[wasm] Replace runtime functions with turbofan code

Motivation:
Improve code efficiency by replacing runtime calls with manually
written turbofan code where possible.

Changes:
- Remove the runtime functions `Runtime_WasmNewMultiReturnFixedArray`
  and `Runtime_WasmNewMultiReturnJSArray` and replace them with
  turbofan code.
- Introduce the builtin function `WasmAllocateJSArray`.

R=clemensb@chromium.org
R=ecmziegler@chromium.org
R=jkummerow@chromium.org

Change-Id: Idc0db39286c4242392c0422919bbc8fd7bedf2af
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2143816Reviewed-by: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Emanuel Ziegler <ecmziegler@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67472}

src/builtins/builtins-definitions.h

@@ -844,6 +844,7 @@ namespace internal {
   TFC(WasmFloat32ToNumber, WasmFloat32ToNumber)                                \
   TFC(WasmFloat64ToNumber, WasmFloat64ToNumber)                                \
   TFC(WasmTaggedToFloat64, WasmTaggedToFloat64)                                \
+  TFS(WasmAllocateJSArray, kArraySize)                                         \
   TFC(WasmAtomicNotify, WasmAtomicNotify)                                      \
   TFC(WasmI32AtomicWait32, WasmI32AtomicWait32)                                \
   TFC(WasmI32AtomicWait64, WasmI32AtomicWait64)                                \

src/builtins/builtins-wasm-gen.cc

@@ -105,6 +105,17 @@ TF_BUILTIN(WasmTraceMemory, WasmBuiltinsAssembler) {
   TailCallRuntime(Runtime::kWasmTraceMemory, context, info);
 }
 
+TF_BUILTIN(WasmAllocateJSArray, WasmBuiltinsAssembler) {
+  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
+  TNode<Smi> array_size = CAST(Parameter(Descriptor::kArraySize));
+
+  TNode<Map> array_map = CAST(
+      LoadContextElement(context, Context::JS_ARRAY_PACKED_ELEMENTS_MAP_INDEX));
+
+  Return(CodeStubAssembler::AllocateJSArray(PACKED_ELEMENTS, array_map,
+                                            array_size, array_size));
+}
+
 TF_BUILTIN(WasmAtomicNotify, WasmBuiltinsAssembler) {
   TNode<Uint32T> address =
       UncheckedCast<Uint32T>(Parameter(Descriptor::kAddress));

src/compiler/wasm-compiler.cc

@@ -5469,6 +5469,26 @@ class WasmWrapperGraphBuilder : public WasmGraphBuilder {
         iterable, length, context, effect(), control()));
   }
 
+  // Extract the FixedArray implementing
+  // the backing storage of a JavaScript array.
+  Node* BuildLoadArrayBackingStorage(Node* js_array) {
+    return gasm_->Load(MachineType::AnyTagged(), js_array,
+                       JSObject::kElementsOffset - kHeapObjectTag);
+  }
+
+  // Generate a call to the AllocateJSArray builtin.
+  Node* BuildCallAllocateJSArray(Node* array_length, Node* context) {
+    // Since we don't check that args will fit in an array,
+    // we make sure this is true based on statically known limits.
+    STATIC_ASSERT(wasm::kV8MaxWasmFunctionMultiReturns <=
+                  JSArray::kInitialMaxFastElementArray);
+    auto call_descriptor =
+        GetBuiltinCallDescriptor<WasmAllocateJSArrayDescriptor>(
+            this, StubCallMode::kCallBuiltinPointer);
+    Node* call_target = GetBuiltinPointerTarget(Builtins::kWasmAllocateJSArray);
+    return gasm_->Call(call_descriptor, call_target, array_length, context);
+  }
+
   void BuildJSToWasmWrapper(bool is_import) {
     const int wasm_count = static_cast<int>(sig_->parameter_count());
     const int rets_count = static_cast<int>(sig_->return_count());
@@ -5552,15 +5572,15 @@ class WasmWrapperGraphBuilder : public WasmGraphBuilder {
       int32_t return_count = static_cast<int32_t>(sig_->return_count());
       Node* size =
           graph()->NewNode(mcgraph()->common()->NumberConstant(return_count));
-      // TODO(thibaudm): Replace runtime calls with TurboFan code.
-      Node* fixed_array =
-          BuildCallToRuntime(Runtime::kWasmNewMultiReturnFixedArray, &size, 1);
+
+      jsval = BuildCallAllocateJSArray(size, js_context);
+
+      Node* fixed_array = BuildLoadArrayBackingStorage(jsval);
+
       for (int i = 0; i < return_count; ++i) {
         Node* value = ToJS(rets[i], sig_->GetReturn(i));
         STORE_FIXED_ARRAY_SLOT_ANY(fixed_array, i, value);
       }
-      jsval = BuildCallToRuntimeWithContext(Runtime::kWasmNewMultiReturnJSArray,
-                                            js_context, &fixed_array, 1);
     }
     Return(jsval);
     if (ContainsInt64(sig_)) LowerInt64(kCalledFromJS);
@@ -6021,16 +6041,14 @@ class WasmWrapperGraphBuilder : public WasmGraphBuilder {
       int32_t return_count = static_cast<int32_t>(sig_->return_count());
       Node* size =
           graph()->NewNode(mcgraph()->common()->NumberConstant(return_count));
-      Node* result_fixed_array =
-          BuildCallToRuntime(Runtime::kWasmNewMultiReturnFixedArray, &size, 1);
+      jsval = BuildCallAllocateJSArray(size, context);
+      Node* result_fixed_array = BuildLoadArrayBackingStorage(jsval);
       for (unsigned i = 0; i < sig_->return_count(); ++i) {
         const auto& type = sig_->GetReturn(i);
         Node* elem = LOAD_FIXED_ARRAY_SLOT_ANY(fixed_array, i);
         Node* cast = ToJS(FromJS(elem, context, type), type);
         STORE_FIXED_ARRAY_SLOT_ANY(result_fixed_array, i, cast);
       }
-      jsval = BuildCallToRuntimeWithContext(Runtime::kWasmNewMultiReturnJSArray,
-                                            context, &result_fixed_array, 1);
     }
     Return(jsval);
   }

