Revert "Remove flag track-allocation-sites."

This reverts commit 6c430da40efe388035504d3603756aa8c46ed1dc.

BUG=

Review URL: https://codereview.chromium.org/109303006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18386 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

src/code-stubs.h

@@ -1907,7 +1907,8 @@ class ArrayConstructorStubBase : public HydrogenCodeStub {
     // It only makes sense to override local allocation site behavior
     // if there is a difference between the global allocation site policy
     // for an ElementsKind and the desired usage of the stub.
-    ASSERT(override_mode != DISABLE_ALLOCATION_SITES ||
+    ASSERT(!(FLAG_track_allocation_sites &&
+             override_mode == DISABLE_ALLOCATION_SITES) ||
            AllocationSite::GetMode(kind) == TRACK_ALLOCATION_SITE);
     bit_field_ = ElementsKindBits::encode(kind) |
         AllocationSiteOverrideModeBits::encode(override_mode) |

src/flag-definitions.h

@@ -309,6 +309,8 @@ DEFINE_bool(dead_code_elimination, true, "use dead code elimination")
 DEFINE_bool(fold_constants, true, "use constant folding")
 DEFINE_bool(trace_dead_code_elimination, false, "trace dead code elimination")
 DEFINE_bool(unreachable_code_elimination, true, "eliminate unreachable code")
+DEFINE_bool(track_allocation_sites, true,
+            "Use allocation site info to reduce transitions")
 DEFINE_bool(trace_osr, false, "trace on-stack replacement")
 DEFINE_int(stress_runs, 0, "number of stress runs")
 DEFINE_bool(optimize_closures, true, "optimize closures")

src/ia32/code-stubs-ia32.cc

@@ -5457,13 +5457,18 @@ static void CreateArrayDispatchOneArgument(MacroAssembler* masm,
 
 template<class T>
 static void ArrayConstructorStubAheadOfTimeHelper(Isolate* isolate) {
+  ElementsKind initial_kind = GetInitialFastElementsKind();
+  ElementsKind initial_holey_kind = GetHoleyElementsKind(initial_kind);
+
   int to_index = GetSequenceIndexFromFastElementsKind(
       TERMINAL_FAST_ELEMENTS_KIND);
   for (int i = 0; i <= to_index; ++i) {
     ElementsKind kind = GetFastElementsKindFromSequenceIndex(i);
     T stub(kind);
     stub.GetCode(isolate);
-    if (AllocationSite::GetMode(kind) != DONT_TRACK_ALLOCATION_SITE) {
+    if (AllocationSite::GetMode(kind) != DONT_TRACK_ALLOCATION_SITE ||
+        (!FLAG_track_allocation_sites &&
+         (kind == initial_kind || kind == initial_holey_kind))) {
       T stub1(kind, CONTEXT_CHECK_REQUIRED, DISABLE_ALLOCATION_SITES);
       stub1.GetCode(isolate);
     }

src/ia32/full-codegen-ia32.cc

@@ -1716,7 +1716,8 @@ void FullCodeGenerator::VisitArrayLiteral(ArrayLiteral* expr) {
   Handle<FixedArrayBase> constant_elements_values(
       FixedArrayBase::cast(constant_elements->get(1)));
 
-  AllocationSiteMode allocation_site_mode = TRACK_ALLOCATION_SITE;
+  AllocationSiteMode allocation_site_mode = FLAG_track_allocation_sites
+      ? TRACK_ALLOCATION_SITE : DONT_TRACK_ALLOCATION_SITE;
   if (has_constant_fast_elements && !FLAG_allocation_site_pretenuring) {
     // If the only customer of allocation sites is transitioning, then
     // we can turn it off if we don't have anywhere else to transition to.

src/objects-inl.h

@@ -1326,7 +1326,8 @@ void AllocationSite::MarkZombie() {
 // elements kind is the initial elements kind.
 AllocationSiteMode AllocationSite::GetMode(
     ElementsKind boilerplate_elements_kind) {
-  if (IsFastSmiElementsKind(boilerplate_elements_kind)) {
+  if (FLAG_track_allocation_sites &&
+      IsFastSmiElementsKind(boilerplate_elements_kind)) {
     return TRACK_ALLOCATION_SITE;
   }
 
