[builtins] Convert the hole to undefined when pushing spread arguments.

The mips64 implementation always ended up in the slowpath due to some
loads that were the wrong width, so that is also fixed here.

BUG=v8:5974

Change-Id: Ie448a1fab5b7fca87597c5a1bf75443864e30c28
Reviewed-on: https://chromium-review.googlesource.com/443247
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43222}

src/builtins/arm/builtins-arm.cc

@@ -2834,12 +2834,15 @@ static void CheckSpreadAndPushToStack(MacroAssembler* masm) {
   // Put the evaluated spread onto the stack as additional arguments.
   {
     __ mov(scratch, Operand(0));
-    Label done, loop;
+    Label done, push, loop;
     __ bind(&loop);
     __ cmp(scratch, spread_len);
     __ b(eq, &done);
     __ add(scratch2, spread, Operand(scratch, LSL, kPointerSizeLog2));
     __ ldr(scratch2, FieldMemOperand(scratch2, FixedArray::kHeaderSize));
+    __ JumpIfNotRoot(scratch2, Heap::kTheHoleValueRootIndex, &push);
+    __ LoadRoot(scratch2, Heap::kUndefinedValueRootIndex);
+    __ bind(&push);
     __ Push(scratch2);
     __ add(scratch, scratch, Operand(1));
     __ b(&loop);

src/builtins/arm64/builtins-arm64.cc

@@ -2908,12 +2908,15 @@ static void CheckSpreadAndPushToStack(MacroAssembler* masm) {
   // Put the evaluated spread onto the stack as additional arguments.
   {
     __ Mov(scratch, 0);
-    Label done, loop;
+    Label done, push, loop;
     __ Bind(&loop);
     __ Cmp(scratch, spread_len);
     __ B(eq, &done);
     __ Add(scratch2, spread, Operand(scratch, LSL, kPointerSizeLog2));
     __ Ldr(scratch2, FieldMemOperand(scratch2, FixedArray::kHeaderSize));
+    __ JumpIfNotRoot(scratch2, Heap::kTheHoleValueRootIndex, &push);
+    __ LoadRoot(scratch2, Heap::kUndefinedValueRootIndex);
+    __ bind(&push);
     __ Push(scratch2);
     __ Add(scratch, scratch, Operand(1));
     __ B(&loop);

src/builtins/ia32/builtins-ia32.cc

@@ -2916,12 +2916,16 @@ static void CheckSpreadAndPushToStack(MacroAssembler* masm) {
     __ movd(xmm2, esi);
 
     __ mov(scratch, Immediate(0));
-    Label done, loop;
+    Label done, push, loop;
     __ bind(&loop);
     __ cmp(scratch, spread_len);
     __ j(equal, &done, Label::kNear);
     __ mov(scratch2, FieldOperand(spread, scratch, times_pointer_size,
                                   FixedArray::kHeaderSize));
+    __ CompareRoot(scratch2, Heap::kTheHoleValueRootIndex);
+    __ j(not_equal, &push, Label::kNear);
+    __ LoadRoot(scratch2, Heap::kUndefinedValueRootIndex);
+    __ bind(&push);
     __ Push(scratch2);
     __ inc(scratch);
     __ jmp(&loop);

src/builtins/mips/builtins-mips.cc

@@ -2834,11 +2834,14 @@ static void CheckSpreadAndPushToStack(MacroAssembler* masm) {
   // Put the evaluated spread onto the stack as additional arguments.
   {
     __ mov(scratch, zero_reg);
-    Label done, loop;
+    Label done, push, loop;
     __ bind(&loop);
     __ Branch(&done, eq, scratch, Operand(spread_len));
     __ Lsa(scratch2, spread, scratch, kPointerSizeLog2);
     __ lw(scratch2, FieldMemOperand(scratch2, FixedArray::kHeaderSize));
+    __ JumpIfNotRoot(scratch2, Heap::kTheHoleValueRootIndex, &push);
+    __ LoadRoot(scratch2, Heap::kUndefinedValueRootIndex);
+    __ bind(&push);
     __ Push(scratch2);
     __ Addu(scratch, scratch, Operand(1));
     __ Branch(&loop);

src/builtins/mips64/builtins-mips64.cc

@@ -2779,7 +2779,7 @@ static void CheckSpreadAndPushToStack(MacroAssembler* masm) {
   // Check that the ArrayPrototype hasn't been modified in a way that would
   // affect iteration.
   __ LoadRoot(scratch, Heap::kArrayIteratorProtectorRootIndex);
-  __ lw(scratch, FieldMemOperand(scratch, PropertyCell::kValueOffset));
+  __ ld(scratch, FieldMemOperand(scratch, PropertyCell::kValueOffset));
   __ Branch(&runtime_call, ne, scratch,
             Operand(Smi::FromInt(Isolate::kProtectorValid)));
 
