Preparatory refactoring-only steps for inlining accessors.

src/hydrogen.cc

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 4746 matching lines @@
     switch (property->kind()) {
       case ObjectLiteral::Property::MATERIALIZED_LITERAL:
         ASSERT(!CompileTimeValue::IsCompileTimeValue(value));
         // Fall through.
       case ObjectLiteral::Property::COMPUTED:
         if (key->handle()->IsSymbol()) {
           if (property->emit_store()) {
             property->RecordTypeFeedback(oracle());
             CHECK_ALIVE(VisitForValue(value));
             HValue* value = Pop();
+            Handle<Map> map = property->GetReceiverType();
+            Handle<String> name =
+                Handle<String>::cast(property->key()->handle());
             HInstruction* store;
-            CHECK_ALIVE(store = BuildStoreNamed(literal,
-                                                value,
-                                                property->GetReceiverType(),
-                                                property->key()));
+            if (map.is_null()) {
+              // If we don't know the monomorphic type, do a generic store.
+              CHECK_ALIVE(store = BuildStoreNamedGeneric(literal, name, value));
+            } else {
+#if DEBUG
+              Handle<AccessorPair> accessors;
+              Handle<JSObject> holder;
+              ASSERT(!LookupAccessorPair(map, name, &accessors, &holder));
+#endif
+              CHECK_ALIVE(store = BuildStoreNamed(literal, name, value, map));
+            }
             AddInstruction(store);
             if (store->HasObservableSideEffects()) AddSimulate(key->id());
           } else {
             CHECK_ALIVE(VisitForEffect(value));
           }
           break;
         }
         // Fall through.
       case ObjectLiteral::Property::PROTOTYPE:
       case ObjectLiteral::Property::SETTER:
@@ skipping 150 matching lines @@
   } else {
     Map* transition = lookup->GetTransitionMapFromMap(*type);
     return transition->PropertyIndexFor(*name) - type->inobject_properties();
   }
 }
 
 
 HInstruction* HGraphBuilder::BuildStoreNamedField(HValue* object,
                                                   Handle<String> name,
                                                   HValue* value,
-                                                  Handle<Map> type,
+                                                  Handle<Map> map,
                                                   LookupResult* lookup,
                                                   bool smi_and_map_check) {
   ASSERT(lookup->IsFound());
   if (smi_and_map_check) {
     AddInstruction(new(zone()) HCheckNonSmi(object));
-    AddInstruction(HCheckMaps::NewWithTransitions(object, type, zone()));
+    AddInstruction(HCheckMaps::NewWithTransitions(object, map, zone()));
   }
 
   // If the property does not exist yet, we have to check that it wasn't made
   // readonly or turned into a setter by some meanwhile modifications on the
   // prototype chain.
-  if (!lookup->IsProperty() && type->prototype()->IsJSReceiver()) {
-    Object* proto = type->prototype();
+  if (!lookup->IsProperty() && map->prototype()->IsJSReceiver()) {
+    Object* proto = map->prototype();
     // First check that the prototype chain isn't affected already.
     LookupResult proto_result(isolate());
     proto->Lookup(*name, &proto_result);
     if (proto_result.IsProperty()) {
       // If the inherited property could induce readonly-ness, bail out.
       if (proto_result.IsReadOnly() || !proto_result.IsCacheable()) {
         Bailout("improper object on prototype chain for store");
         return NULL;
       }
       // We only need to check up to the preexisting property.
       proto = proto_result.holder();
     } else {
       // Otherwise, find the top prototype.
       while (proto->GetPrototype()->IsJSObject()) proto = proto->GetPrototype();
       ASSERT(proto->GetPrototype()->IsNull());
     }
     ASSERT(proto->IsJSObject());
     AddInstruction(new(zone()) HCheckPrototypeMaps(
-        Handle<JSObject>(JSObject::cast(type->prototype())),
+        Handle<JSObject>(JSObject::cast(map->prototype())),
         Handle<JSObject>(JSObject::cast(proto))));
   }
 
