Reviewers: Michael Starzinger,
Message:
PTAL
Description:
Properly filter types using the initial map from HAllocate.
Please review this at https://chromiumcodereview.appspot.com/23615012/
SVN Base: https://v8.googlecode.com/svn/branches/bleeding_edge
Affected files (+46, -8 lines):
M src/ast.h
M src/hydrogen.cc
Index: src/ast.h
diff --git a/src/ast.h b/src/ast.h
index
d0454fb059271912518ead496d6d95c01507e46c..91b4b5f38b8eb9c1e8275b06176f2cf53bacc024
100644
--- a/src/ast.h
+++ b/src/ast.h
@@ -288,6 +288,14 @@ class SmallMapList V8_FINAL {
Add(map, zone);
}
+ void FilterForPossibleTransitions(Map* root_map, Zone* zone) {
+ for (int i = list_.length() - 1; i >= 0; i--) {
+ if (at(i)->FindRootMap() != root_map) {
+ list_.RemoveElement(list_.at(i));
+ }
+ }
+ }
+
void Add(Handle<Map> handle, Zone* zone) {
list_.Add(handle.location(), zone);
}
Index: src/hydrogen.cc
diff --git a/src/hydrogen.cc b/src/hydrogen.cc
index
d6b8d64db67893b77badd7795c404ee9362531e8..7840bbf58bb6bc9f8f78cee59bfcca29266519a4
100644
--- a/src/hydrogen.cc
+++ b/src/hydrogen.cc
@@ -4990,12 +4990,20 @@ void
HOptimizedGraphBuilder::BuildStoreNamed(Expression* expr,
HInstruction* instr = NULL;
SmallMapList* types = expr->GetReceiverTypes();
+
bool monomorphic = expr->IsMonomorphic();
+ if (types != NULL && object->HasMonomorphicJSObjectType()) {
+ types->FilterForPossibleTransitions(
+ object->GetMonomorphicJSObjectMap()->FindRootMap(), zone());
+ monomorphic = types->length() == 1;
+ }
+
Handle<Map> map;
if (monomorphic) {
map = types->first();
monomorphic = CanInlinePropertyAccess(*map);
}
+
if (monomorphic) {
Handle<JSFunction> setter;
Handle<JSObject> holder;
@@ -5692,7 +5700,16 @@ HValue*
HOptimizedGraphBuilder::HandleKeyedElementAccess(
bool* has_side_effects) {
ASSERT(!expr->IsPropertyName());
HInstruction* instr = NULL;
- if (expr->IsMonomorphic()) {
+ bool monomorphic = expr->IsMonomorphic();
+ SmallMapList* types = expr->GetReceiverTypes();
+
+ if (types != NULL && obj->HasMonomorphicJSObjectType()) {
+ types->FilterForPossibleTransitions(
+ obj->GetMonomorphicJSObjectMap()->FindRootMap(), zone());
+ monomorphic = types->length() == 1;
+ }
+
+ if (monomorphic) {
Handle<Map> map = expr->GetMonomorphicReceiverType();
if (map->has_slow_elements_kind()) {
instr = is_store ? BuildStoreKeyedGeneric(obj, key, val)
@@ -5861,15 +5878,19 @@ void HOptimizedGraphBuilder::BuildLoad(Property*
expr,
SmallMapList* types = expr->GetReceiverTypes();
HValue* object = Top();
+ bool monomorphic = expr->IsMonomorphic();
+ if (types != NULL && object->HasMonomorphicJSObjectType()) {
+ types->FilterForPossibleTransitions(
+ object->GetMonomorphicJSObjectMap()->FindRootMap(), zone());
+ monomorphic = types->length() == 1;
+ }
+
Handle<Map> map;
- bool monomorphic = false;
- if (expr->IsMonomorphic()) {
+ if (monomorphic) {
map = types->first();
monomorphic = CanInlinePropertyAccess(*map);
- } else if (object->HasMonomorphicJSObjectType()) {
- map = object->GetMonomorphicJSObjectMap();
- monomorphic = CanInlinePropertyAccess(*map);
}
+
if (monomorphic) {
Handle<JSFunction> getter;
Handle<JSObject> holder;
@@ -6967,7 +6988,18 @@ void HOptimizedGraphBuilder::VisitCall(Call* expr) {
Handle<String> name = prop->key()->AsLiteral()->AsPropertyName();
SmallMapList* types = expr->GetReceiverTypes();
+
+ HValue* receiver =
+ environment()->ExpressionStackAt(expr->arguments()->length());
+
bool monomorphic = expr->IsMonomorphic();
+ if (types != NULL && receiver->HasMonomorphicJSObjectType()) {
+ types->FilterForPossibleTransitions(
+ receiver->GetMonomorphicJSObjectMap()->FindRootMap(), zone());
+ monomorphic = types->length() == 1 &&
+ expr->ComputeTarget(types->at(0), name);
+ }
+
Handle<Map> receiver_map;
if (monomorphic) {
receiver_map = (types == NULL || types->is_empty())
@@ -6975,8 +7007,6 @@ void HOptimizedGraphBuilder::VisitCall(Call* expr) {
: types->first();
}
- HValue* receiver =
- environment()->ExpressionStackAt(expr->arguments()->length());
if (monomorphic) {
if (TryInlineBuiltinMethodCall(expr,
receiver,
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/groups/opt_out.
