Allow merging of monomorphic accesses to tracked fields.

src/hydrogen.cc

 // Copyright 2013 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 5352 matching lines @@
   if (access.representation().IsDouble()) {
     // Load the heap number.
     checked_object = Add<HLoadNamedField>(
         checked_object, static_cast<HValue*>(NULL),
         access.WithRepresentation(Representation::Tagged()));
     checked_object->set_type(HType::HeapNumber());
     // Load the double value from it.
     access = HObjectAccess::ForHeapNumberValue();
   }
   return New<HLoadNamedField>(
-      checked_object, static_cast<HValue*>(NULL), access, info->field_map());
+      checked_object, checked_object, access, info->field_maps(), top_info());
 }
 
 
 HInstruction* HOptimizedGraphBuilder::BuildStoreNamedField(
     PropertyAccessInfo* info,
     HValue* checked_object,
     HValue* value) {
   bool transition_to_field = info->lookup()->IsTransition();
   // TODO(verwaest): Move this logic into PropertyAccessInfo.
   HObjectAccess field_access = info->access();
@@ skipping 23 matching lines @@
     } else {
       // Already holds a HeapNumber; load the box and write its value field.
       HInstruction* heap_number = Add<HLoadNamedField>(
           checked_object, static_cast<HValue*>(NULL), heap_number_access);
       heap_number->set_type(HType::HeapNumber());
       instr = New<HStoreNamedField>(heap_number,
                                     HObjectAccess::ForHeapNumberValue(),
                                     value, STORE_TO_INITIALIZED_ENTRY);
     }
   } else {
-    if (!info->field_map().is_null()) {
+    if (!info->field_maps()->is_empty()) {
       ASSERT(field_access.representation().IsHeapObject());
       BuildCheckHeapObject(value);
-      value = BuildCheckMap(value, info->field_map());
+      if (info->field_maps()->length() == 1) {
+        // TODO(bmeurer): Also apply stable maps optimization to the else case!
+        value = BuildCheckMap(value, info->field_maps()->first());
+      } else {
+        value = Add<HCheckMaps>(value, info->field_maps());
+      }
 
       // TODO(bmeurer): This is a dirty hack to avoid repeating the smi check
       // that was already performed by the HCheckHeapObject above in the
       // HStoreNamedField below. We should really do this right instead and
       // make Crankshaft aware of Representation::HeapObject().
       field_access = field_access.WithRepresentation(Representation::Tagged());
     }
 
     // This is a normal store.
     instr = New<HStoreNamedField>(
@@ skipping 51 matching lines @@
   if (!info->lookup_.IsField()) return false;
 
   Representation r = access_.representation();
   if (IsLoad()) {
     if (!info->access_.representation().IsCompatibleForLoad(r)) return false;
   } else {
     if (!info->access_.representation().IsCompatibleForStore(r)) return false;
   }
   if (info->access_.offset() != access_.offset()) return false;
   if (info->access_.IsInobject() != access_.IsInobject()) return false;
-  if (!field_map_.is_identical_to(info->field_map_)) {
-    if (!IsLoad()) return false;
-
-    // Throw away type information for merging polymorphic loads.
-    info->field_map_ = Handle<Map>::null();
+  if (IsLoad()) {
+    if (field_maps_.is_empty()) {
+      info->field_maps_.Clear();
+    } else if (!info->field_maps_.is_empty()) {
+      for (int i = 0; i < field_maps_.length(); ++i) {
+        info->field_maps_.AddMapIfMissing(field_maps_.at(i), info->zone());
+      }
+      info->field_maps_.Sort();
+    }
+  } else {
+    // We can only merge stores that agree on their field maps. The comparison
+    // below is safe, since we keep the field maps sorted.
+    if (field_maps_.length() != info->field_maps_.length()) return false;
+    for (int i = 0; i < field_maps_.length(); ++i) {
+      if (!field_maps_.at(i).is_identical_to(info->field_maps_.at(i))) {
+        return false;
+      }
+    }
   }
   info->GeneralizeRepresentation(r);
   return true;
 }
 
 
 bool HOptimizedGraphBuilder::PropertyAccessInfo::LookupDescriptor() {
   if (!type_->IsClass()) return true;
   map()->LookupDescriptor(NULL, *name_, &lookup_);
   return LoadResult(map());
 }
 
 
 bool HOptimizedGraphBuilder::PropertyAccessInfo::LoadResult(Handle<Map> map) {
   if (!IsLoad() && lookup_.IsProperty() &&
       (lookup_.IsReadOnly() || !lookup_.IsCacheable())) {
     return false;
   }
 
   if (lookup_.IsField()) {
     // Construct the object field access.
     access_ = HObjectAccess::ForField(map, &lookup_, name_);
 
