Create allocation sites only for array subliterals

Change-Id: I2f10deac1fed96920938d820327f19e7867c409d
Bug: v8:7787, chromium:818642
Reviewed-on: https://chromium-review.googlesource.com/1114608Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Chandan Reddy <chandanreddy@google.com>
Cr-Commit-Position: refs/heads/master@{#54031}

src/runtime/runtime-literals.cc

@@ -49,6 +49,11 @@ class JSObjectWalkVisitor {
  protected:
   V8_WARN_UNUSED_RESULT inline MaybeHandle<JSObject> VisitElementOrProperty(
       Handle<JSObject> object, Handle<JSObject> value) {
+    // Dont create allocation sites for nested object literals
+    if (!value->IsJSArray()) {
+      return StructureWalk(value);
+    }
+
     Handle<AllocationSite> current_site = site_context()->EnterNewScope();
     MaybeHandle<JSObject> copy_of_value = StructureWalk(value);
     site_context()->ExitScope(current_site, value);

test/cctest/heap/test-heap.cc

@@ -3683,19 +3683,21 @@ TEST(AllocationSiteCreation) {
                            0, 0);
   CheckNumberOfAllocations(heap, "f7(); ", 1, 0);
 
+  // No Allocation sites are created for object subliterals
   CheckNumberOfAllocations(heap,
                            "function f8() {"
                            "return {a:{}, b:{ a:2, c:{ d:{f:{}}} } }; "
                            "}; f8(); ",
                            0, 0);
-  CheckNumberOfAllocations(heap, "f8(); ", 1, 5);
+  CheckNumberOfAllocations(heap, "f8(); ", 1, 0);
 
   // We currently eagerly create allocation sites if there are sub-arrays.
+  // Allocation sites are created only for array subliterals
   CheckNumberOfAllocations(heap,
                            "function f9() {"
                            "return {a:[1, 2, 3], b:{ a:2, c:{ d:{f:[]} } }}; "
                            "}; f9(); ",
-                           1, 5);
+                           1, 2);
 
   // No new AllocationSites created on the second invocation.
   CheckNumberOfAllocations(heap, "f9(); ", 0, 0);