[LoadIC] Use LoadIC_Uninitialized for 0->PRE transitions

src/ic/accessor-assembler.cc

 // Copyright 2016 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/ic/accessor-assembler.h"
 
 #include "src/code-factory.h"
 #include "src/code-stubs.h"
 #include "src/counters.h"
 #include "src/ic/handler-configuration.h"
@@ skipping 1176 matching lines @@
     BranchIfPrototypesHaveNoElements(receiver_map, &return_undefined, slow);
 
     Bind(&return_undefined);
     Return(UndefinedConstant());
   }
 }
 
 void AccessorAssembler::GenericPropertyLoad(Node* receiver, Node* receiver_map,
                                             Node* instance_type, Node* key,
                                             const LoadICParameters* p,
-                                            Label* slow) {
+                                            Label* slow,
+                                            UseStubCache use_stub_cache) {
   Comment("key is unique name");
   Label if_found_on_receiver(this), if_property_dictionary(this),
       lookup_prototype_chain(this);
   Variable var_details(this, MachineRepresentation::kWord32);
   Variable var_value(this, MachineRepresentation::kTagged);
 
   // Receivers requiring non-standard accesses (interceptors, access
   // checks, strings and string wrappers, proxies) are handled in the runtime.
   GotoIf(Int32LessThanOrEqual(instance_type,
                               Int32Constant(LAST_SPECIAL_RECEIVER_TYPE)),
          slow);
 
   // Check if the receiver has fast or slow properties.
   Node* properties = LoadProperties(receiver);
   Node* properties_map = LoadMap(properties);
   GotoIf(WordEqual(properties_map, LoadRoot(Heap::kHashTableMapRootIndex)),
          &if_property_dictionary);
 
   // Try looking up the property on the receiver; if unsuccessful, look
   // for a handler in the stub cache.
   Node* bitfield3 = LoadMapBitField3(receiver_map);
   Node* descriptors = LoadMapDescriptors(receiver_map);
 
   Label if_descriptor_found(this), stub_cache(this);
   Variable var_name_index(this, MachineType::PointerRepresentation());
+  Label* notfound =
+      use_stub_cache == kUseStubCache ? &stub_cache : &lookup_prototype_chain;
   DescriptorLookup(key, descriptors, bitfield3, &if_descriptor_found,
-                   &var_name_index, &stub_cache);
+                   &var_name_index, notfound);
 
   Bind(&if_descriptor_found);
   {
     LoadPropertyFromFastObject(receiver, receiver_map, descriptors,
                                var_name_index.value(), &var_details,
                                &var_value);
     Goto(&if_found_on_receiver);
   }
 
-  Bind(&stub_cache);
-  {
+  if (use_stub_cache == kUseStubCache) {
+    Bind(&stub_cache);
     Comment("stub cache probe for fast property load");
     Variable var_handler(this, MachineRepresentation::kTagged);
     Label found_handler(this, &var_handler), stub_cache_miss(this);
     TryProbeStubCache(isolate()->load_stub_cache(), receiver, key,
                       &found_handler, &var_handler, &stub_cache_miss);
     Bind(&found_handler);
     { HandleLoadICHandlerCase(p, var_handler.value(), slow); }
 
     Bind(&stub_cache_miss);
     {
@@ skipping 199 matching lines @@
   }
 }
 
 //////////////////// Entry points into private implementation (one per stub).
 
 void AccessorAssembler::LoadIC(const LoadICParameters* p) {
   Variable var_handler(this, MachineRepresentation::kTagged);
   // TODO(ishell): defer blocks when it works.
   Label if_handler(this, &var_handler), try_polymorphic(this),
       try_megamorphic(this /*, Label::kDeferred*/),
+      try_uninitialized(this /*, Label::kDeferred*/),
       miss(this /*, Label::kDeferred*/);
 
   Node* receiver_map = LoadReceiverMap(p->receiver);
   GotoIf(IsSetWord32<Map::Deprecated>(LoadMapBitField3(receiver_map)), &miss);
 
   // Check monomorphic case.
   Node* feedback =
       TryMonomorphicCase(p->slot, p->vector, receiver_map, &if_handler,
                          &var_handler, &try_polymorphic);
   Bind(&if_handler);
   { HandleLoadICHandlerCase(p, var_handler.value(), &miss); }
 
   Bind(&try_polymorphic);
   {
     // Check polymorphic case.
     Comment("LoadIC_try_polymorphic");
     GotoIfNot(WordEqual(LoadMap(feedback), FixedArrayMapConstant()),
               &try_megamorphic);
     HandlePolymorphicCase(receiver_map, feedback, &if_handler, &var_handler,
                           &miss, 2);
   }
 
   Bind(&try_megamorphic);
   {
     // Check megamorphic case.
     GotoIfNot(WordEqual(feedback, LoadRoot(Heap::kmegamorphic_symbolRootIndex)),
-              &miss);
+              &try_uninitialized);
 