@@ -1336,7 +1337,8 @@ AllocationSiteMode AllocationSite::GetMode(
 
 AllocationSiteMode AllocationSite::GetMode(ElementsKind from,
                                            ElementsKind to) {
-  if (IsFastSmiElementsKind(from) &&
+  if (FLAG_track_allocation_sites &&
+      IsFastSmiElementsKind(from) &&
       IsMoreGeneralElementsKindTransition(from, to)) {
     return TRACK_ALLOCATION_SITE;
   }

src/objects.cc

@@ -9191,6 +9191,7 @@ AllocationMemento* AllocationMemento::FindForHeapObject(HeapObject* object,
   // checking the object immediately after the current object (if there is one)
   // to see if it's an AllocationMemento.
   ASSERT(object->GetHeap()->InNewSpace(object));
+  if (FLAG_track_allocation_sites) {
     Address ptr_end = (reinterpret_cast<Address>(object) - kHeapObjectTag) +
         object->Size();
     Address top;
@@ -9212,6 +9213,7 @@ AllocationMemento* AllocationMemento::FindForHeapObject(HeapObject* object,
         }
       }
     }
+  }
   return NULL;
 }
 
@@ -12893,7 +12895,7 @@ void JSObject::UpdateAllocationSite(Handle<JSObject> object,
 
 
 MaybeObject* JSObject::UpdateAllocationSite(ElementsKind to_kind) {
-  if (!IsJSArray()) {
+  if (!FLAG_track_allocation_sites || !IsJSArray()) {
     return this;
   }
 

test/mjsunit/allocation-site-info.js

@@ -26,7 +26,7 @@
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 // Flags: --allow-natives-syntax --smi-only-arrays --expose-gc
-// Flags: --noalways-opt
+// Flags: --track-allocation-sites --noalways-opt
 
 // Test element kind of objects.
 // Since --smi-only-arrays affects builtins, its default setting at compile

test/mjsunit/array-constructor-feedback.js

@@ -26,7 +26,7 @@
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 // Flags: --allow-natives-syntax --smi-only-arrays --expose-gc
-// Flags: --noalways-opt
+// Flags: --track-allocation-sites --noalways-opt
 
 // Test element kind of objects.
 // Since --smi-only-arrays affects builtins, its default setting at compile

test/mjsunit/array-feedback.js

@@ -26,7 +26,7 @@
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 // Flags: --allow-natives-syntax --smi-only-arrays --expose-gc
-// Flags: --noalways-opt
+// Flags: --track-allocation-sites --noalways-opt
 
 // Test element kind of objects.
 // Since --smi-only-arrays affects builtins, its default setting at compile

test/mjsunit/array-literal-feedback.js

@@ -26,7 +26,7 @@
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 // Flags: --allow-natives-syntax --smi-only-arrays --expose-gc
-// Flags: --noalways-opt
+// Flags: --track-allocation-sites --noalways-opt
 
 // Test element kind of objects.
 // Since --smi-only-arrays affects builtins, its default setting at compile

test/mjsunit/array-natives-elements.js

@@ -26,6 +26,7 @@
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 // Flags: --allow-natives-syntax --smi-only-arrays
+// Flags: --notrack-allocation-sites
 
 // Test element kind of objects.
 // Since --smi-only-arrays affects builtins, its default setting at compile time

test/mjsunit/elements-kind.js

@@ -26,7 +26,12 @@
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 // Flags: --allow-natives-syntax --smi-only-arrays --expose-gc
-// Flags: --nostress-opt
+// Flags: --notrack_allocation_sites
+
+// Limit the number of stress runs to reduce polymorphism it defeats some of the
+// assumptions made about how elements transitions work because transition stubs
+// end up going generic.
+// Flags: --stress-runs=2
 
 // Test element kind of objects.
 // Since --smi-only-arrays affects builtins, its default setting at compile
@@ -118,37 +123,36 @@ if (support_smi_only_arrays) {
 }
 
