[CSA] Create ToObject convenience function

Adds a function to call Builtins::kToObject returning a JSReceiver.
Also changes all previous uses of CallBuiltin(Builtins:kToObject to use
it.

Also fixed a case in builtins-object-gen.cc, where the result of
ToObject is cast (unchecked so it doesn't crash) to a JSObject before
actually checking it is a JSObject.

Change-Id: I3b1ff50babc3b3cbf44d56970099d105f7a66d34
Reviewed-on: https://chromium-review.googlesource.com/906778
Commit-Queue: Dan Elphick <delphick@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51232}

src/builtins/builtins-array-gen.cc

@@ -399,7 +399,7 @@ Node* ArrayBuiltinsAssembler::FindProcessor(Node* k_value, Node* k) {
 
     // 1. Let O be ToObject(this value).
     // 2. ReturnIfAbrupt(O)
-    o_ = CallBuiltin(Builtins::kToObject, context(), receiver());
+    o_ = ToObject(context(), receiver());
 
     // 3. Let len be ToLength(Get(O, "length")).
     // 4. ReturnIfAbrupt(len).
@@ -1328,7 +1328,7 @@ TF_BUILTIN(ArrayPrototypeSlice, ArrayPrototypeSliceCodeStubAssembler) {
   BIND(&generic_length);
   // 1. Let O be ToObject(this value).
   // 2. ReturnIfAbrupt(O).
-  o.Bind(CallBuiltin(Builtins::kToObject, context, receiver));
+  o.Bind(ToObject(context, receiver));
 
   // 3. Let len be ToLength(Get(O, "length")).
   // 4. ReturnIfAbrupt(len).
@@ -1996,9 +1996,7 @@ TF_BUILTIN(ArrayFrom, ArrayPopulatorAssembler) {
   TNode<Object> items = args.GetOptionalArgumentValue(0);
   // The spec doesn't require ToObject to be called directly on the iterable
   // branch, but it's part of GetMethod that is in the spec.
-  // TODO(delphick): Create ToObject_Inline to fast-path the expected case.
-  TNode<Object> array_like =
-      CAST(CallBuiltin(Builtins::kToObject, context, items));
+  TNode<JSReceiver> array_like = ToObject(context, items);
 
   TVARIABLE(Object, array);
   TVARIABLE(Number, length);
@@ -3381,7 +3379,7 @@ class ArrayPrototypeIterationAssembler : public CodeStubAssembler {
 
     BIND(&if_isnotobject);
     {
-      Node* result = CallBuiltin(Builtins::kToObject, context, receiver);
+      Node* result = ToObject(context, receiver);
       var_array.Bind(result);
       var_map.Bind(LoadMap(result));
       var_type.Bind(LoadMapInstanceType(var_map.value()));

src/builtins/builtins-constructor-gen.cc

@@ -662,7 +662,7 @@ TF_BUILTIN(ObjectConstructor, ConstructorBuiltinsAssembler) {
   args.PopAndReturn(EmitCreateEmptyObjectLiteral(context));
 
   BIND(&return_to_object);
-  args.PopAndReturn(CallBuiltin(Builtins::kToObject, context, value));
+  args.PopAndReturn(ToObject(context, value));
 }
 
 TF_BUILTIN(ObjectConstructor_ConstructStub, ConstructorBuiltinsAssembler) {
@@ -687,7 +687,7 @@ TF_BUILTIN(ObjectConstructor_ConstructStub, ConstructorBuiltinsAssembler) {
   args.PopAndReturn(EmitFastNewObject(context, target, new_target));
 
   BIND(&return_to_object);
-  args.PopAndReturn(CallBuiltin(Builtins::kToObject, context, value));
+  args.PopAndReturn(ToObject(context, value));
 }
 
 TF_BUILTIN(NumberConstructor, ConstructorBuiltinsAssembler) {

src/builtins/builtins-object-gen.cc

@@ -187,17 +187,17 @@ TNode<Uint32T> ObjectEntriesValuesBuiltinsAssembler::HasHiddenPrototype(
 void ObjectEntriesValuesBuiltinsAssembler::GetOwnValuesOrEntries(
     TNode<Context> context, TNode<Object> maybe_object,
     CollectType collect_type) {
-  TNode<JSObject> object = TNode<JSObject>::UncheckedCast(
-      CallBuiltin(Builtins::kToObject, context, maybe_object));
+  TNode<JSReceiver> receiver = ToObject(context, maybe_object);
 
