Introduce extra IC state to record additional feedback from IC-s.

src/ic.cc

 // Copyright 2006-2009 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 464 matching lines @@
   // Change the receiver to the result of calling ToObject on it.
   const int argc = this->target()->arguments_count();
   StackFrameLocator locator;
   JavaScriptFrame* frame = locator.FindJavaScriptFrame(0);
   int index = frame->ComputeExpressionsCount() - (argc + 1);
   frame->SetExpression(index, *Factory::ToObject(object));
 }
 
 
 MaybeObject* CallICBase::LoadFunction(State state,
+                                      Code::ExtraICState extra_ic_state,
                                       Handle<Object> object,
                                       Handle<String> name) {
   // If the object is undefined or null it's illegal to try to get any
   // of its properties; throw a TypeError in that case.
   if (object->IsUndefined() || object->IsNull()) {
     return TypeError("non_object_property_call", object, name);
   }
 
   if (object->IsString() || object->IsNumber() || object->IsBoolean()) {
     ReceiverToObject(object);
@@ skipping 25 matching lines @@
     // If the object does not have the requested property, check which
     // exception we need to throw.
     if (IsContextual(object)) {
       return ReferenceError("not_defined", name);
     }
     return TypeError("undefined_method", object, name);
   }
 
   // Lookup is valid: Update inline cache and stub cache.
   if (FLAG_use_ic) {
-    UpdateCaches(&lookup, state, object, name);
+    UpdateCaches(&lookup, state, extra_ic_state, object, name);
   }
 
   // Get the property.
   PropertyAttributes attr;
   Object* result;
   { MaybeObject* maybe_result =
         object->GetProperty(*object, &lookup, *name, &attr);
     if (!maybe_result->ToObject(&result)) return maybe_result;
   }
   if (lookup.type() == INTERCEPTOR) {
@@ skipping 30 matching lines @@
   MaybeObject* answer = result;
   if (!result->IsJSFunction()) {
     answer = TypeError("property_not_function", object, name);
   }
   return answer;
 }
 
 
 void CallICBase::UpdateCaches(LookupResult* lookup,
                               State state,
+                              Code::ExtraICState extra_ic_state,
                               Handle<Object> object,
                               Handle<String> name) {
   // Bail out if we didn't find a result.
   if (!lookup->IsProperty() || !lookup->IsCacheable()) return;
 
   if (lookup->holder() != *object &&
       HasNormalObjectsInPrototypeChain(lookup, object->GetPrototype())) {
     // Suppress optimization for prototype chains with slow properties objects
     // in the middle.
     return;
@@ skipping 26 matching lines @@
         break;
       }
       case CONSTANT_FUNCTION: {
         // Get the constant function and compute the code stub for this
         // call; used for rewriting to monomorphic state and making sure
         // that the code stub is in the stub cache.
         JSFunction* function = lookup->GetConstantFunction();
         maybe_code = StubCache::ComputeCallConstant(argc,
                                                     in_loop,
                                                     kind_,
+                                                    extra_ic_state,
                                                     *name,
                                                     *object,
                                                     lookup->holder(),
                                                     function);
         break;
       }
       case NORMAL: {
         if (!object->IsJSObject()) return;
         Handle<JSObject> receiver = Handle<JSObject>::cast(object);
 
@@ skipping 63 matching lines @@
   TraceIC(kind_ == Code::CALL_IC ? "CallIC" : "KeyedCallIC",
       name, state, target(), in_loop ? " (in-loop)" : "");
 #endif
 }
 
 
 MaybeObject* KeyedCallIC::LoadFunction(State state,
                                        Handle<Object> object,
                                        Handle<Object> key) {
   if (key->IsSymbol()) {
-    return CallICBase::LoadFunction(state, object, Handle<String>::cast(key));
+    return CallICBase::LoadFunction(state,
+                                    Code::kNoExtraICState,
+                                    object,
+                                    Handle<String>::cast(key));
   }
 
   if (object->IsUndefined() || object->IsNull()) {
     return TypeError("non_object_property_call", object, key);
   }
 
   if (object->IsString() || object->IsNumber() || object->IsBoolean()) {
     ReceiverToObject(object);
   }
 
@@ skipping 910 matching lines @@
   } else {
     CompileLazy(function_handle, CLEAR_EXCEPTION);
   }
   return *function_handle;
 }
 
 
 // Used from ic-<arch>.cc.
 MUST_USE_RESULT MaybeObject* CallIC_Miss(Arguments args) {
   NoHandleAllocation na;
-  ASSERT(args.length() == 2);
+  ASSERT(args.length() == 2 || args.length() == 3);
   CallIC ic;
-  IC::State state = IC::StateFrom(ic.target(), args[0], args[1]);
+  IC::State state;
+  Code::ExtraICState extra_ic_state;
+  if (args.length() == 2) {

[Mads Ager (chromium), 2011/01/17 14:06:00]

As discussed offline I would like to keep all the patching decisions in the
runtime system if possible. Based on receiver, name and target code stub we
should be able to make the decision without extra arguments to the miss code.
This would keep generated code simple: if you can't handle it, just call miss.
And we should have all the flexibility needed in the runtime system.

+    state = IC::StateFrom(ic.target(), args[0], args[1]);
+    extra_ic_state = Code::kNoExtraICState;
+  } else {
+    ASSERT(args.length() == 3);
+    ASSERT(ic.target()->ic_state() == MONOMORPHIC);
+    // Extra IC state change is requested. Use PREMONOMORPHIC to
+    // trigger generating a new stub.
+    state = PREMONOMORPHIC;
+    extra_ic_state = static_cast<Code::ExtraICState>(
+        Smi::cast(args[2])->value());
+  }
+  MaybeObject* maybe_result = ic.LoadFunction(state,
+                                              extra_ic_state,
+                                              args.at<Object>(0),
+                                              args.at<String>(1));
   Object* result;
-  { MaybeObject* maybe_result =
-       ic.LoadFunction(state, args.at<Object>(0), args.at<String>(1));
-    if (!maybe_result->ToObject(&result)) return maybe_result;
-  }
+  if (!maybe_result->ToObject(&result)) return maybe_result;
 
   // The first time the inline cache is updated may be the first time the
   // function it references gets called.  If the function was lazily compiled
   // then the first call will trigger a compilation.  We check for this case
   // and we do the compilation immediately, instead of waiting for the stub
   // currently attached to the JSFunction object to trigger compilation.  We
   // do this in the case where we know that the inline cache is inside a loop,
   // because then we know that we want to optimize the function.
   if (!result->IsJSFunction() || JSFunction::cast(result)->is_compiled()) {
     return result;
@@ skipping 505 matching lines @@
 #undef ADDR
 };
 
 
 Address IC::AddressFromUtilityId(IC::UtilityId id) {
   return IC_utilities[id];
 }
 
 
 } }  // namespace v8::internal