[turbofan] Constant-fold keyed loads of sealed properties.

We can constant-fold JSLoadProperty(o, i) when o is a known object (i.e.
TurboFan's context specialization provides a known non-null/-undefined
constant value for it), i is a known array index and o["i"] is an
element on the receiver, that is non-configurable and non-writable (i.e.
o was frozen using Object.freeze earlier, or o is a String object).

This significantly reduces execution time of the tagged templates
micro-benchmarks (ES6 and Babel transpiled), when combined with the
CL https://chromium-review.googlesource.com/c/v8/v8/+/677462, it goes
from

  templateStringTagES5: 4552 ms.
  templateStringTagES6: 14185 ms.
  templateStringTagBabel: 7626 ms.

to

  templateStringTagES5: 4550 ms.
  templateStringTagES6: 616 ms.
  templateStringTagBabel: 589 ms.

so overall a solid 23x improvement on the ES6 benchmark. This is
representative of the six-speed-templatestringtag-es6 benchmark.

Bug: v8:6819, v8:6820, v8:6831
Change-Id: Ia45fbdf92977bfbe7400cfa60bd362b78086dc26
Reviewed-on: https://chromium-review.googlesource.com/677603Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48131}

src/compiler/js-native-context-specialization.cc

@@ -1255,24 +1255,34 @@ Reduction JSNativeContextSpecialization::ReduceKeyedAccess(
   Node* effect = NodeProperties::GetEffectInput(node);
   Node* control = NodeProperties::GetControlInput(node);
 
-  // Optimize access for constant {receiver}.
+  // Optimize the case where we load from a constant {receiver}.
+  if (access_mode == AccessMode::kLoad) {
     HeapObjectMatcher mreceiver(receiver);
-  if (mreceiver.HasValue() && mreceiver.Value()->IsString()) {
-    Handle<String> string = Handle<String>::cast(mreceiver.Value());
-
-    // Strings are immutable in JavaScript.
-    if (access_mode == AccessMode::kStore) return NoChange();
-
-    // Properly deal with constant {index}.
+    if (mreceiver.HasValue() &&
+        !mreceiver.Value()->IsNullOrUndefined(isolate())) {
+      // Check whether we're accessing a known element on the {receiver}
+      // that is non-configurable, non-writable (i.e. the {receiver} was
+      // frozen using Object.freeze).
       NumberMatcher mindex(index);
-    if (mindex.IsInteger() && mindex.IsInRange(0.0, string->length() - 1)) {
-      // Constant-fold the {index} access to {string}.
-      Node* value = jsgraph()->HeapConstant(
-          factory()->LookupSingleCharacterStringFromCode(
-              string->Get(static_cast<int>(mindex.Value()))));
+      if (mindex.IsInteger() && mindex.IsInRange(0.0, kMaxUInt32)) {
+        LookupIterator it(isolate(), mreceiver.Value(),
+                          static_cast<uint32_t>(mindex.Value()),
+                          LookupIterator::OWN);
+        if (it.state() == LookupIterator::DATA && it.IsReadOnly() &&
+            !it.IsConfigurable()) {
+          // We can safely constant-fold the {index} access to {receiver},
+          // since the element is non-configurable, non-writable and thus
+          // cannot change anymore.
+          value = jsgraph()->Constant(it.GetDataValue());
           ReplaceWithValue(node, value, effect, control);
           return Replace(value);
         }
+      }
+
+      // For constant Strings we can eagerly strength-reduce the keyed
+      // accesses using the known length, which doesn't change.
+      if (mreceiver.Value()->IsString()) {
+        Handle<String> string = Handle<String>::cast(mreceiver.Value());
 
         // We can only assume that the {index} is a valid array index if the IC
         // is in element access mode and not MEGAMORPHIC, otherwise there's no
@@ -1283,13 +1293,16 @@ Reduction JSNativeContextSpecialization::ReduceKeyedAccess(
           index = effect = graph()->NewNode(simplified()->CheckBounds(), index,
                                             length, effect, control);
 
-      // Return the character from the {receiver} as single character string.
-      value = graph()->NewNode(simplified()->StringCharAt(), receiver, index,
-                               control);
+          // Return the character from the {receiver} as single character
+          // string.
+          value = graph()->NewNode(simplified()->StringCharAt(), receiver,
+                                   index, control);
           ReplaceWithValue(node, value, effect, control);
           return Replace(value);
         }
       }
+    }
+  }
 
   // Check if the {nexus} reports type feedback for the IC.
   if (nexus.IsUninitialized()) {