Reviewers: ulan,
Message:
PTAL
Description:
Mark maps as unstable if their instances potentially transition away.
Use this as a prerequisite for adding code dependencies.
Please review this at https://chromiumcodereview.appspot.com/21095005/
SVN Base: https://v8.googlecode.com/svn/branches/bleeding_edge
Affected files:
M src/objects-inl.h
M src/objects.h
M src/objects.cc
A + test/mjsunit/regress/regress-omit-checks.js
Index: src/objects-inl.h
diff --git a/src/objects-inl.h b/src/objects-inl.h
index
3189d840304c7cbb5be807cc9b47c8ef470a9372..a7c9921f7409aeb929bbccd72d46b8053cf5db04
100644
--- a/src/objects-inl.h
+++ b/src/objects-inl.h
@@ -3563,6 +3563,7 @@ bool Map::is_shared() {
void Map::set_dictionary_map(bool value) {
+ if (value) mark_unstable();
set_bit_field3(DictionaryMap::update(bit_field3(), value));
}
@@ -3626,6 +3627,16 @@ bool Map::is_frozen() {
}
+void Map::mark_unstable() {
+ set_bit_field3(IsUnstable::update(bit_field3(), true));
+}
+
+
+bool Map::is_stable() {
+ return !IsUnstable::decode(bit_field3());
+}
+
+
bool Map::has_code_cache() {
return code_cache() != GetIsolate()->heap()->empty_fixed_array();
}
@@ -3657,21 +3668,22 @@ bool Map::CanBeDeprecated() {
void Map::NotifyLeafMapLayoutChange() {
- dependent_code()->DeoptimizeDependentCodeGroup(
- GetIsolate(),
- DependentCode::kPrototypeCheckGroup);
+ if (is_stable()) {
+ mark_unstable();
+ dependent_code()->DeoptimizeDependentCodeGroup(
+ GetIsolate(),
+ DependentCode::kPrototypeCheckGroup);
+ }
}
bool Map::CanOmitPrototypeChecks() {
- return !HasTransitionArray() && !is_dictionary_map() &&
- FLAG_omit_prototype_checks_for_leaf_maps;
+ return is_stable() && FLAG_omit_prototype_checks_for_leaf_maps;
}
bool Map::CanOmitMapChecks() {
- return !HasTransitionArray() && !is_dictionary_map() &&
- FLAG_omit_map_checks_for_leaf_maps;
+ return is_stable() && FLAG_omit_map_checks_for_leaf_maps;
}
Index: src/objects.cc
diff --git a/src/objects.cc b/src/objects.cc
index
7839faaddf61e4234b16d6109bc9c6e1c26fde18..03e0120b0e047705ac6658891523df9461a5decc
100644
--- a/src/objects.cc
+++ b/src/objects.cc
@@ -2486,8 +2486,7 @@ void Map::DeprecateTransitionTree() {
deprecate();
dependent_code()->DeoptimizeDependentCodeGroup(
GetIsolate(), DependentCode::kTransitionGroup);
- dependent_code()->DeoptimizeDependentCodeGroup(
- GetIsolate(), DependentCode::kPrototypeCheckGroup);
+ NotifyLeafMapLayoutChange();
}
@@ -6495,6 +6494,7 @@ MaybeObject* Map::RawCopy(int instance_size) {
new_bit_field3 = NumberOfOwnDescriptorsBits::update(new_bit_field3, 0);
new_bit_field3 = EnumLengthBits::update(new_bit_field3,
kInvalidEnumCache);
new_bit_field3 = Deprecated::update(new_bit_field3, false);
+ new_bit_field3 = IsUnstable::update(new_bit_field3, false);
result->set_bit_field3(new_bit_field3);
return result;
}
Index: src/objects.h
diff --git a/src/objects.h b/src/objects.h
index
36611ee077710cdf4efebbc3beb8afe53bf17c52..d67fcf3182f3a63c882f1cec694d78d27e159e18
100644
--- a/src/objects.h
+++ b/src/objects.h
@@ -5188,6 +5188,7 @@ class Map: public HeapObject {
class IsObserved: public BitField<bool, 26, 1> {};
class Deprecated: public BitField<bool, 27, 1> {};
class IsFrozen: public BitField<bool, 28, 1> {};
+ class IsUnstable: public BitField<bool, 29, 1> {};
// Tells whether the object in the prototype property will be used
// for instances created from this function. If the prototype
@@ -5492,6 +5493,8 @@ class Map: public HeapObject {
inline void set_is_observed(bool is_observed);
inline void freeze();
inline bool is_frozen();
+ inline void mark_unstable();
+ inline bool is_stable();
inline void deprecate();
inline bool is_deprecated();
inline bool CanBeDeprecated();
Index: test/mjsunit/regress/regress-omit-checks.js
diff --git a/test/mjsunit/compiler/phi-representations.js
b/test/mjsunit/regress/regress-omit-checks.js
similarity index 79%
copy from test/mjsunit/compiler/phi-representations.js
copy to test/mjsunit/regress/regress-omit-checks.js
index
6d11bb0d8ea714daae5e5942b750fa9d3601439b..e5d50749888078e77259863534964da50bd2abab
100644
--- a/test/mjsunit/compiler/phi-representations.js
+++ b/test/mjsunit/regress/regress-omit-checks.js
@@ -27,30 +27,29 @@
// Flags: --allow-natives-syntax
-function ar() {
- var r = undefined;
- var f = 1;
- while (f--) {
- r = (typeof r === 'undefined') ? 0.1 : r;
- };
- return (r - r);
+var a = {x:1};
+var a_deprecate = {x:1};
+a_deprecate.x = 1.5;
+function create() {
+ return {__proto__:a, y:1};
}
+var b1 = create();
+var b2 = create();
+var b3 = create();
+var b4 = create();
-assertEquals(0, ar());
-assertEquals(0, ar());
-%OptimizeFunctionOnNextCall(ar);
-assertEquals(0, ar());
-
-function ar2() {
- var r = undefined;
- var f = 1;
- while (f--) {
- r = r === undefined ? 0.1 : r;
- };
- return (r - r);
+function set(b) {
+ b.x = 5;
+ b.z = 10;
}
-assertEquals(0, ar2());
-assertEquals(0, ar2());
-%OptimizeFunctionOnNextCall(ar2);
-assertEquals(0, ar2());
+set(b1);
+set(b2);
+%OptimizeFunctionOnNextCall(set);
+set(b3);
+var called = false;
+a.x = 1.5;
+Object.defineProperty(a, "z", {set:function(v) { called = true; }});
+set(b4);
+assertTrue(called);
+assertEquals(undefined, b4.z);
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/groups/opt_out.
