Revert change to always call builtins for Array functions.

It causes regressions on test shell tests.

TBR=antonm@chromium.org
Review URL: http://codereview.chromium.org/819001

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@4075 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

src/arm/stub-cache-arm.cc

@@ -916,6 +916,18 @@ Object* CallStubCompiler::CompileCallConstant(Object* object,
       break;
     }
 
+    case JSARRAY_HAS_FAST_ELEMENTS_CHECK:
+      CheckPrototypes(JSObject::cast(object), r1, holder, r3, r0, name, &miss);
+      // Make sure object->HasFastElements().
+      // Get the elements array of the object.
+      __ ldr(r3, FieldMemOperand(r1, JSObject::kElementsOffset));
+      // Check that the object is in fast mode (not dictionary).
+      __ ldr(r0, FieldMemOperand(r3, HeapObject::kMapOffset));
+      __ LoadRoot(ip, Heap::kFixedArrayMapRootIndex);
+      __ cmp(r0, ip);
+      __ b(ne, &miss);
+      break;
+
     default:
       UNREACHABLE();
   }

src/bootstrapper.cc

@@ -245,14 +245,11 @@ class Genesis BASE_EMBEDDED {
       bool make_prototype_enumerable = false);
   void MakeFunctionInstancePrototypeWritable();
 
-  Handle<JSFunction> MakeFunctionForBuiltin(Handle<String> name,
-                                            Handle<Code> code);
+  void AddSpecialFunction(Handle<JSObject> prototype,
+                          const char* name,
+                          Handle<Code> code);
 
-  void OverrideWithSpecialFunction(Handle<JSObject> prototype,
-                                   const char* name,
-                                   Handle<Code> code);
-
-  void InstallSpecialFunctions();
+  void BuildSpecialFunctionTable();
 
   static bool CompileBuiltin(int index);
   static bool CompileNative(Vector<const char> name, Handle<String> source);
@@ -780,6 +777,8 @@ void Genesis::CreateRoots(v8::Handle<v8::ObjectTemplate> global_template,
     delegate->shared()->DontAdaptArguments();
   }
 
+  global_context()->set_special_function_table(Heap::empty_fixed_array());
+
   // Initialize the out of memory slot.
   global_context()->set_out_of_memory(Heap::false_value());
 
@@ -1458,35 +1457,33 @@ void Genesis::MakeFunctionInstancePrototypeWritable() {
 }
 
 
-Handle<JSFunction> Genesis::MakeFunctionForBuiltin(Handle<String> name,
-                                                   Handle<Code> code) {
-  Handle<JSFunction> optimized = Factory::NewFunction(name,
-                                                      JS_OBJECT_TYPE,
-                                                      JSObject::kHeaderSize,
-                                                      code,
-                                                      false);
-  optimized->shared()->DontAdaptArguments();
-  return optimized;
-}
-
-
-void Genesis::OverrideWithSpecialFunction(Handle<JSObject> prototype,
-                                          const char* name,
-                                          Handle<Code> code) {
+void Genesis::AddSpecialFunction(Handle<JSObject> prototype,
+                                 const char* name,
+                                 Handle<Code> code) {
   Handle<String> key = Factory::LookupAsciiSymbol(name);
-  Handle<Object> old_value = GetProperty(prototype, key);
-  // Check if the function is present in the first place.
-  // For example, FLAG_natives_file could affect if Array functions
-  // are installed at all.
-  if (!old_value->IsJSFunction()) return;
-  int old_length = Handle<JSFunction>::cast(old_value)->shared()->length();
-  Handle<JSFunction> optimized = MakeFunctionForBuiltin(key, code);
-  optimized->shared()->set_length(old_length);
-  SetProperty(prototype, key, optimized, NONE);
+  Handle<Object> value = Handle<Object>(prototype->GetProperty(*key));
+  if (value->IsJSFunction()) {
+    Handle<JSFunction> optimized = Factory::NewFunction(key,
+                                                        JS_OBJECT_TYPE,
+                                                        JSObject::kHeaderSize,
+                                                        code,
+                                                        false);
+    optimized->shared()->DontAdaptArguments();
+    int len = global_context()->special_function_table()->length();
+    Handle<FixedArray> new_array = Factory::NewFixedArray(len + 3);
+    for (int index = 0; index < len; index++) {
+      new_array->set(index,
+                     global_context()->special_function_table()->get(index));
+    }
+    new_array->set(len+0, *prototype);
+    new_array->set(len+1, *value);
+    new_array->set(len+2, *optimized);
+    global_context()->set_special_function_table(*new_array);
+  }
 }
 
