Track up to 5 stable maps as field type.

src/objects.cc

 // Copyright 2013 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 45 matching lines @@
 #ifdef ENABLE_DISASSEMBLER
 #include "disasm.h"
 #include "disassembler.h"
 #endif
 
 namespace v8 {
 namespace internal {
 
 Handle<HeapType> Object::OptimalType(Isolate* isolate,
                                      Representation representation) {
-  if (!FLAG_track_field_types) return HeapType::Any(isolate);
-  if (representation.IsNone()) return HeapType::None(isolate);
-  if (representation.IsHeapObject() && IsHeapObject()) {
-    // We can track only JavaScript objects with stable maps.
-    Handle<Map> map(HeapObject::cast(this)->map(), isolate);
-    if (map->is_stable() &&
-        map->instance_type() >= FIRST_NONCALLABLE_SPEC_OBJECT_TYPE &&
-        map->instance_type() <= LAST_NONCALLABLE_SPEC_OBJECT_TYPE) {
-      return HeapType::Class(map, isolate);
+  if (FLAG_track_field_types) {
+    if (representation.IsNone()) return HeapType::None(isolate);
+    if (representation.IsHeapObject() && IsHeapObject()) {
+      // We can track only JavaScript objects with stable maps.
+      Handle<Map> map(HeapObject::cast(this)->map(), isolate);
+      if (map->is_stable() &&
+          map->instance_type() >= FIRST_NONCALLABLE_SPEC_OBJECT_TYPE &&
+          map->instance_type() <= LAST_NONCALLABLE_SPEC_OBJECT_TYPE) {
+        return HeapType::Class(map, isolate);
+      }
     }
   }
   return HeapType::Any(isolate);
 }
 
 
 MaybeHandle<JSReceiver> Object::ToObject(Isolate* isolate,
                                          Handle<Object> object,
                                          Handle<Context> native_context) {
   if (object->IsJSReceiver()) return Handle<JSReceiver>::cast(object);
@@ skipping 2439 matching lines @@
   instance_descriptors()->Replace(descriptor_number, desc);;
 }
 
 
 // static
 Handle<HeapType> Map::GeneralizeFieldType(Handle<HeapType> old_field_type,
                                           Handle<HeapType> new_field_type,
                                           Isolate* isolate) {
   if (new_field_type->NowIs(old_field_type)) return old_field_type;
   if (old_field_type->NowIs(new_field_type)) return new_field_type;
+  int num_old_classes = old_field_type->NumClasses();
+  int num_new_classes = new_field_type->NumClasses();
+  if (num_old_classes > 0 &&
+      num_new_classes > 0 &&
+      num_old_classes + num_new_classes <= 5 &&

[Sven Panne, 2014/04/17 06:43:41]

Perhaps give the "5" a name...

[Benedikt Meurer, 2014/04/17 07:26:35]

Done.

+      old_field_type->NowStable() && new_field_type->NowStable()) {
+    return HeapType::Union(new_field_type, old_field_type, isolate);

[Sven Panne, 2014/04/17 06:43:41]

As discussed offline: Perhaps calculate the union first and then check its size.

[Benedikt Meurer, 2014/04/17 07:26:35]

Done.

+  }
   return HeapType::Any(isolate);
 }
 
 
 // static
 void Map::GeneralizeFieldType(Handle<Map> map,
                               int modify_index,
                               Handle<HeapType> new_field_type) {
   Isolate* isolate = map->GetIsolate();
   Handle<Map> field_owner(map->FindFieldOwner(modify_index), isolate);
@@ skipping 14567 matching lines @@
 #define ERROR_MESSAGES_TEXTS(C, T) T,
   static const char* error_messages_[] = {
       ERROR_MESSAGES_LIST(ERROR_MESSAGES_TEXTS)
   };
 #undef ERROR_MESSAGES_TEXTS
   return error_messages_[reason];
 }
 
 
 } }  // namespace v8::internal