| Index: src/ic/x64/ic-x64.cc
|
| diff --git a/src/ic/x64/ic-x64.cc b/src/ic/x64/ic-x64.cc
|
| index ef38abd9bb6a8514f0528a253988b0988c6e16bb..a916e22fa5ac3fde7f74e1b1874117f89174f6d7 100644
|
| --- a/src/ic/x64/ic-x64.cc
|
| +++ b/src/ic/x64/ic-x64.cc
|
| @@ -18,18 +18,6 @@ namespace internal {
|
|
|
| #define __ ACCESS_MASM(masm)
|
|
|
| -
|
| -static void GenerateGlobalInstanceTypeCheck(MacroAssembler* masm, Register type,
|
| - Label* global_object) {
|
| - // Register usage:
|
| - // type: holds the receiver instance type on entry.
|
| - __ cmpb(type, Immediate(JS_GLOBAL_OBJECT_TYPE));
|
| - __ j(equal, global_object);
|
| - __ cmpb(type, Immediate(JS_GLOBAL_PROXY_TYPE));
|
| - __ j(equal, global_object);
|
| -}
|
| -
|
| -
|
| // Helper function used to load a property from a dictionary backing storage.
|
| // This function may return false negatives, so miss_label
|
| // must always call a backup property load that is complete.
|
| @@ -133,237 +121,6 @@ static void GenerateDictionaryStore(MacroAssembler* masm, Label* miss_label,
|
| __ RecordWrite(elements, scratch1, scratch0, kDontSaveFPRegs);
|
| }
|
|
|
| -
|
| -// Checks the receiver for special cases (value type, slow case bits).
|
| -// Falls through for regular JS object.
|
| -static void GenerateKeyedLoadReceiverCheck(MacroAssembler* masm,
|
| - Register receiver, Register map,
|
| - int interceptor_bit, Label* slow) {
|
| - // Register use:
|
| - // receiver - holds the receiver and is unchanged.
|
| - // Scratch registers:
|
| - // map - used to hold the map of the receiver.
|
| -
|
| - // Check that the object isn't a smi.
|
| - __ JumpIfSmi(receiver, slow);
|
| -
|
| - // Check that the object is some kind of JS object EXCEPT JS Value type.
|
| - // In the case that the object is a value-wrapper object,
|
| - // we enter the runtime system to make sure that indexing
|
| - // into string objects work as intended.
|
| - DCHECK(JS_OBJECT_TYPE > JS_VALUE_TYPE);
|
| - __ CmpObjectType(receiver, JS_OBJECT_TYPE, map);
|
| - __ j(below, slow);
|
| -
|
| - // Check bit field.
|
| - __ testb(
|
| - FieldOperand(map, Map::kBitFieldOffset),
|
| - Immediate((1 << Map::kIsAccessCheckNeeded) | (1 << interceptor_bit)));
|
| - __ j(not_zero, slow);
|
| -}
|
| -
|
| -
|
| -// Loads an indexed element from a fast case array.
|
| -static void GenerateFastArrayLoad(MacroAssembler* masm, Register receiver,
|
| - Register key, Register elements,
|
| - Register scratch, Register result,
|
| - Label* slow) {
|
| - // Register use:
|
| - //
|
| - // receiver - holds the receiver on entry.
|
| - // Unchanged unless 'result' is the same register.
|
| - //
|
| - // key - holds the smi key on entry.
|
| - // Unchanged unless 'result' is the same register.
|
| - //
|
| - // result - holds the result on exit if the load succeeded.
|
| - // Allowed to be the the same as 'receiver' or 'key'.
|
| - // Unchanged on bailout so 'receiver' and 'key' can be safely
|
| - // used by further computation.
|
| - //
|
| - // Scratch registers:
|
| - //
|
| - // elements - holds the elements of the receiver and its prototypes.
|
| - //
|
| - // scratch - used to hold maps, prototypes, and the loaded value.
|
| - Label check_prototypes, check_next_prototype;
|
| - Label done, in_bounds, absent;
|
| -
|
| - __ movp(elements, FieldOperand(receiver, JSObject::kElementsOffset));
|
| - __ AssertFastElements(elements);
|
| - // Check that the key (index) is within bounds.
|
| - __ SmiCompare(key, FieldOperand(elements, FixedArray::kLengthOffset));
|
| - // Unsigned comparison rejects negative indices.
|
| - __ j(below, &in_bounds);
|
| -
|
| - // Out-of-bounds. Check the prototype chain to see if we can just return
|
| - // 'undefined'.
