MIPS: Port '[x86] Also deal with holey arrays in the Apply builtin.'

src/builtins/mips/builtins-mips.cc

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #if V8_TARGET_ARCH_MIPS
 
 #include "src/codegen.h"
 #include "src/debug/debug.h"
 #include "src/deoptimizer.h"
 #include "src/full-codegen/full-codegen.h"
@@ skipping 2113 matching lines @@
 void Builtins::Generate_Apply(MacroAssembler* masm) {
   // ----------- S t a t e -------------
   //  -- a0    : argumentsList
   //  -- a1    : target
   //  -- a3    : new.target (checked to be constructor or undefined)
   //  -- sp[0] : thisArgument
   // -----------------------------------
 
   // Create the list of arguments from the array-like argumentsList.
   {
-    Label create_arguments, create_array, create_runtime, done_create;
+    Label create_arguments, create_array, create_holey_array, create_runtime,
+        done_create;
     __ JumpIfSmi(a0, &create_runtime);
 
     // Load the map of argumentsList into a2.
     __ lw(a2, FieldMemOperand(a0, HeapObject::kMapOffset));
 
     // Load native context into t0.
     __ lw(t0, NativeContextMemOperand());
 
     // Check if argumentsList is an (unmodified) arguments object.
     __ lw(at, ContextMemOperand(t0, Context::SLOPPY_ARGUMENTS_MAP_INDEX));
@@ skipping 22 matching lines @@
     // Try to create the list from an arguments object.
     __ bind(&create_arguments);
     __ lw(a2, FieldMemOperand(a0, JSArgumentsObject::kLengthOffset));
     __ lw(t0, FieldMemOperand(a0, JSObject::kElementsOffset));
     __ lw(at, FieldMemOperand(t0, FixedArray::kLengthOffset));
     __ Branch(&create_runtime, ne, a2, Operand(at));
     __ SmiUntag(a2);
     __ mov(a0, t0);
     __ Branch(&done_create);
 
+    // For holey JSArrays we need to check that the array prototype chain
+    // protector is intact and our prototype is the Array.prototype actually.
+    __ bind(&create_holey_array);

[Ilija.Pavlovic1, 2016/12/02 10:32:52]

Missing 
__ lw(a2, FieldMemOperand(a0, HeapObject::kMapOffset));
?

[Marija Antic, 2016/12/02 11:48:08]

Value FieldMemOperand(a0, HeapObject::kMapOffset) is loaded into a2 in line
2139. Register a2 might be modified in line 2170, but we will jump to
&done_create afterwards, and never reach this point.
I was also considering arm port https://codereview.chromium.org/2537453003/.

+    __ lw(a2, FieldMemOperand(a2, Map::kPrototypeOffset));
+    __ lw(at, ContextMemOperand(t0, Context::INITIAL_ARRAY_PROTOTYPE_INDEX));
+    __ Branch(&create_runtime, ne, a2, Operand(at));
+    __ LoadRoot(t0, Heap::kArrayProtectorRootIndex);
+    __ lw(a2, FieldMemOperand(t0, PropertyCell::kValueOffset));

[Ilija.Pavlovic1, 2016/12/02 10:32:52]

Maybe to change into 
__ LoadRoot(at, Heap::kArrayProtectorRootIndex);
__ lw(a2, FieldMemOperand(at, PropertyCell::kValueOffset));
?

[Marija Antic, 2016/12/02 11:48:08]

Done.

+    __ Branch(&create_runtime, ne, a2,
+              Operand(Smi::FromInt(Isolate::kProtectorValid)));
+    __ lw(a2, FieldMemOperand(a0, JSArray::kLengthOffset));

[Ilija.Pavlovic1, 2016/12/02 10:32:52]

Maybe to change into 
__ lw(t0, FieldMemOperand(a0, JSArray::kLengthOffset));
?

[Marija Antic, 2016/12/02 11:48:07]

Length should be in a2 after we are finished (lines 2228-2232)

+    __ lw(a0, FieldMemOperand(a0, JSArray::kElementsOffset));
+    __ SmiUntag(a2);
+    __ Branch(&done_create);
+
     // Try to create the list from a JSArray object.
     __ bind(&create_array);
     __ lw(a2, FieldMemOperand(a2, Map::kBitField2Offset));
     __ DecodeField<Map::ElementsKindBits>(a2);
     STATIC_ASSERT(FAST_SMI_ELEMENTS == 0);
     STATIC_ASSERT(FAST_HOLEY_SMI_ELEMENTS == 1);
     STATIC_ASSERT(FAST_ELEMENTS == 2);
+    STATIC_ASSERT(FAST_HOLEY_ELEMENTS == 3);
+    __ Branch(&create_holey_array, eq, a2, Operand(FAST_HOLEY_SMI_ELEMENTS));
+    __ Branch(&create_holey_array, eq, a2, Operand(FAST_HOLEY_ELEMENTS));
     __ Branch(&create_runtime, hi, a2, Operand(FAST_ELEMENTS));
-    __ Branch(&create_runtime, eq, a2, Operand(FAST_HOLEY_SMI_ELEMENTS));
     __ lw(a2, FieldMemOperand(a0, JSArray::kLengthOffset));
     __ lw(a0, FieldMemOperand(a0, JSArray::kElementsOffset));
     __ SmiUntag(a2);
 
     __ bind(&done_create);
   }
 
   // Check for stack overflow.
   {
     // Check the stack for overflow. We are not trying to catch interruptions
@@ skipping 14 matching lines @@
   //  -- a1    : target
   //  -- a0    : args (a FixedArray built from argumentsList)
   //  -- a2    : len (number of elements to push from args)
   //  -- a3    : new.target (checked to be constructor or undefined)
   //  -- sp[0] : thisArgument
   // -----------------------------------
 
   // Push arguments onto the stack (thisArgument is already on the stack).
   {
     __ mov(t0, zero_reg);
-    Label done, loop;
+    Label done, push, loop;
+    __ LoadRoot(t1, Heap::kTheHoleValueRootIndex);
     __ bind(&loop);
     __ Branch(&done, eq, t0, Operand(a2));
     __ Lsa(at, a0, t0, kPointerSizeLog2);
     __ lw(at, FieldMemOperand(at, FixedArray::kHeaderSize));
+    __ Branch(&push, ne, t1, Operand(at));
+    __ LoadRoot(at, Heap::kUndefinedValueRootIndex);
+    __ bind(&push);
     __ Push(at);
     __ Addu(t0, t0, Operand(1));
     __ Branch(&loop);
     __ bind(&done);
     __ Move(a0, t0);
   }
 
   // Dispatch to Call or Construct depending on whether new.target is undefined.
   {
     Label construct;
@@ skipping 709 matching lines @@
     __ break_(0xCC);
   }
 }
 
 #undef __
 
 }  // namespace internal
 }  // namespace v8
 
 #endif  // V8_TARGET_ARCH_MIPS