Fix SmiCompare on 64 bit to distinguish between comparisons where...

src/x64/codegen-x64.cc

 // Copyright 2011 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 748 matching lines @@
   // The value to convert should be popped from the frame.
   Result value = frame_->Pop();
   value.ToRegister();
 
   if (value.is_number()) {
     // Fast case if TypeInfo indicates only numbers.
     if (FLAG_debug_code) {
       __ AbortIfNotNumber(value.reg());
     }
     // Smi => false iff zero.
-    __ SmiCompare(value.reg(), Smi::FromInt(0));
+    __ Cmp(value.reg(), Smi::FromInt(0));
     if (value.is_smi()) {
       value.Unuse();
       dest->Split(not_zero);
     } else {
       dest->false_target()->Branch(equal);
       Condition is_smi = masm_->CheckSmi(value.reg());
       dest->true_target()->Branch(is_smi);
       __ xorpd(xmm0, xmm0);
       __ ucomisd(xmm0, FieldOperand(value.reg(), HeapNumber::kValueOffset));
       value.Unuse();
       dest->Split(not_zero);
     }
   } else {
     // Fast case checks.
     // 'false' => false.
     __ CompareRoot(value.reg(), Heap::kFalseValueRootIndex);
     dest->false_target()->Branch(equal);
 
     // 'true' => true.
     __ CompareRoot(value.reg(), Heap::kTrueValueRootIndex);
     dest->true_target()->Branch(equal);
 
     // 'undefined' => false.
     __ CompareRoot(value.reg(), Heap::kUndefinedValueRootIndex);
     dest->false_target()->Branch(equal);
 
     // Smi => false iff zero.
-    __ SmiCompare(value.reg(), Smi::FromInt(0));
+    __ Cmp(value.reg(), Smi::FromInt(0));
     dest->false_target()->Branch(equal);
     Condition is_smi = masm_->CheckSmi(value.reg());
     dest->true_target()->Branch(is_smi);
 
     // Call the stub for all other cases.
     frame_->Push(&value);  // Undo the Pop() from above.
     ToBooleanStub stub;
     Result temp = frame_->CallStub(&stub, 1);
     // Convert the result to a condition code.
     __ testq(temp.reg(), temp.reg());
@@ skipping 221 matching lines @@
                              operands_type);
     answer = GenerateGenericBinaryOpStubCall(&stub, &left, &right);
   } else if (right_is_smi_constant) {
     answer = ConstantSmiBinaryOperation(expr, &left, right.handle(),
                                         false, overwrite_mode);
   } else if (left_is_smi_constant) {
     answer = ConstantSmiBinaryOperation(expr, &right, left.handle(),
                                         true, overwrite_mode);
   } else {
     // Set the flags based on the operation, type and loop nesting level.
-    // Bit operations always assume they likely operate on Smis. Still only
+    // Bit operations always assume they likely operate on smis. Still only
     // generate the inline Smi check code if this operation is part of a loop.
     // For all other operations only inline the Smi check code for likely smis
     // if the operation is part of a loop.
     if (loop_nesting() > 0 &&
         (Token::IsBitOp(op) ||
          operands_type.IsInteger32() ||
          expr->type()->IsLikelySmi())) {
       answer = LikelySmiBinaryOperation(expr, &left, &right, overwrite_mode);
     } else {
       GenericBinaryOpStub stub(op,
@@ skipping 1051 matching lines @@
       is_string.Bind(&left_side);
       // left_side is a sequential ASCII string.
       ASSERT(left_side.reg().is(left_reg));
       right_side = Result(right_val);
       Result temp2 = allocator_->Allocate();
       ASSERT(temp2.is_valid());
       // Test string equality and comparison.
       if (cc == equal) {
         Label comparison_done;
         __ SmiCompare(FieldOperand(left_side.reg(), String::kLengthOffset),
-                Smi::FromInt(1));
+                      Smi::FromInt(1));
         __ j(not_equal, &comparison_done);
         uint8_t char_value =
             static_cast<uint8_t>(String::cast(*right_val)->Get(0));
         __ cmpb(FieldOperand(left_side.reg(), SeqAsciiString::kHeaderSize),
                 Immediate(char_value));
         __ bind(&comparison_done);
       } else {
         __ movq(temp2.reg(),
                 FieldOperand(left_side.reg(), String::kLengthOffset));
         __ SmiSubConstant(temp2.reg(), temp2.reg(), Smi::FromInt(1));
@@ skipping 165 matching lines @@
     // Since one side is a constant Smi, conversion order does not matter.
     if (left_side_constant_smi) {
       Result* temp = left_side;
       left_side = right_side;
       right_side = temp;
       cc = ReverseCondition(cc);
       // This may re-introduce greater or less_equal as the value of cc.
       // CompareStub and the inline code both support all values of cc.
     }
     // Implement comparison against a constant Smi, inlining the case
-    // where both sides are Smis.
+    // where both sides are smis.
     left_side->ToRegister();
     Register left_reg = left_side->reg();
     Smi* constant_smi = Smi::cast(*right_side->handle());
 
