Vector ICs: Turbofan vector store ic support

src/compiler/ast-graph-builder.cc

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/compiler/ast-graph-builder.h"
 
 #include "src/compiler.h"
 #include "src/compiler/ast-loop-assignment-analyzer.h"
 #include "src/compiler/control-builders.h"
 #include "src/compiler/js-type-feedback.h"
@@ skipping 1333 matching lines @@
       PrepareFrameState(value, stmt->FilterId(),
                         OutputFrameStateCombine::Push());
       IfBuilder test_value(this);
       Node* test_value_cond = NewNode(javascript()->StrictEqual(), value,
                                       jsgraph()->UndefinedConstant());
       test_value.If(test_value_cond, BranchHint::kFalse);
       test_value.Then();
       test_value.Else();
       {
         // Bind value and do loop body.
-        VisitForInAssignment(stmt->each(), value, stmt->AssignmentId());
+        VisitForInAssignment(stmt->each(), value,
+                             ResolveFeedbackSlot(stmt->EachFeedbackSlot()),

[Michael Starzinger, 2015/06/15 14:20:11]

nit: Please pull into local variable for consistency.

[mvstanton, 2015/06/21 13:37:35]

Done.

+                             stmt->AssignmentId());
         VisitIterationBody(stmt, &for_loop);
       }
       test_value.End();
       index = environment()->Peek(0);
       for_loop.EndBody();
 
       // Increment counter and continue.
       index = NewNode(javascript()->ForInStep(), index);
       environment()->Poke(0, index);
     }
@@ skipping 199 matching lines @@
   // is needed here since the constructor is created by the class literal.
   Node* proto =
       BuildLoadObjectField(literal, JSFunction::kPrototypeOrInitialMapOffset);
 
   // The class literal and the prototype are both expected on the operand stack
   // during evaluation of the method values.
   environment()->Push(literal);
   environment()->Push(proto);
 
   // Create nodes to store method values into the literal.
+  int store_slot_index = 0;
   for (int i = 0; i < expr->properties()->length(); i++) {
     ObjectLiteral::Property* property = expr->properties()->at(i);
     environment()->Push(property->is_static() ? literal : proto);
 
     VisitForValue(property->key());
     Node* name = BuildToName(environment()->Pop(), expr->GetIdForProperty(i));
     environment()->Push(name);
 
     // The static prototype property is read only. We handle the non computed
     // property name case in the parser. Since this is the only case where we
     // need to check for an own read only property we special case this so we do
     // not need to do this for every property.
     if (property->is_static() && property->is_computed_name()) {
       Node* check = BuildThrowIfStaticPrototype(environment()->Pop(),
                                                 expr->GetIdForProperty(i));
       environment()->Push(check);
     }
 
     VisitForValue(property->value());
     Node* value = environment()->Pop();
     Node* key = environment()->Pop();
     Node* receiver = environment()->Pop();
-    BuildSetHomeObject(value, receiver, property->value());
+    ResolvedFeedbackSlot slot = ResolveFeedbackSlot(
+        expr->SlotForHomeObject(property->value(), &store_slot_index));
+    BuildSetHomeObject(value, receiver, property->value(), slot);
 
     switch (property->kind()) {
       case ObjectLiteral::Property::CONSTANT:
       case ObjectLiteral::Property::MATERIALIZED_LITERAL:
       case ObjectLiteral::Property::PROTOTYPE:
         UNREACHABLE();
       case ObjectLiteral::Property::COMPUTED: {
         const Operator* op =
             javascript()->CallRuntime(Runtime::kDefineClassMethod, 3);
         NewNode(op, receiver, key, value);
@@ skipping 19 matching lines @@
   // Transform both the class literal and the prototype to fast properties.
   const Operator* op = javascript()->CallRuntime(Runtime::kToFastProperties, 1);
   NewNode(op, environment()->Pop());  // prototype
   NewNode(op, environment()->Pop());  // literal
 
