[csa] Add LoadPropertyArrayElement

Bug: v8:7732
Change-Id: Id7f28e6975a4180573da3981e3e6de312e39f785
Reviewed-on: https://chromium-review.googlesource.com/1049485Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53169}

src/code-stub-assembler.cc

@@ -1798,9 +1798,27 @@ TNode<MaybeObject> CodeStubAssembler::LoadArrayElement(
   TNode<IntPtrT> offset = ElementOffsetFromIndex(index_node, HOLEY_ELEMENTS,
                                                  parameter_mode, header_size);
   STATIC_ASSERT(FixedArrayBase::kLengthOffset == WeakFixedArray::kLengthOffset);
+  STATIC_ASSERT(FixedArrayBase::kLengthOffset ==
+                PropertyArray::kLengthAndHashOffset);
   // Check that index_node + additional_offset <= object.length.
   // TODO(cbruni): Use proper LoadXXLength helpers
-  // TODO(cbruni): Re-add bounds check here.
+  CSA_SLOW_ASSERT(
+      this,
+      IsOffsetInBounds(
+          offset,
+          Select<IntPtrT>(
+              IsPropertyArray(array),
+              [=] {
+                TNode<IntPtrT> length_and_hash = LoadAndUntagObjectField(
+                    array, PropertyArray::kLengthAndHashOffset);
+                return TNode<IntPtrT>::UncheckedCast(
+                    DecodeWord<PropertyArray::LengthField>(length_and_hash));
+              },
+              [=] {
+                return LoadAndUntagObjectField(array,
+                                               FixedArrayBase::kLengthOffset);
+              }),
+          FixedArray::kHeaderSize));
   return UncheckedCast<MaybeObject>(
       Load(MachineType::AnyTagged(), array, offset, needs_poisoning));
 }
@@ -1817,6 +1835,18 @@ TNode<Object> CodeStubAssembler::LoadFixedArrayElement(
                                    needs_poisoning));
 }
 
+TNode<Object> CodeStubAssembler::LoadPropertyArrayElement(
+    SloppyTNode<PropertyArray> object, SloppyTNode<IntPtrT> index) {
+  int additional_offset = 0;
+  ParameterMode parameter_mode = INTPTR_PARAMETERS;
+  LoadSensitivity needs_poisoning = LoadSensitivity::kSafe;
+  STATIC_ASSERT(PropertyArray::kHeaderSize == FixedArray::kHeaderSize);
+
+  return ToObject(LoadArrayElement(object, PropertyArray::kHeaderSize, index,
+                                   additional_offset, parameter_mode,
+                                   needs_poisoning));
+}
+
 TNode<RawPtrT> CodeStubAssembler::LoadFixedTypedArrayBackingStore(
     TNode<FixedTypedArrayBase> typed_array) {
   // Backing store = external_pointer + base_pointer.
@@ -7648,7 +7678,7 @@ void CodeStubAssembler::LoadPropertyFromFastObject(Node* object, Node* map,
       Comment("if_backing_store");
       Node* properties = LoadFastProperties(object);
       field_index = IntPtrSub(field_index, instance_size_in_words);
-      Node* value = LoadFixedArrayElement(properties, field_index);
+      Node* value = LoadPropertyArrayElement(properties, field_index);
 
       Label if_double(this), if_tagged(this);
       Branch(Word32NotEqual(representation,
@@ -8310,6 +8340,7 @@ TNode<IntPtrT> CodeStubAssembler::ElementOffsetFromIndex(Node* index_node,
                                                          ElementsKind kind,
                                                          ParameterMode mode,
                                                          int base_size) {
+  CSA_SLOW_ASSERT(this, MatchesParameterMode(index_node, mode));
   int element_size_shift = ElementsKindToShiftSize(kind);
   int element_size = 1 << element_size_shift;
   int const kSmiShiftBits = kSmiShiftSize + kSmiTagSize;

src/code-stub-assembler.h

@@ -695,7 +695,7 @@ class V8_EXPORT_PRIVATE CodeStubAssembler : public compiler::CodeAssembler {
 
   TNode<MaybeObject> MakeWeak(TNode<HeapObject> value);
 
-  // Load an array element from a FixedArray / WeakFixedArray.
+  // Load an array element from a FixedArray / WeakFixedArray / PropertyArray.
   TNode<MaybeObject> LoadArrayElement(
       SloppyTNode<HeapObject> object, int array_header_size, Node* index,
       int additional_offset = 0,
@@ -735,6 +735,9 @@ class V8_EXPORT_PRIVATE CodeStubAssembler : public compiler::CodeAssembler {
     return LoadFixedArrayElement(object, index, 0, SMI_PARAMETERS);
   }
 
+  TNode<Object> LoadPropertyArrayElement(SloppyTNode<PropertyArray> object,
+                                         SloppyTNode<IntPtrT> index);
+
   // Load an array element from a FixedArray / WeakFixedArray, untag it and
   // return it as Word32.
   TNode<Int32T> LoadAndUntagToWord32ArrayElement(

src/ic/accessor-assembler.cc

@@ -1133,7 +1133,7 @@ void AccessorAssembler::OverwriteExistingFastDataProperty(
         BIND(&double_rep);
         {
           Node* mutable_heap_number =
-              LoadFixedArrayElement(properties, backing_store_index);
+              LoadPropertyArrayElement(properties, backing_store_index);
           Node* double_value = ChangeNumberToFloat64(value);
           StoreHeapNumberValue(mutable_heap_number, double_value);
           Goto(&done);