[turbofan] Add ToNumber for strings and oddballs

Bug: v8:7790
Change-Id: Iba1c887897d17d75c4371b18f375983f7499120a
Reviewed-on: https://chromium-review.googlesource.com/1138075
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54463}

src/compiler/js-heap-broker.cc

@@ -500,6 +500,15 @@ uint16_t StringRef::GetFirstChar() {
   return object<String>()->Get(0);
 }
 
+double StringRef::ToNumber(const JSHeapBroker* broker) {
+  AllowHandleDereference allow_handle_dereference;
+  AllowHandleAllocation allow_handle_allocation;
+  AllowHeapAllocation allow_heap_allocation;
+  int flags = ALLOW_HEX | ALLOW_OCTAL | ALLOW_BINARY;
+  return StringToDouble(broker->isolate(), broker->isolate()->unicode_cache(),
+                        object<String>(), flags);
+}
+
 ObjectRef JSRegExpRef::raw_properties_or_hash(
     const JSHeapBroker* broker) const {
   AllowHandleAllocation handle_allocation;
@@ -705,6 +714,30 @@ bool ObjectRef::BooleanValue(const JSHeapBroker* broker) {
   return object<Object>()->BooleanValue(broker->isolate());
 }
 
+double ObjectRef::OddballToNumber(const JSHeapBroker* broker) const {
+  OddballType type = oddball_type(broker);
+
+  switch (type) {
+    case OddballType::kBoolean: {
+      ObjectRef true_ref(broker->isolate()->factory()->true_value());
+      return this->equals(true_ref) ? 1 : 0;
+      break;
+    }
+    case OddballType::kUndefined: {
+      return std::numeric_limits<double>::quiet_NaN();
+      break;
+    }
+    case OddballType::kNull: {
+      return 0;
+      break;
+    }
+    default: {
+      UNREACHABLE();
+      break;
+    }
+  }
+}
+
 CellRef ModuleRef::GetCell(const JSHeapBroker* broker, int cell_index) {
   AllowHandleAllocation handle_allocation;
   AllowHandleDereference allow_handle_dereference;

src/compiler/js-heap-broker.h

@@ -119,6 +119,7 @@ class ObjectRef {
 
   StringRef TypeOf(const JSHeapBroker* broker) const;
   bool BooleanValue(const JSHeapBroker* broker);
+  double OddballToNumber(const JSHeapBroker* broker) const;
 
  private:
   Handle<Object> object_;
@@ -340,6 +341,7 @@ class StringRef : public NameRef {
 
   int length() const;
   uint16_t GetFirstChar();
+  double ToNumber(const JSHeapBroker* broker);
 };
 
 class ModuleRef : public HeapObjectRef {

src/compiler/js-typed-lowering.cc

@@ -983,27 +983,19 @@ Reduction JSTypedLowering::ReduceJSToNumberOrNumericInput(Node* input) {
   // we only cover cases where ToNumber and ToNumeric coincide.
   Type input_type = NodeProperties::GetType(input);
 
-  // TODO(mslekova): get rid of these allows by doing either one of:
-  // 1. remove the optimization and check if it ruins the performance
-  // 2. leave a placeholder and do the actual allocations once back on the MT
   if (input_type.Is(Type::String())) {
     HeapObjectMatcher m(input);
     if (m.HasValue() && m.Ref().IsString()) {
-      AllowHandleDereference allow_handle_dereference;
-      AllowHandleAllocation allow_handle_allocation;
-      AllowHeapAllocation allow_heap_allocation;
       StringRef input_value = m.Ref().AsString();
-      return Replace(jsgraph()->Constant(
-          String::ToNumber(isolate(), input_value.object<String>())));
+      return Replace(
+          jsgraph()->Constant(input_value.ToNumber(js_heap_broker())));
     }
   }
   if (input_type.IsHeapConstant()) {
     ObjectRef input_value = input_type.AsHeapConstant()->Ref();
     if (input_value.oddball_type(js_heap_broker()) != OddballType::kNone) {
-      AllowHandleDereference allow_handle_dereference;
-      AllowHandleAllocation allow_handle_allocation;
-      return Replace(jsgraph()->Constant(
-          Oddball::ToNumber(isolate(), input_value.object<Oddball>())));
+      return Replace(
+          jsgraph()->Constant(input_value.OddballToNumber(js_heap_broker())));
     }
   }
   if (input_type.Is(Type::Number())) {