[ic] Support data handlers that represent loads from prototypes.

src/code-stub-assembler.cc

 // Copyright 2016 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/code-stub-assembler.h"
 #include "src/code-factory.h"
 #include "src/frames-inl.h"
 #include "src/frames.h"
 #include "src/ic/handler-configuration.h"
 #include "src/ic/stub-cache.h"
@@ skipping 4346 matching lines @@
   // Get the map entry from the cache.
   DCHECK_EQ(kPointerSize * 2, stub_cache->map_reference(table).address() -
                                   stub_cache->key_reference(table).address());
   Node* entry_map =
       Load(MachineType::Pointer(), key_base,
            IntPtrAdd(entry_offset, IntPtrConstant(kPointerSize * 2)));
   GotoIf(WordNotEqual(map, entry_map), if_miss);
 
   DCHECK_EQ(kPointerSize, stub_cache->value_reference(table).address() -
                               stub_cache->key_reference(table).address());
-  Node* code = Load(MachineType::Pointer(), key_base,
-                    IntPtrAdd(entry_offset, IntPtrConstant(kPointerSize)));
+  Node* handler = Load(MachineType::Pointer(), key_base,
+                       IntPtrAdd(entry_offset, IntPtrConstant(kPointerSize)));
 
   // We found the handler.
-  var_handler->Bind(code);
+  var_handler->Bind(handler);
   Goto(if_handler);
 }
 
 void CodeStubAssembler::TryProbeStubCache(
     StubCache* stub_cache, compiler::Node* receiver, compiler::Node* name,
     Label* if_handler, Variable* var_handler, Label* if_miss) {
   Label try_secondary(this), miss(this);
 
   Counters* counters = isolate()->counters();
   IncrementCounter(counters->megamorphic_stub_cache_probes(), 1);
@@ skipping 265 matching lines @@
       var_double_value->Bind(element);
       Goto(rebox_double);
     }
   }
 }
 
 void CodeStubAssembler::HandleLoadICHandlerCase(
     const LoadICParameters* p, Node* handler, Label* miss,
     ElementSupport support_elements) {
   Comment("have_handler");
-  Label call_handler(this);
-  GotoUnless(TaggedIsSmi(handler), &call_handler);
+  Variable var_holder(this, MachineRepresentation::kTagged);
+  var_holder.Bind(p->receiver);
+  Variable var_handler(this, MachineRepresentation::kTagged);
+  var_handler.Bind(handler);
+
+  Variable* vars[] = {&var_holder, &var_handler};
+  Label if_smi_handler(this, 2, vars);
+  Label try_proto_cell_handler(this), call_handler(this);
+
+  Branch(TaggedIsSmi(handler), &if_smi_handler, &try_proto_cell_handler);
 
   // |handler| is a Smi, encoding what to do. See handler-configuration.h
   // for the encoding format.
+  Bind(&if_smi_handler);
   {
+    Node* holder = var_holder.value();
+    Node* handler = var_handler.value();

[Jakob Kummerow, 2016/10/13 11:59:26]

nit: This (and its two friends in 4770 and 4794) shadows an identically named
variable in the outer scope (see parameter in line 4654). Please avoid this,
either by renaming, or by s/Node* // here and below.

[Igor Sheludko, 2016/10/13 13:20:38]

Done.

     Variable var_double_value(this, MachineRepresentation::kFloat64);
     Label rebox_double(this, &var_double_value);
 
     Node* handler_word = SmiUntag(handler);
     if (support_elements == kSupportElements) {
       Label property(this);
       Node* handler_type =
           WordAnd(handler_word, IntPtrConstant(LoadHandlerTypeBit::kMask));
       GotoUnless(
           WordEqual(handler_type, IntPtrConstant(kLoadICHandlerForElements)),
           &property);
 
       Comment("element_load");
       Node* intptr_index = TryToIntptr(p->name, miss);
-      Node* elements = LoadElements(p->receiver);
+      Node* elements = LoadElements(holder);
       Node* is_jsarray =
           WordAnd(handler_word, IntPtrConstant(KeyedLoadIsJsArray::kMask));
       Node* is_jsarray_condition = WordNotEqual(is_jsarray, IntPtrConstant(0));
       Node* elements_kind = BitFieldDecode<KeyedLoadElementsKind>(handler_word);
       Label if_hole(this), unimplemented_elements_kind(this);
       Label* out_of_bounds = miss;
-      EmitElementLoad(p->receiver, elements, elements_kind, intptr_index,
+      EmitElementLoad(holder, elements, elements_kind, intptr_index,
                       is_jsarray_condition, &if_hole, &rebox_double,
                       &var_double_value, &unimplemented_elements_kind,
                       out_of_bounds, miss);
 
