[ic] Fix store handler selection for arguments objects
Drive-by: fix printing of handlers in --trace-feedback-updates mode.
Bug: chromium:1450481
Change-Id: I1c0084701f7f8959da508481cab7a81a2bca3c8d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4584248
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/main@{#88021}
diff --git a/src/diagnostics/objects-printer.cc b/src/diagnostics/objects-printer.cc
index 47f90f8..63d7993 100644
--- a/src/diagnostics/objects-printer.cc
+++ b/src/diagnostics/objects-printer.cc
@@ -1338,12 +1338,18 @@
case FeedbackSlotKind::kSetKeyedStrict: {
os << InlineCacheState2String(ic_state());
if (ic_state() == InlineCacheState::MONOMORPHIC) {
- os << "\n " << Brief(GetFeedback()) << ": ";
- Object handler = GetFeedbackExtra().GetHeapObjectOrSmi();
- if (handler.IsWeakFixedArray()) {
- handler = WeakFixedArray::cast(handler).Get(0).GetHeapObjectOrSmi();
+ HeapObject feedback = GetFeedback().GetHeapObject();
+ HeapObject feedback_extra = GetFeedbackExtra().GetHeapObject();
+ if (feedback.IsName()) {
+ os << " with name " << Brief(feedback);
+ WeakFixedArray array = WeakFixedArray::cast(feedback_extra);
+ os << "\n " << Brief(array.Get(0)) << ": ";
+ Object handler = array.Get(1).GetHeapObjectOrSmi();
+ StoreHandler::PrintHandler(handler, os);
+ } else {
+ os << "\n " << Brief(feedback) << ": ";
+ StoreHandler::PrintHandler(feedback_extra, os);
}
- StoreHandler::PrintHandler(handler, os);
} else if (ic_state() == InlineCacheState::POLYMORPHIC) {
HeapObject feedback = GetFeedback().GetHeapObject();
WeakFixedArray array;
diff --git a/src/ic/handler-configuration.cc b/src/ic/handler-configuration.cc
index 29dd9fa..306ff49 100644
--- a/src/ic/handler-configuration.cc
+++ b/src/ic/handler-configuration.cc
@@ -596,8 +596,11 @@
os << ", validity cell = ";
store_handler.validity_cell().ShortPrint(os);
os << ")" << std::endl;
+ } else if (handler.IsMap()) {
+ os << "StoreHandler(field transition to " << Brief(handler) << ")"
+ << std::endl;
} else {
- os << "StoreHandler(<unexpected>)(" << Brief(handler) << ")";
+ os << "StoreHandler(<unexpected>)(" << Brief(handler) << ")" << std::endl;
}
}
diff --git a/src/ic/ic.cc b/src/ic/ic.cc
index 05ee161..3bc8653 100644
--- a/src/ic/ic.cc
+++ b/src/ic/ic.cc
@@ -2303,10 +2303,18 @@
receiver_map->has_sealed_elements() ||
receiver_map->has_nonextensible_elements() ||
receiver_map->has_typed_array_or_rab_gsab_typed_array_elements()) {
+ // TODO(jgruber): Update counter name.
TRACE_HANDLER_STATS(isolate(), KeyedStoreIC_StoreFastElementStub);
- code = StoreHandler::StoreFastElementBuiltin(isolate(), store_mode);
- if (receiver_map->has_typed_array_or_rab_gsab_typed_array_elements()) {
- return code;
+ if (receiver_map->IsJSArgumentsObjectMap() &&
+ receiver_map->has_fast_packed_elements()) {
+ // Allow fast behaviour for in-bounds stores while making it miss and
+ // properly handle the out of bounds store case.
+ code = StoreHandler::StoreFastElementBuiltin(isolate(), STANDARD_STORE);
+ } else {
+ code = StoreHandler::StoreFastElementBuiltin(isolate(), store_mode);
+ if (receiver_map->has_typed_array_or_rab_gsab_typed_array_elements()) {
+ return code;
+ }
}
} else if (IsStoreInArrayLiteralIC()) {
// TODO(jgruber): Update counter name.
@@ -2317,7 +2325,7 @@
TRACE_HANDLER_STATS(isolate(), KeyedStoreIC_StoreElementStub);
DCHECK(DICTIONARY_ELEMENTS == receiver_map->elements_kind() ||
receiver_map->has_frozen_elements());
- code = StoreHandler::StoreSlow(isolate(), store_mode);
+ return StoreHandler::StoreSlow(isolate(), store_mode);
}
if (IsAnyDefineOwn() || IsStoreInArrayLiteralIC()) return code;
diff --git a/src/objects/map-inl.h b/src/objects/map-inl.h
index 50b16f6..7eb247e 100644
--- a/src/objects/map-inl.h
+++ b/src/objects/map-inl.h
@@ -621,6 +621,10 @@
return IsFastElementsKind(elements_kind());
}
+bool Map::has_fast_packed_elements() const {
+ return IsFastPackedElementsKind(elements_kind());
+}
+
bool Map::has_sloppy_arguments_elements() const {
return IsSloppyArgumentsElementsKind(elements_kind());
}
diff --git a/src/objects/map.h b/src/objects/map.h
index 8718fac..af5e9ae 100644
--- a/src/objects/map.h
+++ b/src/objects/map.h
@@ -429,6 +429,7 @@
inline bool has_fast_smi_or_object_elements() const;
inline bool has_fast_double_elements() const;
inline bool has_fast_elements() const;
+ inline bool has_fast_packed_elements() const;
inline bool has_sloppy_arguments_elements() const;
inline bool has_fast_sloppy_arguments_elements() const;
inline bool has_fast_string_wrapper_elements() const;