Crankshaft: consolidated element loads always deopted on seeing the hole

src/hydrogen.cc

Index: src/hydrogen.cc
diff --git a/src/hydrogen.cc b/src/hydrogen.cc
index 99b4ddd1e884c4bef8ed45725289219bac43682c..b66361178fa454f98c0c16c9bffa635e0ca28614 100644
--- a/src/hydrogen.cc
+++ b/src/hydrogen.cc
@@ -7433,11 +7433,49 @@ HInstruction* HOptimizedGraphBuilder::TryBuildConsolidatedElementLoad(
   ElementsKind consolidated_elements_kind = has_seen_holey_elements
       ? GetHoleyElementsKind(most_general_consolidated_map->elements_kind())
       : most_general_consolidated_map->elements_kind();
+  LoadKeyedHoleMode load_mode = NEVER_RETURN_HOLE;
+  if (has_seen_holey_elements) {
+    if (!isolate()->IsFastArrayConstructorPrototypeChainIntact()) {
+      return NULL;
+    }
+
+    // Make sure that all of the maps we are handling are initial array
+    // maps, or at least that their prototype is the initial array
+    // prototype.
+    for (int i = 0; i < maps->length(); ++i) {
+      Handle<Map> map = maps->at(i);
+      if (*map != isolate()->get_initial_js_array_map(map->elements_kind())) {

[Jakob Kummerow, 2015/09/09 14:12:18]

Isn't this condition...

[mvstanton, 2015/09/09 14:41:56]

Acknowledged.

+        if (map->prototype() != *isolate()->initial_array_prototype()) {

[Jakob Kummerow, 2015/09/09 14:12:18]

...implied by this one? Seems like you could simply drop the first check. (And
update the comment accordingly.)

[mvstanton, 2015/09/09 14:41:56]

Oh yeah, thanks! :)

+          // We can't guarantee that loading the hole is safe. The prototype may
+          // have an element at this position.
+          return NULL;
+        }
+      }
+    }
+
+    Handle<Map> holey_map =
+        handle(isolate()->get_initial_js_array_map(consolidated_elements_kind));
+    load_mode = BuildKeyedHoleMode(holey_map);
+    if (load_mode == NEVER_RETURN_HOLE) {
+      return NULL;
+    }
+
+    for (int i = 0; i < maps->length(); ++i) {
+      Handle<Map> map = maps->at(i);
+      // The prototype check was already done for the holey map in
+      // BuildKeyedHoleMode.
+      if (!map.is_identical_to(holey_map)) {
+        Handle<JSObject> prototype(JSObject::cast(map->prototype()), isolate());
+        Handle<JSObject> object_prototype =
+            isolate()->initial_object_prototype();
+        BuildCheckPrototypeMaps(prototype, object_prototype);
+      }
+    }
+  }
   HInstruction* instr = BuildUncheckedMonomorphicElementAccess(
       checked_object, key, val,
       most_general_consolidated_map->instance_type() == JS_ARRAY_TYPE,
-      consolidated_elements_kind,
-      LOAD, NEVER_RETURN_HOLE, STANDARD_STORE);
+      consolidated_elements_kind, LOAD, load_mode, STANDARD_STORE);
   return instr;
 }