[dart2js] Unmodifiable Array and typed data using flags

- Add SSA HArrayFlags{Check,Get,Set} instructions to check for
  fixed-length and unmodifiable JSArray and JavaScript typed data
  instances.

- Add optimizations to remove redundant checks.

- Added HOutputConstrained interface for instructions that must have
  the input and output in the same JavaScript variable. This
  generalizes some code generation logic already applied to HCheck.

Bug: #53785
Change-Id: I61750dd03aa3a964eed3bc76e1656c5f60f77109
Reviewed-on: https://dart-review.googlesource.com/c/sdk/+/372002
Commit-Queue: Stephen Adams <[email protected]>
Reviewed-by: Mayank Patke <[email protected]>

Author: rakudrama

pkg/compiler/lib/src/common/elements.dart

@@ -820,6 +820,9 @@ abstract class CommonElements {
   FunctionEntity get cyclicThrowHelper =>
       _findHelperFunction("throwCyclicInit");
 
+  FunctionEntity get throwUnsupportedOperation =>
+      _findHelperFunction('throwUnsupportedOperation');
+
   FunctionEntity get defineProperty => _findHelperFunction('defineProperty');
 
   FunctionEntity get throwLateFieldNI =>

pkg/compiler/lib/src/js_backend/namer.dart

@@ -2192,6 +2192,8 @@ class FixedNames {
 
   String get recordShapeRecipe => r'$recipe';
   String get recordShapeTag => r'$shape';
+
+  String get arrayFlagsPropertyName => r'$flags';
 }
 
 /// Minified version of the fixed names usage by the namer.

pkg/compiler/lib/src/js_emitter/interceptor_stub_generator.dart

@@ -4,6 +4,7 @@
 
 library dart2js.js_emitter.interceptor_stub_generator;
 
+import 'package:js_runtime/synced/array_flags.dart';
 import 'package:js_runtime/synced/embedded_names.dart' as embeddedNames;
 
 import '../common/elements.dart';
@@ -409,10 +410,14 @@ class InterceptorStubGenerator {
 
         return js.statement(r'''
           if (typeof a0 === "number")
-            if (# && !receiver.immutable$list &&
+            if (# && !(receiver.# & #) &&
                 (a0 >>> 0) === a0 && a0 < receiver.length)
               return receiver[a0] = a1;
-          ''', typeCheck);
+          ''', [
+          typeCheck,
+          _namer.fixedNames.arrayFlagsPropertyName,
+          js.number(ArrayFlags.unmodifiableCheck)
+        ]);
       }
     } else if (selector.isCall) {
       if (selector.name == 'abs' && selector.argumentCount == 0) {

pkg/compiler/lib/src/js_emitter/startup_emitter/fragment_emitter.dart

@@ -171,11 +171,7 @@ function lazyFinal(holder, name, getterName, initializer) {
 //
 // The runtime ensures that const-lists cannot be modified.
 function makeConstList(list) {
-  // By assigning a function to the properties they become part of the
-  // hidden class. The actual values of the fields don't matter, since we
-  // only check if they exist.
-  list.immutable\$list = Array;
-  list.fixed\$length = Array;
+  list.#arrayFlagsProperty = ${ArrayFlags.constant};
   return list;
 }
 
@@ -675,6 +671,7 @@ class FragmentEmitter {
       'directAccessTestExpression': js.js(_directAccessTestExpression),
       'throwLateFieldADI': _emitter
           .staticFunctionAccess(_closedWorld.commonElements.throwLateFieldADI),
+      'arrayFlagsProperty': js.string(_namer.fixedNames.arrayFlagsPropertyName),
       'operatorIsPrefix': js.string(_namer.fixedNames.operatorIsPrefix),
       'tearOffCode': js.Block(
           buildTearOffCode(_options, _emitter, _closedWorld.commonElements)),

pkg/compiler/lib/src/js_emitter/startup_emitter/model_emitter.dart

@@ -6,6 +6,8 @@ library dart2js.js_emitter.startup_emitter.model_emitter;
 
 import 'dart:convert' show JsonEncoder;
 
