| OLD | NEW |
| 1 // Copyright 2012 the V8 project authors. All rights reserved. | 1 // Copyright 2012 the V8 project authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #if V8_TARGET_ARCH_MIPS | 5 #if V8_TARGET_ARCH_MIPS |
| 6 | 6 |
| 7 #include "src/codegen.h" | 7 #include "src/codegen.h" |
| 8 #include "src/ic/ic.h" | 8 #include "src/ic/ic.h" |
| 9 #include "src/ic/ic-compiler.h" | 9 #include "src/ic/ic-compiler.h" |
| 10 #include "src/ic/stub-cache.h" | 10 #include "src/ic/stub-cache.h" |
| 11 | 11 |
| 12 namespace v8 { | 12 namespace v8 { |
| 13 namespace internal { | 13 namespace internal { |
| 14 | 14 |
| 15 | 15 |
| 16 // ---------------------------------------------------------------------------- | 16 // ---------------------------------------------------------------------------- |
| 17 // Static IC stub generators. | 17 // Static IC stub generators. |
| 18 // | 18 // |
| 19 | 19 |
| 20 #define __ ACCESS_MASM(masm) | 20 #define __ ACCESS_MASM(masm) |
| 21 | 21 |
| 22 | |
| 23 static void GenerateGlobalInstanceTypeCheck(MacroAssembler* masm, Register type, | |
| 24 Label* global_object) { | |
| 25 // Register usage: | |
| 26 // type: holds the receiver instance type on entry. | |
| 27 __ Branch(global_object, eq, type, Operand(JS_GLOBAL_OBJECT_TYPE)); | |
| 28 __ Branch(global_object, eq, type, Operand(JS_GLOBAL_PROXY_TYPE)); | |
| 29 } | |
| 30 | |
| 31 | |
| 32 // Helper function used from LoadIC GenerateNormal. | 22 // Helper function used from LoadIC GenerateNormal. |
| 33 // | 23 // |
| 34 // elements: Property dictionary. It is not clobbered if a jump to the miss | 24 // elements: Property dictionary. It is not clobbered if a jump to the miss |
| 35 // label is done. | 25 // label is done. |
| 36 // name: Property name. It is not clobbered if a jump to the miss label is | 26 // name: Property name. It is not clobbered if a jump to the miss label is |
| 37 // done | 27 // done |
| 38 // result: Register for the result. It is only updated if a jump to the miss | 28 // result: Register for the result. It is only updated if a jump to the miss |
| 39 // label is not done. Can be the same as elements or name clobbering | 29 // label is not done. Can be the same as elements or name clobbering |
| 40 // one of these in the case of not jumping to the miss label. | 30 // one of these in the case of not jumping to the miss label. |
| 41 // The two scratch registers need to be different from elements, name and | 31 // The two scratch registers need to be different from elements, name and |
| (...skipping 80 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 122 const int kValueOffset = kElementsStartOffset + kPointerSize; | 112 const int kValueOffset = kElementsStartOffset + kPointerSize; |
| 123 __ Addu(scratch2, scratch2, Operand(kValueOffset - kHeapObjectTag)); | 113 __ Addu(scratch2, scratch2, Operand(kValueOffset - kHeapObjectTag)); |
| 124 __ sw(value, MemOperand(scratch2)); | 114 __ sw(value, MemOperand(scratch2)); |
| 125 | 115 |
| 126 // Update the write barrier. Make sure not to clobber the value. | 116 // Update the write barrier. Make sure not to clobber the value. |
| 127 __ mov(scratch1, value); | 117 __ mov(scratch1, value); |
| 128 __ RecordWrite(elements, scratch2, scratch1, kRAHasNotBeenSaved, | 118 __ RecordWrite(elements, scratch2, scratch1, kRAHasNotBeenSaved, |
| 129 kDontSaveFPRegs); | 119 kDontSaveFPRegs); |
| 130 } | 120 } |
| 131 | 121 |
| 132 | |
| 133 // Checks the receiver for special cases (value type, slow case bits). | |
