[turbofan] Fix bug in Array.p.reduce[Right]

Array.p.reduce[Right] did not correctly treat holey arrays
when dealing with mixed holey/non-holey receiver maps.

Bug: chromium:804956
Change-Id: Ic22f64a1beeb93005809948299cde1f1d21a0f19
Reviewed-on: https://chromium-review.googlesource.com/883241Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50864}

src/elements-kind.cc

@@ -153,6 +153,92 @@ bool IsMoreGeneralElementsKindTransition(ElementsKind from_kind,
   return false;
 }
 
+bool UnionElementsKindUptoSize(ElementsKind* a_out, ElementsKind b) {
+  // Assert that the union of two ElementKinds can be computed via std::max.
+  static_assert(PACKED_SMI_ELEMENTS < HOLEY_SMI_ELEMENTS,
+                "ElementsKind union not computable via std::max.");
+  static_assert(HOLEY_SMI_ELEMENTS < PACKED_ELEMENTS,
+                "ElementsKind union not computable via std::max.");
+  static_assert(PACKED_ELEMENTS < HOLEY_ELEMENTS,
+                "ElementsKind union not computable via std::max.");
+  static_assert(PACKED_DOUBLE_ELEMENTS < HOLEY_DOUBLE_ELEMENTS,
+                "ElementsKind union not computable via std::max.");
+  ElementsKind a = *a_out;
+  switch (a) {
+    case PACKED_SMI_ELEMENTS:
+      switch (b) {
+        case PACKED_SMI_ELEMENTS:
+        case HOLEY_SMI_ELEMENTS:
+        case PACKED_ELEMENTS:
+        case HOLEY_ELEMENTS:
+          *a_out = b;
+          return true;
+        default:
+          return false;
+      }
+    case HOLEY_SMI_ELEMENTS:
+      switch (b) {
+        case PACKED_SMI_ELEMENTS:
+        case HOLEY_SMI_ELEMENTS:
+          *a_out = HOLEY_SMI_ELEMENTS;
+          return true;
+        case PACKED_ELEMENTS:
+        case HOLEY_ELEMENTS:
+          *a_out = HOLEY_ELEMENTS;
+          return true;
+        default:
+          return false;
+      }
+    case PACKED_ELEMENTS:
+      switch (b) {
+        case PACKED_SMI_ELEMENTS:
+        case PACKED_ELEMENTS:
+          *a_out = PACKED_ELEMENTS;
+          return true;
+        case HOLEY_SMI_ELEMENTS:
+        case HOLEY_ELEMENTS:
+          *a_out = HOLEY_ELEMENTS;
+          return true;
+        default:
+          return false;
+      }
+    case HOLEY_ELEMENTS:
+      switch (b) {
+        case PACKED_SMI_ELEMENTS:
+        case HOLEY_SMI_ELEMENTS:
+        case PACKED_ELEMENTS:
+        case HOLEY_ELEMENTS:
+          *a_out = HOLEY_ELEMENTS;
+          return true;
+        default:
+          return false;
+      }
+      break;
+    case PACKED_DOUBLE_ELEMENTS:
+      switch (b) {
+        case PACKED_DOUBLE_ELEMENTS:
+        case HOLEY_DOUBLE_ELEMENTS:
+          *a_out = b;
+          return true;
+        default:
+          return false;
+      }
+    case HOLEY_DOUBLE_ELEMENTS:
+      switch (b) {
+        case PACKED_DOUBLE_ELEMENTS:
+        case HOLEY_DOUBLE_ELEMENTS:
+          *a_out = HOLEY_DOUBLE_ELEMENTS;
+          return true;
+        default:
+          return false;
+      }
+
+      break;
+    default:
+      break;
+  }
+  return false;
+}
 
 }  // namespace internal
 }  // namespace v8

src/elements-kind.h

@@ -229,40 +229,7 @@ inline bool UnionElementsKindUptoPackedness(ElementsKind* a_out,
   return false;
 }
 
-inline bool UnionElementsKindUptoSize(ElementsKind* a_out, ElementsKind b) {
-  // Assert that the union of two ElementKinds can be computed via std::max.
-  static_assert(PACKED_SMI_ELEMENTS < HOLEY_SMI_ELEMENTS,
-                "ElementsKind union not computable via std::max.");
-  static_assert(HOLEY_SMI_ELEMENTS < PACKED_ELEMENTS,
-                "ElementsKind union not computable via std::max.");
-  static_assert(PACKED_ELEMENTS < HOLEY_ELEMENTS,
-                "ElementsKind union not computable via std::max.");
-  static_assert(PACKED_DOUBLE_ELEMENTS < HOLEY_DOUBLE_ELEMENTS,
-                "ElementsKind union not computable via std::max.");
-  ElementsKind a = *a_out;
-  switch (a) {
-    case HOLEY_SMI_ELEMENTS:
-    case PACKED_SMI_ELEMENTS:
-    case PACKED_ELEMENTS:
-    case HOLEY_ELEMENTS:
-      if (b == PACKED_ELEMENTS || b == HOLEY_ELEMENTS ||
-          b == PACKED_SMI_ELEMENTS || b == HOLEY_SMI_ELEMENTS) {
-        *a_out = std::max(a, b);
-        return true;
-      }
-      break;
-    case PACKED_DOUBLE_ELEMENTS:
-    case HOLEY_DOUBLE_ELEMENTS:
-      if (b == PACKED_DOUBLE_ELEMENTS || b == HOLEY_DOUBLE_ELEMENTS) {
-        *a_out = std::max(a, b);
-        return true;
-      }
-      break;
-    default:
-      break;
-  }
-  return false;
-}
+bool UnionElementsKindUptoSize(ElementsKind* a_out, ElementsKind b);
 
 inline ElementsKind FastSmiToObjectElementsKind(ElementsKind from_kind) {
   DCHECK(IsSmiElementsKind(from_kind));

test/mjsunit/array-reduce.js

@@ -645,7 +645,6 @@ assertEquals(undefined, arr.reduceRight(function(val) { return val }));
   let deopt = false;
   let array = [, ,11,22,,33,45,56,,6,77,84,93,101,];
   let f = (a,current) => {
-    print(a);
     if (current == 6 && deopt) {array[0] = 1.5; }
     return a + current;
   };
@@ -670,7 +669,6 @@ assertEquals(undefined, arr.reduceRight(function(val) { return val }));
   let deopt = false;
   let array = [, ,11,22,,33,45,56,,6,77,84,93,101,];
   let f = (a,current) => {
-    print(a);
     if (current == 6 && deopt) {array[array.length-1] = 1.5; }
     return a + current;
   };
@@ -1291,3 +1289,14 @@ assertEquals(undefined, arr.reduceRight(function(val) { return val }));
   %OptimizeFunctionOnNextCall(__f_3253);
   assertEquals(18, __f_3253(__v_12258));
 })();
+
+(function ReduceMixedHoleyArrays() {
+  function r(a) {
+    return a.reduce((acc, i) => {acc[0]});
+  }
+  r([[0]]);
+  r([[0]]);
+  r([0,,]);
+  %OptimizeFunctionOnNextCall(r);
+  r([,0,0]);
+})();