Index: src/mips/code-stubs-mips.cc |
diff --git a/src/mips/code-stubs-mips.cc b/src/mips/code-stubs-mips.cc |
index 68d81bbfc74cc75d4cd7da8cf2c2df33d9f3878e..a2e1a27b953b851db28ff9b85b0568a0aae22dc2 100644 |
--- a/src/mips/code-stubs-mips.cc |
+++ b/src/mips/code-stubs-mips.cc |
@@ -2144,12 +2144,12 @@ void ArgumentsAccessStub::GenerateNewSloppyFast(MacroAssembler* masm) { |
__ Allocate(t5, v0, a3, t0, &runtime, TAG_OBJECT); |
// v0 = address of new object(s) (tagged) |
- // a2 = argument count (tagged) |
+ // a2 = argument count (smi-tagged) |
// Get the arguments boilerplate from the current native context into t0. |
const int kNormalOffset = |
- Context::SlotOffset(Context::SLOPPY_ARGUMENTS_BOILERPLATE_INDEX); |
+ Context::SlotOffset(Context::SLOPPY_ARGUMENTS_MAP_INDEX); |
const int kAliasedOffset = |
- Context::SlotOffset(Context::ALIASED_ARGUMENTS_BOILERPLATE_INDEX); |
+ Context::SlotOffset(Context::ALIASED_ARGUMENTS_MAP_INDEX); |
__ lw(t0, MemOperand(cp, Context::SlotOffset(Context::GLOBAL_OBJECT_INDEX))); |
__ lw(t0, FieldMemOperand(t0, GlobalObject::kNativeContextOffset)); |
@@ -2164,22 +2164,23 @@ void ArgumentsAccessStub::GenerateNewSloppyFast(MacroAssembler* masm) { |
// v0 = address of new object (tagged) |
// a1 = mapped parameter count (tagged) |
- // a2 = argument count (tagged) |
- // t0 = address of boilerplate object (tagged) |
- // Copy the JS object part. |
- for (int i = 0; i < JSObject::kHeaderSize; i += kPointerSize) { |
- __ lw(a3, FieldMemOperand(t0, i)); |
- __ sw(a3, FieldMemOperand(v0, i)); |
- } |
+ // a2 = argument count (smi-tagged) |
+ // t0 = address of arguments map (tagged) |
+ __ sw(t0, FieldMemOperand(v0, JSObject::kMapOffset)); |
+ __ LoadRoot(a3, Heap::kEmptyFixedArrayRootIndex); |
+ __ sw(a3, FieldMemOperand(v0, JSObject::kPropertiesOffset)); |
+ __ sw(a3, FieldMemOperand(v0, JSObject::kElementsOffset)); |
// Set up the callee in-object property. |
STATIC_ASSERT(Heap::kArgumentsCalleeIndex == 1); |
__ lw(a3, MemOperand(sp, 2 * kPointerSize)); |
+ __ AssertNotSmi(a3); |
const int kCalleeOffset = JSObject::kHeaderSize + |
Heap::kArgumentsCalleeIndex * kPointerSize; |
__ sw(a3, FieldMemOperand(v0, kCalleeOffset)); |
// Use the length (smi tagged) and set that as an in-object property too. |
+ __ AssertSmi(a2); |
STATIC_ASSERT(Heap::kArgumentsLengthIndex == 0); |
const int kLengthOffset = JSObject::kHeaderSize + |
Heap::kArgumentsLengthIndex * kPointerSize; |
@@ -2338,15 +2339,18 @@ void ArgumentsAccessStub::GenerateNewStrict(MacroAssembler* masm) { |
// Get the arguments boilerplate from the current native context. |
__ lw(t0, MemOperand(cp, Context::SlotOffset(Context::GLOBAL_OBJECT_INDEX))); |
__ lw(t0, FieldMemOperand(t0, GlobalObject::kNativeContextOffset)); |
- __ lw(t0, MemOperand(t0, Context::SlotOffset( |
- Context::STRICT_ARGUMENTS_BOILERPLATE_INDEX))); |
+ __ lw(t0, MemOperand( |
+ t0, Context::SlotOffset(Context::STRICT_ARGUMENTS_MAP_INDEX))); |
- // Copy the JS object part. |
- __ CopyFields(v0, t0, a3.bit(), JSObject::kHeaderSize / kPointerSize); |
+ __ sw(t0, FieldMemOperand(v0, JSObject::kMapOffset)); |
+ __ LoadRoot(a3, Heap::kEmptyFixedArrayRootIndex); |
+ __ sw(a3, FieldMemOperand(v0, JSObject::kPropertiesOffset)); |
+ __ sw(a3, FieldMemOperand(v0, JSObject::kElementsOffset)); |
// Get the length (smi tagged) and set that as an in-object property too. |
STATIC_ASSERT(Heap::kArgumentsLengthIndex == 0); |
__ lw(a1, MemOperand(sp, 0 * kPointerSize)); |
+ __ AssertSmi(a1); |
__ sw(a1, FieldMemOperand(v0, JSObject::kHeaderSize + |
Heap::kArgumentsLengthIndex * kPointerSize)); |