Reland "[Torque] Port Array.prototype.reduce and reduceRight to Torque"

A custom deoptimization continuation point erroneously cast a parameter
to a number. Tests added.

BUG: v8:7672
Change-Id: I59848aacdedc1de9fd7d83d55045618f37d39fb0
Reviewed-on: https://chromium-review.googlesource.com/c/1485974Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Michael Stanton <mvstanton@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59841}

BUILD.gn

@@ -907,6 +907,8 @@ torque_files = [
   "src/builtins/array-lastindexof.tq",
   "src/builtins/array-of.tq",
   "src/builtins/array-map.tq",
+  "src/builtins/array-reduce.tq",
+  "src/builtins/array-reduce-right.tq",
   "src/builtins/array-reverse.tq",
   "src/builtins/array-slice.tq",
   "src/builtins/array-some.tq",

src/builtins/array-reduce-right.tq

+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+namespace array {
+  transitioning javascript builtin
+  ArrayReduceRightPreLoopEagerDeoptContinuation(implicit context: Context)(
+      receiver: Object, callback: Object, length: Object): Object {
+    // All continuation points in the optimized every implementation are
+    // after the ToObject(O) call that ensures we are dealing with a
+    // JSReceiver.
+    //
+    // Also, this great mass of casts is necessary because the signature
+    // of Torque javascript builtins requires Object type for all parameters
+    // other than {context}.
+    const jsreceiver = Cast<JSReceiver>(receiver) otherwise unreachable;
+    const callbackfn = Cast<Callable>(callback) otherwise unreachable;
+    const numberLength = Cast<Number>(length) otherwise unreachable;
+
+    // Simulate starting the loop at 0, but ensuring that the accumulator is
+    // the hole. The continuation stub will search for the initial non-hole
+    // element, rightly throwing an exception if not found.
+    return ArrayReduceRightLoopContinuation(
+        jsreceiver, callbackfn, Hole, jsreceiver, 0, numberLength);
+  }
+
+  transitioning javascript builtin
+  ArrayReduceRightLoopEagerDeoptContinuation(implicit context: Context)(
+      receiver: Object, callback: Object, initialK: Object, length: Object,
+      accumulator: Object): Object {
+    // All continuation points in the optimized every implementation are
+    // after the ToObject(O) call that ensures we are dealing with a
+    // JSReceiver.
+    //
+    // Also, this great mass of casts is necessary because the signature
+    // of Torque javascript builtins requires Object type for all parameters
+    // other than {context}.
+    const jsreceiver = Cast<JSReceiver>(receiver) otherwise unreachable;
+    const callbackfn = Cast<Callable>(callback) otherwise unreachable;
+    const numberK = Cast<Number>(initialK) otherwise unreachable;
+    const numberLength = Cast<Number>(length) otherwise unreachable;
+
+    return ArrayReduceRightLoopContinuation(
+        jsreceiver, callbackfn, accumulator, jsreceiver, numberK, numberLength);
+  }
+
+  transitioning javascript builtin
+  ArrayReduceRightLoopLazyDeoptContinuation(implicit context: Context)(
+      receiver: Object, callback: Object, initialK: Object, length: Object,
+      result: Object): Object {
+    // All continuation points in the optimized every implementation are
+    // after the ToObject(O) call that ensures we are dealing with a
+    // JSReceiver.
+    const jsreceiver = Cast<JSReceiver>(receiver) otherwise unreachable;
+    const callbackfn = Cast<Callable>(callback) otherwise unreachable;
+    let numberK = Cast<Number>(initialK) otherwise unreachable;
+    const numberLength = Cast<Number>(length) otherwise unreachable;
+
+    // The accumulator is the result from the callback call which just occured.
+    let r = ArrayReduceRightLoopContinuation(
+        jsreceiver, callbackfn, result, jsreceiver, numberK, numberLength);
+    return r;
+  }
+
+  transitioning builtin ArrayReduceRightLoopContinuation(implicit context:
+                                                             Context)(
+      receiver: JSReceiver, callbackfn: Callable, initialAccumulator: Object,
+      o: JSReceiver, initialK: Number, length: Number): Object {
+    let accumulator = initialAccumulator;
+
+    // 8b and 9. Repeat, while k >= 0
+    for (let k: Number = initialK; k >= 0; k--) {
+      // 8b i and 9a. Let Pk be ! ToString(k).
+      // k is guaranteed to be a positive integer, hence ToString is
+      // side-effect free and HasProperty/GetProperty do the conversion inline.
