Implement KeyedStoreICs to grow arrays on out-of-bound stores.

src/ic.h

-// Copyright 2011 the V8 project authors. All rights reserved.
+// Copyright 2012 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
 //       with the distribution.
@@ skipping 357 matching lines @@
 };
 
 
 class KeyedIC: public IC {
  public:
   enum StubKind {
     LOAD,
     STORE_NO_TRANSITION,
     STORE_TRANSITION_SMI_TO_OBJECT,
     STORE_TRANSITION_SMI_TO_DOUBLE,
-    STORE_TRANSITION_DOUBLE_TO_OBJECT
+    STORE_TRANSITION_DOUBLE_TO_OBJECT,
+    STORE_AND_GROW_NO_TRANSITION,
+    STORE_AND_GROW_TRANSITION_SMI_TO_OBJECT,
+    STORE_AND_GROW_TRANSITION_SMI_TO_DOUBLE,
+    STORE_AND_GROW_TRANSITION_DOUBLE_TO_OBJECT
   };
+
+  static const int kGrowICDelta = STORE_AND_GROW_NO_TRANSITION -
+      STORE_NO_TRANSITION;
+  STATIC_ASSERT(kGrowICDelta ==
+                STORE_AND_GROW_TRANSITION_SMI_TO_OBJECT -
+                STORE_TRANSITION_SMI_TO_OBJECT);
+  STATIC_ASSERT(kGrowICDelta ==
+                STORE_AND_GROW_TRANSITION_SMI_TO_DOUBLE -
+                STORE_TRANSITION_SMI_TO_DOUBLE);
+  STATIC_ASSERT(kGrowICDelta ==
+                STORE_AND_GROW_TRANSITION_DOUBLE_TO_OBJECT -
+                STORE_TRANSITION_DOUBLE_TO_OBJECT);
+
   explicit KeyedIC(Isolate* isolate) : IC(NO_EXTRA_FRAME, isolate) {}
   virtual ~KeyedIC() {}
 
+  static inline KeyedAccessGrowMode GetGrowModeFromStubKind(
+      StubKind stub_kind) {
+    return (stub_kind >= STORE_AND_GROW_NO_TRANSITION)
+        ? ALLOW_JSARRAY_GROWTH
+        : DO_NOT_ALLOW_JSARRAY_GROWTH;
+  }
+
+  static inline StubKind GetGrowStubKind(StubKind stub_kind) {
+    ASSERT(stub_kind != LOAD);
+    if (stub_kind < STORE_AND_GROW_NO_TRANSITION) {
+      stub_kind = static_cast<StubKind>(static_cast<int>(stub_kind) +
+                                        kGrowICDelta);
+    }
+    return stub_kind;
+  }
+
   virtual Handle<Code> GetElementStubWithoutMapCheck(
       bool is_js_array,
-      ElementsKind elements_kind) = 0;
+      ElementsKind elements_kind,
+      KeyedAccessGrowMode grow_mode) = 0;
 
  protected:
   virtual Handle<Code> string_stub() {
     return Handle<Code>::null();
   }
 
   virtual Code::Kind kind() const = 0;
 
   Handle<Code> ComputeStub(Handle<JSObject> receiver,
                            StubKind stub_kind,
                            StrictModeFlag strict_mode,
                            Handle<Code> default_stub);
 
-  virtual Handle<Code> ComputePolymorphicStub(MapHandleList* receiver_maps,
-                                              StrictModeFlag strict_mode) = 0;
+  virtual Handle<Code> ComputePolymorphicStub(
+      MapHandleList* receiver_maps,
+      StrictModeFlag strict_mode,
+      KeyedAccessGrowMode grow_mode) = 0;
 
   Handle<Code> ComputeMonomorphicStubWithoutMapCheck(
       Handle<Map> receiver_map,
-      StrictModeFlag strict_mode);
+      StrictModeFlag strict_mode,
+      KeyedAccessGrowMode grow_mode);
 
  private:
   void GetReceiverMapsForStub(Handle<Code> stub, MapHandleList* result);
 
   Handle<Code> ComputeMonomorphicStub(Handle<JSObject> receiver,
                                       StubKind stub_kind,
                                       StrictModeFlag strict_mode,
                                       Handle<Code> default_stub);
 
   Handle<Map> ComputeTransitionedMap(Handle<JSObject> receiver,
                                      StubKind stub_kind);
 
   static bool IsTransitionStubKind(StubKind stub_kind) {
-    return stub_kind > STORE_NO_TRANSITION;
+    return stub_kind > STORE_NO_TRANSITION &&
+        stub_kind != STORE_AND_GROW_NO_TRANSITION;
+  }
+
+  static bool IsGrowStubKind(StubKind stub_kind) {
+    return stub_kind >= STORE_AND_GROW_NO_TRANSITION;
   }
 };
 
 
 class KeyedLoadIC: public KeyedIC {
  public:
   explicit KeyedLoadIC(Isolate* isolate) : KeyedIC(isolate) {
     ASSERT(target()->is_keyed_load_stub());
   }
 
