Implement fastpath for proxy trap getPrototypeOf

ObjectGetPrototypeOf and ReflectGetPrototypeOf are now Torque builtins (previously CPP) and the Proxy path is implemented completely in Torque while everything else calls into runtime (and is thus a bit slower than previously).

Perf improvement in micro-benchmark JSTests/Proxies
Before:
GetPrototypeOfWithoutTrap-Proxies(Score): 1876
GetPrototypeOfWithTrap-Proxies(Score): 857

After:
GetPrototypeOfWithoutTrap-Proxies(Score): 2810
GetPrototypeOfWithTrap-Proxies(Score): 3197

Bug: v8:6664
Change-Id: If60dda67d6e90c2d6f0ec743f6cb7c0fff54d607
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1658717
Commit-Queue: Z Nguyen-Huu <duongn@microsoft.com>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62256}

BUILD.gn

@@ -957,6 +957,7 @@ torque_files = [
   "src/builtins/object.tq",
   "src/builtins/proxy-constructor.tq",
   "src/builtins/proxy-get-property.tq",
+  "src/builtins/proxy-get-prototype-of.tq",
   "src/builtins/proxy-has-property.tq",
   "src/builtins/proxy-is-extensible.tq",
   "src/builtins/proxy-prevent-extensions.tq",

src/builtins/base.tq

@@ -2833,6 +2833,8 @@ macro ToBoolean(obj: Object): bool {
   }
 }
 
+extern macro BranchIfSameValue(Object, Object): never labels Taken, NotTaken;
+
 transitioning macro ToIndex(input: Object, context: Context): Number
     labels RangeError {
   if (input == Undefined) {

src/builtins/builtins-definitions.h

@@ -726,7 +726,6 @@ namespace internal {
   CPP(ObjectGetOwnPropertyDescriptors)                                         \
   TFJ(ObjectGetOwnPropertyNames, 1, kReceiver, kObject)                        \
   CPP(ObjectGetOwnPropertySymbols)                                             \
-  CPP(ObjectGetPrototypeOf)                                                    \
   CPP(ObjectSetPrototypeOf)                                                    \
   TFJ(ObjectIs, 2, kReceiver, kLeft, kRight)                                   \
   CPP(ObjectIsFrozen)                                                          \
@@ -824,7 +823,6 @@ namespace internal {
   CPP(ReflectDeleteProperty)                                                   \
   CPP(ReflectGet)                                                              \
   CPP(ReflectGetOwnPropertyDescriptor)                                         \
-  CPP(ReflectGetPrototypeOf)                                                   \
   TFJ(ReflectHas, 2, kReceiver, kTarget, kKey)                                 \
   CPP(ReflectOwnKeys)                                                          \
   CPP(ReflectSet)                                                              \

src/builtins/builtins-object.cc

@@ -218,19 +218,6 @@ BUILTIN(ObjectFreeze) {
   return *object;
 }
 
-// ES section 19.1.2.9 Object.getPrototypeOf ( O )
-BUILTIN(ObjectGetPrototypeOf) {
-  HandleScope scope(isolate);
-  Handle<Object> object = args.atOrUndefined(isolate, 1);
-
-  Handle<JSReceiver> receiver;
-  ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, receiver,
-                                     Object::ToObject(isolate, object));
-
-  RETURN_RESULT_OR_FAILURE(isolate,
-                           JSReceiver::GetPrototype(isolate, receiver));
-}
-
 // ES6 section 19.1.2.21 Object.setPrototypeOf ( O, proto )
 BUILTIN(ObjectSetPrototypeOf) {
   HandleScope scope(isolate);

src/builtins/builtins-reflect.cc

@@ -119,23 +119,6 @@ BUILTIN(ReflectGetOwnPropertyDescriptor) {
   return *desc.ToObject(isolate);
 }
 
-// ES6 section 26.1.8 Reflect.getPrototypeOf
-BUILTIN(ReflectGetPrototypeOf) {
-  HandleScope scope(isolate);
-  DCHECK_EQ(2, args.length());
-  Handle<Object> target = args.at(1);
-
-  if (!target->IsJSReceiver()) {
-    THROW_NEW_ERROR_RETURN_FAILURE(
-        isolate, NewTypeError(MessageTemplate::kCalledOnNonObject,
-                              isolate->factory()->NewStringFromAsciiChecked(
-                                  "Reflect.getPrototypeOf")));
-  }
-  Handle<JSReceiver> receiver = Handle<JSReceiver>::cast(target);
-  RETURN_RESULT_OR_FAILURE(isolate,
-                           JSReceiver::GetPrototype(isolate, receiver));
-}
-
 // ES6 section 26.1.11 Reflect.ownKeys
 BUILTIN(ReflectOwnKeys) {
   HandleScope scope(isolate);

