Crankshaft: consolidated element loads always deopted on seeing the hole

src/hydrogen.cc

 // Copyright 2013 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/hydrogen.h"
 
 #include <sstream>
 
 #include "src/allocation-site-scopes.h"
 #include "src/ast-numbering.h"
@@ skipping 7415 matching lines @@
     }
   }
   if (!has_double_maps && !has_smi_or_object_maps) return NULL;
 
   HCheckMaps* checked_object = Add<HCheckMaps>(object, maps);
   // FAST_ELEMENTS is considered more general than FAST_HOLEY_SMI_ELEMENTS.
   // If we've seen both, the consolidated load must use FAST_HOLEY_ELEMENTS.
   ElementsKind consolidated_elements_kind = has_seen_holey_elements
       ? GetHoleyElementsKind(most_general_consolidated_map->elements_kind())
       : most_general_consolidated_map->elements_kind();
+  LoadKeyedHoleMode load_mode = NEVER_RETURN_HOLE;
+  if (has_seen_holey_elements) {
+    if (!isolate()->IsFastArrayConstructorPrototypeChainIntact()) {
+      return NULL;
+    }
+
+    // Make sure that all of the maps we are handling have the initial array
+    // prototype.
+    for (int i = 0; i < maps->length(); ++i) {
+      Handle<Map> map = maps->at(i);
+      if (map->prototype() != *isolate()->initial_array_prototype()) {
+        // We can't guarantee that loading the hole is safe. The prototype may
+        // have an element at this position.
+        return NULL;
+      }
+    }
+
+    Handle<Map> holey_map =
+        handle(isolate()->get_initial_js_array_map(consolidated_elements_kind));
+    load_mode = BuildKeyedHoleMode(holey_map);
+    if (load_mode == NEVER_RETURN_HOLE) {
+      return NULL;
+    }
+
+    for (int i = 0; i < maps->length(); ++i) {
+      Handle<Map> map = maps->at(i);
+      // The prototype check was already done for the holey map in
+      // BuildKeyedHoleMode.
+      if (!map.is_identical_to(holey_map)) {
+        Handle<JSObject> prototype(JSObject::cast(map->prototype()), isolate());
+        Handle<JSObject> object_prototype =
+            isolate()->initial_object_prototype();
+        BuildCheckPrototypeMaps(prototype, object_prototype);
+      }
+    }
+  }
   HInstruction* instr = BuildUncheckedMonomorphicElementAccess(
       checked_object, key, val,
       most_general_consolidated_map->instance_type() == JS_ARRAY_TYPE,
-      consolidated_elements_kind,
-      LOAD, NEVER_RETURN_HOLE, STANDARD_STORE);
+      consolidated_elements_kind, LOAD, load_mode, STANDARD_STORE);
   return instr;
 }
 
 
 HValue* HOptimizedGraphBuilder::HandlePolymorphicElementAccess(
     Expression* expr, FeedbackVectorICSlot slot, HValue* object, HValue* key,
     HValue* val, SmallMapList* maps, PropertyAccessType access_type,
     KeyedAccessStoreMode store_mode, bool* has_side_effects) {
   *has_side_effects = false;
   BuildCheckHeapObject(object);
@@ skipping 5993 matching lines @@
     isolate()->GetHTracer()->TraceHydrogen(name(), graph_);
   }
 
 #ifdef DEBUG
   graph_->Verify(false);  // No full verify.
 #endif
 }
 
 }  // namespace internal
 }  // namespace v8