[ic] Add support for StoreSlow() for StoreInArrayLiteral.

Bug: v8:9779
Change-Id: Ia1389c02b89ff938b4f87408f9193ef66135d772
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1822738
Commit-Queue: Suraj Sharma <surshar@microsoft.com>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63999}

src/ic/accessor-assembler.cc

@@ -3395,9 +3395,13 @@ void AccessorAssembler::StoreInArrayLiteralIC(const StoreICParameters* p) {
     {
       Comment("StoreInArrayLiteralIC_if_handler");
       // This is a stripped-down version of HandleStoreICHandlerCase.
+      Label if_transitioning_element_store(this), if_smi_handler(this);
+
+      // Check used to identify the Slow case.
+      // Currently only the Slow case uses a Smi handler.
+      GotoIf(TaggedIsSmi(var_handler.value()), &if_smi_handler);
 
       TNode<HeapObject> handler = CAST(var_handler.value());
-      Label if_transitioning_element_store(this);
       GotoIfNot(IsCode(handler), &if_transitioning_element_store);
       TailCallStub(StoreWithVectorDescriptor{}, CAST(handler), p->context(),
                    p->receiver(), p->name(), p->value(), p->slot(),
@@ -3416,6 +3420,22 @@ void AccessorAssembler::StoreInArrayLiteralIC(const StoreICParameters* p) {
                      p->receiver(), p->name(), transition_map, p->value(),
                      p->slot(), p->vector());
       }
+
+      BIND(&if_smi_handler);
+      {
+#ifdef DEBUG
+        // A check to ensure that no other Smi handler uses this path.
+        TNode<Int32T> handler_word = SmiToInt32(CAST(var_handler.value()));
+        TNode<Uint32T> handler_kind =
+            DecodeWord32<StoreHandler::KindBits>(handler_word);
+        CSA_ASSERT(this, Word32Equal(handler_kind,
+                                     Int32Constant(StoreHandler::kSlow)));
+#endif
+
+        Comment("StoreInArrayLiteralIC_Slow");
+        TailCallRuntime(Runtime::kStoreInArrayLiteralIC_Slow, p->context(),
+                        p->value(), p->receiver(), p->name());
+      }
     }
 
     BIND(&try_polymorphic);

src/ic/ic.cc

@@ -1402,7 +1402,7 @@ MaybeHandle<Object> StoreGlobalIC::Store(Handle<Name> name,
       } else {
         // Given combination of indices can't be encoded, so use slow stub.
         TRACE_HANDLER_STATS(isolate(), StoreGlobalIC_SlowStub);
-        PatchCache(name, slow_stub());
+        PatchCache(name, StoreHandler::StoreSlow(isolate()));
       }
       TraceIC("StoreGlobalIC", name);
     }
@@ -1435,7 +1435,7 @@ MaybeHandle<Object> StoreIC::Store(Handle<Object> object, Handle<Name> name,
       // Ensure the IC state progresses.
       TRACE_HANDLER_STATS(isolate(), StoreIC_NonReceiver);
       update_receiver_map(object);
-      PatchCache(name, slow_stub());
+      PatchCache(name, StoreHandler::StoreSlow(isolate()));
       TraceIC("StoreIC", name);
     }
     return TypeError(MessageTemplate::kNonObjectPropertyStore, object, name);
@@ -1498,7 +1498,6 @@ void StoreIC::UpdateCaches(LookupIterator* lookup, Handle<Object> value,
     handler = ComputeHandler(lookup);
   } else {
     set_slow_stub_reason("LookupForWrite said 'false'");
-    // TODO(marja): change slow_stub to return MaybeObjectHandle.
     handler = MaybeObjectHandle(StoreHandler::StoreSlow(isolate()));
   }
 
@@ -1920,7 +1919,7 @@ void KeyedStoreIC::StoreElementPolymorphicHandlers(
       // TODO(mvstanton): Consider embedding store_mode in the state of the slow
       // keyed store ic for uniformity.
       TRACE_HANDLER_STATS(isolate(), KeyedStoreIC_SlowStub);
-      handler = slow_stub();
+      handler = StoreHandler::StoreSlow(isolate());
 
     } else {
       {

src/ic/ic.h

@@ -268,11 +268,6 @@ class StoreIC : public IC {
 
  protected:
   // Stub accessors.
-  virtual Handle<Code> slow_stub() const {
-    // All StoreICs share the same slow stub.
-    return BUILTIN_CODE(isolate(), KeyedStoreIC_Slow);
-  }
-
   // Update the inline cache and the global stub cache based on the
   // lookup result.
   void UpdateCaches(LookupIterator* lookup, Handle<Object> value,
@@ -292,11 +287,6 @@ class StoreGlobalIC : public StoreIC {
 
   V8_WARN_UNUSED_RESULT MaybeHandle<Object> Store(Handle<Name> name,
                                                   Handle<Object> value);
-
- protected:
-  Handle<Code> slow_stub() const override {
-    return BUILTIN_CODE(isolate(), StoreGlobalIC_Slow);
-  }
 };
 
 enum KeyedStoreCheckMap { kDontCheckMap, kCheckMap };
@@ -328,10 +318,6 @@ class KeyedStoreIC : public StoreIC {
                           KeyedAccessStoreMode store_mode,
                           Handle<Map> new_receiver_map);
 
-  Handle<Code> slow_stub() const override {
-    return BUILTIN_CODE(isolate(), KeyedStoreIC_Slow);
-  }
-
  private:
   Handle<Map> ComputeTransitionedMap(Handle<Map> map,
                                      TransitionMode transition_mode);
@@ -356,11 +342,6 @@ class StoreInArrayLiteralIC : public KeyedStoreIC {
   }
 
   void Store(Handle<JSArray> array, Handle<Object> index, Handle<Object> value);
-
- private:
-  Handle<Code> slow_stub() const override {
-    return BUILTIN_CODE(isolate(), StoreInArrayLiteralIC_Slow);
-  }
 };
 
 }  // namespace internal