Adding a type vector to replace type cells.

src/full-codegen.h

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 78 matching lines @@
         info_(info),
         scope_(info->scope()),
         nesting_stack_(NULL),
         loop_depth_(0),
         globals_(NULL),
         context_(NULL),
         bailout_entries_(info->HasDeoptimizationSupport()
                          ? info->function()->ast_node_count() : 0,
                          info->zone()),
         back_edges_(2, info->zone()),
-        type_feedback_cells_(info->HasDeoptimizationSupport()
-                             ? info->function()->ast_node_count() : 0,
-                             info->zone()),
         ic_total_count_(0) {
     Initialize();
   }
 
   void Initialize();
 
   static bool MakeCode(CompilationInfo* info);
 
   // Encode state and pc-offset as a BitField<type, start, size>.
   // Only use 30 bits because we encode the result as a smi.
@@ skipping 315 matching lines @@
 
   // Platform-specific code for equality comparison with a nil-like value.
   void EmitLiteralCompareNil(CompareOperation* expr,
                              Expression* sub_expr,
                              NilValue nil);
 
   // Bailout support.
   void PrepareForBailout(Expression* node, State state);
   void PrepareForBailoutForId(BailoutId id, State state);
 
-  // Cache cell support.  This associates AST ids with global property cells
-  // that will be cleared during GC and collected by the type-feedback oracle.
-  void RecordTypeFeedbackCell(TypeFeedbackId id, Handle<Cell> cell);
+  class FeedbackVectorWrapper {
+   public:
+    FeedbackVectorWrapper() : used_(0), maximum_length_(0) {}
+
+    void Initialize(Isolate* isolate, int minimum_length, int maximum_length);
+    Handle<FixedArray> FeedbackVector() { return feedback_vector_; }
+    void Visit(Isolate* isolate, AstNode* node);
+    void Set(int slot, Handle<Object> object);
+    void Finalize(Isolate* isolate);
+
+   private:
+    int used_;
+    int maximum_length_;
+    Handle<FixedArray> feedback_vector_;
+  };
+
+  // Feedback slot support. The feedback vector will be cleared during gc and
+  // collected by the type-feedback oracle.
+  Handle<FixedArray> FeedbackVector() {
+    return feedback_wrapper_.FeedbackVector();
+  }
+  void StoreFeedbackVectorSlot(int slot, Handle<Object> object) {
+    feedback_wrapper_.Set(slot, object);
+  }
 
   // Record a call's return site offset, used to rebuild the frame if the
   // called function was inlined at the site.
   void RecordJSReturnSite(Call* call);
 
   // Prepare for bailout before a test (or compare) and branch.  If
   // should_normalize, then the following comparison will not handle the
   // canonical JS true value so we will insert a (dead) test against true at
   // the actual bailout target from the optimized code. If not
   // should_normalize, the true and false labels are ignored.
@@ skipping 178 matching lines @@
 
   void VisitComma(BinaryOperation* expr);
   void VisitLogicalExpression(BinaryOperation* expr);
   void VisitArithmeticExpression(BinaryOperation* expr);
 
   void VisitForTypeofValue(Expression* expr);
 
   void Generate();
   void PopulateDeoptimizationData(Handle<Code> code);
   void PopulateTypeFeedbackInfo(Handle<Code> code);
-  void PopulateTypeFeedbackCells(Handle<Code> code);
 
   Handle<FixedArray> handler_table() { return handler_table_; }
 
   struct BailoutEntry {
     BailoutId id;
     unsigned pc_and_state;
   };
 
   struct BackEdgeEntry {
     BailoutId id;
     unsigned pc;
     uint32_t loop_depth;
   };
 
-  struct TypeFeedbackCellEntry {
-    TypeFeedbackId ast_id;
-    Handle<Cell> cell;
-  };
-
-
   class ExpressionContext BASE_EMBEDDED {
    public:
     explicit ExpressionContext(FullCodeGenerator* codegen)
         : masm_(codegen->masm()), old_(codegen->context()), codegen_(codegen) {
       codegen->set_new_context(this);
     }
 
     virtual ~ExpressionContext() {
       codegen_->set_new_context(old_);
     }
@@ skipping 169 matching lines @@
   Label return_label_;
   NestedStatement* nesting_stack_;
   int loop_depth_;
   ZoneList<Handle<Object> >* globals_;
   Handle<FixedArray> modules_;
   int module_index_;
   const ExpressionContext* context_;
   ZoneList<BailoutEntry> bailout_entries_;
   GrowableBitVector prepared_bailout_ids_;
   ZoneList<BackEdgeEntry> back_edges_;
-  ZoneList<TypeFeedbackCellEntry> type_feedback_cells_;
   int ic_total_count_;
   Handle<FixedArray> handler_table_;
+  FeedbackVectorWrapper feedback_wrapper_;
   Handle<Cell> profiling_counter_;
   bool generate_debug_code_;
 
   friend class NestedStatement;
 
   DEFINE_AST_VISITOR_SUBCLASS_MEMBERS();
   DISALLOW_COPY_AND_ASSIGN(FullCodeGenerator);
 };
 
 
@@ skipping 102 matching lines @@
 
   Address start_;
   Address instruction_start_;
   uint32_t length_;
 };
 
 
 } }  // namespace v8::internal
 
 #endif  // V8_FULL_CODEGEN_H_