[turbofan] Allow missing length and name in JSCallReducer

MapRef::GetStrongValue now returns an Optional to account for the case
where we can't figure out the name of the bound function during
serialization. We could reach out to the heap in the future in this
case.

Fixed: chromium:1034203
Change-Id: I9fa81921b5dbd8bc9f68aa3c10921bc01b695a6b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1967386Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65470}

src/compiler/heap-refs.h

@@ -625,7 +625,8 @@ class V8_EXPORT_PRIVATE MapRef : public HeapObjectRef {
   FieldIndex GetFieldIndexFor(InternalIndex descriptor_index) const;
   ObjectRef GetFieldType(InternalIndex descriptor_index) const;
   bool IsUnboxedDoubleField(InternalIndex descriptor_index) const;
-  ObjectRef GetStrongValue(InternalIndex descriptor_number) const;
+  base::Optional<ObjectRef> GetStrongValue(
+      InternalIndex descriptor_number) const;
 
   void SerializeRootMap();
   base::Optional<MapRef> FindRootMap() const;

src/compiler/js-call-reducer.cc

@@ -1550,10 +1550,14 @@ Reduction JSCallReducer::ReduceFunctionPrototypeBind(Node* node) {
     StringRef length_string(broker(), roots.length_string_handle());
     StringRef name_string(broker(), roots.name_string_handle());
 
+    base::Optional<ObjectRef> length_value(
+        receiver_map.GetStrongValue(kLengthIndex));
+    base::Optional<ObjectRef> name_value(
+        receiver_map.GetStrongValue(kNameIndex));
     if (!receiver_map.GetPropertyKey(kLengthIndex).equals(length_string) ||
-        !receiver_map.GetStrongValue(kLengthIndex).IsAccessorInfo() ||
+        (length_value && !length_value->IsAccessorInfo()) ||
         !receiver_map.GetPropertyKey(kNameIndex).equals(name_string) ||
-        !receiver_map.GetStrongValue(kNameIndex).IsAccessorInfo()) {
+        (name_value && !name_value->IsAccessorInfo())) {
       return inference.NoChange();
     }
   }

src/compiler/js-heap-broker.cc

@@ -3446,7 +3446,8 @@ BIMODAL_ACCESSOR_C(String, int, length)
 
 BIMODAL_ACCESSOR(FeedbackCell, HeapObject, value)
 
-ObjectRef MapRef::GetStrongValue(InternalIndex descriptor_index) const {
+base::Optional<ObjectRef> MapRef::GetStrongValue(
+    InternalIndex descriptor_index) const {
   if (data_->kind() == ObjectDataKind::kUnserializedHeapObject) {
     AllowHandleDereference allow_handle_dereference;
     return ObjectRef(broker(),
@@ -3454,7 +3455,11 @@ ObjectRef MapRef::GetStrongValue(InternalIndex descriptor_index) const {
                                 descriptor_index),
                             broker()->isolate()));
   }
-  return ObjectRef(broker(), data()->AsMap()->GetStrongValue(descriptor_index));
+  ObjectData* value = data()->AsMap()->GetStrongValue(descriptor_index);
+  if (!value) {
+    return base::nullopt;
+  }
+  return ObjectRef(broker(), value);
 }
 
 void MapRef::SerializeRootMap() {

src/compiler/serializer-for-background-compilation.cc

@@ -967,8 +967,7 @@ std::ostream& operator<<(
     for (size_t i = 0; i < env.locals_hints_.size(); ++i) {
       Hints const& hints = env.locals_hints_[i];
       if (!hints.IsEmpty()) {
-        size_t local_register = i - env.locals_hints_.size();
-        output_stream << "Hints for r" << local_register << ": " << hints;
+        output_stream << "Hints for r" << i << ": " << hints;
       }
     }
   }

test/mjsunit/compiler/regress-1034203.js

+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --opt --allow-natives-syntax
+
+function foo(optimized) {
+  class C {
+    ['h']() { return 42; }
+  }
+  let h = C.prototype.h;
+  let val = h.bind()();
+  if (optimized) {
+    %TurbofanStaticAssert(val === 42);
+  }
+}
+
+%PrepareFunctionForOptimization(foo);
+foo(false);
+%OptimizeFunctionOnNextCall(foo);
+foo(true);