LCOV - code coverage report
Current view: top level - src/builtins - builtins-string-gen.cc (source / functions) Hit Total Coverage
Test: app.info Lines: 1359 1363 99.7 %
Date: 2019-02-19 Functions: 334 334 100.0 %

          Line data    Source code
       1             : // Copyright 2017 the V8 project authors. All rights reserved.
       2             : // Use of this source code is governed by a BSD-style license that can be
       3             : // found in the LICENSE file.
       4             : 
       5             : #include "src/builtins/builtins-string-gen.h"
       6             : 
       7             : #include "src/builtins/builtins-regexp-gen.h"
       8             : #include "src/builtins/builtins-utils-gen.h"
       9             : #include "src/builtins/builtins.h"
      10             : #include "src/code-factory.h"
      11             : #include "src/heap/factory-inl.h"
      12             : #include "src/heap/heap-inl.h"
      13             : #include "src/objects.h"
      14             : #include "src/objects/property-cell.h"
      15             : 
      16             : namespace v8 {
      17             : namespace internal {
      18             : 
      19             : typedef compiler::Node Node;
      20             : template <class T>
      21             : using TNode = compiler::TNode<T>;
      22             : 
      23        1344 : Node* StringBuiltinsAssembler::DirectStringData(Node* string,
      24             :                                                 Node* string_instance_type) {
      25             :   // Compute the effective offset of the first character.
      26        1344 :   VARIABLE(var_data, MachineType::PointerRepresentation());
      27        2688 :   Label if_sequential(this), if_external(this), if_join(this);
      28             :   Branch(Word32Equal(Word32And(string_instance_type,
      29        2688 :                                Int32Constant(kStringRepresentationMask)),
      30        5376 :                      Int32Constant(kSeqStringTag)),
      31        1344 :          &if_sequential, &if_external);
      32             : 
      33        1344 :   BIND(&if_sequential);
      34             :   {
      35             :     var_data.Bind(IntPtrAdd(
      36             :         IntPtrConstant(SeqOneByteString::kHeaderSize - kHeapObjectTag),
      37        1344 :         BitcastTaggedToWord(string)));
      38        1344 :     Goto(&if_join);
      39             :   }
      40             : 
      41        1344 :   BIND(&if_external);
      42             :   {
      43             :     // This is only valid for ExternalStrings where the resource data
      44             :     // pointer is cached (i.e. no uncached external strings).
      45             :     CSA_ASSERT(this, Word32NotEqual(
      46             :                          Word32And(string_instance_type,
      47             :                                    Int32Constant(kUncachedExternalStringMask)),
      48             :                          Int32Constant(kUncachedExternalStringTag)));
      49             :     var_data.Bind(LoadObjectField(string, ExternalString::kResourceDataOffset,
      50        1344 :                                   MachineType::Pointer()));
      51        1344 :     Goto(&if_join);
      52             :   }
      53             : 
      54        1344 :   BIND(&if_join);
      55        2688 :   return var_data.value();
      56             : }
      57             : 
      58         168 : void StringBuiltinsAssembler::DispatchOnStringEncodings(
      59             :     Node* const lhs_instance_type, Node* const rhs_instance_type,
      60             :     Label* if_one_one, Label* if_one_two, Label* if_two_one,
      61             :     Label* if_two_two) {
      62             :   STATIC_ASSERT(kStringEncodingMask == 0x8);
      63             :   STATIC_ASSERT(kTwoByteStringTag == 0x0);
      64             :   STATIC_ASSERT(kOneByteStringTag == 0x8);
      65             : 
      66             :   // First combine the encodings.
      67             : 
      68         168 :   Node* const encoding_mask = Int32Constant(kStringEncodingMask);
      69         168 :   Node* const lhs_encoding = Word32And(lhs_instance_type, encoding_mask);
      70         168 :   Node* const rhs_encoding = Word32And(rhs_instance_type, encoding_mask);
      71             : 
      72             :   Node* const combined_encodings =
      73         168 :       Word32Or(lhs_encoding, Word32Shr(rhs_encoding, 1));
      74             : 
      75             :   // Then dispatch on the combined encoding.
      76             : 
      77         168 :   Label unreachable(this, Label::kDeferred);
      78             : 
      79             :   int32_t values[] = {
      80             :       kOneByteStringTag | (kOneByteStringTag >> 1),
      81             :       kOneByteStringTag | (kTwoByteStringTag >> 1),
      82             :       kTwoByteStringTag | (kOneByteStringTag >> 1),
      83             :       kTwoByteStringTag | (kTwoByteStringTag >> 1),
      84         168 :   };
      85             :   Label* labels[] = {
      86             :       if_one_one, if_one_two, if_two_one, if_two_two,
      87         168 :   };
      88             : 
      89             :   STATIC_ASSERT(arraysize(values) == arraysize(labels));
      90         168 :   Switch(combined_encodings, &unreachable, values, labels, arraysize(values));
      91             : 
      92         168 :   BIND(&unreachable);
      93         168 :   Unreachable();
      94         168 : }
      95             : 
      96             : template <typename SubjectChar, typename PatternChar>
      97         672 : Node* StringBuiltinsAssembler::CallSearchStringRaw(Node* const subject_ptr,
      98             :                                                    Node* const subject_length,
      99             :                                                    Node* const search_ptr,
     100             :                                                    Node* const search_length,
     101             :                                                    Node* const start_position) {
     102             :   Node* const function_addr = ExternalConstant(
     103         672 :       ExternalReference::search_string_raw<SubjectChar, PatternChar>());
     104             :   Node* const isolate_ptr =
     105         672 :       ExternalConstant(ExternalReference::isolate_address(isolate()));
     106             : 
     107         672 :   MachineType type_ptr = MachineType::Pointer();
     108         672 :   MachineType type_intptr = MachineType::IntPtr();
     109             : 
     110             :   Node* const result = CallCFunction6(
     111             :       type_intptr, type_ptr, type_ptr, type_intptr, type_ptr, type_intptr,
     112             :       type_intptr, function_addr, isolate_ptr, subject_ptr, subject_length,
     113         672 :       search_ptr, search_length, start_position);
     114             : 
     115         672 :   return result;
     116             : }
     117             : 
     118        1344 : Node* StringBuiltinsAssembler::PointerToStringDataAtIndex(
     119             :     Node* const string_data, Node* const index, String::Encoding encoding) {
     120             :   const ElementsKind kind = (encoding == String::ONE_BYTE_ENCODING)
     121             :                                 ? UINT8_ELEMENTS
     122        1344 :                                 : UINT16_ELEMENTS;
     123             :   Node* const offset_in_bytes =
     124        1344 :       ElementOffsetFromIndex(index, kind, INTPTR_PARAMETERS);
     125        1344 :   return IntPtrAdd(string_data, offset_in_bytes);
     126             : }
     127             : 
     128          56 : void StringBuiltinsAssembler::GenerateStringEqual(Node* context, Node* left,
     129             :                                                   Node* right) {
     130          56 :   VARIABLE(var_left, MachineRepresentation::kTagged, left);
     131         112 :   VARIABLE(var_right, MachineRepresentation::kTagged, right);
     132         112 :   Label if_equal(this), if_notequal(this), if_indirect(this, Label::kDeferred),
     133         112 :       restart(this, {&var_left, &var_right});
     134             : 
     135          56 :   TNode<IntPtrT> lhs_length = LoadStringLengthAsWord(left);
     136          56 :   TNode<IntPtrT> rhs_length = LoadStringLengthAsWord(right);
     137             : 
     138             :   // Strings with different lengths cannot be equal.
     139          56 :   GotoIf(WordNotEqual(lhs_length, rhs_length), &if_notequal);
     140             : 
     141          56 :   Goto(&restart);
     142          56 :   BIND(&restart);
     143          56 :   Node* lhs = var_left.value();
     144          56 :   Node* rhs = var_right.value();
     145             : 
     146          56 :   Node* lhs_instance_type = LoadInstanceType(lhs);
     147          56 :   Node* rhs_instance_type = LoadInstanceType(rhs);
     148             : 
     149             :   StringEqual_Core(context, lhs, lhs_instance_type, rhs, rhs_instance_type,
     150          56 :                    lhs_length, &if_equal, &if_notequal, &if_indirect);
     151             : 
     152          56 :   BIND(&if_indirect);
     153             :   {
     154             :     // Try to unwrap indirect strings, restart the above attempt on success.
     155             :     MaybeDerefIndirectStrings(&var_left, lhs_instance_type, &var_right,
     156          56 :                               rhs_instance_type, &restart);
     157             : 
     158          56 :     TailCallRuntime(Runtime::kStringEqual, context, lhs, rhs);
     159             :   }
     160             : 
     161          56 :   BIND(&if_equal);
     162          56 :   Return(TrueConstant());
     163             : 
     164          56 :   BIND(&if_notequal);
     165         112 :   Return(FalseConstant());
     166          56 : }
     167             : 
     168         168 : void StringBuiltinsAssembler::StringEqual_Core(
     169             :     Node* context, Node* lhs, Node* lhs_instance_type, Node* rhs,
     170             :     Node* rhs_instance_type, TNode<IntPtrT> length, Label* if_equal,
     171             :     Label* if_not_equal, Label* if_indirect) {
     172             :   CSA_ASSERT(this, IsString(lhs));
     173             :   CSA_ASSERT(this, IsString(rhs));
     174             :   CSA_ASSERT(this, WordEqual(LoadStringLengthAsWord(lhs), length));
     175             :   CSA_ASSERT(this, WordEqual(LoadStringLengthAsWord(rhs), length));
     176             :   // Fast check to see if {lhs} and {rhs} refer to the same String object.
     177         168 :   GotoIf(WordEqual(lhs, rhs), if_equal);
     178             : 
     179             :   // Combine the instance types into a single 16-bit value, so we can check
     180             :   // both of them at once.
     181             :   Node* both_instance_types = Word32Or(
     182         168 :       lhs_instance_type, Word32Shl(rhs_instance_type, Int32Constant(8)));
     183             : 
     184             :   // Check if both {lhs} and {rhs} are internalized. Since we already know
     185             :   // that they're not the same object, they're not equal in that case.
     186             :   int const kBothInternalizedMask =
     187         168 :       kIsNotInternalizedMask | (kIsNotInternalizedMask << 8);
     188         168 :   int const kBothInternalizedTag = kInternalizedTag | (kInternalizedTag << 8);
     189             :   GotoIf(Word32Equal(Word32And(both_instance_types,
     190         336 :                                Int32Constant(kBothInternalizedMask)),
     191         672 :                      Int32Constant(kBothInternalizedTag)),
     192         168 :          if_not_equal);
     193             : 
     194             :   // Check if both {lhs} and {rhs} are direct strings, and that in case of
     195             :   // ExternalStrings the data pointer is cached.
     196             :   STATIC_ASSERT(kUncachedExternalStringTag != 0);
     197             :   STATIC_ASSERT(kIsIndirectStringTag != 0);
     198             :   int const kBothDirectStringMask =
     199             :       kIsIndirectStringMask | kUncachedExternalStringMask |
     200         168 :       ((kIsIndirectStringMask | kUncachedExternalStringMask) << 8);
     201             :   GotoIfNot(Word32Equal(Word32And(both_instance_types,
     202         336 :                                   Int32Constant(kBothDirectStringMask)),
     203         672 :                         Int32Constant(0)),
     204         168 :             if_indirect);
     205             : 
     206             :   // Dispatch based on the {lhs} and {rhs} string encoding.
     207             :   int const kBothStringEncodingMask =
     208         168 :       kStringEncodingMask | (kStringEncodingMask << 8);
     209         168 :   int const kOneOneByteStringTag = kOneByteStringTag | (kOneByteStringTag << 8);
     210         168 :   int const kTwoTwoByteStringTag = kTwoByteStringTag | (kTwoByteStringTag << 8);
     211         168 :   int const kOneTwoByteStringTag = kOneByteStringTag | (kTwoByteStringTag << 8);
     212         336 :   Label if_oneonebytestring(this), if_twotwobytestring(this),
     213         336 :       if_onetwobytestring(this), if_twoonebytestring(this);
     214             :   Node* masked_instance_types =
     215         168 :       Word32And(both_instance_types, Int32Constant(kBothStringEncodingMask));
     216             :   GotoIf(
     217         336 :       Word32Equal(masked_instance_types, Int32Constant(kOneOneByteStringTag)),
     218         168 :       &if_oneonebytestring);
     219             :   GotoIf(
     220         336 :       Word32Equal(masked_instance_types, Int32Constant(kTwoTwoByteStringTag)),
     221         168 :       &if_twotwobytestring);
     222             :   Branch(
     223         336 :       Word32Equal(masked_instance_types, Int32Constant(kOneTwoByteStringTag)),
     224         168 :       &if_onetwobytestring, &if_twoonebytestring);
     225             : 
     226         168 :   BIND(&if_oneonebytestring);
     227             :   StringEqual_Loop(lhs, lhs_instance_type, MachineType::Uint8(), rhs,
     228             :                    rhs_instance_type, MachineType::Uint8(), length, if_equal,
     229         168 :                    if_not_equal);
     230             : 
     231         168 :   BIND(&if_twotwobytestring);
     232             :   StringEqual_Loop(lhs, lhs_instance_type, MachineType::Uint16(), rhs,
     233             :                    rhs_instance_type, MachineType::Uint16(), length, if_equal,
     234         168 :                    if_not_equal);
     235             : 
     236         168 :   BIND(&if_onetwobytestring);
     237             :   StringEqual_Loop(lhs, lhs_instance_type, MachineType::Uint8(), rhs,
     238             :                    rhs_instance_type, MachineType::Uint16(), length, if_equal,
     239         168 :                    if_not_equal);
     240             : 
     241         168 :   BIND(&if_twoonebytestring);
     242             :   StringEqual_Loop(lhs, lhs_instance_type, MachineType::Uint16(), rhs,
     243             :                    rhs_instance_type, MachineType::Uint8(), length, if_equal,
     244         336 :                    if_not_equal);
     245         168 : }
     246             : 
     247         672 : void StringBuiltinsAssembler::StringEqual_Loop(
     248             :     Node* lhs, Node* lhs_instance_type, MachineType lhs_type, Node* rhs,
     249             :     Node* rhs_instance_type, MachineType rhs_type, TNode<IntPtrT> length,
     250             :     Label* if_equal, Label* if_not_equal) {
     251             :   CSA_ASSERT(this, IsString(lhs));
     252             :   CSA_ASSERT(this, IsString(rhs));
     253             :   CSA_ASSERT(this, WordEqual(LoadStringLengthAsWord(lhs), length));
     254             :   CSA_ASSERT(this, WordEqual(LoadStringLengthAsWord(rhs), length));
     255             : 
     256             :   // Compute the effective offset of the first character.
     257         672 :   Node* lhs_data = DirectStringData(lhs, lhs_instance_type);
     258         672 :   Node* rhs_data = DirectStringData(rhs, rhs_instance_type);
     259             : 
     260             :   // Loop over the {lhs} and {rhs} strings to see if they are equal.
     261         672 :   TVARIABLE(IntPtrT, var_offset, IntPtrConstant(0));
     262        1344 :   Label loop(this, &var_offset);
     263         672 :   Goto(&loop);
     264         672 :   BIND(&loop);
     265             :   {
     266             :     // If {offset} equals {end}, no difference was found, so the
     267             :     // strings are equal.
     268         672 :     GotoIf(WordEqual(var_offset.value(), length), if_equal);
     269             : 
     270             :     // Load the next characters from {lhs} and {rhs}.
     271             :     Node* lhs_value =
     272             :         Load(lhs_type, lhs_data,
     273             :              WordShl(var_offset.value(),
     274         672 :                      ElementSizeLog2Of(lhs_type.representation())));
     275             :     Node* rhs_value =
     276             :         Load(rhs_type, rhs_data,
     277             :              WordShl(var_offset.value(),
     278         672 :                      ElementSizeLog2Of(rhs_type.representation())));
     279             : 
     280             :     // Check if the characters match.
     281         672 :     GotoIf(Word32NotEqual(lhs_value, rhs_value), if_not_equal);
     282             : 
     283             :     // Advance to next character.
     284         672 :     var_offset = IntPtrAdd(var_offset.value(), IntPtrConstant(1));
     285         672 :     Goto(&loop);
     286         672 :   }
     287         672 : }
     288             : 
     289         392 : TF_BUILTIN(StringAdd_CheckNone, StringBuiltinsAssembler) {
     290          56 :   TNode<String> left = CAST(Parameter(Descriptor::kLeft));
     291          56 :   TNode<String> right = CAST(Parameter(Descriptor::kRight));
     292          56 :   Node* context = Parameter(Descriptor::kContext);
     293          56 :   Return(StringAdd(context, left, right));
     294          56 : }
     295             : 
     296         392 : TF_BUILTIN(StringAdd_ConvertLeft, StringBuiltinsAssembler) {
     297          56 :   TNode<Object> left = CAST(Parameter(Descriptor::kLeft));
     298          56 :   TNode<String> right = CAST(Parameter(Descriptor::kRight));
     299          56 :   Node* context = Parameter(Descriptor::kContext);
     300             :   // TODO(danno): The ToString and JSReceiverToPrimitive below could be
     301             :   // combined to avoid duplicate smi and instance type checks.
     302          56 :   left = ToString(context, JSReceiverToPrimitive(context, left));
     303          56 :   TailCallBuiltin(Builtins::kStringAdd_CheckNone, context, left, right);
     304          56 : }
     305             : 
     306         392 : TF_BUILTIN(StringAdd_ConvertRight, StringBuiltinsAssembler) {
     307          56 :   TNode<String> left = CAST(Parameter(Descriptor::kLeft));
     308          56 :   TNode<Object> right = CAST(Parameter(Descriptor::kRight));
     309          56 :   Node* context = Parameter(Descriptor::kContext);
     310             :   // TODO(danno): The ToString and JSReceiverToPrimitive below could be
     311             :   // combined to avoid duplicate smi and instance type checks.
     312          56 :   right = ToString(context, JSReceiverToPrimitive(context, right));
     313          56 :   TailCallBuiltin(Builtins::kStringAdd_CheckNone, context, left, right);
     314          56 : }
     315             : 
     316         392 : TF_BUILTIN(SubString, StringBuiltinsAssembler) {
     317          56 :   TNode<String> string = CAST(Parameter(Descriptor::kString));
     318          56 :   TNode<Smi> from = CAST(Parameter(Descriptor::kFrom));
     319          56 :   TNode<Smi> to = CAST(Parameter(Descriptor::kTo));
     320          56 :   Return(SubString(string, SmiUntag(from), SmiUntag(to)));
     321          56 : }
     322             : 
     323         168 : void StringBuiltinsAssembler::GenerateStringAt(
     324             :     char const* method_name, TNode<Context> context, Node* receiver,
     325             :     TNode<Object> maybe_position, TNode<Object> default_return,
     326             :     const StringAtAccessor& accessor) {
     327             :   // Check that {receiver} is coercible to Object and convert it to a String.
