CSE2410 Fall 2014 Bounce

// Copyright 2012 the V8 project authors. All rights reserved.

// Redistribution and use in source and binary forms, with or without

// modification, are permitted provided that the following conditions are

// met:

//

//     * Redistributions of source code must retain the above copyright

//       notice, this list of conditions and the following disclaimer.

//     * Redistributions in binary form must reproduce the above

//       copyright notice, this list of conditions and the following

//       disclaimer in the documentation and/or other materials provided

//       with the distribution.

//     * Neither the name of Google Inc. nor the names of its

//       contributors may be used to endorse or promote products derived

//       from this software without specific prior written permission.

//

// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS

// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT

// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR

// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT

// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,

// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT

// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,

// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY

// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT

// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE

// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

#include "v8.h"

#include "accessors.h"

#include "api.h"

#include "arguments.h"

#include "codegen.h"

#include "execution.h"

#include "ic-inl.h"

#include "runtime.h"

#include "stub-cache.h"

namespace v8 {

namespace internal {

#ifdef DEBUG

char IC::TransitionMarkFromState(IC::State state) {

  switch (state) {

    case UNINITIALIZED: return '0';

    case PREMONOMORPHIC: return '.';

    case MONOMORPHIC: return '1';

    case MONOMORPHIC_PROTOTYPE_FAILURE: return '^';

    case POLYMORPHIC: return 'P';

    case MEGAMORPHIC: return 'N';

    case GENERIC: return 'G';

    // We never see the debugger states here, because the state is

    // computed from the original code - not the patched code. Let

    // these cases fall through to the unreachable code below.

    case DEBUG_STUB: break;

  }

  UNREACHABLE();

  return 0;

}

const char* GetTransitionMarkModifier(KeyedAccessStoreMode mode) {

  if (mode == STORE_NO_TRANSITION_HANDLE_COW) return ".COW";

  if (mode == STORE_NO_TRANSITION_IGNORE_OUT_OF_BOUNDS) {

    return ".IGNORE_OOB";

  }

  if (IsGrowStoreMode(mode)) return ".GROW";

  return "";

}

void IC::TraceIC(const char* type,

                 Handle<Object> name) {

  if (FLAG_trace_ic) {

    Code* new_target = raw_target();

    State new_state = new_target->ic_state();

    PrintF("[%s%s in ", new_target->is_keyed_stub() ? "Keyed" : "", type);

    StackFrameIterator it(isolate());

    while (it.frame()->fp() != this->fp()) it.Advance();

    StackFrame* raw_frame = it.frame();

    if (raw_frame->is_internal()) {

      Code* apply_builtin = isolate()->builtins()->builtin(

          Builtins::kFunctionApply);

      if (raw_frame->unchecked_code() == apply_builtin) {

        PrintF("apply from ");

        it.Advance();

        raw_frame = it.frame();

      }

    }

    JavaScriptFrame::PrintTop(isolate(), stdout, false, true);

    Code::ExtraICState extra_state = new_target->extra_ic_state();

    const char* modifier =

        GetTransitionMarkModifier(Code::GetKeyedAccessStoreMode(extra_state));

    PrintF(" (%c->%c%s)",

           TransitionMarkFromState(state()),

           TransitionMarkFromState(new_state),

           modifier);

    name->Print();

    PrintF("]\n");

  }

}

#define TRACE_GENERIC_IC(isolate, type, reason)                 \

  do {                                                          \

    if (FLAG_trace_ic) {                                        \

      PrintF("[%s patching generic stub in ", type);            \

      JavaScriptFrame::PrintTop(isolate, stdout, false, true);  \

      PrintF(" (%s)]\n", reason);                               \

    }                                                           \

  } while (false)

#else

#define TRACE_GENERIC_IC(isolate, type, reason)

#endif  // DEBUG

#define TRACE_IC(type, name)             \

  ASSERT((TraceIC(type, name), true))

IC::IC(FrameDepth depth, Isolate* isolate)

    : isolate_(isolate),

      target_set_(false) {

  // To improve the performance of the (much used) IC code, we unfold a few

  // levels of the stack frame iteration code. This yields a ~35% speedup when

  // running DeltaBlue and a ~25% speedup of gbemu with the '--nouse-ic' flag.

  const Address entry =

      Isolate::c_entry_fp(isolate->thread_local_top());

  Address* pc_address =

      reinterpret_cast<Address*>(entry + ExitFrameConstants::kCallerPCOffset);

  Address fp = Memory::Address_at(entry + ExitFrameConstants::kCallerFPOffset);

  // If there's another JavaScript frame on the stack or a

  // StubFailureTrampoline, we need to look one frame further down the stack to

  // find the frame pointer and the return address stack slot.

  if (depth == EXTRA_CALL_FRAME) {

    const int kCallerPCOffset = StandardFrameConstants::kCallerPCOffset;

    pc_address = reinterpret_cast<Address*>(fp + kCallerPCOffset);

    fp = Memory::Address_at(fp + StandardFrameConstants::kCallerFPOffset);

  }

#ifdef DEBUG

  StackFrameIterator it(isolate);

  for (int i = 0; i < depth + 1; i++) it.Advance();

  StackFrame* frame = it.frame();

  ASSERT(fp == frame->fp() && pc_address == frame->pc_address());

#endif

  fp_ = fp;

  pc_address_ = StackFrame::ResolveReturnAddressLocation(pc_address);

  target_ = handle(raw_target(), isolate);

  state_ = target_->ic_state();

}

#ifdef ENABLE_DEBUGGER_SUPPORT

Address IC::OriginalCodeAddress() const {

  HandleScope scope(isolate());

  // Compute the JavaScript frame for the frame pointer of this IC

  // structure. We need this to be able to find the function

  // corresponding to the frame.

  StackFrameIterator it(isolate());

  while (it.frame()->fp() != this->fp()) it.Advance();

  JavaScriptFrame* frame = JavaScriptFrame::cast(it.frame());

  // Find the function on the stack and both the active code for the

  // function and the original code.

  JSFunction* function = frame->function();

  Handle<SharedFunctionInfo> shared(function->shared(), isolate());

  Code* code = shared->code();

  ASSERT(Debug::HasDebugInfo(shared));

  Code* original_code = Debug::GetDebugInfo(shared)->original_code();

  ASSERT(original_code->IsCode());

  // Get the address of the call site in the active code. This is the

  // place where the call to DebugBreakXXX is and where the IC

  // normally would be.