| 134 // Falls through for regular JS object. | |
| 135 static void GenerateKeyedLoadReceiverCheck(MacroAssembler* masm, | |
| 136 Register receiver, Register map, | |
| 137 Register scratch, | |
| 138 int interceptor_bit, Label* slow) { | |
| 139 // Check that the object isn't a smi. | |
| 140 __ JumpIfSmi(receiver, slow); | |
| 141 // Get the map of the receiver. | |
| 142 __ lw(map, FieldMemOperand(receiver, HeapObject::kMapOffset)); | |
| 143 // Check bit field. | |
| 144 __ lbu(scratch, FieldMemOperand(map, Map::kBitFieldOffset)); | |
| 145 __ And(at, scratch, | |
| 146 Operand((1 << Map::kIsAccessCheckNeeded) | (1 << interceptor_bit))); | |
| 147 __ Branch(slow, ne, at, Operand(zero_reg)); | |
| 148 // Check that the object is some kind of JS object EXCEPT JS Value type. | |
| 149 // In the case that the object is a value-wrapper object, | |
| 150 // we enter the runtime system to make sure that indexing into string | |
| 151 // objects work as intended. | |
| 152 DCHECK(JS_OBJECT_TYPE > JS_VALUE_TYPE); | |
| 153 __ lbu(scratch, FieldMemOperand(map, Map::kInstanceTypeOffset)); | |
| 154 __ Branch(slow, lt, scratch, Operand(JS_OBJECT_TYPE)); | |
| 155 } | |
| 156 | |
| 157 | |
| 158 // Loads an indexed element from a fast case array. | |
| 159 static void GenerateFastArrayLoad(MacroAssembler* masm, Register receiver, | |
| 160 Register key, Register elements, | |
| 161 Register scratch1, Register scratch2, | |
| 162 Register result, Label* slow) { | |
| 163 // Register use: | |
| 164 // | |
| 165 // receiver - holds the receiver on entry. | |
| 166 // Unchanged unless 'result' is the same register. | |
| 167 // | |
| 168 // key - holds the smi key on entry. | |
| 169 // Unchanged unless 'result' is the same register. | |
| 170 // | |
| 171 // result - holds the result on exit if the load succeeded. | |
| 172 // Allowed to be the the same as 'receiver' or 'key'. | |
| 173 // Unchanged on bailout so 'receiver' and 'key' can be safely | |
| 174 // used by further computation. | |
| 175 // | |
| 176 // Scratch registers: | |
| 177 // | |
| 178 // elements - holds the elements of the receiver and its prototypes. | |
| 179 // | |
| 180 // scratch1 - used to hold elements length, bit fields, base addresses. | |
| 181 // | |
| 182 // scratch2 - used to hold maps, prototypes, and the loaded value. | |
| 183 Label check_prototypes, check_next_prototype; | |
| 184 Label done, in_bounds, absent; | |
| 185 | |
| 186 __ lw(elements, FieldMemOperand(receiver, JSObject::kElementsOffset)); | |
| 187 __ AssertFastElements(elements); | |
| 188 | |
| 189 // Check that the key (index) is within bounds. | |
| 190 __ lw(scratch1, FieldMemOperand(elements, FixedArray::kLengthOffset)); | |
| 191 __ Branch(&in_bounds, lo, key, Operand(scratch1)); | |
| 192 // Out-of-bounds. Check the prototype chain to see if we can just return | |
| 193 // 'undefined'. | |
| 194 // Negative keys can't take the fast OOB path. | |
| 195 __ Branch(slow, lt, key, Operand(zero_reg)); | |
| 196 __ bind(&check_prototypes); | |
| 197 __ lw(scratch2, FieldMemOperand(receiver, HeapObject::kMapOffset)); | |
| 198 __ bind(&check_next_prototype); | |
| 199 __ lw(scratch2, FieldMemOperand(scratch2, Map::kPrototypeOffset)); | |
| 200 // scratch2: current prototype | |
| 201 __ LoadRoot(at, Heap::kNullValueRootIndex); | |
| 202 __ Branch(&absent, eq, scratch2, Operand(at)); | |
| 203 __ lw(elements, FieldMemOperand(scratch2, JSObject::kElementsOffset)); | |
| 204 __ lw(scratch2, FieldMemOperand(scratch2, HeapObject::kMapOffset)); | |
