Index: src/arm/stub-cache-arm.cc |
=================================================================== |
--- src/arm/stub-cache-arm.cc (revision 5040) |
+++ src/arm/stub-cache-arm.cc (working copy) |
@@ -83,6 +83,136 @@ |
} |
+// Helper function used to check that the dictionary doesn't contain |
+// the property. This function may return false negatives, so miss_label |
+// must always call a backup property check that is complete. |
+// This function is safe to call if the receiver has fast properties. |
+// Name must be a symbol and receiver must be a heap object. |
+static void GenerateDictionaryNegativeLookup(MacroAssembler* masm, |
+ Label* miss_label, |
+ Register receiver, |
+ String* name, |
+ Register r0, |
+ Register extra) { |
+ ASSERT(name->IsSymbol()); |
+ if (!extra.is(no_reg)) { |
+ __ IncrementCounter(&Counters::negative_lookups, 1, r0, extra); |
+ __ IncrementCounter(&Counters::negative_lookups_miss, 1, r0, extra); |
+ } |
+ |
+ Label done; |
+ |
+ const int kInterceptorOrAccessCheckNeededMask = |
+ (1 << Map::kHasNamedInterceptor) | (1 << Map::kIsAccessCheckNeeded); |
+ |
+ // Bail out if the receiver has a named interceptor or requires access checks. |
+ Register map = extra.is(no_reg) ? r0 : extra; |
+ __ ldr(map, FieldMemOperand(receiver, HeapObject::kMapOffset)); |
+ __ ldrb(r0, FieldMemOperand(map, Map::kBitFieldOffset)); |
+ __ tst(r0, Operand(kInterceptorOrAccessCheckNeededMask)); |
+ __ b(ne, miss_label); |
+ |
+ // Check that receiver is a JSObject. |
+ if (extra.is(no_reg)) { |
+ __ ldr(map, FieldMemOperand(receiver, HeapObject::kMapOffset)); |
+ } |
+ __ ldrb(r0, FieldMemOperand(map, Map::kInstanceTypeOffset)); |
+ __ cmp(r0, Operand(FIRST_JS_OBJECT_TYPE)); |
+ __ b(lt, miss_label); |
+ |
+ // Load properties array. |
+ Register properties = r0; |
+ __ ldr(properties, FieldMemOperand(receiver, JSObject::kPropertiesOffset)); |
+ // Check that the properties array is a dictionary. |
+ if (!extra.is(no_reg)) { |
+ __ ldr(extra, FieldMemOperand(properties, HeapObject::kMapOffset)); |
+ Register tmp = properties; |
+ __ LoadRoot(tmp, Heap::kHashTableMapRootIndex); |
+ __ cmp(extra, tmp); |
+ } else { |
+ Register tmp1 = receiver; |
+ Register tmp2 = properties; |
+ __ push(tmp1); |
+ __ ldr(tmp1, FieldMemOperand(properties, HeapObject::kMapOffset)); |
+ __ LoadRoot(tmp2, Heap::kHashTableMapRootIndex); |
+ __ cmp(tmp1, tmp2); |
+ __ pop(tmp1); |
+ } |
+ __ b(ne, miss_label); |
+ |
+ // Restore the temporarily used register. |
+ __ ldr(properties, FieldMemOperand(receiver, JSObject::kPropertiesOffset)); |
+ |
+ // Compute the capacity mask. |
+ const int kCapacityOffset = |
+ StringDictionary::kHeaderSize + |
+ StringDictionary::kCapacityIndex * kPointerSize; |
+ |
+ // Generate an unrolled loop that performs a few probes before |
+ // giving up. |
+ static const int kProbes = 4; |
+ const int kElementsStartOffset = |
+ StringDictionary::kHeaderSize + |
+ StringDictionary::kElementsStartIndex * kPointerSize; |
+ |
+ // If names of slots in range from 1 to kProbes - 1 for the hash value are |
+ // not equal to the name and kProbes-th slot is not used (its name is the |
