Adding a type vector to replace type cells.

src/ast.h

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 163 matching lines @@
   kDontSelfOptimize,
   kDontSoftInline,
   kDontCache
 };
 
 
 class AstProperties V8_FINAL BASE_EMBEDDED {
  public:
   class Flags : public EnumSet<AstPropertiesFlag, int> {};
 
-  AstProperties() : node_count_(0) { }
+  AstProperties()
+    : node_count_(0),
+      minimum_feedback_slots_(0),
+      maximum_feedback_slots_(0) { }
 
   Flags* flags() { return &flags_; }
   int node_count() { return node_count_; }
   void add_node_count(int count) { node_count_ += count; }
 
+  int minimum_feedback_slots() { return minimum_feedback_slots_; }
+  int maximum_feedback_slots() { return maximum_feedback_slots_; }
+  void increase_feedback_slots(int minimum, int maximum) {
+    minimum_feedback_slots_ += minimum;
+    maximum_feedback_slots_ += maximum;

[Benedikt Meurer, 2014/01/24 11:29:54]

Can we have an ASSERT here to make sure that  minimum_feedback_slots_ <=
maximum_feedback_slots_?

[mvstanton, 2014/01/30 15:13:41]

Changed the approach totally...

+  }
+
  private:
   Flags flags_;
   int node_count_;
+  int minimum_feedback_slots_;
+  int maximum_feedback_slots_;
 };
 
 
 class AstNode: public ZoneObject {
  public:
 #define DECLARE_TYPE_ENUM(type) k##type,
   enum NodeType {
     AST_NODE_LIST(DECLARE_TYPE_ENUM)
     kInvalid = -1
   };
 #undef DECLARE_TYPE_ENUM
 
   void* operator new(size_t size, Zone* zone) {
     return zone->New(static_cast<int>(size));
   }
 
   explicit AstNode(int position): position_(position) {}
   virtual ~AstNode() {}
 
   virtual void Accept(AstVisitor* v) = 0;
   virtual NodeType node_type() const = 0;
   int position() const { return position_; }
 
+  static int MinimumFeedbackSlots() { return 0; }
+  static int MaximumFeedbackSlots() { return 0; }
+
+  virtual int ConsumeFeedbackSlots(Isolate* isolate, int current_slot) {
+    return current_slot;
+  }
+
   // Type testing & conversion functions overridden by concrete subclasses.
 #define DECLARE_NODE_FUNCTIONS(type)                  \
   bool Is##type() { return node_type() == AstNode::k##type; }          \
   type* As##type() { return Is##type() ? reinterpret_cast<type*>(this) : NULL; }
   AST_NODE_LIST(DECLARE_NODE_FUNCTIONS)
 #undef DECLARE_NODE_FUNCTIONS
 
   virtual TargetCollector* AsTargetCollector() { return NULL; }
   virtual BreakableStatement* AsBreakableStatement() { return NULL; }
   virtual IterationStatement* AsIterationStatement() { return NULL; }
@@ skipping 689 matching lines @@
 
 
 class ForInStatement V8_FINAL : public ForEachStatement {
  public:
   DECLARE_NODE_TYPE(ForInStatement)
 
   Expression* enumerable() const {
     return subject();
   }
 
-  TypeFeedbackId ForInFeedbackId() const { return reuse(PrepareId()); }
+  // Type feedback information.
+  static int MinimumFeedbackSlots() { return 1; }
+  static int MaximumFeedbackSlots() { return 1; }
+
+  virtual int ConsumeFeedbackSlots(Isolate* isolate, int current_slot) {
+    first_feedback_slot_ = current_slot;
+    return current_slot + 1;
+  }
+  int ForInFeedbackSlot() { return first_feedback_slot_; }
+
   enum ForInType { FAST_FOR_IN, SLOW_FOR_IN };
   ForInType for_in_type() const { return for_in_type_; }
   void set_for_in_type(ForInType type) { for_in_type_ = type; }
 
   BailoutId BodyId() const { return body_id_; }
   BailoutId PrepareId() const { return prepare_id_; }
   virtual BailoutId ContinueId() const V8_OVERRIDE { return EntryId(); }
   virtual BailoutId StackCheckId() const V8_OVERRIDE { return body_id_; }
 
  protected:
   ForInStatement(Zone* zone, ZoneStringList* labels, int pos)
       : ForEachStatement(zone, labels, pos),
         for_in_type_(SLOW_FOR_IN),
+        first_feedback_slot_(0),

[Benedikt Meurer, 2014/01/24 11:29:54]

Initialize to -1 as below. Extra points if you add some
kInvalidFeedbackSlotIndex constant for this purpose.

         body_id_(GetNextId(zone)),
         prepare_id_(GetNextId(zone)) {
   }
 
   ForInType for_in_type_;
+  int first_feedback_slot_;
   const BailoutId body_id_;
   const BailoutId prepare_id_;
 };
 
 
 class ForOfStatement V8_FINAL : public ForEachStatement {
  public:
   DECLARE_NODE_TYPE(ForOfStatement)
 
   void Initialize(Expression* each,
@@ skipping 779 matching lines @@
 };
 
 
 class Call V8_FINAL : public Expression {
  public:
   DECLARE_NODE_TYPE(Call)
 
   Expression* expression() const { return expression_; }
   ZoneList<Expression*>* arguments() const { return arguments_; }
 
+  static int MinimumFeedbackSlots() { return 0; }
+  static int MaximumFeedbackSlots() { return 1; }
+  virtual int ConsumeFeedbackSlots(Isolate* isolate, int current_slot);
+  int CallFeedbackSlot() { return first_feedback_slot_; }
+
   // Type feedback information.
   TypeFeedbackId CallFeedbackId() const { return reuse(id()); }
   void RecordTypeFeedback(TypeFeedbackOracle* oracle);
   virtual SmallMapList* GetReceiverTypes() V8_OVERRIDE {
     return &receiver_types_;
   }
   virtual bool IsMonomorphic() V8_OVERRIDE { return is_monomorphic_; }
   bool KeyedArrayCallIsHoley() { return keyed_array_call_is_holey_; }
   CheckType check_type() const { return check_type_; }
 