  Address addr = Assembler::target_address_from_return_address(pc());

  // Return the address in the original code. This is the place where

  // the call which has been overwritten by the DebugBreakXXX resides

  // and the place where the inline cache system should look.

  intptr_t delta =

      original_code->instruction_start() - code->instruction_start();

  return addr + delta;

}

#endif

static bool HasInterceptorGetter(JSObject* object) {

  return !object->GetNamedInterceptor()->getter()->IsUndefined();

}

static bool HasInterceptorSetter(JSObject* object) {

  return !object->GetNamedInterceptor()->setter()->IsUndefined();

}

static void LookupForRead(Handle<Object> object,

                          Handle<String> name,

                          LookupResult* lookup) {

  // Skip all the objects with named interceptors, but

  // without actual getter.

  while (true) {

    object->Lookup(*name, lookup);

    // Besides normal conditions (property not found or it's not

    // an interceptor), bail out if lookup is not cacheable: we won't

    // be able to IC it anyway and regular lookup should work fine.

    if (!lookup->IsInterceptor() || !lookup->IsCacheable()) {

      return;

    }

    Handle<JSObject> holder(lookup->holder(), lookup->isolate());

    if (HasInterceptorGetter(*holder)) {

      return;

    }

    holder->LocalLookupRealNamedProperty(*name, lookup);

    if (lookup->IsFound()) {

      ASSERT(!lookup->IsInterceptor());

      return;

    }

    Handle<Object> proto(holder->GetPrototype(), lookup->isolate());

    if (proto->IsNull()) {

      ASSERT(!lookup->IsFound());

      return;

    }

    object = proto;

  }

}

bool CallIC::TryUpdateExtraICState(LookupResult* lookup,

                                   Handle<Object> object) {

  if (!lookup->IsConstantFunction()) return false;

  JSFunction* function = lookup->GetConstantFunction();

  if (!function->shared()->HasBuiltinFunctionId()) return false;

  // Fetch the arguments passed to the called function.

  const int argc = target()->arguments_count();

  Address entry = isolate()->c_entry_fp(isolate()->thread_local_top());

  Address fp = Memory::Address_at(entry + ExitFrameConstants::kCallerFPOffset);

  Arguments args(argc + 1,

                 &Memory::Object_at(fp +

                                    StandardFrameConstants::kCallerSPOffset +

                                    argc * kPointerSize));

  switch (function->shared()->builtin_function_id()) {

    case kStringCharCodeAt:

    case kStringCharAt:

      if (object->IsString()) {

        String* string = String::cast(*object);

        // Check there's the right string value or wrapper in the receiver slot.

        ASSERT(string == args[0] || string == JSValue::cast(args[0])->value());

        // If we're in the default (fastest) state and the index is

        // out of bounds, update the state to record this fact.

        if (StringStubState::decode(extra_ic_state()) == DEFAULT_STRING_STUB &&

            argc >= 1 && args[1]->IsNumber()) {

          double index = DoubleToInteger(args.number_at(1));

          if (index < 0 || index >= string->length()) {

            extra_ic_state_ =

                StringStubState::update(extra_ic_state(),

                                        STRING_INDEX_OUT_OF_BOUNDS);

            return true;

          }

        }

      }

      break;

    default:

      return false;

  }

  return false;

}

bool IC::TryRemoveInvalidPrototypeDependentStub(Handle<Object> receiver,

                                                Handle<String> name) {

  DisallowHeapAllocation no_gc;

  if (target()->is_call_stub()) {

    LookupResult lookup(isolate());

    LookupForRead(receiver, name, &lookup);

    if (static_cast<CallIC*>(this)->TryUpdateExtraICState(&lookup, receiver)) {

      return true;

    }

  }

  if (target()->is_keyed_stub()) {

    // Determine whether the failure is due to a name failure.

    if (!name->IsName()) return false;

    Name* stub_name = target()->FindFirstName();

    if (*name != stub_name) return false;

  }

  InlineCacheHolderFlag cache_holder =

      Code::ExtractCacheHolderFromFlags(target()->flags());

  switch (cache_holder) {

    case OWN_MAP:

      // The stub was generated for JSObject but called for non-JSObject.

      // IC::GetCodeCacheHolder is not applicable.

      if (!receiver->IsJSObject()) return false;

      break;

    case PROTOTYPE_MAP:

      // IC::GetCodeCacheHolder is not applicable.

      if (receiver->GetPrototype(isolate())->IsNull()) return false;

      break;

  }

  Handle<Map> map(

      IC::GetCodeCacheHolder(isolate(), *receiver, cache_holder)->map());

  // Decide whether the inline cache failed because of changes to the

  // receiver itself or changes to one of its prototypes.

  //

  // If there are changes to the receiver itself, the map of the

  // receiver will have changed and the current target will not be in

  // the receiver map's code cache.  Therefore, if the current target

  // is in the receiver map's code cache, the inline cache failed due

  // to prototype check failure.

  int index = map->IndexInCodeCache(*name, *target());

  if (index >= 0) {

    map->RemoveFromCodeCache(*name, *target(), index);

    // Handlers are stored in addition to the ICs on the map. Remove those, too.

    TryRemoveInvalidHandlers(map, name);

    return true;

  }

  // The stub is not in the cache. We've ruled out all other kinds of failure

  // except for proptotype chain changes, a deprecated map, a map that's

  // different from the one that the stub expects, elements kind changes, or a

  // constant global property that will become mutable. Threat all those

  // situations as prototype failures (stay monomorphic if possible).

  // If the IC is shared between multiple receivers (slow dictionary mode), then

  // the map cannot be deprecated and the stub invalidated.

  if (cache_holder == OWN_MAP) {

    Map* old_map = target()->FindFirstMap();

    if (old_map == *map) return true;

    if (old_map != NULL) {

      if (old_map->is_deprecated()) return true;

      if (IsMoreGeneralElementsKindTransition(old_map->elements_kind(),

                                              map->elements_kind())) {

        return true;

      }

    }

  }

  if (receiver->IsGlobalObject()) {

    LookupResult lookup(isolate());

    GlobalObject* global = GlobalObject::cast(*receiver);

    global->LocalLookupRealNamedProperty(*name, &lookup);

    if (!lookup.IsFound()) return false;

    PropertyCell* cell = global->GetPropertyCell(&lookup);

    return cell->type()->IsConstant();

  }

  return false;

