Fix polymorphic inlined calls with migrating prototypes

LOG=Y
R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/104793003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18307 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

src/ast.cc

@@ -137,7 +137,6 @@ Assignment::Assignment(Isolate* isolate,
       value_(value),
       binary_operation_(NULL),
       assignment_id_(GetNextId(isolate)),
-      is_monomorphic_(false),
       is_uninitialized_(false),
       is_pre_monomorphic_(false),
       store_mode_(STANDARD_STORE) { }
@@ -742,8 +741,10 @@ void CallNew::RecordTypeFeedback(TypeFeedbackOracle* oracle) {
 
 void ObjectLiteral::Property::RecordTypeFeedback(TypeFeedbackOracle* oracle) {
   TypeFeedbackId id = key()->LiteralFeedbackId();
-  receiver_type_ = oracle->ObjectLiteralStoreIsMonomorphic(id)
-      ? oracle->GetObjectLiteralStoreMap(id) : Handle<Map>::null();
+  SmallMapList maps;
+  oracle->CollectReceiverTypes(id, &maps);
+  receiver_type_ = maps.length() == 1 ? maps.at(0)
+                                      : Handle<Map>::null();
 }
 
 

src/ast.h

@@ -279,9 +279,8 @@ class SmallMapList V8_FINAL {
   int length() const { return list_.length(); }
 
   void AddMapIfMissing(Handle<Map> map, Zone* zone) {
-    Map* updated = map->CurrentMapForDeprecated();
-    if (updated == NULL) return;
-    map = Handle<Map>(updated);
+    map = Map::CurrentMapForDeprecated(map);
+    if (map.is_null()) return;
     for (int i = 0; i < length(); ++i) {
       if (at(i).is_identical_to(map)) return;
     }
@@ -1691,7 +1690,9 @@ class Property V8_FINAL : public Expression {
   bool IsFunctionPrototype() const { return is_function_prototype_; }
 
   // Type feedback information.
-  virtual bool IsMonomorphic() V8_OVERRIDE { return is_monomorphic_; }
+  virtual bool IsMonomorphic() V8_OVERRIDE {
+    return receiver_types_.length() == 1;
+  }
   virtual SmallMapList* GetReceiverTypes() V8_OVERRIDE {
     return &receiver_types_;
   }
@@ -1704,7 +1705,6 @@ class Property V8_FINAL : public Expression {
     return is_uninitialized_ || is_pre_monomorphic_;
   }
   void set_is_uninitialized(bool b) { is_uninitialized_ = b; }
-  void set_is_monomorphic(bool b) { is_monomorphic_ = b; }
   void set_is_pre_monomorphic(bool b) { is_pre_monomorphic_ = b; }
   void set_is_string_access(bool b) { is_string_access_ = b; }
   void set_is_function_prototype(bool b) { is_function_prototype_ = b; }
@@ -1720,7 +1720,6 @@ class Property V8_FINAL : public Expression {
         obj_(obj),
         key_(key),
         load_id_(GetNextId(isolate)),
-        is_monomorphic_(false),
         is_pre_monomorphic_(false),
         is_uninitialized_(false),
         is_string_access_(false),
@@ -1732,7 +1731,6 @@ class Property V8_FINAL : public Expression {
   const BailoutId load_id_;
 
   SmallMapList receiver_types_;
-  bool is_monomorphic_ : 1;
   bool is_pre_monomorphic_ : 1;
   bool is_uninitialized_ : 1;
   bool is_string_access_ : 1;
@@ -2001,7 +1999,9 @@ class CountOperation V8_FINAL : public Expression {
 
   Expression* expression() const { return expression_; }
 
-  virtual bool IsMonomorphic() V8_OVERRIDE { return is_monomorphic_; }
+  virtual bool IsMonomorphic() V8_OVERRIDE {
+    return receiver_types_.length() == 1;
+  }
   virtual SmallMapList* GetReceiverTypes() V8_OVERRIDE {
     return &receiver_types_;
   }
@@ -2009,7 +2009,6 @@ class CountOperation V8_FINAL : public Expression {
     return store_mode_;
   }
   Handle<Type> type() const { return type_; }
-  void set_is_monomorphic(bool b) { is_monomorphic_ = b; }
   void set_store_mode(KeyedAccessStoreMode mode) { store_mode_ = mode; }
   void set_type(Handle<Type> type) { type_ = type; }
 
