[torque] improve witness struct

Change-Id: I56321f49894612e80e8e3f5d85a759718be6ef10
Reviewed-on: https://chromium-review.googlesource.com/c/1433786
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Reviewed-by: Daniel Clifford <danno@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59067}

src/builtins/array-filter.tq

@@ -104,33 +104,29 @@ namespace array {
       thisArg: Object, a: JSArray) labels Bailout(Smi, Smi) {
     let k: Smi = 0;
     let to: Smi = 0;
-    const fastOWitness: FastJSArrayWitness =
-        MakeWitness(Cast<FastJSArray>(o) otherwise goto Bailout(k, to));
-    const fastAWitness: FastJSArrayWitness =
-        MakeWitness(Cast<FastJSArray>(a) otherwise goto Bailout(k, to));
+    let fastO =
+    FastJSArrayWitness{Cast<FastJSArray>(o) otherwise goto Bailout(k, to)};
+    let fastA =
+    FastJSArrayWitness{Cast<FastJSArray>(a) otherwise goto Bailout(k, to)};
 
     // Build a fast loop over the smi array.
     for (; k < len; k++) {
-      let fastO: FastJSArray =
-          Testify(fastOWitness) otherwise goto Bailout(k, to);
-
       // Ensure that we haven't walked beyond a possibly updated length.
-      if (k >= fastO.length) goto Bailout(k, to);
+      if (k >= fastO.Get().length) goto Bailout(k, to);
 
       try {
-        const value: Object =
-            LoadElementNoHole<FixedArrayType>(fastO, k) otherwise FoundHole;
+        const value: Object = LoadElementNoHole<FixedArrayType>(fastO.Get(), k)
+            otherwise FoundHole;
         const result: Object =
-            Call(context, callbackfn, thisArg, value, k, fastO);
+            Call(context, callbackfn, thisArg, value, k, fastO.Get());
         if (ToBoolean(result)) {
           try {
             // Since the call to {callbackfn} is observable, we can't
             // use the Bailout label until we've successfully stored.
             // Hence the {SlowStore} label.
-            const fastA: FastJSArray =
-                Testify(fastAWitness) otherwise SlowStore;
-            if (fastA.length != to) goto SlowStore;
-            BuildAppendJSArray(kind, fastA, value)
+            fastA.Recheck() otherwise SlowStore;
+            if (fastA.Get().length != to) goto SlowStore;
+            BuildAppendJSArray(kind, fastA.Get(), value)
                 otherwise SlowStore;
           }
           label SlowStore {
@@ -138,6 +134,7 @@ namespace array {
           }
           to = to + 1;
         }
+        fastO.Recheck() otherwise goto Bailout(k + 1, to);
       }
       label FoundHole {}
     }

src/builtins/array-foreach.tq

@@ -74,20 +74,19 @@ namespace array {
       o: JSArray, len: Smi, callbackfn: Callable, thisArg: Object) labels
   Bailout(Smi) {
     let k: Smi = 0;
-    const fastOWitness: FastJSArrayWitness =
-        MakeWitness(Cast<FastJSArray>(o) otherwise goto Bailout(k));
+    let fastO =
+    FastJSArrayWitness{Cast<FastJSArray>(o) otherwise goto Bailout(k)};
 
     // Build a fast loop over the smi array.
     for (; k < len; k++) {
-      let fastO: FastJSArray = Testify(fastOWitness) otherwise goto Bailout(k);
-
       // Ensure that we haven't walked beyond a possibly updated length.
-      if (k >= fastO.length) goto Bailout(k);
+      if (k >= fastO.Get().length) goto Bailout(k);
 
       try {
-        const value: Object =
-            LoadElementNoHole<FixedArrayType>(fastO, k) otherwise FoundHole;
-        Call(context, callbackfn, thisArg, value, k, fastO);
+        const value: Object = LoadElementNoHole<FixedArrayType>(fastO.Get(), k)
+            otherwise FoundHole;
+        Call(context, callbackfn, thisArg, value, k, fastO.Get());
+        fastO.Recheck() otherwise goto Bailout(k + 1);
       }
       label FoundHole {}
     }

src/builtins/array-map.tq

@@ -189,24 +189,22 @@ namespace array {
       vector: Vector): Vector labels Bailout(Vector, Smi) {
     let k: Smi = 0;
     let v: Vector = vector;
-    const fastOWitness: FastJSArrayWitness =
-        MakeWitness(Cast<FastJSArray>(o) otherwise goto Bailout(v, k));
+    let fastO =
+    FastJSArrayWitness{Cast<FastJSArray>(o) otherwise goto Bailout(v, k)};
 
     // Build a fast loop over the smi array.
     // 7. Repeat, while k < len.
-    for (; k < len; k = k + 1) {
-      let fastO: FastJSArray =
-          Testify(fastOWitness) otherwise goto Bailout(v, k);
-
+    for (; k < len; k++) {
       // Ensure that we haven't walked beyond a possibly updated length.
-      if (k >= fastO.length) goto Bailout(v, k);
+      if (k >= fastO.Get().length) goto Bailout(v, k);
 
       try {
-        const value: Object =
-            LoadElementNoHole<FixedArrayType>(fastO, k) otherwise FoundHole;
+        const value: Object = LoadElementNoHole<FixedArrayType>(fastO.Get(), k)
+            otherwise FoundHole;
         const result: Object =
-            Call(context, callbackfn, thisArg, value, k, fastO);
+            Call(context, callbackfn, thisArg, value, k, fastO.Get());
         v.StoreResult(k, result);
+        fastO.Recheck() otherwise goto Bailout(v, k + 1);
       }
       label FoundHole {
         // Our output array must necessarily be holey because of holes in

src/builtins/base.tq

@@ -778,24 +778,30 @@ CastHeapObject<FastJSArray>(implicit context: Context)(o: HeapObject):
 }
 
 struct FastJSArrayWitness {
-  array: HeapObject;
-  map: Map;
-}
+  constructor(array: FastJSArray) {
+    this.stable = this.unstable = array;
+    this.map = array.map;
+  }
 
-macro MakeWitness(array: FastJSArray): FastJSArrayWitness {
-  return FastJSArrayWitness{array, array.map};
-}
+  Get(): FastJSArray {
+    return this.unstable;
+  }
 
-macro Testify(witness: FastJSArrayWitness): FastJSArray labels CastError {
-  if (witness.array.map != witness.map) goto CastError;
-  // We don't need to check elements kind or whether the prototype
-  // has changed away from the default JSArray prototype, because
-  // if the map remains the same then those properties hold.
-  //
-  // However, we have to make sure there are no elements in the
-  // prototype chain.
-  if (IsNoElementsProtectorCellInvalid()) goto CastError;
-  return %RawObjectCast<FastJSArray>(witness.array);
+  Recheck() labels CastError {
+    if (this.stable.map != this.map) goto CastError;
+    // We don't need to check elements kind or whether the prototype
+    // has changed away from the default JSArray prototype, because
+    // if the map remains the same then those properties hold.
+    //
+    // However, we have to make sure there are no elements in the
+    // prototype chain.
+    if (IsNoElementsProtectorCellInvalid()) goto CastError;
+    this.unstable = %RawObjectCast<FastJSArray>(this.stable);
+  }
+
+  stable: JSArray;
+  unstable: FastJSArray;
+  map: Map;
 }
 
 CastHeapObject<FastJSArrayForCopy>(implicit context: Context)(o: HeapObject):