[maglev] Implement StoreField

Bug: v8:7700
Change-Id: I5827612419b938758b25d1f504e4576016583d4c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3497364Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Auto-Submit: Victor Gomes <victorgomes@chromium.org>
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79404}

src/maglev/maglev-graph-builder.cc

@@ -101,17 +101,12 @@ MAGLEV_UNIMPLEMENTED_BYTECODE(StaLookupSlot)
 void MaglevGraphBuilder::VisitLdaNamedProperty() {
   // LdaNamedProperty <object> <name_index> <slot>
   ValueNode* object = LoadRegister(0);
-
-  // TODO(leszeks): Use JSHeapBroker here.
-  FeedbackNexus nexus(feedback().object() /* TODO(v8:7700) */,
-                      GetSlotOperand(2));
+  FeedbackNexus nexus = feedback_nexus(2);
 
   if (nexus.ic_state() == InlineCacheState::UNINITIALIZED) {
     EnsureCheckpoint();
     AddNewNode<SoftDeopt>({});
-  }
-
-  if (nexus.ic_state() == InlineCacheState::MONOMORPHIC) {
+  } else if (nexus.ic_state() == InlineCacheState::MONOMORPHIC) {
     std::vector<MapAndHandler> maps_and_handlers;
     nexus.ExtractMapsAndHandlers(&maps_and_handlers);
     DCHECK_EQ(maps_and_handlers.size(), 1);
@@ -139,7 +134,38 @@ MAGLEV_UNIMPLEMENTED_BYTECODE(LdaNamedPropertyFromSuper)
 MAGLEV_UNIMPLEMENTED_BYTECODE(LdaKeyedProperty)
 MAGLEV_UNIMPLEMENTED_BYTECODE(LdaModuleVariable)
 MAGLEV_UNIMPLEMENTED_BYTECODE(StaModuleVariable)
-MAGLEV_UNIMPLEMENTED_BYTECODE(StaNamedProperty)
+
+void MaglevGraphBuilder::VisitStaNamedProperty() {
+  // StaNamedProperty <object> <name_index> <slot>
+  ValueNode* object = LoadRegister(0);
+  FeedbackNexus nexus = feedback_nexus(2);
+
+  if (nexus.ic_state() == InlineCacheState::UNINITIALIZED) {
+    EnsureCheckpoint();
+    AddNewNode<SoftDeopt>({});
+  } else if (nexus.ic_state() == InlineCacheState::MONOMORPHIC) {
+    std::vector<MapAndHandler> maps_and_handlers;
+    nexus.ExtractMapsAndHandlers(&maps_and_handlers);
+    DCHECK_EQ(maps_and_handlers.size(), 1);
+    MapAndHandler& map_and_handler = maps_and_handlers[0];
+    if (map_and_handler.second->IsSmi()) {
+      int handler = map_and_handler.second->ToSmi().value();
+      StoreHandler::Kind kind = StoreHandler::KindBits::decode(handler);
+      if (kind == StoreHandler::Kind::kField) {
+        EnsureCheckpoint();
+        AddNewNode<CheckMaps>({object},
+                              MakeRef(broker(), map_and_handler.first));
+        ValueNode* value = GetAccumulator();
+        AddNewNode<StoreField>({object, value}, handler);
+        return;
+      }
+    }
+  }
+
+  // TODO(victorgomes): Generic store.
+  UNREACHABLE();
+}
+
 MAGLEV_UNIMPLEMENTED_BYTECODE(StaNamedOwnProperty)
 MAGLEV_UNIMPLEMENTED_BYTECODE(StaKeyedProperty)
 MAGLEV_UNIMPLEMENTED_BYTECODE(StaKeyedPropertyAsDefine)

src/maglev/maglev-graph-builder.h

@@ -237,7 +237,7 @@ class MaglevGraphBuilder {
         interpreter::Register::current_context());
   }
 
-  FeedbackSlot GetSlotOperand(int operand_index) {
+  FeedbackSlot GetSlotOperand(int operand_index) const {
     return iterator_.GetSlotOperand(operand_index);
   }
 
