[ic] Support data handlers that represent loads from prototypes.

src/ic/ic.cc

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/ic/ic.h"
 
 #include "src/accessors.h"
 #include "src/api-arguments-inl.h"
 #include "src/api.h"
 #include "src/arguments.h"
@@ skipping 813 matching lines @@
 Handle<Code> KeyedStoreIC::ChooseMegamorphicStub(Isolate* isolate,
                                                  ExtraICState extra_state) {
   LanguageMode mode = StoreICState::GetLanguageMode(extra_state);
   return is_strict(mode)
              ? isolate->builtins()->KeyedStoreIC_Megamorphic_Strict()
              : isolate->builtins()->KeyedStoreIC_Megamorphic();
 }
 
 Handle<Object> LoadIC::SimpleFieldLoad(FieldIndex index) {
   if (FLAG_tf_load_ic_stub) {
+    TRACE_HANDLER_STATS(isolate(), LoadIC_LoadFieldDH);
     return handle(Smi::FromInt(index.GetLoadByFieldOffset()), isolate());
   }
   TRACE_HANDLER_STATS(isolate(), LoadIC_LoadFieldStub);
   LoadFieldStub stub(isolate(), index);
   return stub.GetCode();
 }
 
+Handle<Object> LoadIC::SimpleFieldLoadFromPrototype(FieldIndex index,
+                                                    Handle<Map> receiver_map,
+                                                    Handle<JSObject> holder) {
+  if (!FLAG_tf_load_ic_stub) return Handle<Object>::null();
+
+  DCHECK(holder->HasFastProperties());
+
+  // The following kinds of receiver maps require custom handler compilation.
+  if (receiver_map->IsPrimitiveMap() || receiver_map->IsJSGlobalProxyMap() ||
+      receiver_map->IsJSGlobalObjectMap() ||
+      receiver_map->is_dictionary_map()) {
+    return Handle<Object>::null();
+  }
+
+  // Switch to custom compiled handler if the prototype chain contains global
+  // or dictionary objects.
+  for (PrototypeIterator iter(*receiver_map); !iter.IsAtEnd(); iter.Advance()) {
+    JSObject* current = iter.GetCurrent<JSObject>();
+    if (current == *holder) break;
+    Map* current_map = current->map();
+    if (current_map->IsJSGlobalObjectMap() ||
+        current_map->IsJSGlobalProxyMap() || current_map->is_dictionary_map()) {
+      return Handle<Object>::null();
+    }
+    // Only objects that do not require access checks are allowed in stubs.
+    DCHECK(!current_map->is_access_check_needed());
+  }
+  TRACE_HANDLER_STATS(isolate(), LoadIC_LoadFieldFromPrototypeDH);
+  Handle<Cell> validity_cell =
+      Map::GetOrCreatePrototypeChainValidityCell(receiver_map, isolate());
+  DCHECK(!validity_cell.is_null());
+
+  Handle<Object> handler(Smi::FromInt(index.GetLoadByFieldOffset()), isolate());
+  DCHECK(handler->IsSmi());
+
+  Factory* factory = isolate()->factory();
+
+  Handle<WeakCell> holder_cell = factory->NewWeakCell(holder);
+  return factory->NewTuple3(validity_cell, holder_cell, handler);
+}
 
 bool IsCompatibleReceiver(LookupIterator* lookup, Handle<Map> receiver_map) {
   DCHECK(lookup->state() == LookupIterator::ACCESSOR);
   Isolate* isolate = lookup->isolate();
   Handle<Object> accessors = lookup->GetAccessors();
   if (accessors->IsAccessorInfo()) {
     Handle<AccessorInfo> info = Handle<AccessorInfo>::cast(accessors);
     if (info->getter() != NULL &&
         !AccessorInfo::IsCompatibleReceiverMap(isolate, info, receiver_map)) {
       return false;
@@ skipping 284 matching lines @@
         TRACE_HANDLER_STATS(isolate(), LoadIC_LoadNormal);
         return isolate()->builtins()->LoadIC_Normal();
       }
 
       // -------------- Fields --------------
       if (lookup->property_details().type() == DATA) {
         FieldIndex field = lookup->GetFieldIndex();
         if (receiver_is_holder) {
           return SimpleFieldLoad(field);
         }
+        Handle<Object> handler =
+            SimpleFieldLoadFromPrototype(field, map, holder);
+        if (!handler.is_null()) {
+          return handler;
+        }
         break;  // Custom-compiled handler.
       }
 
       // -------------- Constant properties --------------
       DCHECK(lookup->property_details().type() == DATA_CONSTANT);
       if (receiver_is_holder) {
         TRACE_HANDLER_STATS(isolate(), LoadIC_LoadConstantStub);
         LoadConstantStub stub(isolate(), lookup->GetConstantIndex());
         return stub.GetCode();
       }
@@ skipping 1744 matching lines @@
     DCHECK_EQ(LookupIterator::INTERCEPTOR, it.state());
     it.Next();
     ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, result,
                                        Object::GetProperty(&it));
   }
 
   return *result;
 }
 }  // namespace internal
 }  // namespace v8