[turbofan] Handle mixed packed/unpacked multimaps in Array.prototype.push

Bug: v8:7127, v8:7204, v8:7205
Change-Id: I4eb009492222b208ff8875b4b7940174dfb132ff
Reviewed-on: https://chromium-review.googlesource.com/847576
Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50451}

src/compiler/js-call-reducer.cc

@@ -3612,11 +3612,12 @@ Reduction JSCallReducer::ReduceArrayPrototypePush(Node* node) {
   if (result == NodeProperties::kNoReceiverMaps) return NoChange();
   DCHECK_NE(0, receiver_maps.size());
 
-  const ElementsKind kind = receiver_maps[0]->elements_kind();
+  ElementsKind kind = receiver_maps[0]->elements_kind();
 
   for (Handle<Map> receiver_map : receiver_maps) {
     if (!CanInlineArrayResizeOperation(receiver_map)) return NoChange();
-    if (receiver_map->elements_kind() != kind) return NoChange();
+    if (!UnionElementsKindUptoPackedness(&kind, receiver_map->elements_kind()))
+      return NoChange();
   }
 
   // Install code dependencies on the {receiver} global array protector cell.

src/elements-kind.h

@@ -191,6 +191,43 @@ inline ElementsKind GetHoleyElementsKind(ElementsKind packed_kind) {
   return packed_kind;
 }
 
+inline bool UnionElementsKindUptoPackedness(ElementsKind* a_out,
+                                            ElementsKind b) {
+  // Assert that the union of two ElementKinds can be computed via std::max.
+  static_assert(PACKED_SMI_ELEMENTS < HOLEY_SMI_ELEMENTS,
+                "ElementsKind union not computable via std::max.");
+  static_assert(PACKED_ELEMENTS < HOLEY_ELEMENTS,
+                "ElementsKind union not computable via std::max.");
+  static_assert(PACKED_DOUBLE_ELEMENTS < HOLEY_DOUBLE_ELEMENTS,
+                "ElementsKind union not computable via std::max.");
+  ElementsKind a = *a_out;
+  switch (a) {
+    case HOLEY_SMI_ELEMENTS:
+    case PACKED_SMI_ELEMENTS:
+      if (b == PACKED_SMI_ELEMENTS || b == HOLEY_SMI_ELEMENTS) {
+        *a_out = std::max(a, b);
+        return true;
+      }
+      break;
+    case PACKED_ELEMENTS:
+    case HOLEY_ELEMENTS:
+      if (b == PACKED_ELEMENTS || b == HOLEY_ELEMENTS) {
+        *a_out = std::max(a, b);
+        return true;
+      }
+      break;
+    case PACKED_DOUBLE_ELEMENTS:
+    case HOLEY_DOUBLE_ELEMENTS:
+      if (b == PACKED_DOUBLE_ELEMENTS || b == HOLEY_DOUBLE_ELEMENTS) {
+        *a_out = std::max(a, b);
+        return true;
+      }
+      break;
+    default:
+      break;
+  }
+  return false;
+}
 
 inline ElementsKind FastSmiToObjectElementsKind(ElementsKind from_kind) {
   DCHECK(IsSmiElementsKind(from_kind));

test/mjsunit/compiler/array-push-multiple-receiver-maps.js

@@ -2,98 +2,108 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --allow-natives-syntax --opt
+// Flags: --allow-natives-syntax --opt --no-always-opt
 
-(function singleUnreliableReceiverMap() {
-  function f(a, g) {
-    a.push(2, g());
+function runTest(f, message, mkICTraining, deoptArg) {
+  function test(f, message, ictraining, deoptArg) {
+    // Train the call ic to the maps.
+    let t = ictraining;
+    for (let a of t()) {
+      f(a.arr, () => a.el);
+    }
+    for (let a of t()) {
+      f(a.arr, () => a.el);
+    }
+    %OptimizeFunctionOnNextCall(f);
+    message += " trained with" + JSON.stringify(t());
+    if (deoptArg == undefined) {
+      // Make sure the optimized function can handle
+      // all trained maps without deopt.
+      for (let a of t()) {
+        f(a.arr, () => a.el);
+        message += " for args " + JSON.stringify(a);
+        assertOptimized(f, undefined, message);
+      }
+    } else {
+      // Trigger deopt, causing no-speculation bit to be set.
+      let a1 = deoptArg, a2 = deoptArg;
+      message += " for args " + JSON.stringify(a1);
+      f(a1.arr, () => a1.el);
+      assertUnoptimized(f, undefined, message + " should have been unoptimized");
+      %OptimizeFunctionOnNextCall(f);
+      // No speculation should protect against further deopts.
+      f(a2.arr, () => a2.el);
+      assertOptimized(f, undefined,  message + " should have been optimized");
+    }
   }
 
-  f([1], () => 3);
-  f([1], () => 3);
-  %OptimizeFunctionOnNextCall(f);
-  f([1], () => 3);
-  assertOptimized(f);
-})();
+  // Get function as a string.
+  var testString = test.toString();
+  // Remove the function header..
+  testString = testString.replace(new RegExp("[^\n]*"), "let f = " + f.toString() + ";");
+  // ..and trailing '}'.
+  testString = testString.replace(new RegExp("[^\n]*$"), "");
+  // Substitute parameters.
+  testString = testString.replace(new RegExp("ictraining", 'g'), mkICTraining.toString());
+  testString = testString.replace(new RegExp("deoptArg", 'g'),
+    deoptArg ? JSON.stringify(deoptArg) : "undefined");
 