| 205 // elements: elements of current prototype | |
| 206 // scratch2: map of current prototype | |
| 207 __ lbu(scratch1, FieldMemOperand(scratch2, Map::kInstanceTypeOffset)); | |
| 208 __ Branch(slow, lo, scratch1, Operand(JS_OBJECT_TYPE)); | |
| 209 __ lbu(scratch1, FieldMemOperand(scratch2, Map::kBitFieldOffset)); | |
| 210 __ And(at, scratch1, Operand((1 << Map::kIsAccessCheckNeeded) | | |
| 211 (1 << Map::kHasIndexedInterceptor))); | |
| 212 __ Branch(slow, ne, at, Operand(zero_reg)); | |
| 213 __ LoadRoot(at, Heap::kEmptyFixedArrayRootIndex); | |
| 214 __ Branch(slow, ne, elements, Operand(at)); | |
| 215 __ Branch(&check_next_prototype); | |
| 216 | |
| 217 __ bind(&absent); | |
| 218 __ LoadRoot(result, Heap::kUndefinedValueRootIndex); | |
| 219 __ Branch(&done); | |
| 220 | |
| 221 __ bind(&in_bounds); | |
| 222 // Fast case: Do the load. | |
| 223 __ Addu(scratch1, elements, | |
| 224 Operand(FixedArray::kHeaderSize - kHeapObjectTag)); | |
| 225 // The key is a smi. | |
| 226 STATIC_ASSERT(kSmiTag == 0 && kSmiTagSize < kPointerSizeLog2); | |
| 227 __ Lsa(at, scratch1, key, kPointerSizeLog2 - kSmiTagSize); | |
| 228 __ lw(scratch2, MemOperand(at)); | |
| 229 | |
| 230 __ LoadRoot(at, Heap::kTheHoleValueRootIndex); | |
| 231 // In case the loaded value is the_hole we have to check the prototype chain. | |
| 232 __ Branch(&check_prototypes, eq, scratch2, Operand(at)); | |
| 233 __ Move(result, scratch2); | |
| 234 __ bind(&done); | |
| 235 } | |
| 236 | |
| 237 | |
| 238 // Checks whether a key is an array index string or a unique name. | |
| 239 // Falls through if a key is a unique name. | |
| 240 static void GenerateKeyNameCheck(MacroAssembler* masm, Register key, | |
| 241 Register map, Register hash, | |
| 242 Label* index_string, Label* not_unique) { | |
| 243 // The key is not a smi. | |
| 244 Label unique; | |
| 245 // Is it a name? | |
| 246 __ GetObjectType(key, map, hash); | |
| 247 __ Branch(not_unique, hi, hash, Operand(LAST_UNIQUE_NAME_TYPE)); | |
| 248 STATIC_ASSERT(LAST_UNIQUE_NAME_TYPE == FIRST_NONSTRING_TYPE); | |
| 249 __ Branch(&unique, eq, hash, Operand(LAST_UNIQUE_NAME_TYPE)); | |
| 250 | |
| 251 // Is the string an array index, with cached numeric value? | |
| 252 __ lw(hash, FieldMemOperand(key, Name::kHashFieldOffset)); | |
| 253 __ And(at, hash, Operand(Name::kContainsCachedArrayIndexMask)); | |
| 254 __ Branch(index_string, eq, at, Operand(zero_reg)); | |
| 255 | |
| 256 // Is the string internalized? We know it's a string, so a single | |
| 257 // bit test is enough. | |
| 258 // map: key map | |
| 259 __ lbu(hash, FieldMemOperand(map, Map::kInstanceTypeOffset)); | |
| 260 STATIC_ASSERT(kInternalizedTag == 0); | |
| 261 __ And(at, hash, Operand(kIsNotInternalizedMask)); | |
| 262 __ Branch(not_unique, ne, at, Operand(zero_reg)); | |
| 263 | |
| 264 __ bind(&unique); | |
| 265 } | |
| 266 | |
| 267 void LoadIC::GenerateNormal(MacroAssembler* masm) { | 122 void LoadIC::GenerateNormal(MacroAssembler* masm) { |
| 268 Register dictionary = a0; | 123 Register dictionary = a0; |
| 269 DCHECK(!dictionary.is(LoadDescriptor::ReceiverRegister())); | 124 DCHECK(!dictionary.is(LoadDescriptor::ReceiverRegister())); |
| 270 DCHECK(!dictionary.is(LoadDescriptor::NameRegister())); | 125 DCHECK(!dictionary.is(LoadDescriptor::NameRegister())); |
| 271 | 126 |
| 272 Label slow; | 127 Label slow; |
| 273 | 128 |
| 274 __ lw(dictionary, FieldMemOperand(LoadDescriptor::ReceiverRegister(), | 129 __ lw(dictionary, FieldMemOperand(LoadDescriptor::ReceiverRegister(), |
