OLD | NEW |
1 // Copyright 2014 the V8 project authors. All rights reserved. | 1 // Copyright 2014 the V8 project authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include "src/v8.h" | 5 #include "src/v8.h" |
6 | 6 |
7 #if V8_TARGET_ARCH_X64 | 7 #if V8_TARGET_ARCH_X64 |
8 | 8 |
9 #include "src/ic/call-optimization.h" | |
10 #include "src/ic/ic-compiler.h" | 9 #include "src/ic/ic-compiler.h" |
11 | 10 |
12 namespace v8 { | 11 namespace v8 { |
13 namespace internal { | 12 namespace internal { |
14 | 13 |
15 #define __ ACCESS_MASM(masm) | 14 #define __ ACCESS_MASM(masm) |
16 | 15 |
17 | 16 |
18 void PropertyHandlerCompiler::GenerateDictionaryNegativeLookup( | 17 void PropertyICCompiler::GenerateRuntimeSetProperty(MacroAssembler* masm, |
19 MacroAssembler* masm, Label* miss_label, Register receiver, | 18 StrictMode strict_mode) { |
20 Handle<Name> name, Register scratch0, Register scratch1) { | 19 // Return address is on the stack. |
21 DCHECK(name->IsUniqueName()); | 20 DCHECK(!rbx.is(StoreIC::ReceiverRegister()) && |
22 DCHECK(!receiver.is(scratch0)); | 21 !rbx.is(StoreIC::NameRegister()) && !rbx.is(StoreIC::ValueRegister())); |
23 Counters* counters = masm->isolate()->counters(); | |
24 __ IncrementCounter(counters->negative_lookups(), 1); | |
25 __ IncrementCounter(counters->negative_lookups_miss(), 1); | |
26 | 22 |
27 __ movp(scratch0, FieldOperand(receiver, HeapObject::kMapOffset)); | 23 __ PopReturnAddressTo(rbx); |
| 24 __ Push(StoreIC::ReceiverRegister()); |
| 25 __ Push(StoreIC::NameRegister()); |
| 26 __ Push(StoreIC::ValueRegister()); |
| 27 __ Push(Smi::FromInt(strict_mode)); |
| 28 __ PushReturnAddressFrom(rbx); |
28 | 29 |
29 const int kInterceptorOrAccessCheckNeededMask = | 30 // Do tail-call to runtime routine. |
30 (1 << Map::kHasNamedInterceptor) | (1 << Map::kIsAccessCheckNeeded); | 31 __ TailCallRuntime(Runtime::kSetProperty, 4, 1); |
31 | |
32 // Bail out if the receiver has a named interceptor or requires access checks. | |
33 __ testb(FieldOperand(scratch0, Map::kBitFieldOffset), | |
34 Immediate(kInterceptorOrAccessCheckNeededMask)); | |
35 __ j(not_zero, miss_label); | |
36 | |
37 // Check that receiver is a JSObject. | |
38 __ CmpInstanceType(scratch0, FIRST_SPEC_OBJECT_TYPE); | |
39 __ j(below, miss_label); | |
40 | |
41 // Load properties array. | |
42 Register properties = scratch0; | |
43 __ movp(properties, FieldOperand(receiver, JSObject::kPropertiesOffset)); | |
44 | |
45 // Check that the properties array is a dictionary. | |
46 __ CompareRoot(FieldOperand(properties, HeapObject::kMapOffset), | |
47 Heap::kHashTableMapRootIndex); | |
48 __ j(not_equal, miss_label); | |
49 | |
50 Label done; | |
51 NameDictionaryLookupStub::GenerateNegativeLookup(masm, miss_label, &done, | |
52 properties, name, scratch1); | |
53 __ bind(&done); | |
54 __ DecrementCounter(counters->negative_lookups_miss(), 1); | |
55 } | 32 } |
56 | 33 |
57 | 34 |
58 void NamedLoadHandlerCompiler::GenerateDirectLoadGlobalFunctionPrototype( | |
59 MacroAssembler* masm, int index, Register prototype, Label* miss) { | |
60 Isolate* isolate = masm->isolate(); | |
61 // Get the global function with the given index. | |
62 Handle<JSFunction> function( | |
63 JSFunction::cast(isolate->native_context()->get(index))); | |
64 | |
65 // Check we're still in the same context. | |