@@ skipping 18 matching lines @@
 
   // Bit mask to be tested against bit field for the cases when
   // generic stub should go into slow case.
   // Access check is necessary explicitly since generic stub does not perform
   // map checks.
   static const int kSlowCaseBitFieldMask =
       (1 << Map::kIsAccessCheckNeeded) | (1 << Map::kHasIndexedInterceptor);
 
   virtual Handle<Code> GetElementStubWithoutMapCheck(
       bool is_js_array,
-      ElementsKind elements_kind);
+      ElementsKind elements_kind,
+      KeyedAccessGrowMode grow_mode);
 
   virtual bool IsGeneric() const {
     return target() == *generic_stub();
   }
 
  protected:
   virtual Code::Kind kind() const { return Code::KEYED_LOAD_IC; }
 
   virtual Handle<Code> ComputePolymorphicStub(MapHandleList* receiver_maps,
-                                              StrictModeFlag strict_mode);
+                                              StrictModeFlag strict_mode,
+                                              KeyedAccessGrowMode grow_mode);
 
   virtual Handle<Code> string_stub() {
     return isolate()->builtins()->KeyedLoadIC_String();
   }
 
  private:
   // Update the inline cache.
   void UpdateCaches(LookupResult* lookup,
                     State state,
                     Handle<Object> object,
@@ skipping 53 matching lines @@
   // lookup result.
   void UpdateCaches(LookupResult* lookup,
                     State state,
                     StrictModeFlag strict_mode,
                     Handle<JSObject> receiver,
                     Handle<String> name,
                     Handle<Object> value);
 
   void set_target(Code* code) {
     // Strict mode must be preserved across IC patching.
-    ASSERT((code->extra_ic_state() & kStrictMode) ==
-           (target()->extra_ic_state() & kStrictMode));
+    ASSERT(Code::GetStrictMode(code->extra_ic_state()) ==
+           Code::GetStrictMode(target()->extra_ic_state()));
     IC::set_target(code);
   }
 
   // Stub accessors.
   Code* megamorphic_stub() {
     return isolate()->builtins()->builtin(
         Builtins::kStoreIC_Megamorphic);
   }
   Code* megamorphic_stub_strict() {
     return isolate()->builtins()->builtin(
@@ skipping 41 matching lines @@
   static void GenerateSlow(MacroAssembler* masm);
   static void GenerateRuntimeSetProperty(MacroAssembler* masm,
                                          StrictModeFlag strict_mode);
   static void GenerateGeneric(MacroAssembler* masm, StrictModeFlag strict_mode);
   static void GenerateNonStrictArguments(MacroAssembler* masm);
   static void GenerateTransitionElementsSmiToDouble(MacroAssembler* masm);
   static void GenerateTransitionElementsDoubleToObject(MacroAssembler* masm);
 
   virtual Handle<Code> GetElementStubWithoutMapCheck(
       bool is_js_array,
-      ElementsKind elements_kind);
+      ElementsKind elements_kind,
+      KeyedAccessGrowMode grow_mode);
 
   virtual bool IsGeneric() const {
     return target() == *generic_stub() ||
         target() == *generic_stub_strict();
   }
 
  protected:
   virtual Code::Kind kind() const { return Code::KEYED_STORE_IC; }
 
   virtual Handle<Code> ComputePolymorphicStub(MapHandleList* receiver_maps,
-                                              StrictModeFlag strict_mode);
+                                              StrictModeFlag strict_mode,
+                                              KeyedAccessGrowMode grow_mode);
 
   private:
   // Update the inline cache.
   void UpdateCaches(LookupResult* lookup,
                     State state,
                     StrictModeFlag strict_mode,
                     Handle<JSObject> receiver,
                     Handle<String> name,
                     Handle<Object> value);
 
   void set_target(Code* code) {
     // Strict mode must be preserved across IC patching.
-    ASSERT((code->extra_ic_state() & kStrictMode) ==
-           (target()->extra_ic_state() & kStrictMode));
+    ASSERT(Code::GetStrictMode(code->extra_ic_state()) ==
+           Code::GetStrictMode(target()->extra_ic_state()));
     IC::set_target(code);
   }
 
   // Stub accessors.
   static Code* initialize_stub() {
     return Isolate::Current()->builtins()->builtin(
         Builtins::kKeyedStoreIC_Initialize);
   }
   static Code* initialize_stub_strict() {
     return Isolate::Current()->builtins()->builtin(
@@ skipping 10 matching lines @@
   }
   Handle<Code> generic_stub_strict() const {
     return isolate()->builtins()->KeyedStoreIC_Generic_Strict();
   }
   Handle<Code> non_strict_arguments_stub() {
     return isolate()->builtins()->KeyedStoreIC_NonStrictArguments();
   }
 
   static void Clear(Address address, Code* target);
 
+  StubKind GetStubKind(Handle<JSObject> receiver,
+                       Handle<Object> key,
+                       Handle<Object> value);
+
   friend class IC;
 };
 
 
 class UnaryOpIC: public IC {
  public:
   // sorted: increasingly more unspecific (ignoring UNINITIALIZED)
   // TODO(svenpanne) Using enums+switch is an antipattern, use a class instead.
   enum TypeInfo {
     UNINITIALIZED,
@@ skipping 93 matching lines @@
   void patch(Code* code);
 };
 
 
 // Helper for BinaryOpIC and CompareIC.
 void PatchInlinedSmiCode(Address address);
 
 } }  // namespace v8::internal
 
 #endif  // V8_IC_H_