| 275 JSObject::kPropertiesOffset)); | 130 JSObject::kPropertiesOffset)); |
| 276 GenerateDictionaryLoad(masm, &slow, dictionary, | 131 GenerateDictionaryLoad(masm, &slow, dictionary, |
| (...skipping 61 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 338 | 193 |
| 339 void KeyedLoadIC::GenerateRuntimeGetProperty(MacroAssembler* masm) { | 194 void KeyedLoadIC::GenerateRuntimeGetProperty(MacroAssembler* masm) { |
| 340 // The return address is in ra. | 195 // The return address is in ra. |
| 341 | 196 |
| 342 __ Push(LoadDescriptor::ReceiverRegister(), LoadDescriptor::NameRegister()); | 197 __ Push(LoadDescriptor::ReceiverRegister(), LoadDescriptor::NameRegister()); |
| 343 | 198 |
| 344 // Do tail-call to runtime routine. | 199 // Do tail-call to runtime routine. |
| 345 __ TailCallRuntime(Runtime::kKeyedGetProperty); | 200 __ TailCallRuntime(Runtime::kKeyedGetProperty); |
| 346 } | 201 } |
| 347 | 202 |
| 348 void KeyedLoadIC::GenerateMegamorphic(MacroAssembler* masm) { | |
| 349 // The return address is in ra. | |
| 350 Label slow, check_name, index_smi, index_name, property_array_property; | |
| 351 Label probe_dictionary, check_number_dictionary; | |
| 352 | |
| 353 Register key = LoadDescriptor::NameRegister(); | |
| 354 Register receiver = LoadDescriptor::ReceiverRegister(); | |
| 355 DCHECK(key.is(a2)); | |
| 356 DCHECK(receiver.is(a1)); | |
| 357 | |
| 358 Isolate* isolate = masm->isolate(); | |
| 359 | |
| 360 // Check that the key is a smi. | |
| 361 __ JumpIfNotSmi(key, &check_name); | |
| 362 __ bind(&index_smi); | |
| 363 // Now the key is known to be a smi. This place is also jumped to from below | |
| 364 // where a numeric string is converted to a smi. | |
| 365 | |
| 366 GenerateKeyedLoadReceiverCheck(masm, receiver, a0, a3, | |
| 367 Map::kHasIndexedInterceptor, &slow); | |
| 368 | |
| 369 // Check the receiver's map to see if it has fast elements. | |
| 370 __ CheckFastElements(a0, a3, &check_number_dictionary); | |
| 371 | |
| 372 GenerateFastArrayLoad(masm, receiver, key, a0, a3, t0, v0, &slow); | |
| 373 __ IncrementCounter(isolate->counters()->ic_keyed_load_generic_smi(), 1, t0, | |
| 374 a3); | |
| 375 __ Ret(); | |
| 376 | |
| 377 __ bind(&check_number_dictionary); | |
| 378 __ lw(t0, FieldMemOperand(receiver, JSObject::kElementsOffset)); | |
| 379 __ lw(a3, FieldMemOperand(t0, JSObject::kMapOffset)); | |
| 380 | |
| 381 // Check whether the elements is a number dictionary. | |
| 382 // a3: elements map | |
| 383 // t0: elements | |
| 384 __ LoadRoot(at, Heap::kHashTableMapRootIndex); | |
| 385 __ Branch(&slow, ne, a3, Operand(at)); | |
| 386 __ sra(a0, key, kSmiTagSize); | |
| 387 __ LoadFromNumberDictionary(&slow, t0, key, v0, a0, a3, t1); | |
| 388 __ Ret(); | |
| 389 | |
| 390 // Slow case, key and receiver still in a2 and a1. | |
| 391 __ bind(&slow); | |
| 392 __ IncrementCounter(isolate->counters()->ic_keyed_load_generic_slow(), 1, t0, | |
| 393 a3); | |
| 394 GenerateRuntimeGetProperty(masm); | |
| 395 | |
| 396 __ bind(&check_name); | |
| 397 GenerateKeyNameCheck(masm, key, a0, a3, &index_name, &slow); | |
| 398 | |
| 399 GenerateKeyedLoadReceiverCheck(masm, receiver, a0, a3, | |
| 400 Map::kHasNamedInterceptor, &slow); | |
| 401 | |
| 402 | |
| 403 // If the receiver is a fast-case object, check the stub cache. Otherwise | |
| 404 // probe the dictionary. | |
| 405 __ lw(a3, FieldMemOperand(receiver, JSObject::kPropertiesOffset)); | |
| 406 __ lw(t0, FieldMemOperand(a3, HeapObject::kMapOffset)); | |
