[turbofan] Make code and comment match in FastFunctionPrototypeBind

Additionally, used number of own descriptors in both CSA and the
reduction of Function.prototype.bind.

Change-Id: I7b86e059d20faa1160cdc0126932fff924226eee
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1714655
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62885}

src/builtins/builtins-function-gen.cc

@@ -27,7 +27,7 @@ TF_BUILTIN(FastFunctionPrototypeBind, CodeStubAssembler) {
   Node* receiver = args.GetReceiver();
   GotoIf(TaggedIsSmi(receiver), &slow);
 
-  Node* receiver_map = LoadMap(receiver);
+  TNode<Map> receiver_map = LoadMap(receiver);
   {
     Node* instance_type = LoadMapInstanceType(receiver_map);
     GotoIfNot(
@@ -45,20 +45,20 @@ TF_BUILTIN(FastFunctionPrototypeBind, CodeStubAssembler) {
   // AccessorInfo objects. In that case, their value can be recomputed even if
   // the actual value on the object changes.
   Comment("Check descriptor array length");
-  TNode<DescriptorArray> descriptors = LoadMapDescriptors(receiver_map);
   // Minimum descriptor array length required for fast path.
   const int min_nof_descriptors = i::Max(JSFunction::kLengthDescriptorIndex,
-                                         JSFunction::kNameDescriptorIndex);
-  TNode<Int32T> nof_descriptors = LoadNumberOfDescriptors(descriptors);
-  GotoIf(
-      Int32LessThanOrEqual(nof_descriptors, Int32Constant(min_nof_descriptors)),
-      &slow);
+                                         JSFunction::kNameDescriptorIndex) +
+                                  1;
+  TNode<Int32T> nof_descriptors = LoadNumberOfOwnDescriptors(receiver_map);
+  GotoIf(Int32LessThan(nof_descriptors, Int32Constant(min_nof_descriptors)),
+         &slow);
 
   // Check whether the length and name properties are still present as
   // AccessorInfo objects. In that case, their value can be recomputed even if
   // the actual value on the object changes.
   Comment("Check name and length properties");
   {
+    TNode<DescriptorArray> descriptors = LoadMapDescriptors(receiver_map);
     const int length_index = JSFunction::kLengthDescriptorIndex;
     TNode<Name> maybe_length =
         LoadKeyByDescriptorEntry(descriptors, length_index);

src/codegen/code-stub-assembler.cc

@@ -1547,6 +1547,12 @@ TNode<Int32T> CodeStubAssembler::LoadNumberOfDescriptors(
                       MachineType::Int16()));
 }
 
+TNode<Int32T> CodeStubAssembler::LoadNumberOfOwnDescriptors(TNode<Map> map) {
+  Node* bit_field3 = LoadMapBitField3(map);
+  return UncheckedCast<Int32T>(
+      DecodeWord32<Map::NumberOfOwnDescriptorsBits>(bit_field3));
+}
+
 TNode<Int32T> CodeStubAssembler::LoadMapBitField(SloppyTNode<Map> map) {
   CSA_SLOW_ASSERT(this, IsMap(map));
   return UncheckedCast<Int32T>(

src/codegen/code-stub-assembler.h

@@ -940,6 +940,8 @@ class V8_EXPORT_PRIVATE CodeStubAssembler
       SloppyTNode<WeakFixedArray> array);
   // Load the number of descriptors in DescriptorArray.
   TNode<Int32T> LoadNumberOfDescriptors(TNode<DescriptorArray> array);
+  // Load the number of own descriptors of a map.
+  TNode<Int32T> LoadNumberOfOwnDescriptors(TNode<Map> map);
   // Load the bit field of a Map.
   TNode<Int32T> LoadMapBitField(SloppyTNode<Map> map);
   // Load bit field 2 of a map.

src/compiler/js-call-reducer.cc

@@ -550,7 +550,13 @@ Reduction JSCallReducer::ReduceFunctionPrototypeBind(Node* node) {
     // runtime otherwise.
     Handle<DescriptorArray> descriptors(
         receiver_map.object()->instance_descriptors(), isolate());
-    if (descriptors->number_of_descriptors() < 2) return inference.NoChange();
+    int minimum_nof_descriptors = std::max(JSFunction::kLengthDescriptorIndex,
+                                           JSFunction::kNameDescriptorIndex) +
+                                  1;
+    if (receiver_map.object()->NumberOfOwnDescriptors() <
+        minimum_nof_descriptors) {
+      return inference.NoChange();
+    }
     if (descriptors->GetKey(JSFunction::kLengthDescriptorIndex) !=
         ReadOnlyRoots(isolate()).length_string()) {
       return inference.NoChange();