}

void IC::TryRemoveInvalidHandlers(Handle<Map> map, Handle<String> name) {

  CodeHandleList handlers;

  target()->FindHandlers(&handlers);

  for (int i = 0; i < handlers.length(); i++) {

    Handle<Code> handler = handlers.at(i);

    int index = map->IndexInCodeCache(*name, *handler);

    if (index >= 0) {

      map->RemoveFromCodeCache(*name, *handler, index);

      return;

    }

  }

}

void IC::UpdateState(Handle<Object> receiver, Handle<Object> name) {

  if (!name->IsString()) return;

  if (state() != MONOMORPHIC) {

    if (state() == POLYMORPHIC && receiver->IsHeapObject()) {

      TryRemoveInvalidHandlers(

          handle(Handle<HeapObject>::cast(receiver)->map()),

          Handle<String>::cast(name));

    }

    return;

  }

  if (receiver->IsUndefined() || receiver->IsNull()) return;

  // Remove the target from the code cache if it became invalid

  // because of changes in the prototype chain to avoid hitting it

  // again.

  if (TryRemoveInvalidPrototypeDependentStub(

          receiver, Handle<String>::cast(name))) {

    return MarkMonomorphicPrototypeFailure();

  }

  // The builtins object is special.  It only changes when JavaScript

  // builtins are loaded lazily.  It is important to keep inline

  // caches for the builtins object monomorphic.  Therefore, if we get

  // an inline cache miss for the builtins object after lazily loading

  // JavaScript builtins, we return uninitialized as the state to

  // force the inline cache back to monomorphic state.

  if (receiver->IsJSBuiltinsObject()) state_ = UNINITIALIZED;

}

RelocInfo::Mode IC::ComputeMode() {

  Address addr = address();

  Code* code = Code::cast(isolate()->FindCodeObject(addr));

  for (RelocIterator it(code, RelocInfo::kCodeTargetMask);

       !it.done(); it.next()) {

    RelocInfo* info = it.rinfo();

    if (info->pc() == addr) return info->rmode();

  }

  UNREACHABLE();

  return RelocInfo::NONE32;

}

Failure* IC::TypeError(const char* type,

                       Handle<Object> object,

                       Handle<Object> key) {

  HandleScope scope(isolate());

  Handle<Object> args[2] = { key, object };

  Handle<Object> error = isolate()->factory()->NewTypeError(

      type, HandleVector(args, 2));

  return isolate()->Throw(*error);

}

Failure* IC::ReferenceError(const char* type, Handle<String> name) {

  HandleScope scope(isolate());

  Handle<Object> error = isolate()->factory()->NewReferenceError(

      type, HandleVector(&name, 1));

  return isolate()->Throw(*error);

}

static int ComputeTypeInfoCountDelta(IC::State old_state, IC::State new_state) {

  bool was_uninitialized =

      old_state == UNINITIALIZED || old_state == PREMONOMORPHIC;

  bool is_uninitialized =

      new_state == UNINITIALIZED || new_state == PREMONOMORPHIC;

  return (was_uninitialized && !is_uninitialized) ?  1 :

         (!was_uninitialized && is_uninitialized) ? -1 : 0;

}

void IC::PostPatching(Address address, Code* target, Code* old_target) {

  if (FLAG_type_info_threshold == 0 && !FLAG_watch_ic_patching) {

    return;

  }

  Isolate* isolate = target->GetHeap()->isolate();

  Code* host = isolate->

      inner_pointer_to_code_cache()->GetCacheEntry(address)->code;

  if (host->kind() != Code::FUNCTION) return;

  if (FLAG_type_info_threshold > 0 &&

      old_target->is_inline_cache_stub() &&

      target->is_inline_cache_stub()) {

    int delta = ComputeTypeInfoCountDelta(old_target->ic_state(),

                                          target->ic_state());

    // Not all Code objects have TypeFeedbackInfo.

    if (host->type_feedback_info()->IsTypeFeedbackInfo() && delta != 0) {

      TypeFeedbackInfo* info =

          TypeFeedbackInfo::cast(host->type_feedback_info());

      info->change_ic_with_type_info_count(delta);

    }

  }

  if (host->type_feedback_info()->IsTypeFeedbackInfo()) {

    TypeFeedbackInfo* info =

        TypeFeedbackInfo::cast(host->type_feedback_info());

    info->change_own_type_change_checksum();

  }

  if (FLAG_watch_ic_patching) {

    host->set_profiler_ticks(0);

    isolate->runtime_profiler()->NotifyICChanged();

  }

  // TODO(2029): When an optimized function is patched, it would

  // be nice to propagate the corresponding type information to its

  // unoptimized version for the benefit of later inlining.

}

void IC::Clear(Isolate* isolate, Address address) {

  Code* target = GetTargetAtAddress(address);

  // Don't clear debug break inline cache as it will remove the break point.

  if (target->is_debug_stub()) return;

  switch (target->kind()) {

    case Code::LOAD_IC: return LoadIC::Clear(isolate, address, target);

    case Code::KEYED_LOAD_IC:

      return KeyedLoadIC::Clear(isolate, address, target);

    case Code::STORE_IC: return StoreIC::Clear(isolate, address, target);

    case Code::KEYED_STORE_IC:

      return KeyedStoreIC::Clear(isolate, address, target);

    case Code::CALL_IC: return CallIC::Clear(address, target);

    case Code::KEYED_CALL_IC:  return KeyedCallIC::Clear(address, target);

    case Code::COMPARE_IC: return CompareIC::Clear(isolate, address, target);

    case Code::COMPARE_NIL_IC: return CompareNilIC::Clear(address, target);

    case Code::BINARY_OP_IC:

    case Code::TO_BOOLEAN_IC:

      // Clearing these is tricky and does not

      // make any performance difference.

      return;

    default: UNREACHABLE();

  }

}

void CallICBase::Clear(Address address, Code* target) {

  if (IsCleared(target)) return;

  bool contextual = CallICBase::Contextual::decode(target->extra_ic_state());

  Code* code =

      target->GetIsolate()->stub_cache()->FindCallInitialize(

          target->arguments_count(),

          contextual ? RelocInfo::CODE_TARGET_CONTEXT : RelocInfo::CODE_TARGET,

          target->kind());

  SetTargetAtAddress(address, code);

}

void KeyedLoadIC::Clear(Isolate* isolate, Address address, Code* target) {

  if (IsCleared(target)) return;

  // Make sure to also clear the map used in inline fast cases.  If we

  // do not clear these maps, cached code can keep objects alive

  // through the embedded maps.

