Remove prototype checks for leaf maps in optimized code.

src/objects.cc

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 3606 matching lines @@
   int instance_size_delta = map_of_this->instance_size() - new_instance_size;
   ASSERT(instance_size_delta >= 0);
   current_heap->CreateFillerObjectAt(this->address() + new_instance_size,
                                      instance_size_delta);
   if (Marking::IsBlack(Marking::MarkBitFrom(this))) {
     MemoryChunk::IncrementLiveBytesFromMutator(this->address(),
                                                -instance_size_delta);
   }
 
   set_map(new_map);
+  map_of_this->DeoptimizeDependentCodes(DependentCodes::kPrototypeCheckGroup);
 
   set_properties(dictionary);
 
   current_heap->isolate()->counters()->props_to_dictionary()->Increment();
 
 #ifdef DEBUG
   if (FLAG_trace_normalization) {
     PrintF("Object properties have been normalized:\n");
     Print();
   }
@@ skipping 1648 matching lines @@
   MaybeObject* maybe_result = RawCopy(instance_size());
   if (!maybe_result->To(&result)) return maybe_result;
 
   // Please note instance_type and instance_size are set when allocated.
   result->set_inobject_properties(inobject_properties());
   result->set_unused_property_fields(unused_property_fields());
 
   result->set_pre_allocated_property_fields(pre_allocated_property_fields());
   result->set_is_shared(false);
   result->ClearCodeCache(GetHeap());
+  DeoptimizeDependentCodes(DependentCodes::kPrototypeCheckGroup);

[Toon Verwaest, 2013/02/11 12:23:45]

Placing this in CopyDropDescriptors is probably a bit too heavy-weight, given
that you only care about this when transitions are added. I presume you could
rather use the Map::AddTransition api as entry-point to deoptimize. It already
special-cases for the case that you are adding the first transition.

[ulan, 2013/02/12 13:42:07]

As discussed offline, adding abstraction function here to track object layout
changes that not necessarily lead to AddTransition.

   return result;
 }
 
 
 MaybeObject* Map::ShareDescriptor(DescriptorArray* descriptors,
                                   Descriptor* descriptor) {
   // Sanity check. This path is only to be taken if the map owns its descriptor
   // array, implying that its NumberOfOwnDescriptors equals the number of
   // descriptors in the descriptor array.
   ASSERT(NumberOfOwnDescriptors() ==
@@ skipping 4243 matching lines @@
 bool DependentCodes::Contains(DependencyGroup group, Code* code) {
   GroupStartIndexes starts;
   ComputeGroupStartIndexes(starts);
   int number_of_codes = starts[kGroupCount];
   for (int i = 0; i < number_of_codes; i++) {
     if (code_at(i) == code) return true;
   }
   return false;
 }
 
+class DeoptimizeDependentCodeFilter : public OptimizedFunctionFilter {
+ public:
+  virtual bool TakeFunction(JSFunction* function) {
+    return function->code()->marked_for_deoptimization();
+  }
+};
+
+
+void Map::DeoptimizeDependentCodes(DependentCodes::DependencyGroup group) {
+  AssertNoAllocation no_allocation_scope;
+  DependentCodes* codes = dependent_codes();
+  DependentCodes::GroupStartIndexes starts;
+  codes->ComputeGroupStartIndexes(starts);
+  int start = starts[group];
+  int end = starts[group + 1];
+  int number_of_codes = starts[DependentCodes::kGroupCount];
+  if (start == end) return;
+  for (int i = start; i < end; i++) {
+    Code* code = codes->code_at(i);
+    if (!code->marked_for_deoptimization()) {
+      code->set_marked_for_deoptimization(true);
+    }

[Toon Verwaest, 2013/02/11 12:23:45]

I guess the if(!..) { } is not necessary; since after you go over it, it'll
always be set to true. I presume set_marked doesn't trigger extra computation
given that it's lowercase; but if it does, you could move the condition in that
method.

[ulan, 2013/02/12 13:42:07]

Done.

+  }

[Toon Verwaest, 2013/02/11 12:23:45]

I don't particularly like this API. It seems like we'd want to have an iterator
here. Also codes->Compute...(starts) seems a bit odd. Why not just
::GroupStartIndexes starts(codes) and let the constructor compute?

[ulan, 2013/02/12 13:42:07]

Done.

+  for (int src = end, dst = start; src < number_of_codes; src++, dst++) {
+    codes->set_code_at(dst, codes->code_at(src));
+  }
+  codes->set_number_of_codes(group, 0);
+  DeoptimizeDependentCodeFilter filter;
+  Deoptimizer::DeoptimizeAllFunctionsWith(&filter);
+}
+
 
 MaybeObject* JSReceiver::SetPrototype(Object* value,
                                       bool skip_hidden_prototypes) {
 #ifdef DEBUG
   int size = Size();
 #endif
 
   Heap* heap = GetHeap();
   // Silently ignore the change if value is not a JSObject or null.
   // SpiderMonkey behaves this way.
@@ skipping 4342 matching lines @@
   set_year(Smi::FromInt(year), SKIP_WRITE_BARRIER);
   set_month(Smi::FromInt(month), SKIP_WRITE_BARRIER);
   set_day(Smi::FromInt(day), SKIP_WRITE_BARRIER);
   set_weekday(Smi::FromInt(weekday), SKIP_WRITE_BARRIER);
   set_hour(Smi::FromInt(hour), SKIP_WRITE_BARRIER);
   set_min(Smi::FromInt(min), SKIP_WRITE_BARRIER);
   set_sec(Smi::FromInt(sec), SKIP_WRITE_BARRIER);
 }
 
 } }  // namespace v8::internal