[ic] Add fast path for StaInArrayLiteral with no feedback

We could use StorePropertyInLiteral builtin to handle StaInArrayLiteral
when there is no feedback vector.

Change-Id: I38cae322cc1901582e570f996c6ffd270501245f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1862559Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Mythri Alle <mythria@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64379}

src/ic/accessor-assembler.cc

@@ -3397,7 +3397,7 @@ void AccessorAssembler::KeyedStoreIC(const StoreICParameters* p) {
 }
 
 void AccessorAssembler::StoreInArrayLiteralIC(const StoreICParameters* p) {
-  Label miss(this, Label::kDeferred);
+  Label miss(this, Label::kDeferred), no_feedback(this, Label::kDeferred);
   {
     TVARIABLE(MaybeObject, var_handler);
 
@@ -3408,7 +3408,7 @@ void AccessorAssembler::StoreInArrayLiteralIC(const StoreICParameters* p) {
     TNode<Map> array_map = LoadReceiverMap(p->receiver());
     GotoIf(IsDeprecatedMap(array_map), &miss);
 
-    GotoIf(IsUndefined(p->vector()), &miss);
+    GotoIf(IsUndefined(p->vector()), &no_feedback);
 
     TNode<MaybeObject> feedback =
         TryMonomorphicCase(p->slot(), CAST(p->vector()), array_map, &if_handler,
@@ -3485,6 +3485,13 @@ void AccessorAssembler::StoreInArrayLiteralIC(const StoreICParameters* p) {
     }
   }
 
+  BIND(&no_feedback);
+  {
+    Comment("StoreInArrayLiteralIC_NoFeedback");
+    TailCallBuiltin(Builtins::kSetPropertyInLiteral, p->context(),
+                    p->receiver(), p->name(), p->value());
+  }
+
   BIND(&miss);
   {
     Comment("StoreInArrayLiteralIC_miss");

src/ic/keyed-store-generic.cc

@@ -340,6 +340,7 @@ void KeyedStoreGenericAssembler::StoreElementWithCapacity(
   {
     TNode<IntPtrT> offset =
         ElementOffsetFromIndex(index, PACKED_ELEMENTS, kHeaderSize);
+    if (!IsStoreInLiteral()) {
       // Check if we're about to overwrite the hole. We can safely do that
       // only if there can be no setters on the prototype chain.
       // If we know that we're storing beyond the previous array length, we
@@ -349,12 +350,14 @@ void KeyedStoreGenericAssembler::StoreElementWithCapacity(
         if (update_length == kDontChangeLength) {
           TNode<Object> element =
               CAST(Load(MachineType::AnyTagged(), elements, offset));
-        GotoIf(TaggedNotEqual(element, TheHoleConstant()), &hole_check_passed);
+          GotoIf(TaggedNotEqual(element, TheHoleConstant()),
+                 &hole_check_passed);
         }
         BranchIfPrototypesHaveNonFastElements(receiver_map, slow,
                                               &hole_check_passed);
         BIND(&hole_check_passed);
       }
+    }
 
     // Check if the value we're storing matches the elements_kind. Smis
     // can always be stored.
@@ -443,6 +446,8 @@ void KeyedStoreGenericAssembler::StoreElementWithCapacity(
   {
     TNode<IntPtrT> offset =
         ElementOffsetFromIndex(index, PACKED_DOUBLE_ELEMENTS, kHeaderSize);
+    if (!IsStoreInLiteral()) {
+      // Check if we're about to overwrite the hole. We can safely do that
       // Check if we're about to overwrite the hole. We can safely do that
       // only if there can be no setters on the prototype chain.
       {
@@ -460,6 +465,7 @@ void KeyedStoreGenericAssembler::StoreElementWithCapacity(
                                               &hole_check_passed);
         BIND(&hole_check_passed);
       }
+    }
 
     // Try to store the value as a double.
     {
@@ -541,13 +547,15 @@ void KeyedStoreGenericAssembler::EmitGenericElementStore(
   }
 
   BIND(&if_out_of_bounds);
-  {
+  if (!IsStoreInLiteral()) {
     // Integer indexed out-of-bounds accesses to typed arrays are simply
     // ignored, since we never look up integer indexed properties on the
     // prototypes of typed arrays. For all other types, we may need to
     // grow the backing store.
     GotoIfNot(InstanceTypeEqual(instance_type, JS_TYPED_ARRAY_TYPE), &if_grow);
     Return(value);
+  } else {
+    Goto(&if_grow);
   }
 
   BIND(&if_increment_length_by_one);