     328         168 :   TNode<String> string = ToThisString(context, receiver, method_name);
     329             : 
     330             :   // Convert the {position} to a Smi and check that it's in bounds of the
     331             :   // {string}.
     332         168 :   Label if_outofbounds(this, Label::kDeferred);
     333             :   TNode<Number> position = ToInteger_Inline(
     334         168 :       context, maybe_position, CodeStubAssembler::kTruncateMinusZero);
     335         168 :   GotoIfNot(TaggedIsSmi(position), &if_outofbounds);
     336         168 :   TNode<IntPtrT> index = SmiUntag(CAST(position));
     337         168 :   TNode<IntPtrT> length = LoadStringLengthAsWord(string);
     338         168 :   GotoIfNot(UintPtrLessThan(index, length), &if_outofbounds);
     339         168 :   TNode<Object> result = accessor(string, length, index);
     340         168 :   Return(result);
     341             : 
     342         168 :   BIND(&if_outofbounds);
     343         168 :   Return(default_return);
     344         168 : }
     345             : 
     346         224 : void StringBuiltinsAssembler::GenerateStringRelationalComparison(Node* context,
     347             :                                                                  Node* left,
     348             :                                                                  Node* right,
     349             :                                                                  Operation op) {
     350         224 :   VARIABLE(var_left, MachineRepresentation::kTagged, left);
     351         448 :   VARIABLE(var_right, MachineRepresentation::kTagged, right);
     352             : 
     353         224 :   Variable* input_vars[2] = {&var_left, &var_right};
     354         448 :   Label if_less(this), if_equal(this), if_greater(this);
     355         448 :   Label restart(this, 2, input_vars);
     356         224 :   Goto(&restart);
     357         224 :   BIND(&restart);
     358             : 
     359         224 :   Node* lhs = var_left.value();
     360         224 :   Node* rhs = var_right.value();
     361             :   // Fast check to see if {lhs} and {rhs} refer to the same String object.
     362         224 :   GotoIf(WordEqual(lhs, rhs), &if_equal);
     363             : 
     364             :   // Load instance types of {lhs} and {rhs}.
     365         224 :   Node* lhs_instance_type = LoadInstanceType(lhs);
     366         224 :   Node* rhs_instance_type = LoadInstanceType(rhs);
     367             : 
     368             :   // Combine the instance types into a single 16-bit value, so we can check
     369             :   // both of them at once.
     370             :   Node* both_instance_types = Word32Or(
     371         224 :       lhs_instance_type, Word32Shl(rhs_instance_type, Int32Constant(8)));
     372             : 
     373             :   // Check that both {lhs} and {rhs} are flat one-byte strings.
     374             :   int const kBothSeqOneByteStringMask =
     375             :       kStringEncodingMask | kStringRepresentationMask |
     376         224 :       ((kStringEncodingMask | kStringRepresentationMask) << 8);
     377             :   int const kBothSeqOneByteStringTag =
     378             :       kOneByteStringTag | kSeqStringTag |
     379         224 :       ((kOneByteStringTag | kSeqStringTag) << 8);
     380         448 :   Label if_bothonebyteseqstrings(this), if_notbothonebyteseqstrings(this);
     381             :   Branch(Word32Equal(Word32And(both_instance_types,
     382         448 :                                Int32Constant(kBothSeqOneByteStringMask)),
     383         896 :                      Int32Constant(kBothSeqOneByteStringTag)),
     384         224 :          &if_bothonebyteseqstrings, &if_notbothonebyteseqstrings);
     385             : 
     386         224 :   BIND(&if_bothonebyteseqstrings);
     387             :   {
     388             :     // Load the length of {lhs} and {rhs}.
     389         224 :     TNode<IntPtrT> lhs_length = LoadStringLengthAsWord(lhs);
     390         224 :     TNode<IntPtrT> rhs_length = LoadStringLengthAsWord(rhs);
     391             : 
     392             :     // Determine the minimum length.
     393         224 :     TNode<IntPtrT> length = IntPtrMin(lhs_length, rhs_length);
     394             : 
     395             :     // Compute the effective offset of the first character.
     396             :     TNode<IntPtrT> begin =
     397         224 :         IntPtrConstant(SeqOneByteString::kHeaderSize - kHeapObjectTag);
     398             : 
     399             :     // Compute the first offset after the string from the length.
     400         224 :     TNode<IntPtrT> end = IntPtrAdd(begin, length);
     401             : 
     402             :     // Loop over the {lhs} and {rhs} strings to see if they are equal.
     403         224 :     TVARIABLE(IntPtrT, var_offset, begin);
     404         448 :     Label loop(this, &var_offset);
     405         224 :     Goto(&loop);
     406         224 :     BIND(&loop);
     407             :     {
     408             :       // Check if {offset} equals {end}.
     409         448 :       Label if_done(this), if_notdone(this);
     410         224 :       Branch(WordEqual(var_offset.value(), end), &if_done, &if_notdone);
     411             : 
     412         224 :       BIND(&if_notdone);
     413             :       {
     414             :         // Load the next characters from {lhs} and {rhs}.
     415         224 :         Node* lhs_value = Load(MachineType::Uint8(), lhs, var_offset.value());
     416         224 :         Node* rhs_value = Load(MachineType::Uint8(), rhs, var_offset.value());
     417             : 
     418             :         // Check if the characters match.
     419         448 :         Label if_valueissame(this), if_valueisnotsame(this);
     420         448 :         Branch(Word32Equal(lhs_value, rhs_value), &if_valueissame,
     421         224 :                &if_valueisnotsame);
     422             : 
     423         224 :         BIND(&if_valueissame);
     424             :         {
     425             :           // Advance to next character.
     426         224 :           var_offset = IntPtrAdd(var_offset.value(), IntPtrConstant(1));
     427             :         }
     428         224 :         Goto(&loop);
     429             : 
     430         224 :         BIND(&if_valueisnotsame);
     431         448 :         Branch(Uint32LessThan(lhs_value, rhs_value), &if_less, &if_greater);
     432             :       }
     433             : 
     434         224 :       BIND(&if_done);
     435             :       {
     436             :         // All characters up to the min length are equal, decide based on
     437             :         // string length.
     438         224 :         GotoIf(IntPtrEqual(lhs_length, rhs_length), &if_equal);
     439         224 :         Branch(IntPtrLessThan(lhs_length, rhs_length), &if_less, &if_greater);
     440         224 :       }
     441         224 :     }
     442             :   }
     443             : 
     444         224 :   BIND(&if_notbothonebyteseqstrings);
     445             :   {
     446             :     // Try to unwrap indirect strings, restart the above attempt on success.
     447             :     MaybeDerefIndirectStrings(&var_left, lhs_instance_type, &var_right,
     448         224 :                               rhs_instance_type, &restart);
     449             :     // TODO(bmeurer): Add support for two byte string relational comparisons.
     450         224 :     switch (op) {
     451             :       case Operation::kLessThan:
     452          56 :         TailCallRuntime(Runtime::kStringLessThan, context, lhs, rhs);
     453          56 :         break;
     454             :       case Operation::kLessThanOrEqual:
     455          56 :         TailCallRuntime(Runtime::kStringLessThanOrEqual, context, lhs, rhs);
     456          56 :         break;
     457             :       case Operation::kGreaterThan:
     458          56 :         TailCallRuntime(Runtime::kStringGreaterThan, context, lhs, rhs);
     459          56 :         break;
     460             :       case Operation::kGreaterThanOrEqual:
     461          56 :         TailCallRuntime(Runtime::kStringGreaterThanOrEqual, context, lhs, rhs);
     462          56 :         break;
     463             :       default:
     464           0 :         UNREACHABLE();
     465             :     }
     466             :   }
     467             : 
     468         224 :   BIND(&if_less);
     469         224 :   switch (op) {
     470             :     case Operation::kLessThan:
     471             :     case Operation::kLessThanOrEqual:
     472         112 :       Return(TrueConstant());
     473         112 :       break;
     474             : 
     475             :     case Operation::kGreaterThan:
     476             :     case Operation::kGreaterThanOrEqual:
     477         112 :       Return(FalseConstant());
     478         112 :       break;
     479             :     default:
     480           0 :       UNREACHABLE();
     481             :   }
     482             : 
     483         224 :   BIND(&if_equal);
     484         224 :   switch (op) {
     485             :     case Operation::kLessThan:
     486             :     case Operation::kGreaterThan:
     487         112 :       Return(FalseConstant());
     488         112 :       break;
     489             : 
     490             :     case Operation::kLessThanOrEqual:
     491             :     case Operation::kGreaterThanOrEqual:
     492         112 :       Return(TrueConstant());
     493         112 :       break;
     494             :     default:
     495           0 :       UNREACHABLE();
     496             :   }
     497             : 
     498         224 :   BIND(&if_greater);
     499         224 :   switch (op) {
     500             :     case Operation::kLessThan:
     501             :     case Operation::kLessThanOrEqual:
     502         112 :       Return(FalseConstant());
     503         112 :       break;
     504             : 
     505             :     case Operation::kGreaterThan:
     506             :     case Operation::kGreaterThanOrEqual:
     507         112 :       Return(TrueConstant());
     508         112 :       break;
     509             :     default:
     510           0 :       UNREACHABLE();
     511         224 :   }
     512         224 : }
     513             : 
     514         392 : TF_BUILTIN(StringEqual, StringBuiltinsAssembler) {
     515          56 :   Node* context = Parameter(Descriptor::kContext);
     516          56 :   Node* left = Parameter(Descriptor::kLeft);
     517          56 :   Node* right = Parameter(Descriptor::kRight);
     518          56 :   GenerateStringEqual(context, left, right);
     519          56 : }
     520             : 
     521         392 : TF_BUILTIN(StringLessThan, StringBuiltinsAssembler) {
     522          56 :   Node* context = Parameter(Descriptor::kContext);
     523          56 :   Node* left = Parameter(Descriptor::kLeft);
     524          56 :   Node* right = Parameter(Descriptor::kRight);
     525             :   GenerateStringRelationalComparison(context, left, right,
     526          56 :                                      Operation::kLessThan);
     527          56 : }
     528             : 
     529         392 : TF_BUILTIN(StringLessThanOrEqual, StringBuiltinsAssembler) {
     530          56 :   Node* context = Parameter(Descriptor::kContext);
     531          56 :   Node* left = Parameter(Descriptor::kLeft);
     532          56 :   Node* right = Parameter(Descriptor::kRight);
     533             :   GenerateStringRelationalComparison(context, left, right,
     534          56 :                                      Operation::kLessThanOrEqual);
     535          56 : }
     536             : 
     537         392 : TF_BUILTIN(StringGreaterThan, StringBuiltinsAssembler) {
     538          56 :   Node* context = Parameter(Descriptor::kContext);
     539          56 :   Node* left = Parameter(Descriptor::kLeft);
     540          56 :   Node* right = Parameter(Descriptor::kRight);
     541             :   GenerateStringRelationalComparison(context, left, right,
     542          56 :                                      Operation::kGreaterThan);
     543          56 : }
     544             : 
     545         392 : TF_BUILTIN(StringGreaterThanOrEqual, StringBuiltinsAssembler) {
     546          56 :   Node* context = Parameter(Descriptor::kContext);
     547          56 :   Node* left = Parameter(Descriptor::kLeft);
     548          56 :   Node* right = Parameter(Descriptor::kRight);
     549             :   GenerateStringRelationalComparison(context, left, right,
     550          56 :                                      Operation::kGreaterThanOrEqual);
     551          56 : }
     552             : 
     553         336 : TF_BUILTIN(StringCharAt, StringBuiltinsAssembler) {
     554          56 :   TNode<String> receiver = CAST(Parameter(Descriptor::kReceiver));
     555             :   TNode<IntPtrT> position =
     556          56 :       UncheckedCast<IntPtrT>(Parameter(Descriptor::kPosition));
     557             : 
     558             :   // Load the character code at the {position} from the {receiver}.
     559          56 :   TNode<Int32T> code = StringCharCodeAt(receiver, position);
     560             : 
     561             :   // And return the single character string with only that {code}
     562          56 :   TNode<String> result = StringFromSingleCharCode(code);
     563          56 :   Return(result);
     564          56 : }
     565             : 
     566         336 : TF_BUILTIN(StringCodePointAtUTF16, StringBuiltinsAssembler) {
     567          56 :   Node* receiver = Parameter(Descriptor::kReceiver);
     568          56 :   Node* position = Parameter(Descriptor::kPosition);
     569             :   // TODO(sigurds) Figure out if passing length as argument pays off.
     570          56 :   TNode<IntPtrT> length = LoadStringLengthAsWord(receiver);
     571             :   // Load the character code at the {position} from the {receiver}.
     572             :   TNode<Int32T> code =
     573          56 :       LoadSurrogatePairAt(receiver, length, position, UnicodeEncoding::UTF16);
     574             :   // And return it as TaggedSigned value.
     575             :   // TODO(turbofan): Allow builtins to return values untagged.
     576          56 :   TNode<Smi> result = SmiFromInt32(code);
     577          56 :   Return(result);
     578          56 : }
     579             : 
     580         336 : TF_BUILTIN(StringCodePointAtUTF32, StringBuiltinsAssembler) {
     581          56 :   Node* receiver = Parameter(Descriptor::kReceiver);
     582          56 :   Node* position = Parameter(Descriptor::kPosition);
     583             : 
     584             :   // TODO(sigurds) Figure out if passing length as argument pays off.
     585          56 :   TNode<IntPtrT> length = LoadStringLengthAsWord(receiver);
     586             :   // Load the character code at the {position} from the {receiver}.
     587             :   TNode<Int32T> code =
     588          56 :       LoadSurrogatePairAt(receiver, length, position, UnicodeEncoding::UTF32);
     589             :   // And return it as TaggedSigned value.
     590             :   // TODO(turbofan): Allow builtins to return values untagged.
     591          56 :   TNode<Smi> result = SmiFromInt32(code);
     592          56 :   Return(result);
     593          56 : }
     594             : 
     595             : // -----------------------------------------------------------------------------
     596             : // ES6 section 21.1 String Objects
     597             : 
     598             : // ES6 #sec-string.fromcharcode
     599         336 : TF_BUILTIN(StringFromCharCode, CodeStubAssembler) {
     600             :   // TODO(ishell): use constants from Descriptor once the JSFunction linkage
     601             :   // arguments are reordered.
     602             :   TNode<Int32T> argc =
     603          56 :       UncheckedCast<Int32T>(Parameter(Descriptor::kJSActualArgumentsCount));
     604          56 :   Node* context = Parameter(Descriptor::kContext);
     605             : 
     606          56 :   CodeStubArguments arguments(this, ChangeInt32ToIntPtr(argc));
     607             :   // Check if we have exactly one argument (plus the implicit receiver), i.e.
     608             :   // if the parent frame is not an arguments adaptor frame.
     609         112 :   Label if_oneargument(this), if_notoneargument(this);
     610         112 :   Branch(Word32Equal(argc, Int32Constant(1)), &if_oneargument,
     611          56 :          &if_notoneargument);
     612             : 
     613          56 :   BIND(&if_oneargument);
     614             :   {
     615             :     // Single argument case, perform fast single character string cache lookup
     616             :     // for one-byte code units, or fall back to creating a single character
     617             :     // string on the fly otherwise.
     618          56 :     Node* code = arguments.AtIndex(0);
     619          56 :     Node* code32 = TruncateTaggedToWord32(context, code);
     620             :     TNode<Int32T> code16 =
     621          56 :         Signed(Word32And(code32, Int32Constant(String::kMaxUtf16CodeUnit)));
     622          56 :     Node* result = StringFromSingleCharCode(code16);
     623          56 :     arguments.PopAndReturn(result);
     624             :   }
     625             : 
     626          56 :   Node* code16 = nullptr;
     627          56 :   BIND(&if_notoneargument);
     628             :   {
     629          56 :     Label two_byte(this);
     630             :     // Assume that the resulting string contains only one-byte characters.
     631          56 :     Node* one_byte_result = AllocateSeqOneByteString(context, Unsigned(argc));
     632             : 
     633         112 :     TVARIABLE(IntPtrT, var_max_index);
     634          56 :     var_max_index = IntPtrConstant(0);
     635             : 
     636             :     // Iterate over the incoming arguments, converting them to 8-bit character
     637             :     // codes. Stop if any of the conversions generates a code that doesn't fit
     638             :     // in 8 bits.
     639         112 :     CodeStubAssembler::VariableList vars({&var_max_index}, zone());
     640             :     arguments.ForEach(vars, [this, context, &two_byte, &var_max_index, &code16,
     641          56 :                              one_byte_result](Node* arg) {
     642          56 :       Node* code32 = TruncateTaggedToWord32(context, arg);
     643          56 :       code16 = Word32And(code32, Int32Constant(String::kMaxUtf16CodeUnit));
     644             : 
     645             :       GotoIf(
     646         112 :           Int32GreaterThan(code16, Int32Constant(String::kMaxOneByteCharCode)),
     647         112 :           &two_byte);
     648             : 
     649             :       // The {code16} fits into the SeqOneByteString {one_byte_result}.
     650             :       Node* offset = ElementOffsetFromIndex(
     651          56 :           var_max_index.value(), UINT8_ELEMENTS,
     652             :           CodeStubAssembler::INTPTR_PARAMETERS,
     653          56 :           SeqOneByteString::kHeaderSize - kHeapObjectTag);
     654             :       StoreNoWriteBarrier(MachineRepresentation::kWord8, one_byte_result,
     655          56 :                           offset, code16);
     656          56 :       var_max_index = IntPtrAdd(var_max_index.value(), IntPtrConstant(1));
     657         112 :     });
     658          56 :     arguments.PopAndReturn(one_byte_result);
     659             : 
     660          56 :     BIND(&two_byte);
     661             : 
     662             :     // At least one of the characters in the string requires a 16-bit
     663             :     // representation.  Allocate a SeqTwoByteString to hold the resulting
     664             :     // string.
     665          56 :     Node* two_byte_result = AllocateSeqTwoByteString(context, Unsigned(argc));
     666             : 
     667             :     // Copy the characters that have already been put in the 8-bit string into
     668             :     // their corresponding positions in the new 16-bit string.
     669          56 :     TNode<IntPtrT> zero = IntPtrConstant(0);
     670             :     CopyStringCharacters(one_byte_result, two_byte_result, zero, zero,
     671             :                          var_max_index.value(), String::ONE_BYTE_ENCODING,
     672          56 :                          String::TWO_BYTE_ENCODING);
     673             : 
     674             :     // Write the character that caused the 8-bit to 16-bit fault.
     675             :     Node* max_index_offset =
     676             :         ElementOffsetFromIndex(var_max_index.value(), UINT16_ELEMENTS,
     677             :                                CodeStubAssembler::INTPTR_PARAMETERS,
     678          56 :                                SeqTwoByteString::kHeaderSize - kHeapObjectTag);
     679             :     StoreNoWriteBarrier(MachineRepresentation::kWord16, two_byte_result,
     680          56 :                         max_index_offset, code16);
     681          56 :     var_max_index = IntPtrAdd(var_max_index.value(), IntPtrConstant(1));
     682             : 
     683             :     // Resume copying the passed-in arguments from the same place where the
     684             :     // 8-bit copy stopped, but this time copying over all of the characters
     685             :     // using a 16-bit representation.