+
+      // 8b ii and 9b. Set kPresent to ? HasProperty(O, Pk).
+      const present: Boolean = HasProperty_Inline(o, k);
+
+      // 8b iii and 9c. If kPresent is true, then
+      if (present == True) {
+        // 8b iii and 9c i. Let kValue be ? Get(O, Pk).
+        const value: Object = GetProperty(o, k);
+
+        if (accumulator == Hole) {
+          // 8b iii 1.
+          accumulator = value;
+        } else {
+          // 9c. ii. Set accumulator to ? Call(callbackfn, undefined,
+          //         <accumulator, kValue, k, O>).
+          accumulator =
+              Call(context, callbackfn, Undefined, accumulator, value, k, o);
+        }
+      }
+
+      // 8b iv and 9d. Decrease k by 1. (done by the loop).
+    }
+
+    // 8c. if kPresent is false, throw a TypeError exception.
+    // If the accumulator is discovered with the sentinel hole value,
+    // this means kPresent is false.
+    if (accumulator == Hole) {
+      ThrowTypeError(context, kReduceNoInitial, 'Array.prototype.reduceRight');
+    }
+    return accumulator;
+  }
+
+  transitioning macro
+  ReduceRightVisitAllElements<FixedArrayType: type>(implicit context: Context)(
+      o: FastJSArray, len: Smi, callbackfn: Callable,
+      initialAccumulator: Object): Object
+      labels Bailout(Number, Object) {
+    let fastO = FastJSArrayWitness{o};
+    let accumulator = initialAccumulator;
+
+    // Build a fast loop over the array.
+    for (let k: Smi = len - 1; k >= 0; k--) {
+      fastO.Recheck() otherwise goto Bailout(k, accumulator);
+
+      const value: Object = LoadElementNoHole<FixedArrayType>(fastO.Get(), k)
+          otherwise continue;
+      if (accumulator == Hole) {
+        accumulator = value;
+      } else {
+        accumulator = Call(
+            context, callbackfn, Undefined, accumulator, value, k, fastO.Get());
+      }
+    }
+    if (accumulator == Hole) {
+      ThrowTypeError(context, kReduceNoInitial, 'Array.prototype.reduceRight');
+    }
+    return accumulator;
+  }
+
+  transitioning macro FastArrayReduceRight(implicit context: Context)(
+      o: JSReceiver, len: Number, callbackfn: Callable,
+      accumulator: Object): Object
+      labels Bailout(Number, Object) {
+    const k = len - 1;
+    const smiLen = Cast<Smi>(len) otherwise goto Bailout(k, accumulator);
+    let fastO = Cast<FastJSArray>(o) otherwise goto Bailout(k, accumulator);
+    const elementsKind: ElementsKind = fastO.map.elements_kind;
+    if (IsElementsKindGreaterThan(elementsKind, HOLEY_ELEMENTS)) {
+      return ReduceRightVisitAllElements<FixedDoubleArray>(
+          fastO, smiLen, callbackfn, accumulator) otherwise Bailout;
+    } else {
+      return ReduceRightVisitAllElements<FixedArray>(
+          fastO, smiLen, callbackfn, accumulator) otherwise Bailout;
+    }
+  }
+
+  // https://tc39.github.io/ecma262/#sec-array.prototype.reduceRight
+  transitioning javascript builtin
+  ArrayReduceRight(implicit context: Context)(receiver: Object, ...arguments):
+      Object {
+    try {
+      if (IsNullOrUndefined(receiver)) {
+        goto NullOrUndefinedError;
+      }
+
+      // 1. Let O be ? ToObject(this value).
+      const o: JSReceiver = ToObject_Inline(context, receiver);
+
+      // 2. Let len be ? ToLength(? Get(O, "length")).
+      const len: Number = GetLengthProperty(o);
+
+      // 3. If IsCallable(callbackfn) is false, throw a TypeError exception.
+      if (arguments.length == 0) {
+        goto NoCallableError;
+      }
+      const callbackfn = Cast<Callable>(arguments[0]) otherwise NoCallableError;
+
+      // 4. If len is 0 and initialValue is not present, throw a TypeError
+      // exception. (This case is handled at the end of
+      // ArrayReduceRightLoopContinuation).
+
+      const initialValue: Object = arguments.length > 1 ? arguments[1] : Hole;
+
+      try {
+        return FastArrayReduceRight(o, len, callbackfn, initialValue)
+            otherwise Bailout;
+      }
+      label Bailout(value: Number, accumulator: Object) {
+        return ArrayReduceRightLoopContinuation(
+            o, callbackfn, accumulator, o, value, len);
+      }
+    }
+    label NoCallableError deferred {
+      ThrowTypeError(context, kCalledNonCallable, arguments[0]);
+    }
+    label NullOrUndefinedError deferred {
+      ThrowTypeError(
+          context, kCalledOnNullOrUndefined, 'Array.prototype.reduceRight');
+    }
+  }
+}