     if (left_side->is_smi()) {
       if (FLAG_debug_code) {
         __ AbortIfNotSmi(left_reg);
       }
       // Test smi equality and comparison by signed int comparison.
-      // Both sides are smis, so we can use an Immediate.
       __ SmiCompare(left_reg, constant_smi);
       left_side->Unuse();
       right_side->Unuse();
       dest->Split(cc);
     } else {
       // Only the case where the left side could possibly be a non-smi is left.
       JumpTarget is_smi;
       if (cc == equal) {
         // We can do the equality comparison before the smi check.
-        __ SmiCompare(left_reg, constant_smi);
+        __ Cmp(left_reg, constant_smi);
         dest->true_target()->Branch(equal);
         Condition left_is_smi = masm_->CheckSmi(left_reg);
         dest->false_target()->Branch(left_is_smi);
       } else {
         // Do the smi check, then the comparison.
         Condition left_is_smi = masm_->CheckSmi(left_reg);
         is_smi.Branch(left_is_smi, left_side, right_side);
       }
 
       // Jump or fall through to here if we are comparing a non-smi to a
@@ skipping 240 matching lines @@
       __ movq(rdi, Operand(rsp, 2 * kPointerSize));
       is_smi = masm_->CheckSmi(rdi);
       __ j(is_smi, &build_args);
       __ CmpObjectType(rdi, JS_FUNCTION_TYPE, rcx);
       __ j(not_equal, &build_args);
 
       // Copy the arguments to this function possibly from the
       // adaptor frame below it.
       Label invoke, adapted;
       __ movq(rdx, Operand(rbp, StandardFrameConstants::kCallerFPOffset));
-      __ SmiCompare(Operand(rdx, StandardFrameConstants::kContextOffset),
-                    Smi::FromInt(StackFrame::ARGUMENTS_ADAPTOR));
+      __ Cmp(Operand(rdx, StandardFrameConstants::kContextOffset),
+             Smi::FromInt(StackFrame::ARGUMENTS_ADAPTOR));
       __ j(equal, &adapted);
 
       // No arguments adaptor frame. Copy fixed number of arguments.
       __ Set(rax, scope()->num_parameters());
       for (int i = 0; i < scope()->num_parameters(); i++) {
         __ push(frame_->ParameterAt(i));
       }
       __ jmp(&invoke);
 
       // Arguments adaptor frame present. Copy arguments from there, but
@@ skipping 1260 matching lines @@
   __ cmpq(rcx, rdx);
   end_del_check.Branch(equal);
 
   // Convert the entry to a string (or null if it isn't a property anymore).
   frame_->EmitPush(frame_->ElementAt(4));  // push enumerable
   frame_->EmitPush(rbx);  // push entry
   frame_->InvokeBuiltin(Builtins::FILTER_KEY, CALL_FUNCTION, 2);
   __ movq(rbx, rax);
 
