Revision: 17216
Author: [email protected]
Date: Tue Oct 15 12:42:03 2013 UTC
Log: TransitionAndStoreStub bailout needs to transition (and store).
Performance regression found in test regress-2185-2.js. The problem was
that the bailout method for TransitionAndStoreStub was not performing
the appropriate transition.
BUG=
[email protected]
Review URL: https://codereview.chromium.org/26911007
http://code.google.com/p/v8/source/detail?r=17216
Modified:
/branches/bleeding_edge/src/ic.cc
/branches/bleeding_edge/test/mjsunit/allocation-site-info.js
=======================================
--- /branches/bleeding_edge/src/ic.cc Fri Oct 11 14:05:23 2013 UTC
+++ /branches/bleeding_edge/src/ic.cc Tue Oct 15 12:42:03 2013 UTC
@@ -2257,9 +2257,14 @@
ASSERT(args.length() == 4);
KeyedStoreIC ic(IC::EXTRA_CALL_FRAME, isolate);
Handle<Object> value = args.at<Object>(0);
+ Handle<Map> map = args.at<Map>(1);
Handle<Object> key = args.at<Object>(2);
Handle<Object> object = args.at<Object>(3);
StrictModeFlag strict_mode = ic.strict_mode();
+ if (object->IsJSObject()) {
+ JSObject::TransitionElementsKind(Handle<JSObject>::cast(object),
+ map->elements_kind());
+ }
return Runtime::SetObjectProperty(isolate,
object,
key,
=======================================
--- /branches/bleeding_edge/test/mjsunit/allocation-site-info.js Thu Sep 19
13:32:00 2013 UTC
+++ /branches/bleeding_edge/test/mjsunit/allocation-site-info.js Tue Oct 15
12:42:03 2013 UTC
@@ -148,8 +148,12 @@
assertKind(elements_kind.fast_double, obj);
obj = fastliteralcase([3, 6, 2], 1.5);
assertKind(elements_kind.fast_double, obj);
+
+ // Note: thanks to pessimistic transition store stubs, we'll attempt
+ // to transition to the most general elements kind seen at a particular
+ // store site. So, the elements kind will be double.
obj = fastliteralcase([2, 6, 3], 2);
- assertKind(elements_kind.fast_smi_only, obj);
+ assertKind(elements_kind.fast_double, obj);
}
// Verify that we will not pretransition the double->fast path.
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/groups/opt_out.