@@ -2804,7 +2804,7 @@ static void CheckSpreadAndPushToStack(MacroAssembler* masm) {
   __ Branch(&no_protector_check, eq, scratch, Operand(FAST_ELEMENTS));
   // Check the ArrayProtector cell.
   __ LoadRoot(scratch, Heap::kArrayProtectorRootIndex);
-  __ lw(scratch, FieldMemOperand(scratch, PropertyCell::kValueOffset));
+  __ ld(scratch, FieldMemOperand(scratch, PropertyCell::kValueOffset));
   __ Branch(&runtime_call, ne, scratch,
             Operand(Smi::FromInt(Isolate::kProtectorValid)));
 
@@ -2859,11 +2859,14 @@ static void CheckSpreadAndPushToStack(MacroAssembler* masm) {
   // Put the evaluated spread onto the stack as additional arguments.
   {
     __ mov(scratch, zero_reg);
-    Label done, loop;
+    Label done, push, loop;
     __ bind(&loop);
     __ Branch(&done, eq, scratch, Operand(spread_len));
     __ Dlsa(scratch2, spread, scratch, kPointerSizeLog2);
     __ ld(scratch2, FieldMemOperand(scratch2, FixedArray::kHeaderSize));
+    __ JumpIfNotRoot(scratch2, Heap::kTheHoleValueRootIndex, &push);
+    __ LoadRoot(scratch2, Heap::kUndefinedValueRootIndex);
+    __ bind(&push);
     __ Push(scratch2);
     __ Daddu(scratch, scratch, Operand(1));
     __ Branch(&loop);

src/builtins/ppc/builtins-ppc.cc

@@ -2904,13 +2904,16 @@ static void CheckSpreadAndPushToStack(MacroAssembler* masm) {
   // Put the evaluated spread onto the stack as additional arguments.
   {
     __ li(scratch, Operand::Zero());
-    Label done, loop;
+    Label done, push, loop;
     __ bind(&loop);
     __ cmp(scratch, spread_len);
     __ beq(&done);
     __ ShiftLeftImm(r0, scratch, Operand(kPointerSizeLog2));
     __ add(scratch2, spread, r0);
     __ LoadP(scratch2, FieldMemOperand(scratch2, FixedArray::kHeaderSize));
+    __ JumpIfNotRoot(scratch2, Heap::kTheHoleValueRootIndex, &push);
+    __ LoadRoot(scratch2, Heap::kUndefinedValueRootIndex);
+    __ bind(&push);
     __ Push(scratch2);
     __ addi(scratch, scratch, Operand(1));
     __ b(&loop);

src/builtins/s390/builtins-s390.cc

@@ -2918,13 +2918,16 @@ static void CheckSpreadAndPushToStack(MacroAssembler* masm) {
   // Put the evaluated spread onto the stack as additional arguments.
   {
     __ LoadImmP(scratch, Operand::Zero());
-    Label done, loop;
+    Label done, push, loop;
     __ bind(&loop);
     __ CmpP(scratch, spread_len);
     __ beq(&done);
     __ ShiftLeftP(r0, scratch, Operand(kPointerSizeLog2));
     __ AddP(scratch2, spread, r0);
     __ LoadP(scratch2, FieldMemOperand(scratch2, FixedArray::kHeaderSize));
+    __ JumpIfNotRoot(scratch2, Heap::kTheHoleValueRootIndex, &push);
+    __ LoadRoot(scratch2, Heap::kUndefinedValueRootIndex);
+    __ bind(&push);
     __ Push(scratch2);
     __ AddP(scratch, scratch, Operand(1));
     __ b(&loop);

src/builtins/x64/builtins-x64.cc

@@ -2962,12 +2962,16 @@ static void CheckSpreadAndPushToStack(MacroAssembler* masm) {
     __ Pop(rcx);
 
     __ Set(rcx, 0);
-    Label done, loop;
+    Label done, push, loop;
     __ bind(&loop);
     __ cmpl(rcx, r9);
     __ j(equal, &done, Label::kNear);
     __ movp(kScratchRegister, FieldOperand(rbx, rcx, times_pointer_size,
                                            FixedArray::kHeaderSize));
+    __ CompareRoot(kScratchRegister, Heap::kTheHoleValueRootIndex);
+    __ j(not_equal, &push, Label::kNear);
+    __ LoadRoot(kScratchRegister, Heap::kUndefinedValueRootIndex);
+    __ bind(&push);
     __ Push(kScratchRegister);
     __ incl(rcx);
     __ jmp(&loop);

src/builtins/x87/builtins-x87.cc

@@ -2852,6 +2852,9 @@ static void CheckSpreadAndPushToStack(MacroAssembler* masm) {
     __ j(equal, &done, Label::kNear);
     __ mov(scratch2, FieldOperand(spread, scratch, times_pointer_size,
                                   FixedArray::kHeaderSize));
+    __ JumpIfNotRoot(scratch2, Heap::kTheHoleValueRootIndex, &push);
+    __ LoadRoot(scratch2, Heap::kUndefinedValueRootIndex);
+    __ bind(&push);
     __ Push(scratch2);
     __ inc(scratch);
     __ jmp(&loop);

test/mjsunit/regress/regress-5974.js

+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+(function() {
+  var a = Array(...Array(5)).map(() => 1);
+
+  assertEquals([1, 1, 1, 1, 1], a);
+})();