[sparkplug] Pass flags to CreateShallowArrayLiteral

CreateShallowArrayLiteral can fail and bail out to the runtime. We
therefore have to pass the literal flags to the builtin, so that the
runtime e.g. initialises the AllocationSite correctly.

Bug: v8:11420
Change-Id: I57dfbbc202aa2c3b0e7ac01f65ee84f6e3763180
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2786848Reviewed-by: Maya Lekova <mslekova@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73666}

src/baseline/baseline-compiler.cc

@@ -1792,15 +1792,16 @@ void BaselineCompiler::VisitCreateRegExpLiteral() {
 
 void BaselineCompiler::VisitCreateArrayLiteral() {
   uint32_t flags = Flag(2);
+  int32_t flags_raw = static_cast<int32_t>(
+      interpreter::CreateArrayLiteralFlags::FlagsBits::decode(flags));
   if (flags &
       interpreter::CreateArrayLiteralFlags::FastCloneSupportedBit::kMask) {
     CallBuiltin(Builtins::kCreateShallowArrayLiteral,
                 FeedbackVector(),          // feedback vector
                 IndexAsTagged(1),          // slot
-                Constant<HeapObject>(0));  // constant elements
+                Constant<HeapObject>(0),   // constant elements
+                Smi::FromInt(flags_raw));  // flags
   } else {
-    int32_t flags_raw = static_cast<int32_t>(
-        interpreter::CreateArrayLiteralFlags::FlagsBits::decode(flags));
     CallRuntime(Runtime::kCreateArrayLiteral,
                 FeedbackVector(),          // feedback vector
                 IndexAsTagged(1),          // slot

src/builtins/constructor.tq

@@ -61,7 +61,7 @@ builtin CreateRegExpLiteral(implicit context: Context)(
 
 builtin CreateShallowArrayLiteral(implicit context: Context)(
     maybeFeedbackVector: Undefined|FeedbackVector, slot: TaggedIndex,
-    constantElements: ArrayBoilerplateDescription): HeapObject {
+    constantElements: ArrayBoilerplateDescription, flags: Smi): HeapObject {
   try {
     const vector = Cast<FeedbackVector>(maybeFeedbackVector)
         otherwise CallRuntime;
@@ -70,8 +70,7 @@ builtin CreateShallowArrayLiteral(implicit context: Context)(
         otherwise CallRuntime;
   } label CallRuntime deferred {
     tail runtime::CreateArrayLiteral(
-        context, maybeFeedbackVector, slot, constantElements,
-        SmiConstant(kIsShallow));
+        context, maybeFeedbackVector, slot, constantElements, flags);
   }
 }
 

src/compiler/js-generic-lowering.cc

@@ -700,6 +700,7 @@ void JSGenericLowering::LowerJSCreateLiteralArray(Node* node) {
   node->InsertInput(zone(), 1,
                     jsgraph()->TaggedIndexConstant(p.feedback().index()));
   node->InsertInput(zone(), 2, jsgraph()->HeapConstant(p.constant()));
+  node->InsertInput(zone(), 3, jsgraph()->SmiConstant(p.flags()));
 
   // Use the CreateShallowArrayLiteral builtin only for shallow boilerplates
   // without properties up to the number of elements that the stubs can handle.
@@ -707,7 +708,6 @@ void JSGenericLowering::LowerJSCreateLiteralArray(Node* node) {
       p.length() < ConstructorBuiltins::kMaximumClonedShallowArrayElements) {
     ReplaceWithBuiltinCall(node, Builtins::kCreateShallowArrayLiteral);
   } else {
-    node->InsertInput(zone(), 3, jsgraph()->SmiConstant(p.flags()));
     ReplaceWithRuntimeCall(node, Runtime::kCreateArrayLiteral);
   }
 }