| Index: src/mips/code-stubs-mips.cc
|
| diff --git a/src/mips/code-stubs-mips.cc b/src/mips/code-stubs-mips.cc
|
| index 68d81bbfc74cc75d4cd7da8cf2c2df33d9f3878e..a2e1a27b953b851db28ff9b85b0568a0aae22dc2 100644
|
| --- a/src/mips/code-stubs-mips.cc
|
| +++ b/src/mips/code-stubs-mips.cc
|
| @@ -2144,12 +2144,12 @@ void ArgumentsAccessStub::GenerateNewSloppyFast(MacroAssembler* masm) {
|
| __ Allocate(t5, v0, a3, t0, &runtime, TAG_OBJECT);
|
|
|
| // v0 = address of new object(s) (tagged)
|
| - // a2 = argument count (tagged)
|
| + // a2 = argument count (smi-tagged)
|
| // Get the arguments boilerplate from the current native context into t0.
|
| const int kNormalOffset =
|
| - Context::SlotOffset(Context::SLOPPY_ARGUMENTS_BOILERPLATE_INDEX);
|
| + Context::SlotOffset(Context::SLOPPY_ARGUMENTS_MAP_INDEX);
|
| const int kAliasedOffset =
|
| - Context::SlotOffset(Context::ALIASED_ARGUMENTS_BOILERPLATE_INDEX);
|
| + Context::SlotOffset(Context::ALIASED_ARGUMENTS_MAP_INDEX);
|
|
|
| __ lw(t0, MemOperand(cp, Context::SlotOffset(Context::GLOBAL_OBJECT_INDEX)));
|
| __ lw(t0, FieldMemOperand(t0, GlobalObject::kNativeContextOffset));
|
| @@ -2164,22 +2164,23 @@ void ArgumentsAccessStub::GenerateNewSloppyFast(MacroAssembler* masm) {
|
|
|
| // v0 = address of new object (tagged)
|
| // a1 = mapped parameter count (tagged)
|
| - // a2 = argument count (tagged)
|
| - // t0 = address of boilerplate object (tagged)
|
| - // Copy the JS object part.
|
| - for (int i = 0; i < JSObject::kHeaderSize; i += kPointerSize) {
|
| - __ lw(a3, FieldMemOperand(t0, i));
|
| - __ sw(a3, FieldMemOperand(v0, i));
|
| - }
|
| + // a2 = argument count (smi-tagged)
|
| + // t0 = address of arguments map (tagged)
|
| + __ sw(t0, FieldMemOperand(v0, JSObject::kMapOffset));
|
| + __ LoadRoot(a3, Heap::kEmptyFixedArrayRootIndex);
|
| + __ sw(a3, FieldMemOperand(v0, JSObject::kPropertiesOffset));
|
| + __ sw(a3, FieldMemOperand(v0, JSObject::kElementsOffset));
|
|
|
| // Set up the callee in-object property.
|
| STATIC_ASSERT(Heap::kArgumentsCalleeIndex == 1);
|
| __ lw(a3, MemOperand(sp, 2 * kPointerSize));
|
| + __ AssertNotSmi(a3);
|
| const int kCalleeOffset = JSObject::kHeaderSize +
|
| Heap::kArgumentsCalleeIndex * kPointerSize;
|
| __ sw(a3, FieldMemOperand(v0, kCalleeOffset));
|
|
|
| // Use the length (smi tagged) and set that as an in-object property too.
|
| + __ AssertSmi(a2);
|
| STATIC_ASSERT(Heap::kArgumentsLengthIndex == 0);
|
| const int kLengthOffset = JSObject::kHeaderSize +
|
| Heap::kArgumentsLengthIndex * kPointerSize;
|
| @@ -2338,15 +2339,18 @@ void ArgumentsAccessStub::GenerateNewStrict(MacroAssembler* masm) {
|
| // Get the arguments boilerplate from the current native context.
|
| __ lw(t0, MemOperand(cp, Context::SlotOffset(Context::GLOBAL_OBJECT_INDEX)));
|
| __ lw(t0, FieldMemOperand(t0, GlobalObject::kNativeContextOffset));
|
| - __ lw(t0, MemOperand(t0, Context::SlotOffset(
|
| - Context::STRICT_ARGUMENTS_BOILERPLATE_INDEX)));
|
| + __ lw(t0, MemOperand(
|
| + t0, Context::SlotOffset(Context::STRICT_ARGUMENTS_MAP_INDEX)));
|
|
|
| - // Copy the JS object part.
|
| - __ CopyFields(v0, t0, a3.bit(), JSObject::kHeaderSize / kPointerSize);
|
| + __ sw(t0, FieldMemOperand(v0, JSObject::kMapOffset));
|
| + __ LoadRoot(a3, Heap::kEmptyFixedArrayRootIndex);
|
| + __ sw(a3, FieldMemOperand(v0, JSObject::kPropertiesOffset));
|
| + __ sw(a3, FieldMemOperand(v0, JSObject::kElementsOffset));
|
|
|
| // Get the length (smi tagged) and set that as an in-object property too.
|
| STATIC_ASSERT(Heap::kArgumentsLengthIndex == 0);
|
| __ lw(a1, MemOperand(sp, 0 * kPointerSize));
|
| + __ AssertSmi(a1);
|
| __ sw(a1, FieldMemOperand(v0, JSObject::kHeaderSize +
|
| Heap::kArgumentsLengthIndex * kPointerSize));
|
|
|
|
|