[ic] Disable Clone IC for unsupported elements kind

o- · V8 LUCI CQ · commit f20fca65f0b4 · 2023-10-04T11:33:03.000Z
If the elements are not simple, or change in the slow case of the clone IC, then the fast case must be skipped. This is more conservative than neccessary (since some elements kinds have compatible binary layout) but also less risky. Drive-By: Update out of date comment. Bug: chromium:1488365 Change-Id: I705bd624abd8b86f8eeb2c8b1cc961229fb9122d Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4905770 Reviewed-by: Camillo Bruni <cbruni@chromium.org> Reviewed-by: Igor Sheludko <ishell@chromium.org> Auto-Submit: Olivier Flückiger <olivf@chromium.org> Commit-Queue: Olivier Flückiger <olivf@chromium.org> Cr-Commit-Position: refs/heads/main@{#90245}
diff --git a/src/ic/ic.cc b/src/ic/ic.cc
@@ -3170,18 +3170,22 @@ bool CanFastCloneObjectWithDifferentMaps(Handle<Map> source_map,
                                          Handle<Map> target_map,
                                          Isolate* isolate) {
   DisallowGarbageCollection no_gc;
-  // TODO(olivf): Add support for non JS_OBJECT_TYPE source maps. The reason for
-  // this restriction is that the IC does not initialize the target object and
-  // instead relies on copying the source objects bytes. Thus they need to have
-  // the same binary layout.
+  // Ensure source and target have identical binary represenation of properties
+  // and elements as the IC relies on copying the raw bytes. This also excludes
+  // cases with non-enumerable properties or accessors on the source object.
   if (source_map->instance_type() != JS_OBJECT_TYPE ||
       target_map->instance_type() != JS_OBJECT_TYPE ||
       !source_map->OnlyHasSimpleProperties() ||
-      !target_map->OnlyHasSimpleProperties()) {
+      !target_map->OnlyHasSimpleProperties() ||
+      source_map->elements_kind() != target_map->elements_kind() ||
+      !source_map->has_fast_elements()) {
     return false;
   }
   // Check that the source inobject properties are big enough to initialize all
   // target slots, but not too big to fit.
+  // TODO(olivf): This restriction (and the same restriction on the backing
+  // store) could be lifted by properly initializing the target object instead
+  // of relying on copying empty slots.
   int source_inobj_properties = source_map->GetInObjectProperties();
   int target_inobj_properties = target_map->GetInObjectProperties();
   int source_used_inobj_properties =
