[turbofan] Introduce a dedicated Array type.

Use Type::Array to constant-fold Array.isArray builtin based on the
value input type. Also use it to improve type based alias analysis,
where we know that stores to an object of type Array don't affect stores
to an object of type OtherObject, and vice versa.

R=jarin@chromium.org
BUG=v8:6262

Review-Url: https://codereview.chromium.org/2819583002
Cr-Commit-Position: refs/heads/master@{#44681}

src/compiler/js-builtin-reducer.cc

@@ -733,11 +733,23 @@ Reduction JSBuiltinReducer::ReduceArrayIsArray(Node* node) {
     return Replace(value);
   }
   Node* value = NodeProperties::GetValueInput(node, 2);
+  Type* value_type = NodeProperties::GetType(value);
   Node* context = NodeProperties::GetContextInput(node);
   Node* frame_state = NodeProperties::GetFrameStateInput(node);
   Node* effect = NodeProperties::GetEffectInput(node);
   Node* control = NodeProperties::GetControlInput(node);
 
+  // Constant-fold based on {value} type.
+  if (value_type->Is(Type::Array())) {
+    Node* value = jsgraph()->TrueConstant();
+    ReplaceWithValue(node, value);
+    return Replace(value);
+  } else if (!value_type->Maybe(Type::ArrayOrProxy())) {
+    Node* value = jsgraph()->FalseConstant();
+    ReplaceWithValue(node, value);
+    return Replace(value);
+  }
+
   int count = 0;
   Node* values[5];
   Node* effects[5];

src/compiler/js-create-lowering.cc

@@ -1216,7 +1216,7 @@ Node* JSCreateLowering::AllocateFastLiteral(
   // Actually allocate and initialize the object.
   AllocationBuilder builder(jsgraph(), effect, control);
   builder.Allocate(boilerplate_map->instance_size(), pretenure,
-                   Type::OtherObject());
+                   Type::For(boilerplate_map));
   builder.Store(AccessBuilder::ForMap(), boilerplate_map);
   builder.Store(AccessBuilder::ForJSObjectProperties(), properties);
   builder.Store(AccessBuilder::ForJSObjectElements(), elements);

src/compiler/typer.cc

@@ -1119,11 +1119,7 @@ Type* Typer::Visitor::TypeJSCreateArguments(Node* node) {
   return Type::OtherObject();
 }
 
-
-Type* Typer::Visitor::TypeJSCreateArray(Node* node) {
-  return Type::OtherObject();
-}
-
+Type* Typer::Visitor::TypeJSCreateArray(Node* node) { return Type::Array(); }
 
 Type* Typer::Visitor::TypeJSCreateClosure(Node* node) {
   return Type::Function();
@@ -1139,7 +1135,7 @@ Type* Typer::Visitor::TypeJSCreateKeyValueArray(Node* node) {
 }
 
 Type* Typer::Visitor::TypeJSCreateLiteralArray(Node* node) {
-  return Type::OtherObject();
+  return Type::Array();
 }
 
 
@@ -1516,6 +1512,7 @@ Type* Typer::Visitor::JSCallTyper(Type* fun, Typer* t) {
 
         // Object functions.
         case kObjectAssign:
+          return Type::Receiver();
         case kObjectCreate:
           return Type::OtherObject();
         case kObjectHasOwnProperty:
@@ -1527,7 +1524,7 @@ Type* Typer::Visitor::JSCallTyper(Type* fun, Typer* t) {
         case kRegExpCompile:
           return Type::OtherObject();
         case kRegExpExec:
-          return Type::Union(Type::OtherObject(), Type::Null(), t->zone());
+          return Type::Union(Type::Array(), Type::Null(), t->zone());
         case kRegExpTest:
           return Type::Boolean();
         case kRegExpToString:

