[turbofan] Rewrite ToObject as TurboFan stub.

Drive-by fix: Use  CodeStubAssembler::LoadNativeContext()

BUG=chromium:608675

Review-Url: https://codereview.chromium.org/2227763003
Cr-Commit-Position: refs/heads/master@{#38501}

src/builtins/arm/builtins-arm.cc

@@ -2400,8 +2400,10 @@ void Builtins::Generate_CallFunction(MacroAssembler* masm,
         __ SmiTag(r0);
         __ Push(r0, r1);
         __ mov(r0, r3);
+        __ Push(cp);
         ToObjectStub stub(masm->isolate());
         __ CallStub(&stub);
+        __ Pop(cp);
         __ mov(r3, r0);
         __ Pop(r0, r1);
         __ SmiUntag(r0);

src/builtins/arm64/builtins-arm64.cc

@@ -2479,8 +2479,10 @@ void Builtins::Generate_CallFunction(MacroAssembler* masm,
         __ SmiTag(x0);
         __ Push(x0, x1);
         __ Mov(x0, x3);
+        __ Push(cp);
         ToObjectStub stub(masm->isolate());
         __ CallStub(&stub);
+        __ Pop(cp);
         __ Mov(x3, x0);
         __ Pop(x1, x0);
         __ SmiUntag(x0);

src/builtins/ia32/builtins-ia32.cc

@@ -2328,8 +2328,10 @@ void Builtins::Generate_CallFunction(MacroAssembler* masm,
         __ Push(eax);
         __ Push(edi);
         __ mov(eax, ecx);
+        __ Push(esi);
         ToObjectStub stub(masm->isolate());
         __ CallStub(&stub);
+        __ Pop(esi);
         __ mov(ecx, eax);
         __ Pop(edi);
         __ Pop(eax);

src/builtins/mips/builtins-mips.cc

@@ -2413,8 +2413,10 @@ void Builtins::Generate_CallFunction(MacroAssembler* masm,
         __ sll(a0, a0, kSmiTagSize);  // Smi tagged.
         __ Push(a0, a1);
         __ mov(a0, a3);
+        __ Push(cp);
         ToObjectStub stub(masm->isolate());
         __ CallStub(&stub);
+        __ Pop(cp);
         __ mov(a3, v0);
         __ Pop(a0, a1);
         __ sra(a0, a0, kSmiTagSize);  // Un-tag.

src/builtins/mips64/builtins-mips64.cc

@@ -2409,8 +2409,10 @@ void Builtins::Generate_CallFunction(MacroAssembler* masm,
         __ SmiTag(a0);
         __ Push(a0, a1);
         __ mov(a0, a3);
+        __ Push(cp);
         ToObjectStub stub(masm->isolate());
         __ CallStub(&stub);
+        __ Pop(cp);
         __ mov(a3, v0);
         __ Pop(a0, a1);
         __ SmiUntag(a0);

src/builtins/ppc/builtins-ppc.cc

@@ -2457,8 +2457,10 @@ void Builtins::Generate_CallFunction(MacroAssembler* masm,
         __ SmiTag(r3);
         __ Push(r3, r4);
         __ mr(r3, r6);
+        __ Push(cp);
         ToObjectStub stub(masm->isolate());
         __ CallStub(&stub);
+        __ Pop(cp);
         __ mr(r6, r3);
         __ Pop(r3, r4);
         __ SmiUntag(r3);

src/builtins/s390/builtins-s390.cc

@@ -2471,8 +2471,10 @@ void Builtins::Generate_CallFunction(MacroAssembler* masm,
         __ SmiTag(r2);
         __ Push(r2, r3);
         __ LoadRR(r2, r5);
+        __ Push(cp);
         ToObjectStub stub(masm->isolate());
         __ CallStub(&stub);
+        __ Pop(cp);
         __ LoadRR(r5, r2);
         __ Pop(r2, r3);
         __ SmiUntag(r2);

