| Index: src/ic/arm/handler-compiler-arm.cc
|
| diff --git a/src/ic/arm/handler-compiler-arm.cc b/src/ic/arm/handler-compiler-arm.cc
|
| index ed26a4e0df7c2a07a75607a36301712eac254ac2..3aa1a164d98d71ff27acfe0515430e7c62bdf2eb 100644
|
| --- a/src/ic/arm/handler-compiler-arm.cc
|
| +++ b/src/ic/arm/handler-compiler-arm.cc
|
| @@ -437,28 +437,25 @@ Register PropertyHandlerCompiler::CheckPrototypes(
|
| DCHECK(!scratch2.is(object_reg) && !scratch2.is(holder_reg) &&
|
| !scratch2.is(scratch1));
|
|
|
| - if (FLAG_eliminate_prototype_chain_checks) {
|
| - Handle<Cell> validity_cell =
|
| - Map::GetOrCreatePrototypeChainValidityCell(receiver_map, isolate());
|
| - if (!validity_cell.is_null()) {
|
| - DCHECK_EQ(Smi::FromInt(Map::kPrototypeChainValid),
|
| - validity_cell->value());
|
| - __ mov(scratch1, Operand(validity_cell));
|
| - __ ldr(scratch1, FieldMemOperand(scratch1, Cell::kValueOffset));
|
| - __ cmp(scratch1, Operand(Smi::FromInt(Map::kPrototypeChainValid)));
|
| - __ b(ne, miss);
|
| - }
|
| + Handle<Cell> validity_cell =
|
| + Map::GetOrCreatePrototypeChainValidityCell(receiver_map, isolate());
|
| + if (!validity_cell.is_null()) {
|
| + DCHECK_EQ(Smi::FromInt(Map::kPrototypeChainValid), validity_cell->value());
|
| + __ mov(scratch1, Operand(validity_cell));
|
| + __ ldr(scratch1, FieldMemOperand(scratch1, Cell::kValueOffset));
|
| + __ cmp(scratch1, Operand(Smi::FromInt(Map::kPrototypeChainValid)));
|
| + __ b(ne, miss);
|
| + }
|
|
|
| - // The prototype chain of primitives (and their JSValue wrappers) depends
|
| - // on the native context, which can't be guarded by validity cells.
|
| - // |object_reg| holds the native context specific prototype in this case;
|
| - // we need to check its map.
|
| - if (check == CHECK_ALL_MAPS) {
|
| - __ ldr(scratch1, FieldMemOperand(object_reg, HeapObject::kMapOffset));
|
| - Handle<WeakCell> cell = Map::WeakCellForMap(receiver_map);
|
| - __ CmpWeakValue(scratch1, cell, scratch2);
|
| - __ b(ne, miss);
|
| - }
|
| + // The prototype chain of primitives (and their JSValue wrappers) depends
|
| + // on the native context, which can't be guarded by validity cells.
|
| + // |object_reg| holds the native context specific prototype in this case;
|
| + // we need to check its map.
|
| + if (check == CHECK_ALL_MAPS) {
|
| + __ ldr(scratch1, FieldMemOperand(object_reg, HeapObject::kMapOffset));
|
| + Handle<WeakCell> cell = Map::WeakCellForMap(receiver_map);
|
| + __ CmpWeakValue(scratch1, cell, scratch2);
|
| + __ b(ne, miss);
|
| }
|
|
|
| // Keep track of the current object in register reg.
|
| @@ -494,8 +491,10 @@ Register PropertyHandlerCompiler::CheckPrototypes(
|
| !current_map->is_access_check_needed());
|
|
|
| prototype = handle(JSObject::cast(current_map->prototype()));
|
| - if (current_map->is_dictionary_map() &&
|
| - !current_map->IsJSGlobalObjectMap()) {
|
| + if (current_map->IsJSGlobalObjectMap()) {
|
| + GenerateCheckPropertyCell(masm(), Handle<JSGlobalObject>::cast(current),
|
| + name, scratch2, miss);
|
| + } else if (current_map->is_dictionary_map()) {
|
| DCHECK(!current_map->IsJSGlobalProxyMap()); // Proxy maps are fast.
|
| if (!name->IsUniqueName()) {
|
| DCHECK(name->IsString());
|
| @@ -505,33 +504,12 @@ Register PropertyHandlerCompiler::CheckPrototypes(
|
| current->property_dictionary()->FindEntry(name) ==
|
| NameDictionary::kNotFound);
|
|
|
| - if (FLAG_eliminate_prototype_chain_checks && depth > 1) {
|
| + if (depth > 1) {
|
| // TODO(jkummerow): Cache and re-use weak cell.
|
| __ LoadWeakValue(reg, isolate()->factory()->NewWeakCell(current), miss);
|
| }
|
| GenerateDictionaryNegativeLookup(masm(), miss, reg, name, scratch1,
|
| scratch2);
|
| - if (!FLAG_eliminate_prototype_chain_checks) {
|
| - __ ldr(scratch1, FieldMemOperand(reg, HeapObject::kMapOffset));
|
| - __ ldr(holder_reg, FieldMemOperand(scratch1, Map::kPrototypeOffset));
|
| - }
|
| - } else {
|
| - Register map_reg = scratch1;
|
| - if (!FLAG_eliminate_prototype_chain_checks) {
|
| - __ ldr(map_reg, FieldMemOperand(reg, HeapObject::kMapOffset));
|
| - }
|
| - if (current_map->IsJSGlobalObjectMap()) {
|
| - GenerateCheckPropertyCell(masm(), Handle<JSGlobalObject>::cast(current),
|
| - name, scratch2, miss);
|
| - } else if (!FLAG_eliminate_prototype_chain_checks &&
|
| - (depth != 1 || check == CHECK_ALL_MAPS)) {
|
| - Handle<WeakCell> cell = Map::WeakCellForMap(current_map);
|
| - __ CmpWeakValue(map_reg, cell, scratch2);
|
| - __ b(ne, miss);
|
| - }
|
| - if (!FLAG_eliminate_prototype_chain_checks) {
|
| - __ ldr(holder_reg, FieldMemOperand(map_reg, Map::kPrototypeOffset));
|
| - }
|
| }
|
|
|
| reg = holder_reg; // From now on the object will be in holder_reg.
|
| @@ -545,17 +523,8 @@ Register PropertyHandlerCompiler::CheckPrototypes(
|
| // Log the check depth.
|
| LOG(isolate(), IntEvent("check-maps-depth", depth + 1));
|
|
|
| - if (!FLAG_eliminate_prototype_chain_checks &&
|
| - (depth != 0 || check == CHECK_ALL_MAPS)) {
|
| - // Check the holder map.
|
| - __ ldr(scratch1, FieldMemOperand(reg, HeapObject::kMapOffset));
|
| - Handle<WeakCell> cell = Map::WeakCellForMap(current_map);
|
| - __ CmpWeakValue(scratch1, cell, scratch2);
|
| - __ b(ne, miss);
|
| - }
|
| -
|
| bool return_holder = return_what == RETURN_HOLDER;
|
| - if (FLAG_eliminate_prototype_chain_checks && return_holder && depth != 0) {
|
| + if (return_holder && depth != 0) {
|
| __ LoadWeakValue(reg, isolate()->factory()->NewWeakCell(current), miss);
|
| }
|
|
|
|
|