   // Assign to class variable.
   if (expr->scope() != NULL) {
     DCHECK_NOT_NULL(expr->class_variable_proxy());
     Variable* var = expr->class_variable_proxy()->var();
     FrameStateBeforeAndAfter states(this, BailoutId::None());
-    BuildVariableAssignment(var, literal, Token::INIT_CONST, BailoutId::None(),
-                            states);
+    ResolvedFeedbackSlot slot =
+        ResolveFeedbackSlot(FLAG_vector_stores
+                            ? expr->GetNthSlot(store_slot_index++)
+                            : FeedbackVectorICSlot::Invalid());
+    BuildVariableAssignment(var, literal, Token::INIT_CONST, slot,
+                            BailoutId::None(), states);
   }
 
   ast_context()->ProduceValue(literal);
 }
 
 
 void AstGraphBuilder::VisitNativeFunctionLiteral(NativeFunctionLiteral* expr) {
   UNREACHABLE();
 }
 
@@ skipping 57 matching lines @@
   Node* literal = NewNode(op, literals_array, literal_index, constants);
   PrepareFrameState(literal, expr->CreateLiteralId(),
                     OutputFrameStateCombine::Push());
 
   // The object is expected on the operand stack during computation of the
   // property values and is the value of the entire expression.
   environment()->Push(literal);
 
   // Create nodes to store computed values into the literal.
   int property_index = 0;
+  int store_slot_index = 0;
   AccessorTable accessor_table(zone());
   for (; property_index < expr->properties()->length(); property_index++) {
     ObjectLiteral::Property* property = expr->properties()->at(property_index);
     if (property->is_computed_name()) break;
     if (property->IsCompileTimeValue()) continue;
 
     Literal* key = property->key()->AsLiteral();
     switch (property->kind()) {
       case ObjectLiteral::Property::CONSTANT:
         UNREACHABLE();
       case ObjectLiteral::Property::MATERIALIZED_LITERAL:
         DCHECK(!CompileTimeValue::IsCompileTimeValue(property->value()));
       // Fall through.
       case ObjectLiteral::Property::COMPUTED: {
         // It is safe to use [[Put]] here because the boilerplate already
         // contains computed properties with an uninitialized value.
         if (key->value()->IsInternalizedString()) {
           if (property->emit_store()) {
             VisitForValue(property->value());
             FrameStateBeforeAndAfter states(this, property->value()->id());
             Node* value = environment()->Pop();
             Handle<Name> name = key->AsPropertyName();
-            Node* store =
-                BuildNamedStore(literal, name, value, TypeFeedbackId::None());
+            ResolvedFeedbackSlot slot =
+                FLAG_vector_stores
+                    ? ResolveFeedbackSlot(expr->GetNthSlot(store_slot_index++))
+                    : ResolvedFeedbackSlot();
+            Node* store = BuildNamedStore(literal, name, value, slot,
+                                          TypeFeedbackId::None());
             states.AddToNode(store, key->id(),
                              OutputFrameStateCombine::Ignore());
-            BuildSetHomeObject(value, literal, property->value());
+            ResolvedFeedbackSlot home_slot = ResolveFeedbackSlot(
+                expr->SlotForHomeObject(property->value(), &store_slot_index));
+            BuildSetHomeObject(value, literal, property->value(), home_slot);
           } else {
             VisitForEffect(property->value());
           }
           break;
         }
         environment()->Push(literal);  // Duplicate receiver.
         VisitForValue(property->key());
         VisitForValue(property->value());
         Node* value = environment()->Pop();
         Node* key = environment()->Pop();
         Node* receiver = environment()->Pop();
         if (property->emit_store()) {
           Node* language = jsgraph()->Constant(SLOPPY);
           const Operator* op =
               javascript()->CallRuntime(Runtime::kSetProperty, 4);
           Node* set_property = NewNode(op, receiver, key, value, language);
           // SetProperty should not lazy deopt on an object literal.
           PrepareFrameState(set_property, BailoutId::None());
-          BuildSetHomeObject(value, receiver, property->value());
+          ResolvedFeedbackSlot home_slot = ResolveFeedbackSlot(
+              expr->SlotForHomeObject(property->value(), &store_slot_index));
+          BuildSetHomeObject(value, receiver, property->value(), home_slot);
         }
         break;
       }
       case ObjectLiteral::Property::PROTOTYPE: {
         environment()->Push(literal);  // Duplicate receiver.
         VisitForValue(property->value());
         Node* value = environment()->Pop();
         Node* receiver = environment()->Pop();
         DCHECK(property->emit_store());
         const Operator* op =
@@ skipping 15 matching lines @@
         break;
     }
   }
 