 
-void Genesis::InstallSpecialFunctions() {
+void Genesis::BuildSpecialFunctionTable() {
   HandleScope scope;
   Handle<JSObject> global = Handle<JSObject>(global_context()->global());
   // Add special versions for some Array.prototype functions.
@@ -1504,24 +1501,18 @@ void Genesis::InstallSpecialFunctions() {
   } else {
     special_prototype = visible_prototype;
   }
-  OverrideWithSpecialFunction(
-      special_prototype, "pop",
-      Handle<Code>(Builtins::builtin(Builtins::ArrayPop)));
-  OverrideWithSpecialFunction(
-      special_prototype, "push",
-      Handle<Code>(Builtins::builtin(Builtins::ArrayPush)));
-  OverrideWithSpecialFunction(
-      special_prototype, "shift",
-      Handle<Code>(Builtins::builtin(Builtins::ArrayShift)));
-  OverrideWithSpecialFunction(
-      special_prototype, "unshift",
-      Handle<Code>(Builtins::builtin(Builtins::ArrayUnshift)));
-  OverrideWithSpecialFunction(
-      special_prototype, "slice",
-      Handle<Code>(Builtins::builtin(Builtins::ArraySlice)));
-  OverrideWithSpecialFunction(
-      special_prototype, "splice",
-      Handle<Code>(Builtins::builtin(Builtins::ArraySplice)));
+  AddSpecialFunction(special_prototype, "pop",
+                     Handle<Code>(Builtins::builtin(Builtins::ArrayPop)));
+  AddSpecialFunction(special_prototype, "push",
+                     Handle<Code>(Builtins::builtin(Builtins::ArrayPush)));
+  AddSpecialFunction(special_prototype, "shift",
+                     Handle<Code>(Builtins::builtin(Builtins::ArrayShift)));
+  AddSpecialFunction(special_prototype, "unshift",
+                     Handle<Code>(Builtins::builtin(Builtins::ArrayUnshift)));
+  AddSpecialFunction(special_prototype, "slice",
+                     Handle<Code>(Builtins::builtin(Builtins::ArraySlice)));
+  AddSpecialFunction(special_prototype, "splice",
+                     Handle<Code>(Builtins::builtin(Builtins::ArraySplice)));
 }
 
 
@@ -1548,7 +1539,7 @@ Genesis::Genesis(Handle<Object> global_object,
   if (!InstallNatives()) return;
 
   MakeFunctionInstancePrototypeWritable();
-  InstallSpecialFunctions();
+  BuildSpecialFunctionTable();
 
   if (!ConfigureGlobalObjects(global_template)) return;
 

src/builtins.cc

@@ -319,24 +319,6 @@ static bool ArrayPrototypeHasNoElements() {
 }
 
 
-static bool IsJSArrayWithFastElements(Object* receiver,
-                                      FixedArray** elements) {
-  if (!receiver->IsJSArray()) {
-    return false;
-  }
-
-  JSArray* array = JSArray::cast(receiver);
-
-  HeapObject* elms = HeapObject::cast(array->elements());
-  if (elms->map() != Heap::fixed_array_map()) {
-    return false;
-  }
-
-  *elements = FixedArray::cast(elms);
-  return true;
-}
-
-
 static Object* CallJsBuiltin(const char* name,
                              BuiltinArguments<NO_EXTRA_ARGUMENTS> args) {
   HandleScope handleScope;
@@ -364,12 +346,8 @@ static Object* CallJsBuiltin(const char* name,
 
 
 BUILTIN(ArrayPush) {
-  Object* receiver = *args.receiver();
-  FixedArray* elms = NULL;
-  if (!IsJSArrayWithFastElements(receiver, &elms)) {
-    return CallJsBuiltin("ArrayPush", args);
-  }
-  JSArray* array = JSArray::cast(receiver);
+  JSArray* array = JSArray::cast(*args.receiver());
+  ASSERT(array->HasFastElements());
 
   int len = Smi::cast(array->length())->value();
   int to_add = args.length() - 1;
@@ -381,6 +359,7 @@ BUILTIN(ArrayPush) {
   ASSERT(to_add <= (Smi::kMaxValue - len));
 
   int new_length = len + to_add;
+  FixedArray* elms = FixedArray::cast(array->elements());
 
   if (new_length > elms->length()) {
     // New backing storage is needed.
@@ -411,17 +390,14 @@ BUILTIN(ArrayPush) {
 
