Reviewers: Toon Verwaest,
Message:
Hi Toon,
If you get a chance tomorrow or so to have a quick look. I believe this CL
came
out of a debugging session we had some weeks ago. The allocation site info
is
unnecessarily restrictive in accepting feedback for transitions from double
to
fast for array literals that started with smi elements kind.
Thanks,
--michael
Description:
Transitions from DOUBLE to FAST were not checking for allocation site info.
This creates a confusing result. It's better to let allocation sites
transition to their end state than artificially stop tracking at the
double/fast boundary.
BUG=
Please review this at https://codereview.chromium.org/22868004/
SVN Base: https://v8.googlecode.com/svn/branches/bleeding_edge
Affected files:
M src/objects.cc
M test/mjsunit/allocation-site-info.js
M test/mjsunit/array-literal-feedback.js
Index: src/objects.cc
diff --git a/src/objects.cc b/src/objects.cc
index
959e3d38648277f47e94c492297adc411f6fe800..ec5e04c1ee8749ac6dd9d0a13427be27cc61884d
100644
--- a/src/objects.cc
+++ b/src/objects.cc
@@ -10883,6 +10883,10 @@ MaybeObject*
JSObject::SetFastElementsCapacityAndLength(
}
ValidateElements();
set_map_and_elements(new_map, new_elements);
+
+ // Transition through the allocation site as well if present.
+ maybe_obj = UpdateAllocationSite(new_elements_kind);
+ if (maybe_obj->IsFailure()) return maybe_obj;
} else {
FixedArray* parameter_map = FixedArray::cast(old_elements);
parameter_map->set(1, new_elements);
@@ -12406,7 +12410,7 @@ MaybeObject*
JSObject::UpdateAllocationSite(ElementsKind to_kind) {
if (IsHoleyElementsKind(kind)) {
to_kind = GetHoleyElementsKind(to_kind);
}
- if (AllocationSite::GetMode(kind, to_kind) == TRACK_ALLOCATION_SITE) {
+ if (IsMoreGeneralElementsKindTransition(kind, to_kind)) {
// If the array is huge, it's not likely to be defined in a local
// function, so we shouldn't make new instances of it very often.
uint32_t length = 0;
@@ -12428,7 +12432,7 @@ MaybeObject*
JSObject::UpdateAllocationSite(ElementsKind to_kind) {
if (IsHoleyElementsKind(kind)) {
to_kind = GetHoleyElementsKind(to_kind);
}
- if (AllocationSite::GetMode(kind, to_kind) == TRACK_ALLOCATION_SITE) {
+ if (IsMoreGeneralElementsKindTransition(kind, to_kind)) {
if (FLAG_trace_track_allocation_sites) {
PrintF("AllocationSite: JSArray %p site updated %s->%s\n",
reinterpret_cast<void*>(this),
Index: test/mjsunit/allocation-site-info.js
diff --git a/test/mjsunit/allocation-site-info.js
b/test/mjsunit/allocation-site-info.js
index
5f6817b6d365f19190d82d6f4169774086eac905..0f5870d7d96ce4bca41f229ab7e3483a8a7859fd
100644
--- a/test/mjsunit/allocation-site-info.js
+++ b/test/mjsunit/allocation-site-info.js
@@ -150,17 +150,14 @@ if (support_smi_only_arrays) {
// Verify that we will not pretransition the double->fast path.
obj = fastliteralcase(get_standard_literal(), "elliot");
assertKind(elements_kind.fast, obj);
- // This fails until we turn off optimistic transitions to the
- // most general elements kind seen on keyed stores. It's a goal
- // to turn it off, but for now we need it.
- // obj = fastliteralcase(3);
- // assertKind(elements_kind.fast_double, obj);
+ obj = fastliteralcase(get_standard_literal(), 3);
+ assertKind(elements_kind.fast, obj);
// Make sure this works in crankshafted code too.