  SetTargetAtAddress(address, *pre_monomorphic_stub(isolate));

}

void LoadIC::Clear(Isolate* isolate, Address address, Code* target) {

  if (IsCleared(target)) return;

  SetTargetAtAddress(address, *pre_monomorphic_stub(isolate));

}

void StoreIC::Clear(Isolate* isolate, Address address, Code* target) {

  if (IsCleared(target)) return;

  SetTargetAtAddress(address,

      *pre_monomorphic_stub(

          isolate, Code::GetStrictMode(target->extra_ic_state())));

}

void KeyedStoreIC::Clear(Isolate* isolate, Address address, Code* target) {

  if (IsCleared(target)) return;

  SetTargetAtAddress(address,

      *pre_monomorphic_stub(

          isolate, Code::GetStrictMode(target->extra_ic_state())));

}

void CompareIC::Clear(Isolate* isolate, Address address, Code* target) {

  ASSERT(target->major_key() == CodeStub::CompareIC);

  CompareIC::State handler_state;

  Token::Value op;

  ICCompareStub::DecodeMinorKey(target->stub_info(), NULL, NULL,

                                &handler_state, &op);

  // Only clear CompareICs that can retain objects.

  if (handler_state != KNOWN_OBJECT) return;

  SetTargetAtAddress(address, GetRawUninitialized(isolate, op));

  PatchInlinedSmiCode(address, DISABLE_INLINED_SMI_CHECK);

}

Handle<Object> CallICBase::TryCallAsFunction(Handle<Object> object) {

  Handle<Object> delegate = Execution::GetFunctionDelegate(isolate(), object);

  if (delegate->IsJSFunction() && !object->IsJSFunctionProxy()) {

    // Patch the receiver and use the delegate as the function to

    // invoke. This is used for invoking objects as if they were functions.

    const int argc = target()->arguments_count();

    StackFrameLocator locator(isolate());

    JavaScriptFrame* frame = locator.FindJavaScriptFrame(0);

    int index = frame->ComputeExpressionsCount() - (argc + 1);

    frame->SetExpression(index, *object);

  }

  return delegate;

}

void CallICBase::ReceiverToObjectIfRequired(Handle<Object> callee,

                                            Handle<Object> object) {

  while (callee->IsJSFunctionProxy()) {

    callee = Handle<Object>(JSFunctionProxy::cast(*callee)->call_trap(),

                            isolate());

  }

  if (callee->IsJSFunction()) {

    Handle<JSFunction> function = Handle<JSFunction>::cast(callee);

    if (!function->shared()->is_classic_mode() || function->IsBuiltin()) {

      // Do not wrap receiver for strict mode functions or for builtins.

      return;

    }

  }

  // And only wrap string, number or boolean.

  if (object->IsString() || object->IsNumber() || object->IsBoolean()) {

    // Change the receiver to the result of calling ToObject on it.

    const int argc = this->target()->arguments_count();

    StackFrameLocator locator(isolate());

    JavaScriptFrame* frame = locator.FindJavaScriptFrame(0);

    int index = frame->ComputeExpressionsCount() - (argc + 1);

    frame->SetExpression(index, *isolate()->factory()->ToObject(object));

  }

}

static bool MigrateDeprecated(Handle<Object> object) {

  if (!object->IsJSObject()) return false;

  Handle<JSObject> receiver = Handle<JSObject>::cast(object);

  if (!receiver->map()->is_deprecated()) return false;

  JSObject::MigrateInstance(Handle<JSObject>::cast(object));

  return true;

}

MaybeObject* CallICBase::LoadFunction(Handle<Object> object,

                                      Handle<String> name) {

  bool use_ic = MigrateDeprecated(object) ? false : FLAG_use_ic;

  // If the object is undefined or null it's illegal to try to get any

  // of its properties; throw a TypeError in that case.

  if (object->IsUndefined() || object->IsNull()) {

    return TypeError("non_object_property_call", object, name);

  }

  // Check if the name is trivially convertible to an index and get

  // the element if so.

  uint32_t index;

  if (name->AsArrayIndex(&index)) {

    Handle<Object> result = Object::GetElement(isolate(), object, index);

    RETURN_IF_EMPTY_HANDLE(isolate(), result);

    if (result->IsJSFunction()) return *result;

    // Try to find a suitable function delegate for the object at hand.

    result = TryCallAsFunction(result);

    if (result->IsJSFunction()) return *result;

    // Otherwise, it will fail in the lookup step.

  }

  // Lookup the property in the object.

  LookupResult lookup(isolate());

  LookupForRead(object, name, &lookup);

  if (!lookup.IsFound()) {

    // If the object does not have the requested property, check which

    // exception we need to throw.

    return IsUndeclaredGlobal(object)

        ? ReferenceError("not_defined", name)

        : TypeError("undefined_method", object, name);

  }

  // Lookup is valid: Update inline cache and stub cache.

  if (use_ic) UpdateCaches(&lookup, object, name);

  // Get the property.

  PropertyAttributes attr;

  Handle<Object> result =

      Object::GetProperty(object, object, &lookup, name, &attr);

  RETURN_IF_EMPTY_HANDLE(isolate(), result);

  if (lookup.IsInterceptor() && attr == ABSENT) {

    // If the object does not have the requested property, check which

    // exception we need to throw.

    return IsUndeclaredGlobal(object)

        ? ReferenceError("not_defined", name)

        : TypeError("undefined_method", object, name);

  }

  ASSERT(!result->IsTheHole());

  // Make receiver an object if the callee requires it. Strict mode or builtin

  // functions do not wrap the receiver, non-strict functions and objects

  // called as functions do.

  ReceiverToObjectIfRequired(result, object);

  if (result->IsJSFunction()) {

    Handle<JSFunction> function = Handle<JSFunction>::cast(result);

#ifdef ENABLE_DEBUGGER_SUPPORT

    // Handle stepping into a function if step into is active.

    Debug* debug = isolate()->debug();

    if (debug->StepInActive()) {

      // Protect the result in a handle as the debugger can allocate and might

      // cause GC.

      debug->HandleStepIn(function, object, fp(), false);

    }

#endif

    return *function;

  }

  // Try to find a suitable function delegate for the object at hand.

  result = TryCallAsFunction(result);

  if (result->IsJSFunction()) return *result;

  return TypeError("property_not_function", object, name);

}

Handle<Code> CallICBase::ComputeMonomorphicStub(LookupResult* lookup,

                                                Handle<Object> object,

                                                Handle<String> name) {

  int argc = target()->arguments_count();

  Handle<JSObject> holder(lookup->holder(), isolate());

  switch (lookup->type()) {

    case FIELD: {

      PropertyIndex index = lookup->GetFieldIndex();

      return isolate()->stub_cache()->ComputeCallField(

          argc, kind_, extra_ic_state(), name, object, holder, index);

    }

    case CONSTANT: {

      if (!lookup->IsConstantFunction()) return Handle<Code>::null();

      // Get the constant function and compute the code stub for this

      // call; used for rewriting to monomorphic state and making sure

      // that the code stub is in the stub cache.

