[stubs] Port CreateWeakCellStub to turbofan

In the process also inline the stub into the appropriate interpreter bytecode
handler and make sure that the context register is preserved in hand-written
assembly code that calls the stub and expects the context register to be
preserved.

BUG=608675

Review-Url: https://codereview.chromium.org/2188993003
Cr-Commit-Position: refs/heads/master@{#38132}

src/arm/code-stubs-arm.cc

@@ -1634,9 +1634,11 @@ static void CallStubInRecordCallTarget(MacroAssembler* masm, CodeStub* stub) {
   // Number-of-arguments register must be smi-tagged to call out.
   __ SmiTag(r0);
   __ Push(r3, r2, r1, r0);
+  __ Push(cp);
 
   __ CallStub(stub);
 
+  __ Pop(cp);
   __ Pop(r3, r2, r1, r0);
   __ SmiUntag(r0);
 }
@@ -1936,9 +1938,9 @@ void CallICStub::Generate(MacroAssembler* masm) {
   {
     FrameScope scope(masm, StackFrame::INTERNAL);
     CreateWeakCellStub create_stub(masm->isolate());
-    __ Push(r1);
+    __ Push(cp, r1);
     __ CallStub(&create_stub);
-    __ Pop(r1);
+    __ Pop(cp, r1);
   }
 
   __ jmp(&call_function);

src/arm64/code-stubs-arm64.cc

@@ -1826,10 +1826,12 @@ static void CallStubInRecordCallTarget(MacroAssembler* masm, CodeStub* stub,
   // Number-of-arguments register must be smi-tagged to call out.
   __ SmiTag(argc);
   __ Push(argc, function, feedback_vector, index);
+  __ Push(cp);
 
   DCHECK(feedback_vector.Is(x2) && index.Is(x3));
   __ CallStub(stub);
 
+  __ Pop(cp);
   __ Pop(index, feedback_vector, function, argc);
   __ SmiUntag(argc);
 }
@@ -2161,9 +2163,9 @@ void CallICStub::Generate(MacroAssembler* masm) {
   {
     FrameScope scope(masm, StackFrame::INTERNAL);
     CreateWeakCellStub create_stub(masm->isolate());
-    __ Push(function);
+    __ Push(cp, function);
     __ CallStub(&create_stub);
-    __ Pop(function);
+    __ Pop(cp, function);
   }
 
   __ B(&call_function);

src/code-stub-assembler.cc

@@ -891,6 +891,15 @@ Node* CodeStubAssembler::StoreMapNoWriteBarrier(Node* object, Node* map) {
       IntPtrConstant(HeapNumber::kMapOffset - kHeapObjectTag), map);
 }
 
+Node* CodeStubAssembler::StoreObjectFieldRoot(Node* object, int offset,
+                                              Heap::RootListIndex root_index) {
+  if (Heap::RootIsImmortalImmovable(root_index)) {
+    return StoreObjectFieldNoWriteBarrier(object, offset, LoadRoot(root_index));
+  } else {
+    return StoreObjectField(object, offset, LoadRoot(root_index));
+  }
+}
+
 Node* CodeStubAssembler::StoreFixedArrayElement(Node* object, Node* index_node,
                                                 Node* value,
                                                 WriteBarrierMode barrier_mode,
@@ -3254,5 +3263,23 @@ void CodeStubAssembler::CheckEnumCache(Node* receiver, Label* use_cache,
   }
 }
 
+Node* CodeStubAssembler::CreateWeakCellInFeedbackVector(Node* feedback_vector,
+                                                        Node* slot,
+                                                        Node* value) {
+  Node* size = IntPtrConstant(WeakCell::kSize);
+  Node* cell = Allocate(size, compiler::CodeAssembler::kPretenured);
+
+  // Initialize the WeakCell.
+  StoreObjectFieldRoot(cell, WeakCell::kMapOffset, Heap::kWeakCellMapRootIndex);
+  StoreObjectField(cell, WeakCell::kValueOffset, value);
+  StoreObjectFieldRoot(cell, WeakCell::kNextOffset,
+                       Heap::kTheHoleValueRootIndex);
+
+  // Store the WeakCell in the feedback vector.
+  StoreFixedArrayElement(feedback_vector, slot, cell, UPDATE_WRITE_BARRIER,
+                         CodeStubAssembler::SMI_PARAMETERS);
+  return cell;
+}
+
 }  // namespace internal
 }  // namespace v8