66 Register scratch = prototype; | |
67 const int offset = Context::SlotOffset(Context::GLOBAL_OBJECT_INDEX); | |
68 __ movp(scratch, Operand(rsi, offset)); | |
69 __ movp(scratch, FieldOperand(scratch, GlobalObject::kNativeContextOffset)); | |
70 __ Cmp(Operand(scratch, Context::SlotOffset(index)), function); | |
71 __ j(not_equal, miss); | |
72 | |
73 // Load its initial map. The global functions all have initial maps. | |
74 __ Move(prototype, Handle<Map>(function->initial_map())); | |
75 // Load the prototype from the initial map. | |
76 __ movp(prototype, FieldOperand(prototype, Map::kPrototypeOffset)); | |
77 } | |
78 | |
79 | |
80 void NamedLoadHandlerCompiler::GenerateLoadFunctionPrototype( | |
81 MacroAssembler* masm, Register receiver, Register result, Register scratch, | |
82 Label* miss_label) { | |
83 __ TryGetFunctionPrototype(receiver, result, miss_label); | |
84 if (!result.is(rax)) __ movp(rax, result); | |
85 __ ret(0); | |
86 } | |
87 | |
88 | |
89 static void PushInterceptorArguments(MacroAssembler* masm, Register receiver, | |
90 Register holder, Register name, | |
91 Handle<JSObject> holder_obj) { | |
92 STATIC_ASSERT(NamedLoadHandlerCompiler::kInterceptorArgsNameIndex == 0); | |
93 STATIC_ASSERT(NamedLoadHandlerCompiler::kInterceptorArgsInfoIndex == 1); | |
94 STATIC_ASSERT(NamedLoadHandlerCompiler::kInterceptorArgsThisIndex == 2); | |
95 STATIC_ASSERT(NamedLoadHandlerCompiler::kInterceptorArgsHolderIndex == 3); | |
96 STATIC_ASSERT(NamedLoadHandlerCompiler::kInterceptorArgsLength == 4); | |
97 __ Push(name); | |
98 Handle<InterceptorInfo> interceptor(holder_obj->GetNamedInterceptor()); | |
99 DCHECK(!masm->isolate()->heap()->InNewSpace(*interceptor)); | |
100 __ Move(kScratchRegister, interceptor); | |
101 __ Push(kScratchRegister); | |
102 __ Push(receiver); | |
103 __ Push(holder); | |
104 } | |
105 | |
106 | |
107 static void CompileCallLoadPropertyWithInterceptor( | |
108 MacroAssembler* masm, Register receiver, Register holder, Register name, | |
109 Handle<JSObject> holder_obj, IC::UtilityId id) { | |
110 PushInterceptorArguments(masm, receiver, holder, name, holder_obj); | |
111 __ CallExternalReference(ExternalReference(IC_Utility(id), masm->isolate()), | |
112 NamedLoadHandlerCompiler::kInterceptorArgsLength); | |
113 } | |
114 | |
115 | |
116 // Generate call to api function. | |
117 void PropertyHandlerCompiler::GenerateFastApiCall( | |
118 MacroAssembler* masm, const CallOptimization& optimization, | |
119 Handle<Map> receiver_map, Register receiver, Register scratch_in, | |
120 bool is_store, int argc, Register* values) { | |
121 DCHECK(optimization.is_simple_api_call()); | |
122 | |
123 __ PopReturnAddressTo(scratch_in); | |
124 // receiver | |
125 __ Push(receiver); | |
126 // Write the arguments to stack frame. | |
127 for (int i = 0; i < argc; i++) { | |
128 Register arg = values[argc - 1 - i]; | |
129 DCHECK(!receiver.is(arg)); | |
130 DCHECK(!scratch_in.is(arg)); | |
131 __ Push(arg); | |
132 } | |
133 __ PushReturnAddressFrom(scratch_in); | |
134 // Stack now matches JSFunction abi. | |
135 | |
136 // Abi for CallApiFunctionStub. | |
137 Register callee = rax; | |
138 Register call_data = rbx; | |
139 Register holder = rcx; | |
140 Register api_function_address = rdx; | |
141 Register scratch = rdi; // scratch_in is no longer valid. | |
