[turbofan] Migrate collections to JSCallReducer

Bug: v8:7340, v8:7250
Change-Id: I57f78fa5ad261f041b66986918c427821a57a6e1
Reviewed-on: https://chromium-review.googlesource.com/995472Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52356}

src/compiler/js-builtin-reducer.h

@@ -42,15 +42,6 @@ class V8_EXPORT_PRIVATE JSBuiltinReducer final
   Reduction ReduceTypedArrayToStringTag(Node* node);
   Reduction ReduceArrayIsArray(Node* node);
 
-  Reduction ReduceCollectionIterator(Node* node,
-                                     InstanceType collection_instance_type,
-                                     int collection_iterator_map_index);
-  Reduction ReduceCollectionSize(Node* node,
-                                 InstanceType collection_instance_type);
-  Reduction ReduceCollectionIteratorNext(
-      Node* node, int entry_size, Handle<HeapObject> empty_collection,
-      InstanceType collection_iterator_instance_type_first,
-      InstanceType collection_iterator_instance_type_last);
   Reduction ReduceDateNow(Node* node);
   Reduction ReduceDateGetTime(Node* node);
   Reduction ReduceGlobalIsFinite(Node* node);

src/compiler/js-call-reducer.h

@@ -158,6 +158,15 @@ class V8_EXPORT_PRIVATE JSCallReducer final : public AdvancedReducer {
 
   Reduction ReduceMapPrototypeHas(Node* node);
   Reduction ReduceMapPrototypeGet(Node* node);
+  Reduction ReduceCollectionIteration(Node* node,
+                                      CollectionKind collection_kind,
+                                      IterationKind iteration_kind);
+  Reduction ReduceCollectionPrototypeSize(Node* node,
+                                          CollectionKind collection_kind);
+  Reduction ReduceCollectionIteratorPrototypeNext(
+      Node* node, int entry_size, Handle<HeapObject> empty_collection,
+      InstanceType collection_iterator_instance_type_first,
+      InstanceType collection_iterator_instance_type_last);
 
   // Returns the updated {to} node, and updates control and effect along the
   // way.

src/compiler/js-create-lowering.cc

@@ -143,6 +143,8 @@ Reduction JSCreateLowering::Reduce(Node* node) {
       return ReduceJSCreateBoundFunction(node);
     case IrOpcode::kJSCreateClosure:
       return ReduceJSCreateClosure(node);
+    case IrOpcode::kJSCreateCollectionIterator:
+      return ReduceJSCreateCollectionIterator(node);
     case IrOpcode::kJSCreateIterResultObject:
       return ReduceJSCreateIterResultObject(node);
     case IrOpcode::kJSCreateStringIterator:
@@ -911,6 +913,69 @@ Reduction JSCreateLowering::ReduceJSCreateArrayIterator(Node* node) {
   return Changed(node);
 }
 
+namespace {
+
+Context::Field ContextFieldForCollectionIterationKind(
+    CollectionKind collection_kind, IterationKind iteration_kind) {
+  switch (collection_kind) {
+    case CollectionKind::kSet:
+      switch (iteration_kind) {
+        case IterationKind::kKeys:
+          UNREACHABLE();
+        case IterationKind::kValues:
+          return Context::SET_VALUE_ITERATOR_MAP_INDEX;
+        case IterationKind::kEntries:
+          return Context::SET_KEY_VALUE_ITERATOR_MAP_INDEX;
+      }
+      break;
+    case CollectionKind::kMap:
+      switch (iteration_kind) {
+        case IterationKind::kKeys:
+          return Context::MAP_KEY_ITERATOR_MAP_INDEX;
+        case IterationKind::kValues:
+          return Context::MAP_VALUE_ITERATOR_MAP_INDEX;
+        case IterationKind::kEntries:
+          return Context::MAP_KEY_VALUE_ITERATOR_MAP_INDEX;
+      }
+      break;
+  }
+  UNREACHABLE();
+}
+
+}  // namespace
+
+Reduction JSCreateLowering::ReduceJSCreateCollectionIterator(Node* node) {
+  DCHECK_EQ(IrOpcode::kJSCreateCollectionIterator, node->opcode());
+  CreateCollectionIteratorParameters const& p =
+      CreateCollectionIteratorParametersOf(node->op());
+  Node* iterated_object = NodeProperties::GetValueInput(node, 0);
+  Node* effect = NodeProperties::GetEffectInput(node);
+  Node* control = NodeProperties::GetControlInput(node);
+
+  // Load the OrderedHashTable from the {receiver}.
+  Node* table = effect = graph()->NewNode(
+      simplified()->LoadField(AccessBuilder::ForJSCollectionTable()),
+      iterated_object, effect, control);
+
+  // Create the JSArrayIterator result.
+  AllocationBuilder a(jsgraph(), effect, control);
+  a.Allocate(JSCollectionIterator::kSize, NOT_TENURED, Type::OtherObject());
+  a.Store(AccessBuilder::ForMap(),
+          handle(native_context()->get(ContextFieldForCollectionIterationKind(
+                     p.collection_kind(), p.iteration_kind())),
+                 isolate()));
+  a.Store(AccessBuilder::ForJSObjectPropertiesOrHash(),
+          jsgraph()->EmptyFixedArrayConstant());
+  a.Store(AccessBuilder::ForJSObjectElements(),
+          jsgraph()->EmptyFixedArrayConstant());
+  a.Store(AccessBuilder::ForJSCollectionIteratorTable(), table);
+  a.Store(AccessBuilder::ForJSCollectionIteratorIndex(),
+          jsgraph()->ZeroConstant());
+  RelaxControls(node);
+  a.FinishAndChange(node);
+  return Changed(node);
+}
+
 Reduction JSCreateLowering::ReduceJSCreateBoundFunction(Node* node) {
   DCHECK_EQ(IrOpcode::kJSCreateBoundFunction, node->opcode());
   CreateBoundFunctionParameters const& p =