src/builtins/x64/builtins-x64.cc

@@ -2563,8 +2563,10 @@ void Builtins::Generate_CallFunction(MacroAssembler* masm,
         __ Push(rax);
         __ Push(rdi);
         __ movp(rax, rcx);
+        __ Push(rsi);
         ToObjectStub stub(masm->isolate());
         __ CallStub(&stub);
+        __ Pop(rsi);
         __ movp(rcx, rax);
         __ Pop(rdi);
         __ Pop(rax);

src/builtins/x87/builtins-x87.cc

@@ -2352,8 +2352,10 @@ void Builtins::Generate_CallFunction(MacroAssembler* masm,
         __ Push(eax);
         __ Push(edi);
         __ mov(eax, ecx);
+        __ Push(esi);
         ToObjectStub stub(masm->isolate());
         __ CallStub(&stub);
+        __ Pop(esi);
         __ mov(ecx, eax);
         __ Pop(edi);
         __ Pop(eax);

src/code-stubs-hydrogen.cc

@@ -1658,15 +1658,6 @@ Handle<Code> ElementsTransitionAndStoreStub::GenerateCode() {
 }
 
 
-template <>
-HValue* CodeStubGraphBuilder<ToObjectStub>::BuildCodeStub() {
-  HValue* receiver = GetParameter(Descriptor::kArgument);
-  return BuildToObject(receiver);
-}
-
-
-Handle<Code> ToObjectStub::GenerateCode() { return DoGenerateCode(this); }
-
 template <>
 HValue* CodeStubGraphBuilder<LoadDictionaryElementStub>::BuildCodeStub() {
   HValue* receiver = GetParameter(Descriptor::kReceiver);

src/code-stubs.cc

@@ -2083,6 +2083,78 @@ compiler::Node* DecStub::Generate(CodeStubAssembler* assembler,
   return result_var.value();
 }
 
+// ES6 section 7.1.13 ToObject (argument)
+void ToObjectStub::GenerateAssembly(CodeStubAssembler* assembler) const {
+  typedef compiler::Node Node;
+  typedef CodeStubAssembler::Label Label;
+  typedef CodeStubAssembler::Variable Variable;
+
+  Label if_number(assembler, Label::kDeferred), if_notsmi(assembler),
+      if_jsreceiver(assembler), if_noconstructor(assembler, Label::kDeferred),
+      if_wrapjsvalue(assembler);
+
+  Node* object = assembler->Parameter(Descriptor::kArgument);
+  Node* context = assembler->Parameter(Descriptor::kContext);
+
+  Variable constructor_function_index_var(assembler,
+                                          MachineRepresentation::kWord32);
+
+  assembler->Branch(assembler->WordIsSmi(object), &if_number, &if_notsmi);
+
+  assembler->Bind(&if_notsmi);
+  Node* map = assembler->LoadMap(object);
+
+  assembler->GotoIf(
+      assembler->WordEqual(map, assembler->HeapNumberMapConstant()),
+      &if_number);
+
+  Node* instance_type = assembler->LoadMapInstanceType(map);
+  assembler->GotoIf(
+      assembler->Int32GreaterThanOrEqual(
+          instance_type, assembler->Int32Constant(FIRST_JS_RECEIVER_TYPE)),
+      &if_jsreceiver);
+
+  Node* constructor_function_index = assembler->LoadObjectField(
+      map, Map::kInObjectPropertiesOrConstructorFunctionIndexOffset,
+      MachineType::Uint8());
+  assembler->GotoIf(
+      assembler->Word32Equal(
+          constructor_function_index,
+          assembler->Int32Constant(Map::kNoConstructorFunctionIndex)),
+      &if_noconstructor);
+  constructor_function_index_var.Bind(constructor_function_index);
+  assembler->Goto(&if_wrapjsvalue);
+
+  assembler->Bind(&if_number);
+  constructor_function_index_var.Bind(
+      assembler->Int32Constant(Context::NUMBER_FUNCTION_INDEX));
+  assembler->Goto(&if_wrapjsvalue);
+
+  assembler->Bind(&if_wrapjsvalue);
+  Node* native_context = assembler->LoadNativeContext(context);
+  Node* constructor = assembler->LoadFixedArrayElement(
+      native_context, constructor_function_index_var.value());
+  Node* initial_map = assembler->LoadObjectField(
+      constructor, JSFunction::kPrototypeOrInitialMapOffset);
+  Node* js_value = assembler->Allocate(JSValue::kSize);
+  assembler->StoreMapNoWriteBarrier(js_value, initial_map);
+  assembler->StoreObjectFieldRoot(js_value, JSValue::kPropertiesOffset,
+                                  Heap::kEmptyFixedArrayRootIndex);
+  assembler->StoreObjectFieldRoot(js_value, JSObject::kElementsOffset,
+                                  Heap::kEmptyFixedArrayRootIndex);
+  assembler->StoreObjectField(js_value, JSValue::kValueOffset, object);
+  assembler->Return(js_value);
+
+  assembler->Bind(&if_noconstructor);
+  assembler->TailCallRuntime(
+      Runtime::kThrowUndefinedOrNullToObject, context,
+      assembler->HeapConstant(assembler->factory()->NewStringFromAsciiChecked(
+          "ToObject", TENURED)));
+
+  assembler->Bind(&if_jsreceiver);
+  assembler->Return(object);
+}
+
 // static
 // ES6 section 12.5.5 typeof operator
 compiler::Node* TypeofStub::Generate(CodeStubAssembler* assembler,
@@ -2107,7 +2179,7 @@ compiler::Node* TypeofStub::Generate(CodeStubAssembler* assembler,
       assembler->WordEqual(map, assembler->HeapNumberMapConstant()),
       &return_number);
 