142 | |
143 // Put holder in place. | |
144 CallOptimization::HolderLookup holder_lookup; | |
145 Handle<JSObject> api_holder = | |
146 optimization.LookupHolderOfExpectedType(receiver_map, &holder_lookup); | |
147 switch (holder_lookup) { | |
148 case CallOptimization::kHolderIsReceiver: | |
149 __ Move(holder, receiver); | |
150 break; | |
151 case CallOptimization::kHolderFound: | |
152 __ Move(holder, api_holder); | |
153 break; | |
154 case CallOptimization::kHolderNotFound: | |
155 UNREACHABLE(); | |
156 break; | |
157 } | |
158 | |
159 Isolate* isolate = masm->isolate(); | |
160 Handle<JSFunction> function = optimization.constant_function(); | |
161 Handle<CallHandlerInfo> api_call_info = optimization.api_call_info(); | |
162 Handle<Object> call_data_obj(api_call_info->data(), isolate); | |
163 | |
164 // Put callee in place. | |
165 __ Move(callee, function); | |
166 | |
167 bool call_data_undefined = false; | |
168 // Put call_data in place. | |
169 if (isolate->heap()->InNewSpace(*call_data_obj)) { | |
170 __ Move(scratch, api_call_info); | |
171 __ movp(call_data, FieldOperand(scratch, CallHandlerInfo::kDataOffset)); | |
172 } else if (call_data_obj->IsUndefined()) { | |
173 call_data_undefined = true; | |
174 __ LoadRoot(call_data, Heap::kUndefinedValueRootIndex); | |
175 } else { | |
176 __ Move(call_data, call_data_obj); | |
177 } | |
178 | |
179 // Put api_function_address in place. | |
180 Address function_address = v8::ToCData<Address>(api_call_info->callback()); | |
181 __ Move(api_function_address, function_address, | |
182 RelocInfo::EXTERNAL_REFERENCE); | |
183 | |
184 // Jump to stub. | |
185 CallApiFunctionStub stub(isolate, is_store, call_data_undefined, argc); | |
186 __ TailCallStub(&stub); | |
187 } | |
188 | |
189 | |
190 void PropertyHandlerCompiler::GenerateCheckPropertyCell( | |
191 MacroAssembler* masm, Handle<JSGlobalObject> global, Handle<Name> name, | |
192 Register scratch, Label* miss) { | |
193 Handle<PropertyCell> cell = JSGlobalObject::EnsurePropertyCell(global, name); | |
194 DCHECK(cell->value()->IsTheHole()); | |
195 __ Move(scratch, cell); | |
196 __ Cmp(FieldOperand(scratch, Cell::kValueOffset), | |
197 masm->isolate()->factory()->the_hole_value()); | |
198 __ j(not_equal, miss); | |
199 } | |
200 | |
201 | |
202 #undef __ | |
203 #define __ ACCESS_MASM((masm())) | |
204 | |
205 | |
206 void NamedStoreHandlerCompiler::GenerateRestoreName(Label* label, | |
207 Handle<Name> name) { | |
208 if (!label->is_unused()) { | |
209 __ bind(label); | |
210 __ Move(this->name(), name); | |
211 } | |
212 } | |
213 | |
214 | |
215 // Receiver_reg is preserved on jumps to miss_label, but may be destroyed if | |
216 // store is successful. | |
217 void NamedStoreHandlerCompiler::GenerateStoreTransition( | |
218 Handle<Map> transition, Handle<Name> name, Register receiver_reg, | |
219 Register storage_reg, Register value_reg, Register scratch1, | |
220 Register scratch2, Register unused, Label* miss_label, Label* slow) { | |
221 int descriptor = transition->LastAdded(); | |
222 DescriptorArray* descriptors = transition->instance_descriptors(); | |
223 PropertyDetails details = descriptors->GetDetails(descriptor); | |
224 Representation representation = details.representation(); | |
225 DCHECK(!representation.IsNone()); | |
226 | |