 
 BUILTIN(ArrayPop) {
-  Object* receiver = *args.receiver();
-  FixedArray* elms = NULL;
-  if (!IsJSArrayWithFastElements(receiver, &elms)) {
-    return CallJsBuiltin("ArrayPop", args);
-  }
-  JSArray* array = JSArray::cast(receiver);
+  JSArray* array = JSArray::cast(*args.receiver());
+  ASSERT(array->HasFastElements());
 
   int len = Smi::cast(array->length())->value();
   if (len == 0) return Heap::undefined_value();
 
   // Get top element
+  FixedArray* elms = FixedArray::cast(array->elements());
   Object* top = elms->get(len - 1);
 
   // Set the length.
@@ -444,18 +420,18 @@ BUILTIN(ArrayPop) {
 
 
 BUILTIN(ArrayShift) {
-  Object* receiver = *args.receiver();
-  FixedArray* elms = NULL;
-  if (!IsJSArrayWithFastElements(receiver, &elms)
-      || !ArrayPrototypeHasNoElements()) {
+  if (!ArrayPrototypeHasNoElements()) {
     return CallJsBuiltin("ArrayShift", args);
   }
-  JSArray* array = JSArray::cast(receiver);
+
+  JSArray* array = JSArray::cast(*args.receiver());
   ASSERT(array->HasFastElements());
 
   int len = Smi::cast(array->length())->value();
   if (len == 0) return Heap::undefined_value();
 
+  FixedArray* elms = FixedArray::cast(array->elements());
+
   // Get first element
   Object* first = elms->get(0);
   if (first->IsTheHole()) {
@@ -475,13 +451,11 @@ BUILTIN(ArrayShift) {
 
 
 BUILTIN(ArrayUnshift) {
-  Object* receiver = *args.receiver();
-  FixedArray* elms = NULL;
-  if (!IsJSArrayWithFastElements(receiver, &elms)
-      || !ArrayPrototypeHasNoElements()) {
+  if (!ArrayPrototypeHasNoElements()) {
     return CallJsBuiltin("ArrayUnshift", args);
   }
-  JSArray* array = JSArray::cast(receiver);
+
+  JSArray* array = JSArray::cast(*args.receiver());
   ASSERT(array->HasFastElements());
 
   int len = Smi::cast(array->length())->value();
@@ -495,6 +469,8 @@ BUILTIN(ArrayUnshift) {
   // we should never hit this case.
   ASSERT(to_add <= (Smi::kMaxValue - len));
 
+  FixedArray* elms = FixedArray::cast(array->elements());
+
   if (new_length > elms->length()) {
     // New backing storage is needed.
     int capacity = new_length + (new_length >> 1) + 16;
@@ -527,13 +503,11 @@ BUILTIN(ArrayUnshift) {
 
 
 BUILTIN(ArraySlice) {
-  Object* receiver = *args.receiver();
-  FixedArray* elms = NULL;
-  if (!IsJSArrayWithFastElements(receiver, &elms)
-      || !ArrayPrototypeHasNoElements()) {
+  if (!ArrayPrototypeHasNoElements()) {
     return CallJsBuiltin("ArraySlice", args);
   }
-  JSArray* array = JSArray::cast(receiver);
+
+  JSArray* array = JSArray::cast(*args.receiver());
   ASSERT(array->HasFastElements());
 
   int len = Smi::cast(array->length())->value();
@@ -584,6 +558,8 @@ BUILTIN(ArraySlice) {
   if (result->IsFailure()) return result;
   FixedArray* result_elms = FixedArray::cast(result);
 
+  FixedArray* elms = FixedArray::cast(array->elements());
+
   AssertNoAllocation no_gc;
   CopyElements(&no_gc, result_elms, 0, elms, k, result_len);
 