| 407 __ LoadRoot(at, Heap::kHashTableMapRootIndex); | |
| 408 __ Branch(&probe_dictionary, eq, t0, Operand(at)); | |
| 409 | |
| 410 // The handlers in the stub cache expect a vector and slot. Since we won't | |
| 411 // change the IC from any downstream misses, a dummy vector can be used. | |
| 412 Register vector = LoadWithVectorDescriptor::VectorRegister(); | |
| 413 Register slot = LoadWithVectorDescriptor::SlotRegister(); | |
| 414 DCHECK(!AreAliased(vector, slot, t0, t1, t2, t5)); | |
| 415 Handle<TypeFeedbackVector> dummy_vector = | |
| 416 TypeFeedbackVector::DummyVector(masm->isolate()); | |
| 417 int slot_index = dummy_vector->GetIndex( | |
| 418 FeedbackVectorSlot(TypeFeedbackVector::kDummyKeyedLoadICSlot)); | |
| 419 __ LoadRoot(vector, Heap::kDummyVectorRootIndex); | |
| 420 __ li(slot, Operand(Smi::FromInt(slot_index))); | |
| 421 | |
| 422 masm->isolate()->load_stub_cache()->GenerateProbe(masm, receiver, key, t0, t1, | |
| 423 t2, t5); | |
| 424 // Cache miss. | |
| 425 GenerateMiss(masm); | |
| 426 | |
| 427 // Do a quick inline probe of the receiver's dictionary, if it | |
| 428 // exists. | |
| 429 __ bind(&probe_dictionary); | |
| 430 // a3: elements | |
| 431 __ lw(a0, FieldMemOperand(receiver, HeapObject::kMapOffset)); | |
| 432 __ lbu(a0, FieldMemOperand(a0, Map::kInstanceTypeOffset)); | |
| 433 GenerateGlobalInstanceTypeCheck(masm, a0, &slow); | |
| 434 // Load the property to v0. | |
| 435 GenerateDictionaryLoad(masm, &slow, a3, key, v0, t1, t0); | |
| 436 __ IncrementCounter(isolate->counters()->ic_keyed_load_generic_symbol(), 1, | |
| 437 t0, a3); | |
| 438 __ Ret(); | |
| 439 | |
| 440 __ bind(&index_name); | |
| 441 __ IndexFromHash(a3, key); | |
| 442 // Now jump to the place where smi keys are handled. | |
| 443 __ Branch(&index_smi); | |
| 444 } | |
| 445 | |
| 446 | |
| 447 static void KeyedStoreGenerateMegamorphicHelper( | 203 static void KeyedStoreGenerateMegamorphicHelper( |
| 448 MacroAssembler* masm, Label* fast_object, Label* fast_double, Label* slow, | 204 MacroAssembler* masm, Label* fast_object, Label* fast_double, Label* slow, |
| 449 KeyedStoreCheckMap check_map, KeyedStoreIncrementLength increment_length, | 205 KeyedStoreCheckMap check_map, KeyedStoreIncrementLength increment_length, |
| 450 Register value, Register key, Register receiver, Register receiver_map, | 206 Register value, Register key, Register receiver, Register receiver_map, |
| 451 Register elements_map, Register elements) { | 207 Register elements_map, Register elements) { |
| 452 Label transition_smi_elements; | 208 Label transition_smi_elements; |
| 453 Label finish_object_store, non_double_value, transition_double_elements; | 209 Label finish_object_store, non_double_value, transition_double_elements; |
| 454 Label fast_double_without_map_check; | 210 Label fast_double_without_map_check; |
| 455 | 211 |
| 456 // Fast case: Do the store, could be either Object or double. | 212 // Fast case: Do the store, could be either Object or double. |
| (...skipping 435 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 892 break; | 648 break; |
| 893 default: | 649 default: |
| 894 UNIMPLEMENTED(); | 650 UNIMPLEMENTED(); |
| 895 } | 651 } |
| 896 patcher.ChangeBranchCondition(branch_instr, opcode); | 652 patcher.ChangeBranchCondition(branch_instr, opcode); |
| 897 } | 653 } |
| 898 } // namespace internal | 654 } // namespace internal |
| 899 } // namespace v8 | 655 } // namespace v8 |
| 900 | 656 |
| 901 #endif // V8_TARGET_ARCH_MIPS | 657 #endif // V8_TARGET_ARCH_MIPS |
| OLD | NEW |