src/builtins/array-reduce.tq

+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+namespace array {
+  transitioning javascript builtin
+  ArrayReducePreLoopEagerDeoptContinuation(implicit context: Context)(
+      receiver: Object, callback: Object, length: Object): Object {
+    // All continuation points in the optimized every implementation are
+    // after the ToObject(O) call that ensures we are dealing with a
+    // JSReceiver.
+    //
+    // Also, this great mass of casts is necessary because the signature
+    // of Torque javascript builtins requires Object type for all parameters
+    // other than {context}.
+    const jsreceiver = Cast<JSReceiver>(receiver) otherwise unreachable;
+    const callbackfn = Cast<Callable>(callback) otherwise unreachable;
+    const numberLength = Cast<Number>(length) otherwise unreachable;
+
+    // Simulate starting the loop at 0, but ensuring that the accumulator is
+    // the hole. The continuation stub will search for the initial non-hole
+    // element, rightly throwing an exception if not found.
+    return ArrayReduceLoopContinuation(
+        jsreceiver, callbackfn, Hole, jsreceiver, 0, numberLength);
+  }
+
+  transitioning javascript builtin
+  ArrayReduceLoopEagerDeoptContinuation(implicit context: Context)(
+      receiver: Object, callback: Object, initialK: Object, length: Object,
+      accumulator: Object): Object {
+    // All continuation points in the optimized every implementation are
+    // after the ToObject(O) call that ensures we are dealing with a
+    // JSReceiver.
+    //
+    // Also, this great mass of casts is necessary because the signature
+    // of Torque javascript builtins requires Object type for all parameters
+    // other than {context}.
+    const jsreceiver = Cast<JSReceiver>(receiver) otherwise unreachable;
+    const callbackfn = Cast<Callable>(callback) otherwise unreachable;
+    const numberK = Cast<Number>(initialK) otherwise unreachable;
+    const numberLength = Cast<Number>(length) otherwise unreachable;
+
+    return ArrayReduceLoopContinuation(
+        jsreceiver, callbackfn, accumulator, jsreceiver, numberK, numberLength);
+  }
+
+  transitioning javascript builtin
+  ArrayReduceLoopLazyDeoptContinuation(implicit context: Context)(
+      receiver: Object, callback: Object, initialK: Object, length: Object,
+      result: Object): Object {
+    // All continuation points in the optimized every implementation are
+    // after the ToObject(O) call that ensures we are dealing with a
+    // JSReceiver.
+    const jsreceiver = Cast<JSReceiver>(receiver) otherwise unreachable;
+    const callbackfn = Cast<Callable>(callback) otherwise unreachable;
+    let numberK = Cast<Number>(initialK) otherwise unreachable;
+    const numberLength = Cast<Number>(length) otherwise unreachable;
+
+    // The accumulator is the result from the callback call which just occured.
+    let r = ArrayReduceLoopContinuation(
+        jsreceiver, callbackfn, result, jsreceiver, numberK, numberLength);
+    return r;
+  }
+
+  transitioning builtin ArrayReduceLoopContinuation(implicit context: Context)(
+      receiver: JSReceiver, callbackfn: Callable, initialAccumulator: Object,
+      o: JSReceiver, initialK: Number, length: Number): Object {
+    let accumulator = initialAccumulator;
+
+    // 8b and 9. Repeat, while k < len
+    for (let k: Number = initialK; k < length; k++) {
+      // 8b i and 9a. Let Pk be ! ToString(k).
+      // k is guaranteed to be a positive integer, hence ToString is
+      // side-effect free and HasProperty/GetProperty do the conversion inline.
+
+      // 8b ii and 9b. Set kPresent to ? HasProperty(O, Pk).
+      const present: Boolean = HasProperty_Inline(o, k);
+
+      // 6c. If kPresent is true, then
+      if (present == True) {
+        // 6c. i. Let kValue be ? Get(O, Pk).
+        const value: Object = GetProperty(o, k);
+
+        if (accumulator == Hole) {
+          // 8b.
