[js] Avoid %_ClassOf for collection builtins.

The collection builtins (Map, Set, WeakMap, WeakSet) are still written
in JavaScript and make heavy use of %_ClassOf, which is kind of
expensive compared to a simple instance type check. Change that to use
simple instance type checks instead.

R=jarin@chromium.org
BUG=v8:6261,v8:6278,v8:6344

Review-Url: https://codereview.chromium.org/2814773005
Cr-Original-Commit-Position: refs/heads/master@{#45106}
Committed: https://chromium.googlesource.com/v8/v8/+/28170099fd1efc84a724ef133f335fec521c0852
Review-Url: https://codereview.chromium.org/2814773005
Cr-Commit-Position: refs/heads/master@{#45124}

src/compiler/js-intrinsic-lowering.cc

@@ -56,6 +56,18 @@ Reduction JSIntrinsicLowering::Reduce(Node* node) {
       return ReduceIsInstanceType(node, JS_TYPED_ARRAY_TYPE);
     case Runtime::kInlineIsJSProxy:
       return ReduceIsInstanceType(node, JS_PROXY_TYPE);
+    case Runtime::kInlineIsJSMap:
+      return ReduceIsInstanceType(node, JS_MAP_TYPE);
+    case Runtime::kInlineIsJSSet:
+      return ReduceIsInstanceType(node, JS_SET_TYPE);
+    case Runtime::kInlineIsJSMapIterator:
+      return ReduceIsInstanceType(node, JS_MAP_ITERATOR_TYPE);
+    case Runtime::kInlineIsJSSetIterator:
+      return ReduceIsInstanceType(node, JS_SET_ITERATOR_TYPE);
+    case Runtime::kInlineIsJSWeakMap:
+      return ReduceIsInstanceType(node, JS_WEAK_MAP_TYPE);
+    case Runtime::kInlineIsJSWeakSet:
+      return ReduceIsInstanceType(node, JS_WEAK_SET_TYPE);
     case Runtime::kInlineIsJSReceiver:
       return ReduceIsJSReceiver(node);
     case Runtime::kInlineIsSmi:

src/compiler/linkage.cc

@@ -179,6 +179,12 @@ bool Linkage::NeedsFrameStateInput(Runtime::FunctionId function) {
     case Runtime::kInlineGeneratorGetInputOrDebugPos:
     case Runtime::kInlineGeneratorGetResumeMode:
     case Runtime::kInlineIsArray:
+    case Runtime::kInlineIsJSMap:
+    case Runtime::kInlineIsJSSet:
+    case Runtime::kInlineIsJSMapIterator:
+    case Runtime::kInlineIsJSSetIterator:
+    case Runtime::kInlineIsJSWeakMap:
+    case Runtime::kInlineIsJSWeakSet:
     case Runtime::kInlineIsJSReceiver:
     case Runtime::kInlineIsRegExp:
     case Runtime::kInlineIsSmi:

src/debug/debug-evaluate.cc

@@ -274,6 +274,12 @@ bool IntrinsicHasNoSideEffect(Runtime::FunctionId id) {
   V(IsFunction)                      \
   V(IsDate)                          \
   V(IsJSProxy)                       \
+  V(IsJSMap)                         \
+  V(IsJSSet)                         \
+  V(IsJSMapIterator)                 \
+  V(IsJSSetIterator)                 \
+  V(IsJSWeakMap)                     \
+  V(IsJSWeakSet)                     \
   V(IsRegExp)                        \
   V(IsTypedArray)                    \
   V(ClassOf)                         \

src/js/macros.py

@@ -47,29 +47,28 @@ define kMaxUint32 = 4294967295;
 macro IS_ARRAY(arg)             = (%_IsArray(arg));
 macro IS_ARRAYBUFFER(arg)       = (%_ClassOf(arg) === 'ArrayBuffer');
 macro IS_BOOLEAN(arg)           = (typeof(arg) === 'boolean');
-macro IS_DATAVIEW(arg)          = (%_ClassOf(arg) === 'DataView');
 macro IS_DATE(arg)              = (%IsDate(arg));
 macro IS_ERROR(arg)             = (%_ClassOf(arg) === 'Error');
 macro IS_FUNCTION(arg)          = (%IsFunction(arg));
 macro IS_GENERATOR(arg)         = (%_ClassOf(arg) === 'Generator');
 macro IS_GLOBAL(arg)            = (%_ClassOf(arg) === 'global');
-macro IS_MAP(arg)               = (%_ClassOf(arg) === 'Map');
-macro IS_MAP_ITERATOR(arg)      = (%_ClassOf(arg) === 'Map Iterator');
+macro IS_MAP(arg)               = (%_IsJSMap(arg));
+macro IS_MAP_ITERATOR(arg)      = (%_IsJSMapIterator(arg));
 macro IS_NULL(arg)              = (arg === null);
 macro IS_NULL_OR_UNDEFINED(arg) = (arg == null);
 macro IS_NUMBER(arg)            = (typeof(arg) === 'number');
 macro IS_OBJECT(arg)            = (typeof(arg) === 'object');
 macro IS_PROXY(arg)             = (%_IsJSProxy(arg));
 macro IS_SCRIPT(arg)            = (%_ClassOf(arg) === 'Script');
-macro IS_SET(arg)               = (%_ClassOf(arg) === 'Set');
-macro IS_SET_ITERATOR(arg)      = (%_ClassOf(arg) === 'Set Iterator');
+macro IS_SET(arg)               = (%_IsJSSet(arg));
+macro IS_SET_ITERATOR(arg)      = (%_IsJSSetIterator(arg));
 macro IS_SHAREDARRAYBUFFER(arg) = (%_ClassOf(arg) === 'SharedArrayBuffer');
 macro IS_STRING(arg)            = (typeof(arg) === 'string');
 macro IS_SYMBOL(arg)            = (typeof(arg) === 'symbol');
 macro IS_TYPEDARRAY(arg)        = (%_IsTypedArray(arg));
 macro IS_UNDEFINED(arg)         = (arg === (void 0));
-macro IS_WEAKMAP(arg)           = (%_ClassOf(arg) === 'WeakMap');
-macro IS_WEAKSET(arg)           = (%_ClassOf(arg) === 'WeakSet');
+macro IS_WEAKMAP(arg)           = (%_IsJSWeakMap(arg));
+macro IS_WEAKSET(arg)           = (%_IsJSWeakSet(arg));
 
