Track field types.

src/objects.cc

 // Copyright 2013 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 1941 matching lines @@
                                     Representation representation) {
   Heap* heap = isolate->heap();
   CALL_HEAP_FUNCTION(isolate,
                      object->AllocateNewStorageFor(heap, representation),
                      Object);
 }
 
 
 static MaybeObject* CopyAddFieldDescriptor(Map* map,
                                            Name* name,
-                                           int index,
+                                           int field_index,
+                                           HeapType* field_type,
                                            PropertyAttributes attributes,
                                            Representation representation,
                                            TransitionFlag flag) {
   Map* new_map;
-  FieldDescriptor new_field_desc(name, index, attributes, representation);
+  FieldDescriptor new_field_desc(name, field_index, field_type,
+                                 attributes, representation);
   MaybeObject* maybe_map = map->CopyAddDescriptor(&new_field_desc, flag);
   if (!maybe_map->To(&new_map)) return maybe_map;
   int unused_property_fields = map->unused_property_fields() - 1;
   if (unused_property_fields < 0) {
     unused_property_fields += JSObject::kFieldsAdded;
   }
   new_map->set_unused_property_fields(unused_property_fields);
   return new_map;
 }
 
 
 static Handle<Map> CopyAddFieldDescriptor(Handle<Map> map,
                                           Handle<Name> name,
-                                          int index,
+                                          int field_index,
+                                          Handle<HeapType> field_type,
                                           PropertyAttributes attributes,
                                           Representation representation,
                                           TransitionFlag flag) {
   CALL_HEAP_FUNCTION(map->GetIsolate(),
                      CopyAddFieldDescriptor(
-                         *map, *name, index, attributes, representation, flag),
+                         *map, *name, field_index, *field_type,
+                         attributes, representation, flag),
                      Map);
 }
 
 
 void JSObject::AddFastProperty(Handle<JSObject> object,
                                Handle<Name> name,
                                Handle<Object> value,
                                PropertyAttributes attributes,
                                StoreFromKeyed store_mode,
                                ValueType value_type,
                                TransitionFlag flag) {
   ASSERT(!object->IsJSGlobalProxy());
   ASSERT(DescriptorArray::kNotFound ==
          object->map()->instance_descriptors()->Search(
              *name, object->map()->NumberOfOwnDescriptors()));
 
   // Normalize the object if the name is an actual name (not the
   // hidden strings) and is not a real identifier.
   // Normalize the object if it will have too many fast properties.
   Isolate* isolate = object->GetIsolate();
   if (!name->IsCacheable(isolate) ||
       object->TooManyFastProperties(store_mode)) {
     NormalizeProperties(object, CLEAR_INOBJECT_PROPERTIES, 0);
     AddSlowProperty(object, name, value, attributes);
     return;
   }
 
   // Compute the new index for new field.
-  int index = object->map()->NextFreePropertyIndex();
+  int field_index = object->map()->NextFreePropertyIndex();
+
+  // Compute the optimal representation for the new field.
+  if (object->IsJSContextExtensionObject()) value_type = FORCE_TAGGED;
+  Representation representation = value->OptimalRepresentation(value_type);
+
+  // Compute the type of the new field.
+  Handle<HeapType> field_type = FLAG_track_field_types
+      ? HeapType::OfCurrently(value, isolate)

[Toon Verwaest, 2014/03/21 14:33:37]

If it's FORCE_TAGGED we also shouldn't be tracking types, right?
What about having a function that gets the representation in, in addition to the
object? That way, if the representation is tagged, we don't track?

[Benedikt Meurer, 2014/04/11 11:12:00]

Done.

