[Promise.any] Make JSAggregateError.errors a FixedArray

There's no reason for it to be a JSArray; it's an internal data member.

We only have a slow version for constructing a FixedArray from an
Iterable, but since this is not a performance critical code path,
it's fine.

BUG=v8:9808

Change-Id: I5bcfac4cc545880966421a96d3aa3d899bbf6cd5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2157371Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67321}

src/builtins/array.tq

@@ -79,4 +79,13 @@ namespace array {
       goto Bailout;
     }
   }
+
+  macro CreateJSArrayWithElements(implicit context: Context)(array: FixedArray):
+      JSArray {
+    const nativeContext: NativeContext = LoadNativeContext(context);
+    const map: Map =
+        LoadJSArrayElementsMap(ElementsKind::PACKED_ELEMENTS, nativeContext);
+    return AllocateJSArray(map, array, array.length);
+  }
+
 }

src/builtins/builtins-definitions.h

@@ -574,7 +574,9 @@ namespace internal {
   /* IterableToList */                                                         \
   /* ES #sec-iterabletolist */                                                 \
   TFS(IterableToList, kIterable, kIteratorFn)                                  \
+  TFS(IterableToFixedArray, kIterable, kIteratorFn)                            \
   TFS(IterableToListWithSymbolLookup, kIterable)                               \
+  TFS(IterableToFixedArrayWithSymbolLookupSlow, kIterable)                     \
   TFS(IterableToListMayPreserveHoles, kIterable, kIteratorFn)                  \
   TFS(IterableToFixedArrayForWasm, kIterable, kExpectedLength)                 \
                                                                                \

src/builtins/builtins-iterator-gen.cc

@@ -183,6 +183,14 @@ TNode<JSArray> IteratorBuiltinsAssembler::IterableToList(
   return values.ToJSArray(context);
 }
 
+TNode<FixedArray> IteratorBuiltinsAssembler::IterableToFixedArray(
+    TNode<Context> context, TNode<Object> iterable, TNode<Object> iterator_fn) {
+  GrowableFixedArray values(state());
+  FillFixedArrayFromIterable(context, iterable, iterator_fn, &values);
+  TNode<FixedArray> new_array = values.ToFixedArray();
+  return new_array;
+}
+
 void IteratorBuiltinsAssembler::FillFixedArrayFromIterable(
     TNode<Context> context, TNode<Object> iterable, TNode<Object> iterator_fn,
     GrowableFixedArray* values) {
@@ -223,6 +231,14 @@ TF_BUILTIN(IterableToList, IteratorBuiltinsAssembler) {
   Return(IterableToList(context, iterable, iterator_fn));
 }
 
+TF_BUILTIN(IterableToFixedArray, IteratorBuiltinsAssembler) {
+  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
+  TNode<Object> iterable = CAST(Parameter(Descriptor::kIterable));
+  TNode<Object> iterator_fn = CAST(Parameter(Descriptor::kIteratorFn));
+
+  Return(IterableToFixedArray(context, iterable, iterator_fn));
+}
+
 TF_BUILTIN(IterableToFixedArrayForWasm, IteratorBuiltinsAssembler) {
   TNode<Context> context = CAST(Parameter(Descriptor::kContext));
   TNode<Object> iterable = CAST(Parameter(Descriptor::kIterable));
@@ -448,5 +464,17 @@ TF_BUILTIN(GetIteratorWithFeedbackLazyDeoptContinuation,
   Return(result);
 }
 
+// This builtin creates a FixedArray based on an Iterable and doesn't have a
+// fast path for anything.
+TF_BUILTIN(IterableToFixedArrayWithSymbolLookupSlow,
+           IteratorBuiltinsAssembler) {
+  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
+  TNode<Object> iterable = CAST(Parameter(Descriptor::kIterable));
+
+  TNode<Object> iterator_fn = GetIteratorMethod(context, iterable);
+  TailCallBuiltin(Builtins::kIterableToFixedArray, context, iterable,
+                  iterator_fn);
+}
+
 }  // namespace internal
 }  // namespace v8

src/builtins/builtins-iterator-gen.h

@@ -67,6 +67,10 @@ class IteratorBuiltinsAssembler : public CodeStubAssembler {
   TNode<JSArray> IterableToList(TNode<Context> context, TNode<Object> iterable,
                                 TNode<Object> iterator_fn);
 
+  TNode<FixedArray> IterableToFixedArray(TNode<Context> context,
+                                         TNode<Object> iterable,
+                                         TNode<Object> iterator_fn);
+
   void FillFixedArrayFromIterable(TNode<Context> context,
                                   TNode<Object> iterable,
                                   TNode<Object> iterator_fn,

src/builtins/growable-fixed-array-gen.cc

@@ -33,6 +33,10 @@ void GrowableFixedArray::Push(const TNode<Object> value) {
   }
 }
 
+TNode<FixedArray> GrowableFixedArray::ToFixedArray() {
+  return ResizeFixedArray(length(), length());
+}
+
 TNode<JSArray> GrowableFixedArray::ToJSArray(const TNode<Context> context) {
   const ElementsKind kind = PACKED_ELEMENTS;
 

src/builtins/growable-fixed-array-gen.h

@@ -32,6 +32,7 @@ class GrowableFixedArray : public CodeStubAssembler {
 
   void Push(const TNode<Object> value);
 