   // Create nodes to define accessors, using only a single call to the runtime
   // for each pair of corresponding getters and setters.
   for (AccessorTable::Iterator it = accessor_table.begin();
        it != accessor_table.end(); ++it) {
     VisitForValue(it->first);
     VisitForValueOrNull(it->second->getter);
-    BuildSetHomeObject(environment()->Top(), literal, it->second->getter);
+    ResolvedFeedbackSlot slot_getter = ResolveFeedbackSlot(
+        expr->SlotForHomeObject(it->second->getter, &store_slot_index));
+    BuildSetHomeObject(environment()->Top(), literal, it->second->getter,
+                       slot_getter);
     VisitForValueOrNull(it->second->setter);
-    BuildSetHomeObject(environment()->Top(), literal, it->second->setter);
+    ResolvedFeedbackSlot slot_setter = ResolveFeedbackSlot(
+        expr->SlotForHomeObject(it->second->getter, &store_slot_index));
+    BuildSetHomeObject(environment()->Top(), literal, it->second->setter,
+                       slot_setter);
     Node* setter = environment()->Pop();
     Node* getter = environment()->Pop();
     Node* name = environment()->Pop();
     Node* attr = jsgraph()->Constant(NONE);
     const Operator* op =
         javascript()->CallRuntime(Runtime::kDefineAccessorPropertyUnchecked, 5);
     Node* call = NewNode(op, literal, name, getter, setter, attr);
     // This should not lazy deopt on a new literal.
     PrepareFrameState(call, BailoutId::None());
   }
@@ skipping 24 matching lines @@
 
     environment()->Push(literal);  // Duplicate receiver.
     VisitForValue(property->key());
     Node* name = BuildToName(environment()->Pop(),
                              expr->GetIdForProperty(property_index));
     environment()->Push(name);
     VisitForValue(property->value());
     Node* value = environment()->Pop();
     Node* key = environment()->Pop();
     Node* receiver = environment()->Pop();
-    BuildSetHomeObject(value, receiver, property->value());
-
+    ResolvedFeedbackSlot slot = ResolveFeedbackSlot(
+        expr->SlotForHomeObject(property->value(), &store_slot_index));
+    BuildSetHomeObject(value, receiver, property->value(), slot);
     switch (property->kind()) {
       case ObjectLiteral::Property::CONSTANT:
       case ObjectLiteral::Property::COMPUTED:
       case ObjectLiteral::Property::MATERIALIZED_LITERAL: {
         Node* attr = jsgraph()->Constant(NONE);
         const Operator* op =
             javascript()->CallRuntime(Runtime::kDefineDataPropertyUnchecked, 4);
         Node* call = NewNode(op, receiver, key, value, attr);
         PrepareFrameState(call, BailoutId::None());
         break;
@@ skipping 20 matching lines @@
     }
   }
 
   // Transform literals that contain functions to fast properties.
   if (expr->has_function()) {
     const Operator* op =
         javascript()->CallRuntime(Runtime::kToFastProperties, 1);
     NewNode(op, literal);
   }
 
+  // Verify that compilation exactly consumed the number of store ic slots that
+  // the ObjectLiteral node had to offer.
+  DCHECK(!FLAG_vector_stores || store_slot_index == expr->slot_count());
+
   ast_context()->ProduceValue(environment()->Pop());
 }
 
 
 void AstGraphBuilder::VisitArrayLiteral(ArrayLiteral* expr) {
   Node* closure = GetFunctionClosure();
 
   // Create node to deep-copy the literal boilerplate.
   expr->BuildConstantElements(isolate());
   Node* literals_array =
@@ skipping 17 matching lines @@
   for (; array_index < expr->values()->length(); array_index++) {
     Expression* subexpr = expr->values()->at(array_index);
     if (subexpr->IsSpread()) break;
     if (CompileTimeValue::IsCompileTimeValue(subexpr)) continue;
 
     VisitForValue(subexpr);
     {
       FrameStateBeforeAndAfter states(this, subexpr->id());
       Node* value = environment()->Pop();
       Node* index = jsgraph()->Constant(array_index);
+      // TODO(mvstanton): this should be a runtime call. We can't use an
+      // IC unless we have it in full code as well.