+      : HeapType::Any(isolate);
+  if (FLAG_trace_track_field_types) {
+#ifdef OBJECT_PRINT
+    PrintF("[Adding fast property ");
+    name->Print();
+    PrintF(" to object ");
+    object->ShortPrint();
+    PrintF(" with value ");
+    value->ShortPrint();
+    PrintF(" and field type ");
+    field_type->TypePrint(stdout);
+    PrintF("]\n");
+#endif
+  }
 
   // Allocate new instance descriptors with (name, index) added
-  if (object->IsJSContextExtensionObject()) value_type = FORCE_TAGGED;
-  Representation representation = value->OptimalRepresentation(value_type);
   Handle<Map> new_map = CopyAddFieldDescriptor(
-      handle(object->map()), name, index, attributes, representation, flag);
+      handle(object->map()), name, field_index,
+      field_type, attributes, representation, flag);
 
   JSObject::MigrateToMap(object, new_map);
 
   if (representation.IsDouble()) {
     // Nothing more to be done.
     if (value->IsUninitialized()) return;
-    HeapNumber* box = HeapNumber::cast(object->RawFastPropertyAt(index));
+    HeapNumber* box = HeapNumber::cast(object->RawFastPropertyAt(field_index));
     box->set_value(value->Number());
   } else {
-    object->FastPropertyAtPut(index, *value);
+    object->FastPropertyAtPut(field_index, *value);
   }
 }
 
 
 static MaybeObject* CopyAddConstantDescriptor(Map* map,
                                               Name* name,
                                               Object* value,
                                               PropertyAttributes attributes,
                                               TransitionFlag flag) {
   ConstantDescriptor new_constant_desc(name, value, attributes);
@@ skipping 410 matching lines @@
                                            SimpleTransitionFlag flag) {
   CALL_HEAP_FUNCTION(map->GetIsolate(),
                      map->AddTransition(*key, *target, flag),
                      TransitionArray);
 }
 
 
 void JSObject::GeneralizeFieldRepresentation(Handle<JSObject> object,
                                              int modify_index,
                                              Representation new_representation,
+                                             Handle<HeapType> new_field_type,
                                              StoreMode store_mode) {
   Handle<Map> new_map = Map::GeneralizeRepresentation(
-      handle(object->map()), modify_index, new_representation, store_mode);
+      handle(object->map()), modify_index, new_representation,
+      new_field_type, store_mode);
   if (object->map() == *new_map) return;
   return MigrateToMap(object, new_map);
 }
 
 
 int Map::NumberOfFields() {
   DescriptorArray* descriptors = instance_descriptors();
   int result = 0;
   for (int i = 0; i < NumberOfOwnDescriptors(); i++) {
     if (descriptors->GetDetails(i).type() == FIELD) result++;
   }
   return result;
 }
 
 
 Handle<Map> Map::CopyGeneralizeAllRepresentations(Handle<Map> map,
                                                   int modify_index,
                                                   StoreMode store_mode,
                                                   PropertyAttributes attributes,
                                                   const char* reason) {
   Handle<Map> new_map = Copy(map);
 
   DescriptorArray* descriptors = new_map->instance_descriptors();
-  descriptors->InitializeRepresentations(Representation::Tagged());
+  int length = descriptors->number_of_descriptors();
+  for (int i = 0; i < length; i++) {
+    descriptors->SetRepresentation(i, Representation::Tagged());
+    if (descriptors->GetDetails(i).type() == FIELD) {
+      descriptors->SetValue(i, HeapType::Any());
+    }
+  }
 
   // Unless the instance is being migrated, ensure that modify_index is a field.
   PropertyDetails details = descriptors->GetDetails(modify_index);
   if (store_mode == FORCE_FIELD && details.type() != FIELD) {
     FieldDescriptor d(descriptors->GetKey(modify_index),
                       new_map->NumberOfFields(),
+                      HeapType::Any(),
                       attributes,
                       Representation::Tagged());
     d.SetSortedKeyIndex(details.pointer());
     descriptors->Set(modify_index, &d);
     int unused_property_fields = new_map->unused_property_fields() - 1;
     if (unused_property_fields < 0) {
       unused_property_fields += JSObject::kFieldsAdded;
     }
     new_map->set_unused_property_fields(unused_property_fields);
   }
@@ skipping 110 matching lines @@
   for (int i = verbatim; i < length; i++) {
     if (!current->HasTransitionArray()) break;
     Name* name = descriptors->GetKey(i);
     TransitionArray* transitions = current->transitions();
     int transition = transitions->Search(name);
     if (transition == TransitionArray::kNotFound) break;
 
     Map* next = transitions->GetTarget(transition);
     DescriptorArray* next_descriptors = next->instance_descriptors();
 
