Fix polymorphic inlined calls with migrating prototypes

src/ast.h

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 261 matching lines @@
   SmallMapList(int capacity, Zone* zone) : list_(capacity, zone) {}
 
   void Reserve(int capacity, Zone* zone) { list_.Reserve(capacity, zone); }
   void Clear() { list_.Clear(); }
   void Sort() { list_.Sort(); }
 
   bool is_empty() const { return list_.is_empty(); }
   int length() const { return list_.length(); }
 
   void AddMapIfMissing(Handle<Map> map, Zone* zone) {
-    Map* updated = map->CurrentMapForDeprecated();
-    if (updated == NULL) return;
-    map = Handle<Map>(updated);
+    map = Map::CurrentMapForDeprecated(map);
+    if (map.is_null()) return;
     for (int i = 0; i < length(); ++i) {
       if (at(i).is_identical_to(map)) return;
     }
     Add(map, zone);
   }
 
   void FilterForPossibleTransitions(Map* root_map) {
     for (int i = list_.length() - 1; i >= 0; i--) {
       if (at(i)->FindRootMap() != root_map) {
         list_.RemoveElement(list_.at(i));
@@ skipping 1389 matching lines @@
 
   Expression* obj() const { return obj_; }
   Expression* key() const { return key_; }
 
   BailoutId LoadId() const { return load_id_; }
 
   bool IsStringAccess() const { return is_string_access_; }
   bool IsFunctionPrototype() const { return is_function_prototype_; }
 
   // Type feedback information.
-  virtual bool IsMonomorphic() V8_OVERRIDE { return is_monomorphic_; }
+  virtual bool IsMonomorphic() V8_OVERRIDE {
+    return receiver_types_.length() == 1;
+  }
   virtual SmallMapList* GetReceiverTypes() V8_OVERRIDE {
     return &receiver_types_;
   }
   virtual KeyedAccessStoreMode GetStoreMode() V8_OVERRIDE {
     return STANDARD_STORE;
   }
   bool IsUninitialized() { return is_uninitialized_; }
   bool IsPreMonomorphic() { return is_pre_monomorphic_; }
   bool HasNoTypeInformation() {
     return is_uninitialized_ || is_pre_monomorphic_;
   }
   void set_is_uninitialized(bool b) { is_uninitialized_ = b; }
-  void set_is_monomorphic(bool b) { is_monomorphic_ = b; }
   void set_is_pre_monomorphic(bool b) { is_pre_monomorphic_ = b; }
   void set_is_string_access(bool b) { is_string_access_ = b; }
   void set_is_function_prototype(bool b) { is_function_prototype_ = b; }
 
   TypeFeedbackId PropertyFeedbackId() { return reuse(id()); }
 
  protected:
   Property(Isolate* isolate,
            Expression* obj,
            Expression* key,
            int pos)
       : Expression(isolate, pos),
         obj_(obj),
         key_(key),
         load_id_(GetNextId(isolate)),
-        is_monomorphic_(false),
         is_pre_monomorphic_(false),
         is_uninitialized_(false),
         is_string_access_(false),
         is_function_prototype_(false) { }
 
  private:
   Expression* obj_;
   Expression* key_;
   const BailoutId load_id_;
 
   SmallMapList receiver_types_;
-  bool is_monomorphic_ : 1;
   bool is_pre_monomorphic_ : 1;
   bool is_uninitialized_ : 1;
   bool is_string_access_ : 1;
   bool is_function_prototype_ : 1;
 };
 
 
 class Call V8_FINAL : public Expression {
  public:
   DECLARE_NODE_TYPE(Call)
@@ skipping 248 matching lines @@
   bool is_prefix() const { return is_prefix_; }
   bool is_postfix() const { return !is_prefix_; }
 
   Token::Value op() const { return op_; }
   Token::Value binary_op() {
     return (op() == Token::INC) ? Token::ADD : Token::SUB;
   }
 