@@ -597,13 +573,11 @@ BUILTIN(ArraySlice) {
 
 
 BUILTIN(ArraySplice) {
-  Object* receiver = *args.receiver();
-  FixedArray* elms = NULL;
-  if (!IsJSArrayWithFastElements(receiver, &elms)
-      || !ArrayPrototypeHasNoElements()) {
+  if (!ArrayPrototypeHasNoElements()) {
     return CallJsBuiltin("ArraySplice", args);
   }
-  JSArray* array = JSArray::cast(receiver);
+
+  JSArray* array = JSArray::cast(*args.receiver());
   ASSERT(array->HasFastElements());
 
   int len = Smi::cast(array->length())->value();
@@ -644,6 +618,8 @@ BUILTIN(ArraySplice) {
   }
   int actual_delete_count = Min(Max(delete_count, 0), len - actual_start);
 
+  FixedArray* elms = FixedArray::cast(array->elements());
+
   JSArray* result_array = NULL;
   if (actual_delete_count == 0) {
     Object* result = AllocateEmptyJSArray();

src/contexts.h

@@ -50,6 +50,12 @@ enum ContextLookupFlags {
 // must always be allocated via Heap::AllocateContext() or
 // Factory::NewContext.
 
+// Comment for special_function_table:
+// Table for providing optimized/specialized functions.
+// The array contains triplets [object, general_function, optimized_function].
+// Primarily added to support built-in optimized variants of
+// Array.prototype.{push,pop}.
+
 #define GLOBAL_CONTEXT_FIELDS(V) \
   V(GLOBAL_PROXY_INDEX, JSObject, global_proxy_object) \
   V(SECURITY_TOKEN_INDEX, Object, security_token) \
@@ -76,6 +82,7 @@ enum ContextLookupFlags {
   V(FUNCTION_MAP_INDEX, Map, function_map) \
   V(FUNCTION_INSTANCE_MAP_INDEX, Map, function_instance_map) \
   V(JS_ARRAY_MAP_INDEX, Map, js_array_map)\
+  V(SPECIAL_FUNCTION_TABLE_INDEX, FixedArray, special_function_table) \
   V(ARGUMENTS_BOILERPLATE_INDEX, JSObject, arguments_boilerplate) \
   V(MESSAGE_LISTENERS_INDEX, JSObject, message_listeners) \
   V(MAKE_MESSAGE_FUN_INDEX, JSFunction, make_message_fun) \
@@ -199,6 +206,7 @@ class Context: public FixedArray {
     GLOBAL_EVAL_FUN_INDEX,
     INSTANTIATE_FUN_INDEX,
     CONFIGURE_INSTANCE_FUN_INDEX,
+    SPECIAL_FUNCTION_TABLE_INDEX,
     MESSAGE_LISTENERS_INDEX,
     MAKE_MESSAGE_FUN_INDEX,
     GET_STACK_TRACE_LINE_INDEX,

src/ia32/stub-cache-ia32.cc

@@ -698,7 +698,8 @@ class CallInterceptorCompiler BASE_EMBEDDED {
 
     CallOptimization optimization(lookup);
 
-    if (optimization.is_constant_call()) {
+    if (optimization.is_constant_call() &&
+        !Top::CanHaveSpecialFunctions(holder)) {
       CompileCacheable(masm,
                        object,
                        receiver,
@@ -1332,6 +1333,18 @@ Object* CallStubCompiler::CompileCallConstant(Object* object,
       break;
     }
 
+    case JSARRAY_HAS_FAST_ELEMENTS_CHECK:
+      CheckPrototypes(JSObject::cast(object), edx, holder,
+                      ebx, eax, name, &miss);
+      // Make sure object->HasFastElements().
+      // Get the elements array of the object.
+      __ mov(ebx, FieldOperand(edx, JSObject::kElementsOffset));
+      // Check that the object is in fast mode (not dictionary).
+      __ cmp(FieldOperand(ebx, HeapObject::kMapOffset),
+             Immediate(Factory::fixed_array_map()));
+      __ j(not_equal, &miss, not_taken);
+      break;
+
     default:
       UNREACHABLE();
   }

src/ic.cc

@@ -458,6 +458,17 @@ Object* CallIC::LoadFunction(State state,
   ASSERT(result != Heap::the_hole_value());
 
