CallIC must update type feedback info correctly.

src/ic.cc

Index: src/ic.cc
diff --git a/src/ic.cc b/src/ic.cc
index bd8db3e01af8bda046cff075238be2c522597304..ec91d978631f32740014cce8f89da625e8c78246 100644
--- a/src/ic.cc
+++ b/src/ic.cc
@@ -376,11 +376,11 @@ void IC::PostPatching(Address address, Code* target, Code* old_target) {
       inner_pointer_to_code_cache()->GetCacheEntry(address)->code;
   if (host->kind() != Code::FUNCTION) return;
 
+  // Type vector based ICs update these statistics differently.
+  if (target->kind() == Code::CALL_IC) return;
+
   if (FLAG_type_info_threshold > 0 && old_target->is_inline_cache_stub() &&
       target->is_inline_cache_stub() &&
-      // Call ICs don't have interesting state changes from this point
-      // of view.
-      target->kind() != Code::CALL_IC &&
       // Not all Code objects have TypeFeedbackInfo.
       host->type_feedback_info()->IsTypeFeedbackInfo()) {
     int polymorphic_delta = 0;  // "Polymorphic" here includes monomorphic.
@@ -1920,6 +1920,8 @@ bool CallIC::DoCustomHandler(Handle<Object> receiver,
     }
 
     TRACE_IC("CallIC (Array call)", name);
+    Object* new_feedback = vector->get(slot->value());
+    UpdateTypeFeedbackInfo(feedback, new_feedback);
     return true;
   }
   return false;
@@ -1943,6 +1945,49 @@ void CallIC::PatchMegamorphic(Handle<FixedArray> vector,
 }
 
 
+IC::State CallIC::FeedbackObjectToState(Object* feedback) {
+  IC::State state = UNINITIALIZED;
+
+  if (feedback == *TypeFeedbackInfo::MegamorphicSentinel(isolate())) {
+    state = GENERIC;
+  } else if (feedback->IsAllocationSite() || feedback->IsJSFunction()) {
+    state = MONOMORPHIC;
+  } else {
+    CHECK(feedback == *TypeFeedbackInfo::UninitializedSentinel(isolate()));
+  }
+
+  return state;
+}
+
+
+void CallIC::UpdateTypeFeedbackInfo(Object* old_feedback, Object* new_feedback) {

[Jakob Kummerow, 2014/08/06 14:49:09]

nit: 80col

[mvstanton, 2014/08/06 15:32:33]

Done.

+  // Convert old_feedback to an IC_State enum:

[Jakob Kummerow, 2014/08/06 14:49:09]

This comment seems to belong to line 1971, but I don't think it adds much value,
so feel free to just drop it.

[mvstanton, 2014/08/06 15:32:33]

Done.

+  Code* host = isolate()->

[Jakob Kummerow, 2014/08/06 14:49:09]

Idea for reducing code duplication: pull out most of this method (except for
lines 1971, 1972) into a helper with signature (Address*, IC::State old_state,
IC::State new_state).

The drawback is that you'll have to compute the states before you know whether
you'll need them; but that should be fairly cheap, and at least some of the
computations can be avoided: callers of this method know the new_state in many
(all?) cases, e.g. for vector->set(...MegamorphicSentinel...).

[mvstanton, 2014/08/06 15:32:33]

Excellent idea, done. I think the cost of computing a state var is very cheap.

+      inner_pointer_to_code_cache()->GetCacheEntry(address())->code;
+  if (host->kind() != Code::FUNCTION) return;
+
+  if (FLAG_type_info_threshold > 0 &&
+      host->type_feedback_info()->IsTypeFeedbackInfo()) {
+    IC::State old_state = FeedbackObjectToState(old_feedback);
+    IC::State new_state = FeedbackObjectToState(new_feedback);
+    int polymorphic_delta = 0;  // "Polymorphic" here includes monomorphic.
+    int generic_delta = 0;      // "Generic" here includes megamorphic.
+    ComputeTypeInfoCountDelta(old_state, new_state,
+                              &polymorphic_delta, &generic_delta);
+    TypeFeedbackInfo* info = TypeFeedbackInfo::cast(host->type_feedback_info());
+    info->change_ic_with_type_info_count(polymorphic_delta);
+    info->change_ic_generic_count(generic_delta);
+  }
+  if (host->type_feedback_info()->IsTypeFeedbackInfo()) {
+    TypeFeedbackInfo* info =
+        TypeFeedbackInfo::cast(host->type_feedback_info());
+    info->change_own_type_change_checksum();
+  }
+  host->set_profiler_ticks(0);
+  isolate()->runtime_profiler()->NotifyICChanged();
+}
+
+
 void CallIC::HandleMiss(Handle<Object> receiver,
                         Handle<Object> function,
                         Handle<FixedArray> vector,
@@ -1981,6 +2026,9 @@ void CallIC::HandleMiss(Handle<Object> receiver,
     TRACE_IC("CallIC", name);
     vector->set(slot->value(), *function);
   }
+
+  Object* new_feedback = vector->get(slot->value());
+  UpdateTypeFeedbackInfo(feedback, new_feedback);
 }