+ // undefined value), it guarantees the hash table doesn't contain the |
+ // property. It's true even if some slots represent deleted properties |
+ // (their names are the null value). |
+ for (int i = 0; i < kProbes; i++) { |
+ // r0 points to properties hash. |
+ // Compute the masked index: (hash + i + i * i) & mask. |
+ if (extra.is(no_reg)) { |
+ __ push(receiver); |
+ } |
+ Register index = extra.is(no_reg) ? receiver : extra; |
+ // Capacity is smi 2^n. |
+ __ ldr(index, FieldMemOperand(properties, kCapacityOffset)); |
+ __ sub(index, index, Operand(1)); |
+ __ and_(index, index, Operand( |
+ Smi::FromInt(name->Hash() + StringDictionary::GetProbeOffset(i)))); |
+ |
+ // Scale the index by multiplying by the entry size. |
+ ASSERT(StringDictionary::kEntrySize == 3); |
+ __ add(index, index, Operand(index, LSL, 1)); // index *= 3. |
+ |
+ Register entity_name = extra.is(no_reg) ? properties : extra; |
+ // Having undefined at this place means the name is not contained. |
+ ASSERT_EQ(kSmiTagSize, 1); |
+ Register tmp = extra.is(no_reg) ? receiver : properties; |
+ __ add(tmp, properties, Operand(index, LSL, 1)); |
+ __ ldr(entity_name, FieldMemOperand(tmp, kElementsStartOffset)); |
+ |
+ ASSERT(!tmp.is(entity_name)); |
+ __ LoadRoot(tmp, Heap::kUndefinedValueRootIndex); |
+ __ cmp(entity_name, tmp); |
+ if (extra.is(no_reg)) { |
+ // 'receiver' shares a register with 'entity_name'. |
+ __ pop(receiver); |
+ } |
+ if (i != kProbes - 1) { |
+ __ b(eq, &done); |
+ |
+ // Stop if found the property. |
+ __ cmp(entity_name, Operand(Handle<String>(name))); |
+ __ b(eq, miss_label); |
+ |
+ // Restore the properties. |
+ __ ldr(properties, |
+ FieldMemOperand(receiver, JSObject::kPropertiesOffset)); |
+ } else { |
+ // Give up probing if still not found the undefined value. |
+ __ b(ne, miss_label); |
+ } |
+ } |
+ __ bind(&done); |
+ if (!extra.is(no_reg)) { |
+ __ DecrementCounter(&Counters::negative_lookups_miss, 1, r0, extra); |
+ } |
+} |
+ |
+ |
void StubCache::GenerateProbe(MacroAssembler* masm, |
Code::Flags flags, |
Register receiver, |
@@ -743,31 +873,128 @@ |
int save_at_depth, |
Label* miss, |
Register extra) { |
- // Check that the maps haven't changed. |
- Register result = |
- masm()->CheckMaps(object, object_reg, holder, holder_reg, scratch, |
- save_at_depth, miss); |
+ // Make sure there's no overlap between scratch and the other |
+ // registers. |
+ ASSERT(!scratch.is(object_reg) && !scratch.is(holder_reg)); |
+ // Keep track of the current object in register reg. |
+ Register reg = object_reg; |
+ int depth = 0; |
+ |
+ if (save_at_depth == depth) { |
+ __ str(reg, MemOperand(sp)); |
+ } |
+ |
+ // Check the maps in the prototype chain. |
+ // Traverse the prototype chain from the object and do map checks. |
+ JSObject* current = object; |
+ while (current != holder) { |
+ depth++; |
+ |
+ // Only global objects and objects that do not require access |
+ // checks are allowed in stubs. |
+ ASSERT(current->IsJSGlobalProxy() || !current->IsAccessCheckNeeded()); |
+ |
+ JSObject* prototype = JSObject::cast(current->GetPrototype()); |
+ if (!current->HasFastProperties() && |
+ !current->IsJSGlobalObject() && |
+ !current->IsJSGlobalProxy()) { |