+import 'package:js_runtime/synced/array_flags.dart' show ArrayFlags;
+
 import 'package:js_runtime/synced/embedded_names.dart'
     show
         DEFERRED_INITIALIZED,
@@ -35,6 +37,7 @@ import 'package:js_shared/synced/embedded_names.dart'
         RTI_UNIVERSE,
         RtiUniverseFieldNames,
         TYPES;
+
 import 'package:js_shared/variance.dart';
 
 import 'package:js_ast/src/precedence.dart' as js_precedence;

pkg/compiler/lib/src/kernel/dart2js_target.dart

@@ -255,6 +255,7 @@ const implicitlyUsedLibraries = <String>[
 // compile-platform should just specify which libraries to compile instead.
 const requiredLibraries = <String, List<String>>{
   'dart2js': [
+    'dart:_array_flags',
     'dart:_async_status_codes',
     'dart:_dart2js_only',
     'dart:_dart2js_runtime_metrics',
@@ -297,6 +298,7 @@ const requiredLibraries = <String, List<String>>{
     'dart:web_gl',
   ],
   'dart2js_server': [
+    'dart:_array_flags',
     'dart:_async_status_codes',
     'dart:_dart2js_only',
     'dart:_dart2js_runtime_metrics',

pkg/compiler/lib/src/ssa/builder.dart

@@ -4631,6 +4631,12 @@ class KernelSsaGraphBuilder extends ir.VisitorDefault<void>
       _handleLateInitializeOnceCheck(invocation, sourceInformation);
     } else if (name == 'HCharCodeAt') {
       _handleCharCodeAt(invocation, sourceInformation);
+    } else if (name == 'HArrayFlagsGet') {
+      _handleArrayFlagsGet(invocation, sourceInformation);
+    } else if (name == 'HArrayFlagsSet') {
+      _handleArrayFlagsSet(invocation, sourceInformation);
+    } else if (name == 'HArrayFlagsCheck') {
+      _handleArrayFlagsCheck(invocation, sourceInformation);
     } else {
       reporter.internalError(
           _elementMap.getSpannable(targetElement, invocation),
@@ -5372,6 +5378,73 @@ class KernelSsaGraphBuilder extends ir.VisitorDefault<void>
       ..sourceInformation = sourceInformation);
   }
 
+  void _handleArrayFlagsGet(
+      ir.StaticInvocation invocation, SourceInformation? sourceInformation) {
+    if (_unexpectedForeignArguments(invocation,
+        minPositional: 1, maxPositional: 1)) {
+      // Result expected on stack.
+      stack.add(graph.addConstantNull(closedWorld));
+      return;
+    }
+    List<HInstruction> inputs = _visitPositionalArguments(invocation.arguments);
+    final array = inputs.single;
+
+    push(HArrayFlagsGet(array, _abstractValueDomain.uint31Type)
+      ..sourceInformation = sourceInformation);
+  }
+
+  void _handleArrayFlagsSet(
+      ir.StaticInvocation invocation, SourceInformation? sourceInformation) {
+    if (_unexpectedForeignArguments(invocation,
+        minPositional: 2, maxPositional: 2, typeArgumentCount: 1)) {
+      // Result expected on stack.
+      stack.add(graph.addConstantNull(closedWorld));
+      return;
+    }
+
+    List<HInstruction> inputs = _visitPositionalArguments(invocation.arguments);
+    final array = inputs[0];
+    final flags = inputs[1];
+
+    // TODO(sra): Use the flags to improve in the AbstractValue, which may
+    // contain powerset domain bits outside of the conventional type
+    // system. Perhaps do this in types_propagation.
+    DartType type = _getDartTypeIfValid(invocation.arguments.types.single);
+    AbstractValue? instructionType = _typeBuilder.trustTypeMask(type);
+    // TODO(sra): Better type
+    instructionType ??= _abstractValueDomain.dynamicType;
+
+    push(HArrayFlagsSet(array, flags, instructionType)
+      ..sourceInformation = sourceInformation);
+  }
+
+  void _handleArrayFlagsCheck(
+      ir.StaticInvocation invocation, SourceInformation? sourceInformation) {
+    if (_unexpectedForeignArguments(invocation,
+        minPositional: 4, maxPositional: 4, typeArgumentCount: 1)) {
+      // Result expected on stack.
+      stack.add(graph.addConstantNull(closedWorld));
+      return;
+    }
+    List<HInstruction> inputs = _visitPositionalArguments(invocation.arguments);
+    final array = inputs[0];
+    final arrayFlags = inputs[1];
+    final checkFlags = inputs[2];
+    final operation = inputs[3];
+
+    // TODO(sra): Use the flags to improve in the AbstractValue, which may
+    // contain powerset domain bits outside of the conventional type
+    // system. Perhaps do this in types_propagation.
+    DartType type = _getDartTypeIfValid(invocation.arguments.types.single);
+    AbstractValue? instructionType = _typeBuilder.trustTypeMask(type);
+    // TODO(sra): Better type
+    instructionType ??= _abstractValueDomain.dynamicType;
+
+    push(HArrayFlagsCheck(
+        array, arrayFlags, checkFlags, operation, instructionType)
+      ..sourceInformation = sourceInformation);
+  }
+
   void _handleForeignTypeRef(
       ir.StaticInvocation invocation, SourceInformation? sourceInformation) {
     if (_unexpectedForeignArguments(invocation,

