Add a soft-deopt in keyed element access when current IC is pre-monomorphic and no type feedback wa…

src/ic.cc

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 845 matching lines @@
         stub = string_length_stub.GetCode(isolate());
       } else if (state() != MEGAMORPHIC) {
         ASSERT(state() != GENERIC);
         stub = megamorphic_stub();
       }
       if (!stub.is_null()) {
         set_target(*stub);
 #ifdef DEBUG
         if (FLAG_trace_ic) PrintF("[LoadIC : +#length /stringwrapper]\n");
 #endif
+      } else if (kind() == Code::KEYED_LOAD_IC) {
+        set_target(*generic_stub());
+        TRACE_GENERIC_IC(isolate(), "KeyedLoadIC", "access check needed");

[danno, 2013/10/22 14:52:24]

change comment appropriately

       }
       // Get the string if we have a string wrapper object.
       String* string = String::cast(JSValue::cast(*object)->value());
       return Smi::FromInt(string->length());
     }
 
     // Use specialized code for getting prototype of functions.
     if (object->IsJSFunction() &&
         name->Equals(isolate()->heap()->prototype_string()) &&
         Handle<JSFunction>::cast(object)->should_have_prototype()) {
       Handle<Code> stub;
       if (state() == UNINITIALIZED) {
         stub = pre_monomorphic_stub();
       } else if (state() == PREMONOMORPHIC) {
         FunctionPrototypeStub function_prototype_stub(kind());
         stub = function_prototype_stub.GetCode(isolate());
       } else if (state() != MEGAMORPHIC) {
         ASSERT(state() != GENERIC);
         stub = megamorphic_stub();
       }
       if (!stub.is_null()) {
         set_target(*stub);
 #ifdef DEBUG
         if (FLAG_trace_ic) PrintF("[LoadIC : +#prototype /function]\n");
 #endif
+      } else if (kind() == Code::KEYED_LOAD_IC) {
+        set_target(*generic_stub());
+        TRACE_GENERIC_IC(isolate(), "KeyedLoadIC", "access check needed");

[danno, 2013/10/22 14:52:24]

change comment appropriately

       }
       return *Accessors::FunctionGetPrototype(Handle<JSFunction>::cast(object));
     }
   }
 
   // Check if the name is trivially convertible to an index and get
   // the element or char if so.
   uint32_t index;
   if (kind() == Code::KEYED_LOAD_IC && name->AsArrayIndex(&index)) {
     // Rewrite to the generic keyed load stub.
@@ skipping 214 matching lines @@
     KeyedLoadFieldStub stub(inobject, offset, representation);
     return stub.GetCode(isolate());
   }
 }
 
 void LoadIC::UpdateCaches(LookupResult* lookup,
                           Handle<Object> object,
                           Handle<String> name) {
   // TODO(verwaest): It would be nice to support loading fields from smis as
   // well. For now just fail to update the cache.
-  if (!object->IsHeapObject()) return;
+  if (!object->IsHeapObject()) {
+    if (kind() == Code::KEYED_LOAD_IC) {
+      set_target(*generic_stub());
+      TRACE_GENERIC_IC(isolate(), "KeyedLoadIC", "access check needed");

[danno, 2013/10/22 14:52:24]

comment should be: not heap object

+    }
+    return;
+  }
 
   Handle<HeapObject> receiver = Handle<HeapObject>::cast(object);
 
   Handle<Code> code;
   if (state() == UNINITIALIZED) {
     // This is the first time we execute this inline cache.
     // Set the target to the pre monomorphic stub to delay
     // setting the monomorphic state.
     code = pre_monomorphic_stub();
   } else if (!lookup->IsCacheable()) {
@@ skipping 228 matching lines @@
   }
 
   // Check for values that can be converted into an internalized string directly
   // or is representable as a smi.
   key = TryConvertKey(key, isolate());
 
   if (key->IsInternalizedString()) {
     return LoadIC::Load(object, Handle<String>::cast(key));
   }
 
