Vector ICs: Get rid of stack arguments on ia32 transitioning stores.

src/ic/ic.cc

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/ic/ic.h"
 
 #include "src/accessors.h"
 #include "src/api.h"
 #include "src/arguments.h"
 #include "src/base/bits.h"
@@ skipping 2460 matching lines @@
 
 RUNTIME_FUNCTION(Runtime_StoreIC_MissFromStubFailure) {
   TimerEventScope<TimerEventIcMiss> timer(isolate);
   HandleScope scope(isolate);
   Handle<Object> receiver = args.at<Object>(0);
   Handle<Name> key = args.at<Name>(1);
   Handle<Object> value = args.at<Object>(2);
   Handle<Object> result;
 
   if (FLAG_vector_stores) {
-    DCHECK(args.length() == 5 || args.length() == 6);
-    Handle<Smi> slot = args.at<Smi>(3);
-    Handle<TypeFeedbackVector> vector = args.at<TypeFeedbackVector>(4);
+    int length = args.length();
+    DCHECK(length == 5 || length == 6);
+    // We might have slot and vector, for a normal miss (slot(3), vector(4)).
+    // Or, map and vector for a transitioning store miss (map(3), vector(4)).
+    // In this case, we need to recover the slot from a virtual register.
+    // If length == 6, then a map is included (map(3), slot(4), vector(5)).
+    Handle<Smi> slot;
+    Handle<TypeFeedbackVector> vector;
+    if (length == 5) {
+      if (args.at<Object>(3)->IsMap()) {
+        vector = args.at<TypeFeedbackVector>(4);
+        slot = handle(
+            *reinterpret_cast<Smi**>(isolate->virtual_slot_register_address()),
+            isolate);
+      } else {
+        vector = args.at<TypeFeedbackVector>(4);
+        slot = args.at<Smi>(3);
+      }
+    } else {
+      vector = args.at<TypeFeedbackVector>(5);
+      slot = args.at<Smi>(4);
+    }
+
     FeedbackVectorSlot vector_slot = vector->ToSlot(slot->value());
     if (vector->GetKind(vector_slot) == FeedbackVectorSlotKind::STORE_IC) {
       StoreICNexus nexus(vector, vector_slot);
       StoreIC ic(IC::EXTRA_CALL_FRAME, isolate, &nexus);
       ic.UpdateState(receiver, key);
       ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, result,
                                          ic.Store(receiver, key, value));
     } else {
       DCHECK_EQ(FeedbackVectorSlotKind::KEYED_STORE_IC,
                 vector->GetKind(vector_slot));
@@ skipping 115 matching lines @@
   ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
       isolate, result,
       Runtime::SetObjectProperty(isolate, object, key, value, language_mode));
   return *result;
 }
 
 
 RUNTIME_FUNCTION(Runtime_ElementsTransitionAndStoreIC_Miss) {
   TimerEventScope<TimerEventIcMiss> timer(isolate);
   HandleScope scope(isolate);
-  DCHECK(args.length() == (FLAG_vector_stores ? 6 : 4));
+  // Without vector stores, length == 4.
+  // With vector stores, length == 5 or 6, depending on whether the vector slot
+  // is passed in a virtual register or not.
+  DCHECK(!FLAG_vector_stores || args.length() == 5 || args.length() == 6);
   Handle<Object> object = args.at<Object>(0);
   Handle<Object> key = args.at<Object>(1);
   Handle<Object> value = args.at<Object>(2);
-  Handle<Map> map = args.at<Map>(FLAG_vector_stores ? 5 : 3);
+  Handle<Map> map = args.at<Map>(3);
   LanguageMode language_mode;
   if (FLAG_vector_stores) {
     KeyedStoreICNexus nexus(isolate);
     KeyedStoreIC ic(IC::EXTRA_CALL_FRAME, isolate, &nexus);
     language_mode = ic.language_mode();
   } else {
     KeyedStoreIC ic(IC::EXTRA_CALL_FRAME, isolate);
     language_mode = ic.language_mode();
   }
   if (object->IsJSObject()) {
@@ skipping 490 matching lines @@
     KeyedLoadICNexus nexus(vector, vector_slot);
     KeyedLoadIC ic(IC::EXTRA_CALL_FRAME, isolate, &nexus);
     ic.UpdateState(receiver, key);
     ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, result, ic.Load(receiver, key));
   }
 
   return *result;
 }
 }  // namespace internal
 }  // namespace v8