Fix for performance issue 353661 - 23% regression in dromaeo.

The issue was that a previous fix to avoid a logic error was not
targeted enough: it allowed non-transitioning stores to fall
into a code path meant to preserve monomorphic state in the
case of a transitioning store.

BUG=353661
LOG=N
R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/206353002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20127 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
parent e9358fa9
...@@ -1452,7 +1452,8 @@ Handle<Code> KeyedStoreIC::StoreElementStub(Handle<JSObject> receiver, ...@@ -1452,7 +1452,8 @@ Handle<Code> KeyedStoreIC::StoreElementStub(Handle<JSObject> receiver,
if (IsTransitionStoreMode(store_mode)) { if (IsTransitionStoreMode(store_mode)) {
transitioned_receiver_map = ComputeTransitionedMap(receiver, store_mode); transitioned_receiver_map = ComputeTransitionedMap(receiver, store_mode);
} }
if (receiver_map.is_identical_to(previous_receiver_map) || if ((receiver_map.is_identical_to(previous_receiver_map) &&
IsTransitionStoreMode(store_mode)) ||
IsTransitionOfMonomorphicTarget( IsTransitionOfMonomorphicTarget(
MapToType<HeapType>(transitioned_receiver_map, isolate()))) { MapToType<HeapType>(transitioned_receiver_map, isolate()))) {
// If the "old" and "new" maps are in the same elements map family, or // If the "old" and "new" maps are in the same elements map family, or
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment