Enable GVN for polymorphic loads by not expanding them at the HIR level.

src/arm/lithium-codegen-arm.cc

Index: src/arm/lithium-codegen-arm.cc
===================================================================
--- src/arm/lithium-codegen-arm.cc	(revision 7299)
+++ src/arm/lithium-codegen-arm.cc	(working copy)
@@ -2175,6 +2175,69 @@
 }
 
 
+void LCodeGen::EmitLoadField(Register result,
+                             Register object,
+                             Handle<Map> type,
+                             LookupResult* lookup) {
+  ASSERT(lookup->IsProperty() && lookup->type() == FIELD);
+  int index = lookup->GetLocalFieldIndexFromMap(*type);
+  int offset = index * kPointerSize;
+  if (index < 0) {
+    // Negative property indices are in-object properties, indexed
+    // from the end of the fixed part of the object.
+    __ ldr(result, FieldMemOperand(object, offset + type->instance_size()));
+  } else {
+    // Non-negative property indices are in the properties array.
+    __ ldr(result, FieldMemOperand(object, JSObject::kPropertiesOffset));
+    __ ldr(result, FieldMemOperand(result, offset + FixedArray::kHeaderSize));
+  }
+}
+
+
+void LCodeGen::DoLoadNamedFieldPolymorphic(LLoadNamedFieldPolymorphic* instr) {
+  Register object = ToRegister(instr->object());
+  Register result = ToRegister(instr->result());
+  Register scratch = scratch0();
+  Label done;
+  int map_count = instr->hydrogen()->types()->length();

[Kevin Millikin (Chromium), 2011/03/23 15:37:29]

This function still feels too complicated.  Isn't it the case that map_count ==
0 implies needs_generic, because map_count is necessarily less than the number
of maps initially, which is at least two.

Then we could try something like:

if (map_count == 0) {
  ASSERT(needs_generic);
  // Call the IC.
} else {
  for (int i = 0; i < map_count - 1; ++i) ...
  __ cmp(scratch, /* last map */);
  if (needs_generic) {
    Label load;
    __ b(eq, &load);
    // Call the IC.
    __ b(&done);
    __ bind(&load);
  } else {
    DeoptimizeIf(...);
  }
  EmitLoadField(...);
  __ bind(&done);
}

[fschneider, 2011/03/24 08:43:30]

Done.

+  __ ldr(scratch, FieldMemOperand(object, HeapObject::kMapOffset));
+  for (int i = 0; i < map_count - 1; ++i) {
+    Handle<Map> map = instr->hydrogen()->types()->at(i);
+    LookupResult lookup;
+    map->LookupInDescriptors(NULL, *instr->hydrogen()->name(), &lookup);

[Kevin Millikin (Chromium), 2011/03/23 15:37:29]

I think you can move the call to LookupInDescriptors into EmitLoadField (and not
pass the LookupResult arguments).

[fschneider, 2011/03/24 08:43:30]

Done.

+    Label next;
+    __ cmp(scratch, Operand(map));
+    __ b(ne, &next);
+    EmitLoadField(result, object, map, &lookup);
+    __ b(&done);
+    __ bind(&next);
+  }
+  if (map_count > 0) {
+    Handle<Map> map = instr->hydrogen()->types()->at(map_count - 1);

[Kevin Millikin (Chromium), 2011/03/23 15:37:29]

This could be instr->hydrogen()->types()->last();

[fschneider, 2011/03/24 08:43:30]

Done.

+    LookupResult lookup;
+    map->LookupInDescriptors(NULL, *instr->hydrogen()->name(), &lookup);
+    __ cmp(scratch, Operand(map));
+    if (instr->hydrogen()->need_generic()) {
+      Label generic;
+      __ b(ne, &generic);
+      EmitLoadField(result, object, map, &lookup);
+      __ b(&done);
+      __ bind(&generic);
+    } else {
+      DeoptimizeIf(ne, instr->environment());
+      EmitLoadField(result, object, map, &lookup);
+    }
+  }
+  if (instr->hydrogen()->need_generic()) {
+    __ mov(r2, Operand(instr->hydrogen()->name()));
+    Handle<Code> ic(
+        isolate()->builtins()->builtin(Builtins::LoadIC_Initialize));
+    CallCode(ic, RelocInfo::CODE_TARGET, instr);
+  }
+  __ bind(&done);
+}
+
+
 void LCodeGen::DoLoadNamedGeneric(LLoadNamedGeneric* instr) {
   ASSERT(ToRegister(instr->object()).is(r0));
   ASSERT(ToRegister(instr->result()).is(r0));