[ic] Support negative lookup on receiver in data handlers.

src/code-stub-assembler.cc

 // Copyright 2016 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 #include "src/code-stub-assembler.h"
 #include "src/code-factory.h"
 #include "src/frames-inl.h"
 #include "src/frames.h"
 #include "src/ic/handler-configuration.h"
 #include "src/ic/stub-cache.h"
 
@@ skipping 5362 matching lines @@
     const LoadICParameters* p, Node* handler, Label* miss,
     ElementSupport support_elements) {
   Comment("have_handler");
   Variable var_holder(this, MachineRepresentation::kTagged);
   var_holder.Bind(p->receiver);
   Variable var_smi_handler(this, MachineRepresentation::kTagged);
   var_smi_handler.Bind(handler);
 
   Variable* vars[] = {&var_holder, &var_smi_handler};
   Label if_smi_handler(this, 2, vars);
-  Label try_proto_cell_handler(this), call_handler(this);
+  Label try_proto_handler(this), call_handler(this);
 
-  Branch(TaggedIsSmi(handler), &if_smi_handler, &try_proto_cell_handler);
+  Branch(TaggedIsSmi(handler), &if_smi_handler, &try_proto_handler);
 
   // |handler| is a Smi, encoding what to do. See SmiHandler methods
   // for the encoding format.
   Bind(&if_smi_handler);
   {
     Variable var_double_value(this, MachineRepresentation::kFloat64);
     Label rebox_double(this, &var_double_value);
 
     Node* holder = var_holder.value();
     Node* handler_word = SmiUntag(var_smi_handler.value());
@@ skipping 99 matching lines @@
           DecodeWord<LoadHandler::DescriptorValueIndexBits>(handler_word);
 #if defined(DEBUG)
       CSA_ASSERT(UintPtrLessThan(
           descriptor, LoadAndUntagFixedArrayBaseLength(descriptors)));
 #endif
       Return(
           LoadFixedArrayElement(descriptors, descriptor, 0, INTPTR_PARAMETERS));
     }
   }
 
-  Bind(&try_proto_cell_handler);
+  Bind(&try_proto_handler);
   {
-    GotoIf(WordNotEqual(LoadMap(handler), LoadRoot(Heap::kTuple3MapRootIndex)),
+    GotoIf(WordEqual(LoadMap(handler), LoadRoot(Heap::kCodeMapRootIndex)),
            &call_handler);
-    Node* validity_cell = LoadObjectField(handler, Tuple3::kValue1Offset);
-    Node* cell_value = LoadObjectField(validity_cell, Cell::kValueOffset);
-    GotoIf(WordNotEqual(cell_value,
-                        SmiConstant(Smi::FromInt(Map::kPrototypeChainValid))),
-           miss);
-
-    Node* holder =
-        LoadWeakCellValue(LoadObjectField(handler, Tuple3::kValue2Offset));
-    // The |holder| is guaranteed to be alive at this point since we passed
-    // both the receiver map check and the validity cell check.
-    CSA_ASSERT(WordNotEqual(holder, IntPtrConstant(0)));
-
-    Node* smi_handler = LoadObjectField(handler, Tuple3::kValue3Offset);
-    CSA_ASSERT(TaggedIsSmi(smi_handler));
-
-    var_holder.Bind(holder);
-    var_smi_handler.Bind(smi_handler);
-    Goto(&if_smi_handler);
+    HandleLoadICProtoHandler(p, handler, &var_holder, &var_smi_handler,
+                             &if_smi_handler, miss);
   }
 
-  // |handler| is a heap object. Must be code, call it.
   Bind(&call_handler);
   {
     typedef LoadWithVectorDescriptor Descriptor;
     TailCallStub(Descriptor(isolate()), handler, p->context,
                  Arg(Descriptor::kReceiver, p->receiver),
                  Arg(Descriptor::kName, p->name),
                  Arg(Descriptor::kSlot, p->slot),
                  Arg(Descriptor::kVector, p->vector));
   }
 }
 
+void CodeStubAssembler::HandleLoadICProtoHandler(
+    const LoadICParameters* p, Node* handler, Variable* var_holder,
+    Variable* var_smi_handler, Label* if_smi_handler, Label* miss) {
+  DCHECK_EQ(MachineRepresentation::kTagged, var_holder->rep());
+  DCHECK_EQ(MachineRepresentation::kTagged, var_smi_handler->rep());
+
+  Node* validity_cell = LoadObjectField(handler, Tuple3::kValue1Offset);
+  Node* cell_value = LoadObjectField(validity_cell, Cell::kValueOffset);
+  GotoIf(WordNotEqual(cell_value,
+                      SmiConstant(Smi::FromInt(Map::kPrototypeChainValid))),
+         miss);
+
+  Node* holder =
+      LoadWeakCellValue(LoadObjectField(handler, Tuple3::kValue2Offset));
+  // The |holder| is guaranteed to be alive at this point since we passed
+  // both the receiver map check and the validity cell check.
+  CSA_ASSERT(WordNotEqual(holder, IntPtrConstant(0)));
+
+  Node* smi_handler = LoadObjectField(handler, Tuple3::kValue3Offset);
+  CSA_ASSERT(TaggedIsSmi(smi_handler));
+  var_holder->Bind(holder);
+  var_smi_handler->Bind(smi_handler);
+
+  GotoUnless(IsSetWord<LoadHandler::DoNegativeLookupOnReceiverBits>(
+                 SmiUntag(smi_handler)),
+             if_smi_handler);
+
+  NameDictionaryNegativeLookup(p->receiver, p->name, miss);
+  Goto(if_smi_handler);
+}
+
+void CodeStubAssembler::NameDictionaryNegativeLookup(Node* object, Node* name,
+                                                     Label* miss) {
+  CSA_ASSERT(IsDictionaryMap(LoadMap(object)));
+  Node* properties = LoadProperties(object);
+  // Ensure the property does not exist in a dictionary-mode object.
+  Variable var_name_index(this, MachineType::PointerRepresentation());
+  Label done(this);
+  NameDictionaryLookup<NameDictionary>(properties, name, miss, &var_name_index,
+                                       &done);
+  Bind(&done);
+}
+
 void CodeStubAssembler::LoadIC(const LoadICParameters* p) {
   Variable var_handler(this, MachineRepresentation::kTagged);
   // TODO(ishell): defer blocks when it works.
   Label if_handler(this, &var_handler), try_polymorphic(this),
       try_megamorphic(this /*, Label::kDeferred*/),
       miss(this /*, Label::kDeferred*/);
 
   Node* receiver_map = LoadReceiverMap(p->receiver);
 
   // Check monomorphic case.
@@ skipping 2994 matching lines @@
   Node* buffer_bit_field = LoadObjectField(
       buffer, JSArrayBuffer::kBitFieldOffset, MachineType::Uint32());
   Node* was_neutered_mask = Int32Constant(JSArrayBuffer::WasNeutered::kMask);
 
   return Word32NotEqual(Word32And(buffer_bit_field, was_neutered_mask),
                         Int32Constant(0));
 }
 
 }  // namespace internal
 }  // namespace v8