src/code-stub-assembler.h

@@ -220,6 +220,8 @@ class CodeStubAssembler : public compiler::CodeAssembler {
   // Store the Map of an HeapObject.
   compiler::Node* StoreMapNoWriteBarrier(compiler::Node* object,
                                          compiler::Node* map);
+  compiler::Node* StoreObjectFieldRoot(compiler::Node* object, int offset,
+                                       Heap::RootListIndex root);
   // Store an array element to a FixedArray.
   compiler::Node* StoreFixedArrayElement(
       compiler::Node* object, compiler::Node* index, compiler::Node* value,
@@ -485,6 +487,12 @@ class CodeStubAssembler : public compiler::CodeAssembler {
                       CodeStubAssembler::Label* use_cache,
                       CodeStubAssembler::Label* use_runtime);
 
+  // Create a new weak cell with a specified value and install it into a
+  // feedback vector.
+  compiler::Node* CreateWeakCellInFeedbackVector(
+      compiler::Node* feedback_vector, compiler::Node* slot,
+      compiler::Node* value);
+
  private:
   compiler::Node* ElementOffsetFromIndex(compiler::Node* index,
                                          ElementsKind kind, ParameterMode mode,

src/code-stubs-hydrogen.cc

@@ -542,37 +542,6 @@ Handle<Code> FastCloneShallowArrayStub::GenerateCode() {
   return DoGenerateCode(this);
 }
 
-
-template <>
-HValue* CodeStubGraphBuilder<CreateWeakCellStub>::BuildCodeStub() {
-  // This stub is performance sensitive, the generated code must be tuned
-  // so that it doesn't build an eager frame.
-  info()->MarkMustNotHaveEagerFrame();
-
-  HValue* size = Add<HConstant>(WeakCell::kSize);
-  HInstruction* object =
-      Add<HAllocate>(size, HType::JSObject(), TENURED, JS_OBJECT_TYPE,
-                     graph()->GetConstant0());
-
-  Handle<Map> weak_cell_map = isolate()->factory()->weak_cell_map();
-  AddStoreMapConstant(object, weak_cell_map);
-
-  HInstruction* value = GetParameter(Descriptor::kValue);
-  Add<HStoreNamedField>(object, HObjectAccess::ForWeakCellValue(), value);
-  Add<HStoreNamedField>(object, HObjectAccess::ForWeakCellNext(),
-                        graph()->GetConstantHole());
-
-  HInstruction* feedback_vector = GetParameter(Descriptor::kVector);
-  HInstruction* slot = GetParameter(Descriptor::kSlot);
-  Add<HStoreKeyed>(feedback_vector, slot, object, nullptr, FAST_ELEMENTS,
-                   INITIALIZING_STORE);
-  return graph()->GetConstant0();
-}
-
-
-Handle<Code> CreateWeakCellStub::GenerateCode() { return DoGenerateCode(this); }
-
-
 template <>
 HValue* CodeStubGraphBuilder<LoadScriptContextFieldStub>::BuildCodeStub() {
   int context_index = casted_stub()->context_index();

src/code-stubs.cc

@@ -4120,9 +4120,6 @@ void FastCloneShallowArrayStub::InitializeDescriptor(
 }
 
 
-void CreateWeakCellStub::InitializeDescriptor(CodeStubDescriptor* d) {}
-
-
 void RegExpConstructResultStub::InitializeDescriptor(
     CodeStubDescriptor* descriptor) {
   descriptor->Initialize(
@@ -4710,9 +4707,8 @@ void CreateAllocationSiteStub::GenerateAssembly(
   Node* site = assembler->Allocate(size, compiler::CodeAssembler::kPretenured);
 
   // Store the map
-  Node* map =
-      assembler->HeapConstant(isolate()->factory()->allocation_site_map());
-  assembler->StoreMapNoWriteBarrier(site, map);
+  assembler->StoreObjectFieldRoot(site, AllocationSite::kMapOffset,
+                                  Heap::kAllocationSiteMapRootIndex);
 
   Node* kind =
       assembler->SmiConstant(Smi::FromInt(GetInitialFastElementsKind()));
@@ -4733,10 +4729,8 @@ void CreateAllocationSiteStub::GenerateAssembly(
       site, AllocationSite::kPretenureCreateCountOffset, zero);
 