      Handle<JSFunction> function(lookup->GetConstantFunction(), isolate());

      return isolate()->stub_cache()->ComputeCallConstant(

          argc, kind_, extra_ic_state(), name, object, holder, function);

    }

    case NORMAL: {

      // If we return a null handle, the IC will not be patched.

      if (!object->IsJSObject()) return Handle<Code>::null();

      Handle<JSObject> receiver = Handle<JSObject>::cast(object);

      if (holder->IsGlobalObject()) {

        Handle<GlobalObject> global = Handle<GlobalObject>::cast(holder);

        Handle<PropertyCell> cell(

            global->GetPropertyCell(lookup), isolate());

        if (!cell->value()->IsJSFunction()) return Handle<Code>::null();

        Handle<JSFunction> function(JSFunction::cast(cell->value()));

        return isolate()->stub_cache()->ComputeCallGlobal(

            argc, kind_, extra_ic_state(), name,

            receiver, global, cell, function);

      } else {

        // There is only one shared stub for calling normalized

        // properties. It does not traverse the prototype chain, so the

        // property must be found in the receiver for the stub to be

        // applicable.

        if (!holder.is_identical_to(receiver)) return Handle<Code>::null();

        return isolate()->stub_cache()->ComputeCallNormal(

            argc, kind_, extra_ic_state());

      }

      break;

    }

    case INTERCEPTOR:

      ASSERT(HasInterceptorGetter(*holder));

      return isolate()->stub_cache()->ComputeCallInterceptor(

          argc, kind_, extra_ic_state(), name, object, holder);

    default:

      return Handle<Code>::null();

  }

}

Handle<Code> CallICBase::megamorphic_stub() {

  return isolate()->stub_cache()->ComputeCallMegamorphic(

      target()->arguments_count(), kind_, extra_ic_state());

}

Handle<Code> CallICBase::pre_monomorphic_stub() {

  return isolate()->stub_cache()->ComputeCallPreMonomorphic(

      target()->arguments_count(), kind_, extra_ic_state());

}

void CallICBase::UpdateCaches(LookupResult* lookup,

                              Handle<Object> object,

                              Handle<String> name) {

  // Bail out if we didn't find a result.

  if (!lookup->IsProperty() || !lookup->IsCacheable()) return;

  // Compute the number of arguments.

  Handle<Code> code;

  code = state() == UNINITIALIZED

      ? pre_monomorphic_stub()

      : ComputeMonomorphicStub(lookup, object, name);

  // If there's no appropriate stub we simply avoid updating the caches.

  // TODO(verwaest): Install a slow fallback in this case to avoid not learning,

  // and deopting Crankshaft code.

  if (code.is_null()) return;

  Handle<JSObject> cache_object = object->IsJSObject()

      ? Handle<JSObject>::cast(object)

      : Handle<JSObject>(JSObject::cast(object->GetPrototype(isolate())),

                         isolate());

  PatchCache(cache_object, name, code);

  TRACE_IC("CallIC", name);

}

MaybeObject* KeyedCallIC::LoadFunction(Handle<Object> object,

                                       Handle<Object> key) {

  if (key->IsInternalizedString()) {

    return CallICBase::LoadFunction(object, Handle<String>::cast(key));

  }

  if (object->IsUndefined() || object->IsNull()) {

    return TypeError("non_object_property_call", object, key);

  }

  bool use_ic = MigrateDeprecated(object)

      ? false : FLAG_use_ic && !object->IsAccessCheckNeeded();

  if (use_ic && state() != MEGAMORPHIC) {

    ASSERT(!object->IsJSGlobalProxy());

    int argc = target()->arguments_count();

    Handle<Code> stub = isolate()->stub_cache()->ComputeCallMegamorphic(

        argc, Code::KEYED_CALL_IC, Code::kNoExtraICState);

    if (object->IsJSObject()) {

      Handle<JSObject> receiver = Handle<JSObject>::cast(object);

      if (receiver->elements()->map() ==

          isolate()->heap()->non_strict_arguments_elements_map()) {

        stub = isolate()->stub_cache()->ComputeCallArguments(argc);

      }

    }

    ASSERT(!stub.is_null());

    set_target(*stub);

    TRACE_IC("CallIC", key);

  }

  Handle<Object> result = GetProperty(isolate(), object, key);

  RETURN_IF_EMPTY_HANDLE(isolate(), result);

  // Make receiver an object if the callee requires it. Strict mode or builtin

  // functions do not wrap the receiver, non-strict functions and objects

  // called as functions do.

  ReceiverToObjectIfRequired(result, object);

  if (result->IsJSFunction()) return *result;

  result = TryCallAsFunction(result);

  if (result->IsJSFunction()) return *result;

  return TypeError("property_not_function", object, key);

}

MaybeObject* LoadIC::Load(Handle<Object> object,

                          Handle<String> name) {

  // If the object is undefined or null it's illegal to try to get any

  // of its properties; throw a TypeError in that case.

  if (object->IsUndefined() || object->IsNull()) {

    return TypeError("non_object_property_load", object, name);

  }

  if (FLAG_use_ic) {

    // Use specialized code for getting the length of strings and

    // string wrapper objects.  The length property of string wrapper

    // objects is read-only and therefore always returns the length of

    // the underlying string value.  See ECMA-262 15.5.5.1.

    if (object->IsStringWrapper() &&

        name->Equals(isolate()->heap()->length_string())) {

      Handle<Code> stub;

      if (state() == UNINITIALIZED) {

        stub = pre_monomorphic_stub();

      } else if (state() == PREMONOMORPHIC || state() == MONOMORPHIC) {

        StringLengthStub string_length_stub(kind());

        stub = string_length_stub.GetCode(isolate());

      } else if (state() != MEGAMORPHIC) {

        ASSERT(state() != GENERIC);

        stub = megamorphic_stub();

      }

      if (!stub.is_null()) {

        set_target(*stub);

#ifdef DEBUG

        if (FLAG_trace_ic) PrintF("[LoadIC : +#length /stringwrapper]\n");

#endif

      }

      // Get the string if we have a string wrapper object.

