Reviewers: Toon Verwaest,
Message:
Hi Toon,
There was an error in my KeyedStoreIC fix yesterday, happily found by
Golem. The
problem was that too much of the logic for remaining monomorphic was moved
under
the condition that we have a transitioning store mode. I also better
protected
the else case. PTAL, thanks!
--Michael
Description:
Perf regression: changes in KeyedStoreIC introduced polymorphism.
When fixing bug 350884, I introduced an error that meant we went
polymorphic in KeyedStoreIC where we stayed monomorphic before. This
CL addresses the error, while preserving the bug fix for 350884.
[email protected]
Please review this at https://codereview.chromium.org/198793002/
SVN Base: https://v8.googlecode.com/svn/branches/bleeding_edge
Affected files (+10, -10 lines):
M src/ic.cc
Index: src/ic.cc
diff --git a/src/ic.cc b/src/ic.cc
index
9e30aeaf3a77e8c9fda86b37b02b5b23dac0d40d..db3e0c789d4f60b686842d4c41840cdacf9f6518
100644
--- a/src/ic.cc
+++ b/src/ic.cc
@@ -1435,22 +1435,22 @@ Handle<Code>
KeyedStoreIC::StoreElementStub(Handle<JSObject> receiver,
KeyedStoreIC::GetKeyedAccessStoreMode(target()->extra_ic_state());
Handle<Map> previous_receiver_map = target_receiver_maps.at(0);
if (state() == MONOMORPHIC) {
+ Handle<Map> transitioned_receiver_map = receiver_map;
if (IsTransitionStoreMode(store_mode)) {
+ transitioned_receiver_map = ComputeTransitionedMap(receiver,
store_mode);
+ }
+ if (receiver_map.is_identical_to(previous_receiver_map) ||
+ IsTransitionOfMonomorphicTarget(
+ MapToType<HeapType>(transitioned_receiver_map, isolate()))) {
// If the "old" and "new" maps are in the same elements map family,
or
// if they at least come from the same origin for a transitioning
store,
// stay MONOMORPHIC and use the map for the most generic
ElementsKind.
- Handle<Map> transitioned_receiver_map =
- ComputeTransitionedMap(receiver, store_mode);
- if (*previous_receiver_map == receiver->map() ||
- IsTransitionOfMonomorphicTarget(
- MapToType<HeapType>(transitioned_receiver_map, isolate()))) {
- store_mode = GetNonTransitioningStoreMode(store_mode);
- return isolate()->stub_cache()->ComputeKeyedStoreElement(
- transitioned_receiver_map, strict_mode(), store_mode);
- }
+ store_mode = GetNonTransitioningStoreMode(store_mode);
+ return isolate()->stub_cache()->ComputeKeyedStoreElement(
+ transitioned_receiver_map, strict_mode(), store_mode);
} else if (*previous_receiver_map == receiver->map() &&
old_store_mode == STANDARD_STORE &&
- (IsGrowStoreMode(store_mode) ||
+ (store_mode == STORE_AND_GROW_NO_TRANSITION ||
store_mode == STORE_NO_TRANSITION_IGNORE_OUT_OF_BOUNDS ||
store_mode == STORE_NO_TRANSITION_HANDLE_COW)) {
// A "normal" IC that handles stores can switch to a version that can
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
