[nojit] Change builtin pointers to use Smis underneath

This changes Torque's builtin pointers to use a Smi representation
underneath instead of storing the Code target object. Callsites look
up the target entry point through IsolateData::builtin_entry_table.

The notable effect of this CL is that builtin pointer calls no longer
call any on-heap Code.

Bug: v8:7777
Change-Id: Ibf6c749dd46cae7aba51494b09921229dd436f63
Reviewed-on: https://chromium-review.googlesource.com/c/1379880
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58286}

src/arm/macro-assembler-arm.cc

@@ -292,8 +292,18 @@ void TurboAssembler::Call(Handle<Code> code, RelocInfo::Mode rmode,
 }
 
 void TurboAssembler::CallBuiltinPointer(Register builtin_pointer) {
+  STATIC_ASSERT(kSystemPointerSize == 4);
+  STATIC_ASSERT(kSmiShiftSize == 0);
+  STATIC_ASSERT(kSmiTagSize == 1);
+  STATIC_ASSERT(kSmiTag == 0);
+
+  // The builtin_pointer register contains the builtin index as a Smi.
+  // Untagging is folded into the indexing operand below.
+  mov(builtin_pointer,
+      Operand(builtin_pointer, LSL, kSystemPointerSizeLog2 - kSmiTagSize));
   add(builtin_pointer, builtin_pointer,
-      Operand(Code::kHeaderSize - kHeapObjectTag));
+      Operand(IsolateData::builtin_entry_table_offset()));
+  ldr(builtin_pointer, MemOperand(kRootRegister, builtin_pointer));
   Call(builtin_pointer);
 }
 

src/arm64/macro-assembler-arm64.cc

@@ -2030,7 +2030,17 @@ void TurboAssembler::Call(ExternalReference target) {
 }
 
 void TurboAssembler::CallBuiltinPointer(Register builtin_pointer) {
-  Add(builtin_pointer, builtin_pointer, Code::kHeaderSize - kHeapObjectTag);
+  STATIC_ASSERT(kSystemPointerSize == 8);
+  STATIC_ASSERT(kSmiShiftSize == 31);
+  STATIC_ASSERT(kSmiTagSize == 1);
+  STATIC_ASSERT(kSmiTag == 0);
+
+  // The builtin_pointer register contains the builtin index as a Smi.
+  // Untagging is folded into the indexing operand below.
+  Asr(builtin_pointer, builtin_pointer, kSmiShift - kSystemPointerSizeLog2);
+  Add(builtin_pointer, builtin_pointer,
+      IsolateData::builtin_entry_table_offset());
+  Ldr(builtin_pointer, MemOperand(kRootRegister, builtin_pointer));
   Call(builtin_pointer);
 }
 

src/builtins/base.tq

@@ -35,6 +35,7 @@ type int31 extends int32
 type RawPtr generates 'TNode<RawPtrT>' constexpr 'void*';
 type AbstractCode extends HeapObject generates 'TNode<AbstractCode>';
 type Code extends AbstractCode generates 'TNode<Code>';
+type BuiltinPtr extends Smi generates 'TNode<BuiltinPtr>';
 type JSReceiver extends HeapObject generates 'TNode<JSReceiver>';
 type Constructor extends JSReceiver generates 'TNode<JSReceiver>';
 type Context extends HeapObject generates 'TNode<Context>';

src/compiler/code-assembler.h

@@ -250,8 +250,7 @@ using Number = UnionT<Smi, HeapNumber>;
 using Numeric = UnionT<Number, BigInt>;
 