-    if (next_descriptors->GetValue(i) != descriptors->GetValue(i)) break;
-
     PropertyDetails details = descriptors->GetDetails(i);
     PropertyDetails next_details = next_descriptors->GetDetails(i);
     if (details.type() != next_details.type()) break;
     if (details.attributes() != next_details.attributes()) break;
     if (!details.representation().Equals(next_details.representation())) break;
 
+    // TODO(bmeurer): Check descriptors is subtype of next_descriptors.
+    if (next_details.type() != FIELD &&
+        next_descriptors->GetValue(i) != descriptors->GetValue(i)) break;
+
     current = next;
   }
   return current;
 }
 
 
+Map* Map::FindFieldOwner(int descriptor) {
+  ASSERT(instance_descriptors()->GetDetails(descriptor).type() == FIELD);
+  Map* result = this;
+  while (true) {
+    Object* back = result->GetBackPointer();
+    if (back->IsUndefined()) break;
+    Map* parent = Map::cast(back);
+    if (parent->NumberOfOwnDescriptors() <= descriptor) break;
+    result = parent;
+  }
+  return result;
+}
+
+
+void Map::UpdateDescriptor(int descriptor_number, Descriptor* desc) {
+  if (HasTransitionArray()) {
+    TransitionArray* transitions = this->transitions();
+    for (int i = 0; i < transitions->number_of_transitions(); ++i) {
+      transitions->GetTarget(i)->UpdateDescriptor(descriptor_number, desc);
+    }
+  }
+  DescriptorArray* descriptors = instance_descriptors();
+  desc->SetSortedKeyIndex(descriptors->GetDetails(descriptor_number).pointer());
+  descriptors->Set(descriptor_number, desc);
+}
+
+
+void Map::UpdateFieldType(int descriptor, HeapType* field_type) {
+  ASSERT(this == FindFieldOwner(descriptor));
+  DescriptorArray* descriptors = instance_descriptors();
+  PropertyDetails details = descriptors->GetDetails(descriptor);
+  FieldDescriptor d(descriptors->GetKey(descriptor),
+                    descriptors->GetFieldIndex(descriptor),
+                    field_type,
+                    details.attributes(),
+                    details.representation());
+  UpdateDescriptor(descriptor, &d);
+  dependent_code()->DeoptimizeDependentCodeGroup(
+      GetIsolate(), DependentCode::kFieldTypeGroup);
+}
+
+
 // Generalize the representation of the descriptor at |modify_index|.
 // This method rewrites the transition tree to reflect the new change. To avoid
 // high degrees over polymorphism, and to stabilize quickly, on every rewrite
 // the new type is deduced by merging the current type with any potential new
 // (partial) version of the type in the transition tree.
 // To do this, on each rewrite:
 // - Search the root of the transition tree using FindRootMap.
 // - Find |updated|, the newest matching version of this map using
 //   FindUpdatedMap. This uses the keys in the own map's descriptor array to
 //   walk the transition tree.
 // - Merge/generalize the descriptor array of the current map and |updated|.
 // - Generalize the |modify_index| descriptor using |new_representation|.
 // - Walk the tree again starting from the root towards |updated|. Stop at
 //   |split_map|, the first map who's descriptor array does not match the merged
 //   descriptor array.
 // - If |updated| == |split_map|, |updated| is in the expected state. Return it.
 // - Otherwise, invalidate the outdated transition target from |updated|, and
 //   replace its transition tree with a new branch for the updated descriptors.
 Handle<Map> Map::GeneralizeRepresentation(Handle<Map> old_map,
                                           int modify_index,
                                           Representation new_representation,
+                                          Handle<HeapType> new_field_type,
                                           StoreMode store_mode) {
   Handle<DescriptorArray> old_descriptors(old_map->instance_descriptors());
   PropertyDetails old_details = old_descriptors->GetDetails(modify_index);
   Representation old_representation = old_details.representation();
 
   // It's fine to transition from None to anything but double without any
   // modification to the object, because the default uninitialized value for
   // representation None can be overwritten by both smi and tagged values.
   // Doubles, however, would require a box allocation.
   if (old_representation.IsNone() &&
       !new_representation.IsNone() &&
       !new_representation.IsDouble()) {
     old_descriptors->SetRepresentation(modify_index, new_representation);
+    if (old_details.type() == FIELD) {

[Toon Verwaest, 2014/03/21 14:33:37]

Only if new_representation is heap_object right?

