| Index: src/ic/x87/ic-x87.cc
|
| diff --git a/src/ic/x87/ic-x87.cc b/src/ic/x87/ic-x87.cc
|
| index f96e509f53af9106ca28ed3c670c12c2d90f276c..269291992f992ff8410e89efdadfa861367f132a 100644
|
| --- a/src/ic/x87/ic-x87.cc
|
| +++ b/src/ic/x87/ic-x87.cc
|
| @@ -120,251 +120,6 @@ static void GenerateDictionaryStore(MacroAssembler* masm, Label* miss_label,
|
| __ RecordWrite(elements, r0, r1, kDontSaveFPRegs);
|
| }
|
|
|
| -static void KeyedStoreGenerateMegamorphicHelper(
|
| - MacroAssembler* masm, Label* fast_object, Label* fast_double, Label* slow,
|
| - KeyedStoreCheckMap check_map, KeyedStoreIncrementLength increment_length) {
|
| - Label transition_smi_elements;
|
| - Label finish_object_store, non_double_value, transition_double_elements;
|
| - Label fast_double_without_map_check;
|
| - Register receiver = StoreDescriptor::ReceiverRegister();
|
| - Register key = StoreDescriptor::NameRegister();
|
| - Register value = StoreDescriptor::ValueRegister();
|
| - DCHECK(receiver.is(edx));
|
| - DCHECK(key.is(ecx));
|
| - DCHECK(value.is(eax));
|
| - // key is a smi.
|
| - // ebx: FixedArray receiver->elements
|
| - // edi: receiver map
|
| - // Fast case: Do the store, could either Object or double.
|
| - __ bind(fast_object);
|
| - if (check_map == kCheckMap) {
|
| - __ mov(edi, FieldOperand(ebx, HeapObject::kMapOffset));
|
| - __ cmp(edi, masm->isolate()->factory()->fixed_array_map());
|
| - __ j(not_equal, fast_double);
|
| - }
|
| -
|
| - // HOLECHECK: guards "A[i] = V"
|
| - // We have to go to the runtime if the current value is the hole because
|
| - // there may be a callback on the element
|
| - Label holecheck_passed1;
|
| - __ cmp(FixedArrayElementOperand(ebx, key),
|
| - masm->isolate()->factory()->the_hole_value());
|
| - __ j(not_equal, &holecheck_passed1);
|
| - __ JumpIfDictionaryInPrototypeChain(receiver, ebx, edi, slow);
|
| - __ mov(ebx, FieldOperand(receiver, JSObject::kElementsOffset));
|
| -
|
| - __ bind(&holecheck_passed1);
|
| -
|
| - // Smi stores don't require further checks.
|
| - Label non_smi_value;
|
| - __ JumpIfNotSmi(value, &non_smi_value);
|
| - if (increment_length == kIncrementLength) {
|
| - // Add 1 to receiver->length.
|
| - __ add(FieldOperand(receiver, JSArray::kLengthOffset),
|
| - Immediate(Smi::FromInt(1)));
|
| - }
|
| - // It's irrelevant whether array is smi-only or not when writing a smi.
|
| - __ mov(FixedArrayElementOperand(ebx, key), value);
|
| - __ ret(StoreWithVectorDescriptor::kStackArgumentsCount * kPointerSize);
|
| -
|
| - __ bind(&non_smi_value);
|
| - // Escape to elements kind transition case.
|
| - __ mov(edi, FieldOperand(receiver, HeapObject::kMapOffset));
|
| - __ CheckFastObjectElements(edi, &transition_smi_elements);
|
| -
|
| - // Fast elements array, store the value to the elements backing store.
|
| - __ bind(&finish_object_store);
|
| - if (increment_length == kIncrementLength) {
|
| - // Add 1 to receiver->length.
|
| - __ add(FieldOperand(receiver, JSArray::kLengthOffset),
|
| - Immediate(Smi::FromInt(1)));
|
| - }
|
| - __ mov(FixedArrayElementOperand(ebx, key), value);
|
| - // Update write barrier for the elements array address.
|
| - __ mov(edx, value); // Preserve the value which is returned.
|
| - __ RecordWriteArray(ebx, edx, key, kDontSaveFPRegs, EMIT_REMEMBERED_SET,
|
| - OMIT_SMI_CHECK);
|
| - __ ret(StoreWithVectorDescriptor::kStackArgumentsCount * kPointerSize);
|
| -
|
| - __ bind(fast_double);
|
| - if (check_map == kCheckMap) {
|
| - // Check for fast double array case. If this fails, call through to the
|
| - // runtime.
|
| - __ cmp(edi, masm->isolate()->factory()->fixed_double_array_map());
|
| - __ j(not_equal, slow);
|
| - // If the value is a number, store it as a double in the FastDoubleElements
|
| - // array.
|
| - }
|
| -
|
| - // HOLECHECK: guards "A[i] double hole?"
|
| - // We have to see if the double version of the hole is present. If so
|
| - // go to the runtime.
