Add a premonomorphic state to the call target cache.

From a CL by kasperl: https://codereview.chromium.org/162903004/

R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/163413003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19402 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

src/a64/code-stubs-a64.cc

@@ -3192,6 +3192,8 @@ static void GenerateRecordCallTarget(MacroAssembler* masm) {
             masm->isolate()->heap()->undefined_value());
   ASSERT_EQ(*TypeFeedbackInfo::UninitializedSentinel(masm->isolate()),
             masm->isolate()->heap()->the_hole_value());
+  ASSERT_EQ(*TypeFeedbackInfo::PremonomorphicSentinel(masm->isolate()),
+            masm->isolate()->heap()->null_value());
 
   // Load the cache state.
   __ Add(x4, x2, Operand::UntagSmiAndScale(x3, kPointerSizeLog2));
@@ -3219,7 +3221,22 @@ static void GenerateRecordCallTarget(MacroAssembler* masm) {
 
   // A monomorphic miss (i.e, here the cache is not uninitialized) goes
   // megamorphic.
-  __ JumpIfRoot(x4, Heap::kTheHoleValueRootIndex, &initialize);
+  Label not_uninitialized;
+  __ JumpIfNotRoot(x4, Heap::kTheHoleValueRootIndex, &not_uninitialized);
+
+  // PremonomorphicSentinel is an immortal immovable object (null) so no
+  // write-barrier is needed.
+  __ Add(x4, x2, Operand::UntagSmiAndScale(x3, kPointerSizeLog2));
+  __ LoadRoot(x10, Heap::kNullValueRootIndex);
+  __ Str(x10, FieldMemOperand(x4, FixedArray::kHeaderSize));
+  __ B(&done);
+
+  // If the cache isn't uninitialized, it is either premonomorphic or
+  // monomorphic. If it is premonomorphic, we initialize it thus making
+  // it monomorphic. Otherwise, we go megamorphic.
+  __ Bind(&not_uninitialized);
+  __ JumpIfRoot(x4, Heap::kNullValueRootIndex, &initialize);
+
   // MegamorphicSentinel is an immortal immovable object (undefined) so no
   // write-barrier is needed.
   __ Bind(&megamorphic);

src/arm/code-stubs-arm.cc

@@ -3017,6 +3017,8 @@ static void GenerateRecordCallTarget(MacroAssembler* masm) {
             masm->isolate()->heap()->undefined_value());
   ASSERT_EQ(*TypeFeedbackInfo::UninitializedSentinel(masm->isolate()),
             masm->isolate()->heap()->the_hole_value());
+  ASSERT_EQ(*TypeFeedbackInfo::PremonomorphicSentinel(masm->isolate()),
+            masm->isolate()->heap()->null_value());
 
   // Load the cache state into r4.
   __ add(r4, r2, Operand::PointerOffsetFromSmiKey(r3));
@@ -3043,10 +3045,26 @@ static void GenerateRecordCallTarget(MacroAssembler* masm) {
 
   __ bind(&miss);
 
-  // A monomorphic miss (i.e, here the cache is not uninitialized) goes
-  // megamorphic.
+  // A monomorphic miss (i.e, here the cache is not uninitialized or
+  // pre-monomorphic) goes megamorphic.
+  Label not_uninitialized;
   __ CompareRoot(r4, Heap::kTheHoleValueRootIndex);
+  __ b(ne, &not_uninitialized);
+
+  // PremonomorphicSentinel is an immortal immovable object (null) so no
+  // write-barrier is needed.
+  __ add(r4, r2, Operand::PointerOffsetFromSmiKey(r3));
+  __ LoadRoot(ip, Heap::kNullValueRootIndex);
+  __ str(ip, FieldMemOperand(r4, FixedArray::kHeaderSize));
+  __ jmp(&done);
+
+  // If the cache isn't uninitialized, it is either premonomorphic or
+  // monomorphic. If it is premonomorphic, we initialize it thus making
+  // it monomorphic. Otherwise, we go megamorphic.
+  __ bind(&not_uninitialized);
+  __ CompareRoot(r4, Heap::kNullValueRootIndex);
   __ b(eq, &initialize);
+
   // MegamorphicSentinel is an immortal immovable object (undefined) so no
   // write-barrier is needed.
   __ bind(&megamorphic);

src/ia32/code-stubs-ia32.cc

@@ -2362,10 +2362,26 @@ static void GenerateRecordCallTarget(MacroAssembler* masm) {
 