+      old_descriptors->SetValue(modify_index, *new_field_type);
+    }
     return old_map;
   }
 
   int descriptors = old_map->NumberOfOwnDescriptors();
   Handle<Map> root_map(old_map->FindRootMap());
 
   // Check the state of the root map.
   if (!old_map->EquivalentToForTransition(*root_map)) {
     return CopyGeneralizeAllRepresentations(old_map, modify_index, store_mode,
         old_details.attributes(), "not equivalent");
@@ skipping 35 matching lines @@
   ASSERT(store_mode == ALLOW_AS_CONSTANT ||
          new_descriptors->GetDetails(modify_index).type() == FIELD);
 
   old_representation =
       new_descriptors->GetDetails(modify_index).representation();
   Representation updated_representation =
       new_representation.generalize(old_representation);
   if (!updated_representation.Equals(old_representation)) {
     new_descriptors->SetRepresentation(modify_index, updated_representation);
   }
+  if (new_descriptors->GetDetails(modify_index).type() == FIELD) {
+    Handle<HeapType> field_type(new_descriptors->GetFieldType(modify_index),
+                                new_descriptors->GetIsolate());
+    if (!new_field_type->IsCurrently(field_type)) {
+      if (!field_type->IsCurrently(new_field_type)) {
+        new_field_type = HeapType::Any(updated->GetIsolate());
+      }
+      new_descriptors->SetValue(modify_index, *new_field_type);

[Toon Verwaest, 2014/03/21 14:33:37]

Only if new_representation.IsHeapObject()

[Benedikt Meurer, 2014/04/11 11:12:00]

No, we track types independent of the representation.

+    }
+  }
 
   Handle<Map> split_map(root_map->FindLastMatchMap(
       verbatim, descriptors, *new_descriptors));
 
   int split_descriptors = split_map->NumberOfOwnDescriptors();
   // This is shadowed by |updated_descriptors| being more general than
   // |old_descriptors|.
   ASSERT(descriptors != split_descriptors);
 
   int descriptor = split_descriptors;
@@ skipping 14 matching lines @@
     new_map = Map::CopyInstallDescriptors(new_map, descriptor, new_descriptors);
   }
 
   new_map->set_owns_descriptors(true);
   return new_map;
 }
 
 
 // Generalize the representation of all FIELD descriptors.
 Handle<Map> Map::GeneralizeAllFieldRepresentations(
-    Handle<Map> map,
-    Representation new_representation) {
+    Handle<Map> map) {
   Handle<DescriptorArray> descriptors(map->instance_descriptors());
-  for (int i = 0; i < map->NumberOfOwnDescriptors(); i++) {
-    PropertyDetails details = descriptors->GetDetails(i);
-    if (details.type() == FIELD) {
-      map = GeneralizeRepresentation(map, i, new_representation, FORCE_FIELD);
+  for (int i = 0; i < map->NumberOfOwnDescriptors(); ++i) {
+    if (descriptors->GetDetails(i).type() == FIELD) {
+      map = GeneralizeRepresentation(map, i, Representation::Tagged(),
+                                     HeapType::Any(map->GetIsolate()),
+                                     FORCE_FIELD);
     }
   }
   return map;
 }
 
 
 Handle<Map> Map::CurrentMapForDeprecated(Handle<Map> map) {
   Handle<Map> proto_map(map);
   while (proto_map->prototype()->IsJSObject()) {
     Handle<JSObject> holder(JSObject::cast(proto_map->prototype()));
@@ skipping 1058 matching lines @@
   JSObject::MigrateToMap(object, map);
 }
 
 
 void JSObject::MigrateInstance(Handle<JSObject> object) {
   // Converting any field to the most specific type will cause the
   // GeneralizeFieldRepresentation algorithm to create the most general existing
   // transition that matches the object. This achieves what is needed.
   Handle<Map> original_map(object->map());
   GeneralizeFieldRepresentation(
-      object, 0, Representation::None(), ALLOW_AS_CONSTANT);
+      object, 0, Representation::None(),
+      HeapType::None(object->GetIsolate()),
+      ALLOW_AS_CONSTANT);
   object->map()->set_migration_target(true);
   if (FLAG_trace_migration) {
     object->PrintInstanceMigration(stdout, *original_map, object->map());
   }
 }
 