     686             :     arguments.ForEach(
     687             :         vars,
     688          56 :         [this, context, two_byte_result, &var_max_index](Node* arg) {
     689          56 :           Node* code32 = TruncateTaggedToWord32(context, arg);
     690             :           Node* code16 =
     691          56 :               Word32And(code32, Int32Constant(String::kMaxUtf16CodeUnit));
     692             : 
     693             :           Node* offset = ElementOffsetFromIndex(
     694          56 :               var_max_index.value(), UINT16_ELEMENTS,
     695             :               CodeStubAssembler::INTPTR_PARAMETERS,
     696          56 :               SeqTwoByteString::kHeaderSize - kHeapObjectTag);
     697             :           StoreNoWriteBarrier(MachineRepresentation::kWord16, two_byte_result,
     698          56 :                               offset, code16);
     699          56 :           var_max_index = IntPtrAdd(var_max_index.value(), IntPtrConstant(1));
     700          56 :         },
     701          56 :         var_max_index.value());
     702             : 
     703         112 :     arguments.PopAndReturn(two_byte_result);
     704          56 :   }
     705          56 : }
     706             : 
     707             : // ES6 #sec-string.prototype.charat
     708         392 : TF_BUILTIN(StringPrototypeCharAt, StringBuiltinsAssembler) {
     709          56 :   TNode<Context> context = CAST(Parameter(Descriptor::kContext));
     710          56 :   Node* receiver = Parameter(Descriptor::kReceiver);
     711          56 :   TNode<Object> maybe_position = CAST(Parameter(Descriptor::kPosition));
     712             : 
     713             :   GenerateStringAt("String.prototype.charAt", context, receiver, maybe_position,
     714          56 :                    EmptyStringConstant(),
     715             :                    [this](TNode<String> string, TNode<IntPtrT> length,
     716          56 :                           TNode<IntPtrT> index) {
     717          56 :                      TNode<Int32T> code = StringCharCodeAt(string, index);
     718          56 :                      return StringFromSingleCharCode(code);
     719         112 :                    });
     720          56 : }
     721             : 
     722             : // ES6 #sec-string.prototype.charcodeat
     723         392 : TF_BUILTIN(StringPrototypeCharCodeAt, StringBuiltinsAssembler) {
     724          56 :   TNode<Context> context = CAST(Parameter(Descriptor::kContext));
     725          56 :   Node* receiver = Parameter(Descriptor::kReceiver);
     726          56 :   TNode<Object> maybe_position = CAST(Parameter(Descriptor::kPosition));
     727             : 
     728             :   GenerateStringAt("String.prototype.charCodeAt", context, receiver,
     729          56 :                    maybe_position, NanConstant(),
     730             :                    [this](TNode<String> receiver, TNode<IntPtrT> length,
     731          56 :                           TNode<IntPtrT> index) {
     732          56 :                      Node* value = StringCharCodeAt(receiver, index);
     733          56 :                      return SmiFromInt32(value);
     734         112 :                    });
     735          56 : }
     736             : 
     737             : // ES6 #sec-string.prototype.codepointat
     738         392 : TF_BUILTIN(StringPrototypeCodePointAt, StringBuiltinsAssembler) {
     739          56 :   TNode<Context> context = CAST(Parameter(Descriptor::kContext));
     740          56 :   Node* receiver = Parameter(Descriptor::kReceiver);
     741          56 :   TNode<Object> maybe_position = CAST(Parameter(Descriptor::kPosition));
     742             : 
     743             :   GenerateStringAt("String.prototype.codePointAt", context, receiver,
     744          56 :                    maybe_position, UndefinedConstant(),
     745             :                    [this](TNode<String> receiver, TNode<IntPtrT> length,
     746          56 :                           TNode<IntPtrT> index) {
     747             :                      // This is always a call to a builtin from Javascript,
     748             :                      // so we need to produce UTF32.
     749             :                      Node* value = LoadSurrogatePairAt(receiver, length, index,
     750          56 :                                                        UnicodeEncoding::UTF32);
     751          56 :                      return SmiFromInt32(value);
     752         112 :                    });
     753          56 : }
     754             : 
     755             : // ES6 String.prototype.concat(...args)
     756             : // ES6 #sec-string.prototype.concat
     757         336 : TF_BUILTIN(StringPrototypeConcat, CodeStubAssembler) {
     758             :   // TODO(ishell): use constants from Descriptor once the JSFunction linkage
     759             :   // arguments are reordered.
     760             :   CodeStubArguments arguments(
     761             :       this,
     762          56 :       ChangeInt32ToIntPtr(Parameter(Descriptor::kJSActualArgumentsCount)));
     763          56 :   Node* receiver = arguments.GetReceiver();
     764          56 :   Node* context = Parameter(Descriptor::kContext);
     765             : 
     766             :   // Check that {receiver} is coercible to Object and convert it to a String.
     767          56 :   receiver = ToThisString(context, receiver, "String.prototype.concat");
     768             : 
     769             :   // Concatenate all the arguments passed to this builtin.
     770          56 :   VARIABLE(var_result, MachineRepresentation::kTagged);
     771          56 :   var_result.Bind(receiver);
     772             :   arguments.ForEach(
     773             :       CodeStubAssembler::VariableList({&var_result}, zone()),
     774          56 :       [this, context, &var_result](Node* arg) {
     775          56 :         arg = ToString_Inline(context, arg);
     776             :         var_result.Bind(CallStub(CodeFactory::StringAdd(isolate()), context,
     777          56 :                                  var_result.value(), arg));
     778         112 :       });
     779          56 :   arguments.PopAndReturn(var_result.value());
     780          56 : }
     781             : 
     782         168 : void StringBuiltinsAssembler::StringIndexOf(
     783             :     Node* const subject_string, Node* const search_string, Node* const position,
     784             :     const std::function<void(Node*)>& f_return) {
     785             :   CSA_ASSERT(this, IsString(subject_string));
     786             :   CSA_ASSERT(this, IsString(search_string));
     787             :   CSA_ASSERT(this, TaggedIsSmi(position));
     788             : 
     789         168 :   TNode<IntPtrT> const int_zero = IntPtrConstant(0);
     790         168 :   TNode<IntPtrT> const search_length = LoadStringLengthAsWord(search_string);
     791         168 :   TNode<IntPtrT> const subject_length = LoadStringLengthAsWord(subject_string);
     792         168 :   TNode<IntPtrT> const start_position = IntPtrMax(SmiUntag(position), int_zero);
     793             : 
     794         336 :   Label zero_length_needle(this), return_minus_1(this);
     795             :   {
     796         168 :     GotoIf(IntPtrEqual(int_zero, search_length), &zero_length_needle);
     797             : 
     798             :     // Check that the needle fits in the start position.
     799             :     GotoIfNot(IntPtrLessThanOrEqual(search_length,
     800         336 :                                     IntPtrSub(subject_length, start_position)),
     801         168 :               &return_minus_1);
     802             :   }
     803             : 
     804             :   // If the string pointers are identical, we can just return 0. Note that this
     805             :   // implies {start_position} == 0 since we've passed the check above.
     806         336 :   Label return_zero(this);
     807         168 :   GotoIf(WordEqual(subject_string, search_string), &return_zero);
     808             : 
     809             :   // Try to unpack subject and search strings. Bail to runtime if either needs
     810             :   // to be flattened.
     811         336 :   ToDirectStringAssembler subject_to_direct(state(), subject_string);
     812         336 :   ToDirectStringAssembler search_to_direct(state(), search_string);
     813             : 
     814         336 :   Label call_runtime_unchecked(this, Label::kDeferred);
     815             : 
     816         168 :   subject_to_direct.TryToDirect(&call_runtime_unchecked);
     817         168 :   search_to_direct.TryToDirect(&call_runtime_unchecked);
     818             : 
     819             :   // Load pointers to string data.
     820             :   Node* const subject_ptr =
     821         168 :       subject_to_direct.PointerToData(&call_runtime_unchecked);
     822             :   Node* const search_ptr =
     823         168 :       search_to_direct.PointerToData(&call_runtime_unchecked);
     824             : 
     825         168 :   Node* const subject_offset = subject_to_direct.offset();
     826         168 :   Node* const search_offset = search_to_direct.offset();
     827             : 
     828             :   // Like String::IndexOf, the actual matching is done by the optimized
     829             :   // SearchString method in string-search.h. Dispatch based on string instance
     830             :   // types, then call straight into C++ for matching.
     831             : 
     832             :   CSA_ASSERT(this, IntPtrGreaterThan(search_length, int_zero));
     833             :   CSA_ASSERT(this, IntPtrGreaterThanOrEqual(start_position, int_zero));
     834             :   CSA_ASSERT(this, IntPtrGreaterThanOrEqual(subject_length, start_position));
     835             :   CSA_ASSERT(this,
     836             :              IntPtrLessThanOrEqual(search_length,
     837             :                                    IntPtrSub(subject_length, start_position)));
     838             : 
     839         336 :   Label one_one(this), one_two(this), two_one(this), two_two(this);
     840             :   DispatchOnStringEncodings(subject_to_direct.instance_type(),
     841             :                             search_to_direct.instance_type(), &one_one,
     842         168 :                             &one_two, &two_one, &two_two);
     843             : 
     844             :   typedef const uint8_t onebyte_t;
     845             :   typedef const uc16 twobyte_t;
     846             : 
     847         168 :   BIND(&one_one);
     848             :   {
     849             :     Node* const adjusted_subject_ptr = PointerToStringDataAtIndex(
     850         168 :         subject_ptr, subject_offset, String::ONE_BYTE_ENCODING);
     851             :     Node* const adjusted_search_ptr = PointerToStringDataAtIndex(
     852         168 :         search_ptr, search_offset, String::ONE_BYTE_ENCODING);
     853             : 
     854         336 :     Label direct_memchr_call(this), generic_fast_path(this);
     855         336 :     Branch(IntPtrEqual(search_length, IntPtrConstant(1)), &direct_memchr_call,
     856         168 :            &generic_fast_path);
     857             : 
     858             :     // An additional fast path that calls directly into memchr for 1-length
     859             :     // search strings.
     860         168 :     BIND(&direct_memchr_call);
     861             :     {
     862         168 :       Node* const string_addr = IntPtrAdd(adjusted_subject_ptr, start_position);
     863         168 :       Node* const search_length = IntPtrSub(subject_length, start_position);
     864             :       Node* const search_byte =
     865         168 :           ChangeInt32ToIntPtr(Load(MachineType::Uint8(), adjusted_search_ptr));
     866             : 
     867             :       Node* const memchr =
     868         168 :           ExternalConstant(ExternalReference::libc_memchr_function());
     869             :       Node* const result_address =
     870             :           CallCFunction3(MachineType::Pointer(), MachineType::Pointer(),
     871             :                          MachineType::IntPtr(), MachineType::UintPtr(), memchr,
     872         168 :                          string_addr, search_byte, search_length);
     873         168 :       GotoIf(WordEqual(result_address, int_zero), &return_minus_1);
     874             :       Node* const result_index =
     875         168 :           IntPtrAdd(IntPtrSub(result_address, string_addr), start_position);
     876         168 :       f_return(SmiTag(result_index));
     877             :     }
     878             : 
     879         168 :     BIND(&generic_fast_path);
     880             :     {
     881             :       Node* const result = CallSearchStringRaw<onebyte_t, onebyte_t>(
     882             :           adjusted_subject_ptr, subject_length, adjusted_search_ptr,
     883         168 :           search_length, start_position);
     884         168 :       f_return(SmiTag(result));
     885         168 :     }
     886             :   }
     887             : 
     888         168 :   BIND(&one_two);
     889             :   {
     890             :     Node* const adjusted_subject_ptr = PointerToStringDataAtIndex(
     891         168 :         subject_ptr, subject_offset, String::ONE_BYTE_ENCODING);
     892             :     Node* const adjusted_search_ptr = PointerToStringDataAtIndex(
     893         168 :         search_ptr, search_offset, String::TWO_BYTE_ENCODING);
     894             : 
     895             :     Node* const result = CallSearchStringRaw<onebyte_t, twobyte_t>(
     896             :         adjusted_subject_ptr, subject_length, adjusted_search_ptr,
     897         168 :         search_length, start_position);
     898         168 :     f_return(SmiTag(result));
     899             :   }
     900             : 
     901         168 :   BIND(&two_one);
     902             :   {
     903             :     Node* const adjusted_subject_ptr = PointerToStringDataAtIndex(
     904         168 :         subject_ptr, subject_offset, String::TWO_BYTE_ENCODING);
     905             :     Node* const adjusted_search_ptr = PointerToStringDataAtIndex(
     906         168 :         search_ptr, search_offset, String::ONE_BYTE_ENCODING);
     907             : 
     908             :     Node* const result = CallSearchStringRaw<twobyte_t, onebyte_t>(
     909             :         adjusted_subject_ptr, subject_length, adjusted_search_ptr,
     910         168 :         search_length, start_position);
     911         168 :     f_return(SmiTag(result));
     912             :   }
     913             : 
     914         168 :   BIND(&two_two);
     915             :   {
     916             :     Node* const adjusted_subject_ptr = PointerToStringDataAtIndex(
     917         168 :         subject_ptr, subject_offset, String::TWO_BYTE_ENCODING);
     918             :     Node* const adjusted_search_ptr = PointerToStringDataAtIndex(
     919         168 :         search_ptr, search_offset, String::TWO_BYTE_ENCODING);
     920             : 
     921             :     Node* const result = CallSearchStringRaw<twobyte_t, twobyte_t>(
     922             :         adjusted_subject_ptr, subject_length, adjusted_search_ptr,
     923         168 :         search_length, start_position);
     924         168 :     f_return(SmiTag(result));
     925             :   }
     926             : 
     927         168 :   BIND(&return_minus_1);
     928         168 :   f_return(SmiConstant(-1));
     929             : 
     930         168 :   BIND(&return_zero);
     931         168 :   f_return(SmiConstant(0));
     932             : 
     933         168 :   BIND(&zero_length_needle);
     934             :   {
     935         168 :     Comment("0-length search_string");
     936         168 :     f_return(SmiTag(IntPtrMin(subject_length, start_position)));
     937             :   }
     938             : 
     939         168 :   BIND(&call_runtime_unchecked);
     940             :   {
     941             :     // Simplified version of the runtime call where the types of the arguments
     942             :     // are already known due to type checks in this stub.
     943         168 :     Comment("Call Runtime Unchecked");
     944             :     Node* result =
     945         168 :         CallRuntime(Runtime::kStringIndexOfUnchecked, NoContextConstant(),
     946         168 :                     subject_string, search_string, position);
     947         168 :     f_return(result);
     948         168 :   }
     949         168 : }
     950             : 
     951             : // ES6 String.prototype.indexOf(searchString [, position])
     952             : // #sec-string.prototype.indexof
     953             : // Unchecked helper for builtins lowering.
     954         392 : TF_BUILTIN(StringIndexOf, StringBuiltinsAssembler) {
     955          56 :   Node* receiver = Parameter(Descriptor::kReceiver);
     956          56 :   Node* search_string = Parameter(Descriptor::kSearchString);
     957          56 :   Node* position = Parameter(Descriptor::kPosition);
     958             :   StringIndexOf(receiver, search_string, position,
     959         560 :                 [this](Node* result) { this->Return(result); });
     960          56 : }
     961             : 
     962             : // ES6 String.prototype.includes(searchString [, position])
     963             : // #sec-string.prototype.includes
     964         336 : TF_BUILTIN(StringPrototypeIncludes, StringIncludesIndexOfAssembler) {
     965             :   TNode<IntPtrT> argc =
     966          56 :       ChangeInt32ToIntPtr(Parameter(Descriptor::kJSActualArgumentsCount));
     967          56 :   TNode<Context> context = CAST(Parameter(Descriptor::kContext));
     968          56 :   Generate(kIncludes, argc, context);
     969          56 : }
     970             : 
     971             : // ES6 String.prototype.indexOf(searchString [, position])
     972             : // #sec-string.prototype.indexof
     973         336 : TF_BUILTIN(StringPrototypeIndexOf, StringIncludesIndexOfAssembler) {
     974             :   TNode<IntPtrT> argc =
     975          56 :       ChangeInt32ToIntPtr(Parameter(Descriptor::kJSActualArgumentsCount));
     976          56 :   TNode<Context> context = CAST(Parameter(Descriptor::kContext));
     977          56 :   Generate(kIndexOf, argc, context);
     978          56 : }
     979             : 
     980         112 : void StringIncludesIndexOfAssembler::Generate(SearchVariant variant,
     981             :                                               TNode<IntPtrT> argc,
     982             :                                               TNode<Context> context) {
     983         112 :   CodeStubArguments arguments(this, argc);
     984         112 :   Node* const receiver = arguments.GetReceiver();
     985             : 
     986         112 :   VARIABLE(var_search_string, MachineRepresentation::kTagged);
     987         224 :   VARIABLE(var_position, MachineRepresentation::kTagged);
     988         224 :   Label argc_1(this), argc_2(this), call_runtime(this, Label::kDeferred),
     989         224 :       fast_path(this);
     990             : 
     991         112 :   GotoIf(IntPtrEqual(argc, IntPtrConstant(1)), &argc_1);
     992         112 :   GotoIf(IntPtrGreaterThan(argc, IntPtrConstant(1)), &argc_2);
     993             :   {
     994         112 :     Comment("0 Argument case");
     995             :     CSA_ASSERT(this, IntPtrEqual(argc, IntPtrConstant(0)));
     996         112 :     Node* const undefined = UndefinedConstant();
     997         112 :     var_search_string.Bind(undefined);
     998         112 :     var_position.Bind(undefined);
     999         112 :     Goto(&call_runtime);
    1000             :   }
    1001         112 :   BIND(&argc_1);
    1002             :   {
    1003         112 :     Comment("1 Argument case");
    1004         112 :     var_search_string.Bind(arguments.AtIndex(0));
    1005         112 :     var_position.Bind(SmiConstant(0));
    1006         112 :     Goto(&fast_path);
    1007             :   }
    1008         112 :   BIND(&argc_2);
    1009             :   {
    1010         112 :     Comment("2 Argument case");
    1011         112 :     var_search_string.Bind(arguments.AtIndex(0));
    1012         112 :     var_position.Bind(arguments.AtIndex(1));
    1013         112 :     GotoIfNot(TaggedIsSmi(var_position.value()), &call_runtime);
    1014         112 :     Goto(&fast_path);
    1015             :   }
    1016         112 :   BIND(&fast_path);
    1017             :   {
    1018         112 :     Comment("Fast Path");
    1019         112 :     Node* const search = var_search_string.value();
    1020         112 :     Node* const position = var_position.value();
    1021         112 :     GotoIf(TaggedIsSmi(receiver), &call_runtime);
    1022         112 :     GotoIf(TaggedIsSmi(search), &call_runtime);
    1023         112 :     GotoIfNot(IsString(receiver), &call_runtime);
    1024         112 :     GotoIfNot(IsString(search), &call_runtime);
    1025             : 
    1026        1008 :     StringIndexOf(receiver, search, position, [&](Node* result) {
    1027             :       CSA_ASSERT(this, TaggedIsSmi(result));
    1028        1008 :       arguments.PopAndReturn((variant == kIndexOf)
    1029             :                                  ? result
    1030             :                                  : SelectBooleanConstant(SmiGreaterThanOrEqual(
    1031        1008 :                                        CAST(result), SmiConstant(0))));
    1032        1120 :     });
    1033             :   }
    1034         112 :   BIND(&call_runtime);
    1035             :   {
    1036         112 :     Comment("Call Runtime");
    1037         112 :     Runtime::FunctionId runtime = variant == kIndexOf
    1038             :                                       ? Runtime::kStringIndexOf
    1039         112 :                                       : Runtime::kStringIncludes;
    1040             :     Node* const result =
    1041             :         CallRuntime(runtime, context, receiver, var_search_string.value(),
    1042         112 :                     var_position.value());
    1043         112 :     arguments.PopAndReturn(result);
    1044         112 :   }
    1045         112 : }
    1046             : 
    1047         336 : void StringBuiltinsAssembler::RequireObjectCoercible(Node* const context,
    1048             :                                                      Node* const value,
    1049             :                                                      const char* method_name) {
    1050         672 :   Label out(this), throw_exception(this, Label::kDeferred);
    1051         336 :   Branch(IsNullOrUndefined(value), &throw_exception, &out);
    1052             : 
    1053         336 :   BIND(&throw_exception);
    1054             :   ThrowTypeError(context, MessageTemplate::kCalledOnNullOrUndefined,
    1055         336 :                  method_name);
    1056             : 
    1057         672 :   BIND(&out);
    1058         336 : }
    1059             : 
    1060         280 : void StringBuiltinsAssembler::MaybeCallFunctionAtSymbol(
    1061             :     Node* const context, Node* const object, Node* const maybe_string,
    1062             :     Handle<Symbol> symbol, DescriptorIndexAndName symbol_index,
    1063             :     const NodeFunction0& regexp_call, const NodeFunction1& generic_call) {
    1064         280 :   Label out(this);
    1065             : 
    1066             :   // Smis definitely don't have an attached symbol.