+ if (!name->IsSymbol()) { |
+ Object* lookup_result = Heap::LookupSymbol(name); |
+ if (lookup_result->IsFailure()) { |
+ set_failure(Failure::cast(lookup_result)); |
+ return reg; |
+ } else { |
+ name = String::cast(lookup_result); |
+ } |
+ } |
+ ASSERT(current->property_dictionary()->FindEntry(name) == |
+ StringDictionary::kNotFound); |
+ |
+ GenerateDictionaryNegativeLookup(masm(), |
+ miss, |
+ reg, |
+ name, |
+ scratch, |
+ extra); |
+ __ ldr(scratch, FieldMemOperand(reg, HeapObject::kMapOffset)); |
+ reg = holder_reg; // from now the object is in holder_reg |
+ __ ldr(reg, FieldMemOperand(scratch, Map::kPrototypeOffset)); |
+ } else { |
+ // Get the map of the current object. |
+ __ ldr(scratch, FieldMemOperand(reg, HeapObject::kMapOffset)); |
+ __ cmp(scratch, Operand(Handle<Map>(current->map()))); |
+ |
+ // Branch on the result of the map check. |
+ __ b(ne, miss); |
+ |
+ // Check access rights to the global object. This has to happen |
+ // after the map check so that we know that the object is |
+ // actually a global object. |
+ if (current->IsJSGlobalProxy()) { |
+ __ CheckAccessGlobalProxy(reg, scratch, miss); |
+ // Restore scratch register to be the map of the object. In the |
+ // new space case below, we load the prototype from the map in |
+ // the scratch register. |
+ __ ldr(scratch, FieldMemOperand(reg, HeapObject::kMapOffset)); |
+ } |
+ |
+ reg = holder_reg; // from now the object is in holder_reg |
+ if (Heap::InNewSpace(prototype)) { |
+ // The prototype is in new space; we cannot store a reference |
+ // to it in the code. Load it from the map. |
+ __ ldr(reg, FieldMemOperand(scratch, Map::kPrototypeOffset)); |
+ } else { |
+ // The prototype is in old space; load it directly. |
+ __ mov(reg, Operand(Handle<JSObject>(prototype))); |
+ } |
+ } |
+ |
+ if (save_at_depth == depth) { |
+ __ str(reg, MemOperand(sp)); |
+ } |
+ |
+ // Go to the next object in the prototype chain. |
+ current = prototype; |
+ } |
+ |
+ // Check the holder map. |
+ __ ldr(scratch, FieldMemOperand(reg, HeapObject::kMapOffset)); |
+ __ cmp(scratch, Operand(Handle<Map>(current->map()))); |
+ __ b(ne, miss); |
+ |
+ // Log the check depth. |
+ LOG(IntEvent("check-maps-depth", depth + 1)); |
+ |
+ // Perform security check for access to the global object and return |
+ // the holder register. |
+ ASSERT(current == holder); |
+ ASSERT(current->IsJSGlobalProxy() || !current->IsAccessCheckNeeded()); |
+ if (current->IsJSGlobalProxy()) { |
+ __ CheckAccessGlobalProxy(reg, scratch, miss); |
+ } |
+ |
// If we've skipped any global objects, it's not enough to verify |
// that their maps haven't changed. We also need to check that the |
// property cell for the property is still empty. |
- while (object != holder) { |
- if (object->IsGlobalObject()) { |
+ current = object; |
+ while (current != holder) { |
+ if (current->IsGlobalObject()) { |
Object* cell = GenerateCheckPropertyCell(masm(), |
- GlobalObject::cast(object), |
+ GlobalObject::cast(current), |
name, |
scratch, |
miss); |
if (cell->IsFailure()) { |
set_failure(Failure::cast(cell)); |
- return result; |
+ return reg; |
} |
} |
- object = JSObject::cast(object->GetPrototype()); |