-  int index = ComputeLoadStoreFieldIndex(type, name, lookup);
+  int index = ComputeLoadStoreFieldIndex(map, name, lookup);
   bool is_in_object = index < 0;
   int offset = index * kPointerSize;
   if (index < 0) {
     // Negative property indices are in-object properties, indexed
     // from the end of the fixed part of the object.
-    offset += type->instance_size();
+    offset += map->instance_size();
   } else {
     offset += FixedArray::kHeaderSize;
   }
   HStoreNamedField* instr =
       new(zone()) HStoreNamedField(object, name, value, is_in_object, offset);
-  if (lookup->IsTransitionToField(*type)) {
-    Handle<Map> transition(lookup->GetTransitionMapFromMap(*type));
+  if (lookup->IsTransitionToField(*map)) {
+    Handle<Map> transition(lookup->GetTransitionMapFromMap(*map));
     instr->set_transition(transition);
     // TODO(fschneider): Record the new map type of the object in the IR to
     // enable elimination of redundant checks after the transition store.
     instr->SetGVNFlag(kChangesMaps);
   }
   return instr;
 }
 
 
 HInstruction* HGraphBuilder::BuildStoreNamedGeneric(HValue* object,
@@ skipping 16 matching lines @@
     Handle<JSObject> holder(JSObject::cast(map->prototype()));
     if (!holder->HasFastProperties()) break;
     map = Handle<Map>(holder->map());
     map->LookupDescriptor(*holder, *name, lookup);
     if (lookup->IsFound()) return;
   }
   lookup->NotFound();
 }
 
 
-HInstruction* HGraphBuilder::BuildCallSetter(HValue* obj,
-                                             Handle<String> name,
+HInstruction* HGraphBuilder::BuildCallSetter(HValue* object,
                                              HValue* value,
                                              Handle<Map> map,
-                                             Handle<Object> callback,
+                                             Handle<AccessorPair> accessors,
                                              Handle<JSObject> holder) {
-  if (!callback->IsAccessorPair()) {
-    return BuildStoreNamedGeneric(obj, name, value);
-  }
-  Handle<Object> setter(Handle<AccessorPair>::cast(callback)->setter());
-  Handle<JSFunction> function(Handle<JSFunction>::cast(setter));
-  AddCheckConstantFunction(holder, obj, map, true);
-  AddInstruction(new(zone()) HPushArgument(obj));
+  Handle<JSFunction> function(JSFunction::cast(accessors->setter()));
+  AddCheckConstantFunction(holder, object, map, true);
+  AddInstruction(new(zone()) HPushArgument(object));
   AddInstruction(new(zone()) HPushArgument(value));
   return new(zone()) HCallConstantFunction(function, 2);
 }
 
 
 HInstruction* HGraphBuilder::BuildStoreNamed(HValue* object,
+                                             Handle<String> name,
                                              HValue* value,
-                                             Handle<Map> type,
-                                             Expression* key) {
-  // If we don't know the monomorphic type, do a generic store.
-  Handle<String> name = Handle<String>::cast(key->AsLiteral()->handle());
-  if (type.is_null()) return BuildStoreNamedGeneric(object, name, value);
-
+                                             Handle<Map> map) {
   // Handle a store to a known field.
   LookupResult lookup(isolate());
-  if (ComputeLoadStoreField(type, name, &lookup, true)) {
+  if (ComputeLoadStoreField(map, name, &lookup, true)) {
     // true = needs smi and map check.
-    return BuildStoreNamedField(object, name, value, type, &lookup, true);
-  }
-
-  // Handle a known setter directly in the receiver.
-  type->LookupDescriptor(NULL, *name, &lookup);
-  if (lookup.IsPropertyCallbacks()) {
-    Handle<Object> callback(lookup.GetValueFromMap(*type));
-    Handle<JSObject> holder;
-    return BuildCallSetter(object, name, value, type, callback, holder);
-  }
-
-  // Handle a known setter somewhere in the prototype chain.
-  LookupInPrototypes(type, name, &lookup);
-  if (lookup.IsPropertyCallbacks()) {
-    Handle<Object> callback(lookup.GetValue());
-    Handle<JSObject> holder(lookup.holder());
-    return BuildCallSetter(object, name, value, type, callback, holder);
+    return BuildStoreNamedField(object, name, value, map, &lookup, true);
   }
 
