Reviewers: danno,
Description:
Add a soft-deopt in keyed element access when current IC is pre-monomorphic
and
no type feedback was collected.
BUG=
Please review this at https://codereview.chromium.org/32643004/
SVN Base: https://v8.googlecode.com/svn/branches/bleeding_edge
Affected files (+66, -28 lines):
M src/ast.h
M src/ast.cc
M src/hydrogen.cc
M src/ic.cc
M src/type-info.h
M src/type-info.cc
M test/mjsunit/unbox-double-arrays.js
Index: src/ast.cc
diff --git a/src/ast.cc b/src/ast.cc
index
0d667cc168812d0b3f487bf422f1bcf096ac4d1c..481414eb2c2802f0d0922fb6b2f31c8e07361954
100644
--- a/src/ast.cc
+++ b/src/ast.cc
@@ -139,6 +139,7 @@ Assignment::Assignment(Isolate* isolate,
assignment_id_(GetNextId(isolate)),
is_monomorphic_(false),
is_uninitialized_(false),
+ is_pre_monomorphic_(false),
store_mode_(STANDARD_STORE) { }
@@ -426,7 +427,9 @@ void Property::RecordTypeFeedback(TypeFeedbackOracle*
oracle,
is_uninitialized_ = oracle->LoadIsUninitialized(this);
if (is_uninitialized_) return;
+ is_pre_monomorphic_ = oracle->LoadIsPreMonomorphic(this);
is_monomorphic_ = oracle->LoadIsMonomorphicNormal(this);
+ ASSERT(!is_pre_monomorphic_ || !is_monomorphic_);
receiver_types_.Clear();
if (key()->IsPropertyName()) {
FunctionPrototypeStub proto_stub(Code::LOAD_IC);
@@ -456,7 +459,10 @@ void
Assignment::RecordTypeFeedback(TypeFeedbackOracle* oracle,
TypeFeedbackId id = AssignmentFeedbackId();
is_uninitialized_ = oracle->StoreIsUninitialized(id);
if (is_uninitialized_) return;
+
+ is_pre_monomorphic_ = oracle->StoreIsPreMonomorphic(id);
is_monomorphic_ = oracle->StoreIsMonomorphicNormal(id);
+ ASSERT(!is_pre_monomorphic_ || !is_monomorphic_);
receiver_types_.Clear();
if (prop->key()->IsPropertyName()) {
Literal* lit_key = prop->key()->AsLiteral();
Index: src/ast.h
diff --git a/src/ast.h b/src/ast.h
index
4b2010f07773f148a4f416bb5f71031a1e5b20d7..b4f7348eee314eaac011db31d3b238b877d7ef82
100644
--- a/src/ast.h
+++ b/src/ast.h
@@ -1669,6 +1669,10 @@ class Property V8_FINAL : public Expression {
return STANDARD_STORE;
}
bool IsUninitialized() { return is_uninitialized_; }
+ bool IsPreMonomorphic() { return is_pre_monomorphic_; }
+ bool HasNoTypeInformation() {
+ return is_uninitialized_ || is_pre_monomorphic_;
+ }
TypeFeedbackId PropertyFeedbackId() { return reuse(id()); }
protected:
@@ -1681,6 +1685,7 @@ class Property V8_FINAL : public Expression {
key_(key),
load_id_(GetNextId(isolate)),
is_monomorphic_(false),
+ is_pre_monomorphic_(false),
is_uninitialized_(false),
is_string_access_(false),
is_function_prototype_(false) { }
@@ -1692,6 +1697,7 @@ class Property V8_FINAL : public Expression {
SmallMapList receiver_types_;
bool is_monomorphic_ : 1;
+ bool is_pre_monomorphic_ : 1;
bool is_uninitialized_ : 1;
bool is_string_access_ : 1;
bool is_function_prototype_ : 1;
@@ -2098,6 +2104,10 @@ class Assignment V8_FINAL : public Expression {
void RecordTypeFeedback(TypeFeedbackOracle* oracle, Zone* zone);
virtual bool IsMonomorphic() V8_OVERRIDE { return is_monomorphic_; }
bool IsUninitialized() { return is_uninitialized_; }
+ bool IsPreMonomorphic() { return is_pre_monomorphic_; }
+ bool HasNoTypeInformation() {
+ return is_uninitialized_ || is_pre_monomorphic_;
+ }
virtual SmallMapList* GetReceiverTypes() V8_OVERRIDE {
return &receiver_types_;
}
@@ -2130,6 +2140,7 @@ class Assignment V8_FINAL : public Expression {
bool is_monomorphic_ : 1;
bool is_uninitialized_ : 1;
+ bool is_pre_monomorphic_ : 1;
KeyedAccessStoreMode store_mode_ : 5; // Windows treats as signed,
// must have extra bit.
