[typedarray] Port TypedArray.from to CSA.

Factor out IterableToList into a helper stub to save space. There are
two callers now, TypedArrayFrom and ConstructByIterable, and it is
~2.5kb so we save space by doing this.

Increase test coverage to cover more of the branching in CSA.

This is doesn't follow the control flow in the spec exactly - see the
big code comment for an explanation.

Change-Id: Ief39e93c4202cb7bf0e28a39dc6aa81b8b9c59d2
Reviewed-on: https://chromium-review.googlesource.com/908755
Commit-Queue: Peter Marshall <petermarshall@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51377}

src/bootstrapper.cc

@@ -2947,6 +2947,8 @@ void Genesis::InitializeGlobal(Handle<JSGlobalObject> global_object,
 
     SimpleInstallFunction(typed_array_fun, "of", Builtins::kTypedArrayOf, 0,
                           false);
+    SimpleInstallFunction(typed_array_fun, "from", Builtins::kTypedArrayFrom, 1,
+                          false);
 
     // Setup %TypedArrayPrototype%.
     Handle<JSObject> prototype(

src/builtins/builtins-definitions.h

@@ -1071,6 +1071,7 @@ namespace internal {
   TFJ(SymbolPrototypeValueOf, 0)                                               \
                                                                                \
   /* TypedArray */                                                             \
+  TFS(IterableToList, kIterable, kIteratorFn)                                  \
   TFS(TypedArrayInitialize, kHolder, kLength, kElementSize, kInitialize)       \
   TFS(TypedArrayInitializeWithBuffer, kHolder, kLength, kBuffer, kElementSize, \
       kByteOffset)                                                             \
@@ -1140,6 +1141,8 @@ namespace internal {
       SharedFunctionInfo::kDontAdaptArgumentsSentinel)                         \
   /* ES6 %TypedArray%.of */                                                    \
   TFJ(TypedArrayOf, SharedFunctionInfo::kDontAdaptArgumentsSentinel)           \
+  /* ES6 %TypedArray%.from */                                                  \
+  TFJ(TypedArrayFrom, SharedFunctionInfo::kDontAdaptArgumentsSentinel)         \
                                                                                \
   /* Wasm */                                                                   \
   ASM(WasmCompileLazy)                                                         \

src/compiler/code-assembler.cc

@@ -956,13 +956,13 @@ Node* CodeAssembler::Projection(int index, Node* value) {
 
 void CodeAssembler::GotoIfException(Node* node, Label* if_exception,
                                     Variable* exception_var) {
-  DCHECK(!node->op()->HasProperty(Operator::kNoThrow));
-
   if (if_exception == nullptr) {
     // If no handler is supplied, don't add continuations
     return;
   }
 
+  DCHECK(!node->op()->HasProperty(Operator::kNoThrow));
+
   Label success(this), exception(this, Label::kDeferred);
   success.MergeVariables();
   exception.MergeVariables();

src/elements.cc

@@ -3504,8 +3504,12 @@ class TypedElementsAccessor
               isolate, NewTypeError(MessageTemplate::kBigIntToNumber));
         }
       }
-      CopyElementsFromTypedArray(*source_ta, *destination_ta, length, offset);
-      return *isolate->factory()->undefined_value();
+      // If we have to copy more elements than we have in the source, we need to
+      // do special handling and conversion; that happens in the slow case.
+      if (length + offset <= source_ta->length_value()) {
+        CopyElementsFromTypedArray(*source_ta, *destination_ta, length, offset);
+        return *isolate->factory()->undefined_value();
+      }
     }
 
     // Fast cases for packed numbers kinds where we don't need to allocate.

src/js/typedarray.js

@@ -124,57 +124,6 @@ DEFINE_METHOD(
   }
 );
 
