[ic] Handle String character loads in KeyedLoadIC_Megamorphic.

This was discovered on the babel test of the web-tooling-benchmark,
which suffers from a high %KeyedGetProperty overhead, and most of
these calls come from the fact that the KeyedLoadIC_Megamorphic bails
out to the runtime call for all String instance types. Just handling
in-bound accesses to characters reduces the overhead incurred by
%KeyedGetProperty from roughly 9% to roughly 2% only.

This reduces the number of runs per second on the babel test by around
7-8% on average.

Bug: v8:6936, v8:7014
Change-Id: I0dc247d7d6457c7032636d2852cb54cef1b24979
Reviewed-on: https://chromium-review.googlesource.com/743012Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49021}

src/ic/accessor-assembler.cc

@@ -1623,12 +1623,12 @@ void AccessorAssembler::GenericElementLoad(Node* receiver, Node* receiver_map,
 
   ExitPoint direct_exit(this);
 
-  Label if_element_hole(this), if_oob(this);
+  Label if_custom(this), if_element_hole(this), if_oob(this);
   // Receivers requiring non-standard element accesses (interceptors, access
   // checks, strings and string wrappers, proxies) are handled in the runtime.
   GotoIf(Int32LessThanOrEqual(instance_type,
                               Int32Constant(LAST_CUSTOM_ELEMENTS_RECEIVER)),
-         slow);
+         &if_custom);
   Node* elements = LoadElements(receiver);
   Node* elements_kind = LoadMapElementsKind(receiver_map);
   Node* is_jsarray_condition = InstanceTypeEqual(instance_type, JS_ARRAY_TYPE);
@@ -1664,6 +1664,18 @@ void AccessorAssembler::GenericElementLoad(Node* receiver, Node* receiver_map,
     BIND(&return_undefined);
     Return(UndefinedConstant());
   }
+
+  BIND(&if_custom);
+  {
+    Comment("check if string");
+    GotoIfNot(IsStringInstanceType(instance_type), slow);
+    Comment("load string character");
+    Node* length = LoadAndUntagObjectField(receiver, String::kLengthOffset);
+    GotoIfNot(UintPtrLessThan(index, length), slow);
+    IncrementCounter(isolate()->counters()->ic_keyed_load_generic_smi(), 1);
+    TailCallBuiltin(Builtins::kStringCharAt, NoContextConstant(), receiver,
+                    index);
+  }
 }
 
 void AccessorAssembler::GenericPropertyLoad(Node* receiver, Node* receiver_map,