Put the type feedback vector in the unoptimized JavaScript frame.

src/deoptimizer.cc

Index: src/deoptimizer.cc
diff --git a/src/deoptimizer.cc b/src/deoptimizer.cc
index 665279a0ad3beece2b60851d35f93be1aea78c5e..901330c0892288421dae8d860f105355108a4c12 100644
--- a/src/deoptimizer.cc
+++ b/src/deoptimizer.cc
@@ -123,7 +123,8 @@ int Deoptimizer::ConvertJSFrameIndexToFrameIndex(int jsframe_index) {
   int frame_index = 0;
   while (jsframe_index >= 0) {
     FrameDescription* frame = output_[frame_index];
-    if (frame->GetFrameType() == StackFrame::JAVA_SCRIPT) {
+    if (frame->GetFrameType() == StackFrame::JAVA_SCRIPT ||
+        frame->GetFrameType() == StackFrame::OPTIMIZED) {
       jsframe_index--;
     }
     frame_index++;
@@ -599,9 +600,8 @@ Deoptimizer::Deoptimizer(Isolate* isolate,
   }
 #endif
 
-  StackFrame::Type frame_type = function == NULL
-      ? StackFrame::STUB
-      : StackFrame::JAVA_SCRIPT;
+  StackFrame::Type frame_type =
+      function == NULL ? StackFrame::STUB : StackFrame::OPTIMIZED;
   trace_scope_ = TraceEnabledFor(type, frame_type) ?
       new CodeTracer::Scope(isolate->GetCodeTracer()) : NULL;
 #ifdef DEBUG
@@ -887,7 +887,7 @@ void Deoptimizer::DoComputeJSFrame(TranslationIterator* iterator,
 
   // The 'fixed' part of the frame consists of the incoming parameters and
   // the part described by JavaScriptFrameConstants.
-  unsigned fixed_frame_size = ComputeFixedSize(function);
+  unsigned fixed_frame_size = ComputeFixedSize(function, true);
   unsigned input_frame_size = input_->GetFrameSize();
   unsigned output_frame_size = height_in_bytes + fixed_frame_size;
 
@@ -917,10 +917,10 @@ void Deoptimizer::DoComputeJSFrame(TranslationIterator* iterator,
     // 2 = context and function in the frame.
     // If the optimized frame had alignment padding, adjust the frame pointer
     // to point to the new position of the old frame pointer after padding
-    // is removed. Subtract 2 * kPointerSize for the context and function slots.
+    // is removed. Subtract the fixed frame size.
     top_address = input_->GetRegister(fp_reg.code()) -
-        StandardFrameConstants::kFixedFrameSizeFromFp -
-        height_in_bytes + has_alignment_padding_ * kPointerSize;
+                  JavaScriptFrameConstants::kUnoptimizedFixedFrameSizeFromFp -
+                  height_in_bytes + has_alignment_padding_ * kPointerSize;
   } else {
     top_address = output_[frame_index - 1]->GetTop() - output_frame_size;
   }
@@ -1054,6 +1054,18 @@ void Deoptimizer::DoComputeJSFrame(TranslationIterator* iterator,
            top_address + output_offset, output_offset, value);
   }
 
+  // The type feedback vector must be retrieved from the function, as it's
+  // not available in the input frame.
+  output_offset -= kPointerSize;
+  TypeFeedbackVector* vector = function->shared()->feedback_vector();
+  value = reinterpret_cast<intptr_t>(vector);
+  output_frame->SetFrameSlot(output_offset, value);
+  if (trace_scope_ != NULL) {
+    PrintF(trace_scope_->file(),
+           "    0x%08" V8PRIxPTR ": [top + %d] <- 0x%08" V8PRIxPTR "; vector\n",
+           top_address + output_offset, output_offset, value);
+  }
+
   // Translate the rest of the frame.
   for (unsigned i = 0; i < height; ++i) {
     output_offset -= kPointerSize;
@@ -2710,11 +2722,14 @@ unsigned Deoptimizer::ComputeInputFrameSize() const {
 }
 
 
-unsigned Deoptimizer::ComputeFixedSize(JSFunction* function) const {
+unsigned Deoptimizer::ComputeFixedSize(JSFunction* function,
+                                       bool unoptimized_frame) const {
   // The fixed part of the frame consists of the return address, frame
   // pointer, function, context, and all the incoming arguments.
   return ComputeIncomingArgumentSize(function) +
-      StandardFrameConstants::kFixedFrameSize;
+         (unoptimized_frame
+              ? JavaScriptFrameConstants::kUnoptimizedFixedFrameSize
+              : StandardFrameConstants::kFixedFrameSize);
 }
 
 
@@ -2840,8 +2855,12 @@ FrameDescription::FrameDescription(uint32_t frame_size,
 
 
 int FrameDescription::ComputeFixedSize() {
-  return StandardFrameConstants::kFixedFrameSize +
-      (ComputeParametersCount() + 1) * kPointerSize;
+  // Full-code javascript frames have a type feedback vector.
+  const int fixed_size =
+      type_ == StackFrame::JAVA_SCRIPT
+          ? JavaScriptFrameConstants::kUnoptimizedFixedFrameSize
+          : StandardFrameConstants::kFixedFrameSize;
+  return fixed_size + (ComputeParametersCount() + 1) * kPointerSize;
 }
 
 
@@ -2862,6 +2881,7 @@ unsigned FrameDescription::GetOffsetFromSlotIndex(int slot_index) {
 
 int FrameDescription::ComputeParametersCount() {
   switch (type_) {
+    case StackFrame::OPTIMIZED:
     case StackFrame::JAVA_SCRIPT:
       return function_->shared()->internal_formal_parameter_count();
     case StackFrame::ARGUMENTS_ADAPTOR: {
@@ -2888,14 +2908,14 @@ Object* FrameDescription::GetParameter(int index) {
 
 
 unsigned FrameDescription::GetExpressionCount() {
-  CHECK_EQ(StackFrame::JAVA_SCRIPT, type_);
+  CHECK(type_ == StackFrame::JAVA_SCRIPT || type_ == StackFrame::OPTIMIZED);

[Jarin, 2015/02/26 09:22:06]

I am quite confused about how we could get StackFrame::OPTIMIZED here as this
method should only be called for output (i.e., unoptimized) frames. The same
goes for ComputeParametersCount and GetExpression.

[mvstanton, 2015/03/20 12:21:09]

Good point, I've fixed it. That change came out of a kind of dogmatic
refactoring to tolerate StackFrame::OPTIMIZED at downwind locations. 

However, ComputeParametersCount() still needs the check. The reason is that even
though it's nonsensical to examine "expressions" in an optimized frame, it does
happen that we want to know the parameters translation for them. A
FrameDescription is created for the optimized input frame on deoptimization, and
we call ComputeParamersCount() on it.

   unsigned size = GetFrameSize() - ComputeFixedSize();
   return size / kPointerSize;
 }
 
 
 Object* FrameDescription::GetExpression(int index) {
-  DCHECK_EQ(StackFrame::JAVA_SCRIPT, type_);
+  DCHECK(type_ == StackFrame::JAVA_SCRIPT || type_ == StackFrame::OPTIMIZED);
   unsigned offset = GetOffsetFromSlotIndex(index);
   return reinterpret_cast<Object*>(*GetFrameSlotPointer(offset));
 }