src/builtins/object.tq

@@ -13,6 +13,9 @@ namespace runtime {
   extern transitioning runtime
   JSReceiverPreventExtensionsDontThrow(implicit context: Context)(JSReceiver):
       Object;
+
+  extern transitioning runtime
+  JSReceiverGetPrototypeOf(implicit context: Context)(JSReceiver): Object;
 }  // namespace runtime
 
 namespace object {
@@ -43,6 +46,20 @@ namespace object {
         objectJSReceiver);
     return proxy::ProxyPreventExtensions(objectJSProxy, False);
   }
+
+  transitioning macro
+  ObjectGetPrototypeOf(implicit context: Context)(object: Object): Object {
+    const objectJSReceiver: JSReceiver = ToObject_Inline(context, object);
+    return object::JSReceiverGetPrototypeOf(objectJSReceiver);
+  }
+
+  transitioning macro
+  JSReceiverGetPrototypeOf(implicit context: Context)(object: JSReceiver):
+      Object {
+    const objectJSProxy = Cast<JSProxy>(object)
+        otherwise return runtime::JSReceiverGetPrototypeOf(object);
+    return proxy::ProxyGetPrototypeOf(objectJSProxy);
+  }
 }  // namespace object
 
 namespace object_isextensible {
@@ -60,3 +77,11 @@ namespace object_preventextensions {
     return object::ObjectPreventExtensionsThrow(object);
   }
 }  // namespace object_preventextensions
+
+namespace object_getprototypeof {
+  // ES6 section 19.1.2.9 Object.getPrototypeOf ( O )
+  transitioning javascript builtin ObjectGetPrototypeOf(
+      js-implicit context: Context)(_receiver: Object, object: Object): Object {
+    return object::ObjectGetPrototypeOf(object);
+  }
+}  // namespace object_getprototypeof

src/builtins/proxy-get-prototype-of.tq

+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include 'src/builtins/builtins-proxy-gen.h'
+
+namespace proxy {
+
+  // ES #sec-proxy-object-internal-methods-and-internal-slots-isextensible
+  // https://tc39.github.io/ecma262/#sec-proxy-object-internal-methods-and-internal-slots-isextensible
+  transitioning builtin
+  ProxyGetPrototypeOf(implicit context: Context)(proxy: JSProxy): Object {
+    PerformStackCheck();
+    const kTrapName: constexpr string = 'getPrototypeOf';
+    try {
+      // 1. Let handler be O.[[ProxyHandler]].
+      // 2. If handler is null, throw a TypeError exception.
+      // 3. Assert: Type(handler) is Object.
+      const handler =
+          Cast<JSReceiver>(proxy.handler) otherwise ThrowProxyHandlerRevoked;
+
+      // 4. Let target be O.[[ProxyTarget]].
+      const target = proxy.target;
+
+      // 5. Let trap be ? GetMethod(handler, "getPrototypeOf").
+      // 6. If trap is undefined, then (see 6.a below).
+      const trap: Callable = GetMethod(handler, kTrapName)
+          otherwise goto TrapUndefined(target);
+
+      // 7. Let handlerProto be ? Call(trap, handler, « target »).
+      const handlerProto = Call(context, trap, handler, target);
+
+      // 8. If Type(handlerProto) is neither Object nor Null, throw a TypeError
+      // exception.
+      if (!Is<JSReceiver>(handlerProto)) {
+        goto ThrowProxyGetPrototypeOfInvalid;
+      }
+
+      // 9. Let extensibleTarget be ? IsExtensible(target).
+      // 10. If extensibleTarget is true, return handlerProto.
+      const extensibleTarget: Object = object::ObjectIsExtensible(target);
+      assert(extensibleTarget == True || extensibleTarget == False);
+      if (extensibleTarget == True) {
+        return handlerProto;
+      }
+
+      // 11. Let targetProto be ? target.[[GetPrototypeOf]]().
+      const targetProto = object::ObjectGetPrototypeOf(target);
+
+      // 12. If SameValue(handlerProto, targetProto) is false, throw a TypeError
+      // exception.
+      // 13. Return handlerProto.
+      if (BranchIfSameValue(targetProto, handlerProto)) {
+        return handlerProto;
+      }
+      ThrowTypeError(kProxyGetPrototypeOfNonExtensible);
+    }
+    label TrapUndefined(target: Object) {
+      // 6.a. Return ? target.[[GetPrototypeOf]]().
+      return object::ObjectGetPrototypeOf(target);
+    }
+    label ThrowProxyHandlerRevoked deferred {
+      ThrowTypeError(kProxyRevoked, kTrapName);
+    }
+    label ThrowProxyGetPrototypeOfInvalid deferred {
+      ThrowTypeError(kProxyGetPrototypeOfInvalid);
+    }
+  }
+}

