| OLD | NEW |
| 1 // Copyright 2012 the V8 project authors. All rights reserved. | 1 // Copyright 2012 the V8 project authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #if V8_TARGET_ARCH_X87 | 5 #if V8_TARGET_ARCH_X87 |
| 6 | 6 |
| 7 #include "src/codegen.h" | 7 #include "src/codegen.h" |
| 8 #include "src/ic/ic.h" | 8 #include "src/ic/ic.h" |
| 9 #include "src/ic/ic-compiler.h" | 9 #include "src/ic/ic-compiler.h" |
| 10 #include "src/ic/stub-cache.h" | 10 #include "src/ic/stub-cache.h" |
| (...skipping 102 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 113 // Store the value at the masked, scaled index. | 113 // Store the value at the masked, scaled index. |
| 114 const int kValueOffset = kElementsStartOffset + kPointerSize; | 114 const int kValueOffset = kElementsStartOffset + kPointerSize; |
| 115 __ lea(r0, Operand(elements, r0, times_4, kValueOffset - kHeapObjectTag)); | 115 __ lea(r0, Operand(elements, r0, times_4, kValueOffset - kHeapObjectTag)); |
| 116 __ mov(Operand(r0, 0), value); | 116 __ mov(Operand(r0, 0), value); |
| 117 | 117 |
| 118 // Update write barrier. Make sure not to clobber the value. | 118 // Update write barrier. Make sure not to clobber the value. |
| 119 __ mov(r1, value); | 119 __ mov(r1, value); |
| 120 __ RecordWrite(elements, r0, r1, kDontSaveFPRegs); | 120 __ RecordWrite(elements, r0, r1, kDontSaveFPRegs); |
| 121 } | 121 } |
| 122 | 122 |
| 123 static void KeyedStoreGenerateMegamorphicHelper( | |
| 124 MacroAssembler* masm, Label* fast_object, Label* fast_double, Label* slow, | |
| 125 KeyedStoreCheckMap check_map, KeyedStoreIncrementLength increment_length) { | |
| 126 Label transition_smi_elements; | |
| 127 Label finish_object_store, non_double_value, transition_double_elements; | |
| 128 Label fast_double_without_map_check; | |
| 129 Register receiver = StoreDescriptor::ReceiverRegister(); | |
| 130 Register key = StoreDescriptor::NameRegister(); | |
| 131 Register value = StoreDescriptor::ValueRegister(); | |
| 132 DCHECK(receiver.is(edx)); | |
| 133 DCHECK(key.is(ecx)); | |
| 134 DCHECK(value.is(eax)); | |
| 135 // key is a smi. | |
| 136 // ebx: FixedArray receiver->elements | |
| 137 // edi: receiver map | |
| 138 // Fast case: Do the store, could either Object or double. | |
| 139 __ bind(fast_object); | |
| 140 if (check_map == kCheckMap) { | |
| 141 __ mov(edi, FieldOperand(ebx, HeapObject::kMapOffset)); | |
| 142 __ cmp(edi, masm->isolate()->factory()->fixed_array_map()); | |
| 143 __ j(not_equal, fast_double); | |
| 144 } | |
| 145 | |
| 146 // HOLECHECK: guards "A[i] = V" | |
| 147 // We have to go to the runtime if the current value is the hole because | |
| 148 // there may be a callback on the element | |
| 149 Label holecheck_passed1; | |
| 150 __ cmp(FixedArrayElementOperand(ebx, key), | |
| 151 masm->isolate()->factory()->the_hole_value()); | |
| 152 __ j(not_equal, &holecheck_passed1); | |
| 153 __ JumpIfDictionaryInPrototypeChain(receiver, ebx, edi, slow); | |