-
-// ES#sec-iterabletoarraylike Runtime Semantics: IterableToArrayLike( items )
-function IterableToArrayLike(items) {
-  var iterable = GetMethod(items, iteratorSymbol);
-  if (!IS_UNDEFINED(iterable)) {
-    var internal_array = new InternalArray();
-    var i = 0;
-    for (var value of
-         { [iteratorSymbol]() { return GetIterator(items, iterable) } }) {
-      internal_array[i] = value;
-      i++;
-    }
-    var array = [];
-    %MoveArrayContents(internal_array, array);
-    return array;
-  }
-  return TO_OBJECT(items);
-}
-
-
-// ES#sec-%typedarray%.from
-// %TypedArray%.from ( source [ , mapfn [ , thisArg ] ] )
-DEFINE_METHOD_LEN(
-  GlobalTypedArray,
-  'from'(source, mapfn, thisArg) {
-    if (!%IsConstructor(this)) throw %make_type_error(kNotConstructor, this);
-    var mapping;
-    if (!IS_UNDEFINED(mapfn)) {
-      if (!IS_CALLABLE(mapfn)) throw %make_type_error(kCalledNonCallable, this);
-      mapping = true;
-    } else {
-      mapping = false;
-    }
-    var arrayLike = IterableToArrayLike(source);
-    var length = TO_LENGTH(arrayLike.length);
-    var targetObject = TypedArrayCreate(this, length);
-    var value, mappedValue;
-    for (var i = 0; i < length; i++) {
-      value = arrayLike[i];
-      if (mapping) {
-        mappedValue = %_Call(mapfn, thisArg, value, i);
-      } else {
-        mappedValue = value;
-      }
-      targetObject[i] = mappedValue;
-    }
-    return targetObject;
-  },
-  1  /* Set function length. */
-);
-
 // TODO(bmeurer): Migrate this to a proper builtin.
 function TypedArrayConstructor() {
   throw %make_type_error(kConstructAbstractClass, "TypedArray");

src/runtime/runtime-object.cc

@@ -1231,7 +1231,7 @@ RUNTIME_FUNCTION(Runtime_CreateDataProperty) {
 RUNTIME_FUNCTION(Runtime_IterableToListCanBeElided) {
   HandleScope scope(isolate);
   DCHECK_EQ(1, args.length());
-  CONVERT_ARG_HANDLE_CHECKED(JSReceiver, obj, 0);
+  CONVERT_ARG_HANDLE_CHECKED(HeapObject, obj, 0);
 
   if (!obj->IsJSObject()) return isolate->heap()->ToBoolean(false);
 

test/mjsunit/es6/typedarray-from.js

@@ -2,6 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
+// Flags: --allow-natives-syntax
+
 var typedArrayConstructors = [
   Uint8Array,
   Int8Array,
@@ -14,19 +16,65 @@ var typedArrayConstructors = [
   Float64Array
 ];
 
+function defaultValue(constr) {
+  if (constr == Float32Array || constr == Float64Array) return NaN;
+  return 0;
+}
+
+function assertArrayLikeEquals(value, expected, type) {
+  assertEquals(value.__proto__, type.prototype);
+  assertEquals(expected.length, value.length);
+  for (var i = 0; i < value.length; ++i) {
+    assertEquals(expected[i], value[i]);
+  }
+}
+
+(function() {
+  var source = [-0, 0, 2**40, 2**41, 2**42];
+  var arr = Float64Array.from(source);
+  assertArrayLikeEquals(arr, source, Float64Array);
+
+  arr = Float32Array.from(source);
+  assertArrayLikeEquals(arr, source, Float32Array);
+})();
+
+(function() {
+  var source = [-0, 0, , 2**42];
+  var expected = [-0, 0, NaN, 2**42];
+  var arr = Float64Array.from(source);
+  assertArrayLikeEquals(arr, expected, Float64Array);
+
+  arr = Float32Array.from(source);
+  assertArrayLikeEquals(arr, expected, Float32Array);
+})();
+
+(function() {
+  var source = {0: -0, 1: 0, 2: 2**40, 3: 2**41, 4: 2**42, length: 5};
+  var expected = [-0, 0, 2**40, 2**41, 2**42];
+  var arr = Float64Array.from(source);
+  assertArrayLikeEquals(arr, expected, Float64Array);
+
+  arr = Float32Array.from(source);
+  assertArrayLikeEquals(arr, expected, Float32Array);
+})();
+
+(function() {
+  var source = [-0, 0, , 2**42];
+  Object.getPrototypeOf(source)[2] = 27;
+  var expected = [-0, 0, 27, 2**42];
+  var arr = Float64Array.from(source);
+  assertArrayLikeEquals(arr, expected, Float64Array);
+
+  arr = Float32Array.from(source);
+  assertArrayLikeEquals(arr, expected, Float32Array);
+})();
+
 for (var constructor of typedArrayConstructors) {
   assertEquals(1, constructor.from.length);
 