@@ -399,6 +399,11 @@ class MaglevGraphBuilder {
   const compiler::FeedbackVectorRef& feedback() const {
     return compilation_unit_->feedback;
   }
+  const FeedbackNexus feedback_nexus(int slot_operand_index) const {
+    // TODO(leszeks): Use JSHeapBroker here.
+    return FeedbackNexus(feedback().object(),
+                         GetSlotOperand(slot_operand_index));
+  }
   const compiler::BytecodeArrayRef& bytecode() const {
     return compilation_unit_->bytecode;
   }

src/maglev/maglev-ir.cc

@@ -588,6 +588,32 @@ void LoadField::PrintParams(std::ostream& os,
   os << "(" << std::hex << handler() << std::dec << ")";
 }
 
+void StoreField::AllocateVreg(MaglevVregAllocationState* vreg_state,
+                              const ProcessingState& state) {
+  UseRegister(object_input());
+  UseRegister(value_input());
+}
+void StoreField::GenerateCode(MaglevCodeGenState* code_gen_state,
+                              const ProcessingState& state) {
+  Register object = ToRegister(object_input());
+  Register value = ToRegister(value_input());
+
+  if (StoreHandler::IsInobjectBits::decode(this->handler())) {
+    Operand operand = FieldOperand(
+        object,
+        StoreHandler::FieldIndexBits::decode(this->handler()) * kTaggedSize);
+    __ StoreTaggedField(operand, value);
+  } else {
+    // TODO(victorgomes): Out-of-object properties.
+    UNREACHABLE();
+  }
+}
+
+void StoreField::PrintParams(std::ostream& os,
+                             MaglevGraphLabeller* graph_labeller) const {
+  os << "(" << std::hex << handler() << std::dec << ")";
+}
+
 void LoadNamedGeneric::AllocateVreg(MaglevVregAllocationState* vreg_state,
                                     const ProcessingState& state) {
   using D = LoadNoFeedbackDescriptor;

src/maglev/maglev-ir.h

@@ -57,9 +57,10 @@ class MaglevVregAllocationState;
 #define NODE_LIST(V) \
   V(Checkpoint)      \
   V(CheckMaps)       \
+  V(GapMove)         \
   V(SoftDeopt)       \
+  V(StoreField)      \
   V(StoreToFrame)    \
-  V(GapMove)         \
   VALUE_NODE_LIST(V)
 
 #define CONDITIONAL_CONTROL_NODE_LIST(V) \
@@ -902,6 +903,28 @@ class LoadField : public FixedInputValueNodeT<1, LoadField> {
   const int handler_;
 };
 
+class StoreField : public FixedInputNodeT<2, StoreField> {
+  using Base = FixedInputNodeT<2, StoreField>;
+
+ public:
+  explicit StoreField(size_t input_count, int handler)
+      : Base(input_count), handler_(handler) {}
+
+  int handler() const { return handler_; }
+
+  static constexpr int kObjectIndex = 0;
+  static constexpr int kValueIndex = 1;
+  Input& object_input() { return input(kObjectIndex); }
+  Input& value_input() { return input(kValueIndex); }
+
+  void AllocateVreg(MaglevVregAllocationState*, const ProcessingState&);
+  void GenerateCode(MaglevCodeGenState*, const ProcessingState&);
+  void PrintParams(std::ostream&, MaglevGraphLabeller*) const;
+
+ private:
+  const int handler_;
+};
+
 class LoadGlobal : public FixedInputValueNodeT<1, LoadGlobal> {
   using Base = FixedInputValueNodeT<1, LoadGlobal>;
 

test/mjsunit/maglev/17.js

+// Copyright 2022 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+// Flags: --allow-natives-syntax
+
+function setA(o, val) {
+  o.a = val;
+}
+
+function Foo() {
+  this.a = 0;
+}
+
+var foo = new Foo();
+
+%PrepareFunctionForOptimization(setA);
+
+setA(foo, 1);
+assertEquals(foo.a, 1);
+setA(foo, 2);
+assertEquals(foo.a, 2);
+
+%OptimizeMaglevOnNextCall(setA);
+
+setA(foo, 42);
+assertEquals(foo.a, 42);