[compiler] Don't try to inline allocate large arguments arrays

... otherwise we'd abort at runtime.

Bug: chromium:1178076
Change-Id: Ic7b4a3b27379ec0d42419e2695ab487904eabd72
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2695395Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#72744}

src/compiler/allocation-builder-inl.h

@@ -27,11 +27,21 @@ void AllocationBuilder::AllocateContext(int variadic_part_length, MapRef map) {
         jsgraph()->Constant(variadic_part_length));
 }
 
+// static
+bool AllocationBuilder::CanAllocateArray(int length, MapRef map,
+                                         AllocationType allocation) {
+  DCHECK(map.instance_type() == FIXED_ARRAY_TYPE ||
+         map.instance_type() == FIXED_DOUBLE_ARRAY_TYPE);
+  int const size = (map.instance_type() == FIXED_ARRAY_TYPE)
+                       ? FixedArray::SizeFor(length)
+                       : FixedDoubleArray::SizeFor(length);
+  return size <= Heap::MaxRegularHeapObjectSize(allocation);
+}
+
 // Compound allocation of a FixedArray.
 void AllocationBuilder::AllocateArray(int length, MapRef map,
                                       AllocationType allocation) {
-  DCHECK(map.instance_type() == FIXED_ARRAY_TYPE ||
-         map.instance_type() == FIXED_DOUBLE_ARRAY_TYPE);
+  DCHECK(CanAllocateArray(length, map, allocation));
   int size = (map.instance_type() == FIXED_ARRAY_TYPE)
                  ? FixedArray::SizeFor(length)
                  : FixedDoubleArray::SizeFor(length);
@@ -40,8 +50,16 @@ void AllocationBuilder::AllocateArray(int length, MapRef map,
   Store(AccessBuilder::ForFixedArrayLength(), jsgraph()->Constant(length));
 }
 
+// static
+bool AllocationBuilder::CanAllocateSloppyArgumentElements(
+    int length, MapRef map, AllocationType allocation) {
+  int const size = SloppyArgumentsElements::SizeFor(length);
+  return size <= Heap::MaxRegularHeapObjectSize(allocation);
+}
+
 void AllocationBuilder::AllocateSloppyArgumentElements(
     int length, MapRef map, AllocationType allocation) {
+  DCHECK(CanAllocateSloppyArgumentElements(length, map, allocation));
   int size = SloppyArgumentsElements::SizeFor(length);
   Allocate(size, allocation, Type::OtherInternal());
   Store(AccessBuilder::ForMap(), map);

src/compiler/allocation-builder.h

@@ -52,10 +52,16 @@ class AllocationBuilder final {
   inline void AllocateContext(int variadic_part_length, MapRef map);
 
   // Compound allocation of a FixedArray.
+  inline static bool CanAllocateArray(
+      int length, MapRef map,
+      AllocationType allocation = AllocationType::kYoung);
   inline void AllocateArray(int length, MapRef map,
                             AllocationType allocation = AllocationType::kYoung);
 
   // Compound allocation of a SloppyArgumentsElements
+  static inline bool CanAllocateSloppyArgumentElements(
+      int length, MapRef map,
+      AllocationType allocation = AllocationType::kYoung);
   inline void AllocateSloppyArgumentElements(
       int length, MapRef map,
       AllocationType allocation = AllocationType::kYoung);

src/compiler/js-create-lowering.h

@@ -83,17 +83,21 @@ class V8_EXPORT_PRIVATE JSCreateLowering final
       const SlackTrackingPrediction& slack_tracking_prediction);
   Reduction ReduceJSCreateObject(Node* node);
 
-  Node* AllocateArguments(Node* effect, Node* control, FrameState frame_state);
-  Node* AllocateRestArguments(Node* effect, Node* control,
-                              FrameState frame_state, int start_index);
-  Node* AllocateAliasedArguments(Node* effect, Node* control,
-                                 FrameState frame_state, Node* context,
-                                 const SharedFunctionInfoRef& shared,
-                                 bool* has_aliased_arguments);
-  Node* AllocateAliasedArguments(Node* effect, Node* control, Node* context,
-                                 Node* arguments_length,
-                                 const SharedFunctionInfoRef& shared,
-                                 bool* has_aliased_arguments);
+  // The following functions all return nullptr iff there are too many arguments
+  // for inline allocation.
+  Node* TryAllocateArguments(Node* effect, Node* control,
+                             FrameState frame_state);
+  Node* TryAllocateRestArguments(Node* effect, Node* control,
+                                 FrameState frame_state, int start_index);
+  Node* TryAllocateAliasedArguments(Node* effect, Node* control,
+                                    FrameState frame_state, Node* context,
+                                    const SharedFunctionInfoRef& shared,
+                                    bool* has_aliased_arguments);
+  Node* TryAllocateAliasedArguments(Node* effect, Node* control, Node* context,
+                                    Node* arguments_length,
+                                    const SharedFunctionInfoRef& shared,
+                                    bool* has_aliased_arguments);
+
   Node* AllocateElements(Node* effect, Node* control,
                          ElementsKind elements_kind, int capacity,
                          AllocationType allocation);