+ current = JSObject::cast(current->GetPrototype()); |
} |
// Return the register containing the holder. |
- return result; |
+ return reg; |
} |
@@ -1053,7 +1280,7 @@ |
__ b(eq, &miss); |
// Do the right check and compute the holder register. |
- Register reg = CheckPrototypes(object, r0, holder, r1, r3, name, &miss); |
+ Register reg = CheckPrototypes(object, r0, holder, r1, r3, name, &miss, r4); |
GenerateFastPropertyLoad(masm(), r1, reg, holder, index); |
GenerateCallFunction(masm(), object, arguments(), &miss); |
@@ -1098,7 +1325,7 @@ |
__ b(eq, &miss); |
// Check that the maps haven't changed. |
- CheckPrototypes(JSObject::cast(object), r1, holder, r3, r0, name, &miss); |
+ CheckPrototypes(JSObject::cast(object), r1, holder, r3, r0, name, &miss, r4); |
if (object->IsGlobalObject()) { |
__ ldr(r3, FieldMemOperand(r1, GlobalObject::kGlobalReceiverOffset)); |
@@ -1149,7 +1376,7 @@ |
__ b(eq, &miss); |
// Check that the maps haven't changed. |
- CheckPrototypes(JSObject::cast(object), r1, holder, r3, r0, name, &miss); |
+ CheckPrototypes(JSObject::cast(object), r1, holder, r3, r0, name, &miss, r4); |
if (object->IsGlobalObject()) { |
__ ldr(r3, FieldMemOperand(r1, GlobalObject::kGlobalReceiverOffset)); |
@@ -1247,7 +1474,7 @@ |
// Check that the maps haven't changed. |
CheckPrototypes(JSObject::cast(object), r1, holder, r0, r3, name, |
- depth, &miss); |
+ depth, &miss, r4); |
// Patch the receiver on the stack with the global proxy if |
// necessary. |
@@ -1270,7 +1497,7 @@ |
GenerateDirectLoadGlobalFunctionPrototype( |
masm(), Context::STRING_FUNCTION_INDEX, r0); |
CheckPrototypes(JSObject::cast(object->GetPrototype()), r0, holder, r3, |
- r1, name, &miss); |
+ r1, name, &miss, r4); |
} |
break; |
@@ -1290,7 +1517,7 @@ |
GenerateDirectLoadGlobalFunctionPrototype( |
masm(), Context::NUMBER_FUNCTION_INDEX, r0); |
CheckPrototypes(JSObject::cast(object->GetPrototype()), r0, holder, r3, |
- r1, name, &miss); |
+ r1, name, &miss, r4); |
} |
break; |
} |
@@ -1313,7 +1540,7 @@ |
GenerateDirectLoadGlobalFunctionPrototype( |
masm(), Context::BOOLEAN_FUNCTION_INDEX, r0); |
CheckPrototypes(JSObject::cast(object->GetPrototype()), r0, holder, r3, |
- r1, name, &miss); |
+ r1, name, &miss, r4); |
} |
break; |
} |
@@ -1418,7 +1645,7 @@ |
} |
// Check that the maps haven't changed. |
- CheckPrototypes(object, r0, holder, r3, r1, name, &miss); |
+ CheckPrototypes(object, r0, holder, r3, r1, name, &miss, r4); |
// Get the value from the cell. |
__ mov(r3, Operand(Handle<JSGlobalPropertyCell>(cell))); |
@@ -1642,7 +1869,7 @@ |
__ b(eq, &miss); |
// Check the maps of the full prototype chain. |
- CheckPrototypes(object, r0, last, r3, r1, name, &miss); |
+ CheckPrototypes(object, r0, last, r3, r1, name, &miss, r4); |
// If the last object in the prototype chain is a global object, |
// check that the global property cell is empty. |
@@ -1782,7 +2009,7 @@ |
} |
// Check that the map of the global has not changed. |
- CheckPrototypes(object, r0, holder, r3, r4, name, &miss); |
+ CheckPrototypes(object, r0, holder, r3, r4, name, &miss, r1); |
// Get the value from the cell. |
__ mov(r3, Operand(Handle<JSGlobalPropertyCell>(cell))); |