Reviewers: Igor Sheludko,
Message:
ptal
Description:
Simplify PrepareForDataProperty in the IsElement case
BUG=v8:4137
LOG=n
Please review this at https://codereview.chromium.org/1237953002/
Base URL: https://chromium.googlesource.com/v8/v8.git@master
Affected files (+12, -61 lines):
M src/lookup.cc
M src/objects.h
M src/objects.cc
M src/objects-inl.h
Index: src/lookup.cc
diff --git a/src/lookup.cc b/src/lookup.cc
index
3acc6e2a00ed76825174a5e4e5f9e3ed46b2274d..d96671c0a5ca4f4a96e4b11b419e5052621bf7de
100644
--- a/src/lookup.cc
+++ b/src/lookup.cc
@@ -132,29 +132,19 @@ void
LookupIterator::PrepareForDataProperty(Handle<Object> value) {
Handle<JSObject> holder = GetHolder<JSObject>();
if (IsElement()) {
- ElementsKind old_kind = holder_map_->elements_kind();
- holder_map_ = Map::PrepareForDataElement(holder_map_, value);
- ElementsKind new_kind = holder_map_->elements_kind();
- if (new_kind != old_kind) {
- // TODO(verwaest): Handle element migration in MigrateToMap.
- JSObject::UpdateAllocationSite(holder, new_kind);
- if (IsFastDoubleElementsKind(old_kind) !=
- IsFastDoubleElementsKind(new_kind)) {
- uint32_t capacity = holder->elements()->length();
- ElementsAccessor* accessor = ElementsAccessor::ForKind(new_kind);
- accessor->GrowCapacityAndConvert(holder, capacity);
- // GrowCapacityAndConvert migrated the object. No reloading of
property
- // infomation is necessary for elements.
- return;
- } else if (FLAG_trace_elements_transitions) {
- Handle<FixedArrayBase> elements(holder->elements());
- JSObject::PrintElementsTransition(stdout, holder, old_kind,
elements,
- new_kind, elements);
- }
+ ElementsKind kind = holder_map_->elements_kind();
+ ElementsKind to = value->OptimalElementsKind();
+ if (IsHoleyElementsKind(kind) || !holder_map_->IsJSArrayMap()) {
+ to = GetHoleyElementsKind(to);
+ kind = GetHoleyElementsKind(kind);
}
+ to = IsMoreGeneralElementsKindTransition(kind, to) ? to : kind;
+
+ JSObject::TransitionElementsKind(holder, to);
+ holder_map_ = handle(holder->map(), isolate_);
// Copy the backing store if it is copy-on-write.
- if (IsFastSmiOrObjectElementsKind(new_kind)) {
+ if (IsFastSmiOrObjectElementsKind(to)) {
JSObject::EnsureWritableFastElements(holder);
}
Index: src/objects-inl.h
diff --git a/src/objects-inl.h b/src/objects-inl.h
index
857270f674a288cec36cb450b0f6e204e0c1a175..188722e62814e655b73ec21039b769a64bcf157f
100644
--- a/src/objects-inl.h
+++ b/src/objects-inl.h
@@ -695,8 +695,7 @@ bool Object::IsJSReceiver() const {
bool Object::IsJSObject() const {
STATIC_ASSERT(LAST_JS_OBJECT_TYPE == LAST_TYPE);
- return IsHeapObject() &&
- HeapObject::cast(this)->map()->instance_type() >=
FIRST_JS_OBJECT_TYPE;
+ return IsHeapObject() && HeapObject::cast(this)->map()->IsJSObjectMap();
}
Index: src/objects.cc
diff --git a/src/objects.cc b/src/objects.cc
index
0eefbec2ab7fb568312a7282649ebb5b9d9bfbfa..a202320357cb8ee39e66355adf948fece8fc9e20
100644
--- a/src/objects.cc
+++ b/src/objects.cc
@@ -6960,43 +6960,6 @@ bool DescriptorArray::CanHoldValue(int descriptor,
Object* value) {
// static
-Handle<Map> Map::PrepareForDataElement(Handle<Map> map, Handle<Object>
value) {
- ElementsKind kind = map->elements_kind();
- bool holey = IsHoleyElementsKind(kind);
-
- switch (kind) {
- case FAST_SMI_ELEMENTS:
- case FAST_HOLEY_SMI_ELEMENTS:
- if (value->IsSmi()) return map;
- kind = value->IsNumber() ? FAST_DOUBLE_ELEMENTS : FAST_ELEMENTS;
- break;
-
- case FAST_DOUBLE_ELEMENTS:
- case FAST_HOLEY_DOUBLE_ELEMENTS:
- if (value->IsNumber()) return map;
- kind = FAST_ELEMENTS;
- break;
-
- case FAST_ELEMENTS:
- case FAST_HOLEY_ELEMENTS:
- case DICTIONARY_ELEMENTS:
- case FAST_SLOPPY_ARGUMENTS_ELEMENTS:
- case SLOW_SLOPPY_ARGUMENTS_ELEMENTS:
-#define TYPED_ARRAY_CASE(Type, type, TYPE, ctype, size) \
- case EXTERNAL_##TYPE##_ELEMENTS: \
- case TYPE##_ELEMENTS:
-
- TYPED_ARRAYS(TYPED_ARRAY_CASE)
-#undef TYPED_ARRAY_CASE
- return map;
- }
-
- if (holey) kind = GetHoleyElementsKind(kind);
- return Map::AsElementsKind(map, kind);
-}
-
-
-// static
Handle<Map> Map::PrepareForDataProperty(Handle<Map> map, int descriptor,
Handle<Object> value) {
// Dictionaries can store any property value.
Index: src/objects.h
diff --git a/src/objects.h b/src/objects.h
index
fa4d66903ca8d6fbeabfc699d6a8a7ebbcabcf0f..37c03057eede89ca42b1ec2b8059b228ca5b6b68
100644
--- a/src/objects.h
+++ b/src/objects.h
@@ -5766,8 +5766,6 @@ class Map: public HeapObject {
static Handle<Map> PrepareForDataProperty(Handle<Map> old_map,
int descriptor_number,
Handle<Object> value);
- static Handle<Map> PrepareForDataElement(Handle<Map> old_map,
- Handle<Object> value);
static Handle<Map> Normalize(Handle<Map> map, PropertyNormalizationMode
mode,
const char* reason);
@@ -6030,6 +6028,7 @@ class Map: public HeapObject {
bool IsJSObjectMap() {
return instance_type() >= FIRST_JS_OBJECT_TYPE;
}
+ bool IsJSArrayMap() { return instance_type() == JS_ARRAY_TYPE; }
bool IsStringMap() { return instance_type() < FIRST_NONSTRING_TYPE; }
bool IsJSProxyMap() {
InstanceType type = instance_type();
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