+          accumulator = value;
+        } else {
+          // 9c. ii. Set accumulator to ? Call(callbackfn, undefined,
+          //         <accumulator, kValue, k, O>).
+          accumulator =
+              Call(context, callbackfn, Undefined, accumulator, value, k, o);
+        }
+      }
+
+      // 8b iv and 9d. Increase k by 1. (done by the loop).
+    }
+
+    // 8c. if kPresent is false, throw a TypeError exception.
+    // If the accumulator is discovered with the sentinel hole value,
+    // this means kPresent is false.
+    if (accumulator == Hole) {
+      ThrowTypeError(context, kReduceNoInitial, 'Array.prototype.reduce');
+    }
+    return accumulator;
+  }
+
+  transitioning macro
+  ReduceVisitAllElements<FixedArrayType: type>(implicit context: Context)(
+      o: FastJSArray, len: Smi, callbackfn: Callable,
+      initialAccumulator: Object): Object
+      labels Bailout(Number, Object) {
+    let fastO = FastJSArrayWitness{o};
+    let accumulator = initialAccumulator;
+
+    // Build a fast loop over the array.
+    for (let k: Smi = 0; k < len; k++) {
+      fastO.Recheck() otherwise goto Bailout(k, accumulator);
+
+      const value: Object = LoadElementNoHole<FixedArrayType>(fastO.Get(), k)
+          otherwise continue;
+      if (accumulator == Hole) {
+        accumulator = value;
+      } else {
+        accumulator = Call(
+            context, callbackfn, Undefined, accumulator, value, k, fastO.Get());
+      }
+    }
+    if (accumulator == Hole) {
+      ThrowTypeError(context, kReduceNoInitial, 'Array.prototype.reduce');
+    }
+    return accumulator;
+  }
+
+  transitioning macro FastArrayReduce(implicit context: Context)(
+      o: JSReceiver, len: Number, callbackfn: Callable,
+      accumulator: Object): Object
+      labels Bailout(Number, Object) {
+    const k = 0;
+    const smiLen = Cast<Smi>(len) otherwise goto Bailout(k, accumulator);
+    let fastO = Cast<FastJSArray>(o) otherwise goto Bailout(k, accumulator);
+    const elementsKind: ElementsKind = fastO.map.elements_kind;
+    if (IsElementsKindGreaterThan(elementsKind, HOLEY_ELEMENTS)) {
+      return ReduceVisitAllElements<FixedDoubleArray>(
+          fastO, smiLen, callbackfn, accumulator) otherwise Bailout;
+    } else {
+      return ReduceVisitAllElements<FixedArray>(
+          fastO, smiLen, callbackfn, accumulator) otherwise Bailout;
+    }
+  }
+
+  // https://tc39.github.io/ecma262/#sec-array.prototype.reduce
+  transitioning javascript builtin
+  ArrayReduce(implicit context: Context)(receiver: Object, ...arguments):
+      Object {
+    try {
+      if (IsNullOrUndefined(receiver)) {
+        goto NullOrUndefinedError;
+      }
+
+      // 1. Let O be ? ToObject(this value).
+      const o: JSReceiver = ToObject_Inline(context, receiver);
+
+      // 2. Let len be ? ToLength(? Get(O, "length")).
+      const len: Number = GetLengthProperty(o);
+
+      // 3. If IsCallable(callbackfn) is false, throw a TypeError exception.
+      if (arguments.length == 0) {
+        goto NoCallableError;
+      }
+      const callbackfn = Cast<Callable>(arguments[0]) otherwise NoCallableError;
+
+      // 4. If len is 0 and initialValue is not present, throw a TypeError
+      // exception. (This case is handled at the end of
+      // ArrayReduceLoopContinuation).
+
+      const initialValue: Object = arguments.length > 1 ? arguments[1] : Hole;
+
+      try {
+        return FastArrayReduce(o, len, callbackfn, initialValue)
+            otherwise Bailout;
+      }
+      label Bailout(value: Number, accumulator: Object) {
+        return ArrayReduceLoopContinuation(
+            o, callbackfn, accumulator, o, value, len);
+      }
+    }
+    label NoCallableError deferred {
+      ThrowTypeError(context, kCalledNonCallable, arguments[0]);
+    }
+    label NullOrUndefinedError deferred {
+      ThrowTypeError(
+          context, kCalledOnNullOrUndefined, 'Array.prototype.reduce');
+    }
+  }
+}

