Allow new-space JSFunction objects as constant-function properties.

src/arm/stub-cache-arm.cc

 // Copyright 2011 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 547 matching lines @@
   }
 }
 
 
 // Undoes the effects of ReserveSpaceForFastApiCall.
 static void FreeSpaceForFastApiCall(MacroAssembler* masm) {
   __ Drop(kFastApiCallArguments);
 }
 
 
 static MaybeObject* GenerateFastApiDirectCall(

[Vyacheslav Egorov (Chromium), 2011/10/12 12:36:05]

This function returns MaybeObject*

Some callers might not be able to survive GC in LoadHeapObject (cell
allocation). 

Maybe introduce TryLoadHeapObject that tries to allocate cell and returns
failure if fails.

     MacroAssembler* masm,
     const CallOptimization& optimization,
     int argc) {
   // ----------- S t a t e -------------
   //  -- sp[0]              : holder (set by CheckPrototypes)
   //  -- sp[4]              : callee js function
   //  -- sp[8]              : call data
   //  -- sp[12]             : last js argument
   //  -- ...
   //  -- sp[(argc + 3) * 4] : first js argument
   //  -- sp[(argc + 4) * 4] : receiver
   // -----------------------------------
   // Get the function and setup the context.
   JSFunction* function = optimization.constant_function();
-  __ mov(r5, Operand(Handle<JSFunction>(function)));
+  __ LoadHeapObject(r5, Handle<JSFunction>(function));
   __ ldr(cp, FieldMemOperand(r5, JSFunction::kContextOffset));
 
   // Pass the additional arguments FastHandleApiCall expects.
   Object* call_data = optimization.api_call_info()->data();
   Handle<CallHandlerInfo> api_call_info_handle(optimization.api_call_info());
   if (masm->isolate()->heap()->InNewSpace(call_data)) {
     __ Move(r0, api_call_info_handle);
     __ ldr(r6, FieldMemOperand(r0, CallHandlerInfo::kDataOffset));
   } else {
     __ Move(r6, Handle<Object>(call_data));
@@ skipping 588 matching lines @@
 
   // Check that the maps haven't changed.
   Register reg =
       CheckPrototypes(object, receiver, holder, scratch1, scratch2, scratch3,
                       name, miss);
   GenerateFastPropertyLoad(masm(), r0, reg, holder, index);
   __ Ret();
 }
 
 
 void StubCompiler::GenerateLoadConstant(JSObject* object,

[Vyacheslav Egorov (Chromium), 2011/10/12 12:36:05]

some callers of this function are not handlfied and use raw pointers across
invocations of GenerateLoadConstant.

                                         JSObject* holder,
                                         Register receiver,
                                         Register scratch1,
                                         Register scratch2,
                                         Register scratch3,
-                                        Object* value,
+                                        JSFunction* value,
                                         String* name,
                                         Label* miss) {
   // Check that the receiver isn't a smi.
   __ JumpIfSmi(receiver, miss);
 
   // Check that the maps haven't changed.
   CheckPrototypes(object, receiver, holder, scratch1, scratch2, scratch3, name,
                   miss);
 
   // Return the constant value.
-  __ mov(r0, Operand(Handle<Object>(value)));
+  __ LoadHeapObject(r0, Handle<JSFunction>(value));
   __ Ret();
 }
 
 
 MaybeObject* StubCompiler::GenerateLoadCallback(JSObject* object,
                                                 JSObject* holder,
                                                 Register receiver,
                                                 Register name_reg,
                                                 Register scratch1,
                                                 Register scratch2,
@@ skipping 1653 matching lines @@
   __ bind(&miss);
   GenerateLoadMiss(masm(), Code::LOAD_IC);
 
   // Return the generated code.
   return GetCode(CALLBACKS, name);
 }
 
 
 MaybeObject* LoadStubCompiler::CompileLoadConstant(JSObject* object,
                                                    JSObject* holder,
-                                                   Object* value,
+                                                   JSFunction* value,
                                                    String* name) {
   // ----------- S t a t e -------------
   //  -- r0    : receiver
   //  -- r2    : name
   //  -- lr    : return address
   // -----------------------------------
   Label miss;
 
   GenerateLoadConstant(object, holder, r0, r3, r1, r4, value, name, &miss);
   __ bind(&miss);
@@ skipping 130 matching lines @@
   __ bind(&miss);
   GenerateLoadMiss(masm(), Code::KEYED_LOAD_IC);
 
   return GetCode(CALLBACKS, name);
 }
 
 
 MaybeObject* KeyedLoadStubCompiler::CompileLoadConstant(String* name,
                                                         JSObject* receiver,
                                                         JSObject* holder,
-                                                        Object* value) {
+                                                        JSFunction* value) {
   // ----------- S t a t e -------------
   //  -- lr    : return address
   //  -- r0    : key
   //  -- r1    : receiver
   // -----------------------------------
   Label miss;
 
   // Check the key is the cached one.
   __ cmp(r0, Operand(Handle<String>(name)));
   __ b(ne, &miss);
@@ skipping 1398 matching lines @@
       masm->isolate()->builtins()->KeyedStoreIC_MissForceGeneric();
   __ Jump(ic, RelocInfo::CODE_TARGET);
 }
 
 
 #undef __
 
 } }  // namespace v8::internal
 
 #endif  // V8_TARGET_ARCH_ARM