 
 Handle<Object> JSObject::TryMigrateInstance(Handle<JSObject> object) {
   Handle<Map> original_map(object->map());
   Handle<Map> new_map = Map::CurrentMapForDeprecatedInternal(original_map);
@@ skipping 25 matching lines @@
     return JSObject::AddProperty(
         object, name, value, attributes, SLOPPY,
         JSReceiver::CERTAINLY_NOT_STORE_FROM_KEYED,
         JSReceiver::OMIT_EXTENSIBILITY_CHECK,
         JSObject::FORCE_TAGGED, FORCE_FIELD, OMIT_TRANSITION);
   }
 
   // Keep the target CONSTANT if the same value is stored.
   // TODO(verwaest): Also support keeping the placeholder
   // (value->IsUninitialized) as constant.
+  Handle<HeapType> value_type = FLAG_track_field_types
+      ? HeapType::OfCurrently(value, lookup->isolate())
+      : HeapType::Any(lookup->isolate());
   if (!value->FitsRepresentation(details.representation()) ||
       (details.type() == CONSTANT &&
        descriptors->GetValue(descriptor) != *value)) {
-    transition_map = Map::GeneralizeRepresentation(transition_map,
-        descriptor, value->OptimalRepresentation(), FORCE_FIELD);
+    transition_map = Map::GeneralizeRepresentation(
+        transition_map, descriptor,
+        value->OptimalRepresentation(),
+        value_type, FORCE_FIELD);
+  } else if (details.type() == FIELD &&
+             details.representation().IsHeapObject()) {
+    Handle<HeapType> field_type(descriptors->GetFieldType(descriptor),
+                                lookup->isolate());
+    if (!value_type->IsCurrently(field_type)) {
+      if (!field_type->IsCurrently(value_type)) {
+        value_type = HeapType::Any(lookup->isolate());
+      }
+      if (FLAG_trace_track_field_types) {
+#ifdef OBJECT_PRINT
+        PrintF("[Updating type of field ");
+        name->Print();
+        PrintF(" in transition map ");
+        transition_map->ShortPrint();
+        PrintF(": ");
+        field_type->TypePrint(stdout);
+        PrintF(" -> ");
+        value_type->TypePrint(stdout);
+        PrintF("]\n");
+#endif
+      }
+      transition_map->UpdateFieldType(descriptor, *value_type);
+    }
   }
 
   JSObject::MigrateToMap(object, transition_map);
 
   // Reload.
   descriptors = transition_map->instance_descriptors();
   details = descriptors->GetDetails(descriptor);
 
   if (details.type() != FIELD) return value;
 
   int field_index = descriptors->GetFieldIndex(descriptor);
   if (details.representation().IsDouble()) {
     // Nothing more to be done.
     if (value->IsUninitialized()) return value;
     HeapNumber* box = HeapNumber::cast(object->RawFastPropertyAt(field_index));
     box->set_value(value->Number());
   } else {
     object->FastPropertyAtPut(field_index, *value);
   }
 
   return value;
 }
 
 
 static void SetPropertyToField(LookupResult* lookup,
                                Handle<Name> name,
                                Handle<Object> value) {
   Representation representation = lookup->representation();
+  Handle<HeapType> value_type = FLAG_track_field_types
+      ? HeapType::OfCurrently(value, lookup->isolate())
+      : HeapType::Any(lookup->isolate());
   if (!value->FitsRepresentation(representation) ||
       lookup->type() == CONSTANT) {
     JSObject::GeneralizeFieldRepresentation(handle(lookup->holder()),
                                             lookup->GetDescriptorIndex(),
                                             value->OptimalRepresentation(),
-                                            FORCE_FIELD);
+                                            value_type, FORCE_FIELD);
     DescriptorArray* desc = lookup->holder()->map()->instance_descriptors();
     int descriptor = lookup->GetDescriptorIndex();
     representation = desc->GetDetails(descriptor).representation();
+  } else if (representation.IsHeapObject()) {
+    Handle<HeapType> field_type(lookup->GetFieldType(), lookup->isolate());
+    if (!value_type->IsCurrently(field_type)) {
+      if (!field_type->IsCurrently(value_type)) {
+        value_type = HeapType::Any(lookup->isolate());
+      }
+      if (FLAG_trace_track_field_types) {
+#ifdef OBJECT_PRINT
+        PrintF("[Updating type of field ");
+        name->Print();
+        PrintF(" in map ");
+        lookup->GetFieldOwner()->ShortPrint();
+        PrintF(": ");
+        field_type->TypePrint(stdout);
+        PrintF(" -> ");
+        value_type->TypePrint(stdout);
+        PrintF("]\n");
+#endif
+      }
+      lookup->GetFieldOwner()->UpdateFieldType(
+          lookup->GetDescriptorIndex(), *value_type);
+    }
   }
 