     TryProbeStubCache(isolate()->load_stub_cache(), p->receiver, p->name,
                       &if_handler, &var_handler, &miss);
   }
+  Bind(&try_uninitialized);
+  {
+    // Check uninitialized case.
+    GotoIfNot(
+        WordEqual(feedback, LoadRoot(Heap::kuninitialized_symbolRootIndex)),
+        &miss);
+    TailCallStub(CodeFactory::LoadIC_Uninitialized(isolate()), p->context,
+                 p->receiver, p->name, p->slot, p->vector);
+  }
   Bind(&miss);
   {
     TailCallRuntime(Runtime::kLoadIC_Miss, p->context, p->receiver, p->name,
                     p->slot, p->vector);
   }
+}
+
+void AccessorAssembler::LoadIC_Uninitialized(const LoadICParameters* p) {
+  Label miss(this);
+  Node* receiver = p->receiver;
+  GotoIf(TaggedIsSmi(receiver), &miss);
+  Node* receiver_map = LoadMap(receiver);
+  Node* instance_type = LoadMapInstanceType(receiver_map);
+
+  // Optimistically write the state transition to the vector.
+  StoreFixedArrayElement(p->vector, p->slot,
+                         LoadRoot(Heap::kpremonomorphic_symbolRootIndex),
+                         SKIP_WRITE_BARRIER, 0, SMI_PARAMETERS);
+
+  Label not_function_prototype(this);
+  GotoIf(Word32NotEqual(instance_type, Int32Constant(JS_FUNCTION_TYPE)),
+         &not_function_prototype);
+  GotoIfNot(WordEqual(p->name, LoadRoot(Heap::kprototype_stringRootIndex)),
+            &not_function_prototype);
+  Node* bit_field = LoadMapBitField(receiver_map);
+  GotoIf(IsSetWord32(bit_field, 1 << Map::kHasNonInstancePrototype),
+         &not_function_prototype);
+  // Function.prototype load.
+  {
+    // TODO(jkummerow): Unify with LoadIC_FunctionPrototype builtin
+    // (when we have a shared CSA base class for all builtins).
+    Node* proto_or_map =
+        LoadObjectField(receiver, JSFunction::kPrototypeOrInitialMapOffset);
+    GotoIf(IsTheHole(proto_or_map), &miss);
+
+    Variable var_result(this, MachineRepresentation::kTagged, proto_or_map);
+    Label done(this, &var_result);
+    GotoIfNot(IsMap(proto_or_map), &done);
+
+    var_result.Bind(LoadMapPrototype(proto_or_map));
+    Goto(&done);
+
+    Bind(&done);
+    Return(var_result.value());
+  }
+  Bind(&not_function_prototype);
+
+  GenericPropertyLoad(receiver, receiver_map, instance_type, p->name, p, &miss,
+                      kDontUseStubCache);
+
+  Bind(&miss);
+  {
+    // Undo the optimistic state transition.
+    StoreFixedArrayElement(p->vector, p->slot,
+                           LoadRoot(Heap::kuninitialized_symbolRootIndex),
+                           SKIP_WRITE_BARRIER, 0, SMI_PARAMETERS);
+
+    TailCallRuntime(Runtime::kLoadIC_Miss, p->context, p->receiver, p->name,
+                    p->slot, p->vector);
+  }
 }
 
 void AccessorAssembler::LoadICProtoArray(
     const LoadICParameters* p, Node* handler,
     bool throw_reference_error_if_nonexistent) {
   Label miss(this);
   CSA_ASSERT(this, Word32BinaryNot(TaggedIsSmi(handler)));
   CSA_ASSERT(this, IsFixedArrayMap(LoadMap(handler)));
 
   ExitPoint direct_exit(this);
@@ skipping 348 matching lines @@
   Node* receiver = Parameter(Descriptor::kReceiver);
   Node* name = Parameter(Descriptor::kName);
   Node* slot = Parameter(Descriptor::kSlot);
   Node* vector = Parameter(Descriptor::kVector);
   Node* context = Parameter(Descriptor::kContext);
 
   LoadICParameters p(context, receiver, name, slot, vector);
   LoadIC(&p);
 }
 
+void AccessorAssembler::GenerateLoadIC_Uninitialized() {
+  typedef LoadWithVectorDescriptor Descriptor;
+
+  Node* receiver = Parameter(Descriptor::kReceiver);
+  Node* name = Parameter(Descriptor::kName);
+  Node* slot = Parameter(Descriptor::kSlot);
+  Node* vector = Parameter(Descriptor::kVector);
+  Node* context = Parameter(Descriptor::kContext);
+
+  LoadICParameters p(context, receiver, name, slot, vector);
+  LoadIC_Uninitialized(&p);
+}
+
 void AccessorAssembler::GenerateLoadICTrampoline() {
   typedef LoadDescriptor Descriptor;
 
   Node* receiver = Parameter(Descriptor::kReceiver);
   Node* name = Parameter(Descriptor::kName);
   Node* slot = Parameter(Descriptor::kSlot);
   Node* context = Parameter(Descriptor::kContext);
   Node* vector = LoadFeedbackVectorForStub();
 
   LoadICParameters p(context, receiver, name, slot, vector);
@@ skipping 146 matching lines @@
   Node* slot = Parameter(Descriptor::kSlot);
   Node* context = Parameter(Descriptor::kContext);
   Node* vector = LoadFeedbackVectorForStub();
 
   StoreICParameters p(context, receiver, name, value, slot, vector);
   KeyedStoreIC(&p, language_mode);
 }
 
 }  // namespace internal
 }  // namespace v8