227 if (details.type() == CONSTANT) { | |
228 Handle<Object> constant(descriptors->GetValue(descriptor), isolate()); | |
229 __ Cmp(value_reg, constant); | |
230 __ j(not_equal, miss_label); | |
231 } else if (representation.IsSmi()) { | |
232 __ JumpIfNotSmi(value_reg, miss_label); | |
233 } else if (representation.IsHeapObject()) { | |
234 __ JumpIfSmi(value_reg, miss_label); | |
235 HeapType* field_type = descriptors->GetFieldType(descriptor); | |
236 HeapType::Iterator<Map> it = field_type->Classes(); | |
237 if (!it.Done()) { | |
238 Label do_store; | |
239 while (true) { | |
240 __ CompareMap(value_reg, it.Current()); | |
241 it.Advance(); | |
242 if (it.Done()) { | |
243 __ j(not_equal, miss_label); | |
244 break; | |
245 } | |
246 __ j(equal, &do_store, Label::kNear); | |
247 } | |
248 __ bind(&do_store); | |
249 } | |
250 } else if (representation.IsDouble()) { | |
251 Label do_store, heap_number; | |
252 __ AllocateHeapNumber(storage_reg, scratch1, slow, MUTABLE); | |
253 | |
254 __ JumpIfNotSmi(value_reg, &heap_number); | |
255 __ SmiToInteger32(scratch1, value_reg); | |
256 __ Cvtlsi2sd(xmm0, scratch1); | |
257 __ jmp(&do_store); | |
258 | |
259 __ bind(&heap_number); | |
260 __ CheckMap(value_reg, isolate()->factory()->heap_number_map(), miss_label, | |
261 DONT_DO_SMI_CHECK); | |
262 __ movsd(xmm0, FieldOperand(value_reg, HeapNumber::kValueOffset)); | |
263 | |
264 __ bind(&do_store); | |
265 __ movsd(FieldOperand(storage_reg, HeapNumber::kValueOffset), xmm0); | |
266 } | |
267 | |
268 // Stub never generated for objects that require access checks. | |
269 DCHECK(!transition->is_access_check_needed()); | |
270 | |
271 // Perform map transition for the receiver if necessary. | |
272 if (details.type() == FIELD && | |
273 Map::cast(transition->GetBackPointer())->unused_property_fields() == 0) { | |
274 // The properties must be extended before we can store the value. | |
275 // We jump to a runtime call that extends the properties array. | |
276 __ PopReturnAddressTo(scratch1); | |
277 __ Push(receiver_reg); | |
278 __ Push(transition); | |
279 __ Push(value_reg); | |
280 __ PushReturnAddressFrom(scratch1); | |
281 __ TailCallExternalReference( | |
282 ExternalReference(IC_Utility(IC::kSharedStoreIC_ExtendStorage), | |
283 isolate()), | |
284 3, 1); | |
285 return; | |
286 } | |
287 | |
288 // Update the map of the object. | |
289 __ Move(scratch1, transition); | |
290 __ movp(FieldOperand(receiver_reg, HeapObject::kMapOffset), scratch1); | |
291 | |
292 // Update the write barrier for the map field. | |
293 __ RecordWriteField(receiver_reg, HeapObject::kMapOffset, scratch1, scratch2, | |
294 kDontSaveFPRegs, OMIT_REMEMBERED_SET, OMIT_SMI_CHECK); | |
295 | |
296 if (details.type() == CONSTANT) { | |
297 DCHECK(value_reg.is(rax)); | |
298 __ ret(0); | |
299 return; | |
300 } | |
301 | |
302 int index = transition->instance_descriptors()->GetFieldIndex( | |
303 transition->LastAdded()); | |
304 | |
305 // Adjust for the number of properties stored in the object. Even in the | |
306 // face of a transition we can use the old map here because the size of the | |
307 // object and the number of in-object properties is not going to change. | |
308 index -= transition->inobject_properties(); | |
309 | |
310 // TODO(verwaest): Share this code as a code stub. | |
311 SmiCheck smi_check = | |