-  Node* instance_type = assembler->LoadInstanceType(value);
+  Node* instance_type = assembler->LoadMapInstanceType(map);
 
   assembler->GotoIf(assembler->Word32Equal(
                         instance_type, assembler->Int32Constant(ODDBALL_TYPE)),
@@ -4345,12 +4417,6 @@ void ElementsTransitionAndStoreStub::InitializeDescriptor(
       FUNCTION_ADDR(Runtime_ElementsTransitionAndStoreIC_Miss));
 }
 
-
-void ToObjectStub::InitializeDescriptor(CodeStubDescriptor* descriptor) {
-  descriptor->Initialize(Runtime::FunctionForId(Runtime::kToObject)->entry);
-  descriptor->SetMissHandler(Runtime::kToObject);
-}
-
 void StoreTransitionStub::InitializeDescriptor(CodeStubDescriptor* descriptor) {
   descriptor->Initialize(
       FUNCTION_ADDR(Runtime_TransitionStoreIC_MissFromStubFailure));
@@ -4781,8 +4847,7 @@ compiler::Node* FastNewFunctionContextStub::Generate(
       assembler->TheHoleConstant(), SKIP_WRITE_BARRIER);
 
   // Copy the native context from the previous context.
-  Node* native_context = assembler->LoadFixedArrayElement(
-      context, assembler->Int32Constant(Context::NATIVE_CONTEXT_INDEX));
+  Node* native_context = assembler->LoadNativeContext(context);
   assembler->StoreFixedArrayElement(
       function_context, assembler->Int32Constant(Context::NATIVE_CONTEXT_INDEX),
       native_context, SKIP_WRITE_BARRIER);

src/code-stubs.h

@@ -3153,13 +3153,12 @@ class ToNameStub final : public PlatformCodeStub {
   DEFINE_PLATFORM_CODE_STUB(ToName, PlatformCodeStub);
 };
 
-
-class ToObjectStub final : public HydrogenCodeStub {
+class ToObjectStub final : public TurboFanCodeStub {
  public:
-  explicit ToObjectStub(Isolate* isolate) : HydrogenCodeStub(isolate) {}
+  explicit ToObjectStub(Isolate* isolate) : TurboFanCodeStub(isolate) {}
 