| 154 __ mov(ebx, FieldOperand(receiver, JSObject::kElementsOffset)); | |
| 155 | |
| 156 __ bind(&holecheck_passed1); | |
| 157 | |
| 158 // Smi stores don't require further checks. | |
| 159 Label non_smi_value; | |
| 160 __ JumpIfNotSmi(value, &non_smi_value); | |
| 161 if (increment_length == kIncrementLength) { | |
| 162 // Add 1 to receiver->length. | |
| 163 __ add(FieldOperand(receiver, JSArray::kLengthOffset), | |
| 164 Immediate(Smi::FromInt(1))); | |
| 165 } | |
| 166 // It's irrelevant whether array is smi-only or not when writing a smi. | |
| 167 __ mov(FixedArrayElementOperand(ebx, key), value); | |
| 168 __ ret(StoreWithVectorDescriptor::kStackArgumentsCount * kPointerSize); | |
| 169 | |
| 170 __ bind(&non_smi_value); | |
| 171 // Escape to elements kind transition case. | |
| 172 __ mov(edi, FieldOperand(receiver, HeapObject::kMapOffset)); | |
| 173 __ CheckFastObjectElements(edi, &transition_smi_elements); | |
| 174 | |
| 175 // Fast elements array, store the value to the elements backing store. | |
| 176 __ bind(&finish_object_store); | |
| 177 if (increment_length == kIncrementLength) { | |
| 178 // Add 1 to receiver->length. | |
| 179 __ add(FieldOperand(receiver, JSArray::kLengthOffset), | |
| 180 Immediate(Smi::FromInt(1))); | |
| 181 } | |
| 182 __ mov(FixedArrayElementOperand(ebx, key), value); | |
| 183 // Update write barrier for the elements array address. | |
| 184 __ mov(edx, value); // Preserve the value which is returned. | |
| 185 __ RecordWriteArray(ebx, edx, key, kDontSaveFPRegs, EMIT_REMEMBERED_SET, | |
| 186 OMIT_SMI_CHECK); | |
| 187 __ ret(StoreWithVectorDescriptor::kStackArgumentsCount * kPointerSize); | |
| 188 | |
| 189 __ bind(fast_double); | |
| 190 if (check_map == kCheckMap) { | |
| 191 // Check for fast double array case. If this fails, call through to the | |
| 192 // runtime. | |
| 193 __ cmp(edi, masm->isolate()->factory()->fixed_double_array_map()); | |
| 194 __ j(not_equal, slow); | |
| 195 // If the value is a number, store it as a double in the FastDoubleElements | |
| 196 // array. | |
| 197 } | |
| 198 | |
| 199 // HOLECHECK: guards "A[i] double hole?" | |
| 200 // We have to see if the double version of the hole is present. If so | |
| 201 // go to the runtime. | |
| 202 uint32_t offset = FixedDoubleArray::kHeaderSize + sizeof(kHoleNanLower32); | |
| 203 __ cmp(FieldOperand(ebx, key, times_4, offset), Immediate(kHoleNanUpper32)); | |
| 204 __ j(not_equal, &fast_double_without_map_check); | |
| 205 __ JumpIfDictionaryInPrototypeChain(receiver, ebx, edi, slow); | |
| 206 __ mov(ebx, FieldOperand(receiver, JSObject::kElementsOffset)); | |
| 207 | |
| 208 __ bind(&fast_double_without_map_check); | |
| 209 __ StoreNumberToDoubleElements(value, ebx, key, edi, | |
| 210 &transition_double_elements, false); | |
| 211 if (increment_length == kIncrementLength) { | |
| 212 // Add 1 to receiver->length. | |
| 213 __ add(FieldOperand(receiver, JSArray::kLengthOffset), | |
| 214 Immediate(Smi::FromInt(1))); | |
