Adapt Danno's Track Allocation Info idea to fast literals. When allocating a literal array,

src/objects.cc

Index: src/objects.cc
diff --git a/src/objects.cc b/src/objects.cc
index c02cdd944934dbefdd02b5872735526e5a2f3f20..05633028e64ebb9d379c38374cec7a4cd52b73a4 100644
--- a/src/objects.cc
+++ b/src/objects.cc
@@ -7902,6 +7902,27 @@ String* SeqString::Truncate(int new_length) {
 }
 
 
+AllocationSiteInfo* AllocationSiteInfo::FindAfterJSObject(JSObject* object) {

[danno, 2013/01/04 08:50:55]

How about "FindForJSObject?" FindAfterJSObject implies the implementation detail
of how the object is actually found, which the caller doesn't really care about.

[mvstanton, 2013/01/04 12:07:52]

Done.

+  // Are we in new space and using the allocation site info feature?

[danno, 2013/01/04 08:50:55]

nit: the comment seems a little superfluous, since the following code line does
exactly what it states. Perhaps instead a comment describing under which
circumstances such an object is found, i.e. something like "currently,
AllocationSiteInfo objects are only allocated immediately after JSArrays in
NewSpace, and detecting whether a JSArray has one involves carefully checking
the object immediately after the JSArray if there is one whether it qualifies". 

[mvstanton, 2013/01/04 12:07:52]

Way more useful comment, thx!

+  if (FLAG_use_allocation_site_info && object->GetHeap()->InNewSpace(object)) {
+    Address ptr_end = (reinterpret_cast<Address>(object) - kHeapObjectTag) +
+        object->Size();
+    if ((ptr_end + AllocationSiteInfo::kSize) <=
+        object->GetHeap()->NewSpaceTop()) {
+      // There is room in newspace for allocation info. Do we have some?
+      Map** possible_allocation_map = reinterpret_cast<Map**>(ptr_end);
+      if (*possible_allocation_map ==
+          object->GetHeap()->allocation_site_info_map()) {
+        AllocationSiteInfo* info = AllocationSiteInfo::cast(
+            reinterpret_cast<Object*>(ptr_end + 1));
+        return info;
+      }
+    }
+  }
+  return NULL;
+}
+
+
 uint32_t StringHasher::MakeArrayIndexHash(uint32_t value, int length) {
   // For array indexes mix the length into the hash as an array index could
   // be zero.
@@ -10248,6 +10269,14 @@ MaybeObject* JSObject::SetFastElement(uint32_t index,
   }
   // Convert to fast double elements if appropriate.
   if (HasFastSmiElements() && !value->IsSmi() && value->IsNumber()) {
+    // Consider fixing the boilerplate as well if we have one.
+    ElementsKind to_kind = IsHoleyElementsKind(elements_kind)
+        ? FAST_HOLEY_DOUBLE_ELEMENTS
+        : FAST_DOUBLE_ELEMENTS;
+
+    MaybeObject* trans = PossiblyTransitionBoilerplate(to_kind);
+    if (trans != NULL && trans->IsFailure()) return trans;
+
     MaybeObject* maybe =
         SetFastDoubleElementsCapacityAndLength(new_capacity, array_length);
     if (maybe->IsFailure()) return maybe;
@@ -10789,6 +10818,24 @@ Handle<Object> JSObject::TransitionElementsKind(Handle<JSObject> object,
 }
 
 
+MaybeObject* JSObject::PossiblyTransitionBoilerplate(ElementsKind to_kind) {

[danno, 2013/01/04 08:50:55]

Do you want to ASSERT(IsJSArray())? Maybe make the name
PossibleTransitionArrayBoilerplate?

[mvstanton, 2013/01/04 12:07:52]

Done.

+  MaybeObject* ret = NULL;
+  // Are we in new space?

[danno, 2013/01/04 08:50:55]

nit: comment seems incorrect, the FindAfterJSObject does more.

[mvstanton, 2013/01/04 12:07:52]

Done.

+  AllocationSiteInfo* info = AllocationSiteInfo::FindAfterJSObject(this);
+  if (info != NULL) {
+    JSObject* payload = JSObject::cast(info->payload());
+    if (payload->GetElementsKind() != to_kind) {
+      if (IsMoreGeneralElementsKindTransition(payload->GetElementsKind(),
+                                              to_kind)) {
+        ret = payload->TransitionElementsKind(to_kind);
+        if (ret->IsFailure()) return ret;
+      }
+    }
+  }
+  return ret;
+}
+
+
 MaybeObject* JSObject::TransitionElementsKind(ElementsKind to_kind) {
   ASSERT(!map()->is_observed());
   ElementsKind from_kind = map()->elements_kind();
@@ -10799,6 +10846,9 @@ MaybeObject* JSObject::TransitionElementsKind(ElementsKind to_kind) {
 
   if (from_kind == to_kind) return this;
 
+  MaybeObject* trans = PossiblyTransitionBoilerplate(to_kind);
+  if (trans != NULL && trans->IsFailure()) return trans;
+
   Isolate* isolate = GetIsolate();
   if (elements() == isolate->heap()->empty_fixed_array() ||
       (IsFastSmiOrObjectElementsKind(from_kind) &&