src/builtins/base.tq

@@ -364,6 +364,8 @@ const kIteratorValueNotAnObject: constexpr MessageTemplate
     generates 'MessageTemplate::kIteratorValueNotAnObject';
 const kNotIterable: constexpr MessageTemplate
     generates 'MessageTemplate::kNotIterable';
+const kReduceNoInitial: constexpr MessageTemplate
+    generates 'MessageTemplate::kReduceNoInitial';
 const kFirstArgumentNotRegExp: constexpr MessageTemplate
     generates 'MessageTemplate::kFirstArgumentNotRegExp';
 

src/builtins/builtins-array-gen.cc

@@ -1645,86 +1645,6 @@ TF_BUILTIN(TypedArrayPrototypeEvery, ArrayBuiltinsAssembler) {
       &ArrayBuiltinsAssembler::NullPostLoopAction);
 }
 
-TF_BUILTIN(ArrayReduceLoopContinuation, ArrayBuiltinsAssembler) {
-  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
-  TNode<Object> receiver = CAST(Parameter(Descriptor::kReceiver));
-  Node* callbackfn = Parameter(Descriptor::kCallbackFn);
-  Node* this_arg = Parameter(Descriptor::kThisArg);
-  Node* accumulator = Parameter(Descriptor::kAccumulator);
-  TNode<JSReceiver> object = CAST(Parameter(Descriptor::kObject));
-  Node* initial_k = Parameter(Descriptor::kInitialK);
-  TNode<Number> len = CAST(Parameter(Descriptor::kLength));
-  Node* to = Parameter(Descriptor::kTo);
-
-  InitIteratingArrayBuiltinLoopContinuation(context, receiver, callbackfn,
-                                            this_arg, accumulator, object,
-                                            initial_k, len, to);
-
-  GenerateIteratingArrayBuiltinLoopContinuation(
-      &ArrayBuiltinsAssembler::ReduceProcessor,
-      &ArrayBuiltinsAssembler::ReducePostLoopAction,
-      MissingPropertyMode::kSkip);
-}
-
-TF_BUILTIN(ArrayReducePreLoopEagerDeoptContinuation, ArrayBuiltinsAssembler) {
-  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
-  TNode<Object> receiver = CAST(Parameter(Descriptor::kReceiver));
-  Node* callbackfn = Parameter(Descriptor::kCallbackFn);
-  TNode<Number> len = CAST(Parameter(Descriptor::kLength));
-
-  // Simulate starting the loop at 0, but ensuring that the accumulator is
-  // the hole. The continuation stub will search for the initial non-hole
-  // element, rightly throwing an exception if not found.
-  Return(CallBuiltin(Builtins::kArrayReduceLoopContinuation, context, receiver,
-                     callbackfn, UndefinedConstant(), TheHoleConstant(),
