[builtins] Use uintptr for iteration in TypedArray builtins, pt.2

The CL fixes the following builtins:
  %TypedArray%.prototype.filter

Bug: v8:4153
Change-Id: Ifb4a464c91c38c586598359ffcded9cc4e7d8f4a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1864943
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64375}

src/builtins/builtins-array-gen.cc

@@ -32,15 +32,15 @@ ArrayBuiltinsAssembler::ArrayBuiltinsAssembler(
 void ArrayBuiltinsAssembler::TypedArrayMapResultGenerator() {
   // 6. Let A be ? TypedArraySpeciesCreate(O, len).
   TNode<JSTypedArray> original_array = CAST(o());
-  TNode<Smi> length = CAST(len_);
+  // TODO(v8:4153): Consider making |len_| an UintPtrT.
+  TNode<UintPtrT> length = ChangeNonnegativeNumberToUintPtr(len_);
   const char* method_name = "%TypedArray%.prototype.map";
 
   TNode<JSTypedArray> a = TypedArraySpeciesCreateByLength(
       context(), method_name, original_array, length);
   // In the Spec and our current implementation, the length check is already
   // performed in TypedArraySpeciesCreate.
-  CSA_ASSERT(this, UintPtrLessThanOrEqual(SmiUntag(CAST(len_)),
-                                          LoadJSTypedArrayLength(a)));
+  CSA_ASSERT(this, UintPtrLessThanOrEqual(length, LoadJSTypedArrayLength(a)));
   fast_typed_array_target_ =
       Word32Equal(LoadElementsKind(original_array), LoadElementsKind(a));
   a_ = a;

src/builtins/growable-fixed-array.tq

@@ -35,6 +35,7 @@ namespace growable_fixed_array {
     }
 
     array: FixedArray;
+    // TODO(v8:4153): make capacity and length uintptr
     capacity: intptr;
     length: intptr;
   }

src/builtins/typed-array-createtypedarray.tq

@@ -400,15 +400,16 @@ namespace typed_array {
   @export
   transitioning macro TypedArraySpeciesCreateByLength(implicit context:
                                                           Context)(
-      methodName: constexpr string, exemplar: JSTypedArray,
-      length: PositiveSmi): JSTypedArray {
+      methodName: constexpr string, exemplar: JSTypedArray, length: uintptr):
+      JSTypedArray {
     const numArgs: constexpr int31 = 1;
+    // TODO(v8:4153): pass length further as uintptr.
     const typedArray: JSTypedArray = TypedArraySpeciesCreate(
-        methodName, numArgs, exemplar, length, Undefined, Undefined);
-    if (typedArray.length < Convert<uintptr>(length)) deferred {
+        methodName, numArgs, exemplar, Convert<Number>(length), Undefined,
+        Undefined);
+    if (typedArray.length < length) deferred {
         ThrowTypeError(kTypedArrayTooShort);
       }
-
     return typedArray;
   }
 }

src/builtins/typed-array-filter.tq

@@ -18,8 +18,7 @@ namespace typed_array {
       const src = typed_array::EnsureAttached(array) otherwise IsDetached;
 
       // 3. Let len be O.[[ArrayLength]].
-      // TODO(v8:4153): Support huge TypedArrays here.
-      const len = Cast<Smi>(Convert<Number>(src.length)) otherwise unreachable;
+      const len: uintptr = src.length;
 
       // 4. If IsCallable(callbackfn) is false, throw a TypeError exception.
       const callbackfn = Cast<Callable>(arguments[0])
@@ -29,13 +28,15 @@ namespace typed_array {
       const thisArg: JSAny = arguments[1];
 
       // 6. Let kept be a new empty List.
+      // TODO(v8:4153): Support huge TypedArrays here. (growable fixed arrays
+      // can't be longer than kMaxSmiValue).
       let kept = growable_fixed_array::NewGrowableFixedArray();
       let witness = typed_array::NewAttachedJSTypedArrayWitness(src);
 
       // 7. Let k be 0.
       // 8. Let captured be 0.
       // 9. Repeat, while k < len
-      for (let k: Smi = 0; k < len; k++) {
+      for (let k: uintptr = 0; k < len; k++) {
         witness.Recheck() otherwise IsDetached;
 
         // a. Let Pk be ! ToString(k).
@@ -44,8 +45,11 @@ namespace typed_array {
 
         // c. Let selected be ToBoolean(? Call(callbackfn, T, « kValue, k, O
         // »)).
-        const selected: JSAny =
-            Call(context, callbackfn, thisArg, value, k, witness.GetStable());
+        // TODO(v8:4153): Consider versioning this loop for Smi and non-Smi
+        // indices to optimize Convert<Number>(k) for the most common case.
+        const selected: JSAny = Call(
+            context, callbackfn, thisArg, value, Convert<Number>(k),
+            witness.GetStable());
 
         // d. If selected is true, then
         //    i. Append kValue to the end of kept.
@@ -56,15 +60,19 @@ namespace typed_array {
       }
 
       // 10. Let A be ? TypedArraySpeciesCreate(O, captured).
-      const lengthSmi = Convert<PositiveSmi>(kept.length);
-      const typedArray: JSTypedArray =
-          TypedArraySpeciesCreateByLength(kBuiltinNameFilter, array, lengthSmi);
+      const typedArray: JSTypedArray = TypedArraySpeciesCreateByLength(
+          kBuiltinNameFilter, array, Unsigned(kept.length));
 
       // 11. Let n be 0.
       // 12. For each element e of kept, do
       //   a. Perform ! Set(A, ! ToString(n), e, true).
       //   b. Increment n by 1.
-      TypedArrayCopyElements(context, typedArray, kept.ToJSArray(), lengthSmi);
+      // TODO(v8:4153): Consider passing growable typed array directly to
+      // TypedArrayCopyElements() to avoid JSArray materialization. Or collect
+      // indices instead of values the loop above.
+      const lengthNumber = Convert<Number>(Unsigned(kept.length));
+      TypedArrayCopyElements(
+          context, typedArray, kept.ToJSArray(), lengthNumber);
 
       // 13. Return A.
       return typedArray;

src/builtins/typed-array-slice.tq

@@ -84,8 +84,8 @@ namespace typed_array {
     const count = Convert<PositiveSmi>(IntPtrMax(final - k, 0));
 
     // 9. Let A be ? TypedArraySpeciesCreate(O, « count »).
-    const dest: JSTypedArray =
-        TypedArraySpeciesCreateByLength(kBuiltinNameSlice, src, count);
+    const dest: JSTypedArray = TypedArraySpeciesCreateByLength(
+        kBuiltinNameSlice, src, Convert<uintptr>(count));
 
     if (count > 0) {
       try {

src/builtins/typed-array.tq

@@ -112,12 +112,6 @@ namespace typed_array {
       return lf(context, this.unstable, k);
     }
 
-    // TODO(v8:4153): Remove this version once all builtins use uintptr indices
-    // for iteration.
-    Load(implicit context: Context)(k: Smi): JSAny {
-      return this.Load(Unsigned(SmiUntag(k)));
-    }
-
     stable: JSTypedArray;
     unstable: AttachedJSTypedArray;
     loadfn: LoadFn;