Use HType::Tagged when allocating elements.

src/hydrogen.cc

 // Copyright 2013 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 2291 matching lines @@
   HValue* mul = AddUncasted<HMul>(capacity, elements_size_value);
   mul->ClearFlag(HValue::kCanOverflow);
 
   HConstant* header_size = Add<HConstant>(FixedArray::kHeaderSize);
   HValue* total_size = AddUncasted<HAdd>(mul, header_size);
   total_size->ClearFlag(HValue::kCanOverflow);
 
   PretenureFlag pretenure_flag = !FLAG_allocation_site_pretenuring ?
       isolate()->heap()->GetPretenureMode() : NOT_TENURED;
 
-  return Add<HAllocate>(total_size, HType::JSArray(), pretenure_flag,
+  return Add<HAllocate>(total_size, HType::Tagged(), pretenure_flag,
       instance_type);
 }
 
 
 void HGraphBuilder::BuildInitializeElementsHeader(HValue* elements,
                                                   ElementsKind kind,
                                                   HValue* capacity) {
   Factory* factory = isolate()->factory();
   Handle<Map> map = IsFastDoubleElementsKind(kind)
       ? factory->fixed_double_array_map()
@@ skipping 285 matching lines @@
   if (mode == TRACK_ALLOCATION_SITE) {
     BuildCreateAllocationMemento(
         object, Add<HConstant>(JSArray::kSize), allocation_site);
   }
 
   if (length > 0) {
     HValue* boilerplate_elements = AddLoadElements(boilerplate);
     HValue* object_elements;
     if (IsFastDoubleElementsKind(kind)) {
       HValue* elems_size = Add<HConstant>(FixedDoubleArray::SizeFor(length));
-      object_elements = Add<HAllocate>(elems_size, HType::JSArray(),
+      object_elements = Add<HAllocate>(elems_size, HType::Tagged(),
           NOT_TENURED, FIXED_DOUBLE_ARRAY_TYPE);
     } else {
       HValue* elems_size = Add<HConstant>(FixedArray::SizeFor(length));
-      object_elements = Add<HAllocate>(elems_size, HType::JSArray(),
+      object_elements = Add<HAllocate>(elems_size, HType::Tagged(),
           NOT_TENURED, FIXED_ARRAY_TYPE);
     }
     Add<HStoreNamedField>(object, HObjectAccess::ForElementsPointer(),
                           object_elements);
 
     // Copy the elements array header.
     for (int i = 0; i < FixedArrayBase::kHeaderSize; i += kPointerSize) {
       HObjectAccess access = HObjectAccess::ForFixedArrayHeader(i);
       Add<HStoreNamedField>(
           object_elements, access, Add<HLoadNamedField>(
@@ skipping 5893 matching lines @@
     Add<HStoreNamedField>(obj,
         HObjectAccess::ForJSTypedArrayLength(),
         length);
 
     Handle<Map> external_array_map(
         isolate()->heap()->MapForExternalArrayType(array_type));
 
     HValue* elements =
         Add<HAllocate>(
             Add<HConstant>(ExternalArray::kAlignedSize),
-            HType::JSArray(),
+            HType::Tagged(),
             NOT_TENURED,
             external_array_map->instance_type());
 
     AddStoreMapConstant(elements, external_array_map);
 
     HValue* backing_store = Add<HLoadNamedField>(
         buffer, static_cast<HValue*>(NULL),
         HObjectAccess::ForJSArrayBufferBackingStore());
 
     HValue* typed_array_start;
@@ skipping 1234 matching lines @@
     HValue* object_elements_size = Add<HConstant>(elements_size);
     if (boilerplate_object->HasFastDoubleElements()) {
       // Allocation folding will not be able to fold |object| and
       // |object_elements| together if they are pre-tenured.
       if (pretenure_flag == TENURED) {
         HConstant* empty_fixed_array = Add<HConstant>(
             isolate()->factory()->empty_fixed_array());
         Add<HStoreNamedField>(object, HObjectAccess::ForElementsPointer(),
                               empty_fixed_array);
       }
       object_elements = Add<HAllocate>(object_elements_size, HType::JSObject(),

[Michael Starzinger, 2014/03/24 14:08:54]

This seems to be off as well.

           pretenure_flag, FIXED_DOUBLE_ARRAY_TYPE, site_context->current());
     } else {
       object_elements = Add<HAllocate>(object_elements_size, HType::JSObject(),

[Michael Starzinger, 2014/03/24 14:08:54]

This seems to be off as well.

           pretenure_flag, FIXED_ARRAY_TYPE, site_context->current());
     }
   }
   BuildInitElementsInObjectHeader(boilerplate_object, object, object_elements);
 
   // Copy object elements if non-COW.
   if (object_elements != NULL) {
     BuildEmitElements(boilerplate_object, elements, object_elements,
                       site_context);
   }
@@ skipping 1499 matching lines @@
   if (ShouldProduceTraceOutput()) {
     isolate()->GetHTracer()->TraceHydrogen(name(), graph_);
   }
 
 #ifdef DEBUG
   graph_->Verify(false);  // No full verify.
 #endif
 }
 
 } }  // namespace v8::internal