[type profile] Collect return types.

src/runtime/runtime-object.cc

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/runtime/runtime-utils.h"
 
 #include "src/arguments.h"
 #include "src/bootstrapper.h"
 #include "src/debug/debug.h"
 #include "src/isolate-inl.h"
@@ skipping 675 matching lines @@
   // Cannot fail since this should only be called when
   // creating an object literal.
   CHECK(JSObject::DefineOwnPropertyIgnoreAttributes(&it, value, attrs,
                                                     Object::DONT_THROW)
             .IsJust());
   return *object;
 }
 
 RUNTIME_FUNCTION(Runtime_CollectTypeProfile) {
   HandleScope scope(isolate);
-  DCHECK_EQ(4, args.length());
-  CONVERT_ARG_HANDLE_CHECKED(String, name, 0);
-  CONVERT_ARG_HANDLE_CHECKED(Object, value, 1);
-  CONVERT_ARG_HANDLE_CHECKED(FeedbackVector, vector, 2);
-  CONVERT_SMI_ARG_CHECKED(index, 3);
+  DCHECK_EQ(5, args.length());
+  CONVERT_ARG_HANDLE_CHECKED(Smi, position, 0);
+  CONVERT_ARG_HANDLE_CHECKED(String, name, 1);
+  CONVERT_ARG_HANDLE_CHECKED(Object, value, 2);
+  CONVERT_ARG_HANDLE_CHECKED(FeedbackVector, vector, 3);
+  CONVERT_SMI_ARG_CHECKED(index, 4);
 
   DCHECK(FLAG_type_profile);
 
+  Object* function_name = vector->shared_function_info()->name();

[Michael Starzinger, 2017/03/20 09:29:26]

This must be handlified, otherwise the handlified function calls between here
and the use of the {function_name} variable below could trigger a GC and leave
this raw pointer in a stale state. As a general rule of thumb: Either handlify
the entire function and leave the entire function to raw pointers. Mixing raw
pointers and handles is dangerous.

[Michael Starzinger, 2017/03/20 09:31:48]

s/function and leave/function or leave/

[Franzi, 2017/03/20 15:38:39]

Done.

+  if (!function_name->IsString()) {
+    UNREACHABLE();
+  }
+
   Handle<Name> type = Object::TypeOf(isolate, value);
   if (value->IsJSReceiver()) {
     Handle<JSReceiver> object = Handle<JSReceiver>::cast(value);
     type = JSReceiver::GetConstructorName(object);
   }
 
   CollectTypeProfileNexus nexus(vector, vector->ToSlot(index));
   nexus.Collect(type);
 
-  PrintF("%s\n", name->ToCString().get());
-  nexus.Print();
-  PrintF("\n");
+  if (position->value() >= 0) {
+    PrintF("Function: %s, position: %d, expression: %s\n",
+           String::cast(function_name)->ToCString().get(), position->value(),
+           name->ToCString().get());
+    nexus.Print();
+    PrintF("\n");
+  }
 
-  return *name;
+  return *position;
 }
 
 // Return property without being observable by accessors or interceptors.
 RUNTIME_FUNCTION(Runtime_GetDataProperty) {
   HandleScope scope(isolate);
   DCHECK_EQ(2, args.length());
   CONVERT_ARG_HANDLE_CHECKED(JSReceiver, object, 0);
   CONVERT_ARG_HANDLE_CHECKED(Name, name, 1);
   return *JSReceiver::GetDataProperty(object, name);
 }
@@ skipping 293 matching lines @@
   if (!success) return isolate->heap()->exception();
   MAYBE_RETURN(
       JSReceiver::CreateDataProperty(&it, value, Object::THROW_ON_ERROR),
       isolate->heap()->exception());
   return *value;
 }
 
 
 }  // namespace internal
 }  // namespace v8