@@ skipping 51 matching lines @@
   Call(Zone* zone,
        Expression* expression,
        ZoneList<Expression*>* arguments,
        int pos)
       : Expression(zone, pos),
         expression_(expression),
         arguments_(arguments),
         is_monomorphic_(false),
         keyed_array_call_is_holey_(true),
         check_type_(RECEIVER_MAP_CHECK),
+        first_feedback_slot_(-1),

[Benedikt Meurer, 2014/01/24 11:29:54]

Remember the extra points...? ;-)

         return_id_(GetNextId(zone)) { }
 
  private:
   Expression* expression_;
   ZoneList<Expression*>* arguments_;
 
   bool is_monomorphic_;
   bool keyed_array_call_is_holey_;
   CheckType check_type_;
   SmallMapList receiver_types_;
   Handle<JSFunction> target_;
   Handle<JSObject> holder_;
   Handle<Cell> cell_;
+  int first_feedback_slot_;
 
   const BailoutId return_id_;
 };
 
 
 class CallNew V8_FINAL : public Expression {
  public:
   DECLARE_NODE_TYPE(CallNew)
 
   Expression* expression() const { return expression_; }
   ZoneList<Expression*>* arguments() const { return arguments_; }
 
   // Type feedback information.
+  static int MinimumFeedbackSlots() { return 1; }
+  static int MaximumFeedbackSlots() { return 1; }
+
+  virtual int ConsumeFeedbackSlots(Isolate* isolate, int current_slot) {
+    first_feedback_slot_ = current_slot;
+    return current_slot + 1;
+  }
+  int CallNewFeedbackSlot() { return first_feedback_slot_; }
+
   TypeFeedbackId CallNewFeedbackId() const { return reuse(id()); }
   void RecordTypeFeedback(TypeFeedbackOracle* oracle);
   virtual bool IsMonomorphic() V8_OVERRIDE { return is_monomorphic_; }
   Handle<JSFunction> target() const { return target_; }
   ElementsKind elements_kind() const { return elements_kind_; }
   Handle<AllocationSite> allocation_site() const {
     return allocation_site_;
   }
 
+  static int feedback_slots() { return 1; }
+
   BailoutId ReturnId() const { return return_id_; }
 
  protected:
   CallNew(Zone* zone,
           Expression* expression,
           ZoneList<Expression*>* arguments,
           int pos)
       : Expression(zone, pos),
         expression_(expression),
         arguments_(arguments),
         is_monomorphic_(false),
         elements_kind_(GetInitialFastElementsKind()),
+        first_feedback_slot_(0),

[Benedikt Meurer, 2014/01/24 11:29:54]

See above.

         return_id_(GetNextId(zone)) { }
 
  private:
   Expression* expression_;
   ZoneList<Expression*>* arguments_;
 
   bool is_monomorphic_;
   Handle<JSFunction> target_;
   ElementsKind elements_kind_;
   Handle<AllocationSite> allocation_site_;
+  Handle<Cell> allocation_info_cell_;
+  int first_feedback_slot_;
 
   const BailoutId return_id_;
 };
 
 
 // The CallRuntime class does not represent any official JavaScript
 // language construct. Instead it is used to call a C or JS function
 // with a set of arguments. This is used from the builtins that are
 // implemented in JavaScript (see "v8natives.js").
 class CallRuntime V8_FINAL : public Expression {
@@ skipping 465 matching lines @@
   }
   void set_parenthesized() {
     bitfield_ = IsParenthesized::update(bitfield_, kIsParenthesized);
   }
 
   bool is_generator() {
     return IsGenerator::decode(bitfield_) == kIsGenerator;
   }
 
   int ast_node_count() { return ast_properties_.node_count(); }
+
+  int minimum_feedback_slots() {
+    return ast_properties_.minimum_feedback_slots();
+  }
+
+  int maximum_feedback_slots() {
+    return ast_properties_.maximum_feedback_slots();
+  }
+
   AstProperties::Flags* flags() { return ast_properties_.flags(); }
   void set_ast_properties(AstProperties* ast_properties) {
     ast_properties_ = *ast_properties;
   }
 
   bool dont_optimize() { return dont_optimize_reason_ != kNoReason; }
   BailoutReason dont_optimize_reason() { return dont_optimize_reason_; }
   void set_dont_optimize_reason(BailoutReason reason) {
     dont_optimize_reason_ = reason;
   }
@@ skipping 523 matching lines @@
  private:
   template<class> friend class AstNodeFactory;
 
   // Node visitors.
 #define DEF_VISIT(type) \
   void Visit##type(type* node);
   AST_NODE_LIST(DEF_VISIT)
 #undef DEF_VISIT
 
   void increase_node_count() { properties_.add_node_count(1); }
+  void increase_feedback_slots(int count_fixed, int count_optional) {
+    properties_.increase_feedback_slots(count_fixed, count_optional);
+  }
   void add_flag(AstPropertiesFlag flag) { properties_.flags()->Add(flag); }
   void set_dont_optimize_reason(BailoutReason reason) {
       dont_optimize_reason_ = reason;
   }
 
   AstProperties properties_;
   BailoutReason dont_optimize_reason_;
 };
 
 
@@ skipping 412 matching lines @@
 
  private:
   Zone* zone_;
   Visitor visitor_;
 };
 
 
 } }  // namespace v8::internal
 
 #endif  // V8_AST_H_