pkg/compiler/lib/src/ssa/codegen.dart

@@ -682,14 +682,15 @@ class SsaCodeGenerator implements HVisitor<void>, HBlockInformationVisitor {
     // emit an assignment, because the intTypeCheck just returns its
     // argument.
     bool needsAssignment = true;
-    if (instruction is HCheck) {
+    if (instruction is HOutputConstrainedToAnInput) {
       if (instruction is HPrimitiveCheck ||
           instruction is HAsCheck ||
           instruction is HAsCheckSimple ||
           instruction is HBoolConversion ||
           instruction is HNullCheck ||
-          instruction is HLateReadCheck) {
-        String? inputName = variableNames.getName(instruction.checkedInput);
+          instruction is HLateReadCheck ||
+          instruction is HArrayFlagsSet) {
+        String? inputName = variableNames.getName(instruction.constrainedInput);
         if (variableNames.getName(instruction) == inputName) {
           needsAssignment = false;
         }
@@ -715,9 +716,9 @@ class SsaCodeGenerator implements HVisitor<void>, HBlockInformationVisitor {
     }
   }
 
-  HInstruction skipGenerateAtUseCheckInputs(HCheck check) {
-    HInstruction input = check.checkedInput;
-    if (input is HCheck && isGenerateAtUseSite(input)) {
+  HInstruction skipGenerateAtUseCheckInputs(HOutputConstrainedToAnInput check) {
+    HInstruction input = check.constrainedInput;
+    if (input is HOutputConstrainedToAnInput && isGenerateAtUseSite(input)) {
       return skipGenerateAtUseCheckInputs(input);
     }
     return input;
@@ -726,7 +727,8 @@ class SsaCodeGenerator implements HVisitor<void>, HBlockInformationVisitor {
   void use(HInstruction argument) {
     if (isGenerateAtUseSite(argument)) {
       visitExpression(argument);
-    } else if (argument is HCheck && !variableNames.hasName(argument)) {
+    } else if (argument is HOutputConstrainedToAnInput &&
+        !variableNames.hasName(argument)) {
       // We have a check that is not generate-at-use and has no name, yet is a
       // subexpression (we are in 'use'). This happens when we have a chain of
       // checks on an available unnamed value (e.g. a constant). The checks are
@@ -737,11 +739,10 @@ class SsaCodeGenerator implements HVisitor<void>, HBlockInformationVisitor {
       // instruction has a name or is generate-at-use". This would require
       // naming the input or output of the chain-of-checks.
 
-      HCheck check = argument;
       // This can only happen if the checked node also does not have a name.
-      assert(!variableNames.hasName(check.checkedInput));
+      assert(!variableNames.hasName(argument.constrainedInput));
 
-      use(skipGenerateAtUseCheckInputs(check));
+      use(skipGenerateAtUseCheckInputs(argument));
     } else {
       assert(variableNames.hasName(argument));
       push(js.VariableUse(variableNames.getName(argument)!));
@@ -3441,4 +3442,69 @@ class SsaCodeGenerator implements HVisitor<void>, HBlockInformationVisitor {
     _metrics.countHIsLateSentinel++;
     _emitIsLateSentinel(node.inputs.single, node.sourceInformation);
   }
+
+  @override
+  void visitArrayFlagsGet(HArrayFlagsGet node) {
+    use(node.inputs.single);
+    js.Expression array = pop();
+    js.Expression flags =
+        js.js(r'#.#', [array, _namer.fixedNames.arrayFlagsPropertyName]);
+    if (isGenerateAtUseSite(node) && node.usedBy.single is HArrayFlagsCheck) {
+      // The enclosing expression will be an immediate `& mask`.
+      push(flags);
+    } else {
+      // The flags are reused, possibly hoisted, so force an `undefined` to be a
+      // small integer once rather than at each check.
+      push(js.js(r'# | 0', flags));
+    }
+  }
+
+  @override
+  void visitArrayFlagsSet(HArrayFlagsSet node) {
+    use(node.inputs[0]);
+    js.Expression array = pop();
+    use(node.inputs[1]);
+    js.Expression arrayFlags = pop();
+    pushStatement(js.js.statement(r'#.# = #;', [
+      array,
+      _namer.fixedNames.arrayFlagsPropertyName,
+      arrayFlags
+    ]).withSourceInformation(node.sourceInformation));
+  }
+
+  @override
+  void visitArrayFlagsCheck(HArrayFlagsCheck node) {
+    use(node.array);
+    js.Expression array = pop();
+
+    js.Expression? test;
+    if (!node.alwaysThrows()) {
+      use(node.arrayFlags);
+      js.Expression arrayFlags = pop();
+      use(node.checkFlags);
+      js.Expression checkFlags = pop();
+      test = js.js('# & #', [arrayFlags, checkFlags]);
+    }
+
+    final operation = node.operation;
+    // Most common operation is "[]=", so 'pass' that by leaving it out.
+    if (operation
+        case HConstant(constant: StringConstantValue(stringValue: '[]='))) {
+      _pushCallStatic(_commonElements.throwUnsupportedOperation, [array],
+          node.sourceInformation);
+    } else {
+      use(operation);
+      _pushCallStatic(_commonElements.throwUnsupportedOperation, [array, pop()],
+          node.sourceInformation);
+    }
+
+    js.Statement check;
+    if (test == null) {
+      check = js.js.statement('#;', pop());
+    } else {
+      check = js.js.statement('# && #;', [test, pop()]);
+    }
+
+    pushStatement(check.withSourceInformation(node.sourceInformation));
+  }
 }

