Revert "[array] Prepare Array.p.shift for removal of the JavaScript fall-back"

This reverts commit f4ca3fc5.

Reason for revert: Since TF (js-call-reducer) calls into the C++ builtin, it is easier (cleaner for now) to implement the baseline version in C++ instead of Torque.

Original change's description:
> [array] Prepare Array.p.shift for removal of the JavaScript fall-back
> 
> This CL changes the ArrayPrototypeShift builtin to a CSA macro which
> is used in a newly created Torque builtin.
> 
> This is in preparation for removing the JavaScript fall-back, which
> will be replaced by a baseline Torque implementation.
> 
> R=​cbruni@chromium.org, jgruber@chromium.org
> 
> Bug: v8:7624
> Change-Id: I9b7898beea2802cc02d394e040a1e500387cf108
> Reviewed-on: https://chromium-review.googlesource.com/1169172
> Reviewed-by: Jakob Gruber <jgruber@chromium.org>
> Commit-Queue: Simon Zünd <szuend@google.com>
> Cr-Commit-Position: refs/heads/master@{#55036}

TBR=cbruni@chromium.org,jgruber@chromium.org,szuend@google.com

# Not skipping CQ checks because original CL landed > 1 day ago.

Bug: v8:7624
Change-Id: I4929eefaa90ff8681bc8ae20e3ea3fe84ee7f1e8
Reviewed-on: https://chromium-review.googlesource.com/1186342Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Simon Zünd <szuend@google.com>
Cr-Commit-Position: refs/heads/master@{#55345}

BUILD.gn

@@ -887,7 +887,6 @@ torque_files = [
   "src/builtins/array.tq",
   "src/builtins/array-copywithin.tq",
   "src/builtins/array-foreach.tq",
-  "src/builtins/array-shift.tq",
   "src/builtins/typed-array.tq",
   "src/builtins/data-view.tq",
   "test/torque/test-torque.tq",

src/builtins/array-shift.tq

-// Copyright 2018 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-module array {
-  extern macro GenerateFastArrayShift(Context, Object): Object labels Slow;
-  extern builtin ArrayShift(Context, JSFunction, Object, int32): void;
-
-  // https://tc39.github.io/ecma262/#sec-array.prototype.shift
-  javascript builtin ArrayPrototypeShift(
-      context: Context, receiver: Object, ...arguments): Object {
-    try {
-      return GenerateFastArrayShift(context, receiver) otherwise Slow;
-    }
-    label Slow {
-      // TODO(szuend): Move checks if FastElementsAccessor::shift can be used
-      //               from the C++ builtin here.
-      tail ArrayShift(
-          context, LoadTargetFromFrame(), Undefined,
-          convert<int32>(arguments.length));
-    }
-
-    // TODO(szuend): Implement baseline Array.p.shift that replaces JS fallback.
-  }
-}

src/builtins/base.tq

@@ -742,7 +742,6 @@ extern macro IsFixedArray(HeapObject): bool;
 extern macro IsExtensibleMap(Map): bool;
 extern macro IsCustomElementsReceiverInstanceType(int32): bool;
 extern macro Typeof(Object): Object;
-extern macro LoadTargetFromFrame(): JSFunction;
 
 // Return true iff number is NaN.
 macro NumberIsNaN(number: Number): bool {

src/builtins/builtins-array-gen.cc

@@ -18,8 +18,6 @@ namespace v8 {
 namespace internal {
 
 using Node = compiler::Node;
-template <class T>
-using TNode = compiler::TNode<T>;
 
 ArrayBuiltinsAssembler::ArrayBuiltinsAssembler(
     compiler::CodeAssemblerState* state)
@@ -1500,9 +1498,17 @@ TF_BUILTIN(ArrayPrototypeSlice, ArrayPrototypeSliceCodeStubAssembler) {
   args.PopAndReturn(a);
 }
 
