[builtins] Add typing to o() and len() in array builtins

Make BuiltinsArrayAssembler::o() and len() into TNode<JSReceiver> and
TNode<Number> respectively.

Also adds typing to CodeStubAssembler::ToLength_Inline.

Fixes a type error in ArraySpeciesCreate which needs to take a Number rather
than a Smi.

Bug: v8:7310
Change-Id: Ie01d58ba195bddfe58ac7e4a31272c8f1a14c6ce
Reviewed-on: https://chromium-review.googlesource.com/934821
Commit-Queue: Dan Elphick <delphick@chromium.org>
Reviewed-by: Peter Marshall <petermarshall@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51761}

src/builtins/builtins-array-gen.h

@@ -73,8 +73,8 @@ class ArrayBuiltinsAssembler : public CodeStubAssembler {
   TNode<Object> receiver() { return receiver_; }
   Node* new_target() { return new_target_; }
   TNode<IntPtrT> argc() { return argc_; }
-  Node* o() { return o_; }
-  Node* len() { return len_; }
+  TNode<JSReceiver> o() { return o_; }
+  TNode<Number> len() { return len_; }
   Node* callbackfn() { return callbackfn_; }
   Node* this_arg() { return this_arg_; }
   Node* k() { return k_.value(); }
@@ -95,7 +95,8 @@ class ArrayBuiltinsAssembler : public CodeStubAssembler {
       ForEachDirection direction = ForEachDirection::kForward);
   void InitIteratingArrayBuiltinLoopContinuation(
       TNode<Context> context, TNode<Object> receiver, Node* callbackfn,
-      Node* this_arg, Node* a, Node* o, Node* initial_k, Node* len, Node* to);
+      Node* this_arg, Node* a, TNode<JSReceiver> o, Node* initial_k,
+      TNode<Number> len, Node* to);
 
   void GenerateIteratingTypedArrayBuiltinBody(
       const char* name, const BuiltinResultGenerator& generator,
@@ -112,13 +113,15 @@ class ArrayBuiltinsAssembler : public CodeStubAssembler {
 
   void VisitAllTypedArrayElements(Node* array_buffer,
                                   const CallResultProcessor& processor,
-                                  Label* detached, ForEachDirection direction);
+                                  Label* detached, ForEachDirection direction,
+                                  TNode<JSTypedArray> typed_array);
 
   void VisitAllFastElementsOneKind(ElementsKind kind,
                                    const CallResultProcessor& processor,
                                    Label* array_changed, ParameterMode mode,
                                    ForEachDirection direction,
-                                   MissingPropertyMode missing_property_mode);
+                                   MissingPropertyMode missing_property_mode,
+                                   TNode<Smi> length);
 
   void HandleFastElements(const CallResultProcessor& processor,
                           const PostLoopAction& action, Label* slow,
@@ -131,12 +134,12 @@ class ArrayBuiltinsAssembler : public CodeStubAssembler {
   void GenerateArraySpeciesCreate();
 
   // Perform ArraySpeciesCreate (ES6 #sec-arrayspeciescreate).
-  void GenerateArraySpeciesCreate(SloppyTNode<Smi> len);
+  void GenerateArraySpeciesCreate(TNode<Number> len);
 
   Node* callbackfn_ = nullptr;
-  Node* o_ = nullptr;
+  TNode<JSReceiver> o_;
   Node* this_arg_ = nullptr;
-  Node* len_ = nullptr;
+  TNode<Number> len_;
   TNode<Context> context_;
   TNode<Object> receiver_;
   Node* new_target_ = nullptr;

src/code-stub-assembler.cc

@@ -1426,9 +1426,9 @@ TNode<FixedArrayBase> CodeStubAssembler::LoadElements(
   return CAST(LoadObjectField(object, JSObject::kElementsOffset));
 }
 
-TNode<Object> CodeStubAssembler::LoadJSArrayLength(SloppyTNode<JSArray> array) {
+TNode<Number> CodeStubAssembler::LoadJSArrayLength(SloppyTNode<JSArray> array) {
   CSA_ASSERT(this, IsJSArray(array));
-  return LoadObjectField(array, JSArray::kLengthOffset);
+  return CAST(LoadObjectField(array, JSArray::kLengthOffset));
 }
 
 TNode<Smi> CodeStubAssembler::LoadFastJSArrayLength(
@@ -6158,12 +6158,12 @@ TNode<Smi> CodeStubAssembler::ToSmiLength(TNode<Object> input,
   return result.value();
 }
 
-Node* CodeStubAssembler::ToLength_Inline(Node* const context,
-                                         Node* const input) {
-  Node* const smi_zero = SmiConstant(0);
-  return Select(
-      TaggedIsSmi(input), [=] { return SmiMax(input, smi_zero); },
-      [=] { return CallBuiltin(Builtins::kToLength, context, input); },
+TNode<Number> CodeStubAssembler::ToLength_Inline(SloppyTNode<Context> context,
+                                                 SloppyTNode<Object> input) {
+  TNode<Smi> smi_zero = SmiConstant(0);
+  return Select<Number>(
+      TaggedIsSmi(input), [=] { return SmiMax(CAST(input), smi_zero); },
+      [=] { return CAST(CallBuiltin(Builtins::kToLength, context, input)); },
       MachineRepresentation::kTagged);
 }
 

src/code-stub-assembler.h

@@ -526,7 +526,7 @@ class V8_EXPORT_PRIVATE CodeStubAssembler : public compiler::CodeAssembler {
   // Load the elements backing store of a JSObject.
   TNode<FixedArrayBase> LoadElements(SloppyTNode<JSObject> object);
   // Load the length of a JSArray instance.
-  TNode<Object> LoadJSArrayLength(SloppyTNode<JSArray> array);
+  TNode<Number> LoadJSArrayLength(SloppyTNode<JSArray> array);
   // Load the length of a fast JSArray instance. Returns a positive Smi.
   TNode<Smi> LoadFastJSArrayLength(SloppyTNode<JSArray> array);
   // Load the length of a fixed array base instance.
@@ -1309,7 +1309,8 @@ class V8_EXPORT_PRIVATE CodeStubAssembler : public compiler::CodeAssembler {
                          Label* range_error);
 
   // ES6 7.1.15 ToLength, but with inlined fast path.
-  Node* ToLength_Inline(Node* const context, Node* const input);
+  TNode<Number> ToLength_Inline(SloppyTNode<Context> context,
+                                SloppyTNode<Object> input);
 
   // ES6 7.1.4 ToInteger ( argument )
   TNode<Number> ToInteger_Inline(TNode<Context> context, TNode<Object> input,