[ic] Completely unroll polymorphic IC map checks

src/ic/accessor-assembler.cc

 // Copyright 2016 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/ic/accessor-assembler.h"
 
 #include "src/code-factory.h"
 #include "src/code-stubs.h"
 #include "src/counters.h"
 #include "src/ic/handler-configuration.h"
+#include "src/ic/ic.h"
 #include "src/ic/stub-cache.h"
 #include "src/objects-inl.h"
 
 namespace v8 {
 namespace internal {
 
 using compiler::CodeAssemblerState;
 using compiler::Node;
 
 //////////////////// Private helpers.
@@ skipping 40 matching lines @@
   Comment("HandlePolymorphicCase");
   DCHECK_EQ(MachineRepresentation::kTagged, var_handler->rep());
 
   // Deferred so the unrolled case can omit frame construction in bytecode
   // handler.
   Label loop(this, Label::kDeferred);
 
   // Iterate {feedback} array.
   const int kEntrySize = 2;
 
+  // Polymorphic IC feedback is guaranteed contain at least two (map, handler)
+  // pairs.
+  const int kMaxUnrollCountWithoutBoundsCheck = 2;
+  DCHECK_LE(unroll_count, IC::kMaxPolymorphicMapCount);
+
+  Node* length = LoadAndUntagFixedArrayBaseLength(feedback);

[Igor Sheludko, 2017/03/07 13:24:01]

We can delay loading of a length till (i == kMaxUnrollCountWithoutBoundsCheck).

+  CSA_ASSERT(this, IntPtrGreaterThanOrEqual(length, IntPtrConstant(2)));
+
   for (int i = 0; i < unroll_count; i++) {
+    int map_index = i * kEntrySize;
+    int handler_index = i * kEntrySize + 1;
+
+    if (i >= kMaxUnrollCountWithoutBoundsCheck) {
+      GotoIf(IntPtrGreaterThanOrEqual(IntPtrConstant(handler_index), length),
+             if_miss);
+    }
+
     Label next_entry(this);
     Node* cached_map =
-        LoadWeakCellValue(LoadFixedArrayElement(feedback, i * kEntrySize));
+        LoadWeakCellValue(LoadFixedArrayElement(feedback, map_index));
     GotoIf(WordNotEqual(receiver_map, cached_map), &next_entry);
 
     // Found, now call handler.
-    Node* handler = LoadFixedArrayElement(feedback, i * kEntrySize + 1);
+    Node* handler = LoadFixedArrayElement(feedback, handler_index);
     var_handler->Bind(handler);
     Goto(if_handler);
 
     Bind(&next_entry);
   }
   Goto(&loop);
 
   // Loop from {unroll_count}*kEntrySize to {length}.
   Bind(&loop);
   Node* init = IntPtrConstant(unroll_count * kEntrySize);
-  Node* length = LoadAndUntagFixedArrayBaseLength(feedback);
   BuildFastLoop(
       init, length,
       [this, receiver_map, feedback, if_handler, var_handler](Node* index) {
         Node* cached_map =
             LoadWeakCellValue(LoadFixedArrayElement(feedback, index));
 
         Label next_entry(this);
         GotoIf(WordNotEqual(receiver_map, cached_map), &next_entry);
 
         // Found, now call handler.
@@ skipping 1521 matching lines @@
                            &var_handler, &try_polymorphic);
 
     Bind(&if_handler);
     HandleLoadICHandlerCase(p, var_handler.value(), &miss, exit_point);
 
     Bind(&try_polymorphic);
     {
       GotoIfNot(WordEqual(LoadMap(feedback), FixedArrayMapConstant()),
                 &stub_call);
       HandlePolymorphicCase(recv_map, feedback, &if_handler, &var_handler,
-                            &miss, 2);
+                            &miss, IC::kMaxPolymorphicMapCount);
     }
   }
 
   Bind(&stub_call);
   {
     Comment("LoadIC_BytecodeHandler_noninlined");
 
     // Call into the stub that implements the non-inlined parts of LoadIC.
     Callable ic = CodeFactory::LoadICInOptimizedCode_Noninlined(isolate());
     Node* code_target = HeapConstant(ic.code());
@@ skipping 29 matching lines @@
   Bind(&if_handler);
   HandleLoadICHandlerCase(p, var_handler.value(), &miss, &direct_exit);
 
   Bind(&try_polymorphic);
   {
     // Check polymorphic case.
     Comment("LoadIC_try_polymorphic");
     GotoIfNot(WordEqual(LoadMap(feedback), FixedArrayMapConstant()),
               &non_inlined);
     HandlePolymorphicCase(receiver_map, feedback, &if_handler, &var_handler,
-                          &miss, 2);
+                          &miss, IC::kMaxPolymorphicMapCount);
   }
 
   Bind(&non_inlined);
   LoadIC_Noninlined(p, receiver_map, feedback, &var_handler, &if_handler, &miss,
                     &direct_exit);
 
   Bind(&miss);
   direct_exit.ReturnCallRuntime(Runtime::kLoadIC_Miss, p->context, p->receiver,
                                 p->name, p->slot, p->vector);
 }
@@ skipping 211 matching lines @@
                             kSupportElements);
   }
 
   Bind(&try_polymorphic);
   {
     // Check polymorphic case.
     Comment("KeyedLoadIC_try_polymorphic");
     GotoIfNot(WordEqual(LoadMap(feedback), FixedArrayMapConstant()),
               &try_megamorphic);
     HandlePolymorphicCase(receiver_map, feedback, &if_handler, &var_handler,
-                          &miss, 2);
+                          &miss, IC::kMaxPolymorphicMapCount);
   }
 
   Bind(&try_megamorphic);
   {
     // Check megamorphic case.
     Comment("KeyedLoadIC_try_megamorphic");
     GotoIfNot(WordEqual(feedback, LoadRoot(Heap::kmegamorphic_symbolRootIndex)),
               &try_polymorphic_name);
     // TODO(jkummerow): Inline this? Or some of it?
     TailCallStub(CodeFactory::KeyedLoadIC_Megamorphic(isolate()), p->context,
@@ skipping 74 matching lines @@
   }
 
   Bind(&try_polymorphic);
   {
     // Check polymorphic case.
     Comment("StoreIC_try_polymorphic");
     GotoIfNot(
         WordEqual(LoadMap(feedback), LoadRoot(Heap::kFixedArrayMapRootIndex)),
         &try_megamorphic);
     HandlePolymorphicCase(receiver_map, feedback, &if_handler, &var_handler,
-                          &miss, 2);
+                          &miss, IC::kMaxPolymorphicMapCount);
   }
 
   Bind(&try_megamorphic);
   {
     // Check megamorphic case.
     GotoIfNot(WordEqual(feedback, LoadRoot(Heap::kmegamorphic_symbolRootIndex)),
               &miss);
 
     TryProbeStubCache(isolate()->store_stub_cache(), p->receiver, p->name,
                       &if_handler, &var_handler, &miss);
@@ skipping 339 matching lines @@
   Node* context = Parameter(Descriptor::kContext);
   Node* vector = LoadFeedbackVectorForStub();
 
   Callable callable =
       CodeFactory::KeyedStoreICInOptimizedCode(isolate(), language_mode);
   TailCallStub(callable, context, receiver, name, value, slot, vector);
 }
 
 }  // namespace internal
 }  // namespace v8