 # Macro for ES queries of the type: "Type(O) is Object."
 macro IS_RECEIVER(arg) = (%_IsJSReceiver(arg));

src/runtime/runtime-collections.cc

@@ -325,5 +325,48 @@ RUNTIME_FUNCTION(Runtime_GetWeakSetValues) {
   CHECK(max_values >= 0);
   return *JSWeakCollection::GetEntries(holder, max_values);
 }
+
+RUNTIME_FUNCTION(Runtime_IsJSMap) {
+  SealHandleScope shs(isolate);
+  DCHECK_EQ(1, args.length());
+  CONVERT_ARG_CHECKED(Object, obj, 0);
+  return isolate->heap()->ToBoolean(obj->IsJSMap());
+}
+
+RUNTIME_FUNCTION(Runtime_IsJSSet) {
+  SealHandleScope shs(isolate);
+  DCHECK_EQ(1, args.length());
+  CONVERT_ARG_CHECKED(Object, obj, 0);
+  return isolate->heap()->ToBoolean(obj->IsJSSet());
+}
+
+RUNTIME_FUNCTION(Runtime_IsJSMapIterator) {
+  SealHandleScope shs(isolate);
+  DCHECK_EQ(1, args.length());
+  CONVERT_ARG_CHECKED(Object, obj, 0);
+  return isolate->heap()->ToBoolean(obj->IsJSMapIterator());
+}
+
+RUNTIME_FUNCTION(Runtime_IsJSSetIterator) {
+  SealHandleScope shs(isolate);
+  DCHECK_EQ(1, args.length());
+  CONVERT_ARG_CHECKED(Object, obj, 0);
+  return isolate->heap()->ToBoolean(obj->IsJSSetIterator());
+}
+
+RUNTIME_FUNCTION(Runtime_IsJSWeakMap) {
+  SealHandleScope shs(isolate);
+  DCHECK_EQ(1, args.length());
+  CONVERT_ARG_CHECKED(Object, obj, 0);
+  return isolate->heap()->ToBoolean(obj->IsJSWeakMap());
+}
+
+RUNTIME_FUNCTION(Runtime_IsJSWeakSet) {
+  SealHandleScope shs(isolate);
+  DCHECK_EQ(1, args.length());
+  CONVERT_ARG_CHECKED(Object, obj, 0);
+  return isolate->heap()->ToBoolean(obj->IsJSWeakSet());
+}
+
 }  // namespace internal
 }  // namespace v8

src/runtime/runtime.h

@@ -118,7 +118,13 @@ namespace internal {
   F(WeakCollectionHas, 3, 1)              \
   F(WeakCollectionDelete, 3, 1)           \
   F(WeakCollectionSet, 4, 1)              \
-  F(GetWeakSetValues, 2, 1)
+  F(GetWeakSetValues, 2, 1)               \
+  F(IsJSMap, 1, 1)                        \
+  F(IsJSSet, 1, 1)                        \
+  F(IsJSMapIterator, 1, 1)                \
+  F(IsJSSetIterator, 1, 1)                \
+  F(IsJSWeakMap, 1, 1)                    \
+  F(IsJSWeakSet, 1, 1)
 
 #define FOR_EACH_INTRINSIC_COMPILER(F)    \
   F(CompileLazy, 1, 1)                    \

test/inspector/inspector.status

@@ -20,6 +20,12 @@
   'debugger/set-blackbox-patterns': [SKIP],
 }],  # variant != default
 
+##############################################################################
+['variant == noturbofan', {
+  # Crashes due to missing source position in ToBooleanICStub?
+  'runtime/command-line-api': [SKIP],
+}],  # variant == noturbofan
+
 ##############################################################################
 ['variant == wasm_traps', {
   '*': [SKIP],