Avoid fast short-cut in Map::GeneralizeRepresentation() for literals with non-simple transitions.

src/objects.cc

 // Copyright 2013 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include <sstream>
 
 #include "src/v8.h"
 
 #include "src/accessors.h"
 #include "src/allocation-site-scopes.h"
@@ skipping 2453 matching lines @@
   Handle<DescriptorArray> old_descriptors(
       old_map->instance_descriptors(), isolate);
   int old_nof = old_map->NumberOfOwnDescriptors();
   PropertyDetails old_details = old_descriptors->GetDetails(modify_index);
   Representation old_representation = old_details.representation();
 
   // It's fine to transition from None to anything but double without any
   // modification to the object, because the default uninitialized value for
   // representation None can be overwritten by both smi and tagged values.
   // Doubles, however, would require a box allocation.
-  if (old_representation.IsNone() &&
-      !new_representation.IsNone() &&
-      !new_representation.IsDouble()) {
+  // Note that if the map has transitions that do not share descriptors we
+  // can't use this shortcut because field type and representation must be
+  // updated in all the transitions from this map.
+  if (old_representation.IsNone() && !new_representation.IsNone() &&
+      !new_representation.IsDouble() &&
+      (!old_map->HasTransitionArray() ||
+       old_map->transitions()->IsSimpleTransition())) {

[Toon Verwaest, 2014/11/12 22:52:48]

What about instead updating the fieldtype in the entire tree? There's
infrastructure to do that. Knowing we have a simple transition doesn't guarantee
(I believe) that we are sharing the descriptor array...

[Igor Sheludko, 2014/11/13 10:00:41]

Done, thanks!

     DCHECK(old_details.type() == FIELD);
     DCHECK(old_descriptors->GetFieldType(modify_index)->NowIs(
             HeapType::None()));
     if (FLAG_trace_generalization) {
       old_map->PrintGeneralization(
           stdout, "uninitialized field",
           modify_index, old_map->NumberOfOwnDescriptors(),
           old_map->NumberOfOwnDescriptors(), false,
           old_representation, new_representation,
           old_descriptors->GetFieldType(modify_index), *new_field_type);
@@ skipping 14285 matching lines @@
   Handle<DependentCode> codes =
       DependentCode::Insert(handle(cell->dependent_code(), info->isolate()),
                             DependentCode::kPropertyCellChangedGroup,
                             info->object_wrapper());
   if (*codes != cell->dependent_code()) cell->set_dependent_code(*codes);
   info->dependencies(DependentCode::kPropertyCellChangedGroup)->Add(
       cell, info->zone());
 }
 
 } }  // namespace v8::internal