Populate receiver types when there is no type feedback

src/hydrogen.cc

 // Copyright 2013 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 4978 matching lines @@
   Handle<JSFunction> closure = function_state()->compilation_info()->closure();
   Handle<FixedArray> literals(closure->literals());
   HRegExpLiteral* instr = New<HRegExpLiteral>(literals,
                                               expr->pattern(),
                                               expr->flags(),
                                               expr->literal_index());
   return ast_context()->ReturnInstruction(instr, expr->id());
 }
 
 
-static bool CanInlinePropertyAccess(Type* type) {
+static bool CanInlinePropertyAccess(Type* type, PropertyAccessType access) {
   if (type->Is(Type::NumberOrString())) return true;
   if (!type->IsClass()) return false;
   Handle<Map> map = type->AsClass();
   return map->IsJSObjectMap() &&
       !map->is_dictionary_map() &&
-      !map->has_named_interceptor();
+      !map->has_named_interceptor() &&
+      // Must be a LOAD or a non-observed STORE
+      (access == LOAD || !map->is_observed());
 }
 
 
 // Determines whether the given array or object literal boilerplate satisfies
 // all limits to be considered for fast deep-copying and computes the total
 // size of all objects that are part of the graph.
 static bool IsFastLiteral(Handle<JSObject> boilerplate,
                           int max_depth,
                           int* max_properties) {
   if (boilerplate->map()->is_deprecated()) {
@@ skipping 391 matching lines @@
     HConstant* transition_constant = Add<HConstant>(info->transition());
     instr->SetTransition(transition_constant, top_info());
     instr->SetChangesFlag(kMaps);
   }
   return instr;
 }
 
 
 bool HOptimizedGraphBuilder::PropertyAccessInfo::IsCompatible(
     PropertyAccessInfo* info) {
-  if (!CanInlinePropertyAccess(type_)) return false;
+  if (!CanInlinePropertyAccess(type_, access_type_)) return false;
 
   // Currently only handle Type::Number as a polymorphic case.
   // TODO(verwaest): Support monomorphic handling of numbers with a HCheckNumber
   // instruction.
   if (type_->Is(Type::Number())) return false;
 
   // Values are only compatible for monomorphic load if they all behave the same
   // regarding value wrappers.
   if (type_->Is(Type::NumberOrString())) {
     if (!info->type_->Is(Type::NumberOrString())) return false;
@@ skipping 80 matching lines @@
 
 bool HOptimizedGraphBuilder::PropertyAccessInfo::LookupInPrototypes() {
   Handle<Map> map = this->map();
 
   while (map->prototype()->IsJSObject()) {
     holder_ = handle(JSObject::cast(map->prototype()));
     if (holder_->map()->is_deprecated()) {
       JSObject::TryMigrateInstance(holder_);
     }
     map = Handle<Map>(holder_->map());
-    if (!CanInlinePropertyAccess(ToType(map))) {
+    if (!CanInlinePropertyAccess(ToType(map), access_type_)) {
       lookup_.NotFound();
       return false;
     }
     map->LookupDescriptor(*holder_, *name_, &lookup_);
     if (lookup_.IsFound()) return LoadResult(map);
   }
   lookup_.NotFound();
   return true;
 }
 
 
 bool HOptimizedGraphBuilder::PropertyAccessInfo::CanAccessMonomorphic() {
-  if (!CanInlinePropertyAccess(type_)) return false;
+  if (!CanInlinePropertyAccess(type_, access_type_)) return false;
   if (IsJSObjectFieldAccessor()) return IsLoad();
   if (!LookupDescriptor()) return false;
   if (lookup_.IsFound()) {
     if (IsLoad()) return true;
     return !lookup_.IsReadOnly() && lookup_.IsCacheable();
   }
   if (!LookupInPrototypes()) return false;
   if (IsLoad()) return true;
 
   if (lookup_.IsPropertyCallbacks()) return true;
@@ skipping 258 matching lines @@
     if (!ast_context()->IsEffect()) ast_context()->ReturnValue(Pop());
   } else {
     set_current_block(NULL);
   }
 }
 