src/compiler/js-create-lowering.h

@@ -51,6 +51,7 @@ class V8_EXPORT_PRIVATE JSCreateLowering final
   Reduction ReduceJSCreateArguments(Node* node);
   Reduction ReduceJSCreateArray(Node* node);
   Reduction ReduceJSCreateArrayIterator(Node* node);
+  Reduction ReduceJSCreateCollectionIterator(Node* node);
   Reduction ReduceJSCreateBoundFunction(Node* node);
   Reduction ReduceJSCreateClosure(Node* node);
   Reduction ReduceJSCreateIterResultObject(Node* node);

src/compiler/js-generic-lowering.cc

@@ -381,6 +381,10 @@ void JSGenericLowering::LowerJSCreateArrayIterator(Node* node) {
   UNREACHABLE();  // Eliminated in typed lowering.
 }
 
+void JSGenericLowering::LowerJSCreateCollectionIterator(Node* node) {
+  UNREACHABLE();  // Eliminated in typed lowering.
+}
+
 void JSGenericLowering::LowerJSCreateBoundFunction(Node* node) {
   UNREACHABLE();  // Eliminated in typed lowering.
 }

src/compiler/js-operator.cc

@@ -442,6 +442,33 @@ const CreateArrayIteratorParameters& CreateArrayIteratorParametersOf(
   return OpParameter<CreateArrayIteratorParameters>(op);
 }
 
+bool operator==(CreateCollectionIteratorParameters const& lhs,
+                CreateCollectionIteratorParameters const& rhs) {
+  return lhs.collection_kind() == rhs.collection_kind() &&
+         lhs.iteration_kind() == rhs.iteration_kind();
+}
+
+bool operator!=(CreateCollectionIteratorParameters const& lhs,
+                CreateCollectionIteratorParameters const& rhs) {
+  return !(lhs == rhs);
+}
+
+size_t hash_value(CreateCollectionIteratorParameters const& p) {
+  return base::hash_combine(static_cast<size_t>(p.collection_kind()),
+                            static_cast<size_t>(p.iteration_kind()));
+}
+
+std::ostream& operator<<(std::ostream& os,
+                         CreateCollectionIteratorParameters const& p) {
+  return os << p.collection_kind() << " " << p.iteration_kind();
+}
+
+const CreateCollectionIteratorParameters& CreateCollectionIteratorParametersOf(
+    const Operator* op) {
+  DCHECK_EQ(IrOpcode::kJSCreateCollectionIterator, op->opcode());
+  return OpParameter<CreateCollectionIteratorParameters>(op);
+}
+
 bool operator==(CreateBoundFunctionParameters const& lhs,
                 CreateBoundFunctionParameters const& rhs) {
   return lhs.arity() == rhs.arity() &&
@@ -1105,6 +1132,15 @@ const Operator* JSOperatorBuilder::CreateArrayIterator(IterationKind kind) {
       parameters);                                                // parameter
 }
 
+const Operator* JSOperatorBuilder::CreateCollectionIterator(
+    CollectionKind collection_kind, IterationKind iteration_kind) {
+  CreateCollectionIteratorParameters parameters(collection_kind,
+                                                iteration_kind);
+  return new (zone()) Operator1<CreateCollectionIteratorParameters>(
+      IrOpcode::kJSCreateCollectionIterator, Operator::kEliminatable,
+      "JSCreateCollectionIterator", 1, 1, 1, 1, 1, 0, parameters);
+}
+
 const Operator* JSOperatorBuilder::CreateBoundFunction(size_t arity,
                                                        Handle<Map> map) {
   // bound_target_function, bound_this, arg1, ..., argN

src/compiler/js-operator.h

@@ -526,6 +526,38 @@ std::ostream& operator<<(std::ostream&, CreateArrayIteratorParameters const&);
 const CreateArrayIteratorParameters& CreateArrayIteratorParametersOf(
     const Operator* op);
 