     // Load field map for heap objects.
-    LoadFieldMap(map);
+    LoadFieldMaps(map);
   } else if (lookup_.IsPropertyCallbacks()) {
     Handle<Object> callback(lookup_.GetValueFromMap(*map), isolate());
     if (!callback->IsAccessorPair()) return false;
     Object* raw_accessor = IsLoad()
         ? Handle<AccessorPair>::cast(callback)->getter()
         : Handle<AccessorPair>::cast(callback)->setter();
     if (!raw_accessor->IsJSFunction()) return false;
     Handle<JSFunction> accessor = handle(JSFunction::cast(raw_accessor));
     if (accessor->shared()->IsApiFunction()) {
       CallOptimization call_optimization(accessor);
       if (call_optimization.is_simple_api_call()) {
         CallOptimization::HolderLookup holder_lookup;
         Handle<Map> receiver_map = this->map();
         api_holder_ = call_optimization.LookupHolderOfExpectedType(
             receiver_map, &holder_lookup);
       }
     }
     accessor_ = accessor;
   } else if (lookup_.IsConstant()) {
     constant_ = handle(lookup_.GetConstantFromMap(*map), isolate());
   }
 
   return true;
 }
 
 
-void HOptimizedGraphBuilder::PropertyAccessInfo::LoadFieldMap(Handle<Map> map) {
-  // Clear any previous field map.
-  field_map_ = Handle<Map>::null();
+void HOptimizedGraphBuilder::PropertyAccessInfo::LoadFieldMaps(
+    Handle<Map> map) {
+  // Figure out the field type from the accessor map.
+  Handle<HeapType> field_type(lookup_.GetFieldTypeFromMap(*map), isolate());
 
-  // Figure out the field type from the accessor map.
-  HeapType* field_type = lookup_.GetFieldTypeFromMap(*map);
-  if (field_type->IsClass()) {
-    ASSERT(access_.representation().IsHeapObject());
-    Handle<Map> field_map = field_type->AsClass();
-    if (field_map->is_stable()) {
-      field_map_ = field_map;
-      Map::AddDependentCompilationInfo(
-          field_map_, DependentCode::kPrototypeCheckGroup, top_info());
+  // Collect the (stable) maps from the field type.
+  int num_field_maps = field_type->NumClasses();
+  if (num_field_maps == 0) {
+    field_maps_.Clear();
+    return;
+  }
+  ASSERT(access_.representation().IsHeapObject());
+  field_maps_.Reserve(num_field_maps, zone());
+  HeapType::Iterator<Map> it = field_type->Classes();
+  while (!it.Done()) {
+    Handle<Map> field_map = it.Current();
+    if (!field_map->is_stable()) {
+      field_maps_.Clear();
+      return;
+    }
+    field_maps_.Add(field_map, zone());
+    it.Advance();
+  }
+  field_maps_.Sort();
+  ASSERT_EQ(num_field_maps, field_maps_.length());
 
-      // Add dependency on the map that introduced the field.
-      Map::AddDependentCompilationInfo(
-          handle(lookup_.GetFieldOwnerFromMap(*map), isolate()),
-          DependentCode::kFieldTypeGroup, top_info());
-    }
-  }
+  // Add dependency on the map that introduced the field.
+  Map::AddDependentCompilationInfo(
+      handle(lookup_.GetFieldOwnerFromMap(*map), isolate()),
+      DependentCode::kFieldTypeGroup, top_info());
 }
 
 
 bool HOptimizedGraphBuilder::PropertyAccessInfo::LookupInPrototypes() {
   Handle<Map> map = this->map();
 
   while (map->prototype()->IsJSObject()) {
     holder_ = handle(JSObject::cast(map->prototype()));
     if (holder_->map()->is_deprecated()) {
       JSObject::TryMigrateInstance(holder_);
@@ skipping 23 matching lines @@
   if (IsLoad()) return true;
 
   if (lookup_.IsPropertyCallbacks()) return true;
   Handle<Map> map = this->map();
   map->LookupTransition(NULL, *name_, &lookup_);
   if (lookup_.IsTransitionToField() && map->unused_property_fields() > 0) {
     // Construct the object field access.
     access_ = HObjectAccess::ForField(map, &lookup_, name_);
 
     // Load field map for heap objects.
-    LoadFieldMap(transition());
+    LoadFieldMaps(transition());
     return true;
   }
   return false;
 }
 
 
 bool HOptimizedGraphBuilder::PropertyAccessInfo::CanAccessAsMonomorphic(
     SmallMapList* types) {
   ASSERT(type_->Is(ToType(types->first())));
   if (!CanAccessMonomorphic()) return false;
@@ skipping 5983 matching lines @@
   if (ShouldProduceTraceOutput()) {
     isolate()->GetHTracer()->TraceHydrogen(name(), graph_);
   }
 
 #ifdef DEBUG
   graph_->Verify(false);  // No full verify.
 #endif
 }
 
 } }  // namespace v8::internal