Reviewers: danno,
Description:
Do deferred migration of maps after deoptimizing once.
BUG=
Please review this at https://codereview.chromium.org/50213003/
SVN Base: https://v8.googlecode.com/svn/branches/bleeding_edge
Affected files (+39, -2 lines):
M src/hydrogen-instructions.h
M src/objects-inl.h
M src/objects.h
M src/objects.cc
Index: src/hydrogen-instructions.h
diff --git a/src/hydrogen-instructions.h b/src/hydrogen-instructions.h
index
80773bf14789e8524dc4c46184588641d6396495..428cb78f241d64f968ea04743895600dea774dde
100644
--- a/src/hydrogen-instructions.h
+++ b/src/hydrogen-instructions.h
@@ -2689,7 +2689,9 @@ class HCheckMaps V8_FINAL : public
HTemplateInstruction<2> {
private:
void Add(Handle<Map> map, Zone* zone) {
map_set_.Add(Unique<Map>(map), zone);
- if (!has_migration_target_ && map->is_migration_target()) {
+ if (!has_migration_target_ &&
+ map->is_migration_target() &&
+ map->has_migrated()) {
has_migration_target_ = true;
SetGVNFlag(kChangesNewSpacePromotion);
}
Index: src/objects-inl.h
diff --git a/src/objects-inl.h b/src/objects-inl.h
index
deb33653f7844c70ae9d848f5a59e62cbbe43989..408375f2a87a64d6d57016dcd3478b43b39f3205
100644
--- a/src/objects-inl.h
+++ b/src/objects-inl.h
@@ -4289,6 +4289,30 @@ uint32_t Map::bit_field3() {
}
+void Map::set_bit_field4(uint32_t bits) {
+ // Ensure the upper 2 bits have the same value by sign extending it.
This is
+ // necessary to be able to use the 31st bit.
+ int value = bits << 1;
+ WRITE_FIELD(this, kBitField4Offset, Smi::FromInt(value >> 1));
+}
+
+
+uint32_t Map::bit_field4() {
+ Object* value = READ_FIELD(this, kBitField4Offset);
+ return Smi::cast(value)->value();
+}
+
+
+void Map::set_has_migrated(bool value) {
+ set_bit_field4(HasMigrated::update(bit_field4(), value));
+}
+
+
+bool Map::has_migrated() {
+ return HasMigrated::decode(bit_field4());
+}
+
+
void Map::ClearTransitions(Heap* heap, WriteBarrierMode mode) {
Object* back_pointer = GetBackPointer();
Index: src/objects.cc
diff --git a/src/objects.cc b/src/objects.cc
index
f7c89175da75c2fb7916015a34adf9954b565eef..263fee74548463432322cd3ea293a79f611e2165
100644
--- a/src/objects.cc
+++ b/src/objects.cc
@@ -3842,6 +3842,7 @@ void JSObject::MigrateInstance(Handle<JSObject>
object) {
Handle<Map> original_map(object->map());
GeneralizeFieldRepresentation(
object, 0, Representation::None(), ALLOW_AS_CONSTANT);
+ original_map->set_has_migrated(true);
if (FLAG_trace_migration) {
object->PrintInstanceMigration(stdout, *original_map, object->map());
}
Index: src/objects.h
diff --git a/src/objects.h b/src/objects.h
index
c0835e21eb9cb5d3df0d1f5ad1e464b6d4022323..db4c27e02f691615a2b6681ad44567bb6469ace4
100644
--- a/src/objects.h
+++ b/src/objects.h
@@ -5635,6 +5635,15 @@ class Map: public HeapObject {
class IsUnstable: public BitField<bool, 29, 1> {};
class IsMigrationTarget: public BitField<bool, 30, 1> {};
+ // Bit field 4.
+ inline uint32_t bit_field4();
+ inline void set_bit_field4(uint32_t bits);
+
+ class HasMigrated: public BitField<int, 0, 1> {};
+
+ inline void set_has_migrated(bool value);
+ inline bool has_migrated();
+
// Tells whether the object in the prototype property will be used
// for instances created from this function. If the prototype
// property is set to a value that is not a JSObject, the prototype
@@ -6185,7 +6194,8 @@ class Map: public HeapObject {
static const int kCodeCacheOffset = kDescriptorsOffset + kPointerSize;
static const int kDependentCodeOffset = kCodeCacheOffset + kPointerSize;
static const int kBitField3Offset = kDependentCodeOffset + kPointerSize;
- static const int kSize = kBitField3Offset + kPointerSize;
+ static const int kBitField4Offset = kBitField3Offset + kPointerSize;
+ static const int kSize = kBitField4Offset + kPointerSize;
// Layout of pointer fields. Heap iteration code relies on them
// being continuously allocated.
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/groups/opt_out.
