Migrate FastCloneShallowObjectStub to TurboFan

src/code-stubs.cc

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/code-stubs.h"
 
 #include <sstream>
 
 #include "src/bootstrapper.h"
 #include "src/code-factory.h"
@@ skipping 3605 matching lines @@
                     &if_keyisinvalid);
   assembler->Bind(&if_keyispositivesmi);
   assembler->TailCallRuntime(Runtime::kLoadElementWithInterceptor, context,
                              receiver, key);
 
   assembler->Bind(&if_keyisinvalid);
   assembler->TailCallRuntime(Runtime::kKeyedLoadIC_Miss, context, receiver, key,
                              slot, vector);
 }
 
+void FastCloneShallowObjectStub::GenerateAssembly(
+    compiler::CodeStubAssembler* assembler) const {
+  typedef compiler::CodeStubAssembler::Label Label;
+  typedef compiler::Node Node;
+  Label call_runtime(assembler);
+  Node* closure = assembler->Parameter(0);
+  Node* literals_index = assembler->Parameter(1);
+
+  Node* undefined = assembler->UndefinedConstant();
+  Node* literals_array =
+      assembler->LoadObjectField(closure, JSFunction::kLiteralsOffset);
+  Node* allocation_site = assembler->LoadFixedArrayElementSmiIndex(
+      literals_array, literals_index,
+      LiteralsArray::kFirstLiteralIndex * kPointerSize);
+  assembler->GotoIf(assembler->WordEqual(allocation_site, undefined),
+                    &call_runtime);
+
+  Node* boilerplate = assembler->LoadObjectField(
+      allocation_site, AllocationSite::kTransitionInfoOffset);
+
+  int length = this->length();
+  if (length == 0) {
+    length = JSObject::kInitialGlobalObjectUnusedPropertiesCount;
+  }
+  int size = JSObject::kHeaderSize + length * kPointerSize;
+  int object_size = size;
+  if (FLAG_allocation_site_pretenuring) {
+    size += AllocationMemento::kSize;
+  }
+
+  Node* boilerplate_map = assembler->LoadMap(boilerplate);
+  Node* instance_size = assembler->LoadMapInstanceSize(boilerplate_map);
+  Node* size_in_words =
+      assembler->Int32Constant(object_size >> kPointerSizeLog2);
+  assembler->GotoUnless(assembler->Word32Equal(instance_size, size_in_words),
+                        &call_runtime);
+
+  Node* copy = assembler->Allocate(size);
+
+  for (int i = 0; i < size; i += kPointerSize) {

[Jakob Kummerow, 2016/04/15 17:20:55]

This should be "i < object_size"! Otherwise we'll copy beyond the end of the
boilerplate (which doesn't have an AllocationMemento behind it), which may well
mean copying outside the current page.

Suggestion: rename "int size" to "int allocation_size" to make the distinction
more obvious.

+    // The Allocate above guarantees that the copy lies in new space. This
+    // allows us to skip write barriers. This is necessary since we may also be
+    // copying unboxed doubles.
+    Node* field =
+        assembler->LoadObjectField(boilerplate, i, MachineType::IntPtr());
+    assembler->StoreObjectFieldNoWriteBarrier(
+        copy, i, field, MachineType::PointerRepresentation());
+  }
+
+  if (FLAG_allocation_site_pretenuring) {
+    Node* memento = assembler->InnerAllocate(copy, object_size);
+    assembler->StoreObjectFieldNoWriteBarrier(
+        memento, HeapObject::kMapOffset,
+        assembler->LoadRoot(Heap::kAllocationMementoMapRootIndex));
+    assembler->StoreObjectFieldNoWriteBarrier(
+        memento, AllocationMemento::kAllocationSiteOffset, allocation_site);
+    Node* memento_create_count = assembler->LoadObjectField(
+        allocation_site, AllocationSite::kPretenureCreateCountOffset);
+    memento_create_count = assembler->SmiAdd(
+        memento_create_count, assembler->SmiConstant(Smi::FromInt(1)));
+    assembler->StoreObjectFieldNoWriteBarrier(
+        allocation_site, AllocationSite::kPretenureCreateCountOffset,
+        memento_create_count);
+  }
+
+  // TODO(verwaest): Allocate and fill in double boxes.
+  assembler->Return(copy);
+
+  assembler->Bind(&call_runtime);
+  Node* constant_properties = assembler->Parameter(2);
+  Node* flags = assembler->Parameter(3);
+  Node* context = assembler->Parameter(4);
+  assembler->TailCallRuntime(Runtime::kCreateObjectLiteral, context, closure,
+                             literals_index, constant_properties, flags);
+}
+
 template<class StateType>
 void HydrogenCodeStub::TraceTransition(StateType from, StateType to) {
   // Note: Although a no-op transition is semantically OK, it is hinting at a
   // bug somewhere in our state transition machinery.
   DCHECK(from != to);
   if (!FLAG_trace_ic) return;
   OFStream os(stdout);
   os << "[";
   PrintBaseName(os);
   os << ": " << from << "=>" << to << "]" << std::endl;
@@ skipping 122 matching lines @@
 
 
 void FastCloneShallowArrayStub::InitializeDescriptor(
     CodeStubDescriptor* descriptor) {
   FastCloneShallowArrayDescriptor call_descriptor(isolate());
   descriptor->Initialize(
       Runtime::FunctionForId(Runtime::kCreateArrayLiteralStubBailout)->entry);
 }
 
 
-void FastCloneShallowObjectStub::InitializeDescriptor(
-    CodeStubDescriptor* descriptor) {
-  FastCloneShallowObjectDescriptor call_descriptor(isolate());
-  descriptor->Initialize(
-      Runtime::FunctionForId(Runtime::kCreateObjectLiteral)->entry);
-}
-
-
 void CreateAllocationSiteStub::InitializeDescriptor(CodeStubDescriptor* d) {}
 
 
 void CreateWeakCellStub::InitializeDescriptor(CodeStubDescriptor* d) {}
 
 
 void RegExpConstructResultStub::InitializeDescriptor(
     CodeStubDescriptor* descriptor) {
   descriptor->Initialize(
       Runtime::FunctionForId(Runtime::kRegExpConstructResult)->entry);
@@ skipping 268 matching lines @@
   if (type->Is(Type::UntaggedPointer())) {
     return Representation::External();
   }
 
   DCHECK(!type->Is(Type::Untagged()));
   return Representation::Tagged();
 }
 
 }  // namespace internal
 }  // namespace v8