Add a soft-deopt in keyed element access when current IC is pre-monomorphic and no type feedback wa…

src/ic.cc

Index: src/ic.cc
diff --git a/src/ic.cc b/src/ic.cc
index a6ffb13ad40a84b16073b7d6b8a4bbb43ab7e702..0875147280bce5582929efcfcfdf9b8edab2e12e 100644
--- a/src/ic.cc
+++ b/src/ic.cc
@@ -863,6 +863,9 @@ MaybeObject* LoadIC::Load(Handle<Object> object,
 #ifdef DEBUG
         if (FLAG_trace_ic) PrintF("[LoadIC : +#length /stringwrapper]\n");
 #endif
+      } else if (kind() == Code::KEYED_LOAD_IC) {
+        set_target(*generic_stub());
+        TRACE_GENERIC_IC(isolate(), "KeyedLoadIC", "access check needed");

[danno, 2013/10/22 14:52:24]

change comment appropriately

       }
       // Get the string if we have a string wrapper object.
       String* string = String::cast(JSValue::cast(*object)->value());
@@ -888,6 +891,9 @@ MaybeObject* LoadIC::Load(Handle<Object> object,
 #ifdef DEBUG
         if (FLAG_trace_ic) PrintF("[LoadIC : +#prototype /function]\n");
 #endif
+      } else if (kind() == Code::KEYED_LOAD_IC) {
+        set_target(*generic_stub());
+        TRACE_GENERIC_IC(isolate(), "KeyedLoadIC", "access check needed");

[danno, 2013/10/22 14:52:24]

change comment appropriately

       }
       return *Accessors::FunctionGetPrototype(Handle<JSFunction>::cast(object));
     }
@@ -1122,7 +1128,13 @@ void LoadIC::UpdateCaches(LookupResult* lookup,
                           Handle<String> name) {
   // TODO(verwaest): It would be nice to support loading fields from smis as
   // well. For now just fail to update the cache.
-  if (!object->IsHeapObject()) return;
+  if (!object->IsHeapObject()) {
+    if (kind() == Code::KEYED_LOAD_IC) {
+      set_target(*generic_stub());
+      TRACE_GENERIC_IC(isolate(), "KeyedLoadIC", "access check needed");

[danno, 2013/10/22 14:52:24]

comment should be: not heap object

+    }
+    return;
+  }
 
   Handle<HeapObject> receiver = Handle<HeapObject>::cast(object);
 
@@ -1371,32 +1383,38 @@ MaybeObject* KeyedLoadIC::Load(Handle<Object> object,
     return LoadIC::Load(object, Handle<String>::cast(key));
   }
 
-  if (FLAG_use_ic && !object->IsAccessCheckNeeded()) {
-    ASSERT(!object->IsJSGlobalProxy());
+  if (FLAG_use_ic) {
     Handle<Code> stub = generic_stub();
-    if (miss_mode == MISS_FORCE_GENERIC) {
-      TRACE_GENERIC_IC(isolate(), "KeyedLoadIC", "force generic");
-    } else if (object->IsString() && key->IsNumber()) {
-      if (state() == UNINITIALIZED) stub = string_stub();
-    } else if (object->IsJSObject()) {
-      Handle<JSObject> receiver = Handle<JSObject>::cast(object);
-      if (receiver->elements()->map() ==
-          isolate()->heap()->non_strict_arguments_elements_map()) {
-        stub = non_strict_arguments_stub();
-      } else if (receiver->HasIndexedInterceptor()) {
-        stub = indexed_interceptor_stub();
-      } else if (!key->ToSmi()->IsFailure() &&
-                 (!target().is_identical_to(non_strict_arguments_stub()))) {
-        stub = LoadElementStub(receiver);
+    if (!object->IsAccessCheckNeeded()) {
+      ASSERT(!object->IsJSGlobalProxy());
+      if (miss_mode == MISS_FORCE_GENERIC) {
+        TRACE_GENERIC_IC(isolate(), "KeyedLoadIC", "force generic");
+      } else if (object->IsString() && key->IsNumber()) {
+        if (state() == UNINITIALIZED) stub = string_stub();
+      } else if (object->IsJSObject()) {
+        Handle<JSObject> receiver = Handle<JSObject>::cast(object);
+        if (receiver->elements()->map() ==
+            isolate()->heap()->non_strict_arguments_elements_map()) {
+          stub = non_strict_arguments_stub();
+        } else if (receiver->HasIndexedInterceptor()) {
+          stub = indexed_interceptor_stub();
+        } else if (!key->ToSmi()->IsFailure() &&
+                   (!target().is_identical_to(non_strict_arguments_stub()))) {
+          stub = LoadElementStub(receiver);
+        } else {
+          TRACE_GENERIC_IC(isolate(), "KeyedLoadIC", "access check needed");

[danno, 2013/10/22 14:52:24]

Should be: "not otherwise handled"

+        }
+      } else {
+         TRACE_GENERIC_IC(isolate(), "KeyedLoadIC", "access check needed");

[danno, 2013/10/22 14:52:24]

should be: "not JSObject"

       }
+    } else {
+      TRACE_GENERIC_IC(isolate(), "KeyedLoadIC", "access check needed");
     }
-
     ASSERT(!stub.is_null());
     set_target(*stub);
     TRACE_IC("LoadIC", key);
   }
 
-
   return Runtime::GetObjectPropertyOrFail(isolate(), object, key);
 }
 
@@ -1562,9 +1580,11 @@ MaybeObject* StoreIC::Store(Handle<Object> object,
       UpdateCaches(&lookup, receiver, name, value);
     } else if (!name->IsCacheable(isolate()) ||
                lookup.IsNormal() ||
-               (lookup.IsField() && lookup.CanHoldValue(value))) {
-      Handle<Code> stub = generic_stub();
-      set_target(*stub);
+               (lookup.IsField() && lookup.CanHoldValue(value)) ||
+               kind() == Code::KEYED_STORE_IC) {
+      set_target(*generic_stub());
+      TRACE_GENERIC_IC(isolate(), "KeyedStoreIC", "access check needed");
+      TRACE_IC("StoreIC", name);
     }
   }