-(function singleUnreliableReceiverMapDeopt() {
-  function f(a, g) {
-    a.push(2, g());
-  }
-
-  f([1], () => 3);
-  f([1], () => 3);
-  %OptimizeFunctionOnNextCall(f);
-  f([1], () => true);
-  %OptimizeFunctionOnNextCall(f);
-  f([1], () => true);
-  assertOptimized(f);
-})();
-
-(function multipleUnreliableReceiverMaps(){
-  function f(a, g) {
-    a.push(2, g());
-  }
-  let b = [1]
-  b.x = 3;
+  var modTest = new Function("message", testString);
+  //print(modTest);
+  modTest(message);
+}
 
-  f([1], () => 3);
-  f(b, () => 3);
-  f([1], () => 3);
-  f(b, () => 3);
-  %OptimizeFunctionOnNextCall(f);
-  f([1], () => 3);
-  assertOptimized(f);
-})();
+let checks = {
+  smiReceiver:
+    { mkTrainingArguments : () => [{arr:[1], el:3}],
+      deoptingArguments   : [{arr:[1], el:true}, {arr:[0.1], el:1}, {arr:[{}], el:1}]
+    },
+  objectReceiver:
+    { mkTrainingArguments : () => [{arr:[{}], el:0.1}],
+      deoptingArguments : []
+    },
+  multipleSmiReceivers:
+    { mkTrainingArguments : () => { let b = [1]; b.x=3; return [{arr:[1], el:3}, {arr:b, el:3}] },
+      deoptingArguments : [{arr:[1], el:true}, {arr:[0.1], el:1}, {arr:[{}], el:1}]
+    },
+  multipleSmiReceiversPackedUnpacked:
+    { mkTrainingArguments : () => { let b = [1]; b[100] = 3; return [{arr:[1], el:3}, {arr:b, el:3}] },
+      deoptingArguments : [ {arr:[1], el:true} ]
+    },
+  multipleDoubleReceivers:
+    { mkTrainingArguments : () => { let b = [0.1]; b.x=0.3; return [{arr:[0.1], el:0.3}, {arr:b, el:0.3}] },
+      deoptingArguments : [{arr:[{}], el:true}, {arr:[0.1], el:true}]
+    },
+  multipleDoubleReceiversPackedUnpacked:
+    { mkTrainingArguments : () => { let b = [0.1]; b[100] = 0.3; return [{arr:[0.1], el:0.3}, {arr:b, el:0.3}] },
+      deoptingArguments : [{arr:[{}], el:true}, {arr:[0.1], el:true}]
+    },
+  multipleMixedReceivers:
+    { mkTrainingArguments : () => { let b = [0.1]; b.x=0.3; return [{arr:[1], el:0.3}, {arr:[{}], el:true}, {arr:b, el:0.3}] },
+      deoptingArguments : []
+    },
+  multipleMixedReceiversPackedUnpacked:
+    { mkTrainingArguments : () => { let b = [0.1]; b[100] = 0.3; return [{arr:[1], el:0.3}, {arr:[{}], el:true}, {arr:b, el:0.3}] },
+      deoptingArguments : []
+    },
+};
 
-(function multipleUnreliableReceiverMapsDeopt(){
-  function f(a, g) {
-    a.push(2, g());
-  }
-  let b = [1]
-  b.x = 3;
-
-  f([1], () => 3);
-  f(b, () => 3);
-  f([1], () => 3);
-  f(b, () => 3);
-  %OptimizeFunctionOnNextCall(f);
-  f([0.1], () => 3);
-  %OptimizeFunctionOnNextCall(f);
-  f([0.1], () => 3);
-  assertOptimized(f);
-})();
 
-(function multipleReliableReceiverMaps(){
-  function f(a) {
-    a.push(2);
-  }
-  let b = [1]
-  b.x = 3;
+const functions = {
+  push_reliable: (a,g) => { let b = g(); return a.push(2, b); },
+  push_unreliable: (a,g) => { return a.push(2, g()); },
+}
 
-  f([1]);
-  f(b);
-  f([1]);
-  f(b);
-  %OptimizeFunctionOnNextCall(f);
-  f([1]);
-  assertOptimized(f);
-})();
+Object.keys(checks).forEach(
+  key => {
+    let check = checks[key];
 
-(function multipleReliableReceiverMapsDeopt(){
-  function f(a) {
-    a.push(2);
+    for (fnc in functions) {
+      runTest(functions[fnc], "test-reliable-" + key, check.mkTrainingArguments);
+      // Test each deopting arg separately.
+      for (let deoptArg of check.deoptingArguments) {
+        runTest(functions[fnc], "testDeopt-reliable-" + key, check.mkTrainingArguments, deoptArg);
+      }
+    }
   }
-  let b = [1]
-  b.x = 3;
-
-  f([1]);
-  f(b);
-  f([1]);
-  f(b);
-  %OptimizeFunctionOnNextCall(f);
-  f([0.1]);
-  %OptimizeFunctionOnNextCall(f);
-  f([0.1]);
-  assertOptimized(f);
-})();
+);