-  if (FLAG_use_ic && !object->IsAccessCheckNeeded()) {
-    ASSERT(!object->IsJSGlobalProxy());
+  if (FLAG_use_ic) {
     Handle<Code> stub = generic_stub();
-    if (miss_mode == MISS_FORCE_GENERIC) {
-      TRACE_GENERIC_IC(isolate(), "KeyedLoadIC", "force generic");
-    } else if (object->IsString() && key->IsNumber()) {
-      if (state() == UNINITIALIZED) stub = string_stub();
-    } else if (object->IsJSObject()) {
-      Handle<JSObject> receiver = Handle<JSObject>::cast(object);
-      if (receiver->elements()->map() ==
-          isolate()->heap()->non_strict_arguments_elements_map()) {
-        stub = non_strict_arguments_stub();
-      } else if (receiver->HasIndexedInterceptor()) {
-        stub = indexed_interceptor_stub();
-      } else if (!key->ToSmi()->IsFailure() &&
-                 (!target().is_identical_to(non_strict_arguments_stub()))) {
-        stub = LoadElementStub(receiver);
+    if (!object->IsAccessCheckNeeded()) {
+      ASSERT(!object->IsJSGlobalProxy());
+      if (miss_mode == MISS_FORCE_GENERIC) {
+        TRACE_GENERIC_IC(isolate(), "KeyedLoadIC", "force generic");
+      } else if (object->IsString() && key->IsNumber()) {
+        if (state() == UNINITIALIZED) stub = string_stub();
+      } else if (object->IsJSObject()) {
+        Handle<JSObject> receiver = Handle<JSObject>::cast(object);
+        if (receiver->elements()->map() ==
+            isolate()->heap()->non_strict_arguments_elements_map()) {
+          stub = non_strict_arguments_stub();
+        } else if (receiver->HasIndexedInterceptor()) {
+          stub = indexed_interceptor_stub();
+        } else if (!key->ToSmi()->IsFailure() &&
+                   (!target().is_identical_to(non_strict_arguments_stub()))) {
+          stub = LoadElementStub(receiver);
+        } else {
+          TRACE_GENERIC_IC(isolate(), "KeyedLoadIC", "access check needed");

[danno, 2013/10/22 14:52:24]

Should be: "not otherwise handled"

+        }
+      } else {
+         TRACE_GENERIC_IC(isolate(), "KeyedLoadIC", "access check needed");

[danno, 2013/10/22 14:52:24]

should be: "not JSObject"

       }
+    } else {
+      TRACE_GENERIC_IC(isolate(), "KeyedLoadIC", "access check needed");
     }
-
     ASSERT(!stub.is_null());
     set_target(*stub);
     TRACE_IC("LoadIC", key);
   }
 
-
   return Runtime::GetObjectPropertyOrFail(isolate(), object, key);
 }
 
 
 static bool LookupForWrite(Handle<JSObject> receiver,
                            Handle<String> name,
                            Handle<Object> value,
                            LookupResult* lookup,
                            IC* ic) {
   Handle<JSObject> holder = receiver;
@@ skipping 145 matching lines @@
   }
   if (FLAG_use_ic) {
     if (state() == UNINITIALIZED) {
       Handle<Code> stub = pre_monomorphic_stub();
       set_target(*stub);
       TRACE_IC("StoreIC", name);
     } else if (can_store) {
       UpdateCaches(&lookup, receiver, name, value);
     } else if (!name->IsCacheable(isolate()) ||
                lookup.IsNormal() ||
-               (lookup.IsField() && lookup.CanHoldValue(value))) {
-      Handle<Code> stub = generic_stub();
-      set_target(*stub);
+               (lookup.IsField() && lookup.CanHoldValue(value)) ||
+               kind() == Code::KEYED_STORE_IC) {
+      set_target(*generic_stub());
+      TRACE_GENERIC_IC(isolate(), "KeyedStoreIC", "access check needed");
+      TRACE_IC("StoreIC", name);
     }
   }
 
   // Set the property.
   Handle<Object> result = JSReceiver::SetProperty(
       receiver, name, value, NONE, strict_mode(), store_mode);
   RETURN_IF_EMPTY_HANDLE(isolate(), result);
   return *result;
 }
 
@@ skipping 1135 matching lines @@
 #undef ADDR
 };
 
 
 Address IC::AddressFromUtilityId(IC::UtilityId id) {
   return IC_utilities[id];
 }
 
 
 } }  // namespace v8::internal