pkg/compiler/lib/src/ssa/codegen_helpers.dart

@@ -1041,6 +1041,20 @@ class SsaInstructionMerger extends HBaseVisitor<void> implements CodegenPhase {
     }
   }
 
+  @override
+  void visitArrayFlagsSet(HArrayFlagsSet instruction) {
+    // Cannot generate-at-use the array input, it is an alias for the value of
+    // this instruction and need to be allocated to a variable.
+    analyzeInputs(instruction, 1);
+  }
+
+  @override
+  void visitArrayFlagsCheck(HArrayFlagsCheck instruction) {
+    // Cannot generate-at-use the array input, it is an alias for the value of
+    // this instruction and need to be allocated to a variable.
+    analyzeInputs(instruction, 1);
+  }
+
   void tryGenerateAtUseSite(HInstruction instruction) {
     if (instruction.isControlFlow()) return;
     markAsGenerateAtUseSite(instruction);

pkg/compiler/lib/src/ssa/invoke_dynamic_specializers.dart

@@ -2,6 +2,7 @@
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
+import 'package:js_runtime/synced/array_flags.dart' show ArrayFlags;
 import '../common/elements.dart' show JCommonElements;
 import '../constants/constant_system.dart' as constant_system;
 import '../constants/values.dart';
@@ -203,13 +204,23 @@ class IndexAssignSpecializer extends InvokeDynamicSpecializer {
       OptimizationTestLog? log) {
     HInstruction receiver = instruction.inputs[1];
     HInstruction index = instruction.inputs[2];
-    if (receiver
-        .isMutableIndexable(closedWorld.abstractValueDomain)
-        .isPotentiallyFalse) {
-      return null;
+    final abstractValueDomain = closedWorld.abstractValueDomain;
+
+    bool needsMutableCheck = false;
+    if (abstractValueDomain
+        .isTypedArray(receiver.instructionType)
+        .isDefinitelyTrue) {
+      needsMutableCheck = true;
+    } else if (receiver.isArray(abstractValueDomain).isDefinitelyTrue) {
+      needsMutableCheck =
+          receiver.isMutableArray(abstractValueDomain).isPotentiallyFalse;
+    } else {
+      if (receiver.isMutableIndexable(abstractValueDomain).isPotentiallyFalse) {
+        return null;
+      }
     }
     // TODO(johnniwinther): Merge this and the following if statement.
-    if (index.isInteger(closedWorld.abstractValueDomain).isPotentiallyFalse &&
+    if (index.isInteger(abstractValueDomain).isPotentiallyFalse &&
         // TODO(johnniwinther): Support annotations on the possible targets
         // and used their parameter check policy here.
         closedWorld.annotationsData.getParameterCheckPolicy(null).isEmitted) {
@@ -227,6 +238,24 @@ class IndexAssignSpecializer extends InvokeDynamicSpecializer {
       }
     }
 
+    if (needsMutableCheck) {
+      HInstruction getFlags =
+          HArrayFlagsGet(receiver, abstractValueDomain.uint31Type)
+            ..sourceInformation = instruction.sourceInformation;
+      instruction.block!.addBefore(instruction, getFlags);
+      HInstruction mask =
+          graph.addConstantInt(ArrayFlags.unmodifiableCheck, closedWorld);
+      HInstruction name = graph.addConstantString('[]=', closedWorld);
+      final instructionType = receiver.instructionType;
+      final checkFlags =
+          HArrayFlagsCheck(receiver, getFlags, mask, name, instructionType)
+            ..sourceInformation = instruction.sourceInformation;
+      instruction.block!.addBefore(instruction, checkFlags);
+      checkFlags.instructionType = checkFlags.computeInstructionType(
+          instructionType, abstractValueDomain);
+      receiver = checkFlags;
+    }
+
     HInstruction checkedIndex = index;
     if (requiresBoundsCheck(instruction, closedWorld)) {
       checkedIndex =