Allow NORMAL ICs to go polymorphic.

src/ic.cc

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 960 matching lines @@
   receiver_maps->Add(new_receiver_map);
   return true;
 }
 
 
 bool IC::UpdatePolymorphicIC(State state,
                              Handle<JSObject> receiver,
                              Handle<String> name,
                              Handle<Code> code,
                              StrictModeFlag strict_mode) {
-  if (code->type() == Code::NORMAL) return false;
-  if (target()->ic_state() == MONOMORPHIC &&
-      target()->type() == Code::NORMAL) {
-    return false;
-  }
-
   MapHandleList receiver_maps;
   CodeHandleList handlers;
 
   int number_of_valid_maps;
   int handler_to_overwrite = -1;
   Handle<Map> new_receiver_map(receiver->map());
   {
     DisallowHeapAllocation no_gc;
-    target()->FindAllMaps(&receiver_maps);
+    if (target()->ic_state() == POLYMORPHIC ||
+        (target()->ic_state() == MONOMORPHIC &&
+         target()->type() != Code::NORMAL)) {
+      target()->FindAllMaps(&receiver_maps);
+    }
+
     int number_of_maps = receiver_maps.length();
     number_of_valid_maps = number_of_maps;
 
     for (int i = 0; i < number_of_maps; i++) {
       Handle<Map> map = receiver_maps.at(i);
       // Filter out deprecated maps to ensure its instances get migrated.
       if (map->is_deprecated()) {
         number_of_valid_maps--;
       // If the receiver map is already in the polymorphic IC, this indicates
       // there was a prototoype chain failure. In that case, just overwrite the
       // handler.
       } else if (map.is_identical_to(new_receiver_map)) {
         number_of_valid_maps--;
         handler_to_overwrite = i;
       }
     }
 
     if (number_of_valid_maps >= 4) return false;
 
-    // Only allow 0 maps in case target() was reset to UNINITIALIZED by the GC.
-    // In that case, allow the IC to go back monomorphic.
-    if (number_of_maps == 0 && target()->ic_state() != UNINITIALIZED) {
-      return false;
+    if (number_of_maps > 0) {
+      target()->FindAllCode(&handlers, receiver_maps.length());
     }
-    target()->FindAllCode(&handlers, receiver_maps.length());
   }
 
   number_of_valid_maps++;
   if (handler_to_overwrite >= 0) {
     handlers.Set(handler_to_overwrite, code);
   } else {
     receiver_maps.Add(new_receiver_map);
     handlers.Add(code);
   }
 
@@ skipping 2050 matching lines @@
 #undef ADDR
 };
 
 
 Address IC::AddressFromUtilityId(IC::UtilityId id) {
   return IC_utilities[id];
 }
 
 
 } }  // namespace v8::internal