Reviewers: Benedikt Meurer,
Message:
Hi Benedikt, PTAL, thx!
--Michael
Description:
TransitionAndStoreStub bailout needs to transition (and store).
Performance regression found in test regress-2185-2.js. The problem was
that the bailout method for TransitionAndStoreStub was not performing
the appropriate transition.
BUG=
Please review this at https://codereview.chromium.org/26911007/
SVN Base: https://v8.googlecode.com/svn/branches/bleeding_edge
Affected files (+10, -1 lines):
M src/ic.cc
M test/mjsunit/allocation-site-info.js
Index: src/ic.cc
diff --git a/src/ic.cc b/src/ic.cc
index
a6ffb13ad40a84b16073b7d6b8a4bbb43ab7e702..da6e9c69eafcb6fb5712f73ed5f4d9580e70049a
100644
--- a/src/ic.cc
+++ b/src/ic.cc
@@ -2257,9 +2257,14 @@ RUNTIME_FUNCTION(MaybeObject*,
ElementsTransitionAndStoreIC_Miss) {
ASSERT(args.length() == 4);
KeyedStoreIC ic(IC::EXTRA_CALL_FRAME, isolate);
Handle<Object> value = args.at<Object>(0);
+ Handle<Map> map = args.at<Map>(1);
Handle<Object> key = args.at<Object>(2);
Handle<Object> object = args.at<Object>(3);
StrictModeFlag strict_mode = ic.strict_mode();
+ if (object->IsJSObject()) {
+ JSObject::TransitionElementsKind(Handle<JSObject>::cast(object),
+ map->elements_kind());
+ }
return Runtime::SetObjectProperty(isolate,
object,
key,
Index: test/mjsunit/allocation-site-info.js
diff --git a/test/mjsunit/allocation-site-info.js
b/test/mjsunit/allocation-site-info.js
index
dd22f573f0715ff5053b215d2e6825dad90fcded..3ed1c16a8cc0ec503bc03a8a8824544d621ca366
100644
--- a/test/mjsunit/allocation-site-info.js
+++ b/test/mjsunit/allocation-site-info.js
@@ -148,8 +148,12 @@ if (support_smi_only_arrays) {
assertKind(elements_kind.fast_double, obj);
obj = fastliteralcase([3, 6, 2], 1.5);
assertKind(elements_kind.fast_double, obj);
+
+ // Note: thanks to pessimistic transition store stubs, we'll attempt
+ // to transition to the most general elements kind seen at a
particular store
+ // site. So, the elements kind will be double.
obj = fastliteralcase([2, 6, 3], 2);
- assertKind(elements_kind.fast_smi_only, obj);
+ assertKind(elements_kind.fast_double, obj);
}
// Verify that we will not pretransition the double->fast path.
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/groups/opt_out.