|
| - uint32_t offset = FixedDoubleArray::kHeaderSize + sizeof(kHoleNanLower32);
|
| - __ cmp(FieldOperand(ebx, key, times_4, offset), Immediate(kHoleNanUpper32));
|
| - __ j(not_equal, &fast_double_without_map_check);
|
| - __ JumpIfDictionaryInPrototypeChain(receiver, ebx, edi, slow);
|
| - __ mov(ebx, FieldOperand(receiver, JSObject::kElementsOffset));
|
| -
|
| - __ bind(&fast_double_without_map_check);
|
| - __ StoreNumberToDoubleElements(value, ebx, key, edi,
|
| - &transition_double_elements, false);
|
| - if (increment_length == kIncrementLength) {
|
| - // Add 1 to receiver->length.
|
| - __ add(FieldOperand(receiver, JSArray::kLengthOffset),
|
| - Immediate(Smi::FromInt(1)));
|
| - }
|
| - __ ret(StoreWithVectorDescriptor::kStackArgumentsCount * kPointerSize);
|
| -
|
| - __ bind(&transition_smi_elements);
|
| - __ mov(ebx, FieldOperand(receiver, HeapObject::kMapOffset));
|
| -
|
| - // Transition the array appropriately depending on the value type.
|
| - __ CheckMap(value, masm->isolate()->factory()->heap_number_map(),
|
| - &non_double_value, DONT_DO_SMI_CHECK);
|
| -
|
| - // Value is a double. Transition FAST_SMI_ELEMENTS -> FAST_DOUBLE_ELEMENTS
|
| - // and complete the store.
|
| - __ LoadTransitionedArrayMapConditional(FAST_SMI_ELEMENTS,
|
| - FAST_DOUBLE_ELEMENTS, ebx, edi, slow);
|
| - AllocationSiteMode mode =
|
| - AllocationSite::GetMode(FAST_SMI_ELEMENTS, FAST_DOUBLE_ELEMENTS);
|
| - ElementsTransitionGenerator::GenerateSmiToDouble(masm, receiver, key, value,
|
| - ebx, mode, slow);
|
| - __ mov(ebx, FieldOperand(receiver, JSObject::kElementsOffset));
|
| - __ jmp(&fast_double_without_map_check);
|
| -
|
| - __ bind(&non_double_value);
|
| - // Value is not a double, FAST_SMI_ELEMENTS -> FAST_ELEMENTS
|
| - __ LoadTransitionedArrayMapConditional(FAST_SMI_ELEMENTS, FAST_ELEMENTS, ebx,
|
| - edi, slow);
|
| - mode = AllocationSite::GetMode(FAST_SMI_ELEMENTS, FAST_ELEMENTS);
|
| - ElementsTransitionGenerator::GenerateMapChangeElementsTransition(
|
| - masm, receiver, key, value, ebx, mode, slow);
|
| - __ mov(ebx, FieldOperand(receiver, JSObject::kElementsOffset));
|
| - __ jmp(&finish_object_store);
|
| -
|
| - __ bind(&transition_double_elements);
|
| - // Elements are FAST_DOUBLE_ELEMENTS, but value is an Object that's not a
|
| - // HeapNumber. Make sure that the receiver is a Array with FAST_ELEMENTS and
|
| - // transition array from FAST_DOUBLE_ELEMENTS to FAST_ELEMENTS
|
| - __ mov(ebx, FieldOperand(receiver, HeapObject::kMapOffset));
|
| - __ LoadTransitionedArrayMapConditional(FAST_DOUBLE_ELEMENTS, FAST_ELEMENTS,
|
| - ebx, edi, slow);
|
| - mode = AllocationSite::GetMode(FAST_DOUBLE_ELEMENTS, FAST_ELEMENTS);
|
| - ElementsTransitionGenerator::GenerateDoubleToObject(masm, receiver, key,
|
| - value, ebx, mode, slow);
|
| - __ mov(ebx, FieldOperand(receiver, JSObject::kElementsOffset));
|
| - __ jmp(&finish_object_store);
|
| -}
|
| -
|
| -
|
| -void KeyedStoreIC::GenerateMegamorphic(MacroAssembler* masm,
|
| - LanguageMode language_mode) {
|
| - typedef StoreWithVectorDescriptor Descriptor;
|
| - // Return address is on the stack.
|
| - Label slow, fast_object, fast_object_grow;
|
| - Label fast_double, fast_double_grow;
|
| - Label array, extra, check_if_double_array, maybe_name_key, miss;
|
| - Register receiver = Descriptor::ReceiverRegister();
|
| - Register key = Descriptor::NameRegister();
|
| - DCHECK(receiver.is(edx));
|
| - DCHECK(key.is(ecx));
|
| -
|
| - // Check that the object isn't a smi.
|
| - __ JumpIfSmi(receiver, &slow);
|
| - // Get the map from the receiver.