-TNode<Object> ArrayBuiltinsAssembler::GenerateFastArrayShift(
-    TNode<Context> context, TNode<Object> receiver, Label* slow) {
-  Label fast(this), done(this);
+TF_BUILTIN(ArrayPrototypeShift, CodeStubAssembler) {
+  TNode<Int32T> argc =
+      UncheckedCast<Int32T>(Parameter(Descriptor::kJSActualArgumentsCount));
+  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
+  CSA_ASSERT(this, IsUndefined(Parameter(Descriptor::kJSNewTarget)));
+
+  CodeStubArguments args(this, ChangeInt32ToIntPtr(argc));
+  TNode<Object> receiver = args.GetReceiver();
+
+  Label runtime(this, Label::kDeferred);
+  Label fast(this);
 
   // Only shift in this stub if
   // 1) the array has fast elements
@@ -1512,11 +1518,10 @@ TNode<Object> ArrayBuiltinsAssembler::GenerateFastArrayShift(
   // 5) we aren't supposed to left-trim the backing store.
 
   // 1) Check that the array has fast elements.
-  BranchIfFastJSArray(receiver, context, &fast, slow);
+  BranchIfFastJSArray(receiver, context, &fast, &runtime);
 
   BIND(&fast);
   {
-    TVARIABLE(Object, result, UndefinedConstant());
     TNode<JSArray> array_receiver = CAST(receiver);
     CSA_ASSERT(this, TaggedIsPositiveSmi(LoadJSArrayLength(array_receiver)));
     Node* length =
@@ -1526,13 +1531,13 @@ TNode<Object> ArrayBuiltinsAssembler::GenerateFastArrayShift(
     GotoIf(IntPtrEqual(length, IntPtrConstant(0)), &return_undefined);
 
     // 2) Ensure that the length is writable.
-    EnsureArrayLengthWritable(LoadMap(array_receiver), slow);
+    EnsureArrayLengthWritable(LoadMap(array_receiver), &runtime);
 
     // 3) Check that the elements backing store isn't copy-on-write.
     Node* elements = LoadElements(array_receiver);
     GotoIf(WordEqual(LoadMap(elements),
                      LoadRoot(Heap::kFixedCOWArrayMapRootIndex)),
-           slow);
+           &runtime);
 
     Node* new_length = IntPtrSub(length, IntPtrConstant(1));
 
@@ -1543,13 +1548,13 @@ TNode<Object> ArrayBuiltinsAssembler::GenerateFastArrayShift(
                IntPtrAdd(IntPtrAdd(new_length, new_length),
                          IntPtrConstant(JSObject::kMinAddedElementsCapacity)),
                capacity),
-           slow);
+           &runtime);
 
     // 5) Check that we're not supposed to left-trim the backing store, as
     //    implemented in elements.cc:FastElementsAccessor::MoveElements.
     GotoIf(IntPtrGreaterThan(new_length,
                              IntPtrConstant(JSArray::kMaxCopyElements)),
-           slow);
+           &runtime);
 
     StoreObjectFieldNoWriteBarrier(array_receiver, JSArray::kLengthOffset,
                                    SmiTag(new_length));
@@ -1567,10 +1572,12 @@ TNode<Object> ArrayBuiltinsAssembler::GenerateFastArrayShift(
                  Int32LessThanOrEqual(elements_kind,
                                       Int32Constant(HOLEY_DOUBLE_ELEMENTS)));
 
+      VARIABLE(result, MachineRepresentation::kTagged, UndefinedConstant());
+
       Label move_elements(this);
-      result = AllocateHeapNumberWithValue(LoadFixedDoubleArrayElement(
+      result.Bind(AllocateHeapNumberWithValue(LoadFixedDoubleArrayElement(
           elements, IntPtrConstant(0), MachineType::Float64(), 0,
-          INTPTR_PARAMETERS, &move_elements));
+          INTPTR_PARAMETERS, &move_elements)));
       Goto(&move_elements);
       BIND(&move_elements);
 