    1067         280 :   GotoIf(TaggedIsSmi(object), &out);
    1068             : 
    1069             :   // Take the fast path for RegExps.
    1070             :   // There's two conditions: {object} needs to be a fast regexp, and
    1071             :   // {maybe_string} must be a string (we can't call ToString on the fast path
    1072             :   // since it may mutate {object}).
    1073             :   {
    1074         560 :     Label stub_call(this), slow_lookup(this);
    1075             : 
    1076         280 :     GotoIf(TaggedIsSmi(maybe_string), &slow_lookup);
    1077         280 :     GotoIfNot(IsString(maybe_string), &slow_lookup);
    1078             : 
    1079         560 :     RegExpBuiltinsAssembler regexp_asm(state());
    1080         560 :     regexp_asm.BranchIfFastRegExp(context, object, LoadMap(object),
    1081         840 :                                   symbol_index, &stub_call, &slow_lookup);
    1082             : 
    1083         280 :     BIND(&stub_call);
    1084             :     // TODO(jgruber): Add a no-JS scope once it exists.
    1085         280 :     regexp_call();
    1086             : 
    1087         560 :     BIND(&slow_lookup);
    1088             :   }
    1089             : 
    1090         280 :   GotoIf(IsNullOrUndefined(object), &out);
    1091             : 
    1092             :   // Fall back to a slow lookup of {object[symbol]}.
    1093             :   //
    1094             :   // The spec uses GetMethod({object}, {symbol}), which has a few quirks:
    1095             :   // * null values are turned into undefined, and
    1096             :   // * an exception is thrown if the value is not undefined, null, or callable.
    1097             :   // We handle the former by jumping to {out} for null values as well, while
    1098             :   // the latter is already handled by the Call({maybe_func}) operation.
    1099             : 
    1100         280 :   Node* const maybe_func = GetProperty(context, object, symbol);
    1101         280 :   GotoIf(IsUndefined(maybe_func), &out);
    1102         280 :   GotoIf(IsNull(maybe_func), &out);
    1103             : 
    1104             :   // Attempt to call the function.
    1105         280 :   generic_call(maybe_func);
    1106             : 
    1107         280 :   BIND(&out);
    1108         280 : }
    1109             : 
    1110         112 : TNode<Smi> StringBuiltinsAssembler::IndexOfDollarChar(Node* const context,
    1111             :                                                       Node* const string) {
    1112             :   CSA_ASSERT(this, IsString(string));
    1113             : 
    1114             :   TNode<String> const dollar_string = HeapConstant(
    1115         112 :       isolate()->factory()->LookupSingleCharacterStringFromCode('$'));
    1116             :   TNode<Smi> const dollar_ix =
    1117         112 :       CAST(CallBuiltin(Builtins::kStringIndexOf, context, string, dollar_string,
    1118             :                        SmiConstant(0)));
    1119         112 :   return dollar_ix;
    1120             : }
    1121             : 
    1122          56 : compiler::Node* StringBuiltinsAssembler::GetSubstitution(
    1123             :     Node* context, Node* subject_string, Node* match_start_index,
    1124             :     Node* match_end_index, Node* replace_string) {
    1125             :   CSA_ASSERT(this, IsString(subject_string));
    1126             :   CSA_ASSERT(this, IsString(replace_string));
    1127             :   CSA_ASSERT(this, TaggedIsPositiveSmi(match_start_index));
    1128             :   CSA_ASSERT(this, TaggedIsPositiveSmi(match_end_index));
    1129             : 
    1130          56 :   VARIABLE(var_result, MachineRepresentation::kTagged, replace_string);
    1131         112 :   Label runtime(this), out(this);
    1132             : 
    1133             :   // In this primitive implementation we simply look for the next '$' char in
    1134             :   // {replace_string}. If it doesn't exist, we can simply return
    1135             :   // {replace_string} itself. If it does, then we delegate to
    1136             :   // String::GetSubstitution, passing in the index of the first '$' to avoid
    1137             :   // repeated scanning work.
    1138             :   // TODO(jgruber): Possibly extend this in the future to handle more complex
    1139             :   // cases without runtime calls.
    1140             : 
    1141          56 :   TNode<Smi> const dollar_index = IndexOfDollarChar(context, replace_string);
    1142          56 :   Branch(SmiIsNegative(dollar_index), &out, &runtime);
    1143             : 
    1144          56 :   BIND(&runtime);
    1145             :   {
    1146             :     CSA_ASSERT(this, TaggedIsPositiveSmi(dollar_index));
    1147             : 
    1148             :     Node* const matched =
    1149             :         CallBuiltin(Builtins::kStringSubstring, context, subject_string,
    1150          56 :                     SmiUntag(match_start_index), SmiUntag(match_end_index));
    1151             :     Node* const replacement_string =
    1152             :         CallRuntime(Runtime::kGetSubstitution, context, matched, subject_string,
    1153          56 :                     match_start_index, replace_string, dollar_index);
    1154          56 :     var_result.Bind(replacement_string);
    1155             : 
    1156          56 :     Goto(&out);
    1157             :   }
    1158             : 
    1159          56 :   BIND(&out);
    1160         112 :   return var_result.value();
    1161             : }
    1162             : 
    1163             : // ES6 #sec-string.prototype.repeat
    1164         392 : TF_BUILTIN(StringPrototypeRepeat, StringBuiltinsAssembler) {
    1165         112 :   Label invalid_count(this), invalid_string_length(this),
    1166         112 :       return_emptystring(this);
    1167             : 
    1168          56 :   TNode<Context> context = CAST(Parameter(Descriptor::kContext));
    1169          56 :   Node* const receiver = Parameter(Descriptor::kReceiver);
    1170          56 :   TNode<Object> count = CAST(Parameter(Descriptor::kCount));
    1171             :   Node* const string =
    1172          56 :       ToThisString(context, receiver, "String.prototype.repeat");
    1173             : 
    1174         112 :   VARIABLE(
    1175             :       var_count, MachineRepresentation::kTagged,
    1176             :       ToInteger_Inline(context, count, CodeStubAssembler::kTruncateMinusZero));
    1177             : 
    1178             :   // Verifies a valid count and takes a fast path when the result will be an
    1179             :   // empty string.
    1180             :   {
    1181          56 :     Label if_count_isheapnumber(this, Label::kDeferred);
    1182             : 
    1183          56 :     GotoIfNot(TaggedIsSmi(var_count.value()), &if_count_isheapnumber);
    1184             :     {
    1185             :       // If count is a SMI, throw a RangeError if less than 0 or greater than
    1186             :       // the maximum string length.
    1187          56 :       TNode<Smi> smi_count = CAST(var_count.value());
    1188          56 :       GotoIf(SmiLessThan(smi_count, SmiConstant(0)), &invalid_count);
    1189          56 :       GotoIf(SmiEqual(smi_count, SmiConstant(0)), &return_emptystring);
    1190         112 :       GotoIf(Word32Equal(LoadStringLengthAsWord32(string), Int32Constant(0)),
    1191          56 :              &return_emptystring);
    1192          56 :       GotoIf(SmiGreaterThan(smi_count, SmiConstant(String::kMaxLength)),
    1193          56 :              &invalid_string_length);
    1194          56 :       Return(CallBuiltin(Builtins::kStringRepeat, context, string, smi_count));
    1195             :     }
    1196             : 
    1197             :     // If count is a Heap Number...
    1198             :     // 1) If count is Infinity, throw a RangeError exception
    1199             :     // 2) If receiver is an empty string, return an empty string
    1200             :     // 3) Otherwise, throw RangeError exception
    1201          56 :     BIND(&if_count_isheapnumber);
    1202             :     {
    1203             :       CSA_ASSERT(this, IsNumberNormalized(var_count.value()));
    1204          56 :       Node* const number_value = LoadHeapNumberValue(var_count.value());
    1205         112 :       GotoIf(Float64Equal(number_value, Float64Constant(V8_INFINITY)),
    1206          56 :              &invalid_count);
    1207         112 :       GotoIf(Float64LessThan(number_value, Float64Constant(0.0)),
    1208          56 :              &invalid_count);
    1209         112 :       Branch(Word32Equal(LoadStringLengthAsWord32(string), Int32Constant(0)),
    1210          56 :              &return_emptystring, &invalid_string_length);
    1211          56 :     }
    1212             :   }
    1213             : 
    1214          56 :   BIND(&return_emptystring);
    1215          56 :   Return(EmptyStringConstant());
    1216             : 
    1217          56 :   BIND(&invalid_count);
    1218             :   {
    1219             :     ThrowRangeError(context, MessageTemplate::kInvalidCountValue,
    1220          56 :                     var_count.value());
    1221             :   }
    1222             : 
    1223          56 :   BIND(&invalid_string_length);
    1224             :   {
    1225          56 :     CallRuntime(Runtime::kThrowInvalidStringLength, context);
    1226          56 :     Unreachable();
    1227          56 :   }
    1228          56 : }
    1229             : 
    1230             : // Helper with less checks
    1231         392 : TF_BUILTIN(StringRepeat, StringBuiltinsAssembler) {
    1232          56 :   Node* const context = Parameter(Descriptor::kContext);
    1233          56 :   Node* const string = Parameter(Descriptor::kString);
    1234          56 :   TNode<Smi> const count = CAST(Parameter(Descriptor::kCount));
    1235             : 
    1236             :   CSA_ASSERT(this, IsString(string));
    1237             :   CSA_ASSERT(this, Word32BinaryNot(IsEmptyString(string)));
    1238             :   CSA_ASSERT(this, TaggedIsPositiveSmi(count));
    1239             : 
    1240             :   // The string is repeated with the following algorithm:
    1241             :   //   let n = count;
    1242             :   //   let power_of_two_repeats = string;
    1243             :   //   let result = "";
    1244             :   //   while (true) {
    1245             :   //     if (n & 1) result += s;
    1246             :   //     n >>= 1;
    1247             :   //     if (n === 0) return result;
    1248             :   //     power_of_two_repeats += power_of_two_repeats;
    1249             :   //   }
    1250          56 :   VARIABLE(var_result, MachineRepresentation::kTagged, EmptyStringConstant());
    1251         112 :   VARIABLE(var_temp, MachineRepresentation::kTagged, string);
    1252         112 :   TVARIABLE(Smi, var_count, count);
    1253             : 
    1254         112 :   Label loop(this, {&var_count, &var_result, &var_temp}), return_result(this);
    1255          56 :   Goto(&loop);
    1256          56 :   BIND(&loop);
    1257             :   {
    1258             :     {
    1259          56 :       Label next(this);
    1260          56 :       GotoIfNot(SmiToInt32(SmiAnd(var_count.value(), SmiConstant(1))), &next);
    1261             :       var_result.Bind(CallBuiltin(Builtins::kStringAdd_CheckNone, context,
    1262          56 :                                   var_result.value(), var_temp.value()));
    1263          56 :       Goto(&next);
    1264          56 :       BIND(&next);
    1265             :     }
    1266             : 
    1267          56 :     var_count = SmiShr(var_count.value(), 1);
    1268          56 :     GotoIf(SmiEqual(var_count.value(), SmiConstant(0)), &return_result);
    1269             :     var_temp.Bind(CallBuiltin(Builtins::kStringAdd_CheckNone, context,
    1270          56 :                               var_temp.value(), var_temp.value()));
    1271          56 :     Goto(&loop);
    1272             :   }
    1273             : 
    1274          56 :   BIND(&return_result);
    1275         112 :   Return(var_result.value());
    1276          56 : }
    1277             : 
    1278             : // ES6 #sec-string.prototype.replace
    1279         448 : TF_BUILTIN(StringPrototypeReplace, StringBuiltinsAssembler) {
    1280          56 :   Label out(this);
    1281             : 
    1282          56 :   Node* const receiver = Parameter(Descriptor::kReceiver);
    1283          56 :   Node* const search = Parameter(Descriptor::kSearch);
    1284          56 :   Node* const replace = Parameter(Descriptor::kReplace);
    1285          56 :   Node* const context = Parameter(Descriptor::kContext);
    1286             : 
    1287          56 :   TNode<Smi> const smi_zero = SmiConstant(0);
    1288             : 
    1289          56 :   RequireObjectCoercible(context, receiver, "String.prototype.replace");
    1290             : 
    1291             :   // Redirect to replacer method if {search[@@replace]} is not undefined.
    1292             : 
    1293             :   MaybeCallFunctionAtSymbol(
    1294             :       context, search, receiver, isolate()->factory()->replace_symbol(),
    1295             :       DescriptorIndexAndName{JSRegExp::kSymbolReplaceFunctionDescriptorIndex,
    1296             :                              RootIndex::kreplace_symbol},
    1297          56 :       [=]() {
    1298             :         Return(CallBuiltin(Builtins::kRegExpReplace, context, search, receiver,
    1299          56 :                            replace));
    1300          56 :       },
    1301          56 :       [=](Node* fn) {
    1302          56 :         Callable call_callable = CodeFactory::Call(isolate());
    1303          56 :         Return(CallJS(call_callable, context, fn, search, receiver, replace));
    1304         112 :       });
    1305             : 
    1306             :   // Convert {receiver} and {search} to strings.
    1307             : 
    1308          56 :   TNode<String> const subject_string = ToString_Inline(context, receiver);
    1309          56 :   TNode<String> const search_string = ToString_Inline(context, search);
    1310             : 
    1311          56 :   TNode<IntPtrT> const subject_length = LoadStringLengthAsWord(subject_string);
    1312          56 :   TNode<IntPtrT> const search_length = LoadStringLengthAsWord(search_string);
    1313             : 
    1314             :   // Fast-path single-char {search}, long cons {receiver}, and simple string
    1315             :   // {replace}.
    1316             :   {
    1317          56 :     Label next(this);
    1318             : 
    1319          56 :     GotoIfNot(WordEqual(search_length, IntPtrConstant(1)), &next);
    1320          56 :     GotoIfNot(IntPtrGreaterThan(subject_length, IntPtrConstant(0xFF)), &next);
    1321          56 :     GotoIf(TaggedIsSmi(replace), &next);
    1322          56 :     GotoIfNot(IsString(replace), &next);
    1323             : 
    1324          56 :     Node* const subject_instance_type = LoadInstanceType(subject_string);
    1325          56 :     GotoIfNot(IsConsStringInstanceType(subject_instance_type), &next);
    1326             : 
    1327          56 :     GotoIf(TaggedIsPositiveSmi(IndexOfDollarChar(context, replace)), &next);
    1328             : 
    1329             :     // Searching by traversing a cons string tree and replace with cons of
    1330             :     // slices works only when the replaced string is a single character, being
    1331             :     // replaced by a simple string and only pays off for long strings.
    1332             :     // TODO(jgruber): Reevaluate if this is still beneficial.
    1333             :     // TODO(jgruber): TailCallRuntime when it correctly handles adapter frames.
    1334             :     Return(CallRuntime(Runtime::kStringReplaceOneCharWithString, context,
    1335          56 :                        subject_string, search_string, replace));
    1336             : 
    1337          56 :     BIND(&next);
    1338             :   }
    1339             : 
    1340             :   // TODO(jgruber): Extend StringIndexOf to handle two-byte strings and
    1341             :   // longer substrings - we can handle up to 8 chars (one-byte) / 4 chars
    1342             :   // (2-byte).
    1343             : 
    1344             :   TNode<Smi> const match_start_index =
    1345          56 :       CAST(CallBuiltin(Builtins::kStringIndexOf, context, subject_string,
    1346             :                        search_string, smi_zero));
    1347             : 
    1348             :   // Early exit if no match found.
    1349             :   {
    1350         112 :     Label next(this), return_subject(this);
    1351             : 
    1352          56 :     GotoIfNot(SmiIsNegative(match_start_index), &next);
    1353             : 
    1354             :     // The spec requires to perform ToString(replace) if the {replace} is not
    1355             :     // callable even if we are going to exit here.
    1356             :     // Since ToString() being applied to Smi does not have side effects for
    1357             :     // numbers we can skip it.
    1358          56 :     GotoIf(TaggedIsSmi(replace), &return_subject);
    1359          56 :     GotoIf(IsCallableMap(LoadMap(replace)), &return_subject);
    1360             : 
    1361             :     // TODO(jgruber): Could introduce ToStringSideeffectsStub which only
    1362             :     // performs observable parts of ToString.
    1363          56 :     ToString_Inline(context, replace);
    1364          56 :     Goto(&return_subject);
    1365             : 
    1366          56 :     BIND(&return_subject);
    1367          56 :     Return(subject_string);
    1368             : 
    1369         112 :     BIND(&next);
    1370             :   }
    1371             : 
    1372             :   TNode<Smi> const match_end_index =
    1373          56 :       SmiAdd(match_start_index, SmiFromIntPtr(search_length));
    1374             : 
    1375         112 :   VARIABLE(var_result, MachineRepresentation::kTagged, EmptyStringConstant());
    1376             : 
    1377             :   // Compute the prefix.