%OptimizeFunctionOnNextCall(get_standard_literal);
get_standard_literal();
obj = get_standard_literal();
- assertKind(elements_kind.fast_double, obj);
+ assertKind(elements_kind.fast, obj);
function fastliteralcase_smifast(value) {
var literal = [1, 2, 3, 4];
@@ -231,16 +228,14 @@ if (support_smi_only_arrays) {
obj = newarraycase_length_smidouble(2);
assertKind(elements_kind.fast_double, obj);
- // Try to continue the transition to fast object, but
- // we will not pretransition from double->fast, because
- // it may hurt performance ("poisoning").
+ // Try to continue the transition to fast object. This won't work for
+ // constructed arrays because constructor dispatch is done on the
+ // elements kind, and a DOUBLE array constructor won't create an
allocation
+ // memento.
obj = newarraycase_length_smidouble("coates");
assertKind(elements_kind.fast, obj);
- obj = newarraycase_length_smidouble(2.5);
- // However, because of optimistic transitions, we will
- // transition to the most general kind of elements kind found,
- // therefore I can't count on this assert yet.
- // assertKind(elements_kind.fast_double, obj);
+ obj = newarraycase_length_smidouble(2);
+ assertKind(elements_kind.fast_double, obj);
function newarraycase_length_smiobj(value) {
var a = new Array(3);
Index: test/mjsunit/array-literal-feedback.js
diff --git a/test/mjsunit/array-literal-feedback.js
b/test/mjsunit/array-literal-feedback.js
index
3378394d90a32f16e44a4682e3c8ccf4dcd4daec..d2245c62a262fc011f89b5000de310bf26e53635
100644
--- a/test/mjsunit/array-literal-feedback.js
+++ b/test/mjsunit/array-literal-feedback.js
@@ -44,6 +44,42 @@ if (support_smi_only_arrays) {
print("Tests do NOT include smi-only arrays.");
}
+var elements_kind = {
+ fast_smi_only : 'fast smi only elements',
+ fast : 'fast elements',
+ fast_double : 'fast double elements',
+ dictionary : 'dictionary elements',
+ external_byte : 'external byte elements',
+ external_unsigned_byte : 'external unsigned byte elements',
+ external_short : 'external short elements',
+ external_unsigned_short : 'external unsigned short elements',
+ external_int : 'external int elements',
+ external_unsigned_int : 'external unsigned int elements',
+ external_float : 'external float elements',
+ external_double : 'external double elements',
+ external_pixel : 'external pixel elements'
+}
+
+function getKind(obj) {
+ if (%HasFastSmiElements(obj)) return elements_kind.fast_smi_only;
+ if (%HasFastObjectElements(obj)) return elements_kind.fast;
+ if (%HasFastDoubleElements(obj)) return elements_kind.fast_double;
+ if (%HasDictionaryElements(obj)) return elements_kind.dictionary;
+}
+
+function isHoley(obj) {
+ if (%HasFastHoleyElements(obj)) return true;
+ return false;
+}
+
+function assertKind(expected, obj, name_opt) {
+ if (!support_smi_only_arrays &&
+ expected == elements_kind.fast_smi_only) {
+ expected = elements_kind.fast;
+ }
+ assertEquals(expected, getKind(obj), name_opt);
+}
+
if (support_smi_only_arrays) {
function get_literal(x) {
@@ -72,4 +108,19 @@ if (support_smi_only_arrays) {
b = get_literal(3);
assertTrue(%HasFastDoubleElements(b));
assertOptimized(get_literal);
+
+
+ // Test: make sure allocation site information is updated through a
+ // transition from SMI->DOUBLE->FAST
+ (function() {
+ function bar(a, b, c) {
+ return [a, b, c];
+ }
+
+ a = bar(1, 2, 3);
+ a[0] = 3.5;
+ a[1] = 'hi';
+ b = bar(1, 2, 3);
+ assertKind(elements_kind.fast, b);
+ })();
}
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/groups/opt_out.