@@ -2027,7 +2026,6 @@ class CountOperation V8_FINAL : public Expression {
       : Expression(isolate, pos),
         op_(op),
         is_prefix_(is_prefix),
-        is_monomorphic_(false),
         store_mode_(STANDARD_STORE),
         expression_(expr),
         assignment_id_(GetNextId(isolate)),
@@ -2036,7 +2034,6 @@ class CountOperation V8_FINAL : public Expression {
  private:
   Token::Value op_;
   bool is_prefix_ : 1;
-  bool is_monomorphic_ : 1;
   KeyedAccessStoreMode store_mode_ : 5;  // Windows treats as signed,
                                          // must have extra bit.
   Handle<Type> type_;
@@ -2142,7 +2139,9 @@ class Assignment V8_FINAL : public Expression {
 
   // Type feedback information.
   TypeFeedbackId AssignmentFeedbackId() { return reuse(id()); }
-  virtual bool IsMonomorphic() V8_OVERRIDE { return is_monomorphic_; }
+  virtual bool IsMonomorphic() V8_OVERRIDE {
+    return receiver_types_.length() == 1;
+  }
   bool IsUninitialized() { return is_uninitialized_; }
   bool IsPreMonomorphic() { return is_pre_monomorphic_; }
   bool HasNoTypeInformation() {
@@ -2155,7 +2154,6 @@ class Assignment V8_FINAL : public Expression {
     return store_mode_;
   }
   void set_is_uninitialized(bool b) { is_uninitialized_ = b; }
-  void set_is_monomorphic(bool b) { is_monomorphic_ = b; }
   void set_is_pre_monomorphic(bool b) { is_pre_monomorphic_ = b; }
   void set_store_mode(KeyedAccessStoreMode mode) { store_mode_ = mode; }
 
@@ -2182,7 +2180,6 @@ class Assignment V8_FINAL : public Expression {
   BinaryOperation* binary_operation_;
   const BailoutId assignment_id_;
 
-  bool is_monomorphic_ : 1;
   bool is_uninitialized_ : 1;
   bool is_pre_monomorphic_ : 1;
   KeyedAccessStoreMode store_mode_ : 5;  // Windows treats as signed,

src/objects.cc

@@ -2803,31 +2803,44 @@ Handle<Map> Map::GeneralizeAllFieldRepresentations(
 }
 
 
-Map* Map::CurrentMapForDeprecated() {
-  DisallowHeapAllocation no_allocation;
-  if (!is_deprecated()) return this;
+Handle<Map> Map::CurrentMapForDeprecated(Handle<Map> map) {
+  Handle<Map> proto_map(map);
+  while (proto_map->prototype()->IsJSObject()) {
+    Handle<JSObject> holder(JSObject::cast(proto_map->prototype()));
+    if (holder->map()->is_deprecated()) {
+      JSObject::TryMigrateInstance(holder);
+    }
+    proto_map = Handle<Map>(holder->map());
+  }
+  return CurrentMapForDeprecatedInternal(map);
+}
 
-  DescriptorArray* old_descriptors = instance_descriptors();
 
-  int descriptors = NumberOfOwnDescriptors();
-  Map* root_map = FindRootMap();
+Handle<Map> Map::CurrentMapForDeprecatedInternal(Handle<Map> map) {
+  if (!map->is_deprecated()) return map;
+
+  DisallowHeapAllocation no_allocation;
+  DescriptorArray* old_descriptors = map->instance_descriptors();
+
+  int descriptors = map->NumberOfOwnDescriptors();
+  Map* root_map = map->FindRootMap();
 
   // Check the state of the root map.
-  if (!EquivalentToForTransition(root_map)) return NULL;
+  if (!map->EquivalentToForTransition(root_map)) return Handle<Map>();
   int verbatim = root_map->NumberOfOwnDescriptors();
 
   Map* updated = root_map->FindUpdatedMap(
       verbatim, descriptors, old_descriptors);
-  if (updated == NULL) return NULL;
+  if (updated == NULL) return Handle<Map>();
 
   DescriptorArray* updated_descriptors = updated->instance_descriptors();
   int valid = updated->NumberOfOwnDescriptors();
   if (!updated_descriptors->IsMoreGeneralThan(
           verbatim, valid, descriptors, old_descriptors)) {
-    return NULL;
+    return Handle<Map>();
   }
 