   __ bind(&miss);
 
-  // A monomorphic miss (i.e, here the cache is not uninitialized) goes
-  // megamorphic.
+  // A monomorphic miss (i.e, here the cache is not uninitialized or
+  // pre-monomorphic) goes megamorphic.
+  Label not_uninitialized;
   __ cmp(ecx, Immediate(TypeFeedbackInfo::UninitializedSentinel(isolate)));
+  __ j(not_equal, &not_uninitialized);
+
+  // PremonomorphicSentinel is an immortal immovable object (null) so no
+  // write-barrier is needed.
+  __ mov(FieldOperand(ebx, edx, times_half_pointer_size,
+                      FixedArray::kHeaderSize),
+         Immediate(TypeFeedbackInfo::PremonomorphicSentinel(isolate)));
+  __ jmp(&done, Label::kFar);
+
+  // If the cache isn't uninitialized, it is either premonomorphic or
+  // monomorphic. If it is premonomorphic, we initialize it thus making
+  // it monomorphic. Otherwise, we go megamorphic.
+  __ bind(&not_uninitialized);
+  __ cmp(ecx, Immediate(TypeFeedbackInfo::PremonomorphicSentinel(isolate)));
   __ j(equal, &initialize);
+
   // MegamorphicSentinel is an immortal immovable object (undefined) so no
   // write-barrier is needed.
   __ bind(&megamorphic);

src/objects-inl.h

@@ -6532,6 +6532,11 @@ Handle<Object> TypeFeedbackInfo::UninitializedSentinel(Isolate* isolate) {
 }
 
 
+Handle<Object> TypeFeedbackInfo::PremonomorphicSentinel(Isolate* isolate) {
+  return isolate->factory()->null_value();
+}
+
+
 Handle<Object> TypeFeedbackInfo::MegamorphicSentinel(Isolate* isolate) {
   return isolate->factory()->undefined_value();
 }

src/objects.h

@@ -8176,6 +8176,9 @@ class TypeFeedbackInfo: public Struct {
   // The object that indicates an uninitialized cache.
   static inline Handle<Object> UninitializedSentinel(Isolate* isolate);
 
+  // The object that indicates a cache in pre-monomorphic state.
+  static inline Handle<Object> PremonomorphicSentinel(Isolate* isolate);
+
   // The object that indicates a megamorphic state.
   static inline Handle<Object> MegamorphicSentinel(Isolate* isolate);
 

src/runtime.cc

@@ -14762,6 +14762,7 @@ RUNTIME_FUNCTION(MaybeObject*, Runtime_ArrayConstructor) {
 
   Handle<AllocationSite> site;
   if (!type_info.is_null() &&
+      *type_info != isolate->heap()->null_value() &&
       *type_info != isolate->heap()->undefined_value()) {
     site = Handle<AllocationSite>::cast(type_info);
     ASSERT(!site->SitePointsToLiteral());

src/x64/code-stubs-x64.cc

@@ -2201,10 +2201,25 @@ static void GenerateRecordCallTarget(MacroAssembler* masm) {
 
   __ bind(&miss);
 
-  // A monomorphic miss (i.e, here the cache is not uninitialized) goes
-  // megamorphic.
+  // A monomorphic miss (i.e, here the cache is not uninitialized or
+  // pre-monomorphic) goes megamorphic.
+  Label not_uninitialized;
   __ Cmp(rcx, TypeFeedbackInfo::UninitializedSentinel(isolate));
+  __ j(not_equal, &not_uninitialized);
+
+  // PremonomorphicSentinel is an immortal immovable object (null) so no
+  // write-barrier is needed.
+  __ Move(FieldOperand(rbx, rdx, times_pointer_size, FixedArray::kHeaderSize),
+          TypeFeedbackInfo::PremonomorphicSentinel(isolate));
+  __ jmp(&done);
+
+  // If the cache isn't uninitialized, it is either premonomorphic or
+  // monomorphic. If it is premonomorphic, we initialize it thus making
+  // it monomorphic. Otherwise, we go megamorphic.
+  __ bind(&not_uninitialized);
+  __ Cmp(rcx, TypeFeedbackInfo::PremonomorphicSentinel(isolate));
   __ j(equal, &initialize);
+
   // MegamorphicSentinel is an immortal immovable object (undefined) so no
   // write-barrier is needed.
   __ bind(&megamorphic);

