Adding a type vector to replace type cells.

src/ast.h

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 195 matching lines @@
     return zone->New(static_cast<int>(size));
   }
 
   explicit AstNode(int position): position_(position) {}
   virtual ~AstNode() {}
 
   virtual void Accept(AstVisitor* v) = 0;
   virtual NodeType node_type() const = 0;
   int position() const { return position_; }
 
+  static const int kInvalidFeedbackSlot = -1;
+  virtual int ConsumeFeedbackSlots(Isolate* isolate, int current_slot) {

[danno, 2014/01/28 08:27:17]

Is it really consuming? Isn't it more like earmarking or reserving? A comment
might be useful here, too, e.g. "By default, AST nodes don't store their type
information in the type vector and therefore don't reserve slots" or something
to that effect.

[mvstanton, 2014/01/30 15:13:41]

Changed the approach quite a bit.

+    return current_slot;
+  }
+
   // Type testing & conversion functions overridden by concrete subclasses.
 #define DECLARE_NODE_FUNCTIONS(type)                  \
   bool Is##type() { return node_type() == AstNode::k##type; }          \
   type* As##type() { return Is##type() ? reinterpret_cast<type*>(this) : NULL; }
   AST_NODE_LIST(DECLARE_NODE_FUNCTIONS)
 #undef DECLARE_NODE_FUNCTIONS
 
   virtual TargetCollector* AsTargetCollector() { return NULL; }
   virtual BreakableStatement* AsBreakableStatement() { return NULL; }
   virtual IterationStatement* AsIterationStatement() { return NULL; }
@@ skipping 689 matching lines @@
 
 
 class ForInStatement V8_FINAL : public ForEachStatement {
  public:
   DECLARE_NODE_TYPE(ForInStatement)
 
   Expression* enumerable() const {
     return subject();
   }
 
-  TypeFeedbackId ForInFeedbackId() const { return reuse(PrepareId()); }
+  // Type feedback information.
+  virtual int ConsumeFeedbackSlots(Isolate* isolate, int current_slot) {
+    for_in_feedback_slot_ = current_slot;
+    return current_slot + 1;
+  }
+  int ForInFeedbackSlot() {
+    ASSERT(for_in_feedback_slot_ != kInvalidFeedbackSlot);
+    return for_in_feedback_slot_;
+  }
+
   enum ForInType { FAST_FOR_IN, SLOW_FOR_IN };
   ForInType for_in_type() const { return for_in_type_; }
   void set_for_in_type(ForInType type) { for_in_type_ = type; }
 
   BailoutId BodyId() const { return body_id_; }
   BailoutId PrepareId() const { return prepare_id_; }
   virtual BailoutId ContinueId() const V8_OVERRIDE { return EntryId(); }
   virtual BailoutId StackCheckId() const V8_OVERRIDE { return body_id_; }
 
  protected:
   ForInStatement(Zone* zone, ZoneStringList* labels, int pos)
       : ForEachStatement(zone, labels, pos),
         for_in_type_(SLOW_FOR_IN),
+        for_in_feedback_slot_(kInvalidFeedbackSlot),
         body_id_(GetNextId(zone)),
         prepare_id_(GetNextId(zone)) {
   }
 
   ForInType for_in_type_;
+  int for_in_feedback_slot_;
   const BailoutId body_id_;
   const BailoutId prepare_id_;
 };
 
 
 class ForOfStatement V8_FINAL : public ForEachStatement {
  public:
   DECLARE_NODE_TYPE(ForOfStatement)
 
   void Initialize(Expression* each,
@@ skipping 779 matching lines @@
 };
 
 
 class Call V8_FINAL : public Expression {
  public:
   DECLARE_NODE_TYPE(Call)
 
   Expression* expression() const { return expression_; }
   ZoneList<Expression*>* arguments() const { return arguments_; }
 
+  virtual int ConsumeFeedbackSlots(Isolate* isolate, int current_slot);
+  bool HasCallFeedbackSlot() const {
+    return call_feedback_slot_ != kInvalidFeedbackSlot;
+  }
+  int CallFeedbackSlot() const { return call_feedback_slot_; }
+
   // Type feedback information.
   TypeFeedbackId CallFeedbackId() const { return reuse(id()); }
   void RecordTypeFeedback(TypeFeedbackOracle* oracle);
   virtual SmallMapList* GetReceiverTypes() V8_OVERRIDE {
     return &receiver_types_;
   }
   virtual bool IsMonomorphic() V8_OVERRIDE { return is_monomorphic_; }
   bool KeyedArrayCallIsHoley() { return keyed_array_call_is_holey_; }
   CheckType check_type() const { return check_type_; }
 