 // Make sure the element kind transitions from smi when a non-smi is stored.
-function test_wrapper() {
-  var you = new Array();
-  assertKind(elements_kind.fast_smi_only, you);
-  for (var i = 0; i < 1337; i++) {
+var you = new Array();
+assertKind(elements_kind.fast_smi_only, you);
+for (var i = 0; i < 1337; i++) {
   var val = i;
   if (i == 1336) {
     assertKind(elements_kind.fast_smi_only, you);
     val = new Object();
   }
   you[i] = val;
-  }
-  assertKind(elements_kind.fast, you);
+}
+assertKind(elements_kind.fast, you);
 
-  assertKind(elements_kind.dictionary, new Array(0xDECAF));
+assertKind(elements_kind.dictionary, new Array(0xDECAF));
 
-  var fast_double_array = new Array(0xDECAF);
-  for (var i = 0; i < 0xDECAF; i++) fast_double_array[i] = i / 2;
-  assertKind(elements_kind.fast_double, fast_double_array);
+var fast_double_array = new Array(0xDECAF);
+for (var i = 0; i < 0xDECAF; i++) fast_double_array[i] = i / 2;
+assertKind(elements_kind.fast_double, fast_double_array);
 
-  assertKind(elements_kind.external_byte,           new Int8Array(9001));
-  assertKind(elements_kind.external_unsigned_byte,  new Uint8Array(007));
-  assertKind(elements_kind.external_short,          new Int16Array(666));
-  assertKind(elements_kind.external_unsigned_short, new Uint16Array(42));
-  assertKind(elements_kind.external_int,            new Int32Array(0xF));
-  assertKind(elements_kind.external_unsigned_int,   new Uint32Array(23));
-  assertKind(elements_kind.external_float,          new Float32Array(7));
-  assertKind(elements_kind.external_double,         new Float64Array(0));
-  assertKind(elements_kind.external_pixel,          new Uint8ClampedArray(512));
+assertKind(elements_kind.external_byte,           new Int8Array(9001));
+assertKind(elements_kind.external_unsigned_byte,  new Uint8Array(007));
+assertKind(elements_kind.external_short,          new Int16Array(666));
+assertKind(elements_kind.external_unsigned_short, new Uint16Array(42));
+assertKind(elements_kind.external_int,            new Int32Array(0xF));
+assertKind(elements_kind.external_unsigned_int,   new Uint32Array(23));
+assertKind(elements_kind.external_float,          new Float32Array(7));
+assertKind(elements_kind.external_double,         new Float64Array(0));
+assertKind(elements_kind.external_pixel,          new Uint8ClampedArray(512));
 
-  // Crankshaft support for smi-only array elements.
-  function monomorphic(array) {
+// Crankshaft support for smi-only array elements.
+function monomorphic(array) {
   assertKind(elements_kind.fast_smi_only, array);
   for (var i = 0; i < 3; i++) {
     array[i] = i + 10;
@@ -158,35 +162,17 @@ function test_wrapper() {
     var a = array[i];
     assertEquals(i + 10, a);
   }
-  }
-  var smi_only = new Array(1, 2, 3);
-  assertKind(elements_kind.fast_smi_only, smi_only);
-  for (var i = 0; i < 3; i++) monomorphic(smi_only);
-    %OptimizeFunctionOnNextCall(monomorphic);
-  monomorphic(smi_only);
 }
-
-// The test is called in a wrapper function to eliminate the transition learning
-// feedback of AllocationSites.
-test_wrapper();
-%ClearFunctionTypeFeedback(test_wrapper);
+var smi_only = new Array(1, 2, 3);
+assertKind(elements_kind.fast_smi_only, smi_only);
+for (var i = 0; i < 3; i++) monomorphic(smi_only);
+%OptimizeFunctionOnNextCall(monomorphic);
+monomorphic(smi_only);
 
 if (support_smi_only_arrays) {
   %NeverOptimizeFunction(construct_smis);
-
-  // This code exists to eliminate the learning influence of AllocationSites
-  // on the following tests.
-  var __sequence = 0;
-  function make_array_string() {
-    this.__sequence = this.__sequence + 1;
-    return "/* " + this.__sequence + " */  [0, 0, 0];"
-  }
-  function make_array() {
-    return eval(make_array_string());
-  }
-
   function construct_smis() {
-    var a = make_array();
+    var a = [0, 0, 0];
     a[0] = 0;  // Send the COW array map to the steak house.
     assertKind(elements_kind.fast_smi_only, a);
     return a;

test/mjsunit/elements-transition-and-store.js

@@ -25,6 +25,8 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
+// Flags: --notrack-allocation-sites
+
 function foo(a, v) {
   a[0] = v;
   return a;

test/mjsunit/elements-transition-hoisting.js

@@ -25,8 +25,10 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-// Flags: --allow-natives-syntax --smi-only-arrays
-// Flags: --nostress-opt
+// Flags: --allow-natives-syntax --smi-only-arrays --notrack-allocation-sites
+
+// No tracking of allocation sites because it interfers with the semantics
+// the test is trying to ensure.
 
