Add soft-deopt for uninitialized assignment

R=hpayer@google.com

Review URL: https://chromiumcodereview.appspot.com/17071002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15241 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

src/ast.cc

@@ -135,6 +135,7 @@ Assignment::Assignment(Isolate* isolate,
       binary_operation_(NULL),
       assignment_id_(GetNextId(isolate)),
       is_monomorphic_(false),
+      is_uninitialized_(false),
       store_mode_(STANDARD_STORE) { }
 
 
@@ -465,6 +466,8 @@ void Assignment::RecordTypeFeedback(TypeFeedbackOracle* oracle,
   Property* prop = target()->AsProperty();
   ASSERT(prop != NULL);
   TypeFeedbackId id = AssignmentFeedbackId();
+  is_uninitialized_ = oracle->StoreIsUninitialized(id);
+  if (is_uninitialized_) return;
   is_monomorphic_ = oracle->StoreIsMonomorphicNormal(id);
   receiver_types_.Clear();
   if (prop->key()->IsPropertyName()) {

src/ast.h

@@ -2096,6 +2096,7 @@ class Assignment: public Expression {
   TypeFeedbackId AssignmentFeedbackId() { return reuse(id()); }
   void RecordTypeFeedback(TypeFeedbackOracle* oracle, Zone* zone);
   virtual bool IsMonomorphic() { return is_monomorphic_; }
+  bool IsUninitialized() { return is_uninitialized_; }
   virtual SmallMapList* GetReceiverTypes() { return &receiver_types_; }
   virtual KeyedAccessStoreMode GetStoreMode() {
     return store_mode_;
@@ -2126,6 +2127,7 @@ class Assignment: public Expression {
   const BailoutId assignment_id_;
 
   bool is_monomorphic_ : 1;
+  bool is_uninitialized_ : 1;
   KeyedAccessStoreMode store_mode_ : 5;  // Windows treats as signed,
                                          // must have extra bit.
   SmallMapList receiver_types_;

src/hydrogen.cc

@@ -6516,6 +6516,7 @@ void HOptimizedGraphBuilder::HandlePropertyAssignment(Assignment* expr) {
     HValue* value = environment()->ExpressionStackAt(0);
     HValue* object = environment()->ExpressionStackAt(1);
 
+    if (expr->IsUninitialized()) AddSoftDeoptimize();
     return BuildStoreNamed(expr, expr->id(), expr->position(),
                            expr->AssignmentId(), prop, object, value);
   } else {
@@ -6988,8 +6989,6 @@ HInstruction* HOptimizedGraphBuilder::BuildLoadNamedGeneric(
     Property* expr) {
   if (expr->IsUninitialized()) {
     AddSoftDeoptimize();
-  } else {
-    // OS::DebugBreak();
   }
   HValue* context = environment()->LookupContext();
   return new(zone()) HLoadNamedGeneric(context, object, name);

src/type-info.cc

@@ -138,6 +138,15 @@ bool TypeFeedbackOracle::LoadIsPolymorphic(Property* expr) {
 }
 
 
+bool TypeFeedbackOracle::StoreIsUninitialized(TypeFeedbackId ast_id) {
+  Handle<Object> map_or_code = GetInfo(ast_id);
+  if (map_or_code->IsMap()) return false;
+  if (!map_or_code->IsCode()) return true;
+  Handle<Code> code = Handle<Code>::cast(map_or_code);
+  return code->ic_state() == UNINITIALIZED;
+}
+
+
 bool TypeFeedbackOracle::StoreIsMonomorphicNormal(TypeFeedbackId ast_id) {
   Handle<Object> map_or_code = GetInfo(ast_id);
   if (map_or_code->IsMap()) return true;

src/type-info.h

@@ -244,6 +244,7 @@ class TypeFeedbackOracle: public ZoneObject {
   bool LoadIsMonomorphicNormal(Property* expr);
   bool LoadIsUninitialized(Property* expr);
   bool LoadIsPolymorphic(Property* expr);
+  bool StoreIsUninitialized(TypeFeedbackId ast_id);
   bool StoreIsMonomorphicNormal(TypeFeedbackId ast_id);
   bool StoreIsPolymorphic(TypeFeedbackId ast_id);
   bool CallIsMonomorphic(Call* expr);