[Michael Starzinger, 2015/06/15 14:20:11]

As discussed offline: It's not the responsibility of the AstGraphBuilder to
decide whether to use a runtime call or an IC.

Also, these stores are good candidates for load-store-elimination and escape
analysis, so I would strongly vote for keeping them as normal keyed stores.

Hence I think we should just drop this TODO and address this in the generic
lowering once vectore store ICs are actually called there. Of course I am fine
with keeping a comment here saying that we just don't have feedback slots for
these stores.

[mvstanton, 2015/06/21 13:37:35]

Done.

       Node* store =
-          BuildKeyedStore(literal, index, value, TypeFeedbackId::None());
+          BuildKeyedStore(literal, index, value, ResolvedFeedbackSlot(),
+                          TypeFeedbackId::None());
       states.AddToNode(store, expr->GetIdForElement(array_index),
                        OutputFrameStateCombine::Ignore());
     }
   }
 
   // In case the array literal contains spread expressions it has two parts. The
   // first part is  the "static" array which has a literal index is handled
   // above. The second part is the part after the first spread expression
   // (inclusive) and these elements gets appended to the array. Note that the
   // number elements an iterable produces is unknown ahead of time.
@@ skipping 23 matching lines @@
 
     PrepareFrameState(result, expr->GetIdForElement(array_index));
     environment()->Push(result);
   }
 
   ast_context()->ProduceValue(environment()->Pop());
 }
 
 
 void AstGraphBuilder::VisitForInAssignment(Expression* expr, Node* value,
+                                           const ResolvedFeedbackSlot& slot,
                                            BailoutId bailout_id) {
   DCHECK(expr->IsValidReferenceExpression());
 
   // Left-hand side can only be a property, a global or a variable slot.
   Property* property = expr->AsProperty();
   LhsKind assign_type = Property::GetAssignType(property);
 
   // Evaluate LHS expression and store the value.
   switch (assign_type) {
     case VARIABLE: {
       Variable* var = expr->AsVariableProxy()->var();
       FrameStateBeforeAndAfter states(this, BailoutId::None());
-      BuildVariableAssignment(var, value, Token::ASSIGN, bailout_id, states);
+      BuildVariableAssignment(var, value, Token::ASSIGN, slot, bailout_id,
+                              states);
       break;
     }
     case NAMED_PROPERTY: {
       environment()->Push(value);
       VisitForValue(property->obj());
       FrameStateBeforeAndAfter states(this, property->obj()->id());
       Node* object = environment()->Pop();
       value = environment()->Pop();
       Handle<Name> name = property->key()->AsLiteral()->AsPropertyName();
       Node* store =
-          BuildNamedStore(object, name, value, TypeFeedbackId::None());
+          BuildNamedStore(object, name, value, slot, TypeFeedbackId::None());
       states.AddToNode(store, bailout_id, OutputFrameStateCombine::Ignore());
       break;
     }
     case KEYED_PROPERTY: {
       environment()->Push(value);
       VisitForValue(property->obj());
       VisitForValue(property->key());
       FrameStateBeforeAndAfter states(this, property->key()->id());
       Node* key = environment()->Pop();
       Node* object = environment()->Pop();
       value = environment()->Pop();
-      Node* store = BuildKeyedStore(object, key, value, TypeFeedbackId::None());
+      Node* store =
+          BuildKeyedStore(object, key, value, slot, TypeFeedbackId::None());
       states.AddToNode(store, bailout_id, OutputFrameStateCombine::Ignore());
       break;
     }
     case NAMED_SUPER_PROPERTY: {
       environment()->Push(value);
       VisitForValue(property->obj()->AsSuperPropertyReference()->this_var());
       VisitForValue(property->obj()->AsSuperPropertyReference()->home_object());
       FrameStateBeforeAndAfter states(this, property->obj()->id());
       Node* home_object = environment()->Pop();
       Node* receiver = environment()->Pop();
@@ skipping 141 matching lines @@
   } else {
     VisitForValue(expr->value());
     if (needs_frame_state_before) {
       before_store_id = expr->value()->id();
     }
   }
 