SmallMapList receiver_types_;
Index: src/hydrogen.cc
diff --git a/src/hydrogen.cc b/src/hydrogen.cc
index
fbca58f0c6444161ca524c891ce0693eca1e236c..f9d8252718cc2fee9dd276aead52d36a991ab461
100644
--- a/src/hydrogen.cc
+++ b/src/hydrogen.cc
@@ -5785,13 +5785,14 @@ HValue*
HOptimizedGraphBuilder::HandleKeyedElementAccess(
expr->GetStoreMode(), has_side_effects);
} else {
if (is_store) {
- if (expr->IsAssignment() && expr->AsAssignment()->IsUninitialized())
{
+ if (expr->IsAssignment() &&
+ expr->AsAssignment()->HasNoTypeInformation()) {
Add<HDeoptimize>("Insufficient type feedback for keyed store",
Deoptimizer::SOFT);
}
instr = BuildStoreKeyedGeneric(obj, key, val);
} else {
- if (expr->AsProperty()->IsUninitialized()) {
+ if (expr->AsProperty()->HasNoTypeInformation()) {
Add<HDeoptimize>("Insufficient type feedback for keyed load",
Deoptimizer::SOFT);
}
Index: src/ic.cc
diff --git a/src/ic.cc b/src/ic.cc
index
a6ffb13ad40a84b16073b7d6b8a4bbb43ab7e702..1c946603a2b5a42dfed043974244e87f3f1fa601
100644
--- a/src/ic.cc
+++ b/src/ic.cc
@@ -1371,32 +1371,34 @@ MaybeObject* KeyedLoadIC::Load(Handle<Object>
object,
return LoadIC::Load(object, Handle<String>::cast(key));
}
- if (FLAG_use_ic && !object->IsAccessCheckNeeded()) {
- ASSERT(!object->IsJSGlobalProxy());
+ if (FLAG_use_ic) {
Handle<Code> stub = generic_stub();
- if (miss_mode == MISS_FORCE_GENERIC) {
- TRACE_GENERIC_IC(isolate(), "KeyedLoadIC", "force generic");
- } else if (object->IsString() && key->IsNumber()) {
- if (state() == UNINITIALIZED) stub = string_stub();
- } else if (object->IsJSObject()) {
- Handle<JSObject> receiver = Handle<JSObject>::cast(object);
- if (receiver->elements()->map() ==
- isolate()->heap()->non_strict_arguments_elements_map()) {
- stub = non_strict_arguments_stub();
- } else if (receiver->HasIndexedInterceptor()) {
- stub = indexed_interceptor_stub();
- } else if (!key->ToSmi()->IsFailure() &&
- (!target().is_identical_to(non_strict_arguments_stub())))
{
- stub = LoadElementStub(receiver);
+ if (!object->IsAccessCheckNeeded()) {
+ ASSERT(!object->IsJSGlobalProxy());
+ if (miss_mode == MISS_FORCE_GENERIC) {
+ TRACE_GENERIC_IC(isolate(), "KeyedLoadIC", "force generic");
+ } else if (object->IsString() && key->IsNumber()) {
+ if (state() == UNINITIALIZED) stub = string_stub();
+ } else if (object->IsJSObject()) {
+ Handle<JSObject> receiver = Handle<JSObject>::cast(object);
+ if (receiver->elements()->map() ==
+ isolate()->heap()->non_strict_arguments_elements_map()) {
+ stub = non_strict_arguments_stub();
+ } else if (receiver->HasIndexedInterceptor()) {
+ stub = indexed_interceptor_stub();
+ } else if (!key->ToSmi()->IsFailure() &&
+
(!target().is_identical_to(non_strict_arguments_stub()))) {
+ stub = LoadElementStub(receiver);
+ }
}
+ } else {
+ TRACE_GENERIC_IC(isolate(), "KeyedLoadIC", "force generic");
}
-
ASSERT(!stub.is_null());
set_target(*stub);
TRACE_IC("LoadIC", key);
}
-
return Runtime::GetObjectPropertyOrFail(isolate(), object, key);
}
@@ -1981,6 +1983,10 @@ MaybeObject* KeyedStoreIC::Store(Handle<Object>
object,
ASSERT(!stub.is_null());
set_target(*stub);
TRACE_IC("StoreIC", key);
+ } else if (FLAG_use_ic) {