   if (representation.IsDouble()) {
     HeapNumber* storage = HeapNumber::cast(lookup->holder()->RawFastPropertyAt(
         lookup->GetFieldIndex().field_index()));
     storage->set_value(value->Number());
     return;
   }
 
   lookup->holder()->FastPropertyAtPut(
@@ skipping 11 matching lines @@
   }
 
   if (!object->HasFastProperties()) {
     ReplaceSlowProperty(object, name, value, attributes);
     return;
   }
 
   int descriptor_index = lookup->GetDescriptorIndex();
   if (lookup->GetAttributes() == attributes) {
     JSObject::GeneralizeFieldRepresentation(
-        object, descriptor_index, Representation::Tagged(), FORCE_FIELD);
+        object, descriptor_index, Representation::Tagged(),
+        HeapType::Any(lookup->isolate()), FORCE_FIELD);
   } else {
     Handle<Map> old_map(object->map());
     Handle<Map> new_map = Map::CopyGeneralizeAllRepresentations(old_map,
         descriptor_index, FORCE_FIELD, attributes, "attributes mismatch");
     JSObject::MigrateToMap(object, new_map);
   }
 
   DescriptorArray* descriptors = object->map()->instance_descriptors();
   int index = descriptors->GetDetails(descriptor_index).field_index();
   object->FastPropertyAtPut(index, *value);
@@ skipping 975 matching lines @@
     // If the object has fast properties, check whether the first slot
     // in the descriptor array matches the hidden string. Since the
     // hidden strings hash code is zero (and no other name has hash
     // code zero) it will always occupy the first entry if present.
     DescriptorArray* descriptors = this->map()->instance_descriptors();
     if (descriptors->number_of_descriptors() > 0) {
       int sorted_index = descriptors->GetSortedKeyIndex(0);
       if (descriptors->GetKey(sorted_index) == GetHeap()->hidden_string() &&
           sorted_index < map()->NumberOfOwnDescriptors()) {
         ASSERT(descriptors->GetType(sorted_index) == FIELD);
-        ASSERT(descriptors->GetDetails(sorted_index).representation().
-               IsCompatibleForLoad(Representation::Tagged()));
         return this->RawFastPropertyAt(
             descriptors->GetFieldIndex(sorted_index));
       } else {
         return GetHeap()->undefined_value();
       }
     } else {
       return GetHeap()->undefined_value();
     }
   } else {
     PropertyAttributes attributes;
@@ skipping 1884 matching lines @@
 
   result->InitializeDescriptors(descriptors);
 
   if (flag == INSERT_TRANSITION && CanHaveMoreTransitions()) {
     TransitionArray* transitions;
     MaybeObject* maybe_transitions = AddTransition(name, result, simple_flag);
     if (!maybe_transitions->To(&transitions)) return maybe_transitions;
     set_transitions(transitions);
     result->SetBackPointer(this);
   } else {
-    descriptors->InitializeRepresentations(Representation::Tagged());
+    int length = descriptors->number_of_descriptors();
+    for (int i = 0; i < length; i++) {
+      descriptors->SetRepresentation(i, Representation::Tagged());
+      if (descriptors->GetDetails(i).type() == FIELD) {
+        descriptors->SetValue(i, HeapType::Any());
+      }
+    }
   }
 
   return result;
 }
 
 
 // Since this method is used to rewrite an existing transition tree, it can
 // always insert transitions without checking.
 Handle<Map> Map::CopyInstallDescriptors(Handle<Map> map,
                                         int new_descriptor,
@@ skipping 1099 matching lines @@
   ASSERT(!IsEmpty());
   ASSERT(!HasEnumCache() || new_cache->length() > GetEnumCache()->length());
   FixedArray::cast(bridge_storage)->
     set(kEnumCacheBridgeCacheIndex, new_cache);
   FixedArray::cast(bridge_storage)->
     set(kEnumCacheBridgeIndicesCacheIndex, new_index_cache);
   set(kEnumCacheIndex, bridge_storage);
 }
 
