[turboshaft] Maglev-to-ts: support named load on smis and cst key load

Bug: chomium:42204525
Change-Id: I37a97d57f2cdd5898223d0610768411ebe17f191
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5494069
Auto-Submit: Darius Mercadier <dmercadier@chromium.org>
Reviewed-by: Matthias Liedtke <mliedtke@chromium.org>
Commit-Queue: Matthias Liedtke <mliedtke@chromium.org>
Cr-Commit-Position: refs/heads/main@{#93645}

src/compiler/turboshaft/assembler.h

@@ -1754,6 +1754,10 @@ class TurboshaftAssemblerOpInterface
     return ObjectIs(object, ObjectIsOp::Kind::kSmi,
                     ObjectIsOp::InputAssumptions::kNone);
   }
+  V<Word32> ObjectIsString(V<Object> object) {
+    return ObjectIs(object, ObjectIsOp::Kind::kString,
+                    ObjectIsOp::InputAssumptions::kNone);
+  }
 
   V<Word32> Float64Is(V<Float64> input, NumericKind kind) {
     return ReduceIfReachableFloat64Is(input, kind);

src/compiler/turboshaft/maglev-early-lowering-reducer-inl.h

@@ -102,6 +102,21 @@ class MaglevEarlyLoweringReducer : public Next {
     return result;
   }
 
+  void CheckValueEqualsString(V<Object> object, InternalizedStringRef value,
+                              V<FrameState> frame_state,
+                              const FeedbackSource& feedback) {
+    IF_NOT (LIKELY(__ TaggedEqual(object, __ HeapConstant(value.object())))) {
+      __ DeoptimizeIfNot(__ ObjectIsString(object), frame_state,
+                         DeoptimizeReason::kNotAString, feedback);
+      V<Boolean> is_same_string_bool =
+          __ StringEqual(V<String>::Cast(object),
+                         __ template HeapConstant<String>(value.object()));
+      __ DeoptimizeIf(
+          __ RootEqual(is_same_string_bool, RootIndex::kFalseValue, isolate_),
+          frame_state, DeoptimizeReason::kWrongValue, feedback);
+    }
+  }
+
   V<Object> CheckConstructResult(V<Object> construct_result,
                                  V<Object> implicit_receiver) {
     // If the result is an object (in the ECMA sense), we should get rid

src/compiler/turboshaft/maglev-graph-building-phase.cc

@@ -981,6 +981,14 @@ class GraphBuilder {
                      node->eager_deopt_info()->feedback_to_update()));
     return maglev::ProcessResult::kContinue;
   }
+  maglev::ProcessResult Process(maglev::CheckValueEqualsString* node,
+                                const maglev::ProcessingState& state) {
+    V<FrameState> frame_state = BuildFrameState(node->eager_deopt_info());
+    __ CheckValueEqualsString(Map(node->target_input()), node->value(),
+                              frame_state,
+                              node->eager_deopt_info()->feedback_to_update());
+    return maglev::ProcessResult::kContinue;
+  }
   maglev::ProcessResult Process(maglev::BuiltinStringFromCharCode* node,
                                 const maglev::ProcessingState& state) {
     SetMap(node, __ ConvertCharCodeToString(Map(node->code_input())));
@@ -1552,6 +1560,12 @@ class GraphBuilder {
               Map(node->if_true()), Map(node->if_false()));
     return maglev::ProcessResult::kContinue;
   }
+  maglev::ProcessResult Process(maglev::BranchIfSmi* node,
+                                const maglev::ProcessingState& state) {
+    __ Branch(__ IsSmi(Map(node->condition_input())), Map(node->if_true()),
+              Map(node->if_false()));
+    return maglev::ProcessResult::kContinue;
+  }
 
   maglev::ProcessResult Process(maglev::Switch* node,
                                 const maglev::ProcessingState& state) {

test/mjsunit/turboshaft/turboshaft-maglev-frontend.js

@@ -1495,3 +1495,36 @@ let glob_b = 3.35;
   assertEquals(19, f_switch(42));
   assertOptimized(f_switch);
 }
+
+// Testing load named on numbers.
+{
+  function array_length(arr) {
+    return arr.length;
+  }
+
+  %PrepareFunctionForOptimization(array_length);
+  assertEquals(3, array_length([1, 2, 3]));
+  assertEquals(undefined, array_length(3.45));
+  %OptimizeFunctionOnNextCall(array_length);
+  assertEquals(3, array_length([1, 2, 3]));
+  assertEquals(undefined, array_length(3.45));
+  assertEquals(undefined, array_length(1));
+  assertOptimized(array_length);
+}
+
+// Testing load with constant string key.
+{
+  let o = { "a" : 42, "b": 17 };
+
+  function load_const_key(k) {
+    return o[k];
+  }
+
+  %PrepareFunctionForOptimization(load_const_key);
+  assertEquals(42, load_const_key("a"));
+  %OptimizeFunctionOnNextCall(load_const_key);
+  assertEquals(42, load_const_key("a"));
+  assertOptimized(load_const_key);
+  assertEquals(17, load_const_key("b"));
+  assertUnoptimized(load_const_key);
+}