   // If the property has been removed while iterating, we just skip it.
-  __ SmiCompare(rbx, Smi::FromInt(0));
+  __ Cmp(rbx, Smi::FromInt(0));
   node->continue_target()->Branch(equal);
 
   end_del_check.Bind();
   // Store the entry in the 'each' expression and take another spin in the
   // loop.  rdx: i'th entry of the enum cache (or string there of)
   frame_->EmitPush(rbx);
   { Reference each(this, node->each());
     // Loading a reference may leave the frame in an unspilled state.
     frame_->SpillAll();
     if (!each.is_illegal()) {
@@ skipping 2320 matching lines @@
 
 void CodeGenerator::GenerateIsConstructCall(ZoneList<Expression*>* args) {
   ASSERT(args->length() == 0);
 
   // Get the frame pointer for the calling frame.
   Result fp = allocator()->Allocate();
   __ movq(fp.reg(), Operand(rbp, StandardFrameConstants::kCallerFPOffset));
 
   // Skip the arguments adaptor frame if it exists.
   Label check_frame_marker;
-  __ SmiCompare(Operand(fp.reg(), StandardFrameConstants::kContextOffset),
-                Smi::FromInt(StackFrame::ARGUMENTS_ADAPTOR));
+  __ Cmp(Operand(fp.reg(), StandardFrameConstants::kContextOffset),
+         Smi::FromInt(StackFrame::ARGUMENTS_ADAPTOR));
   __ j(not_equal, &check_frame_marker);
   __ movq(fp.reg(), Operand(fp.reg(), StandardFrameConstants::kCallerFPOffset));
 
   // Check the marker in the calling frame.
   __ bind(&check_frame_marker);
-  __ SmiCompare(Operand(fp.reg(), StandardFrameConstants::kMarkerOffset),
-                Smi::FromInt(StackFrame::CONSTRUCT));
+  __ Cmp(Operand(fp.reg(), StandardFrameConstants::kMarkerOffset),
+         Smi::FromInt(StackFrame::CONSTRUCT));
   fp.Unuse();
   destination()->Split(equal);
 }
 
 
 void CodeGenerator::GenerateArgumentsLength(ZoneList<Expression*>* args) {
   ASSERT(args->length() == 0);
 
   Result fp = allocator_->Allocate();
   Result result = allocator_->Allocate();
   ASSERT(fp.is_valid() && result.is_valid());
 
   Label exit;
 
   // Get the number of formal parameters.
   __ Move(result.reg(), Smi::FromInt(scope()->num_parameters()));
 
   // Check if the calling frame is an arguments adaptor frame.
   __ movq(fp.reg(), Operand(rbp, StandardFrameConstants::kCallerFPOffset));
-  __ SmiCompare(Operand(fp.reg(), StandardFrameConstants::kContextOffset),
-                Smi::FromInt(StackFrame::ARGUMENTS_ADAPTOR));
+  __ Cmp(Operand(fp.reg(), StandardFrameConstants::kContextOffset),
+         Smi::FromInt(StackFrame::ARGUMENTS_ADAPTOR));
   __ j(not_equal, &exit);
 
   // Arguments adaptor case: Read the arguments length from the
   // adaptor frame.
   __ movq(result.reg(),
           Operand(fp.reg(), ArgumentsAdaptorFrameConstants::kLengthOffset));
 
   __ bind(&exit);
   result.set_type_info(TypeInfo::Smi());
   if (FLAG_debug_code) {
@@ skipping 535 matching lines @@
   frame_->Spill(index1.reg());
   frame_->Spill(index2.reg());
 
   DeferredSwapElements* deferred = new DeferredSwapElements(object.reg(),
                                                             index1.reg(),
                                                             index2.reg());
 
   // Fetch the map and check if array is in fast case.
   // Check that object doesn't require security checks and
   // has no indexed interceptor.
-  __ CmpObjectType(object.reg(), FIRST_JS_OBJECT_TYPE, tmp1.reg());
-  deferred->Branch(below);
+  __ CmpObjectType(object.reg(), JS_ARRAY_TYPE, tmp1.reg());
+  deferred->Branch(not_equal);
   __ testb(FieldOperand(tmp1.reg(), Map::kBitFieldOffset),
            Immediate(KeyedLoadIC::kSlowCaseBitFieldMask));
   deferred->Branch(not_zero);
 