   // No luck, do a generic store.
   return BuildStoreNamedGeneric(object, name, value);
 }
 
 
 void HGraphBuilder::HandlePolymorphicLoadNamedField(Property* expr,
                                                     HValue* object,
                                                     SmallMapList* types,
                                                     Handle<String> name) {
+  AddInstruction(new(zone()) HCheckNonSmi(object));
   int count = 0;
   int previous_field_offset = 0;
   bool previous_field_is_in_object = false;
   bool is_monomorphic_field = true;
   Handle<Map> map;
   LookupResult lookup(isolate());
   for (int i = 0; i < types->length() && count < kMaxLoadPolymorphism; ++i) {
     map = types->at(i);
     if (ComputeLoadStoreField(map, name, &lookup, false)) {
       int index = ComputeLoadStoreFieldIndex(map, name, &lookup);
@@ skipping 15 matching lines @@
       }
       ++count;
     }
   }
 
   // Use monomorphic load if property lookup results in the same field index
   // for all maps.  Requires special map check on the set of all handled maps.
   HInstruction* instr;
   if (count == types->length() && is_monomorphic_field) {
     AddInstruction(new(zone()) HCheckMaps(object, types, zone()));
-    instr = BuildLoadNamedField(object, expr, map, &lookup, false);
+    instr = BuildLoadNamedField(object, map, &lookup, false);
   } else {
     HValue* context = environment()->LookupContext();
     instr = new(zone()) HLoadNamedFieldPolymorphic(context,
                                                    object,
                                                    types,
                                                    name,
                                                    zone());
   }
 
   instr->set_position(expr->position());
@@ skipping 76 matching lines @@
   if (!ast_context()->IsEffect()) return ast_context()->ReturnValue(Pop());
 }
 
 
 void HGraphBuilder::HandlePropertyAssignment(Assignment* expr) {
   Property* prop = expr->target()->AsProperty();
   ASSERT(prop != NULL);
   expr->RecordTypeFeedback(oracle(), zone());
   CHECK_ALIVE(VisitForValue(prop->obj()));
 
-  HValue* value = NULL;
-  HInstruction* instr = NULL;
-
   if (prop->key()->IsPropertyName()) {
     // Named store.
     CHECK_ALIVE(VisitForValue(expr->value()));
-    value = Pop();
+    HValue* value = Pop();
     HValue* object = Pop();
 
     Literal* key = prop->key()->AsLiteral();
     Handle<String> name = Handle<String>::cast(key->handle());
     ASSERT(!name.is_null());
 
+    HInstruction* instr = NULL;
     SmallMapList* types = expr->GetReceiverTypes();
     if (expr->IsMonomorphic()) {
-      CHECK_ALIVE(instr = BuildStoreNamed(object,
-                                          value,
-                                          types->first(),
-                                          prop->key()));
+      Handle<Map> type = types->first();
+      Handle<AccessorPair> accessors;
+      Handle<JSObject> holder;
+      if (LookupAccessorPair(type, name, &accessors, &holder)) {
+        Push(object);
+        Push(value);
+        Handle<JSFunction> setter(JSFunction::cast(accessors->setter()));
+        AddCheckConstantFunction(holder, object, type, true);
+        if (TryInlineSetter(setter, expr->AssignmentId(), prop->ReturnId())) {
+          return;
+        }
+        Drop(2);
+        AddInstruction(new(zone()) HPushArgument(object));
+        AddInstruction(new(zone()) HPushArgument(value));
+        instr = new(zone()) HCallConstantFunction(setter, 2);
+      } else {
+        CHECK_ALIVE(instr = BuildStoreNamed(object,
+                                            name,
+                                            value,
+                                            type));
+      }
 