test/cctest/test-heap.cc

@@ -2848,7 +2848,9 @@ TEST(IncrementalMarkingClearsTypeFeedbackInfo) {
   // originating from two different native contexts.
   CcTest::global()->Set(v8_str("fun1"), fun1);
   CcTest::global()->Set(v8_str("fun2"), fun2);
-  CompileRun("function f(a, b) { a(); b(); } f(fun1, fun2);");
+  CompileRun("function f(a, b) { a(); b(); }"
+             "f(fun1, fun2);"  // Run twice to skip premonomorphic state.
+             "f(fun1, fun2)");
 
   Handle<JSFunction> f =
       v8::Utils::OpenHandle(

test/mjsunit/allocation-site-info.js

@@ -128,6 +128,7 @@ if (support_smi_only_arrays) {
   }
 
   // Case: [1,2,3] as allocation site
+  get_standard_literal();  // Skip premonomorphic state.
   obj = fastliteralcase(get_standard_literal(), 1);
   assertKind(elements_kind.fast_smi_only, obj);
   obj = fastliteralcase(get_standard_literal(), 1.5);
@@ -169,6 +170,7 @@ if (support_smi_only_arrays) {
     return literal;
   }
 
+  fastliteralcase_smifast(1);  // Skip premonomorphic state.
   obj = fastliteralcase_smifast(1);
   assertKind(elements_kind.fast_smi_only, obj);
   obj = fastliteralcase_smifast("carter");
@@ -183,6 +185,7 @@ if (support_smi_only_arrays) {
     return literal;
   }
 
+  fastliteralcase_smiholey(5, 1);  // Skip premonomorphic state.
   obj = fastliteralcase_smiholey(5, 1);
   assertKind(elements_kind.fast_smi_only, obj);
   assertHoley(obj);
@@ -197,6 +200,7 @@ if (support_smi_only_arrays) {
   }
 
   // Case: new Array() as allocation site, smi->double
+  newarraycase_smidouble(1);  // Skip premonomorphic state.
   obj = newarraycase_smidouble(1);
   assertKind(elements_kind.fast_smi_only, obj);
   obj = newarraycase_smidouble(1.5);
@@ -211,6 +215,7 @@ if (support_smi_only_arrays) {
   }
 
   // Case: new Array() as allocation site, smi->fast
+  newarraycase_smiobj(1);  // Skip premonomorphic state.
   obj = newarraycase_smiobj(1);
   assertKind(elements_kind.fast_smi_only, obj);
   obj = newarraycase_smiobj("gloria");
@@ -225,6 +230,7 @@ if (support_smi_only_arrays) {
   }
 
   // Case: new Array(length) as allocation site
+  newarraycase_length_smidouble(1);  // Skip premonomorphic state.
   obj = newarraycase_length_smidouble(1);
   assertKind(elements_kind.fast_smi_only, obj);
   obj = newarraycase_length_smidouble(1.5);
@@ -248,6 +254,7 @@ if (support_smi_only_arrays) {
   }
 
   // Case: new Array(<length>) as allocation site, smi->fast
+  newarraycase_length_smiobj(1);  // Skip premonomorphic state.
   obj = newarraycase_length_smiobj(1);
   assertKind(elements_kind.fast_smi_only, obj);
   obj = newarraycase_length_smiobj("gloria");
@@ -261,6 +268,7 @@ if (support_smi_only_arrays) {
     return a;
   }
 
