| Index: src/ic/x87/handler-compiler-x87.cc
|
| diff --git a/src/ic/x87/handler-compiler-x87.cc b/src/ic/x87/handler-compiler-x87.cc
|
| index 79832733a1d620bceb68f5863386374b852bab13..435033dd0728fbad48a706d9335fa51cae441bea 100644
|
| --- a/src/ic/x87/handler-compiler-x87.cc
|
| +++ b/src/ic/x87/handler-compiler-x87.cc
|
| @@ -439,28 +439,25 @@ Register PropertyHandlerCompiler::CheckPrototypes(
|
| DCHECK(!scratch2.is(object_reg) && !scratch2.is(holder_reg) &&
|
| !scratch2.is(scratch1));
|
|
|
| - if (FLAG_eliminate_prototype_chain_checks) {
|
| - Handle<Cell> validity_cell =
|
| - Map::GetOrCreatePrototypeChainValidityCell(receiver_map, isolate());
|
| - if (!validity_cell.is_null()) {
|
| - DCHECK_EQ(Smi::FromInt(Map::kPrototypeChainValid),
|
| - validity_cell->value());
|
| - // Operand::ForCell(...) points to the cell's payload!
|
| - __ cmp(Operand::ForCell(validity_cell),
|
| - Immediate(Smi::FromInt(Map::kPrototypeChainValid)));
|
| - __ j(not_equal, miss);
|
| - }
|
| + Handle<Cell> validity_cell =
|
| + Map::GetOrCreatePrototypeChainValidityCell(receiver_map, isolate());
|
| + if (!validity_cell.is_null()) {
|
| + DCHECK_EQ(Smi::FromInt(Map::kPrototypeChainValid), validity_cell->value());
|
| + // Operand::ForCell(...) points to the cell's payload!
|
| + __ cmp(Operand::ForCell(validity_cell),
|
| + Immediate(Smi::FromInt(Map::kPrototypeChainValid)));
|
| + __ j(not_equal, miss);
|
| + }
|
|
|
| - // The prototype chain of primitives (and their JSValue wrappers) depends
|
| - // on the native context, which can't be guarded by validity cells.
|
| - // |object_reg| holds the native context specific prototype in this case;
|
| - // we need to check its map.
|
| - if (check == CHECK_ALL_MAPS) {
|
| - __ mov(scratch1, FieldOperand(object_reg, HeapObject::kMapOffset));
|
| - Handle<WeakCell> cell = Map::WeakCellForMap(receiver_map);
|
| - __ CmpWeakValue(scratch1, cell, scratch2);
|
| - __ j(not_equal, miss);
|
| - }
|
| + // The prototype chain of primitives (and their JSValue wrappers) depends
|
| + // on the native context, which can't be guarded by validity cells.
|
| + // |object_reg| holds the native context specific prototype in this case;
|
| + // we need to check its map.
|
| + if (check == CHECK_ALL_MAPS) {
|
| + __ mov(scratch1, FieldOperand(object_reg, HeapObject::kMapOffset));
|
| + Handle<WeakCell> cell = Map::WeakCellForMap(receiver_map);
|
| + __ CmpWeakValue(scratch1, cell, scratch2);
|
| + __ j(not_equal, miss);
|
| }
|
|
|
| // Keep track of the current object in register reg.
|
| @@ -496,8 +493,10 @@ Register PropertyHandlerCompiler::CheckPrototypes(
|
| !current_map->is_access_check_needed());
|
|
|
| prototype = handle(JSObject::cast(current_map->prototype()));
|
| - if (current_map->is_dictionary_map() &&
|
| - !current_map->IsJSGlobalObjectMap()) {
|
| + if (current_map->IsJSGlobalObjectMap()) {
|
| + GenerateCheckPropertyCell(masm(), Handle<JSGlobalObject>::cast(current),
|
| + name, scratch2, miss);
|
| + } else if (current_map->is_dictionary_map()) {
|
| DCHECK(!current_map->IsJSGlobalProxyMap()); // Proxy maps are fast.
|
| if (!name->IsUniqueName()) {
|
| DCHECK(name->IsString());
|
| @@ -507,34 +506,12 @@ Register PropertyHandlerCompiler::CheckPrototypes(
|
| current->property_dictionary()->FindEntry(name) ==
|
| NameDictionary::kNotFound);
|
|
|
| - if (FLAG_eliminate_prototype_chain_checks && depth > 1) {
|
| + if (depth > 1) {
|
| // TODO(jkummerow): Cache and re-use weak cell.
|
| __ LoadWeakValue(reg, isolate()->factory()->NewWeakCell(current), miss);
|
| }
|
| GenerateDictionaryNegativeLookup(masm(), miss, reg, name, scratch1,
|
| scratch2);
|
| -
|
| - if (!FLAG_eliminate_prototype_chain_checks) {
|
| - __ mov(scratch1, FieldOperand(reg, HeapObject::kMapOffset));
|
| - __ mov(holder_reg, FieldOperand(scratch1, Map::kPrototypeOffset));
|
| - }
|
| - } else {
|
| - Register map_reg = scratch1;
|
| - if (!FLAG_eliminate_prototype_chain_checks) {
|
| - __ mov(map_reg, FieldOperand(reg, HeapObject::kMapOffset));
|
| - }
|
| - if (current_map->IsJSGlobalObjectMap()) {
|
| - GenerateCheckPropertyCell(masm(), Handle<JSGlobalObject>::cast(current),
|
| - name, scratch2, miss);
|
| - } else if (!FLAG_eliminate_prototype_chain_checks &&
|
| - (depth != 1 || check == CHECK_ALL_MAPS)) {
|
| - Handle<WeakCell> cell = Map::WeakCellForMap(current_map);
|
| - __ CmpWeakValue(map_reg, cell, scratch2);
|
| - __ j(not_equal, miss);
|
| - }
|
| - if (!FLAG_eliminate_prototype_chain_checks) {
|
| - __ mov(holder_reg, FieldOperand(map_reg, Map::kPrototypeOffset));
|
| - }
|
| }
|
|
|
| reg = holder_reg; // From now on the object will be in holder_reg.
|
| @@ -548,17 +525,8 @@ Register PropertyHandlerCompiler::CheckPrototypes(
|
| // Log the check depth.
|
| LOG(isolate(), IntEvent("check-maps-depth", depth + 1));
|
|
|
| - if (!FLAG_eliminate_prototype_chain_checks &&
|
| - (depth != 0 || check == CHECK_ALL_MAPS)) {
|
| - // Check the holder map.
|
| - __ mov(scratch1, FieldOperand(reg, HeapObject::kMapOffset));
|
| - Handle<WeakCell> cell = Map::WeakCellForMap(current_map);
|
| - __ CmpWeakValue(scratch1, cell, scratch2);
|
| - __ j(not_equal, miss);
|
| - }
|
| -
|
| bool return_holder = return_what == RETURN_HOLDER;
|
| - if (FLAG_eliminate_prototype_chain_checks && return_holder && depth != 0) {
|
| + if (return_holder && depth != 0) {
|
| __ LoadWeakValue(reg, isolate()->factory()->NewWeakCell(current), miss);
|
| }
|
|
|
|
|