   if (result->IsJSFunction()) {
+    // Check if there is an optimized (builtin) version of the function.
+    // Ignored this will degrade performance for some Array functions.
+    // Please note we only return the optimized function iff
+    // the JSObject has FastElements.
+    if (object->IsJSObject() && JSObject::cast(*object)->HasFastElements()) {
+      Object* opt = Top::LookupSpecialFunction(JSObject::cast(*object),
+                                               lookup.holder(),
+                                               JSFunction::cast(result));
+      if (opt->IsJSFunction()) return opt;
+    }
+
 #ifdef ENABLE_DEBUGGER_SUPPORT
     // Handle stepping into a function if step into is active.
     if (Debug::StepInActive()) {

src/stub-cache.cc

@@ -435,6 +435,14 @@ Object* StubCache::ComputeCallConstant(int argc,
                                     argc);
   Object* code = map->FindInCodeCache(name, flags);
   if (code->IsUndefined()) {
+    if (object->IsJSObject()) {
+      Object* opt =
+          Top::LookupSpecialFunction(JSObject::cast(object), holder, function);
+      if (opt->IsJSFunction()) {
+        check = StubCompiler::JSARRAY_HAS_FAST_ELEMENTS_CHECK;
+        function = JSFunction::cast(opt);
+      }
+    }
     // If the function hasn't been compiled yet, we cannot do it now
     // because it may cause GC. To avoid this issue, we return an
     // internal error which will make sure we do not update any

src/stub-cache.h

@@ -326,7 +326,8 @@ class StubCompiler BASE_EMBEDDED {
     RECEIVER_MAP_CHECK,
     STRING_CHECK,
     NUMBER_CHECK,
-    BOOLEAN_CHECK
+    BOOLEAN_CHECK,
+    JSARRAY_HAS_FAST_ELEMENTS_CHECK
   };
 
   StubCompiler() : scope_(), masm_(NULL, 256), failure_(NULL) { }

src/top.cc

@@ -950,6 +950,27 @@ Handle<Context> Top::GetCallingGlobalContext() {
 }
 
 
+bool Top::CanHaveSpecialFunctions(JSObject* object) {
+  return object->IsJSArray();
+}
+
+
+Object* Top::LookupSpecialFunction(JSObject* receiver,
+                                   JSObject* prototype,
+                                   JSFunction* function) {
+  if (CanHaveSpecialFunctions(receiver)) {
+    FixedArray* table = context()->global_context()->special_function_table();
+    for (int index = 0; index < table->length(); index +=3) {
+      if ((prototype == table->get(index)) &&
+          (function == table->get(index+1))) {
+        return table->get(index+2);
+      }
+    }
+  }
+  return Heap::undefined_value();
+}
+
+
 char* Top::ArchiveThread(char* to) {
   memcpy(to, reinterpret_cast<char*>(&thread_local_), sizeof(thread_local_));
   InitializeThreadLocal();

src/top.h

@@ -342,6 +342,11 @@ class Top {
     return Handle<JSBuiltinsObject>(thread_local_.context_->builtins());
   }
 
+  static bool CanHaveSpecialFunctions(JSObject* object);
+  static Object* LookupSpecialFunction(JSObject* receiver,
+                                       JSObject* prototype,
+                                       JSFunction* value);
+
   static void RegisterTryCatchHandler(v8::TryCatch* that);
   static void UnregisterTryCatchHandler(v8::TryCatch* that);
 

src/x64/stub-cache-x64.cc

@@ -759,6 +759,18 @@ Object* CallStubCompiler::CompileCallConstant(Object* object,
       break;
     }
 
+    case JSARRAY_HAS_FAST_ELEMENTS_CHECK:
+      CheckPrototypes(JSObject::cast(object), rdx, holder,
+                      rbx, rax, name, &miss);
+      // Make sure object->HasFastElements().
+      // Get the elements array of the object.
+      __ movq(rbx, FieldOperand(rdx, JSObject::kElementsOffset));
+      // Check that the object is in fast mode (not dictionary).
+      __ Cmp(FieldOperand(rbx, HeapObject::kMapOffset),
+             Factory::fixed_array_map());
+      __ j(not_equal, &miss);
+      break;
+
     default:
       UNREACHABLE();
   }

test/cctest/test-serialize.cc

@@ -283,6 +283,7 @@ static void SanityCheck() {
 #endif
   CHECK(Top::global()->IsJSObject());
   CHECK(Top::global_context()->IsContext());
+  CHECK(Top::special_function_table()->IsFixedArray());
   CHECK(Heap::symbol_table()->IsSymbolTable());
   CHECK(!Factory::LookupAsciiSymbol("Empty")->IsFailure());
 }