+  newarraycase_list_smidouble(1);  // Skip premonomorphic state.
   obj = newarraycase_list_smidouble(1);
   assertKind(elements_kind.fast_smi_only, obj);
   obj = newarraycase_list_smidouble(1.5);
@@ -274,6 +282,7 @@ if (support_smi_only_arrays) {
     return a;
   }
 
+  newarraycase_list_smiobj(1);  // Skip premonomorphic state.
   obj = newarraycase_list_smiobj(1);
   assertKind(elements_kind.fast_smi_only, obj);
   obj = newarraycase_list_smiobj("coates");
@@ -293,6 +302,7 @@ if (support_smi_only_arrays) {
       return a;
     }
 
+    foo(0); foo(1);  // Skip premonomorphic state.
     for (i = 0; i < 2; i++) {
       a = foo(i);
       b = foo(i);
@@ -313,6 +323,7 @@ if (support_smi_only_arrays) {
     return a;
   }
 
+  newarraycase_onearg(5, 3.5);  // Skip premonomorphic state.
   obj = newarraycase_onearg(5, 3.5);
   assertKind(elements_kind.fast_double, obj);
   obj = newarraycase_onearg(10, 5);
@@ -388,6 +399,7 @@ if (support_smi_only_arrays) {
      return literal;
    }
 
+   get_nested_literal();  // Skip premonomorphic state.
    obj = get_nested_literal();
    assertKind(elements_kind.fast, obj);
    obj[0][0] = 3.5;
@@ -403,6 +415,7 @@ if (support_smi_only_arrays) {
      return literal;
    }
 
+   get_deep_nested_literal();  // Skip premonomorphic state.
    obj = get_deep_nested_literal();
    assertKind(elements_kind.fast_smi_only, obj[1][0]);
    obj[0][0] = 3.5;
@@ -428,6 +441,7 @@ if (support_smi_only_arrays) {
       return literal;
     }
 
+    get_object_literal();  // Skip premonomorphic state.
     obj = get_object_literal();
     assertKind(elements_kind.fast_smi_only, obj.array);
     obj.array[1] = 3.5;
@@ -443,6 +457,7 @@ if (support_smi_only_arrays) {
       return literal;
     }
 
+    get_nested_object_literal();  // Skip premonomorphic state.
     obj = get_nested_object_literal();
     assertKind(elements_kind.fast, obj.array);
     assertKind(elements_kind.fast_smi_only, obj.array[1]);
@@ -462,6 +477,7 @@ if (support_smi_only_arrays) {
       return literal;
     }
 
+    get_nested_literal();  // Skip premonomorphic state.
     obj = get_nested_literal();
     assertKind(elements_kind.fast, obj);
     obj[0][0] = 3.5;
@@ -477,6 +493,7 @@ if (support_smi_only_arrays) {
       return literal;
     }
 
+    get_deep_nested_literal();  // Skip premonomorphic state.
     obj = get_deep_nested_literal();
     assertKind(elements_kind.fast_smi_only, obj[1][0]);
     obj[0][0] = 3.5;

test/mjsunit/array-constructor-feedback.js

@@ -89,6 +89,7 @@ if (support_smi_only_arrays) {
       return new t(len);
     }
 
+    bar(Array, 10);  // Skip premonomorphic state.
     a = bar(Array, 10);
     a[0] = 3.5;
     b = bar(Array, 1);
@@ -108,6 +109,8 @@ if (support_smi_only_arrays) {
     function bar0(t) {
       return new t();
     }
+
+    bar0(Array);  // Skip premonomorphic state.
     a = bar0(Array);
     a[0] = 3.5;
     b = bar0(Array);
@@ -139,6 +142,8 @@ if (support_smi_only_arrays) {
     function bar(len) {
       return new Array(len);
     }
+
+    bar(10);  // Skip premonomorphic state.
     a = bar(10);
     a[0] = "a string";
     a = bar(10);
@@ -190,6 +195,8 @@ if (support_smi_only_arrays) {
     function bar() {
       return new Array();
     }
+
+    bar();  // Skip premonomorphic state.
     a = bar();
     bar();
     %OptimizeFunctionOnNextCall(bar);