|
| - __ mov(edi, FieldOperand(receiver, HeapObject::kMapOffset));
|
| - // Check that the receiver does not require access checks.
|
| - // The generic stub does not perform map checks.
|
| - __ test_b(FieldOperand(edi, Map::kBitFieldOffset),
|
| - Immediate(1 << Map::kIsAccessCheckNeeded));
|
| - __ j(not_zero, &slow);
|
| -
|
| - __ LoadParameterFromStack<Descriptor>(Descriptor::ValueRegister(),
|
| - Descriptor::kValue);
|
| -
|
| - // Check that the key is a smi.
|
| - __ JumpIfNotSmi(key, &maybe_name_key);
|
| - __ CmpInstanceType(edi, JS_ARRAY_TYPE);
|
| - __ j(equal, &array);
|
| - // Check that the object is some kind of JS object EXCEPT JS Value type. In
|
| - // the case that the object is a value-wrapper object, we enter the runtime
|
| - // system to make sure that indexing into string objects works as intended.
|
| - STATIC_ASSERT(JS_VALUE_TYPE < JS_OBJECT_TYPE);
|
| - __ CmpInstanceType(edi, JS_OBJECT_TYPE);
|
| - __ j(below, &slow);
|
| -
|
| - // Object case: Check key against length in the elements array.
|
| - // Key is a smi.
|
| - // edi: receiver map
|
| - __ mov(ebx, FieldOperand(receiver, JSObject::kElementsOffset));
|
| - // Check array bounds. Both the key and the length of FixedArray are smis.
|
| - __ cmp(key, FieldOperand(ebx, FixedArray::kLengthOffset));
|
| - __ j(below, &fast_object);
|
| -
|
| - // Slow case: call runtime.
|
| - __ bind(&slow);
|
| - PropertyICCompiler::GenerateRuntimeSetProperty(masm, language_mode);
|
| - // Never returns to here.
|
| -
|
| - __ bind(&maybe_name_key);
|
| - __ mov(ebx, FieldOperand(key, HeapObject::kMapOffset));
|
| - __ movzx_b(ebx, FieldOperand(ebx, Map::kInstanceTypeOffset));
|
| - __ JumpIfNotUniqueNameInstanceType(ebx, &slow);
|
| -
|
| - masm->isolate()->store_stub_cache()->GenerateProbe(masm, receiver, key, edi,
|
| - no_reg);
|
| -
|
| - // Cache miss.
|
| - __ jmp(&miss);
|
| -
|
| - // Extra capacity case: Check if there is extra capacity to
|
| - // perform the store and update the length. Used for adding one
|
| - // element to the array by writing to array[array.length].
|
| - __ bind(&extra);
|
| - // receiver is a JSArray.
|
| - // key is a smi.
|
| - // ebx: receiver->elements, a FixedArray
|
| - // edi: receiver map
|
| - // flags: compare (key, receiver.length())
|
| - // do not leave holes in the array:
|
| - __ j(not_equal, &slow);
|
| - __ cmp(key, FieldOperand(ebx, FixedArray::kLengthOffset));
|
| - __ j(above_equal, &slow);
|
| - __ mov(edi, FieldOperand(ebx, HeapObject::kMapOffset));
|
| - __ cmp(edi, masm->isolate()->factory()->fixed_array_map());
|
| - __ j(not_equal, &check_if_double_array);
|
| - __ jmp(&fast_object_grow);
|
| -
|
| - __ bind(&check_if_double_array);
|
| - __ cmp(edi, masm->isolate()->factory()->fixed_double_array_map());
|
| - __ j(not_equal, &slow);
|
| - __ jmp(&fast_double_grow);
|
| -
|
| - // Array case: Get the length and the elements array from the JS
|
| - // array. Check that the array is in fast mode (and writable); if it
|
| - // is the length is always a smi.
|
| - __ bind(&array);
|
| - // receiver is a JSArray.
|
| - // key is a smi.
|
| - // edi: receiver map
|
| - __ mov(ebx, FieldOperand(receiver, JSObject::kElementsOffset));
|
| -
|
| - // Check the key against the length in the array and fall through to the
|
| - // common store code.
|
| - __ cmp(key, FieldOperand(receiver, JSArray::kLengthOffset)); // Compare smis.
|
| - __ j(above_equal, &extra);
|
| -
|
| - KeyedStoreGenerateMegamorphicHelper(masm, &fast_object, &fast_double, &slow,
|
| - kCheckMap, kDontIncrementLength);
|
| - KeyedStoreGenerateMegamorphicHelper(masm, &fast_object_grow,
|
| - &fast_double_grow, &slow, kDontCheckMap,
|
| - kIncrementLength);
|
| -
|
| - __ bind(&miss);
|
| - GenerateMiss(masm);
|
| -}
|
| -
|
| void LoadIC::GenerateNormal(MacroAssembler* masm) {
|
| Register dictionary = eax;
|
| DCHECK(!dictionary.is(LoadDescriptor::ReceiverRegister()));
|
|
|