Populate receiver types when there is no type feedback

src/hydrogen.cc

Index: src/hydrogen.cc
diff --git a/src/hydrogen.cc b/src/hydrogen.cc
index 8ce614fd660484efbc59f05e954b078d30acd6a9..2c32d7970e19fd1e0089650b25512e9cabc6fff1 100644
--- a/src/hydrogen.cc
+++ b/src/hydrogen.cc
@@ -5807,13 +5807,26 @@ void HOptimizedGraphBuilder::HandlePolymorphicNamedFieldAccess(
 static bool ComputeReceiverTypes(Expression* expr,
                                  HValue* receiver,
                                  SmallMapList** t,
+                                 PropertyAccessType access_type,
                                  Zone* zone) {
   SmallMapList* types = expr->GetReceiverTypes();
   *t = types;
   bool monomorphic = expr->IsMonomorphic();
-  if (types != NULL && receiver->HasMonomorphicJSObjectType()) {
-    Map* root_map = receiver->GetMonomorphicJSObjectMap()->FindRootMap();
-    types->FilterForPossibleTransitions(root_map);
+  Isolate* isolate = zone->isolate();
+  if (types != NULL) {
+    if (receiver->HasMonomorphicJSObjectType()) {
+      Map* root_map = receiver->GetMonomorphicJSObjectMap()->FindRootMap();
+      types->FilterForPossibleTransitions(root_map);
+    } else if (types->is_empty() &&
+               receiver->IsConstant() &&
+               HConstant::cast(receiver)->handle(isolate)->IsJSObject()) {
+      Handle<Map> map(Handle<JSObject>::cast(
+          HConstant::cast(receiver)->handle(isolate))->map());
+
+      if (access_type != STORE || !map->is_observed()) {

[Toon Verwaest, 2014/04/09 14:08:16]

So this case will still trigger for observed maps, right?

Can we replace !map->is_observed with CanInlinePropertyAccess(MapToType(map))
and add is_observed to the list of criteria there? That way the semantics for
PushLoad will be in sync with what we are checking for here, and we'll be
guaranteed that if PushLoad actually can inline a load (eg an HConstant), it'll
also be added by this code to the types-list for VisitCall.

[p.antonov, 2014/04/09 14:16:19]

When it is a load - yes (since loads should not be affected by 
observation). When it's a store and the map is observed,
adding the map to the typelist would cause some Object.observe
tests to fail.

+        types->Add(map, zone);
+      }
+    }
     monomorphic = types->length() == 1;
   }
   return monomorphic && CanInlinePropertyAccess(
@@ -6520,7 +6533,11 @@ HValue* HOptimizedGraphBuilder::HandleKeyedElementAccess(
   HInstruction* instr = NULL;
 
   SmallMapList* types;
-  bool monomorphic = ComputeReceiverTypes(expr, obj, &types, zone());
+  bool monomorphic = ComputeReceiverTypes(expr,
+                                          obj,
+                                          &types,
+                                          access_type,
+                                          zone());
 
   bool force_generic = false;
   if (access_type == STORE &&
@@ -6659,7 +6676,7 @@ HInstruction* HOptimizedGraphBuilder::BuildNamedAccess(
     HValue* value,
     bool is_uninitialized) {
   SmallMapList* types;
-  ComputeReceiverTypes(expr, object, &types, zone());
+  ComputeReceiverTypes(expr, object, &types, access, zone());
   ASSERT(types != NULL);
 
   if (types->length() > 0) {
@@ -7975,7 +7992,7 @@ void HOptimizedGraphBuilder::VisitCall(Call* expr) {
     HValue* receiver = Top();
 
     SmallMapList* types;
-    ComputeReceiverTypes(expr, receiver, &types, zone());
+    ComputeReceiverTypes(expr, receiver, &types, LOAD, zone());
 
     if (prop->key()->IsPropertyName() && types->length() > 0) {
       Handle<String> name = prop->key()->AsLiteral()->AsPropertyName();