   FrameStateBeforeAndAfter store_states(this, before_store_id);
   // Store the value.
   Node* value = environment()->Pop();
+  ResolvedFeedbackSlot slot = ResolveFeedbackSlot(expr->AssignmentSlot());
   switch (assign_type) {
     case VARIABLE: {
       Variable* variable = expr->target()->AsVariableProxy()->var();
-      BuildVariableAssignment(variable, value, expr->op(), expr->id(),
+      BuildVariableAssignment(variable, value, expr->op(), slot, expr->id(),
                               store_states, ast_context()->GetStateCombine());
       break;
     }
     case NAMED_PROPERTY: {
       Node* object = environment()->Pop();
       Handle<Name> name = property->key()->AsLiteral()->AsPropertyName();
-      Node* store =
-          BuildNamedStore(object, name, value, expr->AssignmentFeedbackId());
+      Node* store = BuildNamedStore(object, name, value, slot,
+                                    expr->AssignmentFeedbackId());
       store_states.AddToNode(store, expr->id(),
                              ast_context()->GetStateCombine());
       break;
     }
     case KEYED_PROPERTY: {
       Node* key = environment()->Pop();
       Node* object = environment()->Pop();
-      Node* store =
-          BuildKeyedStore(object, key, value, expr->AssignmentFeedbackId());
+      Node* store = BuildKeyedStore(object, key, value, slot,
+                                    expr->AssignmentFeedbackId());
       store_states.AddToNode(store, expr->id(),
                              ast_context()->GetStateCombine());
       break;
     }
     case NAMED_SUPER_PROPERTY: {
       Node* home_object = environment()->Pop();
       Node* receiver = environment()->Pop();
       Handle<Name> name = property->key()->AsLiteral()->AsPropertyName();
       Node* store = BuildNamedSuperStore(receiver, home_object, name, value,
                                          expr->AssignmentFeedbackId());
@@ skipping 447 matching lines @@
     FrameStateBeforeAndAfter states(this, BailoutId::None());
     value =
         BuildBinaryOp(old_value, jsgraph()->OneConstant(), expr->binary_op());
     // This should never deoptimize because we have converted to number
     // before.
     states.AddToNode(value, BailoutId::None(),
                      OutputFrameStateCombine::Ignore());
   }
 
   // Store the value.
+  ResolvedFeedbackSlot slot = ResolveFeedbackSlot(expr->CountSlot());
   switch (assign_type) {
     case VARIABLE: {
       Variable* variable = expr->expression()->AsVariableProxy()->var();
       environment()->Push(value);
-      BuildVariableAssignment(variable, value, expr->op(), expr->AssignmentId(),
-                              store_states);
+      BuildVariableAssignment(variable, value, expr->op(), slot,
+                              expr->AssignmentId(), store_states);
       environment()->Pop();
       break;
     }
     case NAMED_PROPERTY: {
       Node* object = environment()->Pop();
       Handle<Name> name = property->key()->AsLiteral()->AsPropertyName();
-      Node* store =
-          BuildNamedStore(object, name, value, expr->CountStoreFeedbackId());
+      Node* store = BuildNamedStore(object, name, value, slot,
+                                    expr->CountStoreFeedbackId());
       environment()->Push(value);
       store_states.AddToNode(store, expr->AssignmentId(),
                              OutputFrameStateCombine::Ignore());
       environment()->Pop();
       break;
     }
     case KEYED_PROPERTY: {
       Node* key = environment()->Pop();
       Node* object = environment()->Pop();
-      Node* store =
-          BuildKeyedStore(object, key, value, expr->CountStoreFeedbackId());
+      Node* store = BuildKeyedStore(object, key, value, slot,
+                                    expr->CountStoreFeedbackId());
       environment()->Push(value);
       store_states.AddToNode(store, expr->AssignmentId(),
                              OutputFrameStateCombine::Ignore());
       environment()->Pop();
       break;
     }
     case NAMED_SUPER_PROPERTY: {
       Node* home_object = environment()->Pop();
       Node* receiver = environment()->Pop();
       Handle<Name> name = property->key()->AsLiteral()->AsPropertyName();
@@ skipping 411 matching lines @@
 