   DEFINE_CALL_INTERFACE_DESCRIPTOR(TypeConversion);
-  DEFINE_HYDROGEN_CODE_STUB(ToObject, HydrogenCodeStub);
+  DEFINE_TURBOFAN_CODE_STUB(ToObject, TurboFanCodeStub);
 };
 
 #undef DEFINE_CALL_INTERFACE_DESCRIPTOR

src/full-codegen/arm/full-codegen-arm.cc

@@ -1005,6 +1005,7 @@ void FullCodeGenerator::VisitForInStatement(ForInStatement* stmt) {
   __ bind(&convert);
   ToObjectStub stub(isolate());
   __ CallStub(&stub);
+  RestoreContext();
   __ bind(&done_convert);
   PrepareForBailoutForId(stmt->ToObjectId(), BailoutState::TOS_REGISTER);
   __ push(r0);

src/full-codegen/arm64/full-codegen-arm64.cc

@@ -1001,6 +1001,7 @@ void FullCodeGenerator::VisitForInStatement(ForInStatement* stmt) {
   __ Bind(&convert);
   ToObjectStub stub(isolate());
   __ CallStub(&stub);
+  RestoreContext();
   __ Bind(&done_convert);
   PrepareForBailoutForId(stmt->ToObjectId(), BailoutState::TOS_REGISTER);
   __ Push(x0);

src/full-codegen/full-codegen.cc

@@ -1069,6 +1069,7 @@ void FullCodeGenerator::VisitWithStatement(WithStatement* stmt) {
   Callable callable = CodeFactory::ToObject(isolate());
   __ Move(callable.descriptor().GetRegisterParameter(0), result_register());
   __ Call(callable.code(), RelocInfo::CODE_TARGET);
+  RestoreContext();
   PrepareForBailoutForId(stmt->ToObjectId(), BailoutState::TOS_REGISTER);
   PushOperand(result_register());
   PushFunctionArgumentForContextAllocation();

src/full-codegen/ia32/full-codegen-ia32.cc

@@ -947,6 +947,7 @@ void FullCodeGenerator::VisitForInStatement(ForInStatement* stmt) {
   __ bind(&convert);
   ToObjectStub stub(isolate());
   __ CallStub(&stub);
+  RestoreContext();
   __ bind(&done_convert);
   PrepareForBailoutForId(stmt->ToObjectId(), BailoutState::TOS_REGISTER);
   __ push(eax);

src/full-codegen/mips/full-codegen-mips.cc

@@ -1001,6 +1001,7 @@ void FullCodeGenerator::VisitForInStatement(ForInStatement* stmt) {
   __ bind(&convert);
   ToObjectStub stub(isolate());
   __ CallStub(&stub);
+  RestoreContext();
   __ mov(a0, v0);
   __ bind(&done_convert);
   PrepareForBailoutForId(stmt->ToObjectId(), BailoutState::TOS_REGISTER);

src/full-codegen/mips64/full-codegen-mips64.cc

@@ -1001,6 +1001,7 @@ void FullCodeGenerator::VisitForInStatement(ForInStatement* stmt) {
   __ bind(&convert);
   ToObjectStub stub(isolate());
   __ CallStub(&stub);
+  RestoreContext();
   __ mov(a0, v0);
   __ bind(&done_convert);
   PrepareForBailoutForId(stmt->ToObjectId(), BailoutState::TOS_REGISTER);

src/full-codegen/ppc/full-codegen-ppc.cc

@@ -968,6 +968,7 @@ void FullCodeGenerator::VisitForInStatement(ForInStatement* stmt) {
   __ bind(&convert);
   ToObjectStub stub(isolate());
   __ CallStub(&stub);
+  RestoreContext();
   __ bind(&done_convert);
   PrepareForBailoutForId(stmt->ToObjectId(), BailoutState::TOS_REGISTER);
   __ push(r3);

