Rewrite StoreIC handling using the LookupIterator. Continued from patch 494153002

src/lookup.cc

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/v8.h"
 
 #include "src/bootstrapper.h"
 #include "src/deoptimizer.h"
 #include "src/lookup.h"
 #include "src/lookup-inl.h"
@@ skipping 39 matching lines @@
 }
 
 
 Handle<Map> LookupIterator::GetReceiverMap() const {
   Handle<Object> receiver = GetReceiver();
   if (receiver->IsNumber()) return isolate_->factory()->heap_number_map();
   return handle(Handle<HeapObject>::cast(receiver)->map());
 }
 
 
+Handle<JSObject> LookupIterator::GetStoreTarget() const {
+  Handle<JSObject> receiver = Handle<JSObject>::cast(GetReceiver());
+
+  if (receiver->IsJSGlobalProxy()) {
+    PrototypeIterator iter(isolate(), receiver);
+    if (iter.IsAtEnd()) return receiver;
+    return Handle<JSGlobalObject>::cast(PrototypeIterator::GetCurrent(iter));
+  }
+  return receiver;
+}
+
+
 bool LookupIterator::IsBootstrapping() const {
   return isolate_->bootstrapper()->IsActive();
 }
 
 
 bool LookupIterator::HasAccess(v8::AccessType access_type) const {
   DCHECK_EQ(ACCESS_CHECK, state_);
   DCHECK(is_guaranteed_to_have_holder());
   return isolate_->MayNamedAccess(GetHolder<JSObject>(), name_, access_type);
 }
@@ skipping 13 matching lines @@
     if (holder->IsGlobalObject() &&
         (property_details_.IsDeleted() || FetchValue()->IsTheHole())) {
       return false;
     }
   } else {
     // Can't use descriptor_number() yet because has_property_ is still false.
     property_details_ =
         holder_map_->instance_descriptors()->GetDetails(number_);
   }
 
+  LoadPropertyKind();
+
+  has_property_ = true;
+  return true;
+}
+
+
+void LookupIterator::LoadPropertyKind() {
   switch (property_details_.type()) {
     case v8::internal::FIELD:
     case v8::internal::NORMAL:
     case v8::internal::CONSTANT:
       property_kind_ = DATA;
       break;
     case v8::internal::CALLBACKS:
       property_kind_ = ACCESSOR;
       break;
     case v8::internal::HANDLER:
     case v8::internal::INTERCEPTOR:
       UNREACHABLE();
   }
-
-  has_property_ = true;
-  return true;
 }
 
 
 void LookupIterator::ReloadPropertyInformation() {
   state_ = BEFORE_PROPERTY;
   state_ = LookupInHolder(*holder_map_);
   DCHECK(IsFound());
   HasProperty();
 }
 
@@ skipping 22 matching lines @@
 
   if (holder_map_->is_dictionary_map()) {
     PropertyDetails details(attributes, NORMAL, 0);
     JSObject::SetNormalizedProperty(holder, name(), value, details);
   }
 
   ReloadPropertyInformation();
 }
 
 
-void LookupIterator::TransitionToDataProperty(
+void LookupIterator::PrepareTransitionToDataProperty(
     Handle<Object> value, PropertyAttributes attributes,
     Object::StoreFromKeyed store_mode) {
-  DCHECK(!has_property_ || !HolderIsReceiverOrHiddenPrototype());
+  if (state_ == TRANSITION) return;
+  DCHECK(!has_property_ || property_kind_ != ACCESSOR);
+  DCHECK(!(has_property_ || state_ == JSPROXY) ||
+         !HolderIsReceiverOrHiddenPrototype());
 
   // Can only be called when the receiver is a JSObject. JSProxy has to be
   // handled via a trap. Adding properties to primitive values is not
   // observable.
-  Handle<JSObject> receiver = Handle<JSObject>::cast(GetReceiver());
+  Handle<JSObject> receiver = GetStoreTarget();
 
