Track representations of fields

src/objects.h

Index: src/objects.h
diff --git a/src/objects.h b/src/objects.h
index 0e64e37eb1988b92e87404d5c738b6a55ac7fff7..be277e8377ebf7fd08eb7325173cb7b409c5bf6b 100644
--- a/src/objects.h
+++ b/src/objects.h
@@ -1060,6 +1060,24 @@ class Object : public MaybeObject {
   inline double Number();
   inline bool IsNaN();
 
+  inline StorageType RequiredStorage() {
+    if (IsTheHole()) return ANY;
+    if (IsSmi()) return SMI;
+    if (IsHeapNumber()) return DOUBLE;
+    return TAGGED;
+  }
+
+  inline bool FitsStorage(StorageType storage) {
+    if (!FLAG_track_fields) return true;
+    if (storage == ANY) return false;
+    if (storage == SMI) {
+      return IsSmi();
+    } else if (storage == DOUBLE) {
+      return IsNumber();
+    }
+    return true;
+  }
+
   // Returns true if the object is of the correct type to be used as a
   // implementation of a JSObject's elements.
   inline bool HasValidElements();
@@ -1806,11 +1824,12 @@ class JSObject: public JSReceiver {
 
   // Extend the receiver with a single fast property appeared first in the
   // passed map. This also extends the property backing store if necessary.
-  static void AddFastPropertyUsingMap(Handle<JSObject> object, Handle<Map> map);
-  inline MUST_USE_RESULT MaybeObject* AddFastPropertyUsingMap(Map* map);
   static void TransitionToMap(Handle<JSObject> object, Handle<Map> map);
   inline MUST_USE_RESULT MaybeObject* TransitionToMap(Map* map);
 
+  static void MigrateInstance(Handle<JSObject> instance);
+  inline MUST_USE_RESULT MaybeObject* MigrateInstance();
+
   // Can cause GC.
   MUST_USE_RESULT MaybeObject* SetLocalPropertyIgnoreAttributes(
       Name* key,
@@ -2164,6 +2183,10 @@ class JSObject: public JSReceiver {
       Object* new_value,
       PropertyAttributes attributes);
 
+  MUST_USE_RESULT MaybeObject* MigrateToMap(Map* new_map);
+  MUST_USE_RESULT MaybeObject* GeneralizeFieldStorage(int modify_index,
+                                                      StorageType new_storage);
+
   // Add a property to a fast-case object.
   MUST_USE_RESULT MaybeObject* AddFastProperty(
       Name* name,
@@ -2753,6 +2776,8 @@ class DescriptorArray: public FixedArray {
   inline Name* GetSortedKey(int descriptor_number);
   inline int GetSortedKeyIndex(int descriptor_number);
   inline void SetSortedKey(int pointer, int descriptor_number);
+  inline void InitializeStorageTypes(StorageType storage_type);
+  inline void SetStorageType(int descriptor_number, StorageType type);
 
   // Accessor for complete descriptor.
   inline void Get(int descriptor_number, Descriptor* desc);
@@ -2773,6 +2798,10 @@ class DescriptorArray: public FixedArray {
                 DescriptorArray* src,
                 int src_index,
                 const WhitenessWitness&);
+  MUST_USE_RESULT MaybeObject* Merge(int verbatim,
+                                     int valid,
+                                     int new_size,
+                                     DescriptorArray* other);
 
   MUST_USE_RESULT MaybeObject* CopyUpTo(int enumeration_index);
 
@@ -4889,6 +4918,9 @@ class DependentCode: public FixedArray {
     // Group of code that weakly embed this map and depend on being
     // deoptimized when the map is garbage collected.
     kWeaklyEmbeddedGroup,
+    // Group of code that embed a transition to this map, and depend on being
+    // deoptimized when the field transition is replaced by a new version.
+    kFieldTransitionGroup,
     // Group of code that omit run-time prototype checks for prototypes
     // described by this map. The group is deoptimized whenever an object
     // described by this map changes shape (and transitions to a new map),
@@ -4982,6 +5014,7 @@ class Map: public HeapObject {
   class DictionaryMap:              public BitField<bool, 24,  1> {};
   class OwnsDescriptors:            public BitField<bool, 25,  1> {};
   class IsObserved:                 public BitField<bool, 26,  1> {};
+  class InvalidTransition:          public BitField<bool, 27,  1> {};
 
   // Tells whether the object in the prototype property will be used
   // for instances created from this function.  If the prototype
@@ -5124,6 +5157,21 @@ class Map: public HeapObject {
   inline void ClearTransitions(Heap* heap,
                                WriteBarrierMode mode = UPDATE_WRITE_BARRIER);
 
+  void InvalidateTransitionTree();
+  void InvalidateTarget(Name* key, DescriptorArray* new_descriptors);
+  bool TransitionsTo(Map* map);
+
+  Map* FindRootMap();
+  Map* FindUpdatedMap(int length, DescriptorArray* descriptors);
+  Map* FindLastMatchMap(DescriptorArray* descriptors);
+
+  int NumberOfFields();
+
+  MUST_USE_RESULT MaybeObject* GeneralizeStorage(int modify_index,
+                                                 StorageType storage);
+  MUST_USE_RESULT MaybeObject* CopyGeneralizeStorage(int modify_index,
+                                                     StorageType storage);
+
   // Tells whether the map is attached to SharedFunctionInfo
   // (for inobject slack tracking).
   inline void set_attached_to_shared_function_info(bool value);
@@ -5262,6 +5310,9 @@ class Map: public HeapObject {
   inline void set_owns_descriptors(bool is_shared);
   inline bool is_observed();
   inline void set_is_observed(bool is_observed);
+  inline void invalidate_transition();
+  inline bool is_invalid_transition();
+  inline bool CanTransitionBeInvalidated();
 
   MUST_USE_RESULT MaybeObject* RawCopy(int instance_size);
   MUST_USE_RESULT MaybeObject* CopyWithPreallocatedFieldDescriptors();
@@ -5271,6 +5322,9 @@ class Map: public HeapObject {
       Name* name,
       TransitionFlag flag,
       int descriptor_index);
+  MUST_USE_RESULT MaybeObject* CopyInstallDescriptors(
+      int new_descriptor,
+      DescriptorArray* descriptors);
   MUST_USE_RESULT MaybeObject* ShareDescriptor(DescriptorArray* descriptors,
                                                Descriptor* descriptor);
   MUST_USE_RESULT MaybeObject* CopyAddDescriptor(Descriptor* descriptor,
@@ -5296,9 +5350,6 @@ class Map: public HeapObject {
   // instance descriptors.
   MUST_USE_RESULT MaybeObject* Copy();
 
-  // Returns the property index for name (only valid for FAST MODE).
-  int PropertyIndexFor(Name* name);
-
   // Returns the next free property index (only valid for FAST MODE).
   int NextFreePropertyIndex();
 
@@ -5349,6 +5400,8 @@ class Map: public HeapObject {
   // Computes a hash value for this map, to be used in HashTables and such.
   int Hash();
 
+  bool EquivalentToForTransition(Map* other);
+
   // Compares this map to another to see if they describe equivalent objects.
   // If |mode| is set to CLEAR_INOBJECT_PROPERTIES, |other| is treated as if
   // it had exactly zero inobject properties.