Make sure transitioned arrays efficiently call builtin Array functions

src/x64/lithium-codegen-x64.cc

-// Copyright 2011 the V8 project authors. All rights reserved.
+// Copyright 2012 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
 //       with the distribution.
@@ skipping 3728 matching lines @@
         isolate()->factory()->NewJSGlobalPropertyCell(target);
     __ movq(kScratchRegister, cell, RelocInfo::GLOBAL_PROPERTY_CELL);
     __ cmpq(reg, Operand(kScratchRegister, 0));
   } else {
     __ Cmp(reg, target);
   }
   DeoptimizeIf(not_equal, instr->environment());
 }
 
 
+void LCodeGen::DoCheckMapCommon(Register reg,
+                                Handle<Map> map,
+                                MapCheckMode mode,
+                                LEnvironment* env) {
+  Label success;
+  __ Cmp(FieldOperand(reg, HeapObject::kMapOffset), map);
+  if (mode == ALLOW_ELEMENT_TRANSITION_MAPS) {
+    bool ignore;
+    Map* transitioned_double_map =

[fschneider, 2012/01/04 09:20:18]

Handle<Map> transitioned_double_map(...)

[fschneider, 2012/01/04 09:20:18]

I'd order this differently and move this down closer to the if-statement where
the result is acutally used.

[danno, 2012/01/04 10:42:15]

Done.

[danno, 2012/01/04 10:42:15]

Done.

+        map->LookupElementsTransitionMap(FAST_DOUBLE_ELEMENTS, &ignore);
+    ASSERT(transitioned_double_map == NULL ||
+           map->elements_kind() == FAST_SMI_ONLY_ELEMENTS);
+    Map* transitioned_fast_element_map =

[fschneider, 2012/01/04 09:20:18]

Handle<Map> transitioned_fast_element_map(...)

[danno, 2012/01/04 10:42:15]

Done.

+        map->LookupElementsTransitionMap(FAST_ELEMENTS, &ignore);
+    ASSERT(transitioned_fast_element_map == NULL ||
+           map->elements_kind() != FAST_ELEMENTS);
+    if (transitioned_fast_element_map != NULL) {
+      __ j(equal, &success);
+      __ Cmp(FieldOperand(reg, HeapObject::kMapOffset),
+             Handle<Map>(transitioned_fast_element_map));
+    }
+
+    if (transitioned_double_map != NULL) {
+      __ j(equal, &success);
+      __ Cmp(FieldOperand(reg, HeapObject::kMapOffset),
+             Handle<Map>(transitioned_double_map));
+    }
+  }
+  DeoptimizeIf(not_equal, env);
+  __ bind(&success);
+}
+
+
 void LCodeGen::DoCheckMap(LCheckMap* instr) {
   LOperand* input = instr->InputAt(0);
   ASSERT(input->IsRegister());
   Register reg = ToRegister(input);
-  __ Cmp(FieldOperand(reg, HeapObject::kMapOffset),
-         instr->hydrogen()->map());
-  DeoptimizeIf(not_equal, instr->environment());
+  Handle<Map> map = Handle<Map>(instr->hydrogen()->map());

[fschneider, 2012/01/04 09:20:18]

Simpler would be:

Handle<Map> map = instr->hydrogen()->map();

[danno, 2012/01/04 10:42:15]

Done.

+  DoCheckMapCommon(reg, map, instr->hydrogen()->mode(), instr->environment());
 }
 
 
 void LCodeGen::DoClampDToUint8(LClampDToUint8* instr) {
   XMMRegister value_reg = ToDoubleRegister(instr->unclamped());
   Register result_reg = ToRegister(instr->result());
   Register temp_reg = ToRegister(instr->TempAt(0));
   __ ClampDoubleToUint8(value_reg, xmm0, result_reg, temp_reg);
 }
 
@@ skipping 45 matching lines @@
   Register reg = ToRegister(instr->TempAt(0));
 
   Handle<JSObject> holder = instr->holder();
   Handle<JSObject> current_prototype = instr->prototype();
 
   // Load prototype object.
   __ LoadHeapObject(reg, current_prototype);
 
   // Check prototype maps up to the holder.
   while (!current_prototype.is_identical_to(holder)) {
-    __ Cmp(FieldOperand(reg, HeapObject::kMapOffset),
-           Handle<Map>(current_prototype->map()));
-    DeoptimizeIf(not_equal, instr->environment());
+    DoCheckMapCommon(reg, Handle<Map>(current_prototype->map()),
+                     ALLOW_ELEMENT_TRANSITION_MAPS, instr->environment());
     current_prototype =
         Handle<JSObject>(JSObject::cast(current_prototype->GetPrototype()));
     // Load next prototype object.
     __ LoadHeapObject(reg, current_prototype);
   }
 
   // Check the holder map.
-  __ Cmp(FieldOperand(reg, HeapObject::kMapOffset),
-         Handle<Map>(current_prototype->map()));
-  DeoptimizeIf(not_equal, instr->environment());
+    DoCheckMapCommon(reg, Handle<Map>(current_prototype->map()),
+                     ALLOW_ELEMENT_TRANSITION_MAPS, instr->environment());
 }
 
 
 void LCodeGen::DoArrayLiteral(LArrayLiteral* instr) {
   Heap* heap = isolate()->heap();
   ElementsKind boilerplate_elements_kind =
       instr->hydrogen()->boilerplate_elements_kind();
 
   // Deopt if the array literal boilerplate ElementsKind is of a type different
   // than the expected one. The check isn't necessary if the boilerplate has
@@ skipping 484 matching lines @@
   RegisterEnvironmentForDeoptimization(environment, Safepoint::kNoLazyDeopt);
   ASSERT(osr_pc_offset_ == -1);
   osr_pc_offset_ = masm()->pc_offset();
 }
 
 #undef __
 
 } }  // namespace v8::internal
 
 #endif  // V8_TARGET_ARCH_X64