Reviewers: fschneider,
Description:
Introduce basic type feedback for for-in statements to avoid deopts.
[email protected]
Please review this at https://chromiumcodereview.appspot.com/9571001/
SVN Base: https://v8.googlecode.com/svn/branches/bleeding_edge
Affected files:
M src/arm/full-codegen-arm.cc
M src/hydrogen.cc
M src/ia32/full-codegen-ia32.cc
M src/objects.h
M src/type-info.h
M src/type-info.cc
M src/x64/full-codegen-x64.cc
Index: src/arm/full-codegen-arm.cc
diff --git a/src/arm/full-codegen-arm.cc b/src/arm/full-codegen-arm.cc
index
418e0c5f7c9cfbcfba491a0b1021e1f95492a9dd..8639698051041118a6eb108706dde664df16ff80
100644
--- a/src/arm/full-codegen-arm.cc
+++ b/src/arm/full-codegen-arm.cc
@@ -1004,6 +1004,16 @@ void
FullCodeGenerator::VisitForInStatement(ForInStatement* stmt) {
// We got a fixed array in register r0. Iterate through that.
Label non_proxy;
__ bind(&fixed_array);
+
+ Handle<JSGlobalPropertyCell> cell =
+ isolate()->factory()->NewJSGlobalPropertyCell(
+ Handle<Object>(
+ Smi::FromInt(TypeFeedbackCells::kForInFastCaseMarker)));
+ RecordTypeFeedbackCell(stmt->PrepareId(), cell);
+ __ LoadHeapObject(r1, cell);
+ __ mov(r2,
Operand(Smi::FromInt(TypeFeedbackCells::kForInSlowCaseMarker)));
+ __ str(r2, FieldMemOperand(r1, JSGlobalPropertyCell::kValueOffset));
+
__ mov(r1, Operand(Smi::FromInt(1))); // Smi indicates slow check
__ ldr(r2, MemOperand(sp, 0 * kPointerSize)); // Get enumerated object
STATIC_ASSERT(FIRST_JS_PROXY_TYPE == FIRST_SPEC_OBJECT_TYPE);
Index: src/hydrogen.cc
diff --git a/src/hydrogen.cc b/src/hydrogen.cc
index
33fa0f4806a556e5f33c8f8735d7b56eb2f2c556..3124817b1d886b0022d8a98e254bfe4ab63b27a8
100644
--- a/src/hydrogen.cc
+++ b/src/hydrogen.cc
@@ -3274,6 +3274,10 @@ void
HGraphBuilder::VisitForInStatement(ForInStatement* stmt) {
return Bailout("ForInStatement optimization is disabled");
}
+ if (!oracle()->IsForInFastCase(stmt)) {
+ return Bailout("ForInStatement is not fast case");
+ }
+
if (!stmt->each()->IsVariableProxy() ||
!stmt->each()->AsVariableProxy()->var()->IsStackLocal()) {
return Bailout("ForInStatement with non-local each variable");
Index: src/ia32/full-codegen-ia32.cc
diff --git a/src/ia32/full-codegen-ia32.cc b/src/ia32/full-codegen-ia32.cc
index
0b7c7fd451fdc1bdf2dd31ee91b13308f8f8ec9d..86ca138ad25495ea867d0fd43a908edec1a4fb2d
100644
--- a/src/ia32/full-codegen-ia32.cc
+++ b/src/ia32/full-codegen-ia32.cc
@@ -1033,6 +1033,16 @@ void
FullCodeGenerator::VisitForInStatement(ForInStatement* stmt) {
// We got a fixed array in register eax. Iterate through that.
Label non_proxy;
__ bind(&fixed_array);
+
+ Handle<JSGlobalPropertyCell> cell =
+ isolate()->factory()->NewJSGlobalPropertyCell(
+ Handle<Object>(
+ Smi::FromInt(TypeFeedbackCells::kForInFastCaseMarker)));
+ RecordTypeFeedbackCell(stmt->PrepareId(), cell);
+ __ LoadHeapObject(ebx, cell);
+ __ mov(FieldOperand(ebx, JSGlobalPropertyCell::kValueOffset),
+ Immediate(Smi::FromInt(TypeFeedbackCells::kForInSlowCaseMarker)));
+
__ mov(ebx, Immediate(Smi::FromInt(1))); // Smi indicates slow check
__ mov(ecx, Operand(esp, 0 * kPointerSize)); // Get enumerated object
STATIC_ASSERT(FIRST_JS_PROXY_TYPE == FIRST_SPEC_OBJECT_TYPE);
Index: src/objects.h
diff --git a/src/objects.h b/src/objects.h
index
be75faba65c0d58183868a185d7c4e6e3ff523da..7d8a55e7dec15bdfde69103b84c667e3bd07d0e7
100644
--- a/src/objects.h
+++ b/src/objects.h
@@ -4063,6 +4063,9 @@ class TypeFeedbackCells: public FixedArray {
// Casting.