 
+HeapType* DescriptorArray::GetFieldType(int descriptor_number) {
+  ASSERT(GetDetails(descriptor_number).type() == FIELD);
+  return HeapType::cast(GetValue(descriptor_number));
+}
+
+
 void DescriptorArray::CopyFrom(int dst_index,
                                DescriptorArray* src,
                                int src_index,
                                const WhitenessWitness& witness) {
   Object* value = src->GetValue(src_index);
   PropertyDetails details = src->GetDetails(src_index);
   Descriptor desc(src->GetKey(src_index), value, details);
   Set(dst_index, &desc, witness);
 }
 
@@ skipping 59 matching lines @@
     PropertyDetails details = GetDetails(descriptor);
     PropertyDetails other_details = other->GetDetails(descriptor);
 
     if (details.type() == FIELD || other_details.type() == FIELD ||
         (store_mode == FORCE_FIELD && descriptor == modify_index) ||
         (details.type() == CONSTANT &&
          other_details.type() == CONSTANT &&
          GetValue(descriptor) != other->GetValue(descriptor))) {
       Representation representation =
           details.representation().generalize(other_details.representation());
+      // TODO(bmeurer): Cleanup this crap!
+      HeapType* field_type = HeapType::Any();
+      if (representation.IsHeapObject()) {
+        Object* val = GetValue(descriptor);
+        Object* other_val = other->GetValue(descriptor);
+        if (details.type() == FIELD && other_details.type() == FIELD) {
+          HeapType* type = HeapType::cast(val);
+          HeapType* other_type = HeapType::cast(other_val);
+          if (type->Is(other_type)) {
+            field_type = other_type;
+          } else if (other_type->Is(type)) {
+            field_type = type;
+          }
+        }
+      }
       FieldDescriptor d(key,
                         current_offset++,
+                        field_type,
                         other_details.attributes(),
                         representation);
       result->Set(descriptor, &d, witness);
     } else {
       result->CopyFrom(descriptor, other, descriptor, witness);
     }
   }
 
   // |valid| -> |new_size|
   for (; descriptor < new_size; descriptor++) {
     PropertyDetails details = other->GetDetails(descriptor);
     if (details.type() == FIELD ||
         (store_mode == FORCE_FIELD && descriptor == modify_index)) {
       Name* key = other->GetKey(descriptor);
       FieldDescriptor d(key,
                         current_offset++,
+                        HeapType::cast(other->GetValue(descriptor)),
                         details.attributes(),
                         details.representation());
       result->Set(descriptor, &d, witness);
     } else {
       result->CopyFrom(descriptor, other, descriptor, witness);
     }
   }
 
   result->Sort();
   return result;
@@ skipping 7623 matching lines @@
         if (current_offset < inobject_props) {
           obj->InObjectPropertyAtPut(current_offset,
                                      value,
                                      UPDATE_WRITE_BARRIER);
         } else {
           int offset = current_offset - inobject_props;
           fields->set(offset, value);
         }
         FieldDescriptor d(key,
                           current_offset++,
+                          HeapType::Any(),
                           details.attributes(),
                           // TODO(verwaest): value->OptimalRepresentation();
                           Representation::Tagged());
         descriptors->Set(enumeration_index - 1, &d, witness);
       } else if (type == CALLBACKS) {
         CallbacksDescriptor d(key,
                               value,
                               details.attributes());
         descriptors->Set(enumeration_index - 1, &d, witness);
       } else {
@@ skipping 739 matching lines @@
 #define ERROR_MESSAGES_TEXTS(C, T) T,
   static const char* error_messages_[] = {
       ERROR_MESSAGES_LIST(ERROR_MESSAGES_TEXTS)
   };
 #undef ERROR_MESSAGES_TEXTS
   return error_messages_[reason];
 }
 
 
 } }  // namespace v8::internal