Revision: 17335
Author: [email protected]
Date: Wed Oct 23 10:41:21 2013 UTC
Log: Add a soft-deopt in keyed element access when current IC is
pre-monomorphic and no type feedback was collected.
BUG=
[email protected]
Review URL: https://codereview.chromium.org/32643004
http://code.google.com/p/v8/source/detail?r=17335
Modified:
/branches/bleeding_edge/src/ast.cc
/branches/bleeding_edge/src/ast.h
/branches/bleeding_edge/src/hydrogen.cc
/branches/bleeding_edge/src/ic.cc
/branches/bleeding_edge/src/ic.h
/branches/bleeding_edge/src/type-info.cc
/branches/bleeding_edge/src/type-info.h
/branches/bleeding_edge/test/mjsunit/unbox-double-arrays.js
=======================================
--- /branches/bleeding_edge/src/ast.cc Mon Oct 21 12:32:38 2013 UTC
+++ /branches/bleeding_edge/src/ast.cc Wed Oct 23 10:41:21 2013 UTC
@@ -139,6 +139,7 @@
assignment_id_(GetNextId(isolate)),
is_monomorphic_(false),
is_uninitialized_(false),
+ is_pre_monomorphic_(false),
store_mode_(STANDARD_STORE) { }
@@ -426,7 +427,9 @@
is_uninitialized_ = oracle->LoadIsUninitialized(this);
if (is_uninitialized_) return;
+ is_pre_monomorphic_ = oracle->LoadIsPreMonomorphic(this);
is_monomorphic_ = oracle->LoadIsMonomorphicNormal(this);
+ ASSERT(!is_pre_monomorphic_ || !is_monomorphic_);
receiver_types_.Clear();
if (key()->IsPropertyName()) {
FunctionPrototypeStub proto_stub(Code::LOAD_IC);
@@ -456,7 +459,10 @@
TypeFeedbackId id = AssignmentFeedbackId();
is_uninitialized_ = oracle->StoreIsUninitialized(id);
if (is_uninitialized_) return;
+
+ is_pre_monomorphic_ = oracle->StoreIsPreMonomorphic(id);
is_monomorphic_ = oracle->StoreIsMonomorphicNormal(id);
+ ASSERT(!is_pre_monomorphic_ || !is_monomorphic_);
receiver_types_.Clear();
if (prop->key()->IsPropertyName()) {
Literal* lit_key = prop->key()->AsLiteral();
=======================================
--- /branches/bleeding_edge/src/ast.h Mon Oct 21 12:32:38 2013 UTC
+++ /branches/bleeding_edge/src/ast.h Wed Oct 23 10:41:21 2013 UTC
@@ -1669,6 +1669,10 @@
return STANDARD_STORE;
}
bool IsUninitialized() { return is_uninitialized_; }
+ bool IsPreMonomorphic() { return is_pre_monomorphic_; }
+ bool HasNoTypeInformation() {
+ return is_uninitialized_ || is_pre_monomorphic_;
+ }
TypeFeedbackId PropertyFeedbackId() { return reuse(id()); }
protected:
@@ -1681,6 +1685,7 @@
key_(key),
load_id_(GetNextId(isolate)),
is_monomorphic_(false),
+ is_pre_monomorphic_(false),
is_uninitialized_(false),
is_string_access_(false),
is_function_prototype_(false) { }
@@ -1692,6 +1697,7 @@
SmallMapList receiver_types_;
bool is_monomorphic_ : 1;
+ bool is_pre_monomorphic_ : 1;
bool is_uninitialized_ : 1;
bool is_string_access_ : 1;
bool is_function_prototype_ : 1;
@@ -2098,6 +2104,10 @@
void RecordTypeFeedback(TypeFeedbackOracle* oracle, Zone* zone);
virtual bool IsMonomorphic() V8_OVERRIDE { return is_monomorphic_; }
bool IsUninitialized() { return is_uninitialized_; }
+ bool IsPreMonomorphic() { return is_pre_monomorphic_; }
+ bool HasNoTypeInformation() {
+ return is_uninitialized_ || is_pre_monomorphic_;
+ }
virtual SmallMapList* GetReceiverTypes() V8_OVERRIDE {
return &receiver_types_;
}
@@ -2130,6 +2140,7 @@
bool is_monomorphic_ : 1;
bool is_uninitialized_ : 1;
+ bool is_pre_monomorphic_ : 1;
KeyedAccessStoreMode store_mode_ : 5; // Windows treats as signed,
// must have extra bit.