-                     receiver, SmiConstant(0), len, UndefinedConstant()));
-}
-
-TF_BUILTIN(ArrayReduceLoopEagerDeoptContinuation, ArrayBuiltinsAssembler) {
-  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
-  TNode<Object> receiver = CAST(Parameter(Descriptor::kReceiver));
-  Node* callbackfn = Parameter(Descriptor::kCallbackFn);
-  Node* accumulator = Parameter(Descriptor::kAccumulator);
-  Node* initial_k = Parameter(Descriptor::kInitialK);
-  TNode<Number> len = CAST(Parameter(Descriptor::kLength));
-
-  Return(CallBuiltin(Builtins::kArrayReduceLoopContinuation, context, receiver,
-                     callbackfn, UndefinedConstant(), accumulator, receiver,
-                     initial_k, len, UndefinedConstant()));
-}
-
-TF_BUILTIN(ArrayReduceLoopLazyDeoptContinuation, ArrayBuiltinsAssembler) {
-  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
-  TNode<Object> receiver = CAST(Parameter(Descriptor::kReceiver));
-  Node* callbackfn = Parameter(Descriptor::kCallbackFn);
-  Node* initial_k = Parameter(Descriptor::kInitialK);
-  TNode<Number> len = CAST(Parameter(Descriptor::kLength));
-  Node* result = Parameter(Descriptor::kResult);
-
-  Return(CallBuiltin(Builtins::kArrayReduceLoopContinuation, context, receiver,
-                     callbackfn, UndefinedConstant(), result, receiver,
-                     initial_k, len, UndefinedConstant()));
-}
-
-TF_BUILTIN(ArrayReduce, ArrayBuiltinsAssembler) {
-  TNode<IntPtrT> argc =
-      ChangeInt32ToIntPtr(Parameter(Descriptor::kJSActualArgumentsCount));
-  CodeStubArguments args(this, argc);
-  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
-  TNode<Object> receiver = args.GetReceiver();
-  Node* callbackfn = args.GetOptionalArgumentValue(0);
-  Node* initial_value = args.GetOptionalArgumentValue(1, TheHoleConstant());
-
-  InitIteratingArrayBuiltinBody(context, receiver, callbackfn, initial_value,
-                                argc);
-
-  GenerateIteratingArrayBuiltinBody(
-      "Array.prototype.reduce", &ArrayBuiltinsAssembler::ReduceResultGenerator,
-      &ArrayBuiltinsAssembler::ReduceProcessor,
-      &ArrayBuiltinsAssembler::ReducePostLoopAction,
-      Builtins::CallableFor(isolate(), Builtins::kArrayReduceLoopContinuation),
-      MissingPropertyMode::kSkip);
-}
 