-  if (receiver->IsJSGlobalProxy()) {
-    PrototypeIterator iter(isolate(), receiver);
-    receiver =
-        Handle<JSGlobalObject>::cast(PrototypeIterator::GetCurrent(iter));
+  if (!name().is_identical_to(isolate()->factory()->hidden_string()) &&
+      !receiver->map()->is_extensible()) {
+    return;
   }
 
+  transition_map_ = Map::TransitionToDataProperty(
+      handle(receiver->map()), name_, value, attributes, store_mode);
+  state_ = TRANSITION;
+}
+
+
+void LookupIterator::ApplyTransitionToDataProperty() {
+  DCHECK_EQ(TRANSITION, state_);
+
+  Handle<JSObject> receiver = GetStoreTarget();
   maybe_holder_ = receiver;
-  holder_map_ = Map::TransitionToDataProperty(handle(receiver->map()), name_,
-                                              value, attributes, store_mode);
+  holder_map_ = transition_map_;
   JSObject::MigrateToMap(receiver, holder_map_);
-
   ReloadPropertyInformation();
 }
 
 
 void LookupIterator::TransitionToAccessorProperty(
     AccessorComponent component, Handle<Object> accessor,
     PropertyAttributes attributes) {
   DCHECK(!accessor->IsNull());
   // Can only be called when the receiver is a JSObject. JSProxy has to be
   // handled via a trap. Adding properties to primitive values is not
   // observable.
-  Handle<JSObject> receiver = Handle<JSObject>::cast(GetReceiver());
-
-  if (receiver->IsJSGlobalProxy()) {
-    PrototypeIterator iter(isolate(), receiver);
-    receiver =
-        Handle<JSGlobalObject>::cast(PrototypeIterator::GetCurrent(iter));
-  }
-
+  Handle<JSObject> receiver = GetStoreTarget();
   maybe_holder_ = receiver;
   holder_map_ = Map::TransitionToAccessorProperty(
       handle(receiver->map()), name_, component, accessor, attributes);
   JSObject::MigrateToMap(receiver, holder_map_);
 
   ReloadPropertyInformation();
 
   if (!holder_map_->is_dictionary_map()) return;
 
   // We have to deoptimize since accesses to data properties may have been
@@ skipping 96 matching lines @@
   DCHECK(has_property_);
   DCHECK_EQ(DESCRIPTOR, property_encoding_);
   DCHECK_EQ(v8::internal::FIELD, property_details_.type());
   int index =
       holder_map()->instance_descriptors()->GetFieldIndex(descriptor_number());
   bool is_double = representation().IsDouble();
   return FieldIndex::ForPropertyIndex(*holder_map(), index, is_double);
 }
 
 
+Handle<HeapType> LookupIterator::GetFieldType() const {
+  DCHECK(has_property_);
+  DCHECK_EQ(DESCRIPTOR, property_encoding_);
+  DCHECK_EQ(v8::internal::FIELD, property_details_.type());
+  return handle(
+      holder_map()->instance_descriptors()->GetFieldType(descriptor_number()),
+      isolate_);
+}
+
+
 Handle<PropertyCell> LookupIterator::GetPropertyCell() const {
   Handle<JSObject> holder = GetHolder<JSObject>();
   Handle<GlobalObject> global = Handle<GlobalObject>::cast(holder);
   Object* value = global->property_dictionary()->ValueAt(dictionary_entry());
   return Handle<PropertyCell>(PropertyCell::cast(value));
 }
 
 
 Handle<Object> LookupIterator::GetAccessors() const {
   DCHECK(has_property_);
@@ skipping 29 matching lines @@
     DCHECK_EQ(v8::internal::CONSTANT, property_details_.type());
   }
 }
 
 
 void LookupIterator::InternalizeName() {
   if (name_->IsUniqueName()) return;
   name_ = factory()->InternalizeString(Handle<String>::cast(name_));
 }
 } }  // namespace v8::internal