     } else if (types != NULL && types->length() > 1) {
-      HandlePolymorphicStoreNamedField(expr, object, value, types, name);
-      return;
-
+      return HandlePolymorphicStoreNamedField(expr, object, value, types, name);
     } else {
       instr = BuildStoreNamedGeneric(object, name, value);
     }
 
+    Push(value);
+    instr->set_position(expr->position());
+    AddInstruction(instr);
+    if (instr->HasObservableSideEffects()) AddSimulate(expr->AssignmentId());
+    return ast_context()->ReturnValue(Pop());
+
   } else {
     // Keyed store.
     CHECK_ALIVE(VisitForValue(prop->key()));
     CHECK_ALIVE(VisitForValue(expr->value()));
-    value = Pop();
+    HValue* value = Pop();
     HValue* key = Pop();
     HValue* object = Pop();
     bool has_side_effects = false;
     HandleKeyedElementAccess(object, key, value, expr, expr->AssignmentId(),
                              expr->position(),
                              true,  // is_store
                              &has_side_effects);
     Push(value);
     ASSERT(has_side_effects);  // Stores always have side effects.
     AddSimulate(expr->AssignmentId());
     return ast_context()->ReturnValue(Pop());
   }
-  Push(value);
-  instr->set_position(expr->position());
-  AddInstruction(instr);
-  if (instr->HasObservableSideEffects()) AddSimulate(expr->AssignmentId());
-  return ast_context()->ReturnValue(Pop());
 }
 
 
 // Because not every expression has a position and there is not common
 // superclass of Assignment and CountOperation, we cannot just pass the
 // owning expression instead of position and ast_id separately.
 void HGraphBuilder::HandleGlobalVariableAssignment(Variable* var,
                                                    HValue* value,
                                                    int position,
                                                    int ast_id) {
@@ skipping 106 matching lines @@
         return Bailout("compound assignment to lookup slot");
     }
     return ast_context()->ReturnValue(Pop());
 
   } else if (prop != NULL) {
     prop->RecordTypeFeedback(oracle(), zone());
 
     if (prop->key()->IsPropertyName()) {
       // Named property.
       CHECK_ALIVE(VisitForValue(prop->obj()));
-      HValue* obj = Top();
+      HValue* object = Top();
 
+      Handle<String> name = prop->key()->AsLiteral()->AsPropertyName();
       Handle<Map> map;
       HInstruction* load;
       if (prop->IsMonomorphic()) {
-        Handle<String> name = prop->key()->AsLiteral()->AsPropertyName();
         map = prop->GetReceiverTypes()->first();
-        load = BuildLoadNamed(obj, prop, map, name);
+        Handle<AccessorPair> accessors;
+        Handle<JSObject> holder;
+        if (LookupAccessorPair(map, name, &accessors, &holder)) {
+          load = BuildCallGetter(object, map, accessors, holder);
+        } else {
+          load = BuildLoadNamed(object, name, prop, map);
+        }
       } else {
-        load = BuildLoadNamedGeneric(obj, prop);
+        load = BuildLoadNamedGeneric(object, name, prop);
       }
       PushAndAdd(load);
       if (load->HasObservableSideEffects()) AddSimulate(expr->CompoundLoadId());
 
       CHECK_ALIVE(VisitForValue(expr->value()));
       HValue* right = Pop();
       HValue* left = Pop();
 
       HInstruction* instr = BuildBinaryOperation(operation, left, right);
       PushAndAdd(instr);
       if (instr->HasObservableSideEffects()) AddSimulate(operation->id());
 