 TF_BUILTIN(TypedArrayPrototypeReduce, ArrayBuiltinsAssembler) {
   TNode<IntPtrT> argc =
@@ -1745,91 +1665,6 @@ TF_BUILTIN(TypedArrayPrototypeReduce, ArrayBuiltinsAssembler) {
       &ArrayBuiltinsAssembler::ReducePostLoopAction);
 }
 
-TF_BUILTIN(ArrayReduceRightLoopContinuation, ArrayBuiltinsAssembler) {
-  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
-  TNode<Object> receiver = CAST(Parameter(Descriptor::kReceiver));
-  Node* callbackfn = Parameter(Descriptor::kCallbackFn);
-  Node* this_arg = Parameter(Descriptor::kThisArg);
-  Node* accumulator = Parameter(Descriptor::kAccumulator);
-  TNode<JSReceiver> object = CAST(Parameter(Descriptor::kObject));
-  Node* initial_k = Parameter(Descriptor::kInitialK);
-  TNode<Number> len = CAST(Parameter(Descriptor::kLength));
-  Node* to = Parameter(Descriptor::kTo);
-
-  InitIteratingArrayBuiltinLoopContinuation(context, receiver, callbackfn,
-                                            this_arg, accumulator, object,
-                                            initial_k, len, to);
-
-  GenerateIteratingArrayBuiltinLoopContinuation(
-      &ArrayBuiltinsAssembler::ReduceProcessor,
-      &ArrayBuiltinsAssembler::ReducePostLoopAction, MissingPropertyMode::kSkip,
-      ForEachDirection::kReverse);
-}
-
-TF_BUILTIN(ArrayReduceRightPreLoopEagerDeoptContinuation,
-           ArrayBuiltinsAssembler) {
-  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
-  TNode<Object> receiver = CAST(Parameter(Descriptor::kReceiver));
-  Node* callbackfn = Parameter(Descriptor::kCallbackFn);
-  TNode<Smi> len = CAST(Parameter(Descriptor::kLength));
-
-  // Simulate starting the loop at 0, but ensuring that the accumulator is
-  // the hole. The continuation stub will search for the initial non-hole
-  // element, rightly throwing an exception if not found.
-  Return(CallBuiltin(Builtins::kArrayReduceRightLoopContinuation, context,
-                     receiver, callbackfn, UndefinedConstant(),
-                     TheHoleConstant(), receiver, SmiSub(len, SmiConstant(1)),
-                     len, UndefinedConstant()));
-}
-
-TF_BUILTIN(ArrayReduceRightLoopEagerDeoptContinuation, ArrayBuiltinsAssembler) {
-  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
-  TNode<Object> receiver = CAST(Parameter(Descriptor::kReceiver));
-  Node* callbackfn = Parameter(Descriptor::kCallbackFn);
-  Node* accumulator = Parameter(Descriptor::kAccumulator);
-  Node* initial_k = Parameter(Descriptor::kInitialK);
-  TNode<Number> len = CAST(Parameter(Descriptor::kLength));
-
-  Return(CallBuiltin(Builtins::kArrayReduceRightLoopContinuation, context,
-                     receiver, callbackfn, UndefinedConstant(), accumulator,
-                     receiver, initial_k, len, UndefinedConstant()));
-}
-
-TF_BUILTIN(ArrayReduceRightLoopLazyDeoptContinuation, ArrayBuiltinsAssembler) {
-  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
-  TNode<Object> receiver = CAST(Parameter(Descriptor::kReceiver));
-  Node* callbackfn = Parameter(Descriptor::kCallbackFn);
-  Node* initial_k = Parameter(Descriptor::kInitialK);
-  TNode<Number> len = CAST(Parameter(Descriptor::kLength));
-  Node* result = Parameter(Descriptor::kResult);
-
-  Return(CallBuiltin(Builtins::kArrayReduceRightLoopContinuation, context,
-                     receiver, callbackfn, UndefinedConstant(), result,
-                     receiver, initial_k, len, UndefinedConstant()));
-}
-
-TF_BUILTIN(ArrayReduceRight, ArrayBuiltinsAssembler) {
-  TNode<IntPtrT> argc =
-      ChangeInt32ToIntPtr(Parameter(Descriptor::kJSActualArgumentsCount));
-  CodeStubArguments args(this, argc);
-  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
-  TNode<Object> receiver = args.GetReceiver();
-  Node* callbackfn = args.GetOptionalArgumentValue(0);
-  Node* initial_value = args.GetOptionalArgumentValue(1, TheHoleConstant());
-
-  InitIteratingArrayBuiltinBody(context, receiver, callbackfn, initial_value,
-                                argc);
-
-  GenerateIteratingArrayBuiltinBody(
-      "Array.prototype.reduceRight",
-      &ArrayBuiltinsAssembler::ReduceResultGenerator,
-      &ArrayBuiltinsAssembler::ReduceProcessor,
-      &ArrayBuiltinsAssembler::ReducePostLoopAction,
-      Builtins::CallableFor(isolate(),
-                            Builtins::kArrayReduceRightLoopContinuation),
-      MissingPropertyMode::kSkip, ForEachDirection::kReverse);
-}
-
 TF_BUILTIN(TypedArrayPrototypeReduceRight, ArrayBuiltinsAssembler) {
   TNode<IntPtrT> argc =
       ChangeInt32ToIntPtr(Parameter(Descriptor::kJSActualArgumentsCount));