+// Defines shared information for the array iterator that should be created.
+// This is used as parameter by JSCreateCollectionIterator operators.
+class CreateCollectionIteratorParameters final {
+ public:
+  explicit CreateCollectionIteratorParameters(CollectionKind collection_kind,
+                                              IterationKind iteration_kind)
+      : collection_kind_(collection_kind), iteration_kind_(iteration_kind) {
+    CHECK(!(collection_kind == CollectionKind::kSet &&
+            iteration_kind == IterationKind::kKeys));
+  }
+
+  CollectionKind collection_kind() const { return collection_kind_; }
+  IterationKind iteration_kind() const { return iteration_kind_; }
+
+ private:
+  CollectionKind const collection_kind_;
+  IterationKind const iteration_kind_;
+};
+
+bool operator==(CreateCollectionIteratorParameters const&,
+                CreateCollectionIteratorParameters const&);
+bool operator!=(CreateCollectionIteratorParameters const&,
+                CreateCollectionIteratorParameters const&);
+
+size_t hash_value(CreateCollectionIteratorParameters const&);
+
+std::ostream& operator<<(std::ostream&,
+                         CreateCollectionIteratorParameters const&);
+
+const CreateCollectionIteratorParameters& CreateCollectionIteratorParametersOf(
+    const Operator* op);
+
 // Defines shared information for the bound function that should be created.
 // This is used as parameter by JSCreateBoundFunction operators.
 class CreateBoundFunctionParameters final {
@@ -686,6 +718,7 @@ class V8_EXPORT_PRIVATE JSOperatorBuilder final
   const Operator* CreateArguments(CreateArgumentsType type);
   const Operator* CreateArray(size_t arity, Handle<AllocationSite> site);
   const Operator* CreateArrayIterator(IterationKind);
+  const Operator* CreateCollectionIterator(CollectionKind, IterationKind);
   const Operator* CreateBoundFunction(size_t arity, Handle<Map> map);
   const Operator* CreateClosure(Handle<SharedFunctionInfo> shared_info,
                                 Handle<FeedbackCell> feedback_cell,

src/compiler/opcodes.h

@@ -139,6 +139,7 @@
   V(JSCreateArrayIterator)      \
   V(JSCreateBoundFunction)      \
   V(JSCreateClosure)            \
+  V(JSCreateCollectionIterator) \
   V(JSCreateGeneratorObject)    \
   V(JSCreateIterResultObject)   \
   V(JSCreateStringIterator)     \

src/compiler/typer.cc

@@ -1212,6 +1212,10 @@ Type* Typer::Visitor::TypeJSCreateArrayIterator(Node* node) {
   return Type::OtherObject();
 }
 
+Type* Typer::Visitor::TypeJSCreateCollectionIterator(Node* node) {
+  return Type::OtherObject();
+}
+
 Type* Typer::Visitor::TypeJSCreateBoundFunction(Node* node) {
   return Type::BoundFunction();
 }

src/compiler/verifier.cc

@@ -669,6 +669,10 @@ void Verifier::Visitor::Check(Node* node, const AllNodes& all) {
       // Type is OtherObject.
       CheckTypeIs(node, Type::OtherObject());
       break;
+    case IrOpcode::kJSCreateCollectionIterator:
+      // Type is OtherObject.
+      CheckTypeIs(node, Type::OtherObject());
+      break;
     case IrOpcode::kJSCreateBoundFunction:
       // Type is BoundFunction.
       CheckTypeIs(node, Type::BoundFunction());

src/globals.h

@@ -1370,6 +1370,18 @@ inline std::ostream& operator<<(std::ostream& os, IterationKind kind) {
   UNREACHABLE();
 }
 
+enum class CollectionKind { kMap, kSet };
+
+inline std::ostream& operator<<(std::ostream& os, CollectionKind kind) {
+  switch (kind) {
+    case CollectionKind::kMap:
+      return os << "CollectionKind::kMap";
+    case CollectionKind::kSet:
+      return os << "CollectionKind::kSet";
+  }
+  UNREACHABLE();
+}
+
 // Flags for the runtime function kDefineDataPropertyInLiteral. A property can
 // be enumerable or not, and, in case of functions, the function name
 // can be set or not.