 
 static bool ComputeReceiverTypes(Expression* expr,
                                  HValue* receiver,
                                  SmallMapList** t,
+                                 PropertyAccessType access_type,
                                  Zone* zone) {
   SmallMapList* types = expr->GetReceiverTypes();
   *t = types;
   bool monomorphic = expr->IsMonomorphic();
-  if (types != NULL && receiver->HasMonomorphicJSObjectType()) {
-    Map* root_map = receiver->GetMonomorphicJSObjectMap()->FindRootMap();
-    types->FilterForPossibleTransitions(root_map);
+  Isolate* isolate = zone->isolate();
+  if (types != NULL) {
+    if (receiver->HasMonomorphicJSObjectType()) {
+      Map* root_map = receiver->GetMonomorphicJSObjectMap()->FindRootMap();
+      types->FilterForPossibleTransitions(root_map);
+    } else if (types->is_empty() &&
+               receiver->IsConstant() &&
+               HConstant::cast(receiver)->handle(isolate)->IsJSObject()) {
+      Handle<Map> map(Handle<JSObject>::cast(
+          HConstant::cast(receiver)->handle(isolate))->map());
+      types->Add(map, zone);
+    }
     monomorphic = types->length() == 1;
   }
   return monomorphic && CanInlinePropertyAccess(
-      IC::MapToType<Type>(types->first(), zone));
+      IC::MapToType<Type>(types->first(), zone), access_type);
 }
 
 
 static bool AreStringTypes(SmallMapList* types) {
   for (int i = 0; i < types->length(); i++) {
     if (types->at(i)->instance_type() >= FIRST_NONSTRING_TYPE) return false;
   }
   return true;
 }
 
@@ skipping 682 matching lines @@
     HValue* obj,
     HValue* key,
     HValue* val,
     Expression* expr,
     PropertyAccessType access_type,
     bool* has_side_effects) {
   ASSERT(!expr->IsPropertyName());
   HInstruction* instr = NULL;
 
   SmallMapList* types;
-  bool monomorphic = ComputeReceiverTypes(expr, obj, &types, zone());
+  bool monomorphic = ComputeReceiverTypes(expr,
+                                          obj,
+                                          &types,
+                                          access_type,
+                                          zone());
 
   bool force_generic = false;
   if (access_type == STORE &&
       (monomorphic || (types != NULL && !types->is_empty()))) {
     // Stores can't be mono/polymorphic if their prototype chain has dictionary
     // elements. However a receiver map that has dictionary elements itself
     // should be left to normal mono/poly behavior (the other maps may benefit
     // from highly optimized stores).
     for (int i = 0; i < types->length(); i++) {
       Handle<Map> current_map = types->at(i);
@@ skipping 118 matching lines @@
 HInstruction* HOptimizedGraphBuilder::BuildNamedAccess(
     PropertyAccessType access,
     BailoutId ast_id,
     BailoutId return_id,
     Expression* expr,
     HValue* object,
     Handle<String> name,
     HValue* value,
     bool is_uninitialized) {
   SmallMapList* types;
-  ComputeReceiverTypes(expr, object, &types, zone());
+  ComputeReceiverTypes(expr, object, &types, access, zone());
   ASSERT(types != NULL);
 
   if (types->length() > 0) {
     PropertyAccessInfo info(this, access, ToType(types->first()), name);
     if (!info.CanAccessAsMonomorphic(types)) {
       HandlePolymorphicNamedFieldAccess(
           access, ast_id, return_id, object, value, types, name);
       return NULL;
     }
 
@@ skipping 1295 matching lines @@
   Expression* callee = expr->expression();
   int argument_count = expr->arguments()->length() + 1;  // Plus receiver.
   HInstruction* call = NULL;
 
   Property* prop = callee->AsProperty();
   if (prop != NULL) {
     CHECK_ALIVE(VisitForValue(prop->obj()));
     HValue* receiver = Top();
 
     SmallMapList* types;
-    ComputeReceiverTypes(expr, receiver, &types, zone());
+    ComputeReceiverTypes(expr, receiver, &types, LOAD, zone());
 
     if (prop->key()->IsPropertyName() && types->length() > 0) {
       Handle<String> name = prop->key()->AsLiteral()->AsPropertyName();
       PropertyAccessInfo info(this, LOAD, ToType(types->first()), name);
       if (!info.CanAccessAsMonomorphic(types)) {
         HandlePolymorphicCallNamed(expr, receiver, types, name);
         return;
       }
     }
 
@@ skipping 3513 matching lines @@
   if (ShouldProduceTraceOutput()) {
     isolate()->GetHTracer()->TraceHydrogen(name(), graph_);
   }
 
 #ifdef DEBUG
   graph_->Verify(false);  // No full verify.
 #endif
 }
 
 } }  // namespace v8::internal