   Expression* expression() const { return expression_; }
 
-  virtual bool IsMonomorphic() V8_OVERRIDE { return is_monomorphic_; }
+  virtual bool IsMonomorphic() V8_OVERRIDE {
+    return receiver_types_.length() == 1;
+  }
   virtual SmallMapList* GetReceiverTypes() V8_OVERRIDE {
     return &receiver_types_;
   }
   virtual KeyedAccessStoreMode GetStoreMode() V8_OVERRIDE {
     return store_mode_;
   }
   Handle<Type> type() const { return type_; }
-  void set_is_monomorphic(bool b) { is_monomorphic_ = b; }
   void set_store_mode(KeyedAccessStoreMode mode) { store_mode_ = mode; }
   void set_type(Handle<Type> type) { type_ = type; }
 
   BailoutId AssignmentId() const { return assignment_id_; }
 
   TypeFeedbackId CountBinOpFeedbackId() const { return count_id_; }
   TypeFeedbackId CountStoreFeedbackId() const { return reuse(id()); }
 
  protected:
   CountOperation(Isolate* isolate,
                  Token::Value op,
                  bool is_prefix,
                  Expression* expr,
                  int pos)
       : Expression(isolate, pos),
         op_(op),
         is_prefix_(is_prefix),
-        is_monomorphic_(false),
         store_mode_(STANDARD_STORE),
         expression_(expr),
         assignment_id_(GetNextId(isolate)),
         count_id_(GetNextId(isolate)) {}
 
  private:
   Token::Value op_;
   bool is_prefix_ : 1;
-  bool is_monomorphic_ : 1;
   KeyedAccessStoreMode store_mode_ : 5;  // Windows treats as signed,
                                          // must have extra bit.
   Handle<Type> type_;
 
   Expression* expression_;
   const BailoutId assignment_id_;
   const TypeFeedbackId count_id_;
   SmallMapList receiver_types_;
 };
 
@@ skipping 85 matching lines @@
   Expression* value() const { return value_; }
   BinaryOperation* binary_operation() const { return binary_operation_; }
 
   // This check relies on the definition order of token in token.h.
   bool is_compound() const { return op() > Token::ASSIGN; }
 
   BailoutId AssignmentId() const { return assignment_id_; }
 
   // Type feedback information.
   TypeFeedbackId AssignmentFeedbackId() { return reuse(id()); }
-  virtual bool IsMonomorphic() V8_OVERRIDE { return is_monomorphic_; }
+  virtual bool IsMonomorphic() V8_OVERRIDE {
+    return receiver_types_.length() == 1;
+  }
   bool IsUninitialized() { return is_uninitialized_; }
   bool IsPreMonomorphic() { return is_pre_monomorphic_; }
   bool HasNoTypeInformation() {
     return is_uninitialized_ || is_pre_monomorphic_;
   }
   virtual SmallMapList* GetReceiverTypes() V8_OVERRIDE {
     return &receiver_types_;
   }
   virtual KeyedAccessStoreMode GetStoreMode() V8_OVERRIDE {
     return store_mode_;
   }
   void set_is_uninitialized(bool b) { is_uninitialized_ = b; }
-  void set_is_monomorphic(bool b) { is_monomorphic_ = b; }
   void set_is_pre_monomorphic(bool b) { is_pre_monomorphic_ = b; }
   void set_store_mode(KeyedAccessStoreMode mode) { store_mode_ = mode; }
 
  protected:
   Assignment(Isolate* isolate,
              Token::Value op,
              Expression* target,
              Expression* value,
              int pos);
 
   template<class Visitor>
   void Init(Isolate* isolate, AstNodeFactory<Visitor>* factory) {
     ASSERT(Token::IsAssignmentOp(op_));
     if (is_compound()) {
       binary_operation_ = factory->NewBinaryOperation(
           binary_op(), target_, value_, position() + 1);
     }
   }
 
  private:
   Token::Value op_;
   Expression* target_;
   Expression* value_;
   BinaryOperation* binary_operation_;
   const BailoutId assignment_id_;
 
-  bool is_monomorphic_ : 1;
   bool is_uninitialized_ : 1;
   bool is_pre_monomorphic_ : 1;
   KeyedAccessStoreMode store_mode_ : 5;  // Windows treats as signed,
                                          // must have extra bit.
   SmallMapList receiver_types_;
 };
 
 
 class Yield V8_FINAL : public Expression {
  public:
@@ skipping 1105 matching lines @@
  private:
   Isolate* isolate_;
   Zone* zone_;
   Visitor visitor_;
 };
 
 
 } }  // namespace v8::internal
 
 #endif  // V8_AST_H_