }
+}
+
+TEST_F(JSBuiltinReducerTest, StringFromCharCodeWithPlainPrimitive) {
+  Node* function = StringFunction("fromCharCode");
+
+  Node* effect = graph()->start();
+  Node* control = graph()->start();
+  Node* context = UndefinedConstant();
+  Node* frame_state = graph()->start();
+  Node* p0 = Parameter(Type::PlainPrimitive(), 0);
+  Node* call =
+      graph()->NewNode(javascript()->Call(3), function, UndefinedConstant(), p0,
+                       context, frame_state, effect, control);
+  Reduction r = Reduce(call);
+
+  ASSERT_TRUE(r.Changed());
+  EXPECT_THAT(r.replacement(),
+              IsStringFromCharCode(IsPlainPrimitiveToNumber(p0)));
+}
+
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8

test/unittests/compiler/js-call-reducer-unittest.cc

@@ -67,19 +67,6 @@ class JSCallReducerTest : public TypedGraphTest {
     return HeapConstant(f);
   }
 
-  Node* StringFunction(const char* name) {
-    Handle<Object> m =
-        JSObject::GetProperty(
-            isolate()->global_object(),
-            isolate()->factory()->NewStringFromAsciiChecked("String"))
-            .ToHandleChecked();
-    Handle<JSFunction> f = Handle<JSFunction>::cast(
-        Object::GetProperty(
-            m, isolate()->factory()->NewStringFromAsciiChecked(name))
-            .ToHandleChecked());
-    return HeapConstant(f);
-  }
-
   std::string op_name_for(const char* fnc) {
     std::string string_fnc(fnc);
     char initial = std::toupper(fnc[0]);
@@ -404,41 +391,6 @@ TEST_F(JSCallReducerTest, MathMaxWithTwoArguments) {
                                            IsSpeculativeToNumber(p1)));
 }
 
-// -----------------------------------------------------------------------------
-// String.fromCharCode
-
-TEST_F(JSCallReducerTest, StringFromCharCodeWithNumber) {
-  Node* function = StringFunction("fromCharCode");
-
-  Node* effect = graph()->start();
-  Node* control = graph()->start();
-  Node* context = UndefinedConstant();
-  Node* frame_state = graph()->start();
-  Node* p0 = Parameter(Type::Any(), 0);
-  Node* call = graph()->NewNode(Call(3), function, UndefinedConstant(), p0,
-                                context, frame_state, effect, control);
-  Reduction r = Reduce(call);
-
-  ASSERT_TRUE(r.Changed());
-  EXPECT_THAT(r.replacement(), IsStringFromCharCode(IsSpeculativeToNumber(p0)));
-}
-
-TEST_F(JSCallReducerTest, StringFromCharCodeWithPlainPrimitive) {
-  Node* function = StringFunction("fromCharCode");
-
-  Node* effect = graph()->start();
-  Node* control = graph()->start();
-  Node* context = UndefinedConstant();
-  Node* frame_state = graph()->start();
-  Node* p0 = Parameter(Type::PlainPrimitive(), 0);
-  Node* call = graph()->NewNode(Call(3), function, UndefinedConstant(), p0,
-                                context, frame_state, effect, control);
-  Reduction r = Reduce(call);
-
-  ASSERT_TRUE(r.Changed());
-  EXPECT_THAT(r.replacement(), IsStringFromCharCode(IsSpeculativeToNumber(p0)));
-}
-
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8