   // Allocate and initialize a new arguments object.
   Node* callee = GetFunctionClosure();
   const Operator* op = javascript()->CallRuntime(Runtime::kNewArguments, 1);
   Node* object = NewNode(op, callee);
 
   // Assign the object to the arguments variable.
   DCHECK(arguments->IsContextSlot() || arguments->IsStackAllocated());
   // This should never lazy deopt, so it is fine to send invalid bailout id.
   FrameStateBeforeAndAfter states(this, BailoutId::None());
-  BuildVariableAssignment(arguments, object, Token::ASSIGN, BailoutId::None(),
-                          states);
+  ResolvedFeedbackSlot slot;
+  BuildVariableAssignment(arguments, object, Token::ASSIGN, slot,
+                          BailoutId::None(), states);
 
   return object;
 }
 
 
 Node* AstGraphBuilder::BuildRestArgumentsArray(Variable* rest, int index) {
   if (rest == NULL) return NULL;
 
   DCHECK(index >= 0);
   const Operator* op = javascript()->CallRuntime(Runtime::kNewRestParamSlow, 2);
   Node* object = NewNode(op, jsgraph()->SmiConstant(index),
                          jsgraph()->SmiConstant(language_mode()));
 
   // Assign the object to the rest array
   DCHECK(rest->IsContextSlot() || rest->IsStackAllocated());
   // This should never lazy deopt, so it is fine to send invalid bailout id.
   FrameStateBeforeAndAfter states(this, BailoutId::None());
-  BuildVariableAssignment(rest, object, Token::ASSIGN, BailoutId::None(),
+  ResolvedFeedbackSlot slot;
+  BuildVariableAssignment(rest, object, Token::ASSIGN, slot, BailoutId::None(),
                           states);
 
   return object;
 }
 
 
 Node* AstGraphBuilder::BuildThisFunctionVar(Variable* this_function_var) {
   if (this_function_var == nullptr) return nullptr;
 
   Node* this_function = GetFunctionClosure();
   FrameStateBeforeAndAfter states(this, BailoutId::None());
+  ResolvedFeedbackSlot slot;
   BuildVariableAssignment(this_function_var, this_function, Token::INIT_CONST,
-                          BailoutId::None(), states);
+                          slot, BailoutId::None(), states);
   return this_function;
 }
 
 
 Node* AstGraphBuilder::BuildHoleCheckSilent(Node* value, Node* for_hole,
                                             Node* not_hole) {
   Node* the_hole = jsgraph()->TheHoleConstant();
   Node* check = NewNode(javascript()->StrictEqual(), value, the_hole);
   return NewNode(common()->Select(kMachAnyTagged, BranchHint::kFalse), check,
                  for_hole, not_hole);
@@ skipping 163 matching lines @@
       PrepareFrameState(result, bailout_id, combine);
       return result;
     }
   }
   UNREACHABLE();
   return NULL;
 }
 