    1378             :   {
    1379          56 :     Label next(this);
    1380             : 
    1381          56 :     GotoIf(SmiEqual(match_start_index, smi_zero), &next);
    1382             :     Node* const prefix =
    1383             :         CallBuiltin(Builtins::kStringSubstring, context, subject_string,
    1384          56 :                     IntPtrConstant(0), SmiUntag(match_start_index));
    1385          56 :     var_result.Bind(prefix);
    1386             : 
    1387          56 :     Goto(&next);
    1388          56 :     BIND(&next);
    1389             :   }
    1390             : 
    1391             :   // Compute the string to replace with.
    1392             : 
    1393         112 :   Label if_iscallablereplace(this), if_notcallablereplace(this);
    1394          56 :   GotoIf(TaggedIsSmi(replace), &if_notcallablereplace);
    1395         112 :   Branch(IsCallableMap(LoadMap(replace)), &if_iscallablereplace,
    1396          56 :          &if_notcallablereplace);
    1397             : 
    1398          56 :   BIND(&if_iscallablereplace);
    1399             :   {
    1400          56 :     Callable call_callable = CodeFactory::Call(isolate());
    1401             :     Node* const replacement =
    1402          56 :         CallJS(call_callable, context, replace, UndefinedConstant(),
    1403          56 :                search_string, match_start_index, subject_string);
    1404          56 :     Node* const replacement_string = ToString_Inline(context, replacement);
    1405             :     var_result.Bind(CallBuiltin(Builtins::kStringAdd_CheckNone, context,
    1406          56 :                                 var_result.value(), replacement_string));
    1407          56 :     Goto(&out);
    1408             :   }
    1409             : 
    1410          56 :   BIND(&if_notcallablereplace);
    1411             :   {
    1412          56 :     Node* const replace_string = ToString_Inline(context, replace);
    1413             :     Node* const replacement =
    1414             :         GetSubstitution(context, subject_string, match_start_index,
    1415          56 :                         match_end_index, replace_string);
    1416             :     var_result.Bind(CallBuiltin(Builtins::kStringAdd_CheckNone, context,
    1417          56 :                                 var_result.value(), replacement));
    1418          56 :     Goto(&out);
    1419             :   }
    1420             : 
    1421          56 :   BIND(&out);
    1422             :   {
    1423             :     Node* const suffix =
    1424             :         CallBuiltin(Builtins::kStringSubstring, context, subject_string,
    1425          56 :                     SmiUntag(match_end_index), subject_length);
    1426             :     Node* const result = CallBuiltin(Builtins::kStringAdd_CheckNone, context,
    1427          56 :                                      var_result.value(), suffix);
    1428          56 :     Return(result);
    1429          56 :   }
    1430          56 : }
    1431             : 
    1432         112 : class StringMatchSearchAssembler : public StringBuiltinsAssembler {
    1433             :  public:
    1434         112 :   explicit StringMatchSearchAssembler(compiler::CodeAssemblerState* state)
    1435         112 :       : StringBuiltinsAssembler(state) {}
    1436             : 
    1437             :  protected:
    1438             :   enum Variant { kMatch, kSearch };
    1439             : 
    1440         112 :   void Generate(Variant variant, const char* method_name,
    1441             :                 TNode<Object> receiver, TNode<Object> maybe_regexp,
    1442             :                 TNode<Context> context) {
    1443         112 :     Label call_regexp_match_search(this);
    1444             : 
    1445             :     Builtins::Name builtin;
    1446             :     Handle<Symbol> symbol;
    1447         112 :     DescriptorIndexAndName property_to_check;
    1448         112 :     if (variant == kMatch) {
    1449          56 :       builtin = Builtins::kRegExpMatchFast;
    1450          56 :       symbol = isolate()->factory()->match_symbol();
    1451             :       property_to_check =
    1452             :           DescriptorIndexAndName{JSRegExp::kSymbolMatchFunctionDescriptorIndex,
    1453          56 :                                  RootIndex::kmatch_symbol};
    1454             :     } else {
    1455          56 :       builtin = Builtins::kRegExpSearchFast;
    1456          56 :       symbol = isolate()->factory()->search_symbol();
    1457             :       property_to_check =
    1458             :           DescriptorIndexAndName{JSRegExp::kSymbolSearchFunctionDescriptorIndex,
    1459          56 :                                  RootIndex::ksearch_symbol};
    1460             :     }
    1461             : 
    1462         112 :     RequireObjectCoercible(context, receiver, method_name);
    1463             : 
    1464             :     MaybeCallFunctionAtSymbol(
    1465             :         context, maybe_regexp, receiver, symbol, property_to_check,
    1466         112 :         [=] { Return(CallBuiltin(builtin, context, maybe_regexp, receiver)); },
    1467         112 :         [=](Node* fn) {
    1468         112 :           Callable call_callable = CodeFactory::Call(isolate());
    1469         112 :           Return(CallJS(call_callable, context, fn, maybe_regexp, receiver));
    1470         224 :         });
    1471             : 
    1472             :     // maybe_regexp is not a RegExp nor has [@@match / @@search] property.
    1473             :     {
    1474         112 :       RegExpBuiltinsAssembler regexp_asm(state());
    1475             : 
    1476         112 :       TNode<String> receiver_string = ToString_Inline(context, receiver);
    1477         112 :       TNode<Context> native_context = LoadNativeContext(context);
    1478         112 :       TNode<HeapObject> regexp_function = CAST(
    1479             :           LoadContextElement(native_context, Context::REGEXP_FUNCTION_INDEX));
    1480         112 :       TNode<Map> initial_map = CAST(LoadObjectField(
    1481             :           regexp_function, JSFunction::kPrototypeOrInitialMapOffset));
    1482             :       TNode<Object> regexp = regexp_asm.RegExpCreate(
    1483         112 :           context, initial_map, maybe_regexp, EmptyStringConstant());
    1484             : 
    1485         224 :       Label fast_path(this), slow_path(this);
    1486             :       regexp_asm.BranchIfFastRegExp(context, regexp, initial_map,
    1487         112 :                                     property_to_check, &fast_path, &slow_path);
    1488             : 
    1489         112 :       BIND(&fast_path);
    1490         112 :       Return(CallBuiltin(builtin, context, regexp, receiver_string));
    1491             : 
    1492         112 :       BIND(&slow_path);
    1493             :       {
    1494         112 :         TNode<Object> maybe_func = GetProperty(context, regexp, symbol);
    1495         112 :         Callable call_callable = CodeFactory::Call(isolate());
    1496             :         Return(CallJS(call_callable, context, maybe_func, regexp,
    1497         112 :                       receiver_string));
    1498         112 :       }
    1499         112 :     }
    1500         112 :   }
    1501             : };
    1502             : 
    1503             : // ES6 #sec-string.prototype.match
    1504         392 : TF_BUILTIN(StringPrototypeMatch, StringMatchSearchAssembler) {
    1505          56 :   TNode<Object> receiver = CAST(Parameter(Descriptor::kReceiver));
    1506          56 :   TNode<Object> maybe_regexp = CAST(Parameter(Descriptor::kRegexp));
    1507          56 :   TNode<Context> context = CAST(Parameter(Descriptor::kContext));
    1508             : 
    1509          56 :   Generate(kMatch, "String.prototype.match", receiver, maybe_regexp, context);
    1510          56 : }
    1511             : 
    1512             : // ES #sec-string.prototype.matchAll
    1513         392 : TF_BUILTIN(StringPrototypeMatchAll, StringBuiltinsAssembler) {
    1514          56 :   char const* method_name = "String.prototype.matchAll";
    1515             : 
    1516          56 :   TNode<Context> context = CAST(Parameter(Descriptor::kContext));
    1517          56 :   TNode<Object> maybe_regexp = CAST(Parameter(Descriptor::kRegexp));
    1518          56 :   TNode<Object> receiver = CAST(Parameter(Descriptor::kReceiver));
    1519          56 :   TNode<Context> native_context = LoadNativeContext(context);
    1520             : 
    1521             :   // 1. Let O be ? RequireObjectCoercible(this value).
    1522          56 :   RequireObjectCoercible(context, receiver, method_name);
    1523             : 
    1524             :   // 2. If regexp is neither undefined nor null, then
    1525             :   //   a. Let matcher be ? GetMethod(regexp, @@matchAll).
    1526             :   //   b. If matcher is not undefined, then
    1527             :   //     i. Return ? Call(matcher, regexp, « O »).
    1528          56 :   auto if_regexp_call = [&] {
    1529             :     // MaybeCallFunctionAtSymbol guarantees fast path is chosen only if
    1530             :     // maybe_regexp is a fast regexp and receiver is a string.
    1531          56 :     TNode<String> s = CAST(receiver);
    1532             : 
    1533          56 :     RegExpMatchAllAssembler regexp_asm(state());
    1534          56 :     regexp_asm.Generate(context, native_context, maybe_regexp, s);
    1535         112 :   };
    1536          56 :   auto if_generic_call = [=](Node* fn) {
    1537          56 :     Callable call_callable = CodeFactory::Call(isolate());
    1538          56 :     Return(CallJS(call_callable, context, fn, maybe_regexp, receiver));
    1539         112 :   };
    1540             :   MaybeCallFunctionAtSymbol(
    1541             :       context, maybe_regexp, receiver, isolate()->factory()->match_all_symbol(),
    1542             :       DescriptorIndexAndName{JSRegExp::kSymbolMatchAllFunctionDescriptorIndex,
    1543             :                              RootIndex::kmatch_all_symbol},
    1544          56 :       if_regexp_call, if_generic_call);
    1545             : 
    1546          56 :   RegExpMatchAllAssembler regexp_asm(state());
    1547             : 
    1548             :   // 3. Let S be ? ToString(O).
    1549          56 :   TNode<String> s = ToString_Inline(context, receiver);
    1550             : 
    1551             :   // 4. Let rx be ? RegExpCreate(R, "g").
    1552             :   TNode<Object> rx = regexp_asm.RegExpCreate(context, native_context,
    1553          56 :                                              maybe_regexp, StringConstant("g"));
    1554             : 
    1555             :   // 5. Return ? Invoke(rx, @@matchAll, « S »).
    1556         112 :   Callable callable = CodeFactory::Call(isolate());
    1557             :   TNode<Object> match_all_func =
    1558         112 :       GetProperty(context, rx, isolate()->factory()->match_all_symbol());
    1559         112 :   Return(CallJS(callable, context, match_all_func, rx, s));
    1560          56 : }
    1561             : 
    1562         112 : class StringPadAssembler : public StringBuiltinsAssembler {
    1563             :  public:
    1564         112 :   explicit StringPadAssembler(compiler::CodeAssemblerState* state)
    1565         112 :       : StringBuiltinsAssembler(state) {}
    1566             : 
    1567             :  protected:
    1568             :   enum Variant { kStart, kEnd };
    1569             : 
    1570         112 :   void Generate(Variant variant, const char* method_name, TNode<IntPtrT> argc,
    1571             :                 TNode<Context> context) {
    1572         112 :     CodeStubArguments arguments(this, argc);
    1573         112 :     Node* const receiver = arguments.GetReceiver();
    1574         112 :     Node* const receiver_string = ToThisString(context, receiver, method_name);
    1575         112 :     TNode<Smi> const string_length = LoadStringLengthAsSmi(receiver_string);
    1576             : 
    1577         112 :     TVARIABLE(String, var_fill_string, StringConstant(" "));
    1578         224 :     TVARIABLE(IntPtrT, var_fill_length, IntPtrConstant(1));
    1579             : 
    1580         224 :     Label check_fill(this), dont_pad(this), invalid_string_length(this),
    1581         224 :         pad(this);
    1582             : 
    1583             :     // If no max_length was provided, return the string.
    1584         112 :     GotoIf(IntPtrEqual(argc, IntPtrConstant(0)), &dont_pad);
    1585             : 
    1586             :     TNode<Number> const max_length =
    1587         112 :         ToLength_Inline(context, arguments.AtIndex(0));
    1588             :     CSA_ASSERT(this, IsNumberNormalized(max_length));
    1589             : 
    1590             :     // If max_length <= string_length, return the string.
    1591         112 :     GotoIfNot(TaggedIsSmi(max_length), &check_fill);
    1592         224 :     Branch(SmiLessThanOrEqual(CAST(max_length), string_length), &dont_pad,
    1593         112 :            &check_fill);
    1594             : 
    1595         112 :     BIND(&check_fill);
    1596             :     {
    1597         112 :       GotoIf(IntPtrEqual(argc, IntPtrConstant(1)), &pad);
    1598         112 :       Node* const fill = arguments.AtIndex(1);
    1599         112 :       GotoIf(IsUndefined(fill), &pad);
    1600             : 
    1601         112 :       var_fill_string = ToString_Inline(context, fill);
    1602         112 :       var_fill_length = LoadStringLengthAsWord(var_fill_string.value());
    1603         224 :       Branch(WordEqual(var_fill_length.value(), IntPtrConstant(0)), &dont_pad,
    1604         112 :              &pad);
    1605             :     }
    1606             : 
    1607         112 :     BIND(&pad);
    1608             :     {
    1609             :       CSA_ASSERT(this,
    1610             :                  IntPtrGreaterThan(var_fill_length.value(), IntPtrConstant(0)));
    1611             : 
    1612             :       // Throw if max_length is greater than String::kMaxLength.
    1613         112 :       GotoIfNot(TaggedIsSmi(max_length), &invalid_string_length);
    1614         112 :       TNode<Smi> smi_max_length = CAST(max_length);
    1615             :       GotoIfNot(
    1616         112 :           SmiLessThanOrEqual(smi_max_length, SmiConstant(String::kMaxLength)),
    1617         112 :           &invalid_string_length);
    1618             : 
    1619             :       CSA_ASSERT(this, SmiGreaterThan(smi_max_length, string_length));
    1620         112 :       TNode<Smi> const pad_length = SmiSub(smi_max_length, string_length);
    1621             : 
    1622         112 :       VARIABLE(var_pad, MachineRepresentation::kTagged);
    1623         224 :       Label single_char_fill(this), multi_char_fill(this), return_result(this);
    1624         224 :       Branch(IntPtrEqual(var_fill_length.value(), IntPtrConstant(1)),
    1625         112 :              &single_char_fill, &multi_char_fill);
    1626             : 
    1627             :       // Fast path for a single character fill.  No need to calculate number of
    1628             :       // repetitions or remainder.
    1629         112 :       BIND(&single_char_fill);
    1630             :       {
    1631             :         var_pad.Bind(CallBuiltin(Builtins::kStringRepeat, context,
    1632             :                                  static_cast<Node*>(var_fill_string.value()),
    1633         112 :                                  pad_length));
    1634         112 :         Goto(&return_result);
    1635             :       }
    1636         112 :       BIND(&multi_char_fill);
    1637             :       {
    1638             :         TNode<Int32T> const fill_length_word32 =
    1639         112 :             TruncateIntPtrToInt32(var_fill_length.value());
    1640         112 :         TNode<Int32T> const pad_length_word32 = SmiToInt32(pad_length);
    1641             :         TNode<Int32T> const repetitions_word32 =
    1642         112 :             Int32Div(pad_length_word32, fill_length_word32);
    1643             :         TNode<Int32T> const remaining_word32 =
    1644         112 :             Int32Mod(pad_length_word32, fill_length_word32);
    1645             : 
    1646             :         var_pad.Bind(CallBuiltin(Builtins::kStringRepeat, context,
    1647             :                                  var_fill_string.value(),
    1648         112 :                                  SmiFromInt32(repetitions_word32)));
    1649             : 
    1650         112 :         GotoIfNot(remaining_word32, &return_result);
    1651             :         {
    1652             :           Node* const remainder_string = CallBuiltin(
    1653             :               Builtins::kStringSubstring, context, var_fill_string.value(),
    1654         112 :               IntPtrConstant(0), ChangeInt32ToIntPtr(remaining_word32));
    1655             :           var_pad.Bind(CallBuiltin(Builtins::kStringAdd_CheckNone, context,
    1656         112 :                                    var_pad.value(), remainder_string));
    1657         112 :           Goto(&return_result);
    1658             :         }
    1659             :       }
    1660         112 :       BIND(&return_result);
    1661             :       CSA_ASSERT(this,
    1662             :                  SmiEqual(pad_length, LoadStringLengthAsSmi(var_pad.value())));
    1663             :       arguments.PopAndReturn(
    1664             :           variant == kStart
    1665             :               ? CallBuiltin(Builtins::kStringAdd_CheckNone, context,
    1666         280 :                             var_pad.value(), receiver_string)
    1667             :               : CallBuiltin(Builtins::kStringAdd_CheckNone, context,
    1668         392 :                             receiver_string, var_pad.value()));
    1669             :     }
    1670         112 :     BIND(&dont_pad);
    1671         112 :     arguments.PopAndReturn(receiver_string);
    1672         112 :     BIND(&invalid_string_length);
    1673             :     {
    1674         112 :       CallRuntime(Runtime::kThrowInvalidStringLength, context);
    1675         112 :       Unreachable();
    1676         112 :     }
    1677         112 :   }
    1678             : };
    1679             : 
    1680         336 : TF_BUILTIN(StringPrototypePadEnd, StringPadAssembler) {
    1681             :   TNode<IntPtrT> argc =
    1682          56 :       ChangeInt32ToIntPtr(Parameter(Descriptor::kJSActualArgumentsCount));
    1683          56 :   TNode<Context> context = CAST(Parameter(Descriptor::kContext));
    1684             : 
    1685          56 :   Generate(kEnd, "String.prototype.padEnd", argc, context);
    1686          56 : }
    1687             : 
    1688         336 : TF_BUILTIN(StringPrototypePadStart, StringPadAssembler) {
    1689             :   TNode<IntPtrT> argc =
    1690          56 :       ChangeInt32ToIntPtr(Parameter(Descriptor::kJSActualArgumentsCount));
    1691          56 :   TNode<Context> context = CAST(Parameter(Descriptor::kContext));
    1692             : 
    1693          56 :   Generate(kStart, "String.prototype.padStart", argc, context);
    1694          56 : }
    1695             : 
    1696             : // ES6 #sec-string.prototype.search
    1697         392 : TF_BUILTIN(StringPrototypeSearch, StringMatchSearchAssembler) {
    1698          56 :   TNode<Object> receiver = CAST(Parameter(Descriptor::kReceiver));
    1699          56 :   TNode<Object> maybe_regexp = CAST(Parameter(Descriptor::kRegexp));
    1700          56 :   TNode<Context> context = CAST(Parameter(Descriptor::kContext));
    1701          56 :   Generate(kSearch, "String.prototype.search", receiver, maybe_regexp, context);
    1702          56 : }
    1703             : 
    1704             : // ES6 section 21.1.3.18 String.prototype.slice ( start, end )
    1705         336 : TF_BUILTIN(StringPrototypeSlice, StringBuiltinsAssembler) {
    1706          56 :   Label out(this);
    1707         112 :   TVARIABLE(IntPtrT, var_start);
    1708         112 :   TVARIABLE(IntPtrT, var_end);
    1709             : 
    1710          56 :   const int kStart = 0;
    1711          56 :   const int kEnd = 1;
    1712             :   Node* argc =
    1713          56 :       ChangeInt32ToIntPtr(Parameter(Descriptor::kJSActualArgumentsCount));
    1714          56 :   CodeStubArguments args(this, argc);
    1715          56 :   Node* const receiver = args.GetReceiver();
    1716          56 :   TNode<Object> start = args.GetOptionalArgumentValue(kStart);
    1717          56 :   TNode<Object> end = args.GetOptionalArgumentValue(kEnd);
    1718          56 :   TNode<Context> context = CAST(Parameter(Descriptor::kContext));
    1719             : 
    1720             :   // 1. Let O be ? RequireObjectCoercible(this value).
