| Index: src/ic/x64/handler-compiler-x64.cc
|
| diff --git a/src/ic/x64/handler-compiler-x64.cc b/src/ic/x64/handler-compiler-x64.cc
|
| index 21d96eaabcfb9ba3ff696f42a31f455461a285d0..348f79cb21df0b22cd80e3d41c39da6fe8b4df85 100644
|
| --- a/src/ic/x64/handler-compiler-x64.cc
|
| +++ b/src/ic/x64/handler-compiler-x64.cc
|
| @@ -440,29 +440,26 @@ Register PropertyHandlerCompiler::CheckPrototypes(
|
| DCHECK(!scratch2.is(object_reg) && !scratch2.is(holder_reg) &&
|
| !scratch2.is(scratch1));
|
|
|
| - if (FLAG_eliminate_prototype_chain_checks) {
|
| - Handle<Cell> validity_cell =
|
| - Map::GetOrCreatePrototypeChainValidityCell(receiver_map, isolate());
|
| - if (!validity_cell.is_null()) {
|
| - DCHECK_EQ(Smi::FromInt(Map::kPrototypeChainValid),
|
| - validity_cell->value());
|
| - __ Move(scratch1, validity_cell, RelocInfo::CELL);
|
| - // Move(..., CELL) loads the payload's address!
|
| - __ SmiCompare(Operand(scratch1, 0),
|
| - Smi::FromInt(Map::kPrototypeChainValid));
|
| - __ j(not_equal, miss);
|
| - }
|
| + Handle<Cell> validity_cell =
|
| + Map::GetOrCreatePrototypeChainValidityCell(receiver_map, isolate());
|
| + if (!validity_cell.is_null()) {
|
| + DCHECK_EQ(Smi::FromInt(Map::kPrototypeChainValid), validity_cell->value());
|
| + __ Move(scratch1, validity_cell, RelocInfo::CELL);
|
| + // Move(..., CELL) loads the payload's address!
|
| + __ SmiCompare(Operand(scratch1, 0),
|
| + Smi::FromInt(Map::kPrototypeChainValid));
|
| + __ j(not_equal, miss);
|
| + }
|
|
|
| - // The prototype chain of primitives (and their JSValue wrappers) depends
|
| - // on the native context, which can't be guarded by validity cells.
|
| - // |object_reg| holds the native context specific prototype in this case;
|
| - // we need to check its map.
|
| - if (check == CHECK_ALL_MAPS) {
|
| - __ movp(scratch1, FieldOperand(object_reg, HeapObject::kMapOffset));
|
| - Handle<WeakCell> cell = Map::WeakCellForMap(receiver_map);
|
| - __ CmpWeakValue(scratch1, cell, scratch2);
|
| - __ j(not_equal, miss);
|
| - }
|
| + // The prototype chain of primitives (and their JSValue wrappers) depends
|
| + // on the native context, which can't be guarded by validity cells.
|
| + // |object_reg| holds the native context specific prototype in this case;
|
| + // we need to check its map.
|
| + if (check == CHECK_ALL_MAPS) {
|
| + __ movp(scratch1, FieldOperand(object_reg, HeapObject::kMapOffset));
|
| + Handle<WeakCell> cell = Map::WeakCellForMap(receiver_map);
|
| + __ CmpWeakValue(scratch1, cell, scratch2);
|
| + __ j(not_equal, miss);
|
| }
|
|
|
| // Keep track of the current object in register reg. On the first
|
| @@ -500,8 +497,10 @@ Register PropertyHandlerCompiler::CheckPrototypes(
|
| !current_map->is_access_check_needed());
|
|
|
| prototype = handle(JSObject::cast(current_map->prototype()));
|
| - if (current_map->is_dictionary_map() &&
|
| - !current_map->IsJSGlobalObjectMap()) {
|
| + if (current_map->IsJSGlobalObjectMap()) {
|
| + GenerateCheckPropertyCell(masm(), Handle<JSGlobalObject>::cast(current),
|
| + name, scratch2, miss);
|
| + } else if (current_map->is_dictionary_map()) {
|
| DCHECK(!current_map->IsJSGlobalProxyMap()); // Proxy maps are fast.
|
| if (!name->IsUniqueName()) {
|
| DCHECK(name->IsString());
|
| @@ -511,34 +510,12 @@ Register PropertyHandlerCompiler::CheckPrototypes(
|
| current->property_dictionary()->FindEntry(name) ==
|
| NameDictionary::kNotFound);
|
|
|
| - if (FLAG_eliminate_prototype_chain_checks && depth > 1) {
|
| + if (depth > 1) {
|
| // TODO(jkummerow): Cache and re-use weak cell.
|
| __ LoadWeakValue(reg, isolate()->factory()->NewWeakCell(current), miss);
|
| }
|
| GenerateDictionaryNegativeLookup(masm(), miss, reg, name, scratch1,
|
| scratch2);
|
| -
|
| - if (!FLAG_eliminate_prototype_chain_checks) {
|
| - __ movp(scratch1, FieldOperand(reg, HeapObject::kMapOffset));
|
| - __ movp(holder_reg, FieldOperand(scratch1, Map::kPrototypeOffset));
|
| - }
|
| - } else {
|
| - Register map_reg = scratch1;
|
| - if (!FLAG_eliminate_prototype_chain_checks) {
|
| - __ movp(map_reg, FieldOperand(reg, HeapObject::kMapOffset));
|
| - }
|
| - if (current_map->IsJSGlobalObjectMap()) {
|
| - GenerateCheckPropertyCell(masm(), Handle<JSGlobalObject>::cast(current),
|
| - name, scratch2, miss);
|
| - } else if (!FLAG_eliminate_prototype_chain_checks &&
|
| - (depth != 1 || check == CHECK_ALL_MAPS)) {
|
| - Handle<WeakCell> cell = Map::WeakCellForMap(current_map);
|
| - __ CmpWeakValue(map_reg, cell, scratch2);
|
| - __ j(not_equal, miss);
|
| - }
|
| - if (!FLAG_eliminate_prototype_chain_checks) {
|
| - __ movp(holder_reg, FieldOperand(map_reg, Map::kPrototypeOffset));
|
| - }
|
| }
|
|
|
| reg = holder_reg; // From now on the object will be in holder_reg.
|
| @@ -552,17 +529,8 @@ Register PropertyHandlerCompiler::CheckPrototypes(
|
| // Log the check depth.
|
| LOG(isolate(), IntEvent("check-maps-depth", depth + 1));
|
|
|
| - if (!FLAG_eliminate_prototype_chain_checks &&
|
| - (depth != 0 || check == CHECK_ALL_MAPS)) {
|
| - // Check the holder map.
|
| - __ movp(scratch1, FieldOperand(reg, HeapObject::kMapOffset));
|
| - Handle<WeakCell> cell = Map::WeakCellForMap(current_map);
|
| - __ CmpWeakValue(scratch1, cell, scratch2);
|
| - __ j(not_equal, miss);
|
| - }
|
| -
|
| bool return_holder = return_what == RETURN_HOLDER;
|
| - if (FLAG_eliminate_prototype_chain_checks && return_holder && depth != 0) {
|
| + if (return_holder && depth != 0) {
|
| __ LoadWeakValue(reg, isolate()->factory()->NewWeakCell(current), miss);
|
| }
|
|
|
|
|