Implement KeyedStoreICs to grow arrays on out-of-bound stores.

src/objects.h

Index: src/objects.h
diff --git a/src/objects.h b/src/objects.h
index 76ac347d32a27e3bd3d2edd56d9f18f5ab61d0f8..336b8896cda70b161338f34c699f71d1648fea75 100644
--- a/src/objects.h
+++ b/src/objects.h
@@ -168,6 +168,11 @@ enum CompareMapMode {
   ALLOW_ELEMENT_TRANSITION_MAPS
 };
 
+enum KeyedAccessGrowMode {
+  ALLOW_JSARRAY_GROWTH,
+  DO_NOT_ALLOW_JSARRAY_GROWTH
+};
+
 const int kElementsKindCount = LAST_ELEMENTS_KIND - FIRST_ELEMENTS_KIND + 1;
 
 void PrintElementsKind(FILE* out, ElementsKind kind);
@@ -4216,6 +4221,34 @@ class Code: public HeapObject {
   // Find the first map in an IC stub.
   Map* FindFirstMap();
 
+  static const int kExtraICStateGrowModeShift = 1;
+
+  static inline StrictModeFlag GetStrictMode(ExtraICState extra_ic_state) {

[Vyacheslav Egorov (Chromium), 2012/02/10 00:19:18]

Consider using BitField to encode and decode extra_ic_state.

[danno, 2012/02/10 12:25:34]

Done.

+    return (extra_ic_state & 1)
+        ? kStrictMode
+        : kNonStrictMode;
+  }
+
+  static inline KeyedAccessGrowMode GetKeyedAccessGrowMode(
+      ExtraICState extra_ic_state) {
+    return ((static_cast<int>(extra_ic_state) >>
+             kExtraICStateGrowModeShift) != 0)
+        ? ALLOW_JSARRAY_GROWTH
+        : DO_NOT_ALLOW_JSARRAY_GROWTH;
+  }
+
+  static inline ExtraICState ComputeExtraICState(
+      KeyedAccessGrowMode grow_mode,
+      StrictModeFlag strict_mode) {
+    int value = (grow_mode == ALLOW_JSARRAY_GROWTH)
+        ? (1 << kExtraICStateGrowModeShift) : 0;
+    ASSERT(static_cast<int>(strict_mode) <= 1);
+    ASSERT((value & strict_mode) == 0);
+    value |= strict_mode;
+    ASSERT(value <= ExtraICStateField::kMax);
+    return static_cast<ExtraICState>(value);
+  }
+
   // Flags operations.
   static inline Flags ComputeFlags(
       Kind kind,