       HInstruction* store;
-      CHECK_ALIVE(store = BuildStoreNamed(obj, instr, map, prop->key()));
+      if (map.is_null()) {
+        // If we don't know the monomorphic type, do a generic store.
+        CHECK_ALIVE(store = BuildStoreNamedGeneric(object, name, instr));
+      } else {
+        Handle<AccessorPair> accessors;
+        Handle<JSObject> holder;
+        if (LookupAccessorPair(map, name, &accessors, &holder)) {
+          CHECK_ALIVE(store = BuildCallSetter(object,
+                                              instr,
+                                              map,
+                                              accessors,
+                                              holder));
+        } else {
+          CHECK_ALIVE(store = BuildStoreNamed(object, name, instr, map));
+        }
+      }
       AddInstruction(store);
       // Drop the simulated receiver and value.  Return the value.
       Drop(2);
       Push(instr);
       if (store->HasObservableSideEffects()) AddSimulate(expr->AssignmentId());
       return ast_context()->ReturnValue(Pop());
 
     } else {
       // Keyed property.
       CHECK_ALIVE(VisitForValue(prop->obj()));
@@ skipping 180 matching lines @@
   HThrow* instr = new(zone()) HThrow(context, value);
   instr->set_position(expr->position());
   AddInstruction(instr);
   AddSimulate(expr->id());
   current_block()->FinishExit(new(zone()) HAbnormalExit);
   set_current_block(NULL);
 }
 
 
 HLoadNamedField* HGraphBuilder::BuildLoadNamedField(HValue* object,
-                                                    Property* expr,
-                                                    Handle<Map> type,
+                                                    Handle<Map> map,
                                                     LookupResult* lookup,
                                                     bool smi_and_map_check) {
   if (smi_and_map_check) {
     AddInstruction(new(zone()) HCheckNonSmi(object));
-    AddInstruction(HCheckMaps::NewWithTransitions(object, type, zone()));
+    AddInstruction(HCheckMaps::NewWithTransitions(object, map, zone()));
   }
 
-  int index = lookup->GetLocalFieldIndexFromMap(*type);
+  int index = lookup->GetLocalFieldIndexFromMap(*map);
   if (index < 0) {
     // Negative property indices are in-object properties, indexed
     // from the end of the fixed part of the object.
-    int offset = (index * kPointerSize) + type->instance_size();
+    int offset = (index * kPointerSize) + map->instance_size();
     return new(zone()) HLoadNamedField(object, true, offset);
   } else {
     // Non-negative property indices are in the properties array.
     int offset = (index * kPointerSize) + FixedArray::kHeaderSize;
     return new(zone()) HLoadNamedField(object, false, offset);
   }
 }
 
 
-HInstruction* HGraphBuilder::BuildLoadNamedGeneric(HValue* obj,
+HInstruction* HGraphBuilder::BuildLoadNamedGeneric(HValue* object,
+                                                   Handle<String> name,
                                                    Property* expr) {
   if (expr->IsUninitialized() && !FLAG_always_opt) {
     AddInstruction(new(zone()) HSoftDeoptimize);
     current_block()->MarkAsDeoptimizing();
   }
-  ASSERT(expr->key()->IsPropertyName());
-  Handle<Object> name = expr->key()->AsLiteral()->handle();
   HValue* context = environment()->LookupContext();
-  return new(zone()) HLoadNamedGeneric(context, obj, name);
+  return new(zone()) HLoadNamedGeneric(context, object, name);
 }
 
