[tests] Fix mjsunit/getters-on-elements

test/mjsunit/getters-on-elements.js

 // Copyright 2011 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 70 matching lines @@
   var calls = 0;
 
   // Testcase: setter in prototype chain
   foo = function(a) { var x = a[0]; return x + 3; }
   var a = create_func();
   var ap = [];
   ap.__defineGetter__(0, function() { calls++; return 0; });
 
   foo(a);
   assertUnoptimized(foo);
+  // Smi and Double elements transition the KeyedLoadIC to Generic state
+  // here, because they miss twice with the same map when loading the hole.
+  // For FAST_HOLEY_ELEMENTS, however, the IC knows how to convert the hole
+  // to undefined if the prototype is the original array prototype, so it
+  // stays monomorphic for now...
   foo(a);
   foo(a);
   delete a[0];
 
   assertEquals(0, calls);
   a.__proto__ = ap;
+  // ...and later becomes polymorphic when it sees a second map. Optimized
+  // code will therefore inline the elements access, and deopt right away
+  // when it loads the hole from index [0].
+  // Possible solutions:
+  // - remove the convert_hole_to_undefined flag from the IC, to force it
+  //   into generic state for all elements kinds. Cost: slower ICs in code
+  //   that doesn't get optimized.
+  // - teach Turbofan about the same trick: for holey elements with the
+  //   original array prototype, convert hole to undefined inline. Cost:
+  //   larger optimized code size, because the loads for different maps with
+  //   the same elements kind can no longer be consolidated if they handle
+  //   the hole differently.
+  // - call "foo" twice after setting a.__proto__ and before optimizing it;
+  //   this is the simplest fix so let's do that for now.
   foo(a);
   assertEquals(1, calls);
+  foo(a);
+  assertEquals(2, calls);
   optimize(foo);
   foo(a);
-  assertEquals(2, calls);
+  assertEquals(3, calls);
   assertOptimized(foo);
 
   // Testcase: getter "deep" in prototype chain.
   clearFunctionTypeFeedback(foo);
   deoptimizeFunction(foo);
   clearFunctionTypeFeedback(foo);
   calls = 0;
 
   a = create_func();
   var ap2 = [];
@@ skipping 110 matching lines @@
 optimize(fun);
 fun(a);
 assertOptimized(fun);
 
 var calls = 0;
 delete a[0];
 ap.__defineGetter__(0, function() { calls++; return 0; });
 fun(a);
 assertEquals(1, calls);
 assertUnoptimized(fun);