    1721          56 :   RequireObjectCoercible(context, receiver, "String.prototype.slice");
    1722             : 
    1723             :   // 2. Let S be ? ToString(O).
    1724             :   TNode<String> const subject_string =
    1725          56 :       CAST(CallBuiltin(Builtins::kToString, context, receiver));
    1726             : 
    1727             :   // 3. Let len be the number of elements in S.
    1728          56 :   TNode<IntPtrT> const length = LoadStringLengthAsWord(subject_string);
    1729             : 
    1730             :   // Convert {start} to a relative index.
    1731          56 :   var_start = ConvertToRelativeIndex(context, start, length);
    1732             : 
    1733             :   // 5. If end is undefined, let intEnd be len;
    1734          56 :   var_end = length;
    1735          56 :   GotoIf(IsUndefined(end), &out);
    1736             : 
    1737             :   // Convert {end} to a relative index.
    1738          56 :   var_end = ConvertToRelativeIndex(context, end, length);
    1739          56 :   Goto(&out);
    1740             : 
    1741         112 :   Label return_emptystring(this);
    1742          56 :   BIND(&out);
    1743             :   {
    1744         112 :     GotoIf(IntPtrLessThanOrEqual(var_end.value(), var_start.value()),
    1745          56 :            &return_emptystring);
    1746             :     TNode<String> const result =
    1747          56 :         SubString(subject_string, var_start.value(), var_end.value());
    1748          56 :     args.PopAndReturn(result);
    1749             :   }
    1750             : 
    1751          56 :   BIND(&return_emptystring);
    1752         112 :   args.PopAndReturn(EmptyStringConstant());
    1753          56 : }
    1754             : 
    1755          56 : TNode<JSArray> StringBuiltinsAssembler::StringToArray(
    1756             :     TNode<Context> context, TNode<String> subject_string,
    1757             :     TNode<Smi> subject_length, TNode<Number> limit_number) {
    1758             :   CSA_ASSERT(this, SmiGreaterThan(subject_length, SmiConstant(0)));
    1759             : 
    1760         112 :   Label done(this), call_runtime(this, Label::kDeferred),
    1761         112 :       fill_thehole_and_call_runtime(this, Label::kDeferred);
    1762         112 :   TVARIABLE(JSArray, result_array);
    1763             : 
    1764          56 :   TNode<Int32T> instance_type = LoadInstanceType(subject_string);
    1765          56 :   GotoIfNot(IsOneByteStringInstanceType(instance_type), &call_runtime);
    1766             : 
    1767             :   // Try to use cached one byte characters.
    1768             :   {
    1769             :     TNode<Smi> length_smi =
    1770         112 :         Select<Smi>(TaggedIsSmi(limit_number),
    1771          56 :                     [=] { return SmiMin(CAST(limit_number), subject_length); },
    1772         224 :                     [=] { return subject_length; });
    1773          56 :     TNode<IntPtrT> length = SmiToIntPtr(length_smi);
    1774             : 
    1775          56 :     ToDirectStringAssembler to_direct(state(), subject_string);
    1776          56 :     to_direct.TryToDirect(&call_runtime);
    1777          56 :     TNode<FixedArray> elements = CAST(AllocateFixedArray(
    1778             :         PACKED_ELEMENTS, length, AllocationFlag::kAllowLargeObjectAllocation));
    1779             :     // Don't allocate anything while {string_data} is live!
    1780             :     TNode<RawPtrT> string_data = UncheckedCast<RawPtrT>(
    1781          56 :         to_direct.PointerToData(&fill_thehole_and_call_runtime));
    1782          56 :     TNode<IntPtrT> string_data_offset = to_direct.offset();
    1783          56 :     TNode<Object> cache = LoadRoot(RootIndex::kSingleCharacterStringCache);
    1784             : 
    1785             :     BuildFastLoop(
    1786          56 :         IntPtrConstant(0), length,
    1787          56 :         [&](Node* index) {
    1788             :           // TODO(jkummerow): Implement a CSA version of DisallowHeapAllocation
    1789             :           // and use that to guard ToDirectStringAssembler.PointerToData().
    1790             :           CSA_ASSERT(this, WordEqual(to_direct.PointerToData(&call_runtime),
    1791             :                                      string_data));
    1792             :           TNode<Int32T> char_code =
    1793             :               UncheckedCast<Int32T>(Load(MachineType::Uint8(), string_data,
    1794          56 :                                          IntPtrAdd(index, string_data_offset)));
    1795          56 :           Node* code_index = ChangeUint32ToWord(char_code);
    1796          56 :           TNode<Object> entry = LoadFixedArrayElement(CAST(cache), code_index);
    1797             : 
    1798             :           // If we cannot find a char in the cache, fill the hole for the fixed
    1799             :           // array, and call runtime.
    1800          56 :           GotoIf(IsUndefined(entry), &fill_thehole_and_call_runtime);
    1801             : 
    1802          56 :           StoreFixedArrayElement(elements, index, entry);
    1803          56 :         },
    1804         112 :         1, ParameterMode::INTPTR_PARAMETERS, IndexAdvanceMode::kPost);
    1805             : 
    1806          56 :     TNode<Map> array_map = LoadJSArrayElementsMap(PACKED_ELEMENTS, context);
    1807          56 :     result_array = AllocateJSArray(array_map, elements, length_smi);
    1808          56 :     Goto(&done);
    1809             : 
    1810          56 :     BIND(&fill_thehole_and_call_runtime);
    1811             :     {
    1812          56 :       FillFixedArrayWithValue(PACKED_ELEMENTS, elements, IntPtrConstant(0),
    1813         112 :                               length, RootIndex::kTheHoleValue);
    1814          56 :       Goto(&call_runtime);
    1815          56 :     }
    1816             :   }
    1817             : 
    1818          56 :   BIND(&call_runtime);
    1819             :   {
    1820         112 :     result_array = CAST(CallRuntime(Runtime::kStringToArray, context,
    1821          56 :                                     subject_string, limit_number));
    1822          56 :     Goto(&done);
    1823             :   }
    1824             : 
    1825          56 :   BIND(&done);
    1826         112 :   return result_array.value();
    1827             : }
    1828             : 
    1829             : // ES6 section 21.1.3.19 String.prototype.split ( separator, limit )
    1830         336 : TF_BUILTIN(StringPrototypeSplit, StringBuiltinsAssembler) {
    1831          56 :   const int kSeparatorArg = 0;
    1832          56 :   const int kLimitArg = 1;
    1833             : 
    1834             :   Node* const argc =
    1835          56 :       ChangeInt32ToIntPtr(Parameter(Descriptor::kJSActualArgumentsCount));
    1836          56 :   CodeStubArguments args(this, argc);
    1837             : 
    1838          56 :   Node* const receiver = args.GetReceiver();
    1839          56 :   Node* const separator = args.GetOptionalArgumentValue(kSeparatorArg);
    1840          56 :   Node* const limit = args.GetOptionalArgumentValue(kLimitArg);
    1841          56 :   TNode<Context> context = CAST(Parameter(Descriptor::kContext));
    1842             : 
    1843          56 :   TNode<Smi> smi_zero = SmiConstant(0);
    1844             : 
    1845          56 :   RequireObjectCoercible(context, receiver, "String.prototype.split");
    1846             : 
    1847             :   // Redirect to splitter method if {separator[@@split]} is not undefined.
    1848             : 
    1849             :   MaybeCallFunctionAtSymbol(
    1850             :       context, separator, receiver, isolate()->factory()->split_symbol(),
    1851             :       DescriptorIndexAndName{JSRegExp::kSymbolSplitFunctionDescriptorIndex,
    1852             :                              RootIndex::ksplit_symbol},
    1853          56 :       [&]() {
    1854             :         args.PopAndReturn(CallBuiltin(Builtins::kRegExpSplit, context,
    1855          56 :                                       separator, receiver, limit));
    1856          56 :       },
    1857          56 :       [&](Node* fn) {
    1858          56 :         Callable call_callable = CodeFactory::Call(isolate());
    1859             :         args.PopAndReturn(
    1860          56 :             CallJS(call_callable, context, fn, separator, receiver, limit));
    1861         112 :       });
    1862             : 
    1863             :   // String and integer conversions.
    1864             : 
    1865          56 :   TNode<String> subject_string = ToString_Inline(context, receiver);
    1866             :   TNode<Number> limit_number = Select<Number>(
    1867         168 :       IsUndefined(limit), [=] { return NumberConstant(kMaxUInt32); },
    1868         224 :       [=] { return ToUint32(context, limit); });
    1869          56 :   Node* const separator_string = ToString_Inline(context, separator);
    1870             : 
    1871          56 :   Label return_empty_array(this);
    1872             : 
    1873             :   // Shortcut for {limit} == 0.
    1874         112 :   GotoIf(WordEqual<Object, Object>(limit_number, smi_zero),
    1875          56 :          &return_empty_array);
    1876             : 
    1877             :   // ECMA-262 says that if {separator} is undefined, the result should
    1878             :   // be an array of size 1 containing the entire string.
    1879             :   {
    1880          56 :     Label next(this);
    1881          56 :     GotoIfNot(IsUndefined(separator), &next);
    1882             : 
    1883          56 :     const ElementsKind kind = PACKED_ELEMENTS;
    1884          56 :     Node* const native_context = LoadNativeContext(context);
    1885          56 :     TNode<Map> array_map = LoadJSArrayElementsMap(kind, native_context);
    1886             : 
    1887          56 :     TNode<Smi> length = SmiConstant(1);
    1888          56 :     TNode<IntPtrT> capacity = IntPtrConstant(1);
    1889          56 :     TNode<JSArray> result = AllocateJSArray(kind, array_map, capacity, length);
    1890             : 
    1891          56 :     TNode<FixedArray> fixed_array = CAST(LoadElements(result));
    1892          56 :     StoreFixedArrayElement(fixed_array, 0, subject_string);
    1893             : 
    1894          56 :     args.PopAndReturn(result);
    1895             : 
    1896          56 :     BIND(&next);
    1897             :   }
    1898             : 
    1899             :   // If the separator string is empty then return the elements in the subject.
    1900             :   {
    1901          56 :     Label next(this);
    1902         112 :     GotoIfNot(SmiEqual(LoadStringLengthAsSmi(separator_string), smi_zero),
    1903          56 :               &next);
    1904             : 
    1905          56 :     TNode<Smi> subject_length = LoadStringLengthAsSmi(subject_string);
    1906          56 :     GotoIf(SmiEqual(subject_length, smi_zero), &return_empty_array);
    1907             : 
    1908             :     args.PopAndReturn(
    1909          56 :         StringToArray(context, subject_string, subject_length, limit_number));
    1910             : 
    1911          56 :     BIND(&next);
    1912             :   }
    1913             : 
    1914             :   Node* const result =
    1915             :       CallRuntime(Runtime::kStringSplit, context, subject_string,
    1916          56 :                   separator_string, limit_number);
    1917          56 :   args.PopAndReturn(result);
    1918             : 
    1919          56 :   BIND(&return_empty_array);
    1920             :   {
    1921          56 :     const ElementsKind kind = PACKED_ELEMENTS;
    1922          56 :     Node* const native_context = LoadNativeContext(context);
    1923          56 :     TNode<Map> array_map = LoadJSArrayElementsMap(kind, native_context);
    1924             : 
    1925          56 :     TNode<Smi> length = smi_zero;
    1926          56 :     TNode<IntPtrT> capacity = IntPtrConstant(0);
    1927          56 :     TNode<JSArray> result = AllocateJSArray(kind, array_map, capacity, length);
    1928             : 
    1929          56 :     args.PopAndReturn(result);
    1930          56 :   }
    1931          56 : }
    1932             : 
    1933             : // ES6 #sec-string.prototype.substr
    1934         336 : TF_BUILTIN(StringPrototypeSubstr, StringBuiltinsAssembler) {
    1935          56 :   const int kStartArg = 0;
    1936          56 :   const int kLengthArg = 1;
    1937             : 
    1938             :   Node* const argc =
    1939          56 :       ChangeInt32ToIntPtr(Parameter(Descriptor::kJSActualArgumentsCount));
    1940          56 :   CodeStubArguments args(this, argc);
    1941             : 
    1942          56 :   Node* const receiver = args.GetReceiver();
    1943          56 :   TNode<Object> start = args.GetOptionalArgumentValue(kStartArg);
    1944          56 :   TNode<Object> length = args.GetOptionalArgumentValue(kLengthArg);
    1945          56 :   TNode<Context> context = CAST(Parameter(Descriptor::kContext));
    1946             : 
    1947          56 :   Label out(this);
    1948             : 
    1949         112 :   TVARIABLE(IntPtrT, var_start);
    1950         112 :   TVARIABLE(Number, var_length);
    1951             : 
    1952          56 :   TNode<IntPtrT> const zero = IntPtrConstant(0);
    1953             : 
    1954             :   // Check that {receiver} is coercible to Object and convert it to a String.
    1955             :   TNode<String> const string =
    1956          56 :       ToThisString(context, receiver, "String.prototype.substr");
    1957             : 
    1958          56 :   TNode<IntPtrT> const string_length = LoadStringLengthAsWord(string);
    1959             : 
    1960             :   // Convert {start} to a relative index.
    1961          56 :   var_start = ConvertToRelativeIndex(context, start, string_length);
    1962             : 
    1963             :   // Conversions and bounds-checks for {length}.
    1964         112 :   Label if_issmi(this), if_isheapnumber(this, Label::kDeferred);
    1965             : 
    1966             :   // Default to {string_length} if {length} is undefined.
    1967             :   {
    1968         112 :     Label if_isundefined(this, Label::kDeferred), if_isnotundefined(this);
    1969          56 :     Branch(IsUndefined(length), &if_isundefined, &if_isnotundefined);
    1970             : 
    1971          56 :     BIND(&if_isundefined);
    1972          56 :     var_length = SmiTag(string_length);
    1973          56 :     Goto(&if_issmi);
    1974             : 
    1975          56 :     BIND(&if_isnotundefined);
    1976         112 :     var_length = ToInteger_Inline(context, length,
    1977         112 :                                   CodeStubAssembler::kTruncateMinusZero);
    1978             :   }
    1979             : 
    1980         112 :   TVARIABLE(IntPtrT, var_result_length);
    1981             : 
    1982          56 :   Branch(TaggedIsSmi(var_length.value()), &if_issmi, &if_isheapnumber);
    1983             : 
    1984             :   // Set {length} to min(max({length}, 0), {string_length} - {start}
    1985          56 :   BIND(&if_issmi);
    1986             :   {
    1987             :     TNode<IntPtrT> const positive_length =
    1988          56 :         IntPtrMax(SmiUntag(CAST(var_length.value())), zero);
    1989             :     TNode<IntPtrT> const minimal_length =
    1990          56 :         IntPtrSub(string_length, var_start.value());
    1991          56 :     var_result_length = IntPtrMin(positive_length, minimal_length);
    1992             : 
    1993          56 :     GotoIfNot(IntPtrLessThanOrEqual(var_result_length.value(), zero), &out);
    1994          56 :     args.PopAndReturn(EmptyStringConstant());
    1995             :   }
    1996             : 
    1997          56 :   BIND(&if_isheapnumber);
    1998             :   {
    1999             :     // If {length} is a heap number, it is definitely out of bounds. There are
    2000             :     // two cases according to the spec: if it is negative, "" is returned; if
    2001             :     // it is positive, then length is set to {string_length} - {start}.
    2002             : 
    2003             :     CSA_ASSERT(this, IsHeapNumber(CAST(var_length.value())));
    2004             : 
    2005         112 :     Label if_isnegative(this), if_ispositive(this);
    2006          56 :     TNode<Float64T> const float_zero = Float64Constant(0.);
    2007             :     TNode<Float64T> const length_float =
    2008          56 :         LoadHeapNumberValue(CAST(var_length.value()));
    2009         112 :     Branch(Float64LessThan(length_float, float_zero), &if_isnegative,
    2010          56 :            &if_ispositive);
    2011             : 
    2012          56 :     BIND(&if_isnegative);
    2013          56 :     args.PopAndReturn(EmptyStringConstant());
    2014             : 
    2015          56 :     BIND(&if_ispositive);
    2016             :     {
    2017          56 :       var_result_length = IntPtrSub(string_length, var_start.value());
    2018          56 :       GotoIfNot(IntPtrLessThanOrEqual(var_result_length.value(), zero), &out);
    2019          56 :       args.PopAndReturn(EmptyStringConstant());
    2020          56 :     }
    2021             :   }
    2022             : 
    2023          56 :   BIND(&out);
    2024             :   {
    2025             :     TNode<IntPtrT> const end =
    2026          56 :         IntPtrAdd(var_start.value(), var_result_length.value());
    2027          56 :     args.PopAndReturn(SubString(string, var_start.value(), end));
    2028          56 :   }
    2029          56 : }
    2030             : 
    2031         112 : TNode<Smi> StringBuiltinsAssembler::ToSmiBetweenZeroAnd(
    2032             :     SloppyTNode<Context> context, SloppyTNode<Object> value,
    2033             :     SloppyTNode<Smi> limit) {
    2034         112 :   Label out(this);
    2035         224 :   TVARIABLE(Smi, var_result);
    2036             : 
    2037             :   TNode<Number> const value_int =
    2038         112 :       ToInteger_Inline(context, value, CodeStubAssembler::kTruncateMinusZero);
    2039             : 
    2040         224 :   Label if_issmi(this), if_isnotsmi(this, Label::kDeferred);
    2041         112 :   Branch(TaggedIsSmi(value_int), &if_issmi, &if_isnotsmi);
    2042             : 
    2043         112 :   BIND(&if_issmi);
    2044             :   {
    2045         112 :     TNode<Smi> value_smi = CAST(value_int);
    2046         224 :     Label if_isinbounds(this), if_isoutofbounds(this, Label::kDeferred);
    2047         112 :     Branch(SmiAbove(value_smi, limit), &if_isoutofbounds, &if_isinbounds);
    2048             : 
    2049         112 :     BIND(&if_isinbounds);
    2050             :     {
    2051         112 :       var_result = CAST(value_int);
    2052         112 :       Goto(&out);
    2053             :     }
    2054             : 
    2055         112 :     BIND(&if_isoutofbounds);
    2056             :     {
    2057         112 :       TNode<Smi> const zero = SmiConstant(0);
    2058         112 :       var_result =
    2059         112 :           SelectConstant<Smi>(SmiLessThan(value_smi, zero), zero, limit);
    2060         112 :       Goto(&out);
    2061         112 :     }
    2062             :   }
    2063             : 
    2064         112 :   BIND(&if_isnotsmi);
    2065             :   {
    2066             :     // {value} is a heap number - in this case, it is definitely out of bounds.