 
-HInstruction* HGraphBuilder::BuildCallGetter(HValue* obj,
-                                             Property* expr,
+HInstruction* HGraphBuilder::BuildCallGetter(HValue* object,
                                              Handle<Map> map,
-                                             Handle<Object> callback,
+                                             Handle<AccessorPair> accessors,
                                              Handle<JSObject> holder) {
-  if (!callback->IsAccessorPair()) return BuildLoadNamedGeneric(obj, expr);
-  Handle<Object> getter(Handle<AccessorPair>::cast(callback)->getter());
-  Handle<JSFunction> function(Handle<JSFunction>::cast(getter));
-  AddCheckConstantFunction(holder, obj, map, true);
-  AddInstruction(new(zone()) HPushArgument(obj));
+  Handle<JSFunction> function(JSFunction::cast(accessors->getter()));
+  AddCheckConstantFunction(holder, object, map, true);
+  AddInstruction(new(zone()) HPushArgument(object));
   return new(zone()) HCallConstantFunction(function, 1);
 }
 
 
-HInstruction* HGraphBuilder::BuildLoadNamed(HValue* obj,
+bool HGraphBuilder::LookupAccessorPair(Handle<Map> map,
+                                       Handle<String> name,
+                                       Handle<AccessorPair>* accessors,
+                                       Handle<JSObject>* holder) {
+  LookupResult lookup(isolate());
+
+  // Check for a JavaScript accessor directly in the map.
+  map->LookupDescriptor(NULL, *name, &lookup);
+  if (lookup.IsPropertyCallbacks()) {
+    Handle<Object> callback(lookup.GetValueFromMap(*map));
+    if (!callback->IsAccessorPair()) return false;
+    *accessors = Handle<AccessorPair>::cast(callback);
+    *holder = Handle<JSObject>();
+    return true;
+  }
+
+  // Everything else, e.g. a field, can't be an accessor call.
+  if (lookup.IsFound()) return false;
+
+  // Check for a JavaScript accessor somewhere in the proto chain.
+  LookupInPrototypes(map, name, &lookup);
+  if (lookup.IsPropertyCallbacks()) {
+    Handle<Object> callback(lookup.GetValue());
+    if (!callback->IsAccessorPair()) return false;
+    *accessors = Handle<AccessorPair>::cast(callback);
+    *holder = Handle<JSObject>(lookup.holder());
+    return true;
+  }
+
+  // We haven't found a JavaScript accessor anywhere.
+  return false;
+}
+
+
+HInstruction* HGraphBuilder::BuildLoadNamed(HValue* object,
+                                            Handle<String> name,
                                             Property* expr,
-                                            Handle<Map> map,
-                                            Handle<String> name) {
+                                            Handle<Map> map) {
   LookupResult lookup(isolate());
   map->LookupDescriptor(NULL, *name, &lookup);
   if (lookup.IsField()) {
-    return BuildLoadNamedField(obj,
-                               expr,
-                               map,
-                               &lookup,
-                               true);
-  } else if (lookup.IsConstantFunction()) {
-    AddInstruction(new(zone()) HCheckNonSmi(obj));
-    AddInstruction(HCheckMaps::NewWithTransitions(obj, map, zone()));
+    return BuildLoadNamedField(object, map, &lookup, true);
+  }
+  if (lookup.IsConstantFunction()) {
+    AddInstruction(new(zone()) HCheckNonSmi(object));
+    AddInstruction(HCheckMaps::NewWithTransitions(object, map, zone()));
     Handle<JSFunction> function(lookup.GetConstantFunctionFromMap(*map));
     return new(zone()) HConstant(function, Representation::Tagged());
-  } else if (lookup.IsPropertyCallbacks()) {
-    Handle<Object> callback(lookup.GetValueFromMap(*map));
-    Handle<JSObject> holder;
-    return BuildCallGetter(obj, expr, map, callback, holder);
-  } else {
-    LookupInPrototypes(map, name, &lookup);
-    if (lookup.IsPropertyCallbacks()) {
-      Handle<Object> callback(lookup.GetValue());
-      Handle<JSObject> holder(lookup.holder());
-      return BuildCallGetter(obj, expr, map, callback, holder);
-    }
-    return BuildLoadNamedGeneric(obj, expr);
   }
+  return BuildLoadNamedGeneric(object, name, expr);
 }
 