| 215 } | |
| 216 __ ret(StoreWithVectorDescriptor::kStackArgumentsCount * kPointerSize); | |
| 217 | |
| 218 __ bind(&transition_smi_elements); | |
| 219 __ mov(ebx, FieldOperand(receiver, HeapObject::kMapOffset)); | |
| 220 | |
| 221 // Transition the array appropriately depending on the value type. | |
| 222 __ CheckMap(value, masm->isolate()->factory()->heap_number_map(), | |
| 223 &non_double_value, DONT_DO_SMI_CHECK); | |
| 224 | |
| 225 // Value is a double. Transition FAST_SMI_ELEMENTS -> FAST_DOUBLE_ELEMENTS | |
| 226 // and complete the store. | |
| 227 __ LoadTransitionedArrayMapConditional(FAST_SMI_ELEMENTS, | |
| 228 FAST_DOUBLE_ELEMENTS, ebx, edi, slow); | |
| 229 AllocationSiteMode mode = | |
| 230 AllocationSite::GetMode(FAST_SMI_ELEMENTS, FAST_DOUBLE_ELEMENTS); | |
| 231 ElementsTransitionGenerator::GenerateSmiToDouble(masm, receiver, key, value, | |
| 232 ebx, mode, slow); | |
| 233 __ mov(ebx, FieldOperand(receiver, JSObject::kElementsOffset)); | |
| 234 __ jmp(&fast_double_without_map_check); | |
| 235 | |
| 236 __ bind(&non_double_value); | |
| 237 // Value is not a double, FAST_SMI_ELEMENTS -> FAST_ELEMENTS | |
| 238 __ LoadTransitionedArrayMapConditional(FAST_SMI_ELEMENTS, FAST_ELEMENTS, ebx, | |
| 239 edi, slow); | |
| 240 mode = AllocationSite::GetMode(FAST_SMI_ELEMENTS, FAST_ELEMENTS); | |
| 241 ElementsTransitionGenerator::GenerateMapChangeElementsTransition( | |
| 242 masm, receiver, key, value, ebx, mode, slow); | |
| 243 __ mov(ebx, FieldOperand(receiver, JSObject::kElementsOffset)); | |
| 244 __ jmp(&finish_object_store); | |
| 245 | |
| 246 __ bind(&transition_double_elements); | |
| 247 // Elements are FAST_DOUBLE_ELEMENTS, but value is an Object that's not a | |
| 248 // HeapNumber. Make sure that the receiver is a Array with FAST_ELEMENTS and | |
| 249 // transition array from FAST_DOUBLE_ELEMENTS to FAST_ELEMENTS | |
| 250 __ mov(ebx, FieldOperand(receiver, HeapObject::kMapOffset)); | |
| 251 __ LoadTransitionedArrayMapConditional(FAST_DOUBLE_ELEMENTS, FAST_ELEMENTS, | |
| 252 ebx, edi, slow); | |
| 253 mode = AllocationSite::GetMode(FAST_DOUBLE_ELEMENTS, FAST_ELEMENTS); | |
| 254 ElementsTransitionGenerator::GenerateDoubleToObject(masm, receiver, key, | |
| 255 value, ebx, mode, slow); | |
| 256 __ mov(ebx, FieldOperand(receiver, JSObject::kElementsOffset)); | |
| 257 __ jmp(&finish_object_store); | |
| 258 } | |
| 259 | |
| 260 | |
| 261 void KeyedStoreIC::GenerateMegamorphic(MacroAssembler* masm, | |
| 262 LanguageMode language_mode) { | |
| 263 typedef StoreWithVectorDescriptor Descriptor; | |
| 264 // Return address is on the stack. | |
| 265 Label slow, fast_object, fast_object_grow; | |
| 266 Label fast_double, fast_double_grow; | |
| 267 Label array, extra, check_if_double_array, maybe_name_key, miss; | |
| 268 Register receiver = Descriptor::ReceiverRegister(); | |
| 269 Register key = Descriptor::NameRegister(); | |
| 270 DCHECK(receiver.is(edx)); | |
| 271 DCHECK(key.is(ecx)); | |
| 272 | |