src/builtins/builtins-definitions.h

@@ -350,26 +350,6 @@ namespace internal {
   TFS(CloneFastJSArray, kSource)                                               \
   TFS(CloneFastJSArrayFillingHoles, kSource)                                   \
   TFS(ExtractFastJSArray, kSource, kBegin, kCount)                             \
-  /* ES6 #sec-array.prototype.reduce */                                        \
-  TFS(ArrayReduceLoopContinuation, kReceiver, kCallbackFn, kThisArg,           \
-      kAccumulator, kObject, kInitialK, kLength, kTo)                          \
-  TFJ(ArrayReducePreLoopEagerDeoptContinuation, 2, kReceiver, kCallbackFn,     \
-      kLength)                                                                 \
-  TFJ(ArrayReduceLoopEagerDeoptContinuation, 4, kReceiver, kCallbackFn,        \
-      kInitialK, kLength, kAccumulator)                                        \
-  TFJ(ArrayReduceLoopLazyDeoptContinuation, 4, kReceiver, kCallbackFn,         \
-      kInitialK, kLength, kResult)                                             \
-  TFJ(ArrayReduce, SharedFunctionInfo::kDontAdaptArgumentsSentinel)            \
-  /* ES6 #sec-array.prototype.reduceRight */                                   \
-  TFS(ArrayReduceRightLoopContinuation, kReceiver, kCallbackFn, kThisArg,      \
-      kAccumulator, kObject, kInitialK, kLength, kTo)                          \
-  TFJ(ArrayReduceRightPreLoopEagerDeoptContinuation, 2, kReceiver,             \
-      kCallbackFn, kLength)                                                    \
-  TFJ(ArrayReduceRightLoopEagerDeoptContinuation, 4, kReceiver, kCallbackFn,   \
-      kInitialK, kLength, kAccumulator)                                        \
-  TFJ(ArrayReduceRightLoopLazyDeoptContinuation, 4, kReceiver, kCallbackFn,    \
-      kInitialK, kLength, kResult)                                             \
-  TFJ(ArrayReduceRight, SharedFunctionInfo::kDontAdaptArgumentsSentinel)       \
   /* ES6 #sec-array.prototype.entries */                                       \
   TFJ(ArrayPrototypeEntries, 0, kReceiver)                                     \
   /* ES6 #sec-array.prototype.find */                                          \

test/mjsunit/optimized-reduce.js

@@ -5,6 +5,30 @@
 // Flags: --allow-natives-syntax --expose-gc --turbo-inline-array-builtins
 // Flags: --opt --no-always-opt
 
+// Unknown field access leads to eager-deopt unrelated to reduce, should still
+// lead to correct result.
+(() => {
+  const a = [1, 2, 3, 4, 5, 6, 7, 8, 9, 10];
+  // For this particular eager deopt point to work, we need to dodge
+  // TurboFan's soft-deopts through a non-inlined and non-optimized function
+  // call to foo().
+  function foo(o, deopt) { if (deopt) { o.abc = 3; }}
+  %NeverOptimizeFunction(foo);
+  function eagerDeoptInCalled(deopt) {
+    return a.reduce((r, v, i, o) => {
+      if (i === 7) {
+        foo(a, deopt);
+      }
+      return r + "S";
+    }, "H");
+  }
+  eagerDeoptInCalled();
+  eagerDeoptInCalled();
+  %OptimizeFunctionOnNextCall(eagerDeoptInCalled);
+  eagerDeoptInCalled();
+  assertEquals("HSSSSSSSSSS", eagerDeoptInCalled(true));
+})();
+
 // Make sure we gracefully handle the case of an empty array in
 // optimized code.
 (function() {

test/mjsunit/optimized-reduceright.js

@@ -5,6 +5,30 @@
 // Flags: --allow-natives-syntax --expose-gc --turbo-inline-array-builtins
 // Flags: --opt --no-always-opt
 
+// Unknown field access leads to eager-deopt unrelated to reduceright, should
+// still lead to correct result.
+(() => {
+  const a = [1, 2, 3, 4, 5, 6, 7, 8, 9, 10];
+  // For this particular eager deopt point to work, we need to dodge
+  // TurboFan's soft-deopts through a non-inlined and non-optimized function
+  // call to foo().
+  function foo(o, deopt) { if (deopt) { o.abc = 3; }}
+  %NeverOptimizeFunction(foo);
+  function eagerDeoptInCalled(deopt) {
+    return a.reduceRight((r, v, i, o) => {
+      if (i === 7) {
+        foo(a, deopt);
+      }
+      return r + "S";
+    }, "H");
+  }
+  eagerDeoptInCalled();
+  eagerDeoptInCalled();
+  %OptimizeFunctionOnNextCall(eagerDeoptInCalled);
+  eagerDeoptInCalled();
+  assertEquals("HSSSSSSSSSS", eagerDeoptInCalled(true));
+})();
+
 // Make sure we gracefully handle the case of an empty array in
 // optimized code.
 (function() {