| Index: src/ic/arm64/handler-compiler-arm64.cc
|
| diff --git a/src/ic/arm64/handler-compiler-arm64.cc b/src/ic/arm64/handler-compiler-arm64.cc
|
| index 84c0397cd11434fef672956ed579fb6b75768b45..27eafec80085743765e18908f96795bdafb38d06 100644
|
| --- a/src/ic/arm64/handler-compiler-arm64.cc
|
| +++ b/src/ic/arm64/handler-compiler-arm64.cc
|
| @@ -467,28 +467,25 @@ Register PropertyHandlerCompiler::CheckPrototypes(
|
| DCHECK(!AreAliased(object_reg, scratch1, scratch2));
|
| DCHECK(!AreAliased(holder_reg, scratch1, scratch2));
|
|
|
| - if (FLAG_eliminate_prototype_chain_checks) {
|
| - Handle<Cell> validity_cell =
|
| - Map::GetOrCreatePrototypeChainValidityCell(receiver_map, isolate());
|
| - if (!validity_cell.is_null()) {
|
| - DCHECK_EQ(Smi::FromInt(Map::kPrototypeChainValid),
|
| - validity_cell->value());
|
| - __ Mov(scratch1, Operand(validity_cell));
|
| - __ Ldr(scratch1, FieldMemOperand(scratch1, Cell::kValueOffset));
|
| - __ Cmp(scratch1, Operand(Smi::FromInt(Map::kPrototypeChainValid)));
|
| - __ B(ne, miss);
|
| - }
|
| + Handle<Cell> validity_cell =
|
| + Map::GetOrCreatePrototypeChainValidityCell(receiver_map, isolate());
|
| + if (!validity_cell.is_null()) {
|
| + DCHECK_EQ(Smi::FromInt(Map::kPrototypeChainValid), validity_cell->value());
|
| + __ Mov(scratch1, Operand(validity_cell));
|
| + __ Ldr(scratch1, FieldMemOperand(scratch1, Cell::kValueOffset));
|
| + __ Cmp(scratch1, Operand(Smi::FromInt(Map::kPrototypeChainValid)));
|
| + __ B(ne, miss);
|
| + }
|
|
|
| - // The prototype chain of primitives (and their JSValue wrappers) depends
|
| - // on the native context, which can't be guarded by validity cells.
|
| - // |object_reg| holds the native context specific prototype in this case;
|
| - // we need to check its map.
|
| - if (check == CHECK_ALL_MAPS) {
|
| - __ Ldr(scratch1, FieldMemOperand(object_reg, HeapObject::kMapOffset));
|
| - Handle<WeakCell> cell = Map::WeakCellForMap(receiver_map);
|
| - __ CmpWeakValue(scratch1, cell, scratch2);
|
| - __ B(ne, miss);
|
| - }
|
| + // The prototype chain of primitives (and their JSValue wrappers) depends
|
| + // on the native context, which can't be guarded by validity cells.
|
| + // |object_reg| holds the native context specific prototype in this case;
|
| + // we need to check its map.
|
| + if (check == CHECK_ALL_MAPS) {
|
| + __ Ldr(scratch1, FieldMemOperand(object_reg, HeapObject::kMapOffset));
|
| + Handle<WeakCell> cell = Map::WeakCellForMap(receiver_map);
|
| + __ CmpWeakValue(scratch1, cell, scratch2);
|
| + __ B(ne, miss);
|
| }
|
|
|
| // Keep track of the current object in register reg.
|
| @@ -525,8 +522,10 @@ Register PropertyHandlerCompiler::CheckPrototypes(
|
| !current_map->is_access_check_needed());
|
|
|
| prototype = handle(JSObject::cast(current_map->prototype()));
|
| - if (current_map->is_dictionary_map() &&
|
| - !current_map->IsJSGlobalObjectMap()) {
|
| + if (current_map->IsJSGlobalObjectMap()) {
|
| + GenerateCheckPropertyCell(masm(), Handle<JSGlobalObject>::cast(current),
|
| + name, scratch2, miss);
|
| + } else if (current_map->is_dictionary_map()) {
|
| DCHECK(!current_map->IsJSGlobalProxyMap()); // Proxy maps are fast.
|
| if (!name->IsUniqueName()) {
|
| DCHECK(name->IsString());
|
| @@ -535,34 +534,12 @@ Register PropertyHandlerCompiler::CheckPrototypes(
|
| DCHECK(current.is_null() || (current->property_dictionary()->FindEntry(
|
| name) == NameDictionary::kNotFound));
|
|
|
| - if (FLAG_eliminate_prototype_chain_checks && depth > 1) {
|
| + if (depth > 1) {
|
| // TODO(jkummerow): Cache and re-use weak cell.
|
| __ LoadWeakValue(reg, isolate()->factory()->NewWeakCell(current), miss);
|
| }
|
| GenerateDictionaryNegativeLookup(masm(), miss, reg, name, scratch1,
|
| scratch2);
|
| -
|
| - if (!FLAG_eliminate_prototype_chain_checks) {
|
| - __ Ldr(scratch1, FieldMemOperand(reg, HeapObject::kMapOffset));
|
| - __ Ldr(holder_reg, FieldMemOperand(scratch1, Map::kPrototypeOffset));
|
| - }
|
| - } else {
|
| - Register map_reg = scratch1;
|
| - if (!FLAG_eliminate_prototype_chain_checks) {
|
| - __ Ldr(map_reg, FieldMemOperand(reg, HeapObject::kMapOffset));
|
| - }
|
| - if (current_map->IsJSGlobalObjectMap()) {
|
| - GenerateCheckPropertyCell(masm(), Handle<JSGlobalObject>::cast(current),
|
| - name, scratch2, miss);
|
| - } else if (!FLAG_eliminate_prototype_chain_checks &&
|
| - (depth != 1 || check == CHECK_ALL_MAPS)) {
|
| - Handle<WeakCell> cell = Map::WeakCellForMap(current_map);
|
| - __ CmpWeakValue(map_reg, cell, scratch2);
|
| - __ B(ne, miss);
|
| - }
|
| - if (!FLAG_eliminate_prototype_chain_checks) {
|
| - __ Ldr(holder_reg, FieldMemOperand(map_reg, Map::kPrototypeOffset));
|
| - }
|
| }
|
|
|
| reg = holder_reg; // From now on the object will be in holder_reg.
|
| @@ -576,17 +553,8 @@ Register PropertyHandlerCompiler::CheckPrototypes(
|
| // Log the check depth.
|
| LOG(isolate(), IntEvent("check-maps-depth", depth + 1));
|
|
|
| - if (!FLAG_eliminate_prototype_chain_checks &&
|
| - (depth != 0 || check == CHECK_ALL_MAPS)) {
|
| - // Check the holder map.
|
| - __ Ldr(scratch1, FieldMemOperand(reg, HeapObject::kMapOffset));
|
| - Handle<WeakCell> cell = Map::WeakCellForMap(current_map);
|
| - __ CmpWeakValue(scratch1, cell, scratch2);
|
| - __ B(ne, miss);
|
| - }
|
| -
|
| bool return_holder = return_what == RETURN_HOLDER;
|
| - if (FLAG_eliminate_prototype_chain_checks && return_holder && depth != 0) {
|
| + if (return_holder && depth != 0) {
|
| __ LoadWeakValue(reg, isolate()->factory()->NewWeakCell(current), miss);
|
| }
|
|
|
|
|