   Label if_call_runtime_with_fast_path(this, Label::kDeferred),
       if_call_runtime(this, Label::kDeferred),
       if_no_properties(this, Label::kDeferred);
 
-  TNode<Map> map = LoadMap(object);
+  TNode<Map> map = LoadMap(receiver);
   GotoIfNot(IsJSObjectMap(map), &if_call_runtime);
   GotoIfMapHasSlowProperties(map, &if_call_runtime);
 
+  TNode<JSObject> object = CAST(receiver);
   TNode<FixedArrayBase> elements = LoadElements(object);
   // If the object has elements, we treat it as slow case.
   // So, we go to runtime call.
@@ -232,10 +232,12 @@ void ObjectEntriesValuesBuiltinsAssembler::GetOwnValuesOrEntries(
   {
     // In slow case, we simply call runtime.
     if (collect_type == CollectType::kEntries) {
-      Return(CallRuntime(Runtime::kObjectEntriesSkipFastPath, context, object));
+      Return(
+          CallRuntime(Runtime::kObjectEntriesSkipFastPath, context, receiver));
     } else {
       DCHECK(collect_type == CollectType::kValues);
-      Return(CallRuntime(Runtime::kObjectValuesSkipFastPath, context, object));
+      Return(
+          CallRuntime(Runtime::kObjectValuesSkipFastPath, context, receiver));
     }
   }
 }
@@ -607,7 +609,7 @@ TF_BUILTIN(ObjectPrototypeIsPrototypeOf, ObjectBuiltinsAssembler) {
     GotoIfNot(IsJSReceiver(value), &if_valueisnotreceiver);
 
     // Simulate the ToObject invocation on {receiver}.
-    CallBuiltin(Builtins::kToObject, context, receiver);
+    ToObject(context, receiver);
     Unreachable();
   }
 
@@ -877,8 +879,7 @@ TF_BUILTIN(ObjectPrototypeToString, ObjectBuiltinsAssembler) {
 
     BIND(&return_generic);
     {
-      Node* tag = GetProperty(
-          context, CallBuiltin(Builtins::kToObject, context, receiver),
+      Node* tag = GetProperty(context, ToObject(context, receiver),
                               LoadRoot(Heap::kto_string_tag_symbolRootIndex));
       GotoIf(TaggedIsSmi(tag), &return_default);
       GotoIfNot(IsString(tag), &return_default);
@@ -895,7 +896,7 @@ TF_BUILTIN(ObjectPrototypeValueOf, CodeStubAssembler) {
   Node* receiver = Parameter(Descriptor::kReceiver);
   Node* context = Parameter(Descriptor::kContext);
 
-  Return(CallBuiltin(Builtins::kToObject, context, receiver));
+  Return(ToObject(context, receiver));
 }
 
 // ES #sec-object.create
@@ -1119,7 +1120,7 @@ TF_BUILTIN(ObjectGetOwnPropertyDescriptor, ObjectBuiltinsAssembler) {
   Node* key = args.GetOptionalArgumentValue(1);
 
   // 1. Let obj be ? ToObject(O).
-  object = CallBuiltin(Builtins::kToObject, context, object);
+  object = ToObject(context, object);
 
   // 2. Let key be ? ToPropertyKey(P).
   key = ToName(context, key);

src/code-stub-assembler.cc

@@ -5909,6 +5909,11 @@ Node* CodeStubAssembler::JSReceiverToPrimitive(Node* context, Node* input) {
   return result.value();
 }
 
+TNode<JSReceiver> CodeStubAssembler::ToObject(SloppyTNode<Context> context,
+                                              SloppyTNode<Object> input) {
+  return CAST(CallBuiltin(Builtins::kToObject, context, input));
+}
+
 Node* CodeStubAssembler::ToSmiIndex(Node* const input, Node* const context,
                                     Label* range_error) {
   VARIABLE(result, MachineRepresentation::kTagged, input);

src/code-stub-assembler.h

@@ -1269,6 +1269,9 @@ class V8_EXPORT_PRIVATE CodeStubAssembler : public compiler::CodeAssembler {
   // Convert any object to a Primitive.
   Node* JSReceiverToPrimitive(Node* context, Node* input);
 
+  TNode<JSReceiver> ToObject(SloppyTNode<Context> context,
+                             SloppyTNode<Object> input);
+
   enum ToIntegerTruncationMode {
     kNoTruncation,
     kTruncateMinusZero,