Clear next map word when folding allocations into js arrays.

src/hydrogen-instructions.cc

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 3191 matching lines @@
     if (FLAG_trace_allocation_folding) {
       PrintF("#%d (%s) cannot fold into #%d (%s)\n",
           id(), Mnemonic(), dominator->id(), dominator->Mnemonic());
     }
     return;
   }
 
   // First update the size of the dominator allocate instruction.
   int32_t dominator_size_constant =
       HConstant::cast(dominator_size)->GetInteger32Constant();
+  int32_t object_offset = dominator_size_constant;
   int32_t current_size_constant =
       HConstant::cast(current_size)->GetInteger32Constant();
   int32_t new_dominator_size = dominator_size_constant + current_size_constant;
 
   if (MustAllocateDoubleAligned()) {
     if (!dominator_allocate_instr->MustAllocateDoubleAligned()) {
       dominator_allocate_instr->MakeDoubleAligned();
     }
     if ((dominator_size_constant & kDoubleAlignmentMask) != 0) {
       dominator_size_constant += kDoubleSize / 2;
       new_dominator_size += kDoubleSize / 2;
     }
   }
 
   if (new_dominator_size > Page::kMaxNonCodeHeapObjectSize) {
     if (FLAG_trace_allocation_folding) {
       PrintF("#%d (%s) cannot fold into #%d (%s) due to size: %d\n",
           id(), Mnemonic(), dominator->id(), dominator->Mnemonic(),
           new_dominator_size);
     }
     return;
   }
   HBasicBlock* block = dominator->block();
   Zone* zone = block->zone();
   HInstruction* new_dominator_size_constant =
       HConstant::New(zone, context(), new_dominator_size);
   new_dominator_size_constant->InsertBefore(dominator_allocate_instr);
   dominator_allocate_instr->UpdateSize(new_dominator_size_constant);
 
+  // TODO(hpayer): This is a short-term hack to make allocation mementos
+  // work again in new space.
+  if (dominator_allocate_instr->type().Equals(HType::JSArray()) &&

[mvstanton, 2013/08/26 10:01:27]

Actually here could you make use of Map::CanTrackAllocationSite(), or at least
extend/generalize that function to also work with an HType? That is a
centralized place for deciding which types have "the right" to use allocation
mementos.

[Hannes Payer (out of office), 2013/08/26 11:51:07]

Thanks for the comment, makes sense. I made a static check method in the
AlloationSite class.

+      !dominator_allocate_instr->clear_next_map_word_) {
+    HObjectAccess access =
+        HObjectAccess::ForJSObjectOffset(object_offset);
+    HStoreNamedField* clear_next_map =
+        HStoreNamedField::New(zone, context(), dominator_allocate_instr, access,
+            block->graph()->GetConstantNull());
+    clear_next_map->ClearAllSideEffects();
+    clear_next_map->InsertAfter(dominator_allocate_instr);
+    dominator_allocate_instr->clear_next_map_word_ = true;
+  }
+
 #ifdef VERIFY_HEAP
   if (FLAG_verify_heap) {
     dominator_allocate_instr->MakePrefillWithFiller();
   }
 #endif
 
   // After that replace the dominated allocate instruction.
   HInstruction* dominated_allocate_instr =
       HInnerAllocatedObject::New(zone,
                                  context(),
@@ skipping 743 matching lines @@
       break;
     case kExternalMemory:
       stream->Add("[external-memory]");
       break;
   }
 
   stream->Add("@%d", offset());
 }
 
 } }  // namespace v8::internal