@@ skipping 51 matching lines @@
   Call(Zone* zone,
        Expression* expression,
        ZoneList<Expression*>* arguments,
        int pos)
       : Expression(zone, pos),
         expression_(expression),
         arguments_(arguments),
         is_monomorphic_(false),
         keyed_array_call_is_holey_(true),
         check_type_(RECEIVER_MAP_CHECK),
+        call_feedback_slot_(kInvalidFeedbackSlot),
         return_id_(GetNextId(zone)) { }
 
  private:
   Expression* expression_;
   ZoneList<Expression*>* arguments_;
 
   bool is_monomorphic_;
   bool keyed_array_call_is_holey_;
   CheckType check_type_;
   SmallMapList receiver_types_;
   Handle<JSFunction> target_;
   Handle<JSObject> holder_;
   Handle<Cell> cell_;
+  int call_feedback_slot_;
 
   const BailoutId return_id_;
 };
 
 
 class CallNew V8_FINAL : public Expression {
  public:
   DECLARE_NODE_TYPE(CallNew)
 
   Expression* expression() const { return expression_; }
   ZoneList<Expression*>* arguments() const { return arguments_; }
 
   // Type feedback information.
+  virtual int ConsumeFeedbackSlots(Isolate* isolate, int current_slot) {

[danno, 2014/01/28 08:27:17]

Somehow, this seems a little clunky. It seems like you want to have a virtual
method that returns the number of nodes needed by the AST node, and that by
default return zero, and only have to implement this method if you want slots.
For examples, if you change the consumefeedbackslots logic in the ASTNode
baseclass to call SetFirstFeedbackSlot and GetFirstFeedbackSlot virtual methods
that do nothing/ASSERT by default and are only implemented for a new subclass of
Expression called ExpressionWithFeedback (which Call and ForIn derive from) you
can get the memory back and make adding slot support easy, just 1) subclass from
ExpressionWithFeedback and 2) Implement virtual int GetFeedbackSlotCount().

+    callnew_feedback_slot_ = current_slot;
+    return current_slot + 1;
+  }
+  int CallNewFeedbackSlot() {
+    ASSERT(callnew_feedback_slot_ != kInvalidFeedbackSlot);
+    return callnew_feedback_slot_;
+  }
+
   TypeFeedbackId CallNewFeedbackId() const { return reuse(id()); }
   void RecordTypeFeedback(TypeFeedbackOracle* oracle);
   virtual bool IsMonomorphic() V8_OVERRIDE { return is_monomorphic_; }
   Handle<JSFunction> target() const { return target_; }
   ElementsKind elements_kind() const { return elements_kind_; }
   Handle<AllocationSite> allocation_site() const {
     return allocation_site_;
   }
 
+  static int feedback_slots() { return 1; }
+
   BailoutId ReturnId() const { return return_id_; }
 
  protected:
   CallNew(Zone* zone,
           Expression* expression,
           ZoneList<Expression*>* arguments,
           int pos)
       : Expression(zone, pos),
         expression_(expression),
         arguments_(arguments),
         is_monomorphic_(false),
         elements_kind_(GetInitialFastElementsKind()),
+        callnew_feedback_slot_(kInvalidFeedbackSlot),
         return_id_(GetNextId(zone)) { }
 
  private:
   Expression* expression_;
   ZoneList<Expression*>* arguments_;
 
   bool is_monomorphic_;
   Handle<JSFunction> target_;
   ElementsKind elements_kind_;
   Handle<AllocationSite> allocation_site_;
+  Handle<Cell> allocation_info_cell_;
+  int callnew_feedback_slot_;
 
   const BailoutId return_id_;
 };
 
 
 // The CallRuntime class does not represent any official JavaScript
 // language construct. Instead it is used to call a C or JS function
 // with a set of arguments. This is used from the builtins that are
 // implemented in JavaScript (see "v8natives.js").
 class CallRuntime V8_FINAL : public Expression {
@@ skipping 1440 matching lines @@
 
  private:
   Zone* zone_;
   Visitor visitor_;
 };
 
 
 } }  // namespace v8::internal
 
 #endif  // V8_AST_H_