 // Ensure that ElementsKind transitions in various situations are hoisted (or
 // not hoisted) correctly, don't change the semantics programs and don't trigger
@@ -40,7 +42,7 @@ if (support_smi_only_arrays) {
   print("Tests do NOT include smi-only arrays.");
 }
 
-function test_wrapper() {
+if (support_smi_only_arrays) {
   // Make sure that a simple elements array transitions inside a loop before
   // stores to an array gets hoisted in a way that doesn't generate a deopt in
   // simple cases.}
@@ -237,10 +239,3 @@ function test_wrapper() {
   assertOptimized(testStraightLineDupeElinination);
   %ClearFunctionTypeFeedback(testStraightLineDupeElinination);
 }
-
-if (support_smi_only_arrays) {
-  // The test is called in a test wrapper that has type feedback cleared to
-  // prevent the influence of allocation-sites, which learn from transitions.
-  test_wrapper();
-  %ClearFunctionTypeFeedback(test_wrapper);
-}

test/mjsunit/elements-transition.js

@@ -25,8 +25,7 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-// Flags: --allow-natives-syntax --smi-only-arrays
-// Flags: --nostress-opt
+// Flags: --allow-natives-syntax --smi-only-arrays --notrack-allocation-sites
 
 support_smi_only_arrays = %HasFastSmiElements(new Array(1,2,3,4,5,6,7,8));
 
@@ -37,26 +36,14 @@ if (support_smi_only_arrays) {
 }
 
 if (support_smi_only_arrays) {
-  // This code exists to eliminate the learning influence of AllocationSites
-  // on the following tests.
-  var __sequence = 0;
-  function make_array_string(length) {
-    this.__sequence = this.__sequence + 1;
-    return "/* " + this.__sequence + " */  new Array(" + length + ");";
-  }
-  function make_array(length) {
-    return eval(make_array_string(length));
-  }
-
   function test(test_double, test_object, set, length) {
     // We apply the same operations to two identical arrays.  The first array
     // triggers an IC miss, upon which the conversion stub is generated, but the
     // actual conversion is done in runtime.  The second array, arriving at
     // the previously patched IC, is then converted using the conversion stub.
-    var array_1 = make_array(length);
-    var array_2 = make_array(length);
+    var array_1 = new Array(length);
+    var array_2 = new Array(length);
 
-    // false, true, nice setter function, 20
     assertTrue(%HasFastSmiElements(array_1));
     assertTrue(%HasFastSmiElements(array_2));
     for (var i = 0; i < length; i++) {
@@ -99,20 +86,15 @@ if (support_smi_only_arrays) {
     assertEquals(length, array_2.length);
   }
 
-  function run_test(test_double, test_object, set, length) {
-    test(test_double, test_object, set, length);
-    %ClearFunctionTypeFeedback(test);
-  }
-
-  run_test(false, false, function(a,i,v){ a[i] = v; }, 20);
-  run_test(true,  false, function(a,i,v){ a[i] = v; }, 20);
-  run_test(false, true,  function(a,i,v){ a[i] = v; }, 20);
-  run_test(true,  true,  function(a,i,v){ a[i] = v; }, 20);
+  test(false, false, function(a,i,v){ a[i] = v; }, 20);
+  test(true,  false, function(a,i,v){ a[i] = v; }, 20);
+  test(false, true,  function(a,i,v){ a[i] = v; }, 20);
+  test(true,  true,  function(a,i,v){ a[i] = v; }, 20);
 