 // A pointer to a builtin function, used by Torque's function pointers.
-// TODO(jgruber): Switch to a Smi representation.
-using BuiltinPtr = Code;
+using BuiltinPtr = Smi;
 
 class int31_t {
  public:
@@ -1226,7 +1225,7 @@ class V8_EXPORT_PRIVATE CodeAssembler {
   template <class... TArgs>
   Node* CallStubR(StubCallMode call_mode,
                   const CallInterfaceDescriptor& descriptor, size_t result_size,
-                  SloppyTNode<Code> target, SloppyTNode<Object> context,
+                  SloppyTNode<Object> target, SloppyTNode<Object> context,
                   TArgs... args) {
     return CallStubRImpl(call_mode, descriptor, result_size, target, context,
                          {args...});

src/ia32/macro-assembler-ia32.cc

@@ -1872,7 +1872,16 @@ void TurboAssembler::Call(Handle<Code> code_object, RelocInfo::Mode rmode) {
 }
 
 void TurboAssembler::CallBuiltinPointer(Register builtin_pointer) {
-  add(builtin_pointer, Immediate(Code::kHeaderSize - kHeapObjectTag));
+  STATIC_ASSERT(kSystemPointerSize == 4);
+  STATIC_ASSERT(kSmiShiftSize == 0);
+  STATIC_ASSERT(kSmiTagSize == 1);
+  STATIC_ASSERT(kSmiTag == 0);
+
+  // The builtin_pointer register contains the builtin index as a Smi.
+  // Untagging is folded into the indexing operand below (we use times_2 instead
+  // of times_4 since smis are already shifted by one).
+  mov(builtin_pointer, Operand(kRootRegister, builtin_pointer, times_2,
+                               IsolateData::builtin_entry_table_offset()));
   call(builtin_pointer);
 }
 

src/isolate-data.h

@@ -49,6 +49,11 @@ class IsolateData final {
     return kExternalReferenceTableOffset - kIsolateRootBias;
   }
 
+  // Root-register-relative offset of the builtin entry table.
+  static constexpr int builtin_entry_table_offset() {
+    return kBuiltinEntryTableOffset - kIsolateRootBias;
+  }
+
   // Root-register-relative offset of the builtins table.
   static constexpr int builtins_table_offset() {
     return kBuiltinsTableOffset - kIsolateRootBias;

src/mips/macro-assembler-mips.cc

@@ -3973,7 +3973,18 @@ void TurboAssembler::Call(Handle<Code> code, RelocInfo::Mode rmode,
 }
 
 void TurboAssembler::CallBuiltinPointer(Register builtin_pointer) {
-  Call(builtin_pointer, builtin_pointer, Code::kHeaderSize - kHeapObjectTag);
+  STATIC_ASSERT(kSystemPointerSize == 4);
+  STATIC_ASSERT(kSmiShiftSize == 0);
+  STATIC_ASSERT(kSmiTagSize == 1);
+  STATIC_ASSERT(kSmiTag == 0);
+
+  // The builtin_pointer register contains the builtin index as a Smi.
+  // Untagging is folded into the indexing operand below.
+  Lsa(builtin_pointer, kRootRegister, builtin_pointer,
+      kSystemPointerSize - kSmiTagSize);
+  lw(builtin_pointer,
+     MemOperand(builtin_pointer, IsolateData::builtin_entry_table_offset()));
+  Call(builtin_pointer);
 }
 
 void TurboAssembler::StoreReturnAddressAndCall(Register target) {

src/mips64/macro-assembler-mips64.cc

@@ -4300,7 +4300,16 @@ void TurboAssembler::Call(Handle<Code> code, RelocInfo::Mode rmode,
 }
 
 void TurboAssembler::CallBuiltinPointer(Register builtin_pointer) {
-  daddiu(builtin_pointer, builtin_pointer, Code::kHeaderSize - kHeapObjectTag);
+  STATIC_ASSERT(kSystemPointerSize == 8);
+  STATIC_ASSERT(kSmiShiftSize == 31);
+  STATIC_ASSERT(kSmiTagSize == 1);
+  STATIC_ASSERT(kSmiTag == 0);
+
+  // The builtin_pointer register contains the builtin index as a Smi.
+  SmiUntag(builtin_pointer, builtin_pointer);
+  Lsa(builtin_pointer, kRootRegister, builtin_pointer, kSystemPointerSizeLog2);
+  Ld(builtin_pointer,
+     MemOperand(builtin_pointer, IsolateData::builtin_entry_table_offset()));
   Call(builtin_pointer);
 }
 