 
 HInstruction* HGraphBuilder::BuildLoadKeyedGeneric(HValue* object,
                                                    HValue* key) {
   HValue* context = environment()->LookupContext();
   return new(zone()) HLoadKeyedGeneric(context, object, key);
 }
 
 
@@ skipping 596 matching lines @@
 
   } else if (expr->IsFunctionPrototype()) {
     HValue* function = Pop();
     AddInstruction(new(zone()) HCheckNonSmi(function));
     instr = new(zone()) HLoadFunctionPrototype(function);
 
   } else if (expr->key()->IsPropertyName()) {
     Handle<String> name = expr->key()->AsLiteral()->AsPropertyName();
     SmallMapList* types = expr->GetReceiverTypes();
 
-    HValue* obj = Pop();
     if (expr->IsMonomorphic()) {
-      instr = BuildLoadNamed(obj, expr, types->first(), name);
+      Handle<Map> map = types->first();
+      Handle<AccessorPair> accessors;
+      Handle<JSObject> holder;
+      if (LookupAccessorPair(map, name, &accessors, &holder)) {
+        AddCheckConstantFunction(holder, Top(), map, true);
+        Handle<JSFunction> getter(JSFunction::cast(accessors->getter()));
+        if (TryInlineGetter(getter, expr->id(), expr->ReturnId())) return;
+        AddInstruction(new(zone()) HPushArgument(Pop()));
+        instr = new(zone()) HCallConstantFunction(getter, 1);
+      } else {
+        instr = BuildLoadNamed(Pop(), name, expr, map);
+      }
     } else if (types != NULL && types->length() > 1) {
-      AddInstruction(new(zone()) HCheckNonSmi(obj));
-      HandlePolymorphicLoadNamedField(expr, obj, types, name);
-      return;
+      return HandlePolymorphicLoadNamedField(expr, Pop(), types, name);
     } else {
-      instr = BuildLoadNamedGeneric(obj, expr);
+      instr = BuildLoadNamedGeneric(Pop(), name, expr);
     }
 
   } else {
     CHECK_ALIVE(VisitForValue(expr->key()));
 
     HValue* key = Pop();
-    HValue* obj = Pop();
+    HValue* object = Pop();
 
     bool has_side_effects = false;
     HValue* load = HandleKeyedElementAccess(
-        obj, key, NULL, expr, expr->id(), expr->position(),
+        object, key, NULL, expr, expr->id(), expr->position(),
         false,  // is_store
         &has_side_effects);
     if (has_side_effects) {
       if (ast_context()->IsEffect()) {
         AddSimulate(expr->id());
       } else {
         Push(load);
         AddSimulate(expr->id());
         Drop(1);
       }
@@ skipping 529 matching lines @@
   return TryInline(CALL_AS_FUNCTION,
                    expr->target(),
                    expr->arguments()->length(),
                    receiver,
                    expr->id(),
                    expr->ReturnId(),
                    CONSTRUCT_CALL_RETURN);
 }
 
 
+bool HGraphBuilder::TryInlineGetter(Handle<JSFunction> getter,
+                                    int ast_id,
+                                    int return_id) {
+  return TryInline(CALL_AS_METHOD,
+                   getter,
+                   0,
+                   NULL,
+                   ast_id,
+                   return_id,
+                   NORMAL_RETURN);
+}
+
+
+bool HGraphBuilder::TryInlineSetter(Handle<JSFunction> setter,
+                                    int ast_id,
+                                    int return_id) {
+  return TryInline(CALL_AS_METHOD,
+                   setter,
+                   1,
+                   NULL,
+                   ast_id,
+                   return_id,
+                   NORMAL_RETURN);
+}
+
+
 bool HGraphBuilder::TryInlineBuiltinFunctionCall(Call* expr, bool drop_extra) {
   if (!expr->target()->shared()->HasBuiltinFunctionId()) return false;
   BuiltinFunctionId id = expr->target()->shared()->builtin_function_id();
   switch (id) {
     case kMathRound:
     case kMathAbs:
     case kMathSqrt:
     case kMathLog:
     case kMathSin:
     case kMathCos:
@@ skipping 898 matching lines @@
     ASSERT(prop != NULL);
     prop->RecordTypeFeedback(oracle(), zone());
 
     if (prop->key()->IsPropertyName()) {
       // Named property.
       if (returns_original_input) Push(graph_->GetConstantUndefined());
 