   // Store an empty fixed array for the code dependency.
-  Node* empty_fixed_array =
-      assembler->HeapConstant(isolate()->factory()->empty_fixed_array());
-  assembler->StoreObjectFieldNoWriteBarrier(
-      site, AllocationSite::kDependentCodeOffset, empty_fixed_array);
+  assembler->StoreObjectFieldRoot(site, AllocationSite::kDependentCodeOffset,
+                                  Heap::kEmptyFixedArrayRootIndex);
 
   // Link the object to the allocation site list
   Node* site_list = assembler->ExternalConstant(
@@ -4762,6 +4756,13 @@ void CreateAllocationSiteStub::GenerateAssembly(
   assembler->Return(site);
 }
 
+void CreateWeakCellStub::GenerateAssembly(CodeStubAssembler* assembler) const {
+  assembler->Return(assembler->CreateWeakCellInFeedbackVector(
+      assembler->Parameter(Descriptor::kVector),
+      assembler->Parameter(Descriptor::kSlot),
+      assembler->Parameter(Descriptor::kValue)));
+}
+
 void ArrayNoArgumentConstructorStub::GenerateAssembly(
     CodeStubAssembler* assembler) const {
   typedef compiler::Node Node;

src/code-stubs.h

@@ -63,7 +63,6 @@ namespace internal {
   /* HydrogenCodeStubs */                   \
   V(BinaryOpIC)                             \
   V(BinaryOpWithAllocationSite)             \
-  V(CreateWeakCell)                         \
   V(ElementsTransitionAndStore)             \
   V(FastArrayPush)                          \
   V(FastCloneRegExp)                        \
@@ -99,6 +98,7 @@ namespace internal {
   V(ArraySingleArgumentConstructor)         \
   V(ArrayNArgumentsConstructor)             \
   V(CreateAllocationSite)                   \
+  V(CreateWeakCell)                         \
   V(StringLength)                           \
   V(Add)                                    \
   V(Subtract)                               \
@@ -1214,18 +1214,16 @@ class CreateAllocationSiteStub : public TurboFanCodeStub {
   DEFINE_TURBOFAN_CODE_STUB(CreateAllocationSite, TurboFanCodeStub);
 };
 
-
-class CreateWeakCellStub : public HydrogenCodeStub {
+class CreateWeakCellStub : public TurboFanCodeStub {
  public:
-  explicit CreateWeakCellStub(Isolate* isolate) : HydrogenCodeStub(isolate) {}
+  explicit CreateWeakCellStub(Isolate* isolate) : TurboFanCodeStub(isolate) {}
 
   static void GenerateAheadOfTime(Isolate* isolate);
 
   DEFINE_CALL_INTERFACE_DESCRIPTOR(CreateWeakCell);
-  DEFINE_HYDROGEN_CODE_STUB(CreateWeakCell, HydrogenCodeStub);
+  DEFINE_TURBOFAN_CODE_STUB(CreateWeakCell, TurboFanCodeStub);
 };
 
-
 class GrowArrayElementsStub : public HydrogenCodeStub {
  public:
   GrowArrayElementsStub(Isolate* isolate, bool is_js_array, ElementsKind kind)

src/ia32/code-stubs-ia32.cc

@@ -1277,9 +1277,11 @@ static void CallStubInRecordCallTarget(MacroAssembler* masm, CodeStub* stub) {
     __ push(edi);
     __ push(edx);
     __ push(ebx);
+    __ push(esi);
 
     __ CallStub(stub);
 
+    __ pop(esi);
     __ pop(ebx);
     __ pop(edx);
     __ pop(edi);
@@ -1575,7 +1577,9 @@ void CallICStub::Generate(MacroAssembler* masm) {
     FrameScope scope(masm, StackFrame::INTERNAL);
     CreateWeakCellStub create_stub(isolate);
     __ push(edi);
+    __ push(esi);
     __ CallStub(&create_stub);
+    __ pop(esi);
     __ pop(edi);
   }
 

src/interpreter/interpreter-assembler.cc

@@ -548,10 +548,8 @@ Node* InterpreterAssembler::CallJSWithFeedback(Node* function, Node* context,
       StoreFixedArrayElement(type_feedback_vector, call_count_slot,
                              SmiTag(Int32Constant(1)), SKIP_WRITE_BARRIER);
 