      String* string = String::cast(JSValue::cast(*object)->value());

      return Smi::FromInt(string->length());

    }

    // Use specialized code for getting prototype of functions.

    if (object->IsJSFunction() &&

        name->Equals(isolate()->heap()->prototype_string()) &&

        Handle<JSFunction>::cast(object)->should_have_prototype()) {

      Handle<Code> stub;

      if (state() == UNINITIALIZED) {

        stub = pre_monomorphic_stub();

      } else if (state() == PREMONOMORPHIC) {

        FunctionPrototypeStub function_prototype_stub(kind());

        stub = function_prototype_stub.GetCode(isolate());

      } else if (state() != MEGAMORPHIC) {

        ASSERT(state() != GENERIC);

        stub = megamorphic_stub();

      }

      if (!stub.is_null()) {

        set_target(*stub);

#ifdef DEBUG

        if (FLAG_trace_ic) PrintF("[LoadIC : +#prototype /function]\n");

#endif

      }

      return *Accessors::FunctionGetPrototype(Handle<JSFunction>::cast(object));

    }

  }

  // Check if the name is trivially convertible to an index and get

  // the element or char if so.

  uint32_t index;

  if (kind() == Code::KEYED_LOAD_IC && name->AsArrayIndex(&index)) {

    // Rewrite to the generic keyed load stub.

    if (FLAG_use_ic) set_target(*generic_stub());

    return Runtime::GetElementOrCharAtOrFail(isolate(), object, index);

  }

  bool use_ic = MigrateDeprecated(object) ? false : FLAG_use_ic;

  // Named lookup in the object.

  LookupResult lookup(isolate());

  LookupForRead(object, name, &lookup);

  // If we did not find a property, check if we need to throw an exception.

  if (!lookup.IsFound()) {

    if (IsUndeclaredGlobal(object)) {

      return ReferenceError("not_defined", name);

    }

    LOG(isolate(), SuspectReadEvent(*name, *object));

  }

  // Update inline cache and stub cache.

  if (use_ic) UpdateCaches(&lookup, object, name);

  PropertyAttributes attr;

  // Get the property.

  Handle<Object> result =

      Object::GetProperty(object, object, &lookup, name, &attr);

  RETURN_IF_EMPTY_HANDLE(isolate(), result);

  // If the property is not present, check if we need to throw an

  // exception.

  if ((lookup.IsInterceptor() || lookup.IsHandler()) &&

      attr == ABSENT && IsUndeclaredGlobal(object)) {

    return ReferenceError("not_defined", name);

  }

  return *result;

}

static bool AddOneReceiverMapIfMissing(MapHandleList* receiver_maps,

                                       Handle<Map> new_receiver_map) {

  ASSERT(!new_receiver_map.is_null());

  for (int current = 0; current < receiver_maps->length(); ++current) {

    if (!receiver_maps->at(current).is_null() &&

        receiver_maps->at(current).is_identical_to(new_receiver_map)) {

      return false;

    }

  }

  receiver_maps->Add(new_receiver_map);

  return true;

}

bool IC::UpdatePolymorphicIC(Handle<HeapObject> receiver,

                             Handle<String> name,

                             Handle<Code> code) {

  if (!code->is_handler()) return false;

  MapHandleList receiver_maps;

  CodeHandleList handlers;

  int number_of_valid_maps;

  int handler_to_overwrite = -1;

  Handle<Map> new_receiver_map(receiver->map());

  {

    DisallowHeapAllocation no_gc;

    target()->FindAllMaps(&receiver_maps);

    int number_of_maps = receiver_maps.length();

    number_of_valid_maps = number_of_maps;

    for (int i = 0; i < number_of_maps; i++) {

      Handle<Map> map = receiver_maps.at(i);

      // Filter out deprecated maps to ensure its instances get migrated.

      if (map->is_deprecated()) {

        number_of_valid_maps--;

      // If the receiver map is already in the polymorphic IC, this indicates

      // there was a prototoype chain failure. In that case, just overwrite the

      // handler.

      } else if (map.is_identical_to(new_receiver_map)) {

        number_of_valid_maps--;

        handler_to_overwrite = i;

      }

    }

    if (number_of_valid_maps >= 4) return false;

    if (number_of_maps == 0) return false;

    if (!target()->FindHandlers(&handlers, receiver_maps.length())) {

      return false;

    }

  }

  number_of_valid_maps++;

  if (handler_to_overwrite >= 0) {

    handlers.Set(handler_to_overwrite, code);

  } else {

    receiver_maps.Add(new_receiver_map);

    handlers.Add(code);

  }

  Handle<Code> ic = isolate()->stub_cache()->ComputePolymorphicIC(

      &receiver_maps, &handlers, number_of_valid_maps, name, strict_mode());

  set_target(*ic);

  return true;

}

void IC::UpdateMonomorphicIC(Handle<HeapObject> receiver,

                             Handle<Code> handler,

                             Handle<String> name) {

  if (!handler->is_handler()) return set_target(*handler);

  Handle<Code> ic = isolate()->stub_cache()->ComputeMonomorphicIC(

      receiver, handler, name, strict_mode());

  set_target(*ic);

}

void IC::CopyICToMegamorphicCache(Handle<String> name) {

  MapHandleList receiver_maps;

  CodeHandleList handlers;

  {

    DisallowHeapAllocation no_gc;

    target()->FindAllMaps(&receiver_maps);

    if (!target()->FindHandlers(&handlers, receiver_maps.length())) return;

  }

  for (int i = 0; i < receiver_maps.length(); i++) {

    UpdateMegamorphicCache(*receiver_maps.at(i), *name, *handlers.at(i));

  }

}

bool IC::IsTransitionedMapOfMonomorphicTarget(Map* receiver_map) {

  DisallowHeapAllocation no_allocation;

  Map* current_map = target()->FindFirstMap();

  ElementsKind receiver_elements_kind = receiver_map->elements_kind();

  bool more_general_transition =

      IsMoreGeneralElementsKindTransition(

        current_map->elements_kind(), receiver_elements_kind);

  Map* transitioned_map = more_general_transition

      ? current_map->LookupElementsTransitionMap(receiver_elements_kind)

      : NULL;

  return transitioned_map == receiver_map;

}

void IC::PatchCache(Handle<HeapObject> receiver,

                    Handle<String> name,

                    Handle<Code> code) {

  switch (state()) {

    case UNINITIALIZED:

    case PREMONOMORPHIC:

    case MONOMORPHIC_PROTOTYPE_FAILURE:

      UpdateMonomorphicIC(receiver, code, name);

      break;

    case MONOMORPHIC:

      // For now, call stubs are allowed to rewrite to the same stub. This

      // happens e.g., when the field does not contain a function.

