[maglev] Support TestIn bytecode

Create a HasProperty node to mirror TF.

Bug: v8:7700
Change-Id: Ie332d54031eef640c247e7c7c5d06c033636fc7c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3803027Reviewed-by: Jakob Linke <jgruber@chromium.org>
Commit-Queue: Jakob Linke <jgruber@chromium.org>
Auto-Submit: Victor Gomes <victorgomes@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82095}

src/maglev/maglev-graph-builder.cc

@@ -1730,7 +1730,21 @@ void MaglevGraphBuilder::VisitTestInstanceOf() {
   SetAccumulator(AddNewNode<TestInstanceOf>({context, object, callable}));
 }
 
-MAGLEV_UNIMPLEMENTED_BYTECODE(TestIn)
+void MaglevGraphBuilder::VisitTestIn() {
+  // TestIn <src> <feedback_slot>
+  ValueNode* object = GetAccumulatorTagged();
+  ValueNode* name = LoadRegisterTagged(0);
+  FeedbackSlot slot = GetSlotOperand(1);
+  compiler::FeedbackSource feedback_source{feedback(), slot};
+
+  // TODO(victorgomes): Create fast path using feedback.
+  USE(feedback_source);
+
+  ValueNode* context = GetContext();
+  SetAccumulator(
+      AddNewNode<HasProperty>({context, object, name}, feedback_source));
+}
+
 MAGLEV_UNIMPLEMENTED_BYTECODE(ToName)
 
 void MaglevGraphBuilder::BuildToNumberOrToNumeric(Object::Conversion mode) {

src/maglev/maglev-graph-verifier.h

@@ -158,6 +158,7 @@ class MaglevGraphVerifier {
         CheckValueInputIs(node, 0, ValueRepresentation::kTagged);
         CheckValueInputIs(node, 1, ValueRepresentation::kTagged);
         break;
+      case Opcode::kHasProperty:
       case Opcode::kLoadNamedFromSuperGeneric:
       case Opcode::kSetNamedGeneric:
       case Opcode::kDefineNamedOwnGeneric:

src/maglev/maglev-ir.cc

@@ -738,6 +738,26 @@ void Constant::PrintParams(std::ostream& os,
   os << "(" << object_ << ")";
 }
 
+void HasProperty::AllocateVreg(MaglevVregAllocationState* vreg_state) {
+  using D = CallInterfaceDescriptorFor<Builtin::kKeyedHasIC>::type;
+  UseFixed(context(), kContextRegister);
+  UseFixed(object(), D::GetRegisterParameter(D::kReceiver));
+  UseFixed(name(), D::GetRegisterParameter(D::kName));
+  DefineAsFixed(vreg_state, this, kReturnRegister0);
+}
+void HasProperty::GenerateCode(MaglevCodeGenState* code_gen_state,
+                               const ProcessingState& state) {
+  using D = CallInterfaceDescriptorFor<Builtin::kKeyedHasIC>::type;
+  DCHECK_EQ(ToRegister(context()), kContextRegister);
+  DCHECK_EQ(ToRegister(object()), D::GetRegisterParameter(D::kReceiver));
+  DCHECK_EQ(ToRegister(name()), D::GetRegisterParameter(D::kName));
+  __ Move(D::GetRegisterParameter(D::kSlot),
+          TaggedIndex::FromIntptr(feedback().index()));
+  __ Move(D::GetRegisterParameter(D::kVector), feedback().vector);
+  __ CallBuiltin(Builtin::kKeyedHasIC);
+  code_gen_state->DefineLazyDeoptPoint(lazy_deopt_info());
+}
+
 void InitialValue::AllocateVreg(MaglevVregAllocationState* vreg_state) {
   // TODO(leszeks): Make this nicer.
   result().SetUnallocated(compiler::UnallocatedOperand::FIXED_SLOT,

src/maglev/maglev-ir.h

@@ -129,6 +129,7 @@ class CompactInterpreterFrameState;
   V(CreateClosure)                \
   V(FastCreateClosure)            \
   V(CreateRegExpLiteral)          \
+  V(HasProperty)                  \
   V(InitialValue)                 \
   V(LoadTaggedField)              \
   V(LoadDoubleField)              \
@@ -1674,6 +1675,31 @@ class ToNumberOrNumeric : public FixedInputValueNodeT<2, ToNumberOrNumeric> {
   const Object::Conversion mode_;
 };
 
+class HasProperty : public FixedInputValueNodeT<3, HasProperty> {
+  using Base = FixedInputValueNodeT<3, HasProperty>;
+
+ public:
+  explicit HasProperty(uint64_t bitfield,
+                       const compiler::FeedbackSource& feedback)
+      : Base(bitfield), feedback_(feedback) {}
+
+  // The implementation currently calls runtime.
+  static constexpr OpProperties kProperties = OpProperties::JSCall();
+
+  Input& context() { return input(0); }
+  Input& object() { return input(1); }
+  Input& name() { return input(2); }
+
+  compiler::FeedbackSource feedback() const { return feedback_; }
+
+  void AllocateVreg(MaglevVregAllocationState*);
+  void GenerateCode(MaglevCodeGenState*, const ProcessingState&);
+  void PrintParams(std::ostream&, MaglevGraphLabeller*) const {}
+
+ private:
+  const compiler::FeedbackSource feedback_;
+};
+
 class InitialValue : public FixedInputValueNodeT<0, InitialValue> {
   using Base = FixedInputValueNodeT<0, InitialValue>;