    2067         112 :     TNode<HeapNumber> value_int_hn = CAST(value_int);
    2068             : 
    2069         112 :     TNode<Float64T> const float_zero = Float64Constant(0.);
    2070         112 :     TNode<Smi> const smi_zero = SmiConstant(0);
    2071         112 :     TNode<Float64T> const value_float = LoadHeapNumberValue(value_int_hn);
    2072         224 :     var_result = SelectConstant<Smi>(Float64LessThan(value_float, float_zero),
    2073         112 :                                      smi_zero, limit);
    2074         112 :     Goto(&out);
    2075             :   }
    2076             : 
    2077         112 :   BIND(&out);
    2078         224 :   return var_result.value();
    2079             : }
    2080             : 
    2081         392 : TF_BUILTIN(StringSubstring, CodeStubAssembler) {
    2082          56 :   TNode<String> string = CAST(Parameter(Descriptor::kString));
    2083          56 :   TNode<IntPtrT> from = UncheckedCast<IntPtrT>(Parameter(Descriptor::kFrom));
    2084          56 :   TNode<IntPtrT> to = UncheckedCast<IntPtrT>(Parameter(Descriptor::kTo));
    2085             : 
    2086          56 :   Return(SubString(string, from, to));
    2087          56 : }
    2088             : 
    2089             : // ES6 #sec-string.prototype.substring
    2090         336 : TF_BUILTIN(StringPrototypeSubstring, StringBuiltinsAssembler) {
    2091          56 :   const int kStartArg = 0;
    2092          56 :   const int kEndArg = 1;
    2093             : 
    2094             :   Node* const argc =
    2095          56 :       ChangeInt32ToIntPtr(Parameter(Descriptor::kJSActualArgumentsCount));
    2096          56 :   CodeStubArguments args(this, argc);
    2097             : 
    2098          56 :   Node* const receiver = args.GetReceiver();
    2099          56 :   Node* const start = args.GetOptionalArgumentValue(kStartArg);
    2100          56 :   Node* const end = args.GetOptionalArgumentValue(kEndArg);
    2101          56 :   Node* const context = Parameter(Descriptor::kContext);
    2102             : 
    2103          56 :   Label out(this);
    2104             : 
    2105         112 :   TVARIABLE(Smi, var_start);
    2106         112 :   TVARIABLE(Smi, var_end);
    2107             : 
    2108             :   // Check that {receiver} is coercible to Object and convert it to a String.
    2109             :   TNode<String> const string =
    2110          56 :       ToThisString(context, receiver, "String.prototype.substring");
    2111             : 
    2112          56 :   TNode<Smi> const length = LoadStringLengthAsSmi(string);
    2113             : 
    2114             :   // Conversion and bounds-checks for {start}.
    2115          56 :   var_start = ToSmiBetweenZeroAnd(context, start, length);
    2116             : 
    2117             :   // Conversion and bounds-checks for {end}.
    2118             :   {
    2119          56 :     var_end = length;
    2120          56 :     GotoIf(IsUndefined(end), &out);
    2121             : 
    2122          56 :     var_end = ToSmiBetweenZeroAnd(context, end, length);
    2123             : 
    2124          56 :     Label if_endislessthanstart(this);
    2125          56 :     Branch(SmiLessThan(var_end.value(), var_start.value()),
    2126          56 :            &if_endislessthanstart, &out);
    2127             : 
    2128          56 :     BIND(&if_endislessthanstart);
    2129             :     {
    2130          56 :       TNode<Smi> const tmp = var_end.value();
    2131          56 :       var_end = var_start.value();
    2132          56 :       var_start = tmp;
    2133          56 :       Goto(&out);
    2134          56 :     }
    2135             :   }
    2136             : 
    2137          56 :   BIND(&out);
    2138             :   {
    2139             :     args.PopAndReturn(SubString(string, SmiUntag(var_start.value()),
    2140          56 :                                 SmiUntag(var_end.value())));
    2141          56 :   }
    2142          56 : }
    2143             : 
    2144             : // ES6 #sec-string.prototype.trim
    2145         336 : TF_BUILTIN(StringPrototypeTrim, StringTrimAssembler) {
    2146             :   TNode<IntPtrT> argc =
    2147          56 :       ChangeInt32ToIntPtr(Parameter(Descriptor::kJSActualArgumentsCount));
    2148          56 :   TNode<Context> context = CAST(Parameter(Descriptor::kContext));
    2149             : 
    2150          56 :   Generate(String::kTrim, "String.prototype.trim", argc, context);
    2151          56 : }
    2152             : 
    2153             : // https://github.com/tc39/proposal-string-left-right-trim
    2154         336 : TF_BUILTIN(StringPrototypeTrimStart, StringTrimAssembler) {
    2155             :   TNode<IntPtrT> argc =
    2156          56 :       ChangeInt32ToIntPtr(Parameter(Descriptor::kJSActualArgumentsCount));
    2157          56 :   TNode<Context> context = CAST(Parameter(Descriptor::kContext));
    2158             : 
    2159          56 :   Generate(String::kTrimStart, "String.prototype.trimLeft", argc, context);
    2160          56 : }
    2161             : 
    2162             : // https://github.com/tc39/proposal-string-left-right-trim
    2163         336 : TF_BUILTIN(StringPrototypeTrimEnd, StringTrimAssembler) {
    2164             :   TNode<IntPtrT> argc =
    2165          56 :       ChangeInt32ToIntPtr(Parameter(Descriptor::kJSActualArgumentsCount));
    2166          56 :   TNode<Context> context = CAST(Parameter(Descriptor::kContext));
    2167             : 
    2168          56 :   Generate(String::kTrimEnd, "String.prototype.trimRight", argc, context);
    2169          56 : }
    2170             : 
    2171         168 : void StringTrimAssembler::Generate(String::TrimMode mode,
    2172             :                                    const char* method_name, TNode<IntPtrT> argc,
    2173             :                                    TNode<Context> context) {
    2174         336 :   Label return_emptystring(this), if_runtime(this);
    2175             : 
    2176         168 :   CodeStubArguments arguments(this, argc);
    2177         168 :   Node* const receiver = arguments.GetReceiver();
    2178             : 
    2179             :   // Check that {receiver} is coercible to Object and convert it to a String.
    2180         168 :   TNode<String> const string = ToThisString(context, receiver, method_name);
    2181         168 :   TNode<IntPtrT> const string_length = LoadStringLengthAsWord(string);
    2182             : 
    2183         336 :   ToDirectStringAssembler to_direct(state(), string);
    2184         168 :   to_direct.TryToDirect(&if_runtime);
    2185         168 :   Node* const string_data = to_direct.PointerToData(&if_runtime);
    2186         168 :   Node* const instance_type = to_direct.instance_type();
    2187         168 :   Node* const is_stringonebyte = IsOneByteStringInstanceType(instance_type);
    2188         168 :   Node* const string_data_offset = to_direct.offset();
    2189             : 
    2190         336 :   TVARIABLE(IntPtrT, var_start, IntPtrConstant(0));
    2191         336 :   TVARIABLE(IntPtrT, var_end, IntPtrSub(string_length, IntPtrConstant(1)));
    2192             : 
    2193         168 :   if (mode == String::kTrimStart || mode == String::kTrim) {
    2194             :     ScanForNonWhiteSpaceOrLineTerminator(string_data, string_data_offset,
    2195             :                                          is_stringonebyte, &var_start,
    2196         112 :                                          string_length, 1, &return_emptystring);
    2197             :   }
    2198         168 :   if (mode == String::kTrimEnd || mode == String::kTrim) {
    2199             :     ScanForNonWhiteSpaceOrLineTerminator(
    2200             :         string_data, string_data_offset, is_stringonebyte, &var_end,
    2201         112 :         IntPtrConstant(-1), -1, &return_emptystring);
    2202             :   }
    2203             : 
    2204             :   arguments.PopAndReturn(
    2205             :       SubString(string, var_start.value(),
    2206         168 :                 IntPtrAdd(var_end.value(), IntPtrConstant(1))));
    2207             : 
    2208         168 :   BIND(&if_runtime);
    2209             :   arguments.PopAndReturn(
    2210         168 :       CallRuntime(Runtime::kStringTrim, context, string, SmiConstant(mode)));
    2211             : 
    2212         168 :   BIND(&return_emptystring);
    2213         336 :   arguments.PopAndReturn(EmptyStringConstant());
    2214         168 : }
    2215             : 
    2216         224 : void StringTrimAssembler::ScanForNonWhiteSpaceOrLineTerminator(
    2217             :     Node* const string_data, Node* const string_data_offset,
    2218             :     Node* const is_stringonebyte, Variable* const var_index, Node* const end,
    2219             :     int increment, Label* const if_none_found) {
    2220         448 :   Label if_stringisonebyte(this), out(this);
    2221             : 
    2222         224 :   GotoIf(is_stringonebyte, &if_stringisonebyte);
    2223             : 
    2224             :   // Two Byte String
    2225             :   BuildLoop(
    2226         224 :       var_index, end, increment, if_none_found, &out, [&](Node* const index) {
    2227             :         return Load(
    2228             :             MachineType::Uint16(), string_data,
    2229         448 :             WordShl(IntPtrAdd(index, string_data_offset), IntPtrConstant(1)));
    2230         672 :       });
    2231             : 
    2232         224 :   BIND(&if_stringisonebyte);
    2233             :   BuildLoop(var_index, end, increment, if_none_found, &out,
    2234         224 :             [&](Node* const index) {
    2235             :               return Load(MachineType::Uint8(), string_data,
    2236         448 :                           IntPtrAdd(index, string_data_offset));
    2237         672 :             });
    2238             : 
    2239         448 :   BIND(&out);
    2240         224 : }
    2241             : 
    2242         448 : void StringTrimAssembler::BuildLoop(
    2243             :     Variable* const var_index, Node* const end, int increment,
    2244             :     Label* const if_none_found, Label* const out,
    2245             :     const std::function<Node*(Node*)>& get_character) {
    2246         448 :   Label loop(this, var_index);
    2247         448 :   Goto(&loop);
    2248         448 :   BIND(&loop);
    2249             :   {
    2250         448 :     Node* const index = var_index->value();
    2251         448 :     GotoIf(IntPtrEqual(index, end), if_none_found);
    2252             :     GotoIfNotWhiteSpaceOrLineTerminator(
    2253         448 :         UncheckedCast<Uint32T>(get_character(index)), out);
    2254         448 :     Increment(var_index, increment);
    2255         448 :     Goto(&loop);
    2256         448 :   }
    2257         448 : }
    2258             : 
    2259         452 : void StringTrimAssembler::GotoIfNotWhiteSpaceOrLineTerminator(
    2260             :     Node* const char_code, Label* const if_not_whitespace) {
    2261         452 :   Label out(this);
    2262             : 
    2263             :   // 0x0020 - SPACE (Intentionally out of order to fast path a commmon case)
    2264         452 :   GotoIf(Word32Equal(char_code, Int32Constant(0x0020)), &out);
    2265             : 
    2266             :   // 0x0009 - HORIZONTAL TAB
    2267         452 :   GotoIf(Uint32LessThan(char_code, Int32Constant(0x0009)), if_not_whitespace);
    2268             :   // 0x000A - LINE FEED OR NEW LINE
    2269             :   // 0x000B - VERTICAL TAB
    2270             :   // 0x000C - FORMFEED
    2271             :   // 0x000D - HORIZONTAL TAB
    2272         452 :   GotoIf(Uint32LessThanOrEqual(char_code, Int32Constant(0x000D)), &out);
    2273             : 
    2274             :   // Common Non-whitespace characters
    2275         452 :   GotoIf(Uint32LessThan(char_code, Int32Constant(0x00A0)), if_not_whitespace);
    2276             : 
    2277             :   // 0x00A0 - NO-BREAK SPACE
    2278         452 :   GotoIf(Word32Equal(char_code, Int32Constant(0x00A0)), &out);
    2279             : 
    2280             :   // 0x1680 - Ogham Space Mark
    2281         452 :   GotoIf(Word32Equal(char_code, Int32Constant(0x1680)), &out);
    2282             : 
    2283             :   // 0x2000 - EN QUAD
    2284         452 :   GotoIf(Uint32LessThan(char_code, Int32Constant(0x2000)), if_not_whitespace);
    2285             :   // 0x2001 - EM QUAD
    2286             :   // 0x2002 - EN SPACE
    2287             :   // 0x2003 - EM SPACE
    2288             :   // 0x2004 - THREE-PER-EM SPACE
    2289             :   // 0x2005 - FOUR-PER-EM SPACE
    2290             :   // 0x2006 - SIX-PER-EM SPACE
    2291             :   // 0x2007 - FIGURE SPACE
    2292             :   // 0x2008 - PUNCTUATION SPACE
    2293             :   // 0x2009 - THIN SPACE
    2294             :   // 0x200A - HAIR SPACE
    2295         452 :   GotoIf(Uint32LessThanOrEqual(char_code, Int32Constant(0x200A)), &out);
    2296             : 
    2297             :   // 0x2028 - LINE SEPARATOR
    2298         452 :   GotoIf(Word32Equal(char_code, Int32Constant(0x2028)), &out);
    2299             :   // 0x2029 - PARAGRAPH SEPARATOR
    2300         452 :   GotoIf(Word32Equal(char_code, Int32Constant(0x2029)), &out);
    2301             :   // 0x202F - NARROW NO-BREAK SPACE
    2302         452 :   GotoIf(Word32Equal(char_code, Int32Constant(0x202F)), &out);
    2303             :   // 0x205F - MEDIUM MATHEMATICAL SPACE
    2304         452 :   GotoIf(Word32Equal(char_code, Int32Constant(0x205F)), &out);
    2305             :   // 0xFEFF - BYTE ORDER MARK
    2306         452 :   GotoIf(Word32Equal(char_code, Int32Constant(0xFEFF)), &out);
    2307             :   // 0x3000 - IDEOGRAPHIC SPACE
    2308         904 :   Branch(Word32Equal(char_code, Int32Constant(0x3000)), &out,
    2309         452 :          if_not_whitespace);
    2310             : 
    2311         452 :   BIND(&out);
    2312         452 : }
    2313             : 
    2314             : // ES6 #sec-string.prototype.tostring
    2315         336 : TF_BUILTIN(StringPrototypeToString, CodeStubAssembler) {
    2316          56 :   Node* context = Parameter(Descriptor::kContext);
    2317          56 :   Node* receiver = Parameter(Descriptor::kReceiver);
    2318             : 
    2319             :   Node* result = ToThisValue(context, receiver, PrimitiveType::kString,
    2320          56 :                              "String.prototype.toString");
    2321          56 :   Return(result);
    2322          56 : }
    2323             : 
    2324             : // ES6 #sec-string.prototype.valueof
    2325         336 : TF_BUILTIN(StringPrototypeValueOf, CodeStubAssembler) {
    2326          56 :   Node* context = Parameter(Descriptor::kContext);
    2327          56 :   Node* receiver = Parameter(Descriptor::kReceiver);
    2328             : 
    2329             :   Node* result = ToThisValue(context, receiver, PrimitiveType::kString,
    2330          56 :                              "String.prototype.valueOf");
    2331          56 :   Return(result);
    2332          56 : }
    2333             : 
    2334         336 : TF_BUILTIN(StringPrototypeIterator, CodeStubAssembler) {
    2335          56 :   Node* context = Parameter(Descriptor::kContext);
    2336          56 :   Node* receiver = Parameter(Descriptor::kReceiver);
    2337             : 
    2338             :   Node* string =
    2339          56 :       ToThisString(context, receiver, "String.prototype[Symbol.iterator]");
    2340             : 
    2341          56 :   Node* native_context = LoadNativeContext(context);
    2342             :   Node* map = LoadContextElement(native_context,
    2343          56 :                                  Context::INITIAL_STRING_ITERATOR_MAP_INDEX);
    2344          56 :   Node* iterator = Allocate(JSStringIterator::kSize);
    2345          56 :   StoreMapNoWriteBarrier(iterator, map);
    2346             :   StoreObjectFieldRoot(iterator, JSValue::kPropertiesOrHashOffset,
    2347          56 :                        RootIndex::kEmptyFixedArray);
    2348             :   StoreObjectFieldRoot(iterator, JSObject::kElementsOffset,
    2349          56 :                        RootIndex::kEmptyFixedArray);
    2350             :   StoreObjectFieldNoWriteBarrier(iterator, JSStringIterator::kStringOffset,
    2351          56 :                                  string);
    2352          56 :   Node* index = SmiConstant(0);
    2353             :   StoreObjectFieldNoWriteBarrier(iterator, JSStringIterator::kNextIndexOffset,
    2354          56 :                                  index);
    2355          56 :   Return(iterator);
    2356          56 : }
    2357             : 
    2358             : // Return the |word32| codepoint at {index}. Supports SeqStrings and
    2359             : // ExternalStrings.
    2360         280 : TNode<Int32T> StringBuiltinsAssembler::LoadSurrogatePairAt(
    2361             :     SloppyTNode<String> string, SloppyTNode<IntPtrT> length,
    2362             :     SloppyTNode<IntPtrT> index, UnicodeEncoding encoding) {
    2363         560 :   Label handle_surrogate_pair(this), return_result(this);
    2364         560 :   TVARIABLE(Int32T, var_result);
    2365         560 :   TVARIABLE(Int32T, var_trail);
    2366         280 :   var_result = StringCharCodeAt(string, index);
    2367         280 :   var_trail = Int32Constant(0);
    2368             : 
    2369         560 :   GotoIf(Word32NotEqual(Word32And(var_result.value(), Int32Constant(0xFC00)),
    2370        1120 :                         Int32Constant(0xD800)),
    2371         280 :          &return_result);
    2372         280 :   TNode<IntPtrT> next_index = IntPtrAdd(index, IntPtrConstant(1));
    2373             : 
    2374         280 :   GotoIfNot(IntPtrLessThan(next_index, length), &return_result);
    2375         280 :   var_trail = StringCharCodeAt(string, next_index);
    2376         560 :   Branch(Word32Equal(Word32And(var_trail.value(), Int32Constant(0xFC00)),
    2377        1120 :                      Int32Constant(0xDC00)),
    2378         280 :          &handle_surrogate_pair, &return_result);
    2379             : 
    2380         280 :   BIND(&handle_surrogate_pair);
    2381             :   {
    2382         280 :     TNode<Int32T> lead = var_result.value();
    2383         280 :     TNode<Int32T> trail = var_trail.value();
    2384             : 
    2385             :     // Check that this path is only taken if a surrogate pair is found
    2386             :     CSA_SLOW_ASSERT(this,
    2387             :                     Uint32GreaterThanOrEqual(lead, Int32Constant(0xD800)));
    2388             :     CSA_SLOW_ASSERT(this, Uint32LessThan(lead, Int32Constant(0xDC00)));
    2389             :     CSA_SLOW_ASSERT(this,
    2390             :                     Uint32GreaterThanOrEqual(trail, Int32Constant(0xDC00)));
    2391             :     CSA_SLOW_ASSERT(this, Uint32LessThan(trail, Int32Constant(0xE000)));
    2392             : 
    2393         280 :     switch (encoding) {
    2394             :       case UnicodeEncoding::UTF16:
    2395         672 :         var_result = Signed(Word32Or(
    2396             : // Need to swap the order for big-endian platforms
    2397             : #if V8_TARGET_BIG_ENDIAN
    2398             :             Word32Shl(lead, Int32Constant(16)), trail));
    2399             : #else
    2400         504 :             Word32Shl(trail, Int32Constant(16)), lead));
    2401             : #endif
    2402         168 :         break;
    2403             : 
    2404             :       case UnicodeEncoding::UTF32: {
    2405             :         // Convert UTF16 surrogate pair into |word32| code point, encoded as
    2406             :         // UTF32.
