Handle non-JSObject heap objects using slow-path IC stub guarded by the map.

src/objects.h

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 1772 matching lines @@
   static void VerifyHeapPointer(Object* p);
 #endif
 
   // Layout description.
   // First field in a heap object is map.
   static const int kMapOffset = Object::kHeaderSize;
   static const int kHeaderSize = kMapOffset + kPointerSize;
 
   STATIC_CHECK(kMapOffset == Internals::kHeapObjectMapOffset);
 
+  static void UpdateMapCodeCache(Handle<HeapObject> object,

[Michael Starzinger, 2013/09/12 14:28:48]

Please move this up a few lines to above the casting method. Also add a short
one-liner commment describing this method.

[Toon Verwaest, 2013/09/12 14:58:23]

Done.

+                                 Handle<Name> name,
+                                 Handle<Code> code);
+
  protected:
   // helpers for calling an ObjectVisitor to iterate over pointers in the
   // half-open range [start, end) specified as integer offsets
   inline void IteratePointers(ObjectVisitor* v, int start, int end);
   // as above, for the single element at "offset"
   inline void IteratePointer(ObjectVisitor* v, int offset);
 
  private:
   DISALLOW_IMPLICIT_CONSTRUCTORS(HeapObject);
 };
@@ skipping 764 matching lines @@
       PropertyNormalizationMode mode,
       int expected_additional_properties);
 
   // Convert and update the elements backing store to be a
   // SeededNumberDictionary dictionary.  Returns the backing after conversion.
   static Handle<SeededNumberDictionary> NormalizeElements(
       Handle<JSObject> object);
 
   MUST_USE_RESULT MaybeObject* NormalizeElements();
 
-  static void UpdateMapCodeCache(Handle<JSObject> object,
-                                 Handle<Name> name,
-                                 Handle<Code> code);
-
   // Transform slow named properties to fast variants.
   // Returns failure if allocation failed.
   static void TransformToFastProperties(Handle<JSObject> object,
                                         int unused_property_fields);
 
   MUST_USE_RESULT MaybeObject* TransformToFastProperties(
       int unused_property_fields);
 
   // Access fast-case object properties at index.
   MUST_USE_RESULT inline MaybeObject* FastPropertyAt(
@@ skipping 2894 matching lines @@
   // Tells whether the instance is undetectable.
   // An undetectable object is a special class of JSObject: 'typeof' operator
   // returns undefined, ToBoolean returns false. Otherwise it behaves like
   // a normal JS object.  It is useful for implementing undetectable
   // document.all in Firefox & Safari.
   // See https://bugzilla.mozilla.org/show_bug.cgi?id=248549.
   inline void set_is_undetectable() {
     set_bit_field(bit_field() | (1 << kIsUndetectable));
   }
 
+  inline bool is_jsobject_map();

[Michael Starzinger, 2013/09/12 14:28:48]

I think starting to duplicate type checking predicates on Map is not good
(especially with a completely new naming convention). I would rather have this
predicate be inlined into CanInlinePropertyAccess directly.

[Toon Verwaest, 2013/09/12 14:58:23]

Done.

+
   inline bool is_undetectable() {
     return ((1 << kIsUndetectable) & bit_field()) != 0;
   }
 
   // Tells whether the instance has a call-as-function handler.
   inline void set_has_instance_call_handler() {
     set_bit_field(bit_field() | (1 << kHasInstanceCallHandler));
   }
 
   inline bool has_instance_call_handler() {
@@ skipping 4719 matching lines @@
     } else {
       value &= ~(1 << bit_position);
     }
     return value;
   }
 };
 
 } }  // namespace v8::internal
 
 #endif  // V8_OBJECTS_H_