Populate receiver types when there is no type feedback

src/hydrogen.cc

 // Copyright 2013 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 5789 matching lines @@
     if (!ast_context()->IsEffect()) ast_context()->ReturnValue(Pop());
   } else {
     set_current_block(NULL);
   }
 }
 
 
 static bool ComputeReceiverTypes(Expression* expr,
                                  HValue* receiver,
                                  SmallMapList** t,
+                                 PropertyAccessType access_type,
                                  Zone* zone) {
   SmallMapList* types = expr->GetReceiverTypes();
   *t = types;
   bool monomorphic = expr->IsMonomorphic();
-  if (types != NULL && receiver->HasMonomorphicJSObjectType()) {
-    Map* root_map = receiver->GetMonomorphicJSObjectMap()->FindRootMap();
-    types->FilterForPossibleTransitions(root_map);
+  Isolate* isolate = zone->isolate();
+  if (types != NULL) {
+    if (receiver->HasMonomorphicJSObjectType()) {
+      Map* root_map = receiver->GetMonomorphicJSObjectMap()->FindRootMap();
+      types->FilterForPossibleTransitions(root_map);
+    } else if (types->is_empty() &&
+               receiver->IsConstant() &&
+               HConstant::cast(receiver)->handle(isolate)->IsJSObject()) {
+      Handle<Map> map(Handle<JSObject>::cast(
+          HConstant::cast(receiver)->handle(isolate))->map());
+
+      if (access_type != STORE || !map->is_observed()) {

[Toon Verwaest, 2014/04/09 14:08:16]

So this case will still trigger for observed maps, right?

Can we replace !map->is_observed with CanInlinePropertyAccess(MapToType(map))
and add is_observed to the list of criteria there? That way the semantics for
PushLoad will be in sync with what we are checking for here, and we'll be
guaranteed that if PushLoad actually can inline a load (eg an HConstant), it'll
also be added by this code to the types-list for VisitCall.

[p.antonov, 2014/04/09 14:16:19]

When it is a load - yes (since loads should not be affected by 
observation). When it's a store and the map is observed,
adding the map to the typelist would cause some Object.observe
tests to fail.

+        types->Add(map, zone);
+      }
+    }
     monomorphic = types->length() == 1;
   }
   return monomorphic && CanInlinePropertyAccess(
       IC::MapToType<Type>(types->first(), zone));
 }
 
 
 static bool AreStringTypes(SmallMapList* types) {
   for (int i = 0; i < types->length(); i++) {
     if (types->at(i)->instance_type() >= FIRST_NONSTRING_TYPE) return false;
@@ skipping 686 matching lines @@
     HValue* obj,
     HValue* key,
     HValue* val,
     Expression* expr,
     PropertyAccessType access_type,
     bool* has_side_effects) {
   ASSERT(!expr->IsPropertyName());
   HInstruction* instr = NULL;
 
   SmallMapList* types;
-  bool monomorphic = ComputeReceiverTypes(expr, obj, &types, zone());
+  bool monomorphic = ComputeReceiverTypes(expr,
+                                          obj,
+                                          &types,
+                                          access_type,
+                                          zone());
 
   bool force_generic = false;
   if (access_type == STORE &&
       (monomorphic || (types != NULL && !types->is_empty()))) {
     // Stores can't be mono/polymorphic if their prototype chain has dictionary
     // elements. However a receiver map that has dictionary elements itself
     // should be left to normal mono/poly behavior (the other maps may benefit
     // from highly optimized stores).
     for (int i = 0; i < types->length(); i++) {
       Handle<Map> current_map = types->at(i);
@@ skipping 118 matching lines @@
 HInstruction* HOptimizedGraphBuilder::BuildNamedAccess(
     PropertyAccessType access,
     BailoutId ast_id,
     BailoutId return_id,
     Expression* expr,
     HValue* object,
     Handle<String> name,
     HValue* value,
     bool is_uninitialized) {
   SmallMapList* types;
-  ComputeReceiverTypes(expr, object, &types, zone());
+  ComputeReceiverTypes(expr, object, &types, access, zone());
   ASSERT(types != NULL);
 
   if (types->length() > 0) {
     PropertyAccessInfo info(this, access, ToType(types->first()), name);
     if (!info.CanAccessAsMonomorphic(types)) {
       HandlePolymorphicNamedFieldAccess(
           access, ast_id, return_id, object, value, types, name);
       return NULL;
     }
 
@@ skipping 1295 matching lines @@
   Expression* callee = expr->expression();
   int argument_count = expr->arguments()->length() + 1;  // Plus receiver.
   HInstruction* call = NULL;
 
   Property* prop = callee->AsProperty();
   if (prop != NULL) {
     CHECK_ALIVE(VisitForValue(prop->obj()));
     HValue* receiver = Top();
 
     SmallMapList* types;
-    ComputeReceiverTypes(expr, receiver, &types, zone());
+    ComputeReceiverTypes(expr, receiver, &types, LOAD, zone());
 
     if (prop->key()->IsPropertyName() && types->length() > 0) {
       Handle<String> name = prop->key()->AsLiteral()->AsPropertyName();
       PropertyAccessInfo info(this, LOAD, ToType(types->first()), name);
       if (!info.CanAccessAsMonomorphic(types)) {
         HandlePolymorphicCallNamed(expr, receiver, types, name);
         return;
       }
     }
 
@@ skipping 3513 matching lines @@
   if (ShouldProduceTraceOutput()) {
     isolate()->GetHTracer()->TraceHydrogen(name(), graph_);
   }
 
 #ifdef DEBUG
   graph_->Verify(false);  // No full verify.
 #endif
 }
 
 } }  // namespace v8::internal