src/torque/csa-generator.cc

@@ -94,11 +94,8 @@ void CSAGenerator::EmitInstruction(
 void CSAGenerator::EmitInstruction(
     const PushBuiltinPointerInstruction& instruction,
     Stack<std::string>* stack) {
-  stack->Push(
-      "ca_.UncheckedCast<BuiltinPtr>(ca_.HeapConstant(Builtins::CallableFor(ca_"
-      "."
-      "isolate(), Builtins::k" +
-      instruction.external_name + ").code()))");
+  stack->Push("ca_.UncheckedCast<BuiltinPtr>(ca_.SmiConstant(Builtins::k" +
+              instruction.external_name + "))");
 }
 
 void CSAGenerator::EmitInstruction(

src/torque/type-oracle.h

@@ -38,9 +38,9 @@ class TypeOracle : public ContextualClass<TypeOracle> {
   static const BuiltinPointerType* GetBuiltinPointerType(
       TypeVector argument_types, const Type* return_type) {
     TypeOracle& self = Get();
-    const Type* code_type = self.GetBuiltinType(CODE_TYPE_STRING);
+    const Type* builtin_type = self.GetBuiltinType(BUILTIN_POINTER_TYPE_STRING);
     const BuiltinPointerType* result = self.function_pointer_types_.Add(
-        BuiltinPointerType(code_type, argument_types, return_type,
+        BuiltinPointerType(builtin_type, argument_types, return_type,
                            self.all_builtin_pointer_types_.size()));
     if (result->function_pointer_type_id() ==
         self.all_builtin_pointer_types_.size()) {

src/torque/types.h

@@ -32,7 +32,7 @@ static const char* const RAWPTR_TYPE_STRING = "RawPtr";
 static const char* const CONST_STRING_TYPE_STRING = "constexpr string";
 static const char* const STRING_TYPE_STRING = "String";
 static const char* const NUMBER_TYPE_STRING = "Number";
-static const char* const CODE_TYPE_STRING = "Code";
+static const char* const BUILTIN_POINTER_TYPE_STRING = "BuiltinPtr";
 static const char* const INTPTR_TYPE_STRING = "intptr";
 static const char* const UINTPTR_TYPE_STRING = "uintptr";
 static const char* const INT32_TYPE_STRING = "int32";

src/x64/macro-assembler-x64.cc

@@ -1638,8 +1638,18 @@ void TurboAssembler::Call(Handle<Code> code_object, RelocInfo::Mode rmode) {
 }
 
 void TurboAssembler::CallBuiltinPointer(Register builtin_pointer) {
-  addp(builtin_pointer, Immediate(Code::kHeaderSize - kHeapObjectTag));
-  call(builtin_pointer);
+  STATIC_ASSERT(kSystemPointerSize == 8);
+  STATIC_ASSERT(kSmiShiftSize == 31);
+  STATIC_ASSERT(kSmiTagSize == 1);
+  STATIC_ASSERT(kSmiTag == 0);
+
+  // TODO(jgruber,ishell): With pointer compression, untagging could be folded
+  // into the operand below.
+
+  // The builtin_pointer register contains the builtin index as a Smi.
+  SmiUntag(builtin_pointer, builtin_pointer);
+  Call(Operand(kRootRegister, builtin_pointer, times_8,
+               IsolateData::builtin_entry_table_offset()));
 }
 
 void TurboAssembler::RetpolineCall(Register reg) {

test/torque/test-torque.tq

@@ -204,7 +204,7 @@ namespace test {
   }
 
   type ObjectToObject = builtin(Context, Object) => Object;
-  macro TestTypeAlias(x: ObjectToObject): Code {
+  macro TestTypeAlias(x: ObjectToObject): BuiltinPtr {
     return x;
   }