SmallMapList receiver_types_;
=======================================
--- /branches/bleeding_edge/src/hydrogen.cc Wed Oct 23 08:46:46 2013 UTC
+++ /branches/bleeding_edge/src/hydrogen.cc Wed Oct 23 10:41:21 2013 UTC
@@ -5806,13 +5806,14 @@
expr->GetStoreMode(), has_side_effects);
} else {
if (is_store) {
- if (expr->IsAssignment() && expr->AsAssignment()->IsUninitialized())
{
+ if (expr->IsAssignment() &&
+ expr->AsAssignment()->HasNoTypeInformation()) {
Add<HDeoptimize>("Insufficient type feedback for keyed store",
Deoptimizer::SOFT);
}
instr = BuildStoreKeyedGeneric(obj, key, val);
} else {
- if (expr->AsProperty()->IsUninitialized()) {
+ if (expr->AsProperty()->HasNoTypeInformation()) {
Add<HDeoptimize>("Insufficient type feedback for keyed load",
Deoptimizer::SOFT);
}
=======================================
--- /branches/bleeding_edge/src/ic.cc Wed Oct 16 14:17:31 2013 UTC
+++ /branches/bleeding_edge/src/ic.cc Wed Oct 23 10:41:21 2013 UTC
@@ -117,7 +117,9 @@
#define TRACE_IC(type, name) \
ASSERT((TraceIC(type, name), true))
-IC::IC(FrameDepth depth, Isolate* isolate) : isolate_(isolate) {
+IC::IC(FrameDepth depth, Isolate* isolate)
+ : isolate_(isolate),
+ target_set_(false) {
// To improve the performance of the (much used) IC code, we unfold a few
// levels of the stack frame iteration code. This yields a ~35% speedup
when
// running DeltaBlue and a ~25% speedup of gbemu with the '--nouse-ic'
flag.
@@ -1362,41 +1364,47 @@
if (MigrateDeprecated(object)) {
return Runtime::GetObjectPropertyOrFail(isolate(), object, key);
}
+
+ MaybeObject* maybe_object = NULL;
+ Handle<Code> stub = generic_stub();
// Check for values that can be converted into an internalized string
directly
// or is representable as a smi.
key = TryConvertKey(key, isolate());
if (key->IsInternalizedString()) {
- return LoadIC::Load(object, Handle<String>::cast(key));
- }
-
- if (FLAG_use_ic && !object->IsAccessCheckNeeded()) {
+ maybe_object = LoadIC::Load(object, Handle<String>::cast(key));
+ if (maybe_object->IsFailure()) return maybe_object;
+ } else if (FLAG_use_ic && !object->IsAccessCheckNeeded()) {
ASSERT(!object->IsJSGlobalProxy());
- Handle<Code> stub = generic_stub();
- if (miss_mode == MISS_FORCE_GENERIC) {
- TRACE_GENERIC_IC(isolate(), "KeyedLoadIC", "force generic");
- } else if (object->IsString() && key->IsNumber()) {
- if (state() == UNINITIALIZED) stub = string_stub();
- } else if (object->IsJSObject()) {
- Handle<JSObject> receiver = Handle<JSObject>::cast(object);
- if (receiver->elements()->map() ==
- isolate()->heap()->non_strict_arguments_elements_map()) {
- stub = non_strict_arguments_stub();
- } else if (receiver->HasIndexedInterceptor()) {
- stub = indexed_interceptor_stub();
- } else if (!key->ToSmi()->IsFailure() &&
- (!target().is_identical_to(non_strict_arguments_stub())))
{
- stub = LoadElementStub(receiver);
+ if (miss_mode != MISS_FORCE_GENERIC) {
+ if (object->IsString() && key->IsNumber()) {
+ if (state() == UNINITIALIZED) stub = string_stub();
+ } else if (object->IsJSObject()) {
+ Handle<JSObject> receiver = Handle<JSObject>::cast(object);
+ if (receiver->elements()->map() ==
+ isolate()->heap()->non_strict_arguments_elements_map()) {
+ stub = non_strict_arguments_stub();
+ } else if (receiver->HasIndexedInterceptor()) {
+ stub = indexed_interceptor_stub();
+ } else if (!key->ToSmi()->IsFailure() &&
+
(!target().is_identical_to(non_strict_arguments_stub()))) {
+ stub = LoadElementStub(receiver);
+ }
}
}
+ }
+ if (!is_target_set()) {
+ if (*stub == *generic_stub()) {
+ TRACE_GENERIC_IC(isolate(), "KeyedLoadIC", "set generic");
+ }
ASSERT(!stub.is_null());
set_target(*stub);
TRACE_IC("LoadIC", key);
}
-
+ if (maybe_object != NULL) return maybe_object;
return Runtime::GetObjectPropertyOrFail(isolate(), object, key);
}
@@ -1936,53 +1944,58 @@
// or is representable as a smi.