       CHECK_ALIVE(VisitForValue(prop->obj()));
       HValue* obj = Top();
 
+      Handle<String> name = prop->key()->AsLiteral()->AsPropertyName();
       Handle<Map> map;
       HInstruction* load;
       if (prop->IsMonomorphic()) {
-        Handle<String> name = prop->key()->AsLiteral()->AsPropertyName();
         map = prop->GetReceiverTypes()->first();
-        load = BuildLoadNamed(obj, prop, map, name);
+        Handle<AccessorPair> accessors;
+        Handle<JSObject> holder;
+        if (LookupAccessorPair(map, name, &accessors, &holder)) {
+          load = BuildCallGetter(obj, map, accessors, holder);
+        } else {
+          load = BuildLoadNamed(obj, name, prop, map);
+        }
       } else {
-        load = BuildLoadNamedGeneric(obj, prop);
+        load = BuildLoadNamedGeneric(obj, name, prop);
       }
       PushAndAdd(load);
       if (load->HasObservableSideEffects()) AddSimulate(expr->CountId());
 
       after = BuildIncrement(returns_original_input, expr);
       input = Pop();
 
       HInstruction* store;
-      CHECK_ALIVE(store = BuildStoreNamed(obj, after, map, prop->key()));
+      if (map.is_null()) {
+        // If we don't know the monomorphic type, do a generic store.
+        CHECK_ALIVE(store = BuildStoreNamedGeneric(obj, name, after));
+      } else {
+        Handle<AccessorPair> accessors;
+        Handle<JSObject> holder;
+        if (LookupAccessorPair(map, name, &accessors, &holder)) {
+          CHECK_ALIVE(store = BuildCallSetter(obj,
+                                              after,
+                                              map,
+                                              accessors,
+                                              holder));
+        } else {
+          CHECK_ALIVE(store = BuildStoreNamed(obj, name, after, map));
+        }
+      }
       AddInstruction(store);
 
       // Overwrite the receiver in the bailout environment with the result
       // of the operation, and the placeholder with the original value if
       // necessary.
       environment()->SetExpressionStackAt(0, after);
       if (returns_original_input) environment()->SetExpressionStackAt(1, input);
       if (store->HasObservableSideEffects()) AddSimulate(expr->AssignmentId());
 
     } else {
@@ skipping 1364 matching lines @@
     Handle<JSFunction> target,
     int arguments,
     FunctionLiteral* function,
     HConstant* undefined,
     CallKind call_kind,
     bool is_construct) const {
   ASSERT(frame_type() == JS_FUNCTION);
 
   // Outer environment is a copy of this one without the arguments.
   int arity = function->scope()->num_parameters();
-
   HEnvironment* outer = Copy();
   outer->Drop(arguments + 1);  // Including receiver.
   outer->ClearHistory();
 
   if (is_construct) {
     // Create artificial constructor stub environment.  The receiver should
     // actually be the constructor function, but we pass the newly allocated
     // object instead, DoComputeConstructStubFrame() relies on that.
     outer = CreateStubEnvironment(outer, target, JS_CONSTRUCT, arguments);
   }
@@ skipping 370 matching lines @@
     }
   }
 
 #ifdef DEBUG
   if (graph_ != NULL) graph_->Verify(false);  // No full verify.
   if (allocator_ != NULL) allocator_->Verify();
 #endif
 }
 
 } }  // namespace v8::internal