-  return updated;
+  return handle(updated);
 }
 
 
@@ -3879,10 +3892,10 @@ void JSObject::MigrateInstance(Handle<JSObject> object) {
 
 
 Handle<Object> JSObject::TryMigrateInstance(Handle<JSObject> object) {
-  Map* new_map = object->map()->CurrentMapForDeprecated();
-  if (new_map == NULL) return Handle<Object>();
   Handle<Map> original_map(object->map());
-  JSObject::MigrateToMap(object, handle(new_map));
+  Handle<Map> new_map = Map::CurrentMapForDeprecatedInternal(original_map);
+  if (new_map.is_null()) return Handle<Object>();
+  JSObject::MigrateToMap(object, new_map);
   if (FLAG_trace_migration) {
     object->PrintInstanceMigration(stdout, *original_map, object->map());
   }

src/objects.h

@@ -6039,7 +6039,10 @@ class Map: public HeapObject {
   // deprecated, it is directly returned. Otherwise, the non-deprecated version
   // is found by re-transitioning from the root of the transition tree using the
   // descriptor array of the map. Returns NULL if no updated map is found.
-  Map* CurrentMapForDeprecated();
+  // This method also applies any pending migrations along the prototype chain.
+  static Handle<Map> CurrentMapForDeprecated(Handle<Map> map);
+  // Same as above, but does not touch the prototype chain.
+  static Handle<Map> CurrentMapForDeprecatedInternal(Handle<Map> map);
 
   static Handle<Map> RawCopy(Handle<Map> map, int instance_size);
   MUST_USE_RESULT MaybeObject* RawCopy(int instance_size);

src/type-info.h

@@ -230,18 +230,14 @@ class TypeFeedbackOracle: public ZoneObject {
                      Isolate* isolate,
                      Zone* zone);
 
-  bool LoadIsMonomorphicNormal(TypeFeedbackId id);
   bool LoadIsUninitialized(TypeFeedbackId id);
   bool LoadIsPreMonomorphic(TypeFeedbackId id);
-  bool LoadIsPolymorphic(TypeFeedbackId id);
   bool StoreIsUninitialized(TypeFeedbackId id);
-  bool StoreIsMonomorphicNormal(TypeFeedbackId id);
   bool StoreIsPreMonomorphic(TypeFeedbackId id);
   bool StoreIsKeyedPolymorphic(TypeFeedbackId id);
   bool CallIsMonomorphic(TypeFeedbackId aid);
   bool KeyedArrayCallIsHoley(TypeFeedbackId id);
   bool CallNewIsMonomorphic(TypeFeedbackId id);
-  bool ObjectLiteralStoreIsMonomorphic(TypeFeedbackId id);
 
   // TODO(1571) We can't use ForInStatement::ForInType as the return value due
   // to various cycles in our headers.
@@ -249,27 +245,13 @@ class TypeFeedbackOracle: public ZoneObject {
   // be possible.
   byte ForInType(TypeFeedbackId id);
 
-  Handle<Map> LoadMonomorphicReceiverType(TypeFeedbackId id);
-  Handle<Map> StoreMonomorphicReceiverType(TypeFeedbackId id);
-
   KeyedAccessStoreMode GetStoreMode(TypeFeedbackId id);
 
-  void LoadReceiverTypes(TypeFeedbackId id,
-                         Handle<String> name,
-                         SmallMapList* types);
-  void StoreReceiverTypes(TypeFeedbackId id,
-                          Handle<String> name,
-                          SmallMapList* types);
   void CallReceiverTypes(TypeFeedbackId id,
                          Handle<String> name,
                          int arity,
                          CallKind call_kind,
                          SmallMapList* types);
-  void CollectKeyedReceiverTypes(TypeFeedbackId id,
-                                 SmallMapList* types);
-  void CollectPolymorphicStoreReceiverTypes(TypeFeedbackId id,
-                                            SmallMapList* types);
-
   void PropertyReceiverTypes(TypeFeedbackId id,
                              Handle<String> name,
                              SmallMapList* receiver_types,
@@ -286,19 +268,18 @@ class TypeFeedbackOracle: public ZoneObject {
   void CountReceiverTypes(TypeFeedbackId id,
                           SmallMapList* receiver_types);
 