    2407             :         TNode<Int32T> surrogate_offset =
    2408         112 :             Int32Constant(0x10000 - (0xD800 << 10) - 0xDC00);
    2409             : 
    2410             :         // (lead << 10) + trail + SURROGATE_OFFSET
    2411         224 :         var_result = Signed(Int32Add(Word32Shl(lead, Int32Constant(10)),
    2412         224 :                                      Int32Add(trail, surrogate_offset)));
    2413         112 :         break;
    2414             :       }
    2415             :     }
    2416         280 :     Goto(&return_result);
    2417             :   }
    2418             : 
    2419         280 :   BIND(&return_result);
    2420         560 :   return var_result.value();
    2421             : }
    2422             : 
    2423             : // ES6 #sec-%stringiteratorprototype%.next
    2424         336 : TF_BUILTIN(StringIteratorPrototypeNext, StringBuiltinsAssembler) {
    2425          56 :   VARIABLE(var_value, MachineRepresentation::kTagged);
    2426         112 :   VARIABLE(var_done, MachineRepresentation::kTagged);
    2427             : 
    2428          56 :   var_value.Bind(UndefinedConstant());
    2429          56 :   var_done.Bind(TrueConstant());
    2430             : 
    2431         112 :   Label throw_bad_receiver(this), next_codepoint(this), return_result(this);
    2432             : 
    2433          56 :   Node* context = Parameter(Descriptor::kContext);
    2434          56 :   Node* iterator = Parameter(Descriptor::kReceiver);
    2435             : 
    2436          56 :   GotoIf(TaggedIsSmi(iterator), &throw_bad_receiver);
    2437             :   GotoIfNot(
    2438         112 :       InstanceTypeEqual(LoadInstanceType(iterator), JS_STRING_ITERATOR_TYPE),
    2439          56 :       &throw_bad_receiver);
    2440             : 
    2441          56 :   Node* string = LoadObjectField(iterator, JSStringIterator::kStringOffset);
    2442             :   TNode<IntPtrT> position = SmiUntag(
    2443          56 :       CAST(LoadObjectField(iterator, JSStringIterator::kNextIndexOffset)));
    2444          56 :   TNode<IntPtrT> length = LoadStringLengthAsWord(string);
    2445             : 
    2446          56 :   Branch(IntPtrLessThan(position, length), &next_codepoint, &return_result);
    2447             : 
    2448          56 :   BIND(&next_codepoint);
    2449             :   {
    2450          56 :     UnicodeEncoding encoding = UnicodeEncoding::UTF16;
    2451          56 :     TNode<Int32T> ch = LoadSurrogatePairAt(string, length, position, encoding);
    2452          56 :     TNode<String> value = StringFromSingleCodePoint(ch, encoding);
    2453          56 :     var_value.Bind(value);
    2454          56 :     TNode<IntPtrT> length = LoadStringLengthAsWord(value);
    2455             :     StoreObjectFieldNoWriteBarrier(iterator, JSStringIterator::kNextIndexOffset,
    2456          56 :                                    SmiTag(Signed(IntPtrAdd(position, length))));
    2457          56 :     var_done.Bind(FalseConstant());
    2458          56 :     Goto(&return_result);
    2459             :   }
    2460             : 
    2461          56 :   BIND(&return_result);
    2462             :   {
    2463             :     Node* result =
    2464          56 :         AllocateJSIteratorResult(context, var_value.value(), var_done.value());
    2465          56 :     Return(result);
    2466             :   }
    2467             : 
    2468          56 :   BIND(&throw_bad_receiver);
    2469             :   {
    2470             :     // The {receiver} is not a valid JSGeneratorObject.
    2471             :     ThrowTypeError(context, MessageTemplate::kIncompatibleMethodReceiver,
    2472          56 :                    StringConstant("String Iterator.prototype.next"), iterator);
    2473          56 :   }
    2474          56 : }
    2475             : 
    2476         112 : void StringBuiltinsAssembler::BranchIfStringPrimitiveWithNoCustomIteration(
    2477             :     TNode<Object> object, TNode<Context> context, Label* if_true,
    2478             :     Label* if_false) {
    2479         112 :   GotoIf(TaggedIsSmi(object), if_false);
    2480         112 :   GotoIfNot(IsString(CAST(object)), if_false);
    2481             : 
    2482             :   // Check that the String iterator hasn't been modified in a way that would
    2483             :   // affect iteration.
    2484         112 :   Node* protector_cell = LoadRoot(RootIndex::kStringIteratorProtector);
    2485             :   DCHECK(isolate()->heap()->string_iterator_protector()->IsPropertyCell());
    2486             :   Branch(WordEqual(LoadObjectField(protector_cell, PropertyCell::kValueOffset),
    2487         224 :                    SmiConstant(Isolate::kProtectorValid)),
    2488         112 :          if_true, if_false);
    2489         112 : }
    2490             : 
    2491             : // This function assumes StringPrimitiveWithNoCustomIteration is true.
    2492          56 : TNode<JSArray> StringBuiltinsAssembler::StringToList(TNode<Context> context,
    2493             :                                                      TNode<String> string) {
    2494          56 :   const ElementsKind kind = PACKED_ELEMENTS;
    2495          56 :   const TNode<IntPtrT> length = LoadStringLengthAsWord(string);
    2496             : 
    2497             :   TNode<Map> array_map =
    2498          56 :       LoadJSArrayElementsMap(kind, LoadNativeContext(context));
    2499             :   TNode<JSArray> array =
    2500             :       AllocateJSArray(kind, array_map, length, SmiTag(length), nullptr,
    2501          56 :                       INTPTR_PARAMETERS, kAllowLargeObjectAllocation);
    2502          56 :   TNode<FixedArrayBase> elements = LoadElements(array);
    2503             : 
    2504          56 :   const int first_element_offset = FixedArray::kHeaderSize - kHeapObjectTag;
    2505             :   TNode<IntPtrT> first_to_element_offset =
    2506          56 :       ElementOffsetFromIndex(IntPtrConstant(0), kind, INTPTR_PARAMETERS, 0);
    2507             :   TNode<IntPtrT> first_offset =
    2508          56 :       IntPtrAdd(first_to_element_offset, IntPtrConstant(first_element_offset));
    2509          56 :   TVARIABLE(IntPtrT, var_offset, first_offset);
    2510         112 :   TVARIABLE(IntPtrT, var_position, IntPtrConstant(0));
    2511         112 :   Label done(this), next_codepoint(this, {&var_position, &var_offset});
    2512             : 
    2513          56 :   Goto(&next_codepoint);
    2514             : 
    2515          56 :   BIND(&next_codepoint);
    2516             :   {
    2517             :     // Loop condition.
    2518          56 :     GotoIfNot(IntPtrLessThan(var_position.value(), length), &done);
    2519          56 :     const UnicodeEncoding encoding = UnicodeEncoding::UTF16;
    2520             :     TNode<Int32T> ch =
    2521          56 :         LoadSurrogatePairAt(string, length, var_position.value(), encoding);
    2522          56 :     TNode<String> value = StringFromSingleCodePoint(ch, encoding);
    2523             : 
    2524          56 :     Store(elements, var_offset.value(), value);
    2525             : 
    2526             :     // Increment the position.
    2527          56 :     TNode<IntPtrT> ch_length = LoadStringLengthAsWord(value);
    2528          56 :     var_position = IntPtrAdd(var_position.value(), ch_length);
    2529             :     // Increment the array offset and continue the loop.
    2530          56 :     var_offset = IntPtrAdd(var_offset.value(), IntPtrConstant(kTaggedSize));
    2531          56 :     Goto(&next_codepoint);
    2532             :   }
    2533             : 
    2534          56 :   BIND(&done);
    2535             :   TNode<IntPtrT> new_length = IntPtrDiv(
    2536          56 :       IntPtrSub(var_offset.value(), first_offset), IntPtrConstant(kTaggedSize));
    2537             :   CSA_ASSERT(this, IntPtrGreaterThanOrEqual(new_length, IntPtrConstant(0)));
    2538             :   CSA_ASSERT(this, IntPtrGreaterThanOrEqual(length, new_length));
    2539             :   StoreObjectFieldNoWriteBarrier(array, JSArray::kLengthOffset,
    2540          56 :                                  SmiTag(new_length));
    2541             : 
    2542         112 :   return UncheckedCast<JSArray>(array);
    2543             : }
    2544             : 
    2545         336 : TF_BUILTIN(StringToList, StringBuiltinsAssembler) {
    2546          56 :   TNode<Context> context = CAST(Parameter(Descriptor::kContext));
    2547          56 :   TNode<String> string = CAST(Parameter(Descriptor::kSource));
    2548          56 :   Return(StringToList(context, string));
    2549          56 : }
    2550             : 
    2551             : // -----------------------------------------------------------------------------
    2552             : // ES6 section B.2.3 Additional Properties of the String.prototype object
    2553             : 
    2554         728 : class StringHtmlAssembler : public StringBuiltinsAssembler {
    2555             :  public:
    2556         728 :   explicit StringHtmlAssembler(compiler::CodeAssemblerState* state)
    2557         728 :       : StringBuiltinsAssembler(state) {}
    2558             : 
    2559             :  protected:
    2560         504 :   void Generate(Node* const context, Node* const receiver,
    2561             :                 const char* method_name, const char* tag_name) {
    2562         504 :     Node* const string = ToThisString(context, receiver, method_name);
    2563         504 :     std::string open_tag = "<" + std::string(tag_name) + ">";
    2564        1008 :     std::string close_tag = "</" + std::string(tag_name) + ">";
    2565             : 
    2566         504 :     Node* strings[] = {StringConstant(open_tag.c_str()), string,
    2567         504 :                        StringConstant(close_tag.c_str())};
    2568        1008 :     Return(ConcatStrings(context, strings, arraysize(strings)));
    2569         504 :   }
    2570             : 
    2571         224 :   void GenerateWithAttribute(Node* const context, Node* const receiver,
    2572             :                              const char* method_name, const char* tag_name,
    2573             :                              const char* attr, Node* const value) {
    2574         224 :     Node* const string = ToThisString(context, receiver, method_name);
    2575             :     TNode<String> value_string =
    2576         224 :         EscapeQuotes(CAST(context), ToString_Inline(context, value));
    2577             :     std::string open_tag_attr =
    2578         224 :         "<" + std::string(tag_name) + " " + std::string(attr) + "=\"";
    2579         448 :     std::string close_tag = "</" + std::string(tag_name) + ">";
    2580             : 
    2581         224 :     Node* strings[] = {StringConstant(open_tag_attr.c_str()), value_string,
    2582         224 :                        StringConstant("\">"), string,
    2583         448 :                        StringConstant(close_tag.c_str())};
    2584         448 :     Return(ConcatStrings(context, strings, arraysize(strings)));
    2585         224 :   }
    2586             : 
    2587         728 :   Node* ConcatStrings(Node* const context, Node** strings, int len) {
    2588         728 :     VARIABLE(var_result, MachineRepresentation::kTagged, strings[0]);
    2589        2632 :     for (int i = 1; i < len; i++) {
    2590             :       var_result.Bind(CallStub(CodeFactory::StringAdd(isolate()), context,
    2591        1904 :                                var_result.value(), strings[i]));
    2592             :     }
    2593         728 :     return var_result.value();
    2594             :   }
    2595             : 
    2596         224 :   TNode<String> EscapeQuotes(TNode<Context> context, TNode<String> string) {
    2597         224 :     return CAST(CallRuntime(Runtime::kStringEscapeQuotes, context, string));
    2598             :   }
    2599             : };
    2600             : 
    2601             : // ES6 #sec-string.prototype.anchor
    2602         392 : TF_BUILTIN(StringPrototypeAnchor, StringHtmlAssembler) {
    2603          56 :   Node* const context = Parameter(Descriptor::kContext);
    2604          56 :   Node* const receiver = Parameter(Descriptor::kReceiver);
    2605          56 :   Node* const value = Parameter(Descriptor::kValue);
    2606             :   GenerateWithAttribute(context, receiver, "String.prototype.anchor", "a",
    2607          56 :                         "name", value);
    2608          56 : }
    2609             : 
    2610             : // ES6 #sec-string.prototype.big
    2611         336 : TF_BUILTIN(StringPrototypeBig, StringHtmlAssembler) {
    2612          56 :   Node* const context = Parameter(Descriptor::kContext);
    2613          56 :   Node* const receiver = Parameter(Descriptor::kReceiver);
    2614          56 :   Generate(context, receiver, "String.prototype.big", "big");
    2615          56 : }
    2616             : 
    2617             : // ES6 #sec-string.prototype.blink
    2618         336 : TF_BUILTIN(StringPrototypeBlink, StringHtmlAssembler) {
    2619          56 :   Node* const context = Parameter(Descriptor::kContext);
    2620          56 :   Node* const receiver = Parameter(Descriptor::kReceiver);
    2621          56 :   Generate(context, receiver, "String.prototype.blink", "blink");
    2622          56 : }
    2623             : 
    2624             : // ES6 #sec-string.prototype.bold
    2625         336 : TF_BUILTIN(StringPrototypeBold, StringHtmlAssembler) {
    2626          56 :   Node* const context = Parameter(Descriptor::kContext);
    2627          56 :   Node* const receiver = Parameter(Descriptor::kReceiver);
    2628          56 :   Generate(context, receiver, "String.prototype.bold", "b");
    2629          56 : }
    2630             : 
    2631             : // ES6 #sec-string.prototype.fontcolor
    2632         392 : TF_BUILTIN(StringPrototypeFontcolor, StringHtmlAssembler) {
    2633          56 :   Node* const context = Parameter(Descriptor::kContext);
    2634          56 :   Node* const receiver = Parameter(Descriptor::kReceiver);
    2635          56 :   Node* const value = Parameter(Descriptor::kValue);
    2636             :   GenerateWithAttribute(context, receiver, "String.prototype.fontcolor", "font",
    2637          56 :                         "color", value);
    2638          56 : }
    2639             : 
    2640             : // ES6 #sec-string.prototype.fontsize
    2641         392 : TF_BUILTIN(StringPrototypeFontsize, StringHtmlAssembler) {
    2642          56 :   Node* const context = Parameter(Descriptor::kContext);
    2643          56 :   Node* const receiver = Parameter(Descriptor::kReceiver);
    2644          56 :   Node* const value = Parameter(Descriptor::kValue);
    2645             :   GenerateWithAttribute(context, receiver, "String.prototype.fontsize", "font",
    2646          56 :                         "size", value);
    2647          56 : }
    2648             : 
    2649             : // ES6 #sec-string.prototype.fixed
    2650         336 : TF_BUILTIN(StringPrototypeFixed, StringHtmlAssembler) {
    2651          56 :   Node* const context = Parameter(Descriptor::kContext);
    2652          56 :   Node* const receiver = Parameter(Descriptor::kReceiver);
    2653          56 :   Generate(context, receiver, "String.prototype.fixed", "tt");
    2654          56 : }
    2655             : 
    2656             : // ES6 #sec-string.prototype.italics
    2657         336 : TF_BUILTIN(StringPrototypeItalics, StringHtmlAssembler) {
    2658          56 :   Node* const context = Parameter(Descriptor::kContext);
    2659          56 :   Node* const receiver = Parameter(Descriptor::kReceiver);
    2660          56 :   Generate(context, receiver, "String.prototype.italics", "i");
    2661          56 : }
    2662             : 
    2663             : // ES6 #sec-string.prototype.link
    2664         392 : TF_BUILTIN(StringPrototypeLink, StringHtmlAssembler) {
    2665          56 :   Node* const context = Parameter(Descriptor::kContext);
    2666          56 :   Node* const receiver = Parameter(Descriptor::kReceiver);
    2667          56 :   Node* const value = Parameter(Descriptor::kValue);
    2668             :   GenerateWithAttribute(context, receiver, "String.prototype.link", "a", "href",
    2669          56 :                         value);
    2670          56 : }
    2671             : 
    2672             : // ES6 #sec-string.prototype.small
    2673         336 : TF_BUILTIN(StringPrototypeSmall, StringHtmlAssembler) {
    2674          56 :   Node* const context = Parameter(Descriptor::kContext);
    2675          56 :   Node* const receiver = Parameter(Descriptor::kReceiver);
    2676          56 :   Generate(context, receiver, "String.prototype.small", "small");
    2677          56 : }
    2678             : 
    2679             : // ES6 #sec-string.prototype.strike
    2680         336 : TF_BUILTIN(StringPrototypeStrike, StringHtmlAssembler) {
    2681          56 :   Node* const context = Parameter(Descriptor::kContext);
    2682          56 :   Node* const receiver = Parameter(Descriptor::kReceiver);
    2683          56 :   Generate(context, receiver, "String.prototype.strike", "strike");
    2684          56 : }
    2685             : 
    2686             : // ES6 #sec-string.prototype.sub
    2687         336 : TF_BUILTIN(StringPrototypeSub, StringHtmlAssembler) {
    2688          56 :   Node* const context = Parameter(Descriptor::kContext);
    2689          56 :   Node* const receiver = Parameter(Descriptor::kReceiver);
    2690          56 :   Generate(context, receiver, "String.prototype.sub", "sub");
    2691          56 : }
    2692             : 
    2693             : // ES6 #sec-string.prototype.sup
    2694         336 : TF_BUILTIN(StringPrototypeSup, StringHtmlAssembler) {
    2695          56 :   Node* const context = Parameter(Descriptor::kContext);
    2696          56 :   Node* const receiver = Parameter(Descriptor::kReceiver);
    2697          56 :   Generate(context, receiver, "String.prototype.sup", "sup");
    2698          56 : }
    2699             : 
    2700             : }  // namespace internal
    2701       86739 : }  // namespace v8

Generated by: LCOV version 1.10