src/builtins/proxy-prevent-extensions.tq

@@ -38,7 +38,7 @@ namespace proxy {
       if (BranchIfToBooleanIsTrue(trapResult)) {
         const extensibleTarget: Object = object::ObjectIsExtensible(target);
         assert(extensibleTarget == True || extensibleTarget == False);
-        if (BranchIfToBooleanIsTrue(extensibleTarget)) {
+        if (extensibleTarget == True) {
           ThrowTypeError(kProxyPreventExtensionsExtensible);
         }
       } else {

src/builtins/proxy.tq

@@ -42,6 +42,10 @@ namespace proxy {
   generates 'MessageTemplate::kProxyPreventExtensionsExtensible';
   const kProxyTrapReturnedFalsish: constexpr MessageTemplate
   generates 'MessageTemplate::kProxyTrapReturnedFalsish';
+  const kProxyGetPrototypeOfInvalid: constexpr MessageTemplate
+  generates 'MessageTemplate::kProxyGetPrototypeOfInvalid';
+  const kProxyGetPrototypeOfNonExtensible: constexpr MessageTemplate
+  generates 'MessageTemplate::kProxyGetPrototypeOfNonExtensible';
 
   const kProxyGet: constexpr int31
   generates 'JSProxy::AccessKind::kGet';

src/builtins/reflect.tq

@@ -22,4 +22,12 @@ namespace reflect {
         otherwise ThrowTypeError(kCalledOnNonObject, 'Reflect.preventExtensions');
     return object::ObjectPreventExtensionsDontThrow(objectJSReceiver);
   }
+
+  // ES6 section 26.1.8 Reflect.getPrototypeOf
+  transitioning javascript builtin ReflectGetPrototypeOf(
+      js-implicit context: Context)(_receiver: Object, object: Object): Object {
+    const objectJSReceiver = Cast<JSReceiver>(object)
+        otherwise ThrowTypeError(kCalledOnNonObject, 'Reflect.getPrototypeOf');
+    return object::JSReceiverGetPrototypeOf(objectJSReceiver);
+  }
 }  // namespace reflect

src/debug/debug-evaluate.cc

@@ -961,6 +961,7 @@ static bool TransitivelyCalledBuiltinHasNoSideEffect(Builtins::Name caller,
     case Builtins::kParseInt:
     case Builtins::kProxyHasProperty:
     case Builtins::kProxyIsExtensible:
+    case Builtins::kProxyGetPrototypeOf:
     case Builtins::kRecordWrite:
     case Builtins::kStringAdd_CheckNone:
     case Builtins::kStringEqual:

src/init/bootstrapper.cc

@@ -1446,7 +1446,7 @@ void Genesis::InitializeGlobal(Handle<JSGlobalObject> global_object,
 
     Handle<JSFunction> object_get_prototype_of =
         SimpleInstallFunction(isolate_, object_function, "getPrototypeOf",
-                              Builtins::kObjectGetPrototypeOf, 1, false);
+                              Builtins::kObjectGetPrototypeOf, 1, true);
     native_context()->set_object_get_prototype_of(*object_get_prototype_of);
     SimpleInstallFunction(isolate_, object_function, "setPrototypeOf",
                           Builtins::kObjectSetPrototypeOf, 2, false);

src/runtime/runtime-object.cc

@@ -537,6 +537,15 @@ RUNTIME_FUNCTION(Runtime_JSReceiverPreventExtensionsDontThrow) {
   return *isolate->factory()->ToBoolean(result.FromJust());
 }
 
+RUNTIME_FUNCTION(Runtime_JSReceiverGetPrototypeOf) {
+  HandleScope scope(isolate);
+  DCHECK_EQ(1, args.length());
+  CONVERT_ARG_HANDLE_CHECKED(JSReceiver, receiver, 0);
+
+  RETURN_RESULT_OR_FAILURE(isolate,
+                           JSReceiver::GetPrototype(isolate, receiver));
+}
+
 RUNTIME_FUNCTION(Runtime_GetProperty) {
   HandleScope scope(isolate);
   DCHECK_EQ(2, args.length());

src/runtime/runtime.h

@@ -302,6 +302,7 @@ namespace internal {
   I(IsJSReceiver, 1, 1)                                         \
   F(JSReceiverPreventExtensionsDontThrow, 1, 1)                 \
   F(JSReceiverPreventExtensionsThrow, 1, 1)                     \
+  F(JSReceiverGetPrototypeOf, 1, 1)                             \
   F(NewObject, 2, 1)                                            \
   F(ObjectCreate, 2, 1)                                         \
   F(ObjectEntries, 1, 1)                                        \