update vector ics to handle megamorphic keyed loads

R=mvstanton@chromium.org

BUG=

Review URL: https://codereview.chromium.org/889863002

Cr-Commit-Position: refs/heads/master@{#26352}

src/code-stubs-hydrogen.cc

@@ -2171,14 +2171,15 @@ HValue* CodeStubGraphBuilder<VectorKeyedLoadStub>::BuildCodeStub() {
   }
   array_checker.Else();
   {
-    // Check if the IC is in generic state.
-    IfBuilder generic_checker(this);
-    HConstant* generic_symbol =
-        Add<HConstant>(isolate()->factory()->generic_symbol());
-    generic_checker.If<HCompareObjectEqAndBranch>(feedback, generic_symbol);
-    generic_checker.Then();
+    // Check if the IC is in megamorphic state.
+    IfBuilder megamorphic_checker(this);
+    HConstant* megamorphic_symbol =
+        Add<HConstant>(isolate()->factory()->megamorphic_symbol());
+    megamorphic_checker.If<HCompareObjectEqAndBranch>(feedback,
+                                                      megamorphic_symbol);
+    megamorphic_checker.Then();
     {
-      // Tail-call to the generic KeyedLoadIC, treating it like a handler.
+      // Tail-call to the megamorphic KeyedLoadIC, treating it like a handler.
       Handle<Code> stub = KeyedLoadIC::ChooseMegamorphicStub(isolate());
       HValue* constant_stub = Add<HConstant>(stub);
       LoadDescriptor descriptor(isolate());
@@ -2187,7 +2188,7 @@ HValue* CodeStubGraphBuilder<VectorKeyedLoadStub>::BuildCodeStub() {
                                Vector<HValue*>(op_vals, 3), TAIL_CALL);
       // We never return here, it is a tail call.
     }
-    generic_checker.End();
+    megamorphic_checker.End();
   }
   array_checker.End();
 

src/heap/heap.h

@@ -291,7 +291,6 @@ namespace internal {
   V(uninitialized_symbol)           \
   V(megamorphic_symbol)             \
   V(premonomorphic_symbol)          \
-  V(generic_symbol)                 \
   V(stack_trace_symbol)             \
   V(detailed_stack_trace_symbol)    \
   V(normal_ic_symbol)               \

src/ic/ic.cc

@@ -637,10 +637,10 @@ void IC::ConfigureVectorState(IC::State new_state) {
     }
   } else if (kind() == Code::KEYED_LOAD_IC) {
     KeyedLoadICNexus* nexus = casted_nexus<KeyedLoadICNexus>();
-    if (new_state == GENERIC) {
-      nexus->ConfigureGeneric();
-    } else if (new_state == PREMONOMORPHIC) {
+    if (new_state == PREMONOMORPHIC) {
       nexus->ConfigurePremonomorphic();
+    } else if (new_state == MEGAMORPHIC) {
+      nexus->ConfigureMegamorphic();
     } else {
       UNREACHABLE();
     }
@@ -704,7 +704,7 @@ MaybeHandle<Object> LoadIC::Load(Handle<Object> object, Handle<Name> name) {
     // Rewrite to the generic keyed load stub.
     if (FLAG_use_ic) {
       if (UseVector()) {
-        ConfigureVectorState(GENERIC);
+        ConfigureVectorState(MEGAMORPHIC);
       } else {
         set_target(*megamorphic_stub());
       }
@@ -1433,7 +1433,7 @@ MaybeHandle<Object> KeyedLoadIC::Load(Handle<Object> object,
     if (!is_vector_set() || stub.is_null()) {
       Code* generic = *megamorphic_stub();
       if (!stub.is_null() && *stub == generic) {
-        ConfigureVectorState(GENERIC);
+        ConfigureVectorState(MEGAMORPHIC);
         TRACE_GENERIC_IC(isolate(), "KeyedLoadIC", "set generic");
       }
 

src/type-feedback-vector-inl.h

@@ -30,11 +30,6 @@ Handle<Object> TypeFeedbackVector::PremonomorphicSentinel(Isolate* isolate) {
 }
 
 
-Handle<Object> TypeFeedbackVector::GenericSentinel(Isolate* isolate) {
-  return isolate->factory()->generic_symbol();
-}
-
-
 Handle<Object> TypeFeedbackVector::MonomorphicArraySentinel(
     Isolate* isolate, ElementsKind elements_kind) {
   return Handle<Object>(Smi::FromInt(static_cast<int>(elements_kind)), isolate);

src/type-feedback-vector.cc

@@ -264,8 +264,8 @@ InlineCacheState KeyedLoadICNexus::StateFromFeedback() const {
     return UNINITIALIZED;
   } else if (feedback == *vector()->PremonomorphicSentinel(isolate)) {
     return PREMONOMORPHIC;
-  } else if (feedback == *vector()->GenericSentinel(isolate)) {
-    return GENERIC;
+  } else if (feedback == *vector()->MegamorphicSentinel(isolate)) {
+    return MEGAMORPHIC;
   } else if (feedback->IsFixedArray()) {
     // Determine state purely by our structure, don't check if the maps are
     // cleared.
@@ -323,8 +323,8 @@ void CallICNexus::ConfigureMonomorphic(Handle<JSFunction> function) {
 }
 