312 representation.IsTagged() ? INLINE_SMI_CHECK : OMIT_SMI_CHECK; | |
313 if (index < 0) { | |
314 // Set the property straight into the object. | |
315 int offset = transition->instance_size() + (index * kPointerSize); | |
316 if (representation.IsDouble()) { | |
317 __ movp(FieldOperand(receiver_reg, offset), storage_reg); | |
318 } else { | |
319 __ movp(FieldOperand(receiver_reg, offset), value_reg); | |
320 } | |
321 | |
322 if (!representation.IsSmi()) { | |
323 // Update the write barrier for the array address. | |
324 if (!representation.IsDouble()) { | |
325 __ movp(storage_reg, value_reg); | |
326 } | |
327 __ RecordWriteField(receiver_reg, offset, storage_reg, scratch1, | |
328 kDontSaveFPRegs, EMIT_REMEMBERED_SET, smi_check); | |
329 } | |
330 } else { | |
331 // Write to the properties array. | |
332 int offset = index * kPointerSize + FixedArray::kHeaderSize; | |
333 // Get the properties array (optimistically). | |
334 __ movp(scratch1, FieldOperand(receiver_reg, JSObject::kPropertiesOffset)); | |
335 if (representation.IsDouble()) { | |
336 __ movp(FieldOperand(scratch1, offset), storage_reg); | |
337 } else { | |
338 __ movp(FieldOperand(scratch1, offset), value_reg); | |
339 } | |
340 | |
341 if (!representation.IsSmi()) { | |
342 // Update the write barrier for the array address. | |
343 if (!representation.IsDouble()) { | |
344 __ movp(storage_reg, value_reg); | |
345 } | |
346 __ RecordWriteField(scratch1, offset, storage_reg, receiver_reg, | |
347 kDontSaveFPRegs, EMIT_REMEMBERED_SET, smi_check); | |
348 } | |
349 } | |
350 | |
351 // Return the value (register rax). | |
352 DCHECK(value_reg.is(rax)); | |
353 __ ret(0); | |
354 } | |
355 | |
356 | |
357 void NamedStoreHandlerCompiler::GenerateStoreField(LookupIterator* lookup, | |
358 Register value_reg, | |
359 Label* miss_label) { | |
360 DCHECK(lookup->representation().IsHeapObject()); | |
361 __ JumpIfSmi(value_reg, miss_label); | |
362 HeapType::Iterator<Map> it = lookup->GetFieldType()->Classes(); | |
363 Label do_store; | |
364 while (true) { | |
365 __ CompareMap(value_reg, it.Current()); | |
366 it.Advance(); | |
367 if (it.Done()) { | |
368 __ j(not_equal, miss_label); | |
369 break; | |
370 } | |
371 __ j(equal, &do_store, Label::kNear); | |
372 } | |
373 __ bind(&do_store); | |
374 | |
375 StoreFieldStub stub(isolate(), lookup->GetFieldIndex(), | |
376 lookup->representation()); | |
377 GenerateTailCall(masm(), stub.GetCode()); | |
378 } | |
379 | |
380 | |
381 Register PropertyHandlerCompiler::CheckPrototypes( | |
382 Register object_reg, Register holder_reg, Register scratch1, | |
383 Register scratch2, Handle<Name> name, Label* miss, | |
384 PrototypeCheckType check) { | |
385 Handle<Map> receiver_map(IC::TypeToMap(*type(), isolate())); | |
386 | |
387 // Make sure there's no overlap between holder and object registers. | |
388 DCHECK(!scratch1.is(object_reg) && !scratch1.is(holder_reg)); | |
389 DCHECK(!scratch2.is(object_reg) && !scratch2.is(holder_reg) && | |
390 !scratch2.is(scratch1)); | |
391 | |
392 // Keep track of the current object in register reg. On the first | |
393 // iteration, reg is an alias for object_reg, on later iterations, | |
394 // it is an alias for holder_reg. | |
395 Register reg = object_reg; | |
396 int depth = 0; | |
397 | |
398 Handle<JSObject> current = Handle<JSObject>::null(); | |
