| Index: src/ic/accessor-assembler.cc
|
| diff --git a/src/ic/accessor-assembler.cc b/src/ic/accessor-assembler.cc
|
| index 6a27045f1228311a235692e01b87386898a36c09..1c8e7154ed363bec200ae98fbdaa70da0d32b2c7 100644
|
| --- a/src/ic/accessor-assembler.cc
|
| +++ b/src/ic/accessor-assembler.cc
|
| @@ -743,6 +743,96 @@ void AccessorAssemblerImpl::HandleStoreFieldAndReturn(
|
| }
|
| }
|
|
|
| +Node* AccessorAssemblerImpl::PrepareValueForWrite(Node* value,
|
| + Representation representation,
|
| + Label* bailout) {
|
| + if (representation.IsDouble()) {
|
| + value = TryTaggedToFloat64(value, bailout);
|
| + } else if (representation.IsHeapObject()) {
|
| + // Field type is checked by the handler, here we only check if the value
|
| + // is a heap object.
|
| + GotoIf(TaggedIsSmi(value), bailout);
|
| + } else if (representation.IsSmi()) {
|
| + GotoUnless(TaggedIsSmi(value), bailout);
|
| + } else {
|
| + DCHECK(representation.IsTagged());
|
| + }
|
| + return value;
|
| +}
|
| +
|
| +void AccessorAssemblerImpl::ExtendPropertiesBackingStore(Node* object) {
|
| + Node* properties = LoadProperties(object);
|
| + Node* length = LoadFixedArrayBaseLength(properties);
|
| +
|
| + ParameterMode mode = OptimalParameterMode();
|
| + length = TaggedToParameter(length, mode);
|
| +
|
| + Node* delta = IntPtrOrSmiConstant(JSObject::kFieldsAdded, mode);
|
| + Node* new_capacity = IntPtrOrSmiAdd(length, delta, mode);
|
| +
|
| + // Grow properties array.
|
| + ElementsKind kind = FAST_ELEMENTS;
|
| + DCHECK(kMaxNumberOfDescriptors + JSObject::kFieldsAdded <
|
| + FixedArrayBase::GetMaxLengthForNewSpaceAllocation(kind));
|
| + // The size of a new properties backing store is guaranteed to be small
|
| + // enough that the new backing store will be allocated in new space.
|
| + CSA_ASSERT(this,
|
| + UintPtrOrSmiLessThan(
|
| + new_capacity,
|
| + IntPtrOrSmiConstant(
|
| + kMaxNumberOfDescriptors + JSObject::kFieldsAdded, mode),
|
| + mode));
|
| +
|
| + Node* new_properties = AllocateFixedArray(kind, new_capacity, mode);
|
| +
|
| + FillFixedArrayWithValue(kind, new_properties, length, new_capacity,
|
| + Heap::kUndefinedValueRootIndex, mode);
|
| +
|
| + // |new_properties| is guaranteed to be in new space, so we can skip
|
| + // the write barrier.
|
| + CopyFixedArrayElements(kind, properties, new_properties, length,
|
| + SKIP_WRITE_BARRIER, mode);
|
| +
|
| + StoreObjectField(object, JSObject::kPropertiesOffset, new_properties);
|
| +}
|
| +
|
| +void AccessorAssemblerImpl::StoreNamedField(Node* object, Node* offset,
|
| + bool is_inobject,
|
| + Representation representation,
|
| + Node* value,
|
| + bool transition_to_field) {
|
| + bool store_value_as_double = representation.IsDouble();
|
| + Node* property_storage = object;
|
| + if (!is_inobject) {
|
| + property_storage = LoadProperties(object);
|
| + }
|
| +
|
| + if (representation.IsDouble()) {
|
| + if (!FLAG_unbox_double_fields || !is_inobject) {
|
| + if (transition_to_field) {
|
| + Node* heap_number = AllocateHeapNumberWithValue(value, MUTABLE);
|
| + // Store the new mutable heap number into the object.
|
| + value = heap_number;
|
| + store_value_as_double = false;
|
| + } else {
|
| + // Load the heap number.
|
| + property_storage = LoadObjectField(property_storage, offset);
|
| + // Store the double value into it.
|
| + offset = IntPtrConstant(HeapNumber::kValueOffset);
|
| + }
|
| + }
|
| + }
|
| +
|
| + if (store_value_as_double) {
|
| + StoreObjectFieldNoWriteBarrier(property_storage, offset, value,
|
| + MachineRepresentation::kFloat64);
|
| + } else if (representation.IsSmi()) {
|
| + StoreObjectFieldNoWriteBarrier(property_storage, offset, value);
|
| + } else {
|
| + StoreObjectField(property_storage, offset, value);
|
| + }
|
| +}
|
| +
|
| void AccessorAssemblerImpl::EmitFastElementsBoundsCheck(
|
| Node* object, Node* elements, Node* intptr_index,
|
| Node* is_jsarray_condition, Label* miss) {
|
|
|