[turbofan] Improve typing rules for various builtins.

Sanitize the typing rules for the various supported Math builtins, and
add appropriate typing rules for various Number, String, Object and global
builtins as well.

R=franzih@chromium.org

Review-Url: https://codereview.chromium.org/2222053002
Cr-Commit-Position: refs/heads/master@{#38472}

src/bootstrapper.cc

@@ -452,6 +452,15 @@ Handle<JSFunction> SimpleInstallFunction(Handle<JSObject> base,
                                len, adapt, attrs);
 }
 
+Handle<JSFunction> SimpleInstallFunction(Handle<JSObject> base,
+                                         const char* name, Builtins::Name call,
+                                         int len, bool adapt,
+                                         BuiltinFunctionId id) {
+  Handle<JSFunction> fun = SimpleInstallFunction(base, name, call, len, adapt);
+  fun->shared()->set_builtin_function_id(id);
+  return fun;
+}
+
 Handle<JSFunction> SimpleInstallGetter(Handle<JSObject> base,
                                        Handle<String> name, Builtins::Name call,
                                        bool adapt) {
@@ -3055,27 +3064,29 @@ bool Genesis::InstallNatives(GlobalContextType context_type) {
 
   // Install Global.decodeURI.
   SimpleInstallFunction(global_object, "decodeURI", Builtins::kGlobalDecodeURI,
-                        1, false);
+                        1, false, kGlobalDecodeURI);
 
   // Install Global.decodeURIComponent.
   SimpleInstallFunction(global_object, "decodeURIComponent",
-                        Builtins::kGlobalDecodeURIComponent, 1, false);
+                        Builtins::kGlobalDecodeURIComponent, 1, false,
+                        kGlobalDecodeURIComponent);
 
   // Install Global.encodeURI.
   SimpleInstallFunction(global_object, "encodeURI", Builtins::kGlobalEncodeURI,
-                        1, false);
+                        1, false, kGlobalEncodeURI);
 
   // Install Global.encodeURIComponent.
   SimpleInstallFunction(global_object, "encodeURIComponent",
-                        Builtins::kGlobalEncodeURIComponent, 1, false);
+                        Builtins::kGlobalEncodeURIComponent, 1, false,
+                        kGlobalEncodeURIComponent);
 
   // Install Global.escape.
   SimpleInstallFunction(global_object, "escape", Builtins::kGlobalEscape, 1,
-                        false);
+                        false, kGlobalEscape);
 
   // Install Global.unescape.
   SimpleInstallFunction(global_object, "unescape", Builtins::kGlobalUnescape, 1,
-                        false);
+                        false, kGlobalUnescape);
 
   // Install Global.eval.
   {

src/compiler/typer.cc

@@ -1292,21 +1292,27 @@ Type* Typer::Visitor::JSCallFunctionTyper(Type* fun, Typer* t) {
         // Unary math functions.
         case kMathAbs:
         case kMathExp:
+        case kMathExpm1:
           return Type::Union(Type::PlainNumber(), Type::NaN(), t->zone());
-        case kMathLog:
-        case kMathSqrt:
-        case kMathCos:
-        case kMathSin:
-        case kMathTan:
         case kMathAcos:
         case kMathAcosh:
         case kMathAsin:
         case kMathAsinh:
         case kMathAtan:
         case kMathAtanh:
+        case kMathCbrt:
+        case kMathCos:
         case kMathFround:
-        case kMathSign:
+        case kMathLog:
+        case kMathLog1p:
+        case kMathLog10:
+        case kMathLog2:
+        case kMathSin:
+        case kMathSqrt:
+        case kMathTan:
           return Type::Number();
+        case kMathSign:
+          return t->cache_.kMinusOneToOne;
         // Binary math functions.
         case kMathAtan2:
         case kMathPow:
@@ -1317,6 +1323,11 @@ Type* Typer::Visitor::JSCallFunctionTyper(Type* fun, Typer* t) {
           return Type::Signed32();
         case kMathClz32:
           return t->cache_.kZeroToThirtyTwo;
+        // Number functions.
+        case kNumberParseInt:
+          return t->cache_.kIntegerOrMinusZeroOrNaN;
+        case kNumberToString:
+          return Type::String();
         // String functions.
         case kStringCharCodeAt:
           return Type::Union(Type::Range(0, kMaxUInt16, t->zone()), Type::NaN(),
@@ -1324,13 +1335,25 @@ Type* Typer::Visitor::JSCallFunctionTyper(Type* fun, Typer* t) {
         case kStringCharAt:
         case kStringConcat:
         case kStringFromCharCode:
+        case kStringSubstr:
         case kStringToLowerCase:
         case kStringToUpperCase:
           return Type::String();
         // Array functions.
         case kArrayIndexOf:
         case kArrayLastIndexOf:
-          return Type::Number();
+          return Type::Range(-1, kMaxSafeInteger, t->zone());
+        // Object functions.
+        case kObjectHasOwnProperty:
+          return Type::Boolean();
+        // Global functions.
+        case kGlobalDecodeURI:
+        case kGlobalDecodeURIComponent:
+        case kGlobalEncodeURI:
+        case kGlobalEncodeURIComponent:
+        case kGlobalEscape:
+        case kGlobalUnescape:
+          return Type::String();
         default:
           break;
       }

src/objects.h

@@ -6797,6 +6797,7 @@ class Script: public Struct {
   V(String.prototype, charCodeAt, StringCharCodeAt)         \
   V(String.prototype, charAt, StringCharAt)                 \
   V(String.prototype, concat, StringConcat)                 \
+  V(String.prototype, substr, StringSubstr)                 \
   V(String.prototype, toLowerCase, StringToLowerCase)       \
   V(String.prototype, toUpperCase, StringToUpperCase)       \
   V(String, fromCharCode, StringFromCharCode)               \
@@ -6834,7 +6835,8 @@ class Script: public Struct {
   V(Math, clz32, MathClz32)                                 \
   V(Math, fround, MathFround)                               \
   V(Math, trunc, MathTrunc)                                 \
-  V(Number, parseInt, NumberParseInt)
+  V(Number, parseInt, NumberParseInt)                       \
+  V(Number.prototype, toString, NumberToString)
 
 #define ATOMIC_FUNCTIONS_WITH_ID_LIST(V) \
   V(Atomics, load, AtomicsLoad)          \
@@ -6855,6 +6857,12 @@ enum BuiltinFunctionId {
   kDataViewBuffer,
   kDataViewByteLength,
   kDataViewByteOffset,
+  kGlobalDecodeURI,
+  kGlobalDecodeURIComponent,
+  kGlobalEncodeURI,
+  kGlobalEncodeURIComponent,
+  kGlobalEscape,
+  kGlobalUnescape,
   kTypedArrayByteLength,
   kTypedArrayByteOffset,
   kTypedArrayLength,

src/type-cache.h

@@ -49,6 +49,7 @@ class TypeCache final {
   Type* const kTenOrUndefined =
       Type::Union(kSingletonTen, Type::Undefined(), zone());
   Type* const kMinusOneOrZero = CreateRange(-1.0, 0.0);
+  Type* const kMinusOneToOne = CreateRange(-1.0, 1.0);
   Type* const kZeroOrOne = CreateRange(0.0, 1.0);
   Type* const kZeroOrOneOrNaN = Type::Union(kZeroOrOne, Type::NaN(), zone());
   Type* const kZeroToThirtyOne = CreateRange(0.0, 31.0);