399 if (type()->IsConstant()) { | |
400 current = Handle<JSObject>::cast(type()->AsConstant()->Value()); | |
401 } | |
402 Handle<JSObject> prototype = Handle<JSObject>::null(); | |
403 Handle<Map> current_map = receiver_map; | |
404 Handle<Map> holder_map(holder()->map()); | |
405 // Traverse the prototype chain and check the maps in the prototype chain for | |
406 // fast and global objects or do negative lookup for normal objects. | |
407 while (!current_map.is_identical_to(holder_map)) { | |
408 ++depth; | |
409 | |
410 // Only global objects and objects that do not require access | |
411 // checks are allowed in stubs. | |
412 DCHECK(current_map->IsJSGlobalProxyMap() || | |
413 !current_map->is_access_check_needed()); | |
414 | |
415 prototype = handle(JSObject::cast(current_map->prototype())); | |
416 if (current_map->is_dictionary_map() && | |
417 !current_map->IsJSGlobalObjectMap()) { | |
418 DCHECK(!current_map->IsJSGlobalProxyMap()); // Proxy maps are fast. | |
419 if (!name->IsUniqueName()) { | |
420 DCHECK(name->IsString()); | |
421 name = factory()->InternalizeString(Handle<String>::cast(name)); | |
422 } | |
423 DCHECK(current.is_null() || | |
424 current->property_dictionary()->FindEntry(name) == | |
425 NameDictionary::kNotFound); | |
426 | |
427 GenerateDictionaryNegativeLookup(masm(), miss, reg, name, scratch1, | |
428 scratch2); | |
429 | |
430 __ movp(scratch1, FieldOperand(reg, HeapObject::kMapOffset)); | |
431 reg = holder_reg; // From now on the object will be in holder_reg. | |
432 __ movp(reg, FieldOperand(scratch1, Map::kPrototypeOffset)); | |
433 } else { | |
434 bool in_new_space = heap()->InNewSpace(*prototype); | |
435 // Two possible reasons for loading the prototype from the map: | |
436 // (1) Can't store references to new space in code. | |
437 // (2) Handler is shared for all receivers with the same prototype | |
438 // map (but not necessarily the same prototype instance). | |
439 bool load_prototype_from_map = in_new_space || depth == 1; | |
440 if (load_prototype_from_map) { | |
441 // Save the map in scratch1 for later. | |
442 __ movp(scratch1, FieldOperand(reg, HeapObject::kMapOffset)); | |
443 } | |
444 if (depth != 1 || check == CHECK_ALL_MAPS) { | |
445 __ CheckMap(reg, current_map, miss, DONT_DO_SMI_CHECK); | |
446 } | |
447 | |
448 // Check access rights to the global object. This has to happen after | |
449 // the map check so that we know that the object is actually a global | |
450 // object. | |
451 // This allows us to install generated handlers for accesses to the | |
452 // global proxy (as opposed to using slow ICs). See corresponding code | |
453 // in LookupForRead(). | |
454 if (current_map->IsJSGlobalProxyMap()) { | |
455 __ CheckAccessGlobalProxy(reg, scratch2, miss); | |
456 } else if (current_map->IsJSGlobalObjectMap()) { | |
457 GenerateCheckPropertyCell(masm(), Handle<JSGlobalObject>::cast(current), | |
458 name, scratch2, miss); | |
459 } | |
460 reg = holder_reg; // From now on the object will be in holder_reg. | |
461 | |
462 if (load_prototype_from_map) { | |
463 __ movp(reg, FieldOperand(scratch1, Map::kPrototypeOffset)); | |
464 } else { | |
465 __ Move(reg, prototype); | |
466 } | |
467 } | |
468 | |
469 // Go to the next object in the prototype chain. | |
470 current = prototype; | |
