[turbofan] We can inline property access for all primitives.

TurboFan is actually able to generate property access to all prototypes
of all primitives, except the special Oddball primitives that have no
wrapper counterparts (namely null and undefined from the ES6 point of
view).

R=jarin@chromium.org
BUG=v8:4470
LOG=n

Review URL: https://codereview.chromium.org/1409163007

Cr-Commit-Position: refs/heads/master@{#31739}

src/compiler/access-info.cc

@@ -28,8 +28,12 @@ bool CanInlineElementAccess(Handle<Map> map) {
 
 
 bool CanInlinePropertyAccess(Handle<Map> map) {
-  if (map->instance_type() == HEAP_NUMBER_TYPE) return true;
-  if (map->instance_type() < FIRST_NONSTRING_TYPE) return true;
+  // We can inline property access to prototypes of all primitives, except
+  // the special Oddball ones that have no wrapper counterparts (i.e. Null,
+  // Undefined and TheHole).
+  STATIC_ASSERT(ODDBALL_TYPE == LAST_PRIMITIVE_TYPE);
+  if (map->IsBooleanMap()) return true;
+  if (map->instance_type() < LAST_PRIMITIVE_TYPE) return true;
   return map->IsJSObjectMap() && !map->is_dictionary_map() &&
          !map->has_named_interceptor() &&
          // TODO(verwaest): Whitelist contexts to which we have access.

src/objects-inl.h

@@ -4897,6 +4897,7 @@ bool Map::CanTransition() {
 }
 
 
+bool Map::IsBooleanMap() { return this == GetHeap()->boolean_map(); }
 bool Map::IsPrimitiveMap() {
   STATIC_ASSERT(FIRST_PRIMITIVE_TYPE == FIRST_TYPE);
   return instance_type() <= LAST_PRIMITIVE_TYPE;

src/objects.h

@@ -5924,6 +5924,7 @@ class Map: public HeapObject {
 
   inline bool CanTransition();
 
+  inline bool IsBooleanMap();
   inline bool IsPrimitiveMap();
   inline bool IsJSObjectMap();
   inline bool IsJSArrayMap();

test/mjsunit/compiler/boolean-protototype.js

+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function test1(s) {
+  return s.toString;
+}
+assertSame(test1(false), Boolean.prototype.toString);
+assertSame(test1(true), Boolean.prototype.toString);
+%OptimizeFunctionOnNextCall(test1);
+assertSame(test1(false), Boolean.prototype.toString);
+assertSame(test1(true), Boolean.prototype.toString);
+
+function test2(s) {
+  return s.valueOf;
+}
+assertSame(test2(false), Boolean.prototype.valueOf);
+assertSame(test2(true), Boolean.prototype.valueOf);
+%OptimizeFunctionOnNextCall(test2);
+assertSame(test2(false), Boolean.prototype.valueOf);
+assertSame(test2(true), Boolean.prototype.valueOf);
+
+Boolean.prototype.foo = 42;
+function test3(s) {
+  return s["foo"];
+}
+assertEquals(test3(false), 42);
+assertEquals(test3(true), 42);
+%OptimizeFunctionOnNextCall(test3);
+assertEquals(test3(false), 42);
+assertEquals(test3(true), 42);
+
+Boolean.prototype.bar = function bar() { "use strict"; return this; }
+function test4(s) {
+  return s.bar();
+}
+assertEquals(test4(false), false);
+assertEquals(test4(true), true);
+%OptimizeFunctionOnNextCall(test4);
+assertEquals(test4(false), false);
+assertEquals(test4(true), true);

test/mjsunit/compiler/symbol-protototype.js

+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function test1(s) {
+  return s.toString;
+}
+assertSame(test1(Symbol()), Symbol.prototype.toString);
+assertSame(test1(Symbol()), Symbol.prototype.toString);
+%OptimizeFunctionOnNextCall(test1);
+assertSame(test1(Symbol()), Symbol.prototype.toString);
+
+function test2(s) {
+  return s.valueOf;
+}
+assertSame(test2(Symbol()), Symbol.prototype.valueOf);
+assertSame(test2(Symbol()), Symbol.prototype.valueOf);
+%OptimizeFunctionOnNextCall(test2);
+assertSame(test2(Symbol()), Symbol.prototype.valueOf);
+
+Symbol.prototype.foo = 1;
+function test3(s) {
+  return s["foo"];
+}
+assertEquals(test3(Symbol()), 1);
+assertEquals(test3(Symbol()), 1);
+%OptimizeFunctionOnNextCall(test3);
+assertEquals(test3(Symbol()), 1);
+
+Symbol.prototype.bar = function() { "use strict"; return this; }
+function test4(s) {
+  return s.bar();
+}
+var s = Symbol("foo");
+assertEquals(test4(s), s);
+assertEquals(test4(s), s);
+%OptimizeFunctionOnNextCall(test4);
+assertEquals(test4(s), s);