 
 Node* AstGraphBuilder::BuildVariableAssignment(
-    Variable* variable, Node* value, Token::Value op, BailoutId bailout_id,
+    Variable* variable, Node* value, Token::Value op,
+    const ResolvedFeedbackSlot& slot, BailoutId bailout_id,
     FrameStateBeforeAndAfter& states, OutputFrameStateCombine combine) {
   Node* the_hole = jsgraph()->TheHoleConstant();
   VariableMode mode = variable->mode();
   switch (variable->location()) {
     case Variable::UNALLOCATED: {
       // Global var, const, or let variable.
       Node* global = BuildLoadGlobalObject();
       Handle<Name> name = variable->name();
       Node* store =
-          BuildNamedStore(global, name, value, TypeFeedbackId::None());
+          BuildNamedStore(global, name, value, slot, TypeFeedbackId::None());
       states.AddToNode(store, bailout_id, combine);
       return store;
     }
     case Variable::PARAMETER:
     case Variable::LOCAL:
       // Local var, const, or let variable.
       if (mode == CONST_LEGACY && op == Token::INIT_CONST_LEGACY) {
         // Perform an initialization check for legacy const variables.
         Node* current = environment()->Lookup(variable);
         if (current->op() != the_hole->op()) {
@@ skipping 112 matching lines @@
                                       const ResolvedFeedbackSlot& feedback,
                                       ContextualMode mode) {
   const Operator* op =
       javascript()->LoadNamed(MakeUnique(name), feedback, mode);
   return Record(js_type_feedback_, NewNode(op, object, GetFeedbackVector()),
                 feedback.slot());
 }
 
 
 Node* AstGraphBuilder::BuildKeyedStore(Node* object, Node* key, Node* value,
+                                       const ResolvedFeedbackSlot& feedback,
                                        TypeFeedbackId id) {
-  const Operator* op = javascript()->StoreProperty(language_mode());
+  const Operator* op = javascript()->StoreProperty(language_mode(), feedback);
   return Record(js_type_feedback_, NewNode(op, object, key, value), id);
 }
 
 
 Node* AstGraphBuilder::BuildNamedStore(Node* object, Handle<Name> name,
-                                       Node* value, TypeFeedbackId id) {
+                                       Node* value,
+                                       const ResolvedFeedbackSlot& feedback,
+                                       TypeFeedbackId id) {
   const Operator* op =
-      javascript()->StoreNamed(language_mode(), MakeUnique(name));
+      javascript()->StoreNamed(language_mode(), feedback, MakeUnique(name));
   return Record(js_type_feedback_, NewNode(op, object, value), id);
 }
 
 
 Node* AstGraphBuilder::BuildNamedSuperLoad(
     Node* receiver, Node* home_object, Handle<Name> name,
     const ResolvedFeedbackSlot& feedback) {
   Node* name_node = jsgraph()->Constant(name);
   const Operator* op = javascript()->CallRuntime(Runtime::kLoadFromSuper, 3);
   Node* value = NewNode(op, receiver, home_object, name_node);
@@ skipping 118 matching lines @@
 
 
 Node* AstGraphBuilder::BuildToObject(Node* input, BailoutId bailout_id) {
   Node* object = NewNode(javascript()->ToObject(), input);
   PrepareFrameState(object, bailout_id, OutputFrameStateCombine::Push());
   return object;
 }
 
 
 Node* AstGraphBuilder::BuildSetHomeObject(Node* value, Node* home_object,
-                                          Expression* expr) {
+                                          Expression* expr,
+                                          const ResolvedFeedbackSlot& slot) {
   if (!FunctionLiteral::NeedsHomeObject(expr)) return value;
   Handle<Name> name = isolate()->factory()->home_object_symbol();
   FrameStateBeforeAndAfter states(this, BailoutId::None());
   Node* store =
-      BuildNamedStore(value, name, home_object, TypeFeedbackId::None());
+      BuildNamedStore(value, name, home_object, slot, TypeFeedbackId::None());
   states.AddToNode(store, BailoutId::None(), OutputFrameStateCombine::Ignore());
   return store;
 }
 
 
 Node* AstGraphBuilder::BuildThrowError(Node* exception, BailoutId bailout_id) {
   const Operator* op = javascript()->CallRuntime(Runtime::kThrow, 1);
   Node* call = NewNode(op, exception);
   PrepareFrameState(call, bailout_id);
   Node* control = NewNode(common()->Throw(), call);
@@ skipping 426 matching lines @@
     // Phi does not exist yet, introduce one.
     value = NewPhi(inputs, value, control);
     value->ReplaceInput(inputs - 1, other);
   }
   return value;
 }
 
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8