Implement crankshaft support for nested object literals.

src/ia32/lithium-codegen-ia32.cc

 // Copyright 2011 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 4143 matching lines @@
     FastCloneShallowArrayStub::Mode mode =
         constant_elements_kind == FAST_DOUBLE_ELEMENTS
         ? FastCloneShallowArrayStub::CLONE_DOUBLE_ELEMENTS
         : FastCloneShallowArrayStub::CLONE_ELEMENTS;
     FastCloneShallowArrayStub stub(mode, length);
     CallCode(stub.GetCode(), RelocInfo::CODE_TARGET, instr);
   }
 }
 
 
-void LCodeGen::DoObjectLiteral(LObjectLiteral* instr) {
+void LCodeGen::EmitDeepCopy(Handle<JSObject> object,
+                            Register result,
+                            Register source,
+                            int* offset) {
+  ASSERT(!source.is(ecx));
+  ASSERT(!result.is(ecx));
+  int current_offset = *offset;
+
+  if (FLAG_debug_code && !HEAP->InNewSpace(*object)) {
+    __ cmp(source, object);
+    __ Assert(equal, "Unexpected object literal boilerplate");
+  }
+
+  // Increase the offset so that subsequent objects end up right after
+  // this one.
+  int size = object->map()->instance_size();
+  *offset += size;
+
+  // Copy object header.
+  ASSERT(object->properties()->length() == 0);
+  ASSERT(object->elements()->length() == 0 ||
+         object->elements()->map() == HEAP->fixed_cow_array_map());
+  int inobject_properties = object->map()->inobject_properties();
+  int header_size = size - inobject_properties * kPointerSize;
+  for (int i = 0; i < header_size; i += kPointerSize) {
+    __ mov(ecx, FieldOperand(source, i));
+    __ mov(FieldOperand(result, current_offset + i), ecx);
+  }
+
+  // Copy in-object properties.
+  for (int i = 0; i < inobject_properties; i++) {

[fschneider, 2011/11/22 17:26:16]

Can you instead of cloning the original, just store constants into the target
area? All values should be known at compile-time, right? No need for source
register then.

[Michael Starzinger, 2011/11/23 10:55:32]

Done.

+    int in_object_offset = object->GetInObjectPropertyOffset(i);
+    Handle<Object> value = Handle<Object>(object->InObjectPropertyAt(i));
+    if (value->IsJSObject()) {
+      Handle<JSObject> value_object = Handle<JSObject>::cast(value);
+      __ push(source);
+      __ mov(source, FieldOperand(source, in_object_offset));
+      __ lea(ecx, Operand(result, *offset));

[fschneider, 2011/11/22 17:26:16]

Replace the 3 lines above with:

__ LoadHeapObject(ecx, HeapObject::cast(value));

[Michael Starzinger, 2011/11/23 10:55:32]

Done. As discussed offline, ecx needs to be loaded with a pointer into the space
just allocated in DoObjectLiteralFast(), which is not known statically. But we
can still get rid of the pushes and pops of the source register.

+      __ mov(FieldOperand(result, current_offset + in_object_offset), ecx);
+      EmitDeepCopy(value_object, result, source, offset);
+      __ pop(source);
+    } else {
+      __ mov(ecx, FieldOperand(source, in_object_offset));

[fschneider, 2011/11/22 17:26:16]

Here you could say:

if (value->IsHeapObject()) {
  __ LoadHeapObject(ecx, HeapObject::cast(value));
} else {
  __ mov(ecx, Immediate(value));  
}

[Michael Starzinger, 2011/11/23 10:55:32]

Done.

+      __ mov(FieldOperand(result, current_offset + in_object_offset), ecx);
+    }
+  }
+}
+
+
+void LCodeGen::DoObjectLiteralFast(LObjectLiteralFast* instr) {
+  ASSERT(ToRegister(instr->context()).is(esi));
+  int size = instr->hydrogen()->total_size();
+
+  // Allocate all objects that are part of the literal in one big
+  // allocation. This avoids multiple limit checks.
+  Label allocated, runtime_allocate;
+  __ AllocateInNewSpace(size, eax, ecx, edx, &runtime_allocate, TAG_OBJECT);
+  __ jmp(&allocated);
+
+  __ bind(&runtime_allocate);
+  __ push(Immediate(Smi::FromInt(size)));
+  CallRuntime(Runtime::kAllocateInNewSpace, 1, instr);
+
+  __ bind(&allocated);
+  int offset = 0;
+  int literal_offset = FixedArray::kHeaderSize +
+      instr->hydrogen()->literal_index() * kPointerSize;
+  __ mov(ebx, Operand(ebp, JavaScriptFrameConstants::kFunctionOffset));
+  __ mov(ebx, FieldOperand(ebx, JSFunction::kLiteralsOffset));
+  __ mov(ebx, FieldOperand(ebx, literal_offset));

[fschneider, 2011/11/22 17:26:16]

You could just load the boilerplace object directly. The LoadHeapObject macro
handles the case of a new-space object by indirecting via a global cell:

__ LoadHeapObject(ebx, instr->hydrogen()->boilerplate());

[Michael Starzinger, 2011/11/23 10:55:32]

Done.

+  EmitDeepCopy(instr->hydrogen()->boilerplate(), eax, ebx, &offset);
+  ASSERT_EQ(size, offset);
+}
+
+
+void LCodeGen::DoObjectLiteralGeneric(LObjectLiteralGeneric* instr) {
   ASSERT(ToRegister(instr->context()).is(esi));
   Handle<FixedArray> constant_properties =
       instr->hydrogen()->constant_properties();
 
   // Setup the parameters to the stub/runtime call.
   __ mov(eax, Operand(ebp, JavaScriptFrameConstants::kFunctionOffset));
   __ push(FieldOperand(eax, JSFunction::kLiteralsOffset));
   __ push(Immediate(Smi::FromInt(instr->hydrogen()->literal_index())));
   __ push(Immediate(constant_properties));
   int flags = instr->hydrogen()->fast_elements()
@@ skipping 374 matching lines @@
       this, pointers, Safepoint::kLazyDeopt);
   __ InvokeBuiltin(Builtins::IN, CALL_FUNCTION, safepoint_generator);
 }
 
 
 #undef __
 
 } }  // namespace v8::internal
 
 #endif  // V8_TARGET_ARCH_IA32