+ set_target(*generic_stub());
+ TRACE_GENERIC_IC(isolate(), "KeyedStoreIC", "force generic");
+ TRACE_IC("StoreIC", key);
}
return Runtime::SetObjectPropertyOrFail(
Index: src/type-info.cc
diff --git a/src/type-info.cc b/src/type-info.cc
index
da4d1834421520f5dcbe110c433a57fb6c56d362..65d1364058eaf672d99a583480028a37d4da6030
100644
--- a/src/type-info.cc
+++ b/src/type-info.cc
@@ -128,6 +128,16 @@ bool
TypeFeedbackOracle::LoadIsMonomorphicNormal(Property* expr) {
}
+bool TypeFeedbackOracle::LoadIsPreMonomorphic(Property* expr) {
+ Handle<Object> map_or_code = GetInfo(expr->PropertyFeedbackId());
+ if (map_or_code->IsCode()) {
+ Handle<Code> code = Handle<Code>::cast(map_or_code);
+ return code->is_inline_cache_stub() && code->ic_state() ==
PREMONOMORPHIC;
+ }
+ return false;
+}
+
+
bool TypeFeedbackOracle::LoadIsPolymorphic(Property* expr) {
Handle<Object> map_or_code = GetInfo(expr->PropertyFeedbackId());
if (map_or_code->IsCode()) {
@@ -166,6 +176,16 @@ bool
TypeFeedbackOracle::StoreIsMonomorphicNormal(TypeFeedbackId ast_id) {
}
+bool TypeFeedbackOracle::StoreIsPreMonomorphic(TypeFeedbackId ast_id) {
+ Handle<Object> map_or_code = GetInfo(ast_id);
+ if (map_or_code->IsCode()) {
+ Handle<Code> code = Handle<Code>::cast(map_or_code);
+ return code->ic_state() == PREMONOMORPHIC;
+ }
+ return false;
+}
+
+
bool TypeFeedbackOracle::StoreIsKeyedPolymorphic(TypeFeedbackId ast_id) {
Handle<Object> map_or_code = GetInfo(ast_id);
if (map_or_code->IsCode()) {
@@ -622,12 +642,6 @@ void
TypeFeedbackOracle::ProcessRelocInfos(ZoneList<RelocInfo>* infos) {
case Code::KEYED_LOAD_IC:
case Code::KEYED_STORE_IC:
- if (target->ic_state() == MONOMORPHIC ||
- target->ic_state() == POLYMORPHIC) {
- SetInfo(ast_id, target);
- }
- break;
-
case Code::BINARY_OP_IC:
case Code::COMPARE_IC:
case Code::TO_BOOLEAN_IC:
Index: src/type-info.h
diff --git a/src/type-info.h b/src/type-info.h
index
7d7d7eae4de67c0a97a6a42ddd620f0473d989bd..f295c06dac7feaa52a91a88c031bb755098b3ef3
100644
--- a/src/type-info.h
+++ b/src/type-info.h
@@ -243,9 +243,11 @@ class TypeFeedbackOracle: public ZoneObject {
bool LoadIsMonomorphicNormal(Property* expr);
bool LoadIsUninitialized(Property* expr);
+ bool LoadIsPreMonomorphic(Property* expr);
bool LoadIsPolymorphic(Property* expr);
bool StoreIsUninitialized(TypeFeedbackId ast_id);
bool StoreIsMonomorphicNormal(TypeFeedbackId ast_id);
+ bool StoreIsPreMonomorphic(TypeFeedbackId ast_id);
bool StoreIsKeyedPolymorphic(TypeFeedbackId ast_id);
bool CallIsMonomorphic(Call* expr);
bool CallNewIsMonomorphic(CallNew* expr);
Index: test/mjsunit/unbox-double-arrays.js
diff --git a/test/mjsunit/unbox-double-arrays.js
b/test/mjsunit/unbox-double-arrays.js
index
4e8718eb3fe63c6e8f1a68f1a3f1738d16320bd5..5ed404025f69bf08b9ced1c55d973d507590dfa1
100644
--- a/test/mjsunit/unbox-double-arrays.js
+++ b/test/mjsunit/unbox-double-arrays.js
@@ -345,8 +345,6 @@ function testOneArrayType(allocator) {
-Infinity,
expected_array_value(7));
- assertOptimized(test_various_stores);
-
// Make sure that we haven't converted from fast double.
assertTrue(%HasFastDoubleElements(large_array));
}
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/groups/opt_out.
