--debug-code: sanity-checking instrumentation for Lithium object accesses

src/objects.h

Index: src/objects.h
diff --git a/src/objects.h b/src/objects.h
index bf7f67d22af9cb8bc4820bafc7bdbeffde17f91e..9be6fd5d81aff1a6b462fb4da7247b3761d5ea98 100644
--- a/src/objects.h
+++ b/src/objects.h
@@ -376,6 +376,9 @@ const int kStubMinorKeyBits = kBitsPerInt - kSmiTagSize - kStubMajorKeyBits;
   V(FIXED_FLOAT64_ARRAY_TYPE)                                                  \
   V(FIXED_UINT8_CLAMPED_ARRAY_TYPE)                                            \
                                                                                \
+  V(FIXED_DOUBLE_ARRAY_TYPE)                                                   \
+  V(FIXED_ARRAY_TYPE)                                                          \
+                                                                               \
   V(FILLER_TYPE)                                                               \
                                                                                \
   V(DECLARED_ACCESSOR_DESCRIPTOR_TYPE)                                         \
@@ -398,8 +401,6 @@ const int kStubMinorKeyBits = kBitsPerInt - kSmiTagSize - kStubMajorKeyBits;
   V(ALIASED_ARGUMENTS_ENTRY_TYPE)                                              \
   V(BOX_TYPE)                                                                  \
                                                                                \
-  V(FIXED_ARRAY_TYPE)                                                          \
-  V(FIXED_DOUBLE_ARRAY_TYPE)                                                   \
   V(CONSTANT_POOL_ARRAY_TYPE)                                                  \
   V(SHARED_FUNCTION_INFO_TYPE)                                                 \
                                                                                \
@@ -681,8 +682,10 @@ enum InstanceType {
   FOREIGN_TYPE,
   BYTE_ARRAY_TYPE,
   FREE_SPACE_TYPE,
+  FILLER_TYPE,
 
-  EXTERNAL_INT8_ARRAY_TYPE,  // FIRST_EXTERNAL_ARRAY_TYPE
+  EXTERNAL_INT8_ARRAY_TYPE,  // FIRST_EXTERNAL_ARRAY_TYPE,
+                             // FIRST_FIXED_ARRAY_TYPE
   EXTERNAL_UINT8_ARRAY_TYPE,
   EXTERNAL_INT16_ARRAY_TYPE,
   EXTERNAL_UINT16_ARRAY_TYPE,
@@ -702,8 +705,8 @@ enum InstanceType {
   FIXED_FLOAT64_ARRAY_TYPE,
   FIXED_UINT8_CLAMPED_ARRAY_TYPE,  // LAST_FIXED_TYPED_ARRAY_TYPE
 
-  FIXED_DOUBLE_ARRAY_TYPE,
-  FILLER_TYPE,  // LAST_DATA_TYPE
+  FIXED_DOUBLE_ARRAY_TYPE,  // LAST_DATA_TYPE
+  FIXED_ARRAY_TYPE,  // LAST_FIXED_ARRAY_TYPE
 
   // Structs.
   DECLARED_ACCESSOR_DESCRIPTOR_TYPE,
@@ -728,7 +731,6 @@ enum InstanceType {
   DEBUG_INFO_TYPE,
   BREAK_POINT_INFO_TYPE,
 
-  FIXED_ARRAY_TYPE,
   CONSTANT_POOL_ARRAY_TYPE,
   SHARED_FUNCTION_INFO_TYPE,
 
@@ -779,8 +781,11 @@ enum InstanceType {
   // Boundaries for testing for a fixed typed array.
   FIRST_FIXED_TYPED_ARRAY_TYPE = FIXED_INT8_ARRAY_TYPE,
   LAST_FIXED_TYPED_ARRAY_TYPE = FIXED_UINT8_CLAMPED_ARRAY_TYPE,
+  // Boundaries for testing (regular, typed, external) typed arrays.
+  FIRST_FIXED_ARRAY_TYPE = EXTERNAL_INT8_ARRAY_TYPE,
+  LAST_FIXED_ARRAY_TYPE = FIXED_ARRAY_TYPE,
   // Boundary for promotion to old data space/old pointer space.
-  LAST_DATA_TYPE = FILLER_TYPE,
+  LAST_DATA_TYPE = FIXED_DOUBLE_ARRAY_TYPE,
   // Boundary for objects represented as JSReceiver (i.e. JSObject or JSProxy).
   // Note that there is no range for JSObject or JSProxy, since their subtypes
   // are not continuous in this enum! The enum ranges instead reflect the
@@ -1183,6 +1188,7 @@ template <class C> inline bool Is(Object* obj);
     "Not enough spill slots for OSR")                                         \
   V(kNotEnoughVirtualRegistersRegalloc,                                       \
     "Not enough virtual registers (regalloc)")                                \
+  V(kObjectAccessCheckFailed, "HObjectAccess check failed")                   \
   V(kObjectFoundInSmiOnlyArray, "Object found in smi-only array")             \
   V(kObjectLiteralWithComplexProperty,                                        \
     "Object literal with complex property")                                   \
@@ -6319,6 +6325,10 @@ class Map: public HeapObject {
         || elements_kind() == SLOPPY_ARGUMENTS_ELEMENTS;
   }
 
+  inline bool has_elements() {
+    return static_cast<uint32_t>(instance_type()) >= FIRST_JS_OBJECT_TYPE;

[Igor Sheludko, 2014/06/05 09:04:30]

I think you can use IsJSObjectMap() predicate here and probably in all other
places where we do similar instance type comparison.

[Jakob Kummerow, 2014/06/05 14:33:31]

Done. Thanks for the pointer :-)

+  }
+
   static bool IsValidElementsTransition(ElementsKind from_kind,
                                         ElementsKind to_kind);