[maglev] Support GetTemplateObject

Bug: v8:7700
Change-Id: Ifa3c78017abf8f596a7d3c96877ca035d6126c90
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3815481
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Reviewed-by: Victor Gomes <victorgomes@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82249}

src/maglev/maglev-graph-builder.cc

@@ -2139,7 +2139,23 @@ void MaglevGraphBuilder::VisitCloneObject() {
                                                            feedback_source));
 }
 
-MAGLEV_UNIMPLEMENTED_BYTECODE(GetTemplateObject)
+void MaglevGraphBuilder::VisitGetTemplateObject() {
+  // GetTemplateObject <descriptor_idx> <literal_idx>
+  compiler::SharedFunctionInfoRef shared_function_info =
+      compilation_unit_->shared_function_info();
+  ValueNode* description = GetConstant(GetRefOperand<HeapObject>(0));
+  FeedbackSlot slot = GetSlotOperand(1);
+  compiler::FeedbackSource feedback_source{feedback(), slot};
+
+  const compiler::ProcessedFeedback& feedback =
+      broker()->GetFeedbackForTemplateObject(feedback_source);
+  if (feedback.IsInsufficient()) {
+    return SetAccumulator(AddNewNode<GetTemplateObject>(
+        {description}, shared_function_info, feedback_source));
+  }
+  compiler::JSArrayRef template_object = feedback.AsTemplateObject().value();
+  SetAccumulator(GetConstant(template_object));
+}
 
 void MaglevGraphBuilder::VisitCreateClosure() {
   compiler::SharedFunctionInfoRef shared_function_info =

src/maglev/maglev-graph-verifier.h

@@ -129,6 +129,7 @@ class MaglevGraphVerifier {
       case Opcode::kCreateFunctionContext:
       case Opcode::kCreateClosure:
       case Opcode::kFastCreateClosure:
+      case Opcode::kGetTemplateObject:
       case Opcode::kLogicalNot:
       case Opcode::kSetPendingMessage:
       case Opcode::kToBooleanLogicalNot:

src/maglev/maglev-ir.cc

@@ -1143,6 +1143,22 @@ void CreateRegExpLiteral::GenerateCode(MaglevCodeGenState* code_gen_state,
   __ CallBuiltin(Builtin::kCreateRegExpLiteral);
 }
 
+void GetTemplateObject::AllocateVreg(MaglevVregAllocationState* vreg_state) {
+  using D = GetTemplateObjectDescriptor;
+  UseFixed(description(), D::GetRegisterParameter(D::kDescription));
+  DefineAsFixed(vreg_state, this, kReturnRegister0);
+}
+
+void GetTemplateObject::GenerateCode(MaglevCodeGenState* code_gen_state,
+                                     const ProcessingState& state) {
+  using D = GetTemplateObjectDescriptor;
+  __ Move(D::ContextRegister(), code_gen_state->native_context().object());
+  __ Move(D::GetRegisterParameter(D::kMaybeFeedbackVector), feedback().vector);
+  __ Move(D::GetRegisterParameter(D::kSlot), feedback().slot.ToInt());
+  __ Move(D::GetRegisterParameter(D::kShared), shared_function_info_.object());
+  __ CallBuiltin(Builtin::kGetTemplateObject);
+}
+
 void Abort::GenerateCode(MaglevCodeGenState* code_gen_state,
                          const ProcessingState& state) {
   __ Push(Smi::FromInt(static_cast<int>(reason())));

src/maglev/maglev-ir.h

@@ -137,6 +137,7 @@ class CompactInterpreterFrameState;
   V(ForInPrepare)                 \
   V(ForInNext)                    \
   V(GetSecondReturnedValue)       \
+  V(GetTemplateObject)            \
   V(InitialValue)                 \
   V(LoadTaggedField)              \
   V(LoadDoubleField)              \
@@ -2433,6 +2434,37 @@ class CheckedInternalizedString
   void PrintParams(std::ostream&, MaglevGraphLabeller*) const {}
 };
 
+class GetTemplateObject : public FixedInputValueNodeT<1, GetTemplateObject> {
+  using Base = FixedInputValueNodeT<1, GetTemplateObject>;
+
+ public:
+  explicit GetTemplateObject(
+      uint64_t bitfield,
+      const compiler::SharedFunctionInfoRef& shared_function_info,
+      const compiler::FeedbackSource& feedback)
+      : Base(bitfield),
+        shared_function_info_(shared_function_info),
+        feedback_(feedback) {}
+
+  // The implementation currently calls runtime.
+  static constexpr OpProperties kProperties = OpProperties::Call();
+
+  Input& description() { return input(0); }
+
+  compiler::SharedFunctionInfoRef shared_function_info() {
+    return shared_function_info_;
+  }
+  compiler::FeedbackSource feedback() const { return feedback_; }
+
+  void AllocateVreg(MaglevVregAllocationState*);
+  void GenerateCode(MaglevCodeGenState*, const ProcessingState&);
+  void PrintParams(std::ostream&, MaglevGraphLabeller*) const {}
+
+ private:
+  compiler::SharedFunctionInfoRef shared_function_info_;
+  const compiler::FeedbackSource feedback_;
+};
+
 class LoadTaggedField : public FixedInputValueNodeT<1, LoadTaggedField> {
   using Base = FixedInputValueNodeT<1, LoadTaggedField>;
 

test/mjsunit/maglev/get-template-object.js

+// Copyright 2022 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --maglev --no-stress-opt --no-always-turbofan
+
+function bar(x, y){
+  return [...x, y]
+}
+function foo(x) {
+  return bar`123${x}`
+}
+
+%PrepareFunctionForOptimization(foo);
+assertEquals(["123", "", 1], foo(1));
+assertEquals(["123", "", 2], foo(2));
+%OptimizeMaglevOnNextCall(foo);
+assertEquals(["123", "", 1], foo(1));
+assertEquals(["123", "", 2], foo(2));
+assertTrue(isMaglevved(foo));