-      CreateWeakCellStub weak_cell_stub(isolate());
-      CallStub(weak_cell_stub.GetCallInterfaceDescriptor(),
-               HeapConstant(weak_cell_stub.GetCode()), context,
-               type_feedback_vector, SmiTag(slot_id), function);
+      CreateWeakCellInFeedbackVector(type_feedback_vector, SmiTag(slot_id),
+                                     function);
 
       // Call using call function builtin.
       Callable callable = CodeFactory::InterpreterPushArgsAndCall(

src/mips/code-stubs-mips.cc

@@ -1766,7 +1766,8 @@ static void CallStubInRecordCallTarget(MacroAssembler* masm, CodeStub* stub) {
   const RegList kSavedRegs = 1 << 4 |  // a0
                              1 << 5 |  // a1
                              1 << 6 |  // a2
-                             1 << 7;   // a3
+                             1 << 7 |  // a3
+                             1 << cp.code();
 
   // Number-of-arguments register must be smi-tagged to call out.
   __ SmiTag(a0);
@@ -2064,9 +2065,9 @@ void CallICStub::Generate(MacroAssembler* masm) {
   {
     FrameScope scope(masm, StackFrame::INTERNAL);
     CreateWeakCellStub create_stub(masm->isolate());
-    __ Push(a1);
+    __ Push(cp, a1);
     __ CallStub(&create_stub);
-    __ Pop(a1);
+    __ Pop(cp, a1);
   }
 
   __ Branch(&call_function);

src/mips64/code-stubs-mips64.cc

@@ -1767,8 +1767,8 @@ static void CallStubInRecordCallTarget(MacroAssembler* masm, CodeStub* stub) {
   const RegList kSavedRegs = 1 << 4 |  // a0
                              1 << 5 |  // a1
                              1 << 6 |  // a2
-                             1 << 7;   // a3
-
+                             1 << 7 |  // a3
+                             1 << cp.code();
 
   // Number-of-arguments register must be smi-tagged to call out.
   __ SmiTag(a0);
@@ -2118,9 +2118,9 @@ void CallICStub::Generate(MacroAssembler* masm) {
   {
     FrameScope scope(masm, StackFrame::INTERNAL);
     CreateWeakCellStub create_stub(masm->isolate());
-    __ Push(a1);
+    __ Push(cp, a1);
     __ CallStub(&create_stub);
-    __ Pop(a1);
+    __ Pop(cp, a1);
   }
 
   __ Branch(&call_function);

src/x64/code-stubs-x64.cc

@@ -1166,9 +1166,11 @@ static void CallStubInRecordCallTarget(MacroAssembler* masm, CodeStub* stub) {
   __ Integer32ToSmi(rdx, rdx);
   __ Push(rdx);
   __ Push(rbx);
+  __ Push(rsi);
 
   __ CallStub(stub);
 
+  __ Pop(rsi);
   __ Pop(rbx);
   __ Pop(rdx);
   __ Pop(rdi);
@@ -1466,7 +1468,9 @@ void CallICStub::Generate(MacroAssembler* masm) {
 
     __ Integer32ToSmi(rdx, rdx);
     __ Push(rdi);
+    __ Push(rsi);
     __ CallStub(&create_stub);
+    __ Pop(rsi);
     __ Pop(rdi);
   }
 

src/x87/code-stubs-x87.cc

@@ -1106,9 +1106,11 @@ static void CallStubInRecordCallTarget(MacroAssembler* masm, CodeStub* stub) {
     __ push(edi);
     __ push(edx);
     __ push(ebx);
+    __ push(esi);
 
     __ CallStub(stub);
 
+    __ pop(esi);
     __ pop(ebx);
     __ pop(edx);
     __ pop(edi);
@@ -1404,7 +1406,9 @@ void CallICStub::Generate(MacroAssembler* masm) {
     FrameScope scope(masm, StackFrame::INTERNAL);
     CreateWeakCellStub create_stub(isolate);
     __ push(edi);
+    __ push(esi);
     __ CallStub(&create_stub);
+    __ pop(esi);
     __ pop(edi);
   }
 

test/mjsunit/regress/regress-353551.js

@@ -30,7 +30,7 @@ function __f_3(x) {
   var __v_1 = arguments;
   __v_1[1000] = 123;
   depth++;
-  if (depth > 2700) return;
+  if (depth > 2500) return;
   function __f_4() {
     ++__v_1[0];
     __f_3(0.5);