      ASSERT(target()->is_call_stub() ||

             target()->is_keyed_call_stub() ||

             !target().is_identical_to(code));

      if (!target()->is_keyed_stub()) {

        bool is_same_handler = false;

        {

          DisallowHeapAllocation no_allocation;

          Code* old_handler = target()->FindFirstHandler();

          is_same_handler = old_handler == *code;

        }

        if (is_same_handler

            && IsTransitionedMapOfMonomorphicTarget(receiver->map())) {

          UpdateMonomorphicIC(receiver, code, name);

          break;

        }

        if (UpdatePolymorphicIC(receiver, name, code)) {

          break;

        }

        CopyICToMegamorphicCache(name);

      }

      UpdateMegamorphicCache(receiver->map(), *name, *code);

      set_target(*megamorphic_stub());

      break;

    case MEGAMORPHIC:

      UpdateMegamorphicCache(receiver->map(), *name, *code);

      break;

    case POLYMORPHIC:

      if (target()->is_keyed_stub()) {

        // When trying to patch a polymorphic keyed stub with anything other

        // than another polymorphic stub, go generic.

        set_target(*generic_stub());

      } else {

        if (UpdatePolymorphicIC(receiver, name, code)) {

          break;

        }

        CopyICToMegamorphicCache(name);

        UpdateMegamorphicCache(receiver->map(), *name, *code);

        set_target(*megamorphic_stub());

      }

      break;

    case DEBUG_STUB:

      break;

    case GENERIC:

      UNREACHABLE();

      break;

  }

}

Handle<Code> LoadIC::SimpleFieldLoad(int offset,

                                     bool inobject,

                                     Representation representation) {

  if (kind() == Code::LOAD_IC) {

    LoadFieldStub stub(inobject, offset, representation);

    return stub.GetCode(isolate());

  } else {

    KeyedLoadFieldStub stub(inobject, offset, representation);

    return stub.GetCode(isolate());

  }

}

void LoadIC::UpdateCaches(LookupResult* lookup,

                          Handle<Object> object,

                          Handle<String> name) {

  // TODO(verwaest): It would be nice to support loading fields from smis as

  // well. For now just fail to update the cache.

  if (!object->IsHeapObject()) return;

  Handle<HeapObject> receiver = Handle<HeapObject>::cast(object);

  Handle<Code> code;

  if (state() == UNINITIALIZED) {

    // This is the first time we execute this inline cache.

    // Set the target to the pre monomorphic stub to delay

    // setting the monomorphic state.

    code = pre_monomorphic_stub();

  } else if (!lookup->IsCacheable()) {

    // Bail out if the result is not cacheable.

    code = slow_stub();

  } else if (object->IsString() &&

             name->Equals(isolate()->heap()->length_string())) {

    int length_index = String::kLengthOffset / kPointerSize;

    code = SimpleFieldLoad(length_index);

  } else if (!object->IsJSObject()) {

    // TODO(jkummerow): It would be nice to support non-JSObjects in

    // ComputeLoadHandler, then we wouldn't need to go generic here.

    code = slow_stub();

  } else if (!lookup->IsProperty()) {

    code = kind() == Code::LOAD_IC

        ? isolate()->stub_cache()->ComputeLoadNonexistent(

              name, Handle<JSObject>::cast(receiver))

        : slow_stub();

  } else {

    code = ComputeHandler(lookup, Handle<JSObject>::cast(receiver), name);

  }

  PatchCache(receiver, name, code);

  TRACE_IC("LoadIC", name);

}

void IC::UpdateMegamorphicCache(Map* map, Name* name, Code* code) {

  // Cache code holding map should be consistent with

  // GenerateMonomorphicCacheProbe.

  isolate()->stub_cache()->Set(name, map, code);

}

Handle<Code> IC::ComputeHandler(LookupResult* lookup,

                                Handle<JSObject> receiver,

                                Handle<String> name,

                                Handle<Object> value) {

  Handle<Code> code = isolate()->stub_cache()->FindHandler(

      name, receiver, kind());

  if (!code.is_null()) return code;

  code = CompileHandler(lookup, receiver, name, value);

  if (code->is_handler() && code->type() != Code::NORMAL) {

    HeapObject::UpdateMapCodeCache(receiver, name, code);

  }

  return code;

}

Handle<Code> LoadIC::CompileHandler(LookupResult* lookup,

                                    Handle<JSObject> receiver,

                                    Handle<String> name,

                                    Handle<Object> unused) {

  Handle<JSObject> holder(lookup->holder());

  LoadStubCompiler compiler(isolate(), kind());

  switch (lookup->type()) {

    case FIELD: {

      PropertyIndex field = lookup->GetFieldIndex();

      if (receiver.is_identical_to(holder)) {

        return SimpleFieldLoad(field.translate(holder),

                               field.is_inobject(holder),

                               lookup->representation());

      }

      return compiler.CompileLoadField(

          receiver, holder, name, field, lookup->representation());

    }

    case CONSTANT: {

      Handle<Object> constant(lookup->GetConstant(), isolate());

      // TODO(2803): Don't compute a stub for cons strings because they cannot

      // be embedded into code.

      if (constant->IsConsString()) break;

      return compiler.CompileLoadConstant(receiver, holder, name, constant);

    }

    case NORMAL:

      if (kind() != Code::LOAD_IC) break;

      if (holder->IsGlobalObject()) {

        Handle<GlobalObject> global = Handle<GlobalObject>::cast(holder);

        Handle<PropertyCell> cell(

            global->GetPropertyCell(lookup), isolate());

        // TODO(verwaest): Turn into a handler.

        return isolate()->stub_cache()->ComputeLoadGlobal(

            name, receiver, global, cell, lookup->IsDontDelete());

      }

      // There is only one shared stub for loading normalized

      // properties. It does not traverse the prototype chain, so the

      // property must be found in the receiver for the stub to be

      // applicable.

      if (!holder.is_identical_to(receiver)) break;

      return isolate()->builtins()->LoadIC_Normal();

    case CALLBACKS: {

      // Use simple field loads for some well-known callback properties.

      int object_offset;

      Handle<Map> map(receiver->map());

      if (Accessors::IsJSObjectFieldAccessor(map, name, &object_offset)) {

        PropertyIndex index =

            PropertyIndex::NewHeaderIndex(object_offset / kPointerSize);

        return compiler.CompileLoadField(

            receiver, receiver, name, index, Representation::Tagged());