key = TryConvertKey(key, isolate());
+ MaybeObject* maybe_object = NULL;
+ Handle<Code> stub = generic_stub();
+
if (key->IsInternalizedString()) {
- return StoreIC::Store(object,
- Handle<String>::cast(key),
- value,
- JSReceiver::MAY_BE_STORE_FROM_KEYED);
- }
+ maybe_object = StoreIC::Store(object,
+ Handle<String>::cast(key),
+ value,
+ JSReceiver::MAY_BE_STORE_FROM_KEYED);
+ if (maybe_object->IsFailure()) return maybe_object;
+ } else {
+ bool use_ic = FLAG_use_ic && !object->IsAccessCheckNeeded() &&
+ !(FLAG_harmony_observation && object->IsJSObject() &&
+ JSObject::cast(*object)->map()->is_observed());
+ if (use_ic && !object->IsSmi()) {
+ // Don't use ICs for maps of the objects in Array's prototype chain.
We
+ // expect to be able to trap element sets to objects with those maps
in
+ // the runtime to enable optimization of element hole access.
+ Handle<HeapObject> heap_object = Handle<HeapObject>::cast(object);
+ if (heap_object->map()->IsMapInArrayPrototypeChain()) use_ic = false;
+ }
- bool use_ic = FLAG_use_ic && !object->IsAccessCheckNeeded() &&
- !(FLAG_harmony_observation && object->IsJSObject() &&
- JSObject::cast(*object)->map()->is_observed());
- if (use_ic && !object->IsSmi()) {
- // Don't use ICs for maps of the objects in Array's prototype chain. We
- // expect to be able to trap element sets to objects with those maps
in the
- // runtime to enable optimization of element hole access.
- Handle<HeapObject> heap_object = Handle<HeapObject>::cast(object);
- if (heap_object->map()->IsMapInArrayPrototypeChain()) use_ic = false;
- }
+ if (use_ic) {
+ ASSERT(!object->IsJSGlobalProxy());
- if (use_ic) {
- ASSERT(!object->IsJSGlobalProxy());
-
- Handle<Code> stub = generic_stub();
- if (miss_mode != MISS_FORCE_GENERIC) {
- if (object->IsJSObject()) {
- Handle<JSObject> receiver = Handle<JSObject>::cast(object);
- bool key_is_smi_like = key->IsSmi() || !key->ToSmi()->IsFailure();
- if (receiver->elements()->map() ==
- isolate()->heap()->non_strict_arguments_elements_map()) {
- stub = non_strict_arguments_stub();
- } else if (key_is_smi_like &&
-
(!target().is_identical_to(non_strict_arguments_stub()))) {
- KeyedAccessStoreMode store_mode = GetStoreMode(receiver, key,
value);
- stub = StoreElementStub(receiver, store_mode);
- } else {
- TRACE_GENERIC_IC(isolate(), "KeyedStoreIC", "key not a number");
+ if (miss_mode != MISS_FORCE_GENERIC) {
+ if (object->IsJSObject()) {
+ Handle<JSObject> receiver = Handle<JSObject>::cast(object);
+ bool key_is_smi_like = key->IsSmi() |
| !key->ToSmi()->IsFailure();
+ if (receiver->elements()->map() ==
+ isolate()->heap()->non_strict_arguments_elements_map()) {
+ stub = non_strict_arguments_stub();
+ } else if (key_is_smi_like &&
+
(!target().is_identical_to(non_strict_arguments_stub()))) {
+ KeyedAccessStoreMode store_mode =
+ GetStoreMode(receiver, key, value);
+ stub = StoreElementStub(receiver, store_mode);
+ }
}
- } else {
- TRACE_GENERIC_IC(isolate(), "KeyedStoreIC", "not an object");
}
- } else {
- TRACE_GENERIC_IC(isolate(), "KeyedStoreIC", "force generic");
+ }
+ }
+
+ if (!is_target_set()) {
+ if (*stub == *generic_stub()) {
+ TRACE_GENERIC_IC(isolate(), "KeyedStoreIC", "set generic");
}
ASSERT(!stub.is_null());
set_target(*stub);
TRACE_IC("StoreIC", key);
}
+ if (maybe_object) return maybe_object;
return Runtime::SetObjectPropertyOrFail(
isolate(), object , key, value, NONE, strict_mode());
}
=======================================
--- /branches/bleeding_edge/src/ic.h Fri Oct 11 14:05:23 2013 UTC
+++ /branches/bleeding_edge/src/ic.h Wed Oct 23 10:41:21 2013 UTC
@@ -155,7 +155,12 @@
#endif
// Set the call-site target.
