Move Oddball/String to %Typearray%.prototype.fill fast path

ToNumber for Oddball/String has no side-effect, no need to go
through %Typearray%.prototype.fill slow path.

BUG=v8:5929,chromium:702902

Review-Url: https://codereview.chromium.org/2769673002
Cr-Commit-Position: refs/heads/master@{#44129}

src/elements.cc

@@ -2863,16 +2863,23 @@ class TypedElementsAccessor
     Handle<JSTypedArray> array = Handle<JSTypedArray>::cast(receiver);
     DCHECK(!array->WasNeutered());
 
-    if (!obj_value->IsNumber()) {
-      return FillNumberSlowPath(isolate, array, obj_value, start, end);
-    }
-
-    ctype value = 0;
+    ctype value;
     if (obj_value->IsSmi()) {
       value = BackingStore::from_int(Smi::cast(*obj_value)->value());
     } else {
-      DCHECK(obj_value->IsHeapNumber());
-      value = BackingStore::from_double(HeapNumber::cast(*obj_value)->value());
+      Handle<HeapObject> heap_obj_value = Handle<HeapObject>::cast(obj_value);
+      if (heap_obj_value->IsHeapNumber()) {
+        value = BackingStore::from_double(
+            HeapNumber::cast(*heap_obj_value)->value());
+      } else if (heap_obj_value->IsOddball()) {
+        value = BackingStore::from_double(
+            Oddball::ToNumber(Handle<Oddball>::cast(heap_obj_value))->Number());
+      } else if (heap_obj_value->IsString()) {
+        value = BackingStore::from_double(
+            String::ToNumber(Handle<String>::cast(heap_obj_value))->Number());
+      } else {
+        return FillNumberSlowPath(isolate, array, obj_value, start, end);
+      }
     }
 
     // Ensure indexes are within array bounds

test/mjsunit/es6/typedarray-fill.js

@@ -2,16 +2,22 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-var typedArrayConstructors = [
+var intArrayConstructors = [
   Uint8Array,
   Int8Array,
   Uint16Array,
   Int16Array,
   Uint32Array,
   Int32Array,
-  Uint8ClampedArray,
+  Uint8ClampedArray
+];
+
+var floatArrayConstructors = [
   Float32Array,
-  Float64Array];
+  Float64Array
+];
+
+var typedArrayConstructors = [...intArrayConstructors, ...floatArrayConstructors];
 
 for (var constructor of typedArrayConstructors) {
   assertEquals(1, constructor.prototype.fill.length);
@@ -40,6 +46,11 @@ for (var constructor of typedArrayConstructors) {
   assertThrows('constructor.prototype.fill.call(undefined)', TypeError);
   assertThrows('constructor.prototype.fill.call([])', TypeError);
 
+  assertArrayEquals([0, 0, 0, 0, 0], new constructor([0, 0, 0, 0, 0]).fill(false));
+  assertArrayEquals([1, 1, 1, 1, 1], new constructor([0, 0, 0, 0, 0]).fill(true));
+  assertArrayEquals([0, 0, 0, 0, 0], new constructor([0, 0, 0, 0, 0]).fill(null));
+  assertArrayEquals([8, 8, 8, 8, 8], new constructor([0, 0, 0, 0, 0]).fill("8"));
+
   // Test ToNumber
   var s = "";
   var p = new Proxy({}, {get(t,k) { s += k.toString() + '\n'; return Reflect.get(t, k)}})
@@ -67,9 +78,17 @@ Symbol(Symbol.toStringTag)
   assertArrayEquals([4, 3], [a[0], a[1]]);
 }
 
-// Empty args
-assertArrayEquals([0], new Uint8Array([0]).fill());
-assertArrayEquals([NaN], new Float32Array([0]).fill());
+for (var constructor of intArrayConstructors) {
+  assertArrayEquals([0, 0, 0, 0, 0], new constructor([0, 0, 0, 0, 0]).fill(undefined));
+  assertArrayEquals([0, 0, 0, 0, 0], new constructor([0, 0, 0, 0, 0]).fill());
+  assertArrayEquals([0, 0, 0, 0, 0], new constructor([0, 0, 0, 0, 0]).fill("abcd"));
+}
+
+for (var constructor of floatArrayConstructors) {
+  assertArrayEquals([NaN, NaN, NaN, NaN, NaN], new constructor([0, 0, 0, 0, 0]).fill(undefined));
+  assertArrayEquals([NaN, NaN, NaN, NaN, NaN], new constructor([0, 0, 0, 0, 0]).fill());
+  assertArrayEquals([NaN, NaN, NaN, NaN, NaN], new constructor([0, 0, 0, 0, 0]).fill("abcd"));
+}
 
 // Clamping
 assertArrayEquals([0, 0, 0, 0, 0], new Uint8ClampedArray([0, 0, 0, 0, 0]).fill(-10));