|
| - __ SmiCompare(key, Smi::kZero);
|
| - __ j(less, slow); // Negative keys can't take the fast OOB path.
|
| - __ bind(&check_prototypes);
|
| - __ movp(scratch, FieldOperand(receiver, HeapObject::kMapOffset));
|
| - __ bind(&check_next_prototype);
|
| - __ movp(scratch, FieldOperand(scratch, Map::kPrototypeOffset));
|
| - // scratch: current prototype
|
| - __ CompareRoot(scratch, Heap::kNullValueRootIndex);
|
| - __ j(equal, &absent);
|
| - __ movp(elements, FieldOperand(scratch, JSObject::kElementsOffset));
|
| - __ movp(scratch, FieldOperand(scratch, HeapObject::kMapOffset));
|
| - // elements: elements of current prototype
|
| - // scratch: map of current prototype
|
| - __ CmpInstanceType(scratch, JS_OBJECT_TYPE);
|
| - __ j(below, slow);
|
| - __ testb(FieldOperand(scratch, Map::kBitFieldOffset),
|
| - Immediate((1 << Map::kIsAccessCheckNeeded) |
|
| - (1 << Map::kHasIndexedInterceptor)));
|
| - __ j(not_zero, slow);
|
| - __ CompareRoot(elements, Heap::kEmptyFixedArrayRootIndex);
|
| - __ j(not_equal, slow);
|
| - __ jmp(&check_next_prototype);
|
| -
|
| - __ bind(&absent);
|
| - __ LoadRoot(result, Heap::kUndefinedValueRootIndex);
|
| - __ jmp(&done);
|
| -
|
| - __ bind(&in_bounds);
|
| - // Fast case: Do the load.
|
| - SmiIndex index = masm->SmiToIndex(scratch, key, kPointerSizeLog2);
|
| - __ movp(scratch, FieldOperand(elements, index.reg, index.scale,
|
| - FixedArray::kHeaderSize));
|
| - __ CompareRoot(scratch, Heap::kTheHoleValueRootIndex);
|
| - // In case the loaded value is the_hole we have to check the prototype chain.
|
| - __ j(equal, &check_prototypes);
|
| - __ Move(result, scratch);
|
| - __ bind(&done);
|
| -}
|
| -
|
| -
|
| -// Checks whether a key is an array index string or a unique name.
|
| -// Falls through if the key is a unique name.
|
| -static void GenerateKeyNameCheck(MacroAssembler* masm, Register key,
|
| - Register map, Register hash,
|
| - Label* index_string, Label* not_unique) {
|
| - // Register use:
|
| - // key - holds the key and is unchanged. Assumed to be non-smi.
|
| - // Scratch registers:
|
| - // map - used to hold the map of the key.
|
| - // hash - used to hold the hash of the key.
|
| - Label unique;
|
| - __ CmpObjectType(key, LAST_UNIQUE_NAME_TYPE, map);
|
| - __ j(above, not_unique);
|
| - STATIC_ASSERT(LAST_UNIQUE_NAME_TYPE == FIRST_NONSTRING_TYPE);
|
| - __ j(equal, &unique);
|
| -
|
| - // Is the string an array index, with cached numeric value?
|
| - __ movl(hash, FieldOperand(key, Name::kHashFieldOffset));
|
| - __ testl(hash, Immediate(Name::kContainsCachedArrayIndexMask));
|
| - __ j(zero, index_string); // The value in hash is used at jump target.
|
| -
|
| - // Is the string internalized? We already know it's a string so a single
|
| - // bit test is enough.
|
| - STATIC_ASSERT(kNotInternalizedTag != 0);
|
| - __ testb(FieldOperand(map, Map::kInstanceTypeOffset),
|
| - Immediate(kIsNotInternalizedMask));
|
| - __ j(not_zero, not_unique);
|
| -
|
| - __ bind(&unique);
|
| -}
|
| -
|
| -void KeyedLoadIC::GenerateMegamorphic(MacroAssembler* masm) {
|
| - // The return address is on the stack.
|
| - Label slow, check_name, index_smi, index_name, property_array_property;
|
| - Label probe_dictionary, check_number_dictionary;
|
| -
|
| - Register receiver = LoadDescriptor::ReceiverRegister();
|
| - Register key = LoadDescriptor::NameRegister();
|
| - DCHECK(receiver.is(rdx));
|
| - DCHECK(key.is(rcx));
|
| -
|
| - // Check that the key is a smi.
|
| - __ JumpIfNotSmi(key, &check_name);
|
| - __ bind(&index_smi);
|
| - // Now the key is known to be a smi. This place is also jumped to from below
|
| - // where a numeric string is converted to a smi.
