[stubs] KeyedLoadIC_Generic: prototype chain lookup support

src/ic/accessor-assembler.cc

 // Copyright 2016 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/ic/accessor-assembler.h"
 
 #include "src/code-factory.h"
 #include "src/code-stubs.h"
 #include "src/ic/handler-configuration.h"
 #include "src/ic/stub-cache.h"
@@ skipping 1385 matching lines @@
 }
 
 void AccessorAssembler::KeyedLoadICGeneric(const LoadICParameters* p) {
   Variable var_index(this, MachineType::PointerRepresentation());
   Variable var_unique(this, MachineRepresentation::kTagged);
   var_unique.Bind(p->name);  // Dummy initialization.
   Variable var_details(this, MachineRepresentation::kWord32);
   Variable var_value(this, MachineRepresentation::kTagged);
   Label if_index(this), if_unique_name(this), if_element_hole(this),
       if_oob(this), slow(this), stub_cache_miss(this),
-      if_property_dictionary(this), if_found_on_receiver(this);
+      if_property_dictionary(this), if_found_on_receiver(this),
+      lookup_prototype_chain(this);
 
   Node* receiver = p->receiver;
   GotoIf(TaggedIsSmi(receiver), &slow);
   Node* receiver_map = LoadMap(receiver);
   Node* instance_type = LoadMapInstanceType(receiver_map);
   // Receivers requiring non-standard element accesses (interceptors, access
   // checks, strings and string wrappers, proxies) are handled in the runtime.
   GotoIf(Int32LessThanOrEqual(instance_type,
                               Int32Constant(LAST_CUSTOM_ELEMENTS_RECEIVER)),
          &slow);
@@ skipping 104 matching lines @@
   Bind(&if_property_dictionary);
   {
     Comment("dictionary property load");
     // We checked for LAST_CUSTOM_ELEMENTS_RECEIVER before, which rules out
     // seeing global objects here (which would need special handling).
 
     Node* key = var_unique.value();
     Variable var_name_index(this, MachineType::PointerRepresentation());
     Label dictionary_found(this, &var_name_index);
     NameDictionaryLookup<NameDictionary>(properties, key, &dictionary_found,
-                                         &var_name_index, &slow);
+                                         &var_name_index,
+                                         &lookup_prototype_chain);
     Bind(&dictionary_found);
     {
       LoadPropertyFromNameDictionary(properties, var_name_index.value(),
                                      &var_details, &var_value);
       Goto(&if_found_on_receiver);
     }
   }
 
   Bind(&if_found_on_receiver);
   {
     Node* value = CallGetterIfAccessor(var_value.value(), var_details.value(),
                                        p->context, receiver, &slow);
     IncrementCounter(isolate()->counters()->ic_keyed_load_generic_symbol(), 1);
     Return(value);
   }
 
+  Bind(&lookup_prototype_chain);
+  {
+    Variable var_holder_map(this, MachineRepresentation::kTagged);
+    Variable var_holder_instance_type(this, MachineRepresentation::kWord32);
+    Label return_undefined(this);
+    Variable* merged_variables[] = {&var_holder_map, &var_holder_instance_type};
+    Label loop(this, arraysize(merged_variables), merged_variables);
+
+    var_holder_map.Bind(receiver_map);
+    var_holder_instance_type.Bind(instance_type);
+    Goto(&loop);
+    Bind(&loop);
+    {
+      // Bailout if it can be an integer indexed exotic case.
+      GotoIf(Word32Equal(var_holder_instance_type.value(),

[Igor Sheludko, 2017/01/27 08:58:08]

I guess we can move this check to next_proto block.

[Jakob Kummerow, 2017/01/28 01:41:29]

No, we need it in the first iteration. "Integer indexed exotic" is weird.

+                         Int32Constant(JS_TYPED_ARRAY_TYPE)),
+             &slow);
+      Node* proto = LoadMapPrototype(var_holder_map.value());
+      GotoIf(WordEqual(proto, NullConstant()), &return_undefined);
+      Node* proto_map = LoadMap(proto);
+      Node* proto_instance_type = LoadMapInstanceType(proto_map);
+      var_holder_map.Bind(proto_map);
+      var_holder_instance_type.Bind(proto_instance_type);
+      Label next_proto(this), return_value(this, &var_value), goto_slow(this);
+      TryGetOwnProperty(p->context, receiver, proto, proto_map,
+                        proto_instance_type, var_unique.value(), &return_value,
+                        &var_value, &next_proto, &goto_slow);
+
+      Bind(&next_proto);

[Jakob Kummerow, 2017/01/25 16:40:06]

This trampoline and the next are needed to appease Turbofan's variable resolver.

[Igor Sheludko, 2017/01/27 08:58:08]

Maybe add this as a comment to the code.

[Jakob Kummerow, 2017/01/28 01:41:29]

Done.

+      Goto(&loop);
+
+      Bind(&goto_slow);
+      Goto(&slow);
+
+      Bind(&return_value);
+      Return(var_value.value());
+    }
+
+    Bind(&return_undefined);
+    Return(UndefinedConstant());
+  }
+
   Bind(&slow);
   {
     Comment("KeyedLoadGeneric_slow");
     IncrementCounter(isolate()->counters()->ic_keyed_load_generic_slow(), 1);
     // TODO(jkummerow): Should we use the GetProperty TF stub instead?
     TailCallRuntime(Runtime::kKeyedGetProperty, p->context, p->receiver,
                     p->name);
   }
 }
 
@@ skipping 325 matching lines @@
   Node* slot = Parameter(Descriptor::kSlot);
   Node* context = Parameter(Descriptor::kContext);
   Node* vector = LoadTypeFeedbackVectorForStub();
 
   StoreICParameters p(context, receiver, name, value, slot, vector);
   KeyedStoreIC(&p, language_mode);
 }
 
 }  // namespace internal
 }  // namespace v8