Collect type profile for DevTools.

src/runtime/runtime-object.cc

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
+#include <src/ic/ic-state.h>
 #include "src/runtime/runtime-utils.h"
 
 #include "src/arguments.h"
 #include "src/bootstrapper.h"
 #include "src/debug/debug.h"
 #include "src/isolate-inl.h"
 #include "src/messages.h"
 #include "src/property-descriptor.h"
 #include "src/runtime/runtime.h"
 
@@ skipping 658 matching lines @@
   LookupIterator it = LookupIterator::PropertyOrElement(
       isolate, object, name, object, LookupIterator::OWN);
   // Cannot fail since this should only be called when
   // creating an object literal.
   CHECK(JSObject::DefineOwnPropertyIgnoreAttributes(&it, value, attrs,
                                                     Object::DONT_THROW)
             .IsJust());
   return *object;
 }
 
+RUNTIME_FUNCTION(Runtime_StoreTypeInformation) {
+  HandleScope scope(isolate);
+  DCHECK_EQ(4, args.length());
+  CONVERT_ARG_HANDLE_CHECKED(Object, name, 0);
+  CONVERT_ARG_HANDLE_CHECKED(Object, value, 1);
+  CONVERT_ARG_HANDLE_CHECKED(FeedbackVector, vector, 2);
+  CONVERT_SMI_ARG_CHECKED(index, 3);
+
+  DCHECK(FLAG_type_profile);
+
+  CollectTypeProfileICNexus nexus(vector, vector->ToSlot(index));

[Yang, 2017/02/22 10:39:28]

Do we need to fit this into the IC framework? We don't really care about whether
it's monomorphic/polymorphic/megamorphic. And I don't think setting an arbitrary
megamorphic limit makes sense at this point.

Let's just add the types onto the ArrayList without making this look like an IC.

[Franzi, 2017/02/27 11:38:01]

Yes, IC framework makes no sense for types. Simplified it. 

+
+  // We've seen to much. Nothing to see here
+  if (nexus.ic_state() == MEGAMORPHIC) {
+    name->Print();
+    printf("Too many types to list them.\n\n");
+    return *name;
+  }
+
+  Handle<Name> type = Object::TypeOf(isolate, value);
+  if (value->IsJSReceiver()) {
+    Handle<JSReceiver> object = Handle<JSReceiver>::cast(value);
+    type = JSReceiver::GetConstructorName(object);
+  }
+  if (nexus.ic_state() == UNINITIALIZED) {
+    nexus.ConfigureMonomorphic(type);
+  } else if (nexus.ic_state() == MONOMORPHIC) {
+    DCHECK(nexus.GetFeedback()->IsName());
+    Handle<Name> known_type =
+        Handle<Name>::cast(Handle<Object>(nexus.GetFeedback(), isolate));
+    // Do not store the value if it is the same type.
+    if (!known_type->Equals(*type)) {
+      nexus.ConfigurePolymorphic(type);
+    }
+  } else {
+    DCHECK(nexus.ic_state() == POLYMORPHIC);
+    DCHECK(nexus.GetFeedback()->IsArrayList());
+    Handle<ArrayList> known_types =
+        Handle<ArrayList>::cast(Handle<Object>(nexus.GetFeedback(), isolate));
+    if (known_types->Length() == kMaxKeyedPolymorphism) {
+      nexus.ConfigureMegamorphic();
+      return *name;
+    }
+    nexus.ConfigurePolymorphic(type);
+  }
+
+  name->Print();
+  nexus.GetFeedback()->Print();
+  printf("\n");
+
+  return *name;
+}
+
 // Return property without being observable by accessors or interceptors.
 RUNTIME_FUNCTION(Runtime_GetDataProperty) {
   HandleScope scope(isolate);
   DCHECK_EQ(2, args.length());
   CONVERT_ARG_HANDLE_CHECKED(JSReceiver, object, 0);
   CONVERT_ARG_HANDLE_CHECKED(Name, name, 1);
   return *JSReceiver::GetDataProperty(object, name);
 }
 
 RUNTIME_FUNCTION(Runtime_GetConstructorName) {
@@ skipping 291 matching lines @@
   if (!success) return isolate->heap()->exception();
   MAYBE_RETURN(
       JSReceiver::CreateDataProperty(&it, value, Object::THROW_ON_ERROR),
       isolate->heap()->exception());
   return *value;
 }
 
 
 }  // namespace internal
 }  // namespace v8