- void set_target(Code* code) { SetTargetAtAddress(address(), code); }
+ void set_target(Code* code) {
+ SetTargetAtAddress(address(), code);
+ target_set_ = true;
+ }
+
+ bool is_target_set() { return target_set_; }
#ifdef DEBUG
char TransitionMarkFromState(IC::State state);
@@ -235,6 +240,7 @@
// The original code target that missed.
Handle<Code> target_;
State state_;
+ bool target_set_;
DISALLOW_IMPLICIT_CONSTRUCTORS(IC);
};
=======================================
--- /branches/bleeding_edge/src/type-info.cc Mon Oct 21 12:32:38 2013 UTC
+++ /branches/bleeding_edge/src/type-info.cc Wed Oct 23 10:41:21 2013 UTC
@@ -126,6 +126,16 @@
}
return false;
}
+
+
+bool TypeFeedbackOracle::LoadIsPreMonomorphic(Property* expr) {
+ Handle<Object> map_or_code = GetInfo(expr->PropertyFeedbackId());
+ if (map_or_code->IsCode()) {
+ Handle<Code> code = Handle<Code>::cast(map_or_code);
+ return code->is_inline_cache_stub() && code->ic_state() ==
PREMONOMORPHIC;
+ }
+ return false;
+}
bool TypeFeedbackOracle::LoadIsPolymorphic(Property* expr) {
@@ -164,6 +174,16 @@
}
return false;
}
+
+
+bool TypeFeedbackOracle::StoreIsPreMonomorphic(TypeFeedbackId ast_id) {
+ Handle<Object> map_or_code = GetInfo(ast_id);
+ if (map_or_code->IsCode()) {
+ Handle<Code> code = Handle<Code>::cast(map_or_code);
+ return code->ic_state() == PREMONOMORPHIC;
+ }
+ return false;
+}
bool TypeFeedbackOracle::StoreIsKeyedPolymorphic(TypeFeedbackId ast_id) {
@@ -622,12 +642,6 @@
case Code::KEYED_LOAD_IC:
case Code::KEYED_STORE_IC:
- if (target->ic_state() == MONOMORPHIC ||
- target->ic_state() == POLYMORPHIC) {
- SetInfo(ast_id, target);
- }
- break;
-
case Code::BINARY_OP_IC:
case Code::COMPARE_IC:
case Code::TO_BOOLEAN_IC:
=======================================
--- /branches/bleeding_edge/src/type-info.h Mon Oct 21 12:32:38 2013 UTC
+++ /branches/bleeding_edge/src/type-info.h Wed Oct 23 10:41:21 2013 UTC
@@ -243,9 +243,11 @@
bool LoadIsMonomorphicNormal(Property* expr);
bool LoadIsUninitialized(Property* expr);
+ bool LoadIsPreMonomorphic(Property* expr);
bool LoadIsPolymorphic(Property* expr);
bool StoreIsUninitialized(TypeFeedbackId ast_id);
bool StoreIsMonomorphicNormal(TypeFeedbackId ast_id);
+ bool StoreIsPreMonomorphic(TypeFeedbackId ast_id);
bool StoreIsKeyedPolymorphic(TypeFeedbackId ast_id);
bool CallIsMonomorphic(Call* expr);
bool CallNewIsMonomorphic(CallNew* expr);
=======================================
--- /branches/bleeding_edge/test/mjsunit/unbox-double-arrays.js Mon Jul 22
09:16:33 2013 UTC
+++ /branches/bleeding_edge/test/mjsunit/unbox-double-arrays.js Wed Oct 23
10:41:21 2013 UTC
@@ -345,8 +345,6 @@
-Infinity,
expected_array_value(7));
- assertOptimized(test_various_stores);
-
// Make sure that we haven't converted from fast double.
assertTrue(%HasFastDoubleElements(large_array));
}
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/groups/opt_out.