@@ -1600,14 +1607,13 @@ TNode<Object> ArrayBuiltinsAssembler::GenerateFastArrayShift(
                             IntPtrAdd(offset, IntPtrConstant(kPointerSize)),
                             double_hole);
       }
-
-      Goto(&done);
+      args.PopAndReturn(result.value());
     }
 
     BIND(&fast_elements_tagged);
     {
       TNode<FixedArray> elements_fixed_array = CAST(elements);
-      TNode<Object> value = LoadFixedArrayElement(elements_fixed_array, 0);
+      Node* value = LoadFixedArrayElement(elements_fixed_array, 0);
       BuildFastLoop(
           IntPtrConstant(0), new_length,
           [&](Node* index) {
@@ -1620,15 +1626,13 @@ TNode<Object> ArrayBuiltinsAssembler::GenerateFastArrayShift(
       StoreFixedArrayElement(elements_fixed_array, new_length,
                              TheHoleConstant());
       GotoIf(WordEqual(value, TheHoleConstant()), &return_undefined);
-
-      result = value;
-      Goto(&done);
+      args.PopAndReturn(value);
     }
 
     BIND(&fast_elements_smi);
     {
       TNode<FixedArray> elements_fixed_array = CAST(elements);
-      TNode<Object> value = LoadFixedArrayElement(elements_fixed_array, 0);
+      Node* value = LoadFixedArrayElement(elements_fixed_array, 0);
       BuildFastLoop(
           IntPtrConstant(0), new_length,
           [&](Node* index) {
@@ -1642,19 +1646,21 @@ TNode<Object> ArrayBuiltinsAssembler::GenerateFastArrayShift(
       StoreFixedArrayElement(elements_fixed_array, new_length,
                              TheHoleConstant());
       GotoIf(WordEqual(value, TheHoleConstant()), &return_undefined);
-
-      result = value;
-      Goto(&done);
+      args.PopAndReturn(value);
     }
 
     BIND(&return_undefined);
-    {
-      result = UndefinedConstant();
-      Goto(&done);
-    }
+    { args.PopAndReturn(UndefinedConstant()); }
+  }
 
-    BIND(&done);
-    return result.value();
+  BIND(&runtime);
+  {
+    // We are not using Parameter(Descriptor::kJSTarget) and loading the value
+    // from the current frame here in order to reduce register pressure on the
+    // fast path.
+    TNode<JSFunction> target = LoadTargetFromFrame();
+    TailCallBuiltin(Builtins::kArrayShift, context, target, UndefinedConstant(),
+                    argc);
   }
 }
 

src/builtins/builtins-array-gen.h

@@ -145,9 +145,6 @@ class ArrayBuiltinsAssembler : public BaseBuiltinsFromDSLAssembler {
   void GenerateInternalArrayNoArgumentConstructor(ElementsKind kind);
   void GenerateInternalArraySingleArgumentConstructor(ElementsKind kind);
 
-  TNode<Object> GenerateFastArrayShift(TNode<Context> context,
-                                       TNode<Object> receiver, Label* slow);
-
  private:
   static ElementsKind ElementsKindForInstanceType(InstanceType type);
 

src/builtins/builtins-definitions.h

@@ -316,6 +316,7 @@ namespace internal {
   TFJ(ArrayPrototypePush, SharedFunctionInfo::kDontAdaptArgumentsSentinel)     \
   /* ES6 #sec-array.prototype.shift */                                         \
   CPP(ArrayShift)                                                              \
+  TFJ(ArrayPrototypeShift, SharedFunctionInfo::kDontAdaptArgumentsSentinel)    \
   /* ES6 #sec-array.prototype.slice */                                         \
   TFJ(ArrayPrototypeSlice, SharedFunctionInfo::kDontAdaptArgumentsSentinel)    \
   /* ES6 #sec-array.prototype.splice */                                        \