src/full-codegen/s390/full-codegen-s390.cc

@@ -939,6 +939,7 @@ void FullCodeGenerator::VisitForInStatement(ForInStatement* stmt) {
   __ bind(&convert);
   ToObjectStub stub(isolate());
   __ CallStub(&stub);
+  RestoreContext();
   __ bind(&done_convert);
   PrepareForBailoutForId(stmt->ToObjectId(), BailoutState::TOS_REGISTER);
   __ push(r2);

src/full-codegen/x64/full-codegen-x64.cc

@@ -962,6 +962,7 @@ void FullCodeGenerator::VisitForInStatement(ForInStatement* stmt) {
   __ bind(&convert);
   ToObjectStub stub(isolate());
   __ CallStub(&stub);
+  RestoreContext();
   __ bind(&done_convert);
   PrepareForBailoutForId(stmt->ToObjectId(), BailoutState::TOS_REGISTER);
   __ Push(rax);

src/full-codegen/x87/full-codegen-x87.cc

@@ -939,6 +939,7 @@ void FullCodeGenerator::VisitForInStatement(ForInStatement* stmt) {
   __ bind(&convert);
   ToObjectStub stub(isolate());
   __ CallStub(&stub);
+  RestoreContext();
   __ bind(&done_convert);
   PrepareForBailoutForId(stmt->ToObjectId(), BailoutState::TOS_REGISTER);
   __ push(eax);

src/runtime/runtime-internal.cc

@@ -466,7 +466,6 @@ RUNTIME_FUNCTION(Runtime_ThrowConstructedNonConstructable) {
       isolate, NewTypeError(MessageTemplate::kNotConstructor, callsite));
 }
 
-
 RUNTIME_FUNCTION(Runtime_ThrowDerivedConstructorReturnedNonObject) {
   HandleScope scope(isolate);
   DCHECK_EQ(0, args.length());
@@ -474,6 +473,13 @@ RUNTIME_FUNCTION(Runtime_ThrowDerivedConstructorReturnedNonObject) {
       isolate, NewTypeError(MessageTemplate::kDerivedConstructorReturn));
 }
 
+RUNTIME_FUNCTION(Runtime_ThrowUndefinedOrNullToObject) {
+  HandleScope scope(isolate);
+  DCHECK_EQ(1, args.length());
+  CONVERT_ARG_HANDLE_CHECKED(String, name, 0);
+  THROW_NEW_ERROR_RETURN_FAILURE(
+      isolate, NewTypeError(MessageTemplate::kUndefinedOrNullToObject, name));
+}
 
 // ES6 section 7.3.17 CreateListFromArrayLike (obj)
 RUNTIME_FUNCTION(Runtime_CreateListFromArrayLike) {