src/compiler/types.cc

@@ -208,6 +208,8 @@ Type::bitset BitsetType::Lub(i::Map* map) {
         return kOtherCallable;
       }
       return kOtherObject;
+    case JS_ARRAY_TYPE:
+      return kArray;
     case JS_VALUE_TYPE:
     case JS_MESSAGE_OBJECT_TYPE:
     case JS_DATE_TYPE:
@@ -216,7 +218,6 @@ Type::bitset BitsetType::Lub(i::Map* map) {
     case JS_ASYNC_GENERATOR_OBJECT_TYPE:
     case JS_MODULE_NAMESPACE_TYPE:
     case JS_ARRAY_BUFFER_TYPE:
-    case JS_ARRAY_TYPE:
     case JS_REGEXP_TYPE:  // TODO(rossberg): there should be a RegExp type.
     case JS_TYPED_ARRAY_TYPE:
     case JS_DATA_VIEW_TYPE:

src/compiler/types.h

@@ -126,6 +126,7 @@ namespace compiler {
   V(Hole,                1u << 22)  \
   V(OtherInternal,       1u << 23)  \
   V(ExternalPointer,     1u << 24)  \
+  V(Array,               1u << 25)  \
   \
   V(Signed31,                     kUnsigned30 | kNegative31) \
   V(Signed32,                     kSigned31 | kOtherUnsigned31 | \
@@ -166,12 +167,13 @@ namespace compiler {
   V(Primitive,                    kSymbol | kPlainPrimitive) \
   V(OtherUndetectableOrUndefined, kOtherUndetectable | kUndefined) \
   V(Proxy,                        kCallableProxy | kOtherProxy) \
+  V(ArrayOrProxy,                 kArray | kProxy) \
   V(DetectableCallable,           kFunction | kBoundFunction | \
                                   kOtherCallable | kCallableProxy) \
   V(Callable,                     kDetectableCallable | kOtherUndetectable) \
-  V(NonCallable,                  kOtherObject | kOtherProxy) \
+  V(NonCallable,                  kArray | kOtherObject | kOtherProxy) \
   V(NonCallableOrNull,            kNonCallable | kNull) \
-  V(DetectableObject,             kFunction | kBoundFunction | \
+  V(DetectableObject,             kArray | kFunction | kBoundFunction | \
                                   kOtherCallable | kOtherObject) \
   V(DetectableReceiver,           kDetectableObject | kProxy) \
   V(DetectableReceiverOrNull,     kDetectableReceiver | kNull) \

src/compiler/verifier.cc

@@ -602,8 +602,8 @@ void Verifier::Visitor::Check(Node* node) {
       CheckTypeIs(node, Type::OtherObject());
       break;
     case IrOpcode::kJSCreateArray:
-      // Type is OtherObject.
-      CheckTypeIs(node, Type::OtherObject());
+      // Type is Array.
+      CheckTypeIs(node, Type::Array());
       break;
     case IrOpcode::kJSCreateClosure:
       // Type is Function.
@@ -618,6 +618,9 @@ void Verifier::Visitor::Check(Node* node) {
       CheckTypeIs(node, Type::OtherObject());
       break;
     case IrOpcode::kJSCreateLiteralArray:
+      // Type is Array.
+      CheckTypeIs(node, Type::Array());
+      break;
     case IrOpcode::kJSCreateLiteralObject:
     case IrOpcode::kJSCreateLiteralRegExp:
       // Type is OtherObject.

test/cctest/test-types.cc

@@ -631,11 +631,12 @@ struct Tests {
 
     CheckSub(T.Object, T.Receiver);
     CheckSub(T.Proxy, T.Receiver);
+    CheckSub(T.Array, T.Object);
     CheckSub(T.OtherObject, T.Object);
     CheckSub(T.OtherUndetectable, T.Object);
-    CheckSub(T.OtherObject, T.Object);
 
     CheckUnordered(T.Object, T.Proxy);
+    CheckUnordered(T.Array, T.Undetectable);
     CheckUnordered(T.OtherObject, T.Undetectable);
 
     // Subtyping between concrete structural types
@@ -646,7 +647,7 @@ struct Tests {
     CheckSub(T.ObjectConstant1, T.Object);
     CheckSub(T.ObjectConstant2, T.Object);
     CheckSub(T.ArrayConstant, T.Object);
-    CheckSub(T.ArrayConstant, T.OtherObject);
+    CheckSub(T.ArrayConstant, T.Array);
     CheckSub(T.ArrayConstant, T.Receiver);
     CheckSub(T.UninitializedConstant, T.Internal);
     CheckUnordered(T.ObjectConstant1, T.ObjectConstant2);