| 273 // Check that the object isn't a smi. | |
| 274 __ JumpIfSmi(receiver, &slow); | |
| 275 // Get the map from the receiver. | |
| 276 __ mov(edi, FieldOperand(receiver, HeapObject::kMapOffset)); | |
| 277 // Check that the receiver does not require access checks. | |
| 278 // The generic stub does not perform map checks. | |
| 279 __ test_b(FieldOperand(edi, Map::kBitFieldOffset), | |
| 280 Immediate(1 << Map::kIsAccessCheckNeeded)); | |
| 281 __ j(not_zero, &slow); | |
| 282 | |
| 283 __ LoadParameterFromStack<Descriptor>(Descriptor::ValueRegister(), | |
| 284 Descriptor::kValue); | |
| 285 | |
| 286 // Check that the key is a smi. | |
| 287 __ JumpIfNotSmi(key, &maybe_name_key); | |
| 288 __ CmpInstanceType(edi, JS_ARRAY_TYPE); | |
| 289 __ j(equal, &array); | |
| 290 // Check that the object is some kind of JS object EXCEPT JS Value type. In | |
| 291 // the case that the object is a value-wrapper object, we enter the runtime | |
| 292 // system to make sure that indexing into string objects works as intended. | |
| 293 STATIC_ASSERT(JS_VALUE_TYPE < JS_OBJECT_TYPE); | |
| 294 __ CmpInstanceType(edi, JS_OBJECT_TYPE); | |
| 295 __ j(below, &slow); | |
| 296 | |
| 297 // Object case: Check key against length in the elements array. | |
| 298 // Key is a smi. | |
| 299 // edi: receiver map | |
| 300 __ mov(ebx, FieldOperand(receiver, JSObject::kElementsOffset)); | |
| 301 // Check array bounds. Both the key and the length of FixedArray are smis. | |
| 302 __ cmp(key, FieldOperand(ebx, FixedArray::kLengthOffset)); | |
| 303 __ j(below, &fast_object); | |
| 304 | |
| 305 // Slow case: call runtime. | |
| 306 __ bind(&slow); | |
| 307 PropertyICCompiler::GenerateRuntimeSetProperty(masm, language_mode); | |
| 308 // Never returns to here. | |
| 309 | |
| 310 __ bind(&maybe_name_key); | |
| 311 __ mov(ebx, FieldOperand(key, HeapObject::kMapOffset)); | |
| 312 __ movzx_b(ebx, FieldOperand(ebx, Map::kInstanceTypeOffset)); | |
| 313 __ JumpIfNotUniqueNameInstanceType(ebx, &slow); | |
| 314 | |
| 315 masm->isolate()->store_stub_cache()->GenerateProbe(masm, receiver, key, edi, | |
| 316 no_reg); | |
| 317 | |
| 318 // Cache miss. | |
| 319 __ jmp(&miss); | |
| 320 | |
| 321 // Extra capacity case: Check if there is extra capacity to | |
| 322 // perform the store and update the length. Used for adding one | |
| 323 // element to the array by writing to array[array.length]. | |
| 324 __ bind(&extra); | |
| 325 // receiver is a JSArray. | |
| 326 // key is a smi. | |
| 327 // ebx: receiver->elements, a FixedArray | |
| 328 // edi: receiver map | |
| 329 // flags: compare (key, receiver.length()) | |
| 330 // do not leave holes in the array: | |
| 331 __ j(not_equal, &slow); | |
| 332 __ cmp(key, FieldOperand(ebx, FixedArray::kLengthOffset)); | |
| 333 __ j(above_equal, &slow); | |
| 334 __ mov(edi, FieldOperand(ebx, HeapObject::kMapOffset)); | |
| 335 __ cmp(edi, masm->isolate()->factory()->fixed_array_map()); | |
| 336 __ j(not_equal, &check_if_double_array); | |