+  void CollectReceiverTypes(TypeFeedbackId id,
+                            SmallMapList* types);
+
   static bool CanRetainOtherContext(Map* map, Context* native_context);
   static bool CanRetainOtherContext(JSFunction* function,
                                     Context* native_context);
 
-  void CollectPolymorphicMaps(Handle<Code> code, SmallMapList* types);
-
   CheckType GetCallCheckType(TypeFeedbackId id);
   Handle<JSFunction> GetCallTarget(TypeFeedbackId id);
   Handle<JSFunction> GetCallNewTarget(TypeFeedbackId id);
   Handle<Cell> GetCallNewAllocationInfoCell(TypeFeedbackId id);
 
-  Handle<Map> GetObjectLiteralStoreMap(TypeFeedbackId id);
-
   bool LoadIsBuiltin(TypeFeedbackId id, Builtins::Name builtin_id);
   bool LoadIsStub(TypeFeedbackId id, ICStub* stub);
 

src/typing.cc

@@ -394,8 +394,6 @@ void AstTyper::VisitAssignment(Assignment* expr) {
     expr->set_is_uninitialized(oracle()->StoreIsUninitialized(id));
     if (!expr->IsUninitialized()) {
       expr->set_is_pre_monomorphic(oracle()->StoreIsPreMonomorphic(id));
-      expr->set_is_monomorphic(oracle()->StoreIsMonomorphicNormal(id));
-      ASSERT(!expr->IsPreMonomorphic() || !expr->IsMonomorphic());
       if (prop->key()->IsPropertyName()) {
         Literal* lit_key = prop->key()->AsLiteral();
         ASSERT(lit_key != NULL && lit_key->value()->IsString());
@@ -407,6 +405,7 @@ void AstTyper::VisitAssignment(Assignment* expr) {
             id, expr->GetReceiverTypes(), &store_mode);
         expr->set_store_mode(store_mode);
       }
+      ASSERT(!expr->IsPreMonomorphic() || !expr->IsMonomorphic());
     }
   }
 
@@ -445,8 +444,6 @@ void AstTyper::VisitProperty(Property* expr) {
   expr->set_is_uninitialized(oracle()->LoadIsUninitialized(id));
   if (!expr->IsUninitialized()) {
     expr->set_is_pre_monomorphic(oracle()->LoadIsPreMonomorphic(id));
-    expr->set_is_monomorphic(oracle()->LoadIsMonomorphicNormal(id));
-    ASSERT(!expr->IsPreMonomorphic() || !expr->IsMonomorphic());
     if (expr->key()->IsPropertyName()) {
       Literal* lit_key = expr->key()->AsLiteral();
       ASSERT(lit_key != NULL && lit_key->value()->IsString());
@@ -461,6 +458,7 @@ void AstTyper::VisitProperty(Property* expr) {
           id, expr->GetReceiverTypes(), &is_string);
       expr->set_is_string_access(is_string);
     }
+    ASSERT(!expr->IsPreMonomorphic() || !expr->IsMonomorphic());
   }
 
   RECURSE(Visit(expr->obj()));
@@ -551,7 +549,6 @@ void AstTyper::VisitUnaryOperation(UnaryOperation* expr) {
 void AstTyper::VisitCountOperation(CountOperation* expr) {
   // Collect type feedback.
   TypeFeedbackId store_id = expr->CountStoreFeedbackId();
-  expr->set_is_monomorphic(oracle()->StoreIsMonomorphicNormal(store_id));
   expr->set_store_mode(oracle()->GetStoreMode(store_id));
   oracle()->CountReceiverTypes(store_id, expr->GetReceiverTypes());
   expr->set_type(oracle()->CountType(expr->CountBinOpFeedbackId()));

test/mjsunit/regress/regress-calls-with-migrating-prototypes.js

+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+function f() {
+ return 1;
+}
+function C1(f) {
+ this.f = f;
+}
+var o1 = new C1(f);
+var o2 = {__proto__: new C1(f) }
+function foo(o) {
+ return o.f();
+}
+foo(o1);
+foo(o1);
+foo(o2);
+foo(o1);
+var o3 = new C1(function() { return 2; });
+%OptimizeFunctionOnNextCall(foo);
+assertEquals(1, foo(o2));
+o2.__proto__.f = function() { return 3; };
+assertEquals(3, foo(o2));