Introduce extra IC state to record additional feedback from IC-s.

src/ic.cc

Index: src/ic.cc
diff --git a/src/ic.cc b/src/ic.cc
index 645c6fdcf6542304d6b67901e1c649ede62a566e..099a604e801fd8342fb41dcd4cd1d6646feae788 100644
--- a/src/ic.cc
+++ b/src/ic.cc
@@ -482,6 +482,7 @@ void CallICBase::ReceiverToObject(Handle<Object> object) {
 
 
 MaybeObject* CallICBase::LoadFunction(State state,
+                                      Code::ExtraICState extra_ic_state,
                                       Handle<Object> object,
                                       Handle<String> name) {
   // If the object is undefined or null it's illegal to try to get any
@@ -527,7 +528,7 @@ MaybeObject* CallICBase::LoadFunction(State state,
 
   // Lookup is valid: Update inline cache and stub cache.
   if (FLAG_use_ic) {
-    UpdateCaches(&lookup, state, object, name);
+    UpdateCaches(&lookup, state, extra_ic_state, object, name);
   }
 
   // Get the property.
@@ -578,6 +579,7 @@ MaybeObject* CallICBase::LoadFunction(State state,
 
 void CallICBase::UpdateCaches(LookupResult* lookup,
                               State state,
+                              Code::ExtraICState extra_ic_state,
                               Handle<Object> object,
                               Handle<String> name) {
   // Bail out if we didn't find a result.
@@ -624,6 +626,7 @@ void CallICBase::UpdateCaches(LookupResult* lookup,
         maybe_code = StubCache::ComputeCallConstant(argc,
                                                     in_loop,
                                                     kind_,
+                                                    extra_ic_state,
                                                     *name,
                                                     *object,
                                                     lookup->holder(),
@@ -707,7 +710,10 @@ MaybeObject* KeyedCallIC::LoadFunction(State state,
                                        Handle<Object> object,
                                        Handle<Object> key) {
   if (key->IsSymbol()) {
-    return CallICBase::LoadFunction(state, object, Handle<String>::cast(key));
+    return CallICBase::LoadFunction(state,
+                                    Code::kNoExtraICState,
+                                    object,
+                                    Handle<String>::cast(key));
   }
 
   if (object->IsUndefined() || object->IsNull()) {
@@ -1638,14 +1644,28 @@ static JSFunction* CompileFunction(JSFunction* function,
 // Used from ic-<arch>.cc.
 MUST_USE_RESULT MaybeObject* CallIC_Miss(Arguments args) {
   NoHandleAllocation na;
-  ASSERT(args.length() == 2);
+  ASSERT(args.length() == 2 || args.length() == 3);
   CallIC ic;
-  IC::State state = IC::StateFrom(ic.target(), args[0], args[1]);
+  IC::State state;
+  Code::ExtraICState extra_ic_state;
+  if (args.length() == 2) {

[Mads Ager (chromium), 2011/01/17 14:06:00]

As discussed offline I would like to keep all the patching decisions in the
runtime system if possible. Based on receiver, name and target code stub we
should be able to make the decision without extra arguments to the miss code.
This would keep generated code simple: if you can't handle it, just call miss.
And we should have all the flexibility needed in the runtime system.

+    state = IC::StateFrom(ic.target(), args[0], args[1]);
+    extra_ic_state = Code::kNoExtraICState;
+  } else {
+    ASSERT(args.length() == 3);
+    ASSERT(ic.target()->ic_state() == MONOMORPHIC);
+    // Extra IC state change is requested. Use PREMONOMORPHIC to
+    // trigger generating a new stub.
+    state = PREMONOMORPHIC;
+    extra_ic_state = static_cast<Code::ExtraICState>(
+        Smi::cast(args[2])->value());
+  }
+  MaybeObject* maybe_result = ic.LoadFunction(state,
+                                              extra_ic_state,
+                                              args.at<Object>(0),
+                                              args.at<String>(1));
   Object* result;
-  { MaybeObject* maybe_result =
-       ic.LoadFunction(state, args.at<Object>(0), args.at<String>(1));
-    if (!maybe_result->ToObject(&result)) return maybe_result;
-  }
+  if (!maybe_result->ToObject(&result)) return maybe_result;
 
   // The first time the inline cache is updated may be the first time the
   // function it references gets called.  If the function was lazily compiled