|
| -
|
| - GenerateKeyedLoadReceiverCheck(masm, receiver, rax,
|
| - Map::kHasIndexedInterceptor, &slow);
|
| -
|
| - // Check the receiver's map to see if it has fast elements.
|
| - __ CheckFastElements(rax, &check_number_dictionary);
|
| -
|
| - GenerateFastArrayLoad(masm, receiver, key, rax, rbx, rax, &slow);
|
| - Counters* counters = masm->isolate()->counters();
|
| - __ IncrementCounter(counters->ic_keyed_load_generic_smi(), 1);
|
| - __ ret(0);
|
| -
|
| - __ bind(&check_number_dictionary);
|
| - __ SmiToInteger32(rbx, key);
|
| - __ movp(rax, FieldOperand(receiver, JSObject::kElementsOffset));
|
| -
|
| - // Check whether the elements is a number dictionary.
|
| - // rbx: key as untagged int32
|
| - // rax: elements
|
| - __ CompareRoot(FieldOperand(rax, HeapObject::kMapOffset),
|
| - Heap::kHashTableMapRootIndex);
|
| - __ j(not_equal, &slow);
|
| - __ LoadFromNumberDictionary(&slow, rax, key, rbx, r9, rdi, rax);
|
| - __ ret(0);
|
| -
|
| - __ bind(&slow);
|
| - // Slow case: Jump to runtime.
|
| - __ IncrementCounter(counters->ic_keyed_load_generic_slow(), 1);
|
| - KeyedLoadIC::GenerateRuntimeGetProperty(masm);
|
| -
|
| - __ bind(&check_name);
|
| - GenerateKeyNameCheck(masm, key, rax, rbx, &index_name, &slow);
|
| -
|
| - GenerateKeyedLoadReceiverCheck(masm, receiver, rax, Map::kHasNamedInterceptor,
|
| - &slow);
|
| -
|
| - // If the receiver is a fast-case object, check the stub cache. Otherwise
|
| - // probe the dictionary.
|
| - __ movp(rbx, FieldOperand(receiver, JSObject::kPropertiesOffset));
|
| - __ CompareRoot(FieldOperand(rbx, HeapObject::kMapOffset),
|
| - Heap::kHashTableMapRootIndex);
|
| - __ j(equal, &probe_dictionary);
|
| -
|
| - Register megamorphic_scratch = rdi;
|
| - // The handlers in the stub cache expect a vector and slot. Since we won't
|
| - // change the IC from any downstream misses, a dummy vector can be used.
|
| - Register vector = LoadWithVectorDescriptor::VectorRegister();
|
| - Register slot = LoadDescriptor::SlotRegister();
|
| - DCHECK(!AreAliased(megamorphic_scratch, vector, slot));
|
| - Handle<TypeFeedbackVector> dummy_vector =
|
| - TypeFeedbackVector::DummyVector(masm->isolate());
|
| - int slot_index = dummy_vector->GetIndex(
|
| - FeedbackVectorSlot(TypeFeedbackVector::kDummyKeyedLoadICSlot));
|
| - __ Move(vector, dummy_vector);
|
| - __ Move(slot, Smi::FromInt(slot_index));
|
| -
|
| - masm->isolate()->load_stub_cache()->GenerateProbe(
|
| - masm, receiver, key, megamorphic_scratch, no_reg);
|
| - // Cache miss.
|
| - GenerateMiss(masm);
|
| -
|
| - // Do a quick inline probe of the receiver's dictionary, if it
|
| - // exists.
|
| - __ bind(&probe_dictionary);
|
| - // rbx: elements
|
| -
|
| - __ movp(rax, FieldOperand(receiver, JSObject::kMapOffset));
|
| - __ movb(rax, FieldOperand(rax, Map::kInstanceTypeOffset));
|
| - GenerateGlobalInstanceTypeCheck(masm, rax, &slow);
|
| -
|
| - GenerateDictionaryLoad(masm, &slow, rbx, key, rax, rdi, rax);
|
| - __ IncrementCounter(counters->ic_keyed_load_generic_symbol(), 1);
|
| - __ ret(0);
|
| -
|
| - __ bind(&index_name);
|
| - __ IndexFromHash(rbx, key);
|
| - __ jmp(&index_smi);
|
| -}
|
| -
|
| -
|
| static void KeyedStoreGenerateMegamorphicHelper(
|
| MacroAssembler* masm, Label* fast_object, Label* fast_double, Label* slow,
|
| KeyedStoreCheckMap check_map, KeyedStoreIncrementLength increment_length) {
|
|
|