AllocationSites: when updating allocation site transition information,

src/objects.cc

Index: src/objects.cc
diff --git a/src/objects.cc b/src/objects.cc
index cc28814373fceb9d450bb06d03c736b4db89c5d1..b28078dea0ea6b8e146e48ddc656ee96639e0a59 100644
--- a/src/objects.cc
+++ b/src/objects.cc
@@ -12317,6 +12317,10 @@ MaybeObject* JSObject::UpdateAllocationSite(ElementsKind to_kind) {
   if (site->IsLiteralSite()) {
     JSArray* transition_info = JSArray::cast(site->transition_info());
     ElementsKind kind = transition_info->GetElementsKind();
+    // if kind is holey ensure that to_kind is as well.
+    if (IsHoleyElementsKind(kind) && IsFastPackedElementsKind(to_kind)) {

[Toon Verwaest, 2013/07/11 13:04:40]

You don't need to check whether the to_kind is packed. GetHoley on Holey will
return to_kind (I believe).

[mvstanton, 2013/07/11 13:08:26]

Done.

+      to_kind = GetHoleyElementsKind(to_kind);
+    }
     if (AllocationSite::GetMode(kind, to_kind) == TRACK_ALLOCATION_SITE) {
       // If the array is huge, it's not likely to be defined in a local
       // function, so we shouldn't make new instances of it very often.
@@ -12335,6 +12339,10 @@ MaybeObject* JSObject::UpdateAllocationSite(ElementsKind to_kind) {
     }
   } else {
     ElementsKind kind = site->GetElementsKind();
+    // if kind is holey ensure that to_kind is as well.
+    if (IsHoleyElementsKind(kind) && IsFastPackedElementsKind(to_kind)) {

[Toon Verwaest, 2013/07/11 13:04:40]

Same as above.

[mvstanton, 2013/07/11 13:08:26]

Done.

+      to_kind = GetHoleyElementsKind(to_kind);
+    }
     if (AllocationSite::GetMode(kind, to_kind) == TRACK_ALLOCATION_SITE) {
       if (FLAG_trace_track_allocation_sites) {
         PrintF("AllocationSite: JSArray %p site updated %s->%s\n",