| 337 __ jmp(&fast_object_grow); | |
| 338 | |
| 339 __ bind(&check_if_double_array); | |
| 340 __ cmp(edi, masm->isolate()->factory()->fixed_double_array_map()); | |
| 341 __ j(not_equal, &slow); | |
| 342 __ jmp(&fast_double_grow); | |
| 343 | |
| 344 // Array case: Get the length and the elements array from the JS | |
| 345 // array. Check that the array is in fast mode (and writable); if it | |
| 346 // is the length is always a smi. | |
| 347 __ bind(&array); | |
| 348 // receiver is a JSArray. | |
| 349 // key is a smi. | |
| 350 // edi: receiver map | |
| 351 __ mov(ebx, FieldOperand(receiver, JSObject::kElementsOffset)); | |
| 352 | |
| 353 // Check the key against the length in the array and fall through to the | |
| 354 // common store code. | |
| 355 __ cmp(key, FieldOperand(receiver, JSArray::kLengthOffset)); // Compare smis. | |
| 356 __ j(above_equal, &extra); | |
| 357 | |
| 358 KeyedStoreGenerateMegamorphicHelper(masm, &fast_object, &fast_double, &slow, | |
| 359 kCheckMap, kDontIncrementLength); | |
| 360 KeyedStoreGenerateMegamorphicHelper(masm, &fast_object_grow, | |
| 361 &fast_double_grow, &slow, kDontCheckMap, | |
| 362 kIncrementLength); | |
| 363 | |
| 364 __ bind(&miss); | |
| 365 GenerateMiss(masm); | |
| 366 } | |
| 367 | |
| 368 void LoadIC::GenerateNormal(MacroAssembler* masm) { | 123 void LoadIC::GenerateNormal(MacroAssembler* masm) { |
| 369 Register dictionary = eax; | 124 Register dictionary = eax; |
| 370 DCHECK(!dictionary.is(LoadDescriptor::ReceiverRegister())); | 125 DCHECK(!dictionary.is(LoadDescriptor::ReceiverRegister())); |
| 371 DCHECK(!dictionary.is(LoadDescriptor::NameRegister())); | 126 DCHECK(!dictionary.is(LoadDescriptor::NameRegister())); |
| 372 | 127 |
| 373 Label slow; | 128 Label slow; |
| 374 | 129 |
| 375 __ mov(dictionary, FieldOperand(LoadDescriptor::ReceiverRegister(), | 130 __ mov(dictionary, FieldOperand(LoadDescriptor::ReceiverRegister(), |
| 376 JSObject::kPropertiesOffset)); | 131 JSObject::kPropertiesOffset)); |
| 377 GenerateDictionaryLoad(masm, &slow, dictionary, | 132 GenerateDictionaryLoad(masm, &slow, dictionary, |
| (...skipping 221 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 599 Condition cc = | 354 Condition cc = |
| 600 (check == ENABLE_INLINED_SMI_CHECK) | 355 (check == ENABLE_INLINED_SMI_CHECK) |
| 601 ? (*jmp_address == Assembler::kJncShortOpcode ? not_zero : zero) | 356 ? (*jmp_address == Assembler::kJncShortOpcode ? not_zero : zero) |
| 602 : (*jmp_address == Assembler::kJnzShortOpcode ? not_carry : carry); | 357 : (*jmp_address == Assembler::kJnzShortOpcode ? not_carry : carry); |
| 603 *jmp_address = static_cast<byte>(Assembler::kJccShortPrefix | cc); | 358 *jmp_address = static_cast<byte>(Assembler::kJccShortPrefix | cc); |
| 604 } | 359 } |
| 605 } // namespace internal | 360 } // namespace internal |
| 606 } // namespace v8 | 361 } // namespace v8 |
| 607 | 362 |
| 608 #endif // V8_TARGET_ARCH_X87 | 363 #endif // V8_TARGET_ARCH_X87 |
| OLD | NEW |