src/runtime/runtime.h

@@ -281,51 +281,52 @@ namespace internal {
 #endif
 
 #define FOR_EACH_INTRINSIC_INTERNAL(F)              \
+  F(AllocateInNewSpace, 1, 1)                       \
+  F(AllocateInTargetSpace, 2, 1)                    \
+  F(AllocateSeqOneByteString, 1, 1)                 \
+  F(AllocateSeqTwoByteString, 1, 1)                 \
   F(CheckIsBootstrapping, 0, 1)                     \
-  F(ExportFromRuntime, 1, 1)                        \
+  F(CreateListFromArrayLike, 1, 1)                  \
+  F(EnqueueMicrotask, 1, 1)                         \
+  F(GetAndResetRuntimeCallStats, -1 /* <= 2 */, 1)  \
   F(ExportExperimentalFromRuntime, 1, 1)            \
+  F(ExportFromRuntime, 1, 1)                        \
+  F(IncrementUseCounter, 1, 1)                      \
   F(InstallToContext, 1, 1)                         \
-  F(Throw, 1, 1)                                    \
-  F(ReThrow, 1, 1)                                  \
-  F(UnwindAndFindExceptionHandler, 0, 1)            \
+  F(Interrupt, 0, 1)                                \
+  F(IS_VAR, 1, 1)                                   \
+  F(IsWasmObject, 1, 1)                             \
+  F(MessageGetScript, 1, 1)                         \
+  F(MessageGetStartPosition, 1, 1)                  \
+  F(NewReferenceError, 2, 1)                        \
+  F(NewSyntaxError, 2, 1)                           \
+  F(NewTypeError, 2, 1)                             \
+  F(OrdinaryHasInstance, 2, 1)                      \
+  F(PromiseRejectEvent, 3, 1)                       \
+  F(PromiseRevokeReject, 1, 1)                      \
   F(PromoteScheduledException, 0, 1)                \
-  F(ThrowReferenceError, 1, 1)                      \
+  F(ReThrow, 1, 1)                                  \
+  F(RunMicrotasks, 0, 1)                            \
+  F(StackGuard, 0, 1)                               \
+  F(Throw, 1, 1)                                    \
   F(ThrowApplyNonFunction, 1, 1)                    \
-  F(NewTypeError, 2, 1)                             \
-  F(NewSyntaxError, 2, 1)                           \
-  F(NewReferenceError, 2, 1)                        \
   F(ThrowCannotConvertToPrimitive, 0, 1)            \
+  F(ThrowCalledNonCallable, 1, 1)                   \
+  F(ThrowCalledOnNullOrUndefined, 1, 1)             \
+  F(ThrowConstructedNonConstructable, 1, 1)         \
+  F(ThrowDerivedConstructorReturnedNonObject, 0, 1) \
+  F(ThrowGeneratorRunning, 0, 1)                    \
   F(ThrowIllegalInvocation, 0, 1)                   \
   F(ThrowIncompatibleMethodReceiver, 2, 1)          \
   F(ThrowInvalidStringLength, 0, 1)                 \
   F(ThrowIteratorResultNotAnObject, 1, 1)           \
   F(ThrowNotGeneric, 1, 1)                          \
-  F(ThrowGeneratorRunning, 0, 1)                    \
+  F(ThrowReferenceError, 1, 1)                      \
   F(ThrowStackOverflow, 0, 1)                       \
   F(ThrowWasmError, 2, 1)                           \
-  F(PromiseRejectEvent, 3, 1)                       \
-  F(PromiseRevokeReject, 1, 1)                      \
-  F(StackGuard, 0, 1)                               \
-  F(Interrupt, 0, 1)                                \
-  F(AllocateInNewSpace, 1, 1)                       \
-  F(AllocateInTargetSpace, 2, 1)                    \
-  F(AllocateSeqOneByteString, 1, 1)                 \
-  F(AllocateSeqTwoByteString, 1, 1)                 \
-  F(MessageGetStartPosition, 1, 1)                  \
-  F(MessageGetScript, 1, 1)                         \
-  F(IS_VAR, 1, 1)                                   \
-  F(ThrowConstructedNonConstructable, 1, 1)         \
-  F(ThrowDerivedConstructorReturnedNonObject, 0, 1) \
-  F(ThrowCalledNonCallable, 1, 1)                   \
-  F(ThrowCalledOnNullOrUndefined, 1, 1)             \
-  F(CreateListFromArrayLike, 1, 1)                  \
-  F(IncrementUseCounter, 1, 1)                      \
-  F(GetAndResetRuntimeCallStats, -1 /* <= 2 */, 1)  \
-  F(EnqueueMicrotask, 1, 1)                         \
-  F(RunMicrotasks, 0, 1)                            \
-  F(OrdinaryHasInstance, 2, 1)                      \
-  F(IsWasmObject, 1, 1)                             \
-  F(Typeof, 1, 1)
+  F(ThrowUndefinedOrNullToObject, 1, 1)             \
+  F(Typeof, 1, 1)                                   \
+  F(UnwindAndFindExceptionHandler, 0, 1)
 
 #define FOR_EACH_INTRINSIC_LITERALS(F) \
   F(CreateRegExpLiteral, 4, 1)         \