src/runtime/runtime-wasm.cc

@@ -607,29 +607,6 @@ RUNTIME_FUNCTION(Runtime_WasmTableFill) {
   return ReadOnlyRoots(isolate).undefined_value();
 }
 
-RUNTIME_FUNCTION(Runtime_WasmNewMultiReturnFixedArray) {
-  // This code is called from wrappers, so the "thread is wasm" flag is not set.
-  DCHECK(!trap_handler::IsThreadInWasm());
-  DCHECK_EQ(1, args.length());
-  HandleScope scope(isolate);
-  CONVERT_INT32_ARG_CHECKED(size, 0);
-  Handle<FixedArray> fixed_array = isolate->factory()->NewFixedArray(size);
-  return *fixed_array;
-}
-
-RUNTIME_FUNCTION(Runtime_WasmNewMultiReturnJSArray) {
-  // This code is called from wrappers, so the "thread is wasm" flag is not set.
-  DCHECK(!trap_handler::IsThreadInWasm());
-  HandleScope scope(isolate);
-  DCHECK_EQ(1, args.length());
-  DCHECK(!isolate->context().is_null());
-  CONVERT_ARG_CHECKED(FixedArray, fixed_array, 0);
-  Handle<FixedArray> fixed_array_handle(fixed_array, isolate);
-  Handle<JSArray> array = isolate->factory()->NewJSArrayWithElements(
-      fixed_array_handle, PACKED_ELEMENTS);
-  return *array;
-}
-
 RUNTIME_FUNCTION(Runtime_WasmDebugBreak) {
   ClearThreadInWasmScope flag_scope;
   HandleScope scope(isolate);

src/runtime/runtime.h

@@ -573,8 +573,6 @@ namespace internal {
   F(WasmTableFill, 4, 1)                \
   F(WasmIsValidFuncRefValue, 1, 1)      \
   F(WasmCompileLazy, 2, 1)              \
-  F(WasmNewMultiReturnFixedArray, 1, 1) \
-  F(WasmNewMultiReturnJSArray, 1, 1)    \
   F(WasmDebugBreak, 0, 1)               \
   F(WasmStructNew, 1, 1)
 

src/wasm/wasm-code-manager.h

@@ -55,6 +55,7 @@ struct WasmModule;
   V(WasmFloat32ToNumber)                 \
   V(WasmFloat64ToNumber)                 \
   V(WasmTaggedToFloat64)                 \
+  V(WasmAllocateJSArray)                 \
   V(WasmAtomicNotify)                    \
   V(WasmI32AtomicWait32)                 \
   V(WasmI32AtomicWait64)                 \