[ic] Completely unroll polymorphic IC map checks

[ic] Completely unroll polymorphic IC map checks

Polymorphic IC feedback can contain up to four (map, handler) pairs.

HandlePolymorphicCase already unrolled checks for the first two pairs; these
are guaranteed to exist and can omit bound checks.

This CL unrolls checks against the final two pairs as well.

BUG=v8:5917
Review-Url: https://codereview.chromium.org/2728293005
Cr-Commit-Position: refs/heads/master@{#43650}
Committed: https://chromium.googlesource.com/v8/v8/+/3c246db781fa78bca43fa668c1ba0c83c141d2ef

[jgruber, 2017-03-07 11:29:18]

The CQ bit was checked by jgruber@chromium.org to run a CQ dry run

[commit-bot: I haz the power, 2017-03-07 11:29:27]

Dry run: CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[jgruber, 2017-03-07 12:31:27]

jgruber@chromium.org changed reviewers:
+ ishell@chromium.org

[commit-bot: I haz the power, 2017-03-07 12:37:01]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2017-03-07 12:37:02]

Dry run: This issue passed the CQ dry run.

[Igor Sheludko, 2017-03-07 13:24:01]

lgtm with a nit:

https://codereview.chromium.org/2728293005/diff/1/src/ic/accessor-assembler.cc
File src/ic/accessor-assembler.cc (right):

https://codereview.chromium.org/2728293005/diff/1/src/ic/accessor-assembler.c...
src/ic/accessor-assembler.cc:77: Node* length =
LoadAndUntagFixedArrayBaseLength(feedback);
We can delay loading of a length till (i == kMaxUnrollCountWithoutBoundsCheck).

[jgruber, 2017-03-07 15:07:55]

The CQ bit was checked by jgruber@chromium.org to run a CQ dry run

[commit-bot: I haz the power, 2017-03-07 15:08:04]

Dry run: CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[jgruber, 2017-03-07 15:20:54]

The CQ bit was checked by jgruber@chromium.org to run a CQ dry run

[commit-bot: I haz the power, 2017-03-07 15:21:00]

Dry run: CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[jgruber, 2017-03-07 15:22:29]

https://codereview.chromium.org/2728293005/diff/20001/src/ic/accessor-assembl...
File src/ic/accessor-assembler.cc (right):

https://codereview.chromium.org/2728293005/diff/20001/src/ic/accessor-assembl...
src/ic/accessor-assembler.cc:61: int min_feedback_capacity) {
As discussed offline, not all code paths calling into HandlePolymorphicCase can
guarantee feedback.size >= 2. The latest patchset changes behavior to:
* Take a min_feedback_capacity. We omit bounds checks for this many iterations.
* Always unroll 4 loop iterations. The generated code is very small so it should
be a net gain.
* Length is loaded as needed for the first bounds check.

[commit-bot: I haz the power, 2017-03-07 15:46:15]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2017-03-07 15:46:16]

Dry run: This issue passed the CQ dry run.

[Igor Sheludko, 2017-03-07 16:28:12]

lgtm with a nit:

https://codereview.chromium.org/2728293005/diff/40001/src/ic/accessor-assembl...
File src/ic/accessor-assembler.cc (right):

https://codereview.chromium.org/2728293005/diff/40001/src/ic/accessor-assembl...
src/ic/accessor-assembler.cc:107: Node* end_index =
LoadAndUntagFixedArrayBaseLength(feedback);
SmiUntag(length)?

[Igor Sheludko, 2017-03-07 16:30:30]

https://codereview.chromium.org/2728293005/diff/40001/src/ic/accessor-assembl...
File src/ic/accessor-assembler.cc (right):

https://codereview.chromium.org/2728293005/diff/40001/src/ic/accessor-assembl...
src/ic/accessor-assembler.cc:107: Node* end_index =
LoadAndUntagFixedArrayBaseLength(feedback);
On 2017/03/07 16:28:12, Igor Sheludko wrote:
> SmiUntag(length)?

Please ignore this comment.

[jgruber, 2017-03-07 16:55:24]

The CQ bit was checked by jgruber@chromium.org

[commit-bot: I haz the power, 2017-03-07 16:55:31]

CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[commit-bot: I haz the power, 2017-03-07 16:57:08]

CQ is committing da patch.

Bot data: {"patchset_id": 40001, "attempt_start_ts": 1488905724407430,
"parent_rev": "c478a2298d145772fbb848e39627e304f0a5c60a", "commit_rev":
"3c246db781fa78bca43fa668c1ba0c83c141d2ef"}

[commit-bot: I haz the power, 2017-03-07 16:57:13]

Description was changed from

==========
[ic] Completely unroll polymorphic IC map checks

Polymorphic IC feedback can contain up to four (map, handler) pairs.

HandlePolymorphicCase already unrolled checks for the first two pairs; these
are guaranteed to exist and can omit bound checks.

This CL unrolls checks against the final two pairs as well.

BUG=v8:5917
==========

to

==========
[ic] Completely unroll polymorphic IC map checks

Polymorphic IC feedback can contain up to four (map, handler) pairs.

HandlePolymorphicCase already unrolled checks for the first two pairs; these
are guaranteed to exist and can omit bound checks.

This CL unrolls checks against the final two pairs as well.

BUG=v8:5917

Review-Url: https://codereview.chromium.org/2728293005
Cr-Commit-Position: refs/heads/master@{#43650}
Committed:
https://chromium.googlesource.com/v8/v8/+/3c246db781fa78bca43fa668c1ba0c83c14...
==========

[commit-bot: I haz the power, 2017-03-07 16:57:14]

Committed patchset #3 (id:40001) as
https://chromium.googlesource.com/v8/v8/+/3c246db781fa78bca43fa668c1ba0c83c14...