Properly filter types using the initial map from HAllocate.

src/hydrogen.cc

Index: src/hydrogen.cc
diff --git a/src/hydrogen.cc b/src/hydrogen.cc
index d6b8d64db67893b77badd7795c404ee9362531e8..7840bbf58bb6bc9f8f78cee59bfcca29266519a4 100644
--- a/src/hydrogen.cc
+++ b/src/hydrogen.cc
@@ -4990,12 +4990,20 @@ void HOptimizedGraphBuilder::BuildStoreNamed(Expression* expr,
 
   HInstruction* instr = NULL;
   SmallMapList* types = expr->GetReceiverTypes();
+
   bool monomorphic = expr->IsMonomorphic();
+  if (types != NULL && object->HasMonomorphicJSObjectType()) {
+    types->FilterForPossibleTransitions(
+        object->GetMonomorphicJSObjectMap()->FindRootMap(), zone());
+    monomorphic = types->length() == 1;
+  }
+
   Handle<Map> map;
   if (monomorphic) {
     map = types->first();
     monomorphic = CanInlinePropertyAccess(*map);
   }
+
   if (monomorphic) {
     Handle<JSFunction> setter;
     Handle<JSObject> holder;
@@ -5692,7 +5700,16 @@ HValue* HOptimizedGraphBuilder::HandleKeyedElementAccess(
     bool* has_side_effects) {
   ASSERT(!expr->IsPropertyName());
   HInstruction* instr = NULL;
-  if (expr->IsMonomorphic()) {
+  bool monomorphic = expr->IsMonomorphic();
+  SmallMapList* types = expr->GetReceiverTypes();
+
+  if (types != NULL && obj->HasMonomorphicJSObjectType()) {

[Michael Starzinger, 2013/09/05 20:07:23]

suggestion: Does it make sense to factor this out into a static helper method
that computes the receiver types for us? I was thinking along the lines of a
method with either of the following signatures (I prefer the first one)...

// Return true if receiver is monomorphic.
static bool ComputeReceiverTypes(Expression* expr,
                                 Object* receiver,
                                 SmallMapList** types);

static SmallMapList* ComputeReceiverTypes(Expression* expr,
                                          Object* receiver,
                                          bool* monomorphic);

[Toon Verwaest, 2013/09/06 09:23:12]

Done.

+    types->FilterForPossibleTransitions(
+        obj->GetMonomorphicJSObjectMap()->FindRootMap(), zone());
+    monomorphic = types->length() == 1;
+  }
+
+  if (monomorphic) {
     Handle<Map> map = expr->GetMonomorphicReceiverType();
     if (map->has_slow_elements_kind()) {
       instr = is_store ? BuildStoreKeyedGeneric(obj, key, val)
@@ -5861,15 +5878,19 @@ void HOptimizedGraphBuilder::BuildLoad(Property* expr,
     SmallMapList* types = expr->GetReceiverTypes();
     HValue* object = Top();
 
+    bool monomorphic = expr->IsMonomorphic();
+    if (types != NULL && object->HasMonomorphicJSObjectType()) {
+      types->FilterForPossibleTransitions(
+          object->GetMonomorphicJSObjectMap()->FindRootMap(), zone());
+      monomorphic = types->length() == 1;
+    }
+
     Handle<Map> map;
-    bool monomorphic = false;
-    if (expr->IsMonomorphic()) {
+    if (monomorphic) {
       map = types->first();
       monomorphic = CanInlinePropertyAccess(*map);
-    } else if (object->HasMonomorphicJSObjectType()) {
-      map = object->GetMonomorphicJSObjectMap();
-      monomorphic = CanInlinePropertyAccess(*map);
     }
+
     if (monomorphic) {
       Handle<JSFunction> getter;
       Handle<JSObject> holder;
@@ -6967,7 +6988,18 @@ void HOptimizedGraphBuilder::VisitCall(Call* expr) {
     Handle<String> name = prop->key()->AsLiteral()->AsPropertyName();
     SmallMapList* types = expr->GetReceiverTypes();
 
+

[Michael Starzinger, 2013/09/05 20:07:23]

nit: Drop one of the two empty newlines.

+    HValue* receiver =
+        environment()->ExpressionStackAt(expr->arguments()->length());
+
     bool monomorphic = expr->IsMonomorphic();
+    if (types != NULL && receiver->HasMonomorphicJSObjectType()) {
+      types->FilterForPossibleTransitions(
+          receiver->GetMonomorphicJSObjectMap()->FindRootMap(), zone());
+      monomorphic = types->length() == 1 &&
+          expr->ComputeTarget(types->at(0), name);
+    }
+
     Handle<Map> receiver_map;
     if (monomorphic) {
       receiver_map = (types == NULL || types->is_empty())

[Michael Starzinger, 2013/09/05 20:07:23]

I know it's not part of this change, but can "types" really be NULL or empty of
expr->IsMonomorphic() reports true? The lines 7003 until 7008 look needlessly
verbose.

@@ -6975,8 +7007,6 @@ void HOptimizedGraphBuilder::VisitCall(Call* expr) {
           : types->first();
     }
 
-    HValue* receiver =
-        environment()->ExpressionStackAt(expr->arguments()->length());
     if (monomorphic) {
       if (TryInlineBuiltinMethodCall(expr,
                                      receiver,