Introduce HTransitionElementsKind instruction.

src/objects.cc

Index: src/objects.cc
diff --git a/src/objects.cc b/src/objects.cc
index 561273230389c5909163fd1fd253f887b7e66490..9caf8f4274277fd52238d02dd15fc3f493c80d54 100644
--- a/src/objects.cc
+++ b/src/objects.cc
@@ -2085,6 +2085,44 @@ void Map::LookupInDescriptors(JSObject* holder,
 }
 
 
+// If |map| is contained in |maps_list|, returns |map|; otherwise returns NULL.
+Map* GetMapIfPresent(Map* map, MapList* maps_list) {
+  for (int i = 0; i < maps_list->length(); ++i) {
+    if (maps_list->at(i) == map) return map;
+  }
+  return NULL;
+}
+
+
+Map* Map::FindTransitionedMap(MapList* candidates) {
+  ElementsKind elms_kind = elements_kind();
+  if (elms_kind == FAST_DOUBLE_ELEMENTS) {
+    bool dummy = true;
+    Map* fast_map = LookupElementsTransitionMap(FAST_ELEMENTS, &dummy);
+    if (fast_map == NULL) return NULL;
+    return GetMapIfPresent(fast_map, candidates);

[danno, 2011/10/17 12:36:05]

I think it might be clearer is you re-wrote GetMapIfPresent to be a "Contains"
predicate, so that this code reads like:

if (Contains(candidates, fast_map)) return fast_map;

[Jakob Kummerow, 2011/10/18 08:13:09]

Done.

+  }
+  if (elms_kind == FAST_SMI_ONLY_ELEMENTS) {
+    bool dummy = true;
+    Map* double_map = LookupElementsTransitionMap(FAST_DOUBLE_ELEMENTS, &dummy);
+    // In the current implementation, if the DOUBLE map doesn't exist, the
+    // FAST map can't exist either.
+    if (double_map == NULL) return NULL;
+    Map* fast_map = double_map->LookupElementsTransitionMap(FAST_ELEMENTS,
+                                                            &dummy);
+    if (fast_map == NULL) {
+      return GetMapIfPresent(double_map, candidates);
+    }
+    // Both double_map and fast_map are non-NULL. Return fast_map if it's in
+    // maps_list, double_map otherwise.
+    Map* fast_map_present = GetMapIfPresent(fast_map, candidates);
+    if (fast_map_present != NULL) return fast_map_present;

[danno, 2011/10/17 12:36:05]

fast_map_present is the same as fast_map, except and can be null, I think that
contains predicate would be clearer here, too.

[Jakob Kummerow, 2011/10/18 08:13:09]

Done.

+    return GetMapIfPresent(double_map, candidates);
+  }
+  return NULL;
+}
+
+
 static Map* GetElementsTransitionMapFromDescriptor(Object* descriptor_contents,
                                                    ElementsKind elements_kind) {
   if (descriptor_contents->IsMap()) {
@@ -9313,6 +9351,39 @@ MaybeObject* JSObject::SetElementWithoutInterceptor(uint32_t index,
 }
 
 
+MUST_USE_RESULT MaybeObject* JSObject::TransitionElementsKind(
+    ElementsKind to_kind) {
+  ElementsKind from_kind = map()->elements_kind();
+  if (from_kind == FAST_SMI_ONLY_ELEMENTS) {
+    FixedArray* elms = FixedArray::cast(elements());
+    uint32_t capacity = static_cast<uint32_t>(elms->length());
+    uint32_t length = capacity;
+    if (IsJSArray()) {
+      CHECK(JSArray::cast(this)->length()->ToArrayIndex(&length));
+    }
+    if (to_kind == FAST_DOUBLE_ELEMENTS) {
+      return SetFastDoubleElementsCapacityAndLength(capacity, length);
+    } else if (to_kind == FAST_ELEMENTS) {
+      MaybeObject* maybe_new_map = GetElementsTransitionMap(FAST_ELEMENTS);
+      Map* new_map;
+      if (!maybe_new_map->To(&new_map)) return maybe_new_map;
+      set_map(new_map);
+      return this;
+    }
+  } else if (from_kind == FAST_DOUBLE_ELEMENTS && to_kind == FAST_ELEMENTS) {
+    FixedDoubleArray* elms = FixedDoubleArray::cast(elements());
+    uint32_t capacity = static_cast<uint32_t>(elms->length());
+    uint32_t length = capacity;
+    if (IsJSArray()) {
+      CHECK(JSArray::cast(this)->length()->ToArrayIndex(&length));
+    }
+    return SetFastElementsCapacityAndLength(
+        capacity, length, kDontAllowSmiOnlyElements);
+  }

[danno, 2011/10/17 12:36:05]

This code should be unreachable, right? Perhaps an appropriate assert?

[Jakob Kummerow, 2011/10/18 08:13:09]

This should indeed be unreachable, but we have mjsunit/fuzz-natives which calls
all runtime functions with default objects as arguments and expects us not to
crash.
I've moved the non-crashing check to runtime.cc and could then use an
UNREACHABLE() here.

+  return Failure::Exception();

[danno, 2011/10/17 12:36:05]

Is returning an exception failure really OK? Does that create the right
exception object to be thrown/etc? I think you need a DoThrow with the
appropriate exception object for this to be OK. 

[Jakob Kummerow, 2011/10/18 08:13:09]

Returning Failure::Exception is the way other methods in objects.cc that return
MaybeObject*s do it, and it seems to work just fine. But it's a moot point
either way, see comment above.

+}
+
+
 MaybeObject* JSArray::JSArrayUpdateLengthFromIndex(uint32_t index,
                                                    Object* value) {
   uint32_t old_len = 0;