[maglev] Support CallJSRuntime

Bug: v8:7700
Change-Id: Iad4b8c8187dc99e811a90f66b05d0cd9e2713ec9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3815484Reviewed-by: Victor Gomes <victorgomes@chromium.org>
Commit-Queue: 王澳 <wangao.james@bytedance.com>
Cr-Commit-Position: refs/heads/main@{#82250}

src/maglev/maglev-graph-builder.cc

@@ -1762,7 +1762,29 @@ void MaglevGraphBuilder::VisitCallRuntime() {
 }
 
 MAGLEV_UNIMPLEMENTED_BYTECODE(CallRuntimeForPair)
-MAGLEV_UNIMPLEMENTED_BYTECODE(CallJSRuntime)
+
+void MaglevGraphBuilder::VisitCallJSRuntime() {
+  // Get the function to call from the native context.
+  compiler::NativeContextRef native_context = broker()->target_native_context();
+  ValueNode* context = GetConstant(native_context);
+  uint32_t slot = iterator_.GetNativeContextIndexOperand(0);
+  ValueNode* callee = AddNewNode<LoadTaggedField>(
+      {context}, NativeContext::OffsetOfElementAt(slot));
+  // Call the function.
+  interpreter::RegisterList args = iterator_.GetRegisterListOperand(1);
+  int kTheReceiver = 1;
+  size_t input_count =
+      args.register_count() + Call::kFixedInputCount + kTheReceiver;
+
+  Call* call = CreateNewNode<Call>(
+      input_count, ConvertReceiverMode::kNullOrUndefined, callee, GetContext());
+  int arg_index = 0;
+  call->set_arg(arg_index++, GetRootConstant(RootIndex::kUndefinedValue));
+  for (int i = 0; i < args.register_count(); ++i) {
+    call->set_arg(arg_index++, GetTaggedValue(args[i]));
+  }
+  SetAccumulator(AddNode(call));
+}
 
 void MaglevGraphBuilder::VisitInvokeIntrinsic() {
   // InvokeIntrinsic <function_id> <first_arg> <arg_count>

test/mjsunit/maglev/call-js-runtime.js

+// Copyright 2022 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --maglev --no-stress-opt --no-always-turbofan
+
+function Bar(x) {
+  this.bar = x
+}
+
+function foo(x) {
+  return new Bar(...x, 1);
+}
+
+%PrepareFunctionForOptimization(foo);
+assertEquals(1, foo([1]).bar);
+assertEquals(2, foo([2]).bar);
+%OptimizeMaglevOnNextCall(foo);
+assertEquals(1, foo([1]).bar);
+assertEquals(2, foo([2]).bar);
+assertTrue(isMaglevved(foo));