static inline TypeFeedbackCells* cast(Object* obj);
+
+ static const int kForInFastCaseMarker = 0;
+ static const int kForInSlowCaseMarker = 1;
};
Index: src/type-info.cc
diff --git a/src/type-info.cc b/src/type-info.cc
index
81cbff3b0a9d144e3d8706e1062d472335dd1d43..fa479b2e515b5c811b30c67bae9ce4c3fd4c9e09
100644
--- a/src/type-info.cc
+++ b/src/type-info.cc
@@ -154,6 +154,13 @@ bool TypeFeedbackOracle::CallNewIsMonomorphic(CallNew*
expr) {
}
+bool TypeFeedbackOracle::IsForInFastCase(ForInStatement* stmt) {
+ Handle<Object> value = GetInfo(stmt->PrepareId());
+ return value->IsSmi() &&
+ Smi::cast(*value)->value() ==
TypeFeedbackCells::kForInFastCaseMarker;
+}
+
+
Handle<Map> TypeFeedbackOracle::LoadMonomorphicReceiverType(Property*
expr) {
ASSERT(LoadIsMonomorphicNormal(expr));
Handle<Object> map_or_code = GetInfo(expr->id());
@@ -659,9 +666,10 @@ void
TypeFeedbackOracle::ProcessTypeFeedbackCells(Handle<Code> code) {
for (int i = 0; i < cache->CellCount(); i++) {
unsigned ast_id = cache->AstId(i)->value();
Object* value = cache->Cell(i)->value();
- if (value->IsJSFunction() &&
- !CanRetainOtherContext(JSFunction::cast(value),
- *global_context_)) {
+ if (value->IsSmi() ||
+ (value->IsJSFunction() &&
+ !CanRetainOtherContext(JSFunction::cast(value),
+ *global_context_))) {
SetInfo(ast_id, value);
}
}
Index: src/type-info.h
diff --git a/src/type-info.h b/src/type-info.h
index
19a309bc8d9bc3fb3f438ea16ce8c54885886878..84ec51d97567dc4b7ec6665913985546d9711e0d
100644
--- a/src/type-info.h
+++ b/src/type-info.h
@@ -228,6 +228,7 @@ class Expression;
class Property;
class SmallMapList;
class UnaryOperation;
+class ForInStatement;
class TypeFeedbackOracle BASE_EMBEDDED {
@@ -243,6 +244,8 @@ class TypeFeedbackOracle BASE_EMBEDDED {
bool CallIsMonomorphic(Call* expr);
bool CallNewIsMonomorphic(CallNew* expr);
+ bool IsForInFastCase(ForInStatement* expr);
+
Handle<Map> LoadMonomorphicReceiverType(Property* expr);
Handle<Map> StoreMonomorphicReceiverType(Expression* expr);
Index: src/x64/full-codegen-x64.cc
diff --git a/src/x64/full-codegen-x64.cc b/src/x64/full-codegen-x64.cc
index
a9bf9a80e717e1e91ff94a20ea84190653dadd61..7a60adc0b37db09bf368fc6ee61556f461d016a6
100644
--- a/src/x64/full-codegen-x64.cc
+++ b/src/x64/full-codegen-x64.cc
@@ -969,6 +969,16 @@ void
FullCodeGenerator::VisitForInStatement(ForInStatement* stmt) {
// We got a fixed array in register rax. Iterate through that.
Label non_proxy;
__ bind(&fixed_array);
+
+ Handle<JSGlobalPropertyCell> cell =
+ isolate()->factory()->NewJSGlobalPropertyCell(
+ Handle<Object>(
+ Smi::FromInt(TypeFeedbackCells::kForInFastCaseMarker)));
+ RecordTypeFeedbackCell(stmt->PrepareId(), cell);
+ __ LoadHeapObject(rbx, cell);
+ __ Move(FieldOperand(rbx, JSGlobalPropertyCell::kValueOffset),
+ Smi::FromInt(TypeFeedbackCells::kForInSlowCaseMarker));
+
__ Move(rbx, Smi::FromInt(1)); // Smi indicates slow check
__ movq(rcx, Operand(rsp, 0 * kPointerSize)); // Get enumerated object
STATIC_ASSERT(FIRST_JS_PROXY_TYPE == FIRST_SPEC_OBJECT_TYPE);
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
