Improve load IC so it can call a native accessor even if the holder is

Improve load IC so it can call a native accessor even if the holder is
in dictionary mode.  Add a flag to all maps to indicate whether they are
used for dictionary (normalized) objects or fast mode objects.
Committed: https://code.google.com/p/v8/source/detail?r=12264

[Toon Verwaest, 2012-08-06 13:49:24]

lgtm with nits.

http://codereview.chromium.org/10831153/diff/2002/benchmarks/run.js
File benchmarks/run.js (right):

http://codereview.chromium.org/10831153/diff/2002/benchmarks/run.js#newcode37
benchmarks/run.js:37: //load('navier-stokes.js');
Probably shouldn't disable the benchmarks?

http://codereview.chromium.org/10831153/diff/2002/src/arm/stub-cache-arm.cc
File src/arm/stub-cache-arm.cc (right):

http://codereview.chromium.org/10831153/diff/2002/src/arm/stub-cache-arm.cc#n...
src/arm/stub-cache-arm.cc:1257: Register index = scratch2;
If you do this assignment before passing scratch2 (index) into
GeneratePositiveLookup, half of the comment becomes unnecessary.

http://codereview.chromium.org/10831153/diff/2002/src/objects.cc
File src/objects.cc (right):

http://codereview.chromium.org/10831153/diff/2002/src/objects.cc#newcode3222
src/objects.cc:3222: Map::cast(result)->set_dictionary_map(true);
This is superfluous since CopyNormalized already sets the map to dictionary_map.

[Erik Corry, 2012-08-06 14:26:46]

http://codereview.chromium.org/10831153/diff/2002/benchmarks/run.js
File benchmarks/run.js (right):

http://codereview.chromium.org/10831153/diff/2002/benchmarks/run.js#newcode37
benchmarks/run.js:37: //load('navier-stokes.js');
On 2012/08/06 13:49:24, Toon Verwaest wrote:
> Probably shouldn't disable the benchmarks?

Oops!

http://codereview.chromium.org/10831153/diff/2002/src/arm/stub-cache-arm.cc
File src/arm/stub-cache-arm.cc (right):

http://codereview.chromium.org/10831153/diff/2002/src/arm/stub-cache-arm.cc#n...
src/arm/stub-cache-arm.cc:1257: Register index = scratch2;
On 2012/08/06 13:49:24, Toon Verwaest wrote:
> If you do this assignment before passing scratch2 (index) into
> GeneratePositiveLookup, half of the comment becomes unnecessary.

Done.

http://codereview.chromium.org/10831153/diff/2002/src/objects.cc
File src/objects.cc (right):

http://codereview.chromium.org/10831153/diff/2002/src/objects.cc#newcode3222
src/objects.cc:3222: Map::cast(result)->set_dictionary_map(true);
On 2012/08/06 13:49:24, Toon Verwaest wrote:
> This is superfluous since CopyNormalized already sets the map to
dictionary_map.

Done.

[Michael Starzinger, 2012-08-13 17:47:16]

I have some drive-by comments for this CL.

https://chromiumcodereview.appspot.com/10831153/diff/2002/src/ia32/stub-cache...
File src/ia32/stub-cache-ia32.cc (right):

https://chromiumcodereview.appspot.com/10831153/diff/2002/src/ia32/stub-cache...
src/ia32/stub-cache-ia32.cc:1110: receiver, name_reg, scratch1, scratch2,
scratch3, callback, name, miss);
This performs a dictionary lookup on the receiver, not the holder, we should use
"reg" instead of "receiver" in this call.

https://chromiumcodereview.appspot.com/10831153/diff/2002/src/ic.cc
File src/ic.cc (left):

https://chromiumcodereview.appspot.com/10831153/diff/2002/src/ic.cc#oldcode992
src/ic.cc:992: if (!holder->HasFastProperties()) return;
What about the KeyedLoadIC?

https://chromiumcodereview.appspot.com/10831153/diff/2002/src/ic.cc#oldcode1000
src/ic.cc:1000: if (!holder->HasFastProperties()) return;
Why can we generate a JavaScript getter call for a slow holder now? We are not
doing any positive dictionary lookup there.