   // Check the object's elements are in fast case and writable.
   __ movq(tmp1.reg(), FieldOperand(object.reg(), JSObject::kElementsOffset));
   __ CompareRoot(FieldOperand(tmp1.reg(), HeapObject::kMapOffset),
                  Heap::kFixedArrayMapRootIndex);
   deferred->Branch(not_equal);
 
@@ skipping 21 matching lines @@
                                     FixedArray::kHeaderSize));
 
   // Swap elements.
   __ movq(object.reg(), Operand(index1.reg(), 0));
   __ movq(tmp2.reg(), Operand(index2.reg(), 0));
   __ movq(Operand(index2.reg(), 0), object.reg());
   __ movq(Operand(index1.reg(), 0), tmp2.reg());
 
   Label done;
   __ InNewSpace(tmp1.reg(), tmp2.reg(), equal, &done);
-  // Possible optimization: do a check that both values are Smis
+  // Possible optimization: do a check that both values are smis
   // (or them and test against Smi mask.)
 
   __ movq(tmp2.reg(), tmp1.reg());
   __ RecordWriteHelper(tmp1.reg(), index1.reg(), object.reg());
   __ RecordWriteHelper(tmp2.reg(), index2.reg(), object.reg());
   __ bind(&done);
 
   deferred->BindExit();
   frame_->Push(Factory::undefined_value());
 }
@@ skipping 1669 matching lines @@
     if (!key.is_smi()) {
       __ JumpIfNotSmi(key.reg(), deferred->entry_label());
     } else if (FLAG_debug_code) {
       __ AbortIfNotSmi(key.reg());
     }
 
     // Check that the receiver is a JSArray.
     __ CmpObjectType(receiver.reg(), JS_ARRAY_TYPE, kScratchRegister);
     deferred->Branch(not_equal);
 
-    // Check that the key is within bounds.  Both the key and the length of
-    // the JSArray are smis. Use unsigned comparison to handle negative keys.
-    __ SmiCompare(FieldOperand(receiver.reg(), JSArray::kLengthOffset),
-                  key.reg());
-    deferred->Branch(below_equal);
-
     // Get the elements array from the receiver and check that it is not a
     // dictionary.
     __ movq(tmp.reg(),
             FieldOperand(receiver.reg(), JSArray::kElementsOffset));
 
     // Check whether it is possible to omit the write barrier. If the elements
     // array is in new space or the value written is a smi we can safely update
     // the elements array without write barrier.
     Label in_new_space;
     __ InNewSpace(tmp.reg(), tmp2.reg(), equal, &in_new_space);
     if (!value_is_constant) {
       __ JumpIfNotSmi(result.reg(), deferred->entry_label());
     }
 
     __ bind(&in_new_space);
     // Bind the deferred code patch site to be able to locate the fixed
     // array map comparison.  When debugging, we patch this comparison to
     // always fail so that we will hit the IC call in the deferred code
     // which will allow the debugger to break for fast case stores.
     __ bind(deferred->patch_site());
     // Avoid using __ to ensure the distance from patch_site
     // to the map address is always the same.
     masm()->movq(kScratchRegister, Factory::fixed_array_map(),
                RelocInfo::EMBEDDED_OBJECT);
     __ cmpq(FieldOperand(tmp.reg(), HeapObject::kMapOffset),
             kScratchRegister);
     deferred->Branch(not_equal);
 
+    // Check that the key is within bounds.  Both the key and the length of
+    // the JSArray are smis (because the fixed array check above ensures the
+    // elements are in fast case). Use unsigned comparison to handle negative
+    // keys.
+    __ SmiCompare(FieldOperand(receiver.reg(), JSArray::kLengthOffset),
+                  key.reg());
+    deferred->Branch(below_equal);
+
     // Store the value.
     SmiIndex index =
         masm()->SmiToIndex(kScratchRegister, key.reg(), kPointerSizeLog2);
     __ movq(FieldOperand(tmp.reg(),
                          index.reg,
                          index.scale,
                          FixedArray::kHeaderSize),
             result.reg());
     __ IncrementCounter(&Counters::keyed_store_inline, 1);
 
@@ skipping 271 matching lines @@
 }
 
 #endif
 
 
 #undef __
 
 } }  // namespace v8::internal
 
 #endif  // V8_TARGET_ARCH_X64