+  TNode<FixedArray> ToFixedArray();
   TNode<JSArray> ToJSArray(const TNode<Context> context);
 
  private:

src/builtins/iterator.tq

@@ -50,6 +50,8 @@ namespace iterator {
                                                     Context)(JSAny, JSAny);
   extern builtin IterableToListWithSymbolLookup(implicit context:
                                                     Context)(JSAny): JSArray;
+  extern builtin IterableToFixedArrayWithSymbolLookupSlow(
+      implicit context: Context)(JSAny): FixedArray;
 
   transitioning builtin GetIteratorWithFeedback(
       context: Context, receiver: JSAny, loadSlot: TaggedIndex,

src/codegen/code-stub-assembler.cc

@@ -3688,6 +3688,17 @@ void CodeStubAssembler::StoreFieldsNoWriteBarrier(TNode<IntPtrT> start_address,
       kTaggedSize, IndexAdvanceMode::kPost);
 }
 
+void CodeStubAssembler::MakeFixedArrayCOW(TNode<FixedArray> array) {
+  CSA_ASSERT(this, IsFixedArrayMap(LoadMap(array)));
+  Label done(this);
+  // The empty fixed array is not modifiable anyway. And we shouldn't change its
+  // Map.
+  GotoIf(TaggedEqual(array, EmptyFixedArrayConstant()), &done);
+  StoreMap(array, FixedCOWArrayMapConstant());
+  Goto(&done);
+  BIND(&done);
+}
+
 TNode<BoolT> CodeStubAssembler::IsValidFastJSArrayCapacity(
     TNode<IntPtrT> capacity) {
   return UintPtrLessThanOrEqual(capacity,

src/codegen/code-stub-assembler.h

@@ -1780,6 +1780,9 @@ class V8_EXPORT_PRIVATE CodeStubAssembler
                                  TNode<IntPtrT> end_address,
                                  TNode<Object> value);
 
+  // Marks the FixedArray copy-on-write without moving it.
+  void MakeFixedArrayCOW(TNode<FixedArray> array);
+
   TNode<Cell> AllocateCellWithValue(
       TNode<Object> value, WriteBarrierMode mode = UPDATE_WRITE_BARRIER);
   TNode<Cell> AllocateSmiCell(int value = 0) {

src/objects/js-aggregate-error.tq

@@ -6,8 +6,10 @@
 
 @generateCppClass
 extern class JSAggregateError extends JSObject {
-  // Only Undefined during AggregateError object creation.
-  errors: JSAny|Undefined;
+  // Only Undefined during AggregateError object creation. In order to make the
+  // field type FixedArray, we'd need to initialize it in ErrorUtils::Construct
+  // (after it, it's too late) which we don't want.
+  errors: FixedArray|Undefined;
 }
 
 namespace error {
@@ -34,7 +36,9 @@ namespace error {
 
     // 4. Let errorsList be ? IterableToList(errors).
     const errors: JSAny = arguments.length > 0 ? arguments[0] : Undefined;
-    const errorsArray = iterator::IterableToListWithSymbolLookup(errors);
+    const errorsArray =
+        iterator::IterableToFixedArrayWithSymbolLookupSlow(errors);
+    MakeFixedArrayCOW(errorsArray);
 
     // 5. Set O.[[AggregateErrors]] to errorsList.
     obj.errors = errorsArray;
@@ -54,8 +58,8 @@ namespace error {
     // 5. Return ! CreateArrayFromList(E.[[AggregateErrors]]).
     typeswitch (receiver) {
       case (receiver: JSAggregateError): {
-        return CloneFastJSArrayFillingHoles(
-            context, UnsafeCast<JSArray>(receiver.errors));
+        return array::CreateJSArrayWithElements(
+            UnsafeCast<FixedArray>(receiver.errors));
       }
       case (Object): {
         ThrowTypeError(
@@ -68,6 +72,6 @@ namespace error {
   extern runtime ConstructAggregateErrorHelper(
       Context, JSFunction, JSAny, JSAny): JSAggregateError;
 
-  extern transitioning builtin CloneFastJSArrayFillingHoles(Context, JSArray):
-      JSArray;
+  extern macro MakeFixedArrayCOW(FixedArray);
+
 }

test/mjsunit/harmony/aggregate-error.js

@@ -137,6 +137,33 @@
     assertNotSame(errors1, errors2);
 })();
 
+(function ErrorsModified(){
+    let e = new AggregateError([9, 6, 3]);
+    const errors1 = e.errors;
+    errors1[0] = 50;
+    const errors2 = e.errors;
+    assertEquals([50, 6, 3], errors1);
+    assertEquals([9, 6, 3], errors2);
+})();
+
+(function EmptyErrorsModified1(){
+    let e = new AggregateError([]);
+    const errors1 = e.errors;
+    errors1[0] = 50;
+    const errors2 = e.errors;
+    assertEquals([50], errors1);
+    assertEquals([], errors2);
+})();
+
+(function EmptyErrorsModified2(){
+    let e = new AggregateError([]);
+    const errors1 = e.errors;
+    errors1.push(50);
+    const errors2 = e.errors;
+    assertEquals([50], errors1);
+    assertEquals([], errors2);
+})();
+
 (function AggregateErrorCreation() {
     // Verify that we match the spec wrt getting the prototype from the
     // newTarget, iterating the errors array and calling toString on the