       Bind(&unimplemented_elements_kind);
       {
         // Smi handlers should only be installed for supported elements kinds.
         // Crash if we get here.
         DebugBreak();
         Goto(miss);
@@ skipping 26 matching lines @@
     Node* inobject_bit =
         WordAnd(handler_word, IntPtrConstant(FieldOffsetIsInobject::kMask));
     Node* double_bit =
         WordAnd(handler_word, IntPtrConstant(FieldOffsetIsDouble::kMask));
     Node* offset =
         WordSar(handler_word, IntPtrConstant(FieldOffsetOffset::kShift));
 
     GotoIf(WordEqual(inobject_bit, IntPtrConstant(0)), &out_of_object);
 
     GotoUnless(WordEqual(double_bit, IntPtrConstant(0)), &inobject_double);
-    Return(LoadObjectField(p->receiver, offset));
+    Return(LoadObjectField(holder, offset));
 
     Bind(&inobject_double);
     if (FLAG_unbox_double_fields) {
       var_double_value.Bind(
-          LoadObjectField(p->receiver, offset, MachineType::Float64()));
+          LoadObjectField(holder, offset, MachineType::Float64()));
     } else {
-      Node* mutable_heap_number = LoadObjectField(p->receiver, offset);
+      Node* mutable_heap_number = LoadObjectField(holder, offset);
       var_double_value.Bind(LoadHeapNumberValue(mutable_heap_number));
     }
     Goto(&rebox_double);
 
     Bind(&out_of_object);
-    Node* properties = LoadProperties(p->receiver);
+    Node* properties = LoadProperties(holder);
     Node* value = LoadObjectField(properties, offset);
     GotoUnless(WordEqual(double_bit, IntPtrConstant(0)), &out_of_object_double);
     Return(value);
 
     Bind(&out_of_object_double);
     var_double_value.Bind(LoadHeapNumberValue(value));
     Goto(&rebox_double);
 
     Bind(&rebox_double);
     Return(AllocateHeapNumberWithValue(var_double_value.value()));
   }
 
+  Bind(&try_proto_cell_handler);
+  {
+    Node* handler = var_handler.value();
+    GotoIf(WordNotEqual(LoadMap(handler), LoadRoot(Heap::kTuple3MapRootIndex)),
+           &call_handler);
+    Node* validity_cell = LoadObjectField(handler, Tuple3::kValue1Offset);
+    Node* cell_value = LoadObjectField(validity_cell, Cell::kValueOffset);
+    GotoIf(WordNotEqual(cell_value,
+                        SmiConstant(Smi::FromInt(Map::kPrototypeChainValid))),
+           miss);
+
+    Node* holder =
+        LoadWeakCellValue(LoadObjectField(handler, Tuple3::kValue2Offset));
+    Assert(WordNotEqual(holder, IntPtrConstant(0)));

[Jakob Kummerow, 2016/10/13 11:59:26]

Why is it guaranteed that this WeakCell has not been cleared? Please add a
comment.

[Igor Sheludko, 2016/10/13 13:20:38]

Done.

+
+    Node* smi_handler = LoadObjectField(handler, Tuple3::kValue3Offset);
+    Assert(TaggedIsSmi(smi_handler));
+
+    var_holder.Bind(holder);
+    var_handler.Bind(smi_handler);
+    Goto(&if_smi_handler);
+  }
+
   // |handler| is a heap object. Must be code, call it.
   Bind(&call_handler);
-  typedef LoadWithVectorDescriptor Descriptor;
-  TailCallStub(Descriptor(isolate()), handler, p->context,
-               Arg(Descriptor::kReceiver, p->receiver),
-               Arg(Descriptor::kName, p->name),
-               Arg(Descriptor::kSlot, p->slot),
-               Arg(Descriptor::kVector, p->vector));
+  {
+    Node* handler = var_handler.value();
+    typedef LoadWithVectorDescriptor Descriptor;
+    TailCallStub(Descriptor(isolate()), handler, p->context,
+                 Arg(Descriptor::kReceiver, p->receiver),
+                 Arg(Descriptor::kName, p->name),
+                 Arg(Descriptor::kSlot, p->slot),
+                 Arg(Descriptor::kVector, p->vector));
+  }
 }
 
 void CodeStubAssembler::LoadIC(const LoadICParameters* p) {
   Variable var_handler(this, MachineRepresentation::kTagged);
   // TODO(ishell): defer blocks when it works.
   Label if_handler(this, &var_handler), try_polymorphic(this),
       try_megamorphic(this /*, Label::kDeferred*/),
       miss(this /*, Label::kDeferred*/);
 
   Node* receiver_map = LoadReceiverMap(p->receiver);
@@ skipping 2462 matching lines @@
     result.Bind(CallRuntime(Runtime::kInstanceOf, context, object, callable));
     Goto(&end);
   }
 
   Bind(&end);
   return result.value();
 }
 
 }  // namespace internal
 }  // namespace v8