   // TypedArray.from only callable on this subclassing %TypedArray%
   assertThrows(function () {constructor.from.call(Array, [])}, TypeError);
 
-  function assertArrayLikeEquals(value, expected, type) {
-    assertEquals(value.__proto__, type.prototype);
-    assertEquals(expected.length, value.length);
-    for (var i = 0; i < value.length; ++i) {
-      assertEquals(expected[i], value[i]);
-    }
-  }
 
   // Assert that calling mapfn with / without thisArg in sloppy and strict modes
   // works as expected.
@@ -47,6 +95,14 @@ for (var constructor of typedArrayConstructors) {
   assertThrows(function() {constructor.from.call(1, [])}, TypeError);
   assertThrows(function() {constructor.from.call(undefined, [])}, TypeError);
 
+  // Use a map function that returns non-numbers.
+  function mapper(value, index) {
+    return String.fromCharCode(value);
+  }
+  var d = defaultValue(constructor);
+  assertArrayLikeEquals(
+      constructor.from([72, 69, 89], mapper), [d, d, d], constructor);
+
   // Converting from various other types, demonstrating that it can
   // operate on array-like objects as well as iterables.
   // TODO(littledan): constructors should have similar flexibility.
@@ -72,12 +128,50 @@ for (var constructor of typedArrayConstructors) {
   assertArrayLikeEquals(constructor.from(generator()),
                         [4, 5, 6], constructor);
 
+  // Check mapper is used for non-iterator case.
+  function mapper2(value, index) {
+    return value + 1;
+  }
+  var array_like = {
+    0: 1,
+    1: 2,
+    2: 3,
+    length: 3
+  };
+  assertArrayLikeEquals(constructor.from(array_like, mapper2),
+                        [2, 3, 4], constructor);
+
+  // With a smi source. Step 10 will set len = 0.
+  var source = 1;
+  assertArrayLikeEquals(constructor.from(source), [], constructor);
+
   assertThrows(function() { constructor.from(null); }, TypeError);
   assertThrows(function() { constructor.from(undefined); }, TypeError);
   assertThrows(function() { constructor.from([], null); }, TypeError);
   assertThrows(function() { constructor.from([], 'noncallable'); },
                TypeError);
 
+  source = [1, 2, 3];
+  source[Symbol.iterator] = undefined;
+  assertArrayLikeEquals(constructor.from(source), source, constructor);
+
+  source = [{ valueOf: function(){ return 42; }}];
+  source[Symbol.iterator] = undefined;
+  assertArrayLikeEquals(constructor.from(source), [42], constructor);
+
+  source = [1, 2, 3];
+  var proxy = new Proxy(source, {});
+  assertArrayLikeEquals(constructor.from(proxy), source, constructor);
+
+  proxy = new Proxy(source, {
+    get: function(target, name) {
+      if (name === Symbol.iterator) return target[name];
+      if (name === "length") return 3;
+      return target[name] + 1;
+    }
+  });
+  assertArrayLikeEquals(constructor.from(proxy), [2, 3, 4], constructor);
+
   var nullIterator = {};
   nullIterator[Symbol.iterator] = null;
   assertArrayLikeEquals(constructor.from(nullIterator), [],
@@ -90,6 +184,26 @@ for (var constructor of typedArrayConstructors) {
 
   assertThrows(function() { constructor.from([], null); }, TypeError);
 
+  d = defaultValue(constructor);
+  let ta1 = new constructor(3).fill(1);
+  Object.defineProperty(ta1, "length", {get: function() {
+    return 6;
+  }});
+  delete ta1[Symbol.iterator];
+  delete ta1.__proto__[Symbol.iterator];
+  delete ta1.__proto__.__proto__[Symbol.iterator];
+  assertArrayLikeEquals(constructor.from(ta1), [1, 1, 1, d, d, d], constructor);
+
+  let ta2 = new constructor(3).fill(1);
+  Object.defineProperty(ta2, "length", {get: function() {
+    %ArrayBufferNeuter(ta2.buffer);
+    return 6;
+  }});
+  assertArrayLikeEquals(constructor.from(ta2), [d, d, d, d, d, d], constructor);
+
+  var o1 = {0: 0, 1: 1, 2: 2, length: 6};
+  assertArrayLikeEquals(constructor.from(o1), [0, 1, 2, d, d, d], constructor);
+
   // Ensure iterator is only accessed once, and only invoked once
   var called = 0;
   var arr = [1, 2, 3];