      }

      Handle<Object> callback(lookup->GetCallbackObject(), isolate());

      if (callback->IsExecutableAccessorInfo()) {

        Handle<ExecutableAccessorInfo> info =

            Handle<ExecutableAccessorInfo>::cast(callback);

        if (v8::ToCData<Address>(info->getter()) == 0) break;

        if (!info->IsCompatibleReceiver(*receiver)) break;

        return compiler.CompileLoadCallback(receiver, holder, name, info);

      } else if (callback->IsAccessorPair()) {

        Handle<Object> getter(Handle<AccessorPair>::cast(callback)->getter(),

                              isolate());

        if (!getter->IsJSFunction()) break;

        if (holder->IsGlobalObject()) break;

        if (!holder->HasFastProperties()) break;

        Handle<JSFunction> function = Handle<JSFunction>::cast(getter);

        CallOptimization call_optimization(function);

        if (call_optimization.is_simple_api_call() &&

            call_optimization.IsCompatibleReceiver(*receiver)) {

          return compiler.CompileLoadCallback(

              receiver, holder, name, call_optimization);

        }

        return compiler.CompileLoadViaGetter(receiver, holder, name, function);

      }

      // TODO(dcarney): Handle correctly.

      if (callback->IsDeclaredAccessorInfo()) break;

      ASSERT(callback->IsForeign());

      // No IC support for old-style native accessors.

      break;

    }

    case INTERCEPTOR:

      ASSERT(HasInterceptorGetter(*holder));

      return compiler.CompileLoadInterceptor(receiver, holder, name);

    default:

      break;

  }

  return slow_stub();

}

static Handle<Object> TryConvertKey(Handle<Object> key, Isolate* isolate) {

  // This helper implements a few common fast cases for converting

  // non-smi keys of keyed loads/stores to a smi or a string.

  if (key->IsHeapNumber()) {

    double value = Handle<HeapNumber>::cast(key)->value();

    if (std::isnan(value)) {

      key = isolate->factory()->nan_string();

    } else {

      int int_value = FastD2I(value);

      if (value == int_value && Smi::IsValid(int_value)) {

        key = Handle<Smi>(Smi::FromInt(int_value), isolate);

      }

    }

  } else if (key->IsUndefined()) {

    key = isolate->factory()->undefined_string();

  }

  return key;

}

Handle<Code> KeyedLoadIC::LoadElementStub(Handle<JSObject> receiver) {

  // Don't handle megamorphic property accesses for INTERCEPTORS or CALLBACKS

  // via megamorphic stubs, since they don't have a map in their relocation info

  // and so the stubs can't be harvested for the object needed for a map check.

  if (target()->type() != Code::NORMAL) {

    TRACE_GENERIC_IC(isolate(), "KeyedIC", "non-NORMAL target type");

    return generic_stub();

  }

  Handle<Map> receiver_map(receiver->map(), isolate());

  MapHandleList target_receiver_maps;

  if (state() == UNINITIALIZED || state() == PREMONOMORPHIC) {

    // Optimistically assume that ICs that haven't reached the MONOMORPHIC state

    // yet will do so and stay there.

    return isolate()->stub_cache()->ComputeKeyedLoadElement(receiver_map);

  }

  if (target().is_identical_to(string_stub())) {

    target_receiver_maps.Add(isolate()->factory()->string_map());

  } else {

    target()->FindAllMaps(&target_receiver_maps);

    if (target_receiver_maps.length() == 0) {

      return isolate()->stub_cache()->ComputeKeyedLoadElement(receiver_map);

    }

  }

  // The first time a receiver is seen that is a transitioned version of the

  // previous monomorphic receiver type, assume the new ElementsKind is the

  // monomorphic type. This benefits global arrays that only transition

  // once, and all call sites accessing them are faster if they remain

  // monomorphic. If this optimistic assumption is not true, the IC will

  // miss again and it will become polymorphic and support both the

  // untransitioned and transitioned maps.

  if (state() == MONOMORPHIC &&

      IsMoreGeneralElementsKindTransition(

          target_receiver_maps.at(0)->elements_kind(),

          receiver->GetElementsKind())) {

    return isolate()->stub_cache()->ComputeKeyedLoadElement(receiver_map);

  }

  ASSERT(state() != GENERIC);

  // Determine the list of receiver maps that this call site has seen,

  // adding the map that was just encountered.

  if (!AddOneReceiverMapIfMissing(&target_receiver_maps, receiver_map)) {

    // If the miss wasn't due to an unseen map, a polymorphic stub

    // won't help, use the generic stub.

    TRACE_GENERIC_IC(isolate(), "KeyedIC", "same map added twice");

    return generic_stub();

  }

  // If the maximum number of receiver maps has been exceeded, use the generic

  // version of the IC.

  if (target_receiver_maps.length() > kMaxKeyedPolymorphism) {

    TRACE_GENERIC_IC(isolate(), "KeyedIC", "max polymorph exceeded");

    return generic_stub();

  }

  return isolate()->stub_cache()->ComputeLoadElementPolymorphic(

      &target_receiver_maps);

}

MaybeObject* KeyedLoadIC::Load(Handle<Object> object,

                               Handle<Object> key,

                               ICMissMode miss_mode) {

  if (MigrateDeprecated(object)) {

    return Runtime::GetObjectPropertyOrFail(isolate(), object, key);

  }

  MaybeObject* maybe_object = NULL;

  Handle<Code> stub = generic_stub();

  // Check for values that can be converted into an internalized string directly

  // or is representable as a smi.

  key = TryConvertKey(key, isolate());

  if (key->IsInternalizedString()) {

    maybe_object = LoadIC::Load(object, Handle<String>::cast(key));

    if (maybe_object->IsFailure()) return maybe_object;

  } else if (FLAG_use_ic && !object->IsAccessCheckNeeded()) {

    ASSERT(!object->IsJSGlobalProxy());

    if (miss_mode != MISS_FORCE_GENERIC) {

      if (object->IsString() && key->IsNumber()) {

        if (state() == UNINITIALIZED) stub = string_stub();

      } else if (object->IsJSObject()) {

        Handle<JSObject> receiver = Handle<JSObject>::cast(object);

        if (receiver->elements()->map() ==

            isolate()->heap()->non_strict_arguments_elements_map()) {

          stub = non_strict_arguments_stub();

        } else if (receiver->HasIndexedInterceptor()) {

          stub = indexed_interceptor_stub();