current commit
261004.7 · deps: update V8 to 15.2.124.38
// Copyright 2018 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.

#include 'src/builtins/builtins-array-gen.h'

namespace array {
// Naming convention from elements.cc. We have a similar intent but implement
// fastpaths using generics instead of using a class hierarchy for elements
// kinds specific implementations.
type GenericElementsAccessor extends ElementsKind;
type FastPackedSmiElements extends ElementsKind;
type FastPackedObjectElements extends ElementsKind;
type FastPackedDoubleElements extends ElementsKind;
type FastSmiOrObjectElements extends ElementsKind;
type FastDoubleElements extends ElementsKind;
type DictionaryElements extends ElementsKind;

macro EnsureWriteableFastElements(
    implicit context: Context)(array: JSArray): void {
  dcheck(IsFastElementsKind(array.map.elements_kind));

  const elements: FixedArrayBase = array.elements;
  if (elements.map != kCOWMap) return;

  // There are no COW *_DOUBLE_ELEMENTS arrays, so we are allowed to always
  // extract FixedArrays and don't have to worry about FixedDoubleArrays.
  dcheck(IsFastSmiOrTaggedElementsKind(array.map.elements_kind));

  const length = Convert<intptr>(Cast<Smi>(array.length) otherwise unreachable);
  array.elements = ExtractFixedArray(
      UnsafeCast<FixedArray>(elements), 0, length, length, TheHole);
  dcheck(array.elements.map != kCOWMap);
}

macro LoadElementOrUndefined(
    implicit context: Context)(a: FixedArray, i: Smi): JSAny {
  const e = UnsafeCast<(JSAny | TheHole)>(a.objects[i]);
  return ReplaceTheHoleWithUndefined(e);
}

macro LoadElementOrUndefined(a: FixedDoubleArray, i: Smi):
    NumberOrUndefined {
  const f: float64 = a.values[i].Value() otherwise return Undefined,
           return Undefined;
  return AllocateHeapNumberWithValue(f);
}

macro StoreArrayHole(elements: FixedDoubleArray, k: Smi): void {
  elements.values[k] = kDoubleHole;
}

macro StoreArrayHole(elements: FixedArray, k: Smi): void {
  elements.objects[k] = TheHole;
}

extern macro SetPropertyLength(implicit context: Context)(JSAny, Number):
    void;

const kLengthDescriptorIndex:
    constexpr int31 generates 'JSArray::kLengthDescriptorIndex';
const kAttributesReadOnlyMask: constexpr int31
    generates 'PropertyDetails::kAttributesReadOnlyMask';

@export
macro EnsureArrayLengthWritable(implicit context: Context)(map: Map):
    void labels Bailout {
  // Don't support arrays in dictionary named property mode.
  if (IsDictionaryMap(map)) {
    goto Bailout;
  }

  // Check whether the length property is writable. The length property is the
  // only default named property on arrays. It's nonconfigurable, hence is
  // guaranteed to stay the first property.
  const descriptors: DescriptorArray =
      UnsafeCast<DescriptorArray>(map.instance_descriptors);
  const descriptor:&DescriptorEntry =
      &descriptors.descriptors[kLengthDescriptorIndex];
  dcheck(TaggedEqual(descriptor->key, LengthStringConstant()));
  const details: Smi = UnsafeCast<Smi>(descriptor->details);
  if ((details & kAttributesReadOnlyMask) != 0) {
    goto Bailout;
  }
}

macro CreateJSArrayWithElements(
    implicit context: Context)(array: FixedArray): JSArray {
  const nativeContext: NativeContext = LoadNativeContext(context);
  const map: Map =
      LoadJSArrayElementsMap(ElementsKind::PACKED_ELEMENTS, nativeContext);
  return AllocateJSArray(map, array, Convert<Smi>(array.length));
}

// Deopt continuations for the inlined Array.prototype.sort.  The inlined sort
// took a snapshot of the receiver's elements into temp_array before calling
// comparefn for the first time.  On deopt we hand that snapshot to the generic
// PowerSort tail so that comparefn side effects on the receiver do not affect
// the sort result and the final array remains a permutation of the original
// elements, matching ECMA-262 23.1.3.30 SortIndexedProperties semantics.
//
// The inlined reduction is responsible for keeping temp_array a valid
// permutation of the original elements at every deopt point (the pivot is
// written back into temp_array after each shift in the insertion sort inner
// loop, so the pivot is never stranded in a register only).
//
// Receivers containing Undefined never reach this continuation: the inlined
// sort deopts on Undefined during copy-in, before its deopt continuation
// frame state is established.  That deopt unwinds to the bytecode level (the
// .sort call), where Array.prototype.sort's full algorithm runs and handles
// Undefined per CompareArrayElements -- including the compaction step
// (CompactReceiverElementsIntoWorkArray) that this continuation skips.
transitioning macro ArraySortContinueFromSnapshot(
    implicit context: Context)(receiver: JSAny, comparefn: JSAny,
    tempArray: FixedArray, originalLength: Smi): JSAny {
  const obj = Cast<JSReceiver>(receiver) otherwise unreachable;
  const cmp = Cast<(Undefined | Callable)>(comparefn) otherwise unreachable;
  const sortState: SortState =
      NewSortStateFromSnapshot(obj, cmp, tempArray, originalLength);
  ArrayPowerSortTail(originalLength);
  return obj;
}

transitioning javascript builtin
ArraySortContinueFromSnapshotEagerDeoptContinuation(
    js-implicit context: NativeContext, receiver: JSAny)(comparefn: JSAny,
    tempArray: JSAny, originalLength: JSAny): JSAny {
  const temp = Cast<FixedArray>(tempArray) otherwise unreachable;
  const len = Cast<Smi>(originalLength) otherwise unreachable;
  return ArraySortContinueFromSnapshot(receiver, comparefn, temp, len);
}

transitioning javascript builtin
ArraySortContinueFromSnapshotLazyDeoptContinuation(
    js-implicit context: NativeContext, receiver: JSAny)(comparefn: JSAny,
    tempArray: JSAny, originalLength: JSAny, _result: JSAny): JSAny {
  const temp = Cast<FixedArray>(tempArray) otherwise unreachable;
  const len = Cast<Smi>(originalLength) otherwise unreachable;
  return ArraySortContinueFromSnapshot(receiver, comparefn, temp, len);
}
}