Enable GVN for polymorphic loads by not expanding them at the HIR level.

src/x64/lithium-codegen-x64.cc

 // Copyright 2011 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 2076 matching lines @@
   Register result = ToRegister(instr->result());
   if (instr->hydrogen()->is_in_object()) {
     __ movq(result, FieldOperand(object, instr->hydrogen()->offset()));
   } else {
     __ movq(result, FieldOperand(object, JSObject::kPropertiesOffset));
     __ movq(result, FieldOperand(result, instr->hydrogen()->offset()));
   }
 }
 
 
+void LCodeGen::EmitLoadField(Register result,
+                             Register object,
+                             Handle<Map> type,
+                             LookupResult* lookup) {
+  ASSERT(lookup->IsProperty() && lookup->type() == FIELD);
+  int index = lookup->GetLocalFieldIndexFromMap(*type);
+  int offset = index * kPointerSize;
+  if (index < 0) {
+    // Negative property indices are in-object properties, indexed
+    // from the end of the fixed part of the object.
+    __ movq(result, FieldOperand(object, offset + type->instance_size()));
+  } else {
+    // Non-negative property indices are in the properties array.
+    __ movq(result, FieldOperand(object, JSObject::kPropertiesOffset));
+    __ movq(result, FieldOperand(result, offset + FixedArray::kHeaderSize));
+  }
+}
+
+
+void LCodeGen::DoLoadNamedFieldPolymorphic(LLoadNamedFieldPolymorphic* instr) {
+  Register object = ToRegister(instr->object());
+  Register result = ToRegister(instr->result());
+  NearLabel done;
+  int map_count = instr->hydrogen()->types()->length();
+  for (int i = 0; i < map_count - 1; ++i) {
+    Handle<Map> map = instr->hydrogen()->types()->at(i);
+    LookupResult lookup;
+    map->LookupInDescriptors(NULL, *instr->hydrogen()->name(), &lookup);
+    NearLabel next;
+    __ Cmp(FieldOperand(object, HeapObject::kMapOffset), map);
+    __ j(not_equal, &next);
+    EmitLoadField(result, object, map, &lookup);
+    __ jmp(&done);
+    __ bind(&next);
+  }
+  if (map_count > 0) {
+    Handle<Map> map = instr->hydrogen()->types()->at(map_count - 1);
+    LookupResult lookup;
+    map->LookupInDescriptors(NULL, *instr->hydrogen()->name(), &lookup);
+    __ Cmp(FieldOperand(object, HeapObject::kMapOffset), map);
+    if (instr->hydrogen()->need_generic()) {
+      NearLabel generic;
+      __ j(not_equal, &generic);
+      EmitLoadField(result, object, map, &lookup);
+      __ jmp(&done);
+      __ bind(&generic);
+    } else {
+      DeoptimizeIf(not_equal, instr->environment());
+      EmitLoadField(result, object, map, &lookup);
+    }
+  }
+  if (instr->hydrogen()->need_generic()) {
+    __ Move(rcx, instr->hydrogen()->name());
+    Handle<Code> ic(
+        isolate()->builtins()->builtin(Builtins::LoadIC_Initialize));
+    CallCode(ic, RelocInfo::CODE_TARGET, instr);
+  }
+  __ bind(&done);
+}
+
+
 void LCodeGen::DoLoadNamedGeneric(LLoadNamedGeneric* instr) {
   ASSERT(ToRegister(instr->object()).is(rax));
   ASSERT(ToRegister(instr->result()).is(rax));
 
   __ Move(rcx, instr->name());
   Handle<Code> ic(isolate()->builtins()->builtin(Builtins::LoadIC_Initialize));
   CallCode(ic, RelocInfo::CODE_TARGET, instr);
 }
 
 
@@ skipping 1712 matching lines @@
   RegisterEnvironmentForDeoptimization(environment);
   ASSERT(osr_pc_offset_ == -1);
   osr_pc_offset_ = masm()->pc_offset();
 }
 
 #undef __
 
 } }  // namespace v8::internal
 
 #endif  // V8_TARGET_ARCH_X64