-  run_test(false, false, function(a,i,v){ a[i] = v; }, 10000);
-  run_test(true,  false, function(a,i,v){ a[i] = v; }, 10000);
-  run_test(false, true,  function(a,i,v){ a[i] = v; }, 10000);
-  run_test(true,  true,  function(a,i,v){ a[i] = v; }, 10000);
+  test(false, false, function(a,i,v){ a[i] = v; }, 10000);
+  test(true,  false, function(a,i,v){ a[i] = v; }, 10000);
+  test(false, true,  function(a,i,v){ a[i] = v; }, 10000);
+  test(true,  true,  function(a,i,v){ a[i] = v; }, 10000);
 
   // Check COW arrays
   function get_cow() { return [1, 2, 3]; }

test/mjsunit/opt-elements-kind.js

@@ -26,6 +26,7 @@
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 // Flags: --allow-natives-syntax --smi-only-arrays --expose-gc
+// Flags: --notrack_allocation_sites
 
 // Limit the number of stress runs to reduce polymorphism it defeats some of the
 // assumptions made about how elements transitions work because transition stubs
@@ -113,20 +114,8 @@ function assertKind(expected, obj, name_opt) {
 }
 
 %NeverOptimizeFunction(construct_smis);
-
-// This code exists to eliminate the learning influence of AllocationSites
-// on the following tests.
-var __sequence = 0;
-function make_array_string() {
-  this.__sequence = this.__sequence + 1;
-  return "/* " + this.__sequence + " */  [0, 0, 0];"
-}
-function make_array() {
-  return eval(make_array_string());
-}
-
 function construct_smis() {
-  var a = make_array();
+  var a = [0, 0, 0];
   a[0] = 0;  // Send the COW array map to the steak house.
   assertKind(elements_kind.fast_smi_only, a);
   return a;

test/mjsunit/osr-elements-kind.js

@@ -26,6 +26,7 @@
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 // Flags: --allow-natives-syntax --smi-only-arrays --expose-gc
+// Flags: --notrack_allocation_sites
 
 // Limit the number of stress runs to reduce polymorphism it defeats some of the
 // assumptions made about how elements transitions work because transition stubs
@@ -119,19 +120,8 @@ function assertKind(expected, obj, name_opt) {
 for (var i = 0; i < 1000000; i++) { }
 
 if (support_smi_only_arrays) {
-  // This code exists to eliminate the learning influence of AllocationSites
-  // on the following tests.
-  var __sequence = 0;
-  function make_array_string() {
-    this.__sequence = this.__sequence + 1;
-    return "/* " + this.__sequence + " */  [0, 0, 0];"
-  }
-  function make_array() {
-    return eval(make_array_string());
-  }
-
   function construct_smis() {
-    var a = make_array();
+    var a = [0, 0, 0];
     a[0] = 0;  // Send the COW array map to the steak house.
     assertKind(elements_kind.fast_smi_only, a);
     return a;

test/mjsunit/regress/regress-320532.js

@@ -26,7 +26,7 @@
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 //
 // Flags: --allow-natives-syntax --smi-only-arrays --expose-gc
-// Flags: --noalways-opt
+// Flags: --track-allocation-sites --noalways-opt
 // Flags: --stress-runs=8 --send-idle-notification --gc-global
 
 

test/mjsunit/regress/regress-convert-hole2.js

@@ -24,7 +24,7 @@
 // THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-// Flags: --allow-natives-syntax
+// Flags: --allow-natives-syntax --notrack-allocation-sites
 
 // Test adding undefined from hole in double-holey to string.
 var a = [1.5, , 1.8];

test/mjsunit/regress/regress-crbug-244461.js

@@ -26,6 +26,7 @@
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 // Flags: --allow-natives-syntax --smi-only-arrays
+// Flags: --track-allocation-sites
 
 function foo(arg) {
   var a = arg();

test/mjsunit/regress/regress-crbug-245480.js

@@ -26,7 +26,7 @@
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 // Flags: --allow-natives-syntax --smi-only-arrays --expose-gc
-// Flags: --noalways-opt
+// Flags: --track-allocation-sites --noalways-opt
 
 // Test element kind of objects.
 // Since --smi-only-arrays affects builtins, its default setting at compile

test/mjsunit/transition-elements-kind.js

@@ -25,7 +25,7 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-// Flags: --allow-natives-syntax
+// Flags: --allow-natives-syntax --track-allocation-sites
 
 // Allocation site for empty double arrays.
 function foo() {