 
-void KeyedLoadICNexus::ConfigureGeneric() {
-  SetFeedback(*vector()->GenericSentinel(GetIsolate()), SKIP_WRITE_BARRIER);
+void KeyedLoadICNexus::ConfigureMegamorphic() {
+  SetFeedback(*vector()->MegamorphicSentinel(GetIsolate()), SKIP_WRITE_BARRIER);
 }
 
 

src/type-feedback-vector.h

@@ -175,9 +175,6 @@ class TypeFeedbackVector : public FixedArray {
   // The object that indicates a premonomorphic state.
   static inline Handle<Object> PremonomorphicSentinel(Isolate* isolate);
 
-  // The object that indicates a generic state.
-  static inline Handle<Object> GenericSentinel(Isolate* isolate);
-
   // The object that indicates a monomorphic state of Array with
   // ElementsKind
   static inline Handle<Object> MonomorphicArraySentinel(
@@ -348,7 +345,7 @@ class KeyedLoadICNexus : public FeedbackNexus {
 
   void Clear(Code* host);
 
-  void ConfigureGeneric();
+  void ConfigureMegamorphic();
   void ConfigurePremonomorphic();
   // name can be a null handle for element loads.
   void ConfigureMonomorphic(Handle<Name> name, Handle<HeapType> type,

tools/v8heapconst.py

@@ -216,8 +216,8 @@ KNOWN_MAPS = {
   0x08cd9: (187, "JSMessageObjectMap"),
   0x08d01: (136, "ForeignMap"),
   0x08d29: (189, "NeanderMap"),
-  0x08d51: (171, "AllocationMementoMap"),
-  0x08d79: (170, "AllocationSiteMap"),
+  0x08d51: (170, "AllocationSiteMap"),
+  0x08d79: (171, "AllocationMementoMap"),
   0x08da1: (174, "PolymorphicCodeCacheMap"),
   0x08dc9: (172, "ScriptMap"),
   0x08e19: (189, "ExternalMap"),
@@ -255,16 +255,16 @@ KNOWN_OBJECTS = {
   ("OLD_POINTER_SPACE", 0x09531): "TerminationException",
   ("OLD_POINTER_SPACE", 0x09541): "MessageListeners",
   ("OLD_POINTER_SPACE", 0x0955d): "CodeStubs",
-  ("OLD_POINTER_SPACE", 0x10f91): "NonMonomorphicCache",
-  ("OLD_POINTER_SPACE", 0x115a5): "PolymorphicCodeCache",
-  ("OLD_POINTER_SPACE", 0x115ad): "NativesSourceCache",
-  ("OLD_POINTER_SPACE", 0x11621): "EmptyScript",
-  ("OLD_POINTER_SPACE", 0x1165d): "IntrinsicFunctionNames",
-  ("OLD_POINTER_SPACE", 0x17679): "ObservationState",
-  ("OLD_POINTER_SPACE", 0x17685): "SymbolRegistry",
-  ("OLD_POINTER_SPACE", 0x18041): "EmptySlowElementDictionary",
-  ("OLD_POINTER_SPACE", 0x181dd): "AllocationSitesScratchpad",
-  ("OLD_POINTER_SPACE", 0x4560d): "StringTable",
+  ("OLD_POINTER_SPACE", 0x1139d): "NonMonomorphicCache",
+  ("OLD_POINTER_SPACE", 0x119b1): "PolymorphicCodeCache",
+  ("OLD_POINTER_SPACE", 0x119b9): "NativesSourceCache",
+  ("OLD_POINTER_SPACE", 0x11a2d): "EmptyScript",
+  ("OLD_POINTER_SPACE", 0x11a69): "IntrinsicFunctionNames",
+  ("OLD_POINTER_SPACE", 0x17a85): "ObservationState",
+  ("OLD_POINTER_SPACE", 0x17a91): "SymbolRegistry",
+  ("OLD_POINTER_SPACE", 0x1844d): "EmptySlowElementDictionary",
+  ("OLD_POINTER_SPACE", 0x185e9): "AllocationSitesScratchpad",
+  ("OLD_POINTER_SPACE", 0x45d11): "StringTable",
   ("OLD_DATA_SPACE", 0x08081): "EmptyDescriptorArray",
   ("OLD_DATA_SPACE", 0x08089): "EmptyFixedArray",
   ("OLD_DATA_SPACE", 0x080a9): "NanValue",
@@ -290,6 +290,6 @@ KNOWN_OBJECTS = {
   ("OLD_DATA_SPACE", 0x082ed): "EmptyFixedUint8ClampedArray",
   ("OLD_DATA_SPACE", 0x082f5): "InfinityValue",
   ("OLD_DATA_SPACE", 0x08301): "MinusZeroValue",
-  ("CODE_SPACE", 0x16881): "JsEntryCode",
-  ("CODE_SPACE", 0x2a8e1): "JsConstructEntryCode",
+  ("CODE_SPACE", 0x17da1): "JsEntryCode",
+  ("CODE_SPACE", 0x2a921): "JsConstructEntryCode",
 }