Vector-based LoadICs need to handle Smi receivers.

src/code-stubs-hydrogen.cc

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/v8.h"
 
 #include "src/bailout-reason.h"
 #include "src/code-stubs.h"
 #include "src/field-index.h"
 #include "src/hydrogen.h"
@@ skipping 2015 matching lines @@
       receiver, name, slot, vector,
       HTailCallThroughMegamorphicCache::ComputeFlags(keyed_load, true));
   // We never return here, it is a tail call.
 }
 
 
 void CodeStubGraphBuilderBase::HandleArrayCases(HValue* array, HValue* receiver,
                                                 HValue* name, HValue* slot,
                                                 HValue* vector,
                                                 bool keyed_load) {
+  HConstant* constant_two = Add<HConstant>(2);
+  HConstant* constant_three = Add<HConstant>(3);
+
   IfBuilder if_receiver_heap_object(this);
   if_receiver_heap_object.IfNot<HIsSmiAndBranch>(receiver);
   if_receiver_heap_object.Then();
+  Push(AddLoadMap(receiver, nullptr));

[Yang, 2015/01/15 11:33:45]

Don't we usually just use NULL (instead of nullptr)?

[mvstanton, 2015/01/15 12:25:39]

Looks like someone did a refactoring CL a while back that changed this. I
believe the NULLs had a static_cast around them, and this was cleaner. In the
rest of the file we've got "nullptr" for this situation, so I'll leave it.

+  if_receiver_heap_object.Else();
+  HConstant* heap_number_map =
+      Add<HConstant>(isolate()->factory()->heap_number_map());
+  Push(heap_number_map);
+  if_receiver_heap_object.End();
+  HValue* receiver_map = Pop();
+
+  HValue* start =
+      keyed_load ? graph()->GetConstant1() : graph()->GetConstant0();
+  HValue* weak_cell =
+      Add<HLoadKeyed>(array, start, nullptr, FAST_ELEMENTS, ALLOW_RETURN_HOLE);
+  // Load the weak cell value. It may be Smi(0), or a map. Compare nonetheless
+  // against the receiver_map.
+  HValue* array_map = Add<HLoadNamedField>(weak_cell, nullptr,
+                                           HObjectAccess::ForWeakCellValue());
+
+  IfBuilder if_correct_map(this);
+  if_correct_map.If<HCompareObjectEqAndBranch>(receiver_map, array_map);
+  if_correct_map.Then();
+  { TailCallHandler(receiver, name, array, start, slot, vector); }
+  if_correct_map.Else();
   {
-    HConstant* constant_two = Add<HConstant>(2);
-    HConstant* constant_three = Add<HConstant>(3);
-
-    HValue* receiver_map = AddLoadMap(receiver, nullptr);
-    HValue* start =
-        keyed_load ? graph()->GetConstant1() : graph()->GetConstant0();
-    HValue* weak_cell = Add<HLoadKeyed>(array, start, nullptr, FAST_ELEMENTS,
-                                        ALLOW_RETURN_HOLE);
-    // Load the weak cell value. It may be Smi(0), or a map. Compare nonetheless
-    // against the receiver_map.
-    HValue* array_map = Add<HLoadNamedField>(weak_cell, nullptr,
-                                             HObjectAccess::ForWeakCellValue());
-
-    IfBuilder if_correct_map(this);
-    if_correct_map.If<HCompareObjectEqAndBranch>(receiver_map, array_map);
-    if_correct_map.Then();
-    { TailCallHandler(receiver, name, array, start, slot, vector); }
-    if_correct_map.Else();
+    // If our array has more elements, the ic is polymorphic. Look for the
+    // receiver map in the rest of the array.
+    HValue* length = AddLoadFixedArrayLength(array, nullptr);
+    LoopBuilder builder(this, context(), LoopBuilder::kPostIncrement,
+                        constant_two);
+    start = keyed_load ? constant_three : constant_two;
+    HValue* key = builder.BeginBody(start, length, Token::LT);
     {
-      // If our array has more elements, the ic is polymorphic. Look for the
-      // receiver map in the rest of the array.
-      HValue* length = AddLoadFixedArrayLength(array, nullptr);
-      LoopBuilder builder(this, context(), LoopBuilder::kPostIncrement,
-                          constant_two);
-      start = keyed_load ? constant_three : constant_two;
-      HValue* key = builder.BeginBody(start, length, Token::LT);
-      {
-        HValue* weak_cell = Add<HLoadKeyed>(array, key, nullptr, FAST_ELEMENTS,
-                                            ALLOW_RETURN_HOLE);
-        HValue* array_map = Add<HLoadNamedField>(
-            weak_cell, nullptr, HObjectAccess::ForWeakCellValue());
-        IfBuilder if_correct_poly_map(this);
-        if_correct_poly_map.If<HCompareObjectEqAndBranch>(receiver_map,
-                                                          array_map);
-        if_correct_poly_map.Then();
-        { TailCallHandler(receiver, name, array, key, slot, vector); }
-      }
-      builder.EndBody();
+      HValue* weak_cell = Add<HLoadKeyed>(array, key, nullptr, FAST_ELEMENTS,
+                                          ALLOW_RETURN_HOLE);
+      HValue* array_map = Add<HLoadNamedField>(
+          weak_cell, nullptr, HObjectAccess::ForWeakCellValue());
+      IfBuilder if_correct_poly_map(this);
+      if_correct_poly_map.If<HCompareObjectEqAndBranch>(receiver_map,
+                                                        array_map);
+      if_correct_poly_map.Then();
+      { TailCallHandler(receiver, name, array, key, slot, vector); }
     }
-    if_correct_map.End();
+    builder.EndBody();
   }
+  if_correct_map.End();
 }
 
 
 template <>
 HValue* CodeStubGraphBuilder<VectorLoadStub>::BuildCodeStub() {
   HValue* receiver = GetParameter(VectorLoadICDescriptor::kReceiverIndex);
   HValue* name = GetParameter(VectorLoadICDescriptor::kNameIndex);
   HValue* slot = GetParameter(VectorLoadICDescriptor::kSlotIndex);
   HValue* vector = GetParameter(VectorLoadICDescriptor::kVectorIndex);
 
@@ skipping 116 matching lines @@
   // megamorphic case is handled as part of the default stub.
   DCHECK(!FLAG_vector_ics);
 
   // Probe the stub cache.
   Add<HTailCallThroughMegamorphicCache>(receiver, name);
 
   // We never continue.
   return graph()->GetConstant0();
 }
 } }  // namespace v8::internal