471 current_map = handle(current->map()); | |
472 } | |
473 | |
474 // Log the check depth. | |
475 LOG(isolate(), IntEvent("check-maps-depth", depth + 1)); | |
476 | |
477 if (depth != 0 || check == CHECK_ALL_MAPS) { | |
478 // Check the holder map. | |
479 __ CheckMap(reg, current_map, miss, DONT_DO_SMI_CHECK); | |
480 } | |
481 | |
482 // Perform security check for access to the global object. | |
483 DCHECK(current_map->IsJSGlobalProxyMap() || | |
484 !current_map->is_access_check_needed()); | |
485 if (current_map->IsJSGlobalProxyMap()) { | |
486 __ CheckAccessGlobalProxy(reg, scratch1, miss); | |
487 } | |
488 | |
489 // Return the register containing the holder. | |
490 return reg; | |
491 } | |
492 | |
493 | |
494 void NamedLoadHandlerCompiler::FrontendFooter(Handle<Name> name, Label* miss) { | |
495 if (!miss->is_unused()) { | |
496 Label success; | |
497 __ jmp(&success); | |
498 __ bind(miss); | |
499 TailCallBuiltin(masm(), MissBuiltin(kind())); | |
500 __ bind(&success); | |
501 } | |
502 } | |
503 | |
504 | |
505 void NamedStoreHandlerCompiler::FrontendFooter(Handle<Name> name, Label* miss) { | |
506 if (!miss->is_unused()) { | |
507 Label success; | |
508 __ jmp(&success); | |
509 GenerateRestoreName(miss, name); | |
510 TailCallBuiltin(masm(), MissBuiltin(kind())); | |
511 __ bind(&success); | |
512 } | |
513 } | |
514 | |
515 | |
516 void NamedLoadHandlerCompiler::GenerateLoadCallback( | |
517 Register reg, Handle<ExecutableAccessorInfo> callback) { | |
518 // Insert additional parameters into the stack frame above return address. | |
519 DCHECK(!scratch4().is(reg)); | |
520 __ PopReturnAddressTo(scratch4()); | |
521 | |
522 STATIC_ASSERT(PropertyCallbackArguments::kHolderIndex == 0); | |
523 STATIC_ASSERT(PropertyCallbackArguments::kIsolateIndex == 1); | |
524 STATIC_ASSERT(PropertyCallbackArguments::kReturnValueDefaultValueIndex == 2); | |
525 STATIC_ASSERT(PropertyCallbackArguments::kReturnValueOffset == 3); | |
526 STATIC_ASSERT(PropertyCallbackArguments::kDataIndex == 4); | |
527 STATIC_ASSERT(PropertyCallbackArguments::kThisIndex == 5); | |
528 STATIC_ASSERT(PropertyCallbackArguments::kArgsLength == 6); | |
529 __ Push(receiver()); // receiver | |
530 if (heap()->InNewSpace(callback->data())) { | |
531 DCHECK(!scratch2().is(reg)); | |
532 __ Move(scratch2(), callback); | |
533 __ Push(FieldOperand(scratch2(), | |
534 ExecutableAccessorInfo::kDataOffset)); // data | |
535 } else { | |
536 __ Push(Handle<Object>(callback->data(), isolate())); | |
537 } | |
538 DCHECK(!kScratchRegister.is(reg)); | |
539 __ LoadRoot(kScratchRegister, Heap::kUndefinedValueRootIndex); | |
540 __ Push(kScratchRegister); // return value | |
541 __ Push(kScratchRegister); // return value default | |
542 __ PushAddress(ExternalReference::isolate_address(isolate())); | |
543 __ Push(reg); // holder | |
544 __ Push(name()); // name | |
545 // Save a pointer to where we pushed the arguments pointer. This will be | |
546 // passed as the const PropertyAccessorInfo& to the C++ callback. | |
547 | |
548 __ PushReturnAddressFrom(scratch4()); | |
549 | |
550 // Abi for CallApiGetter | |
551 Register api_function_address = r8; | |
552 Address getter_address = v8::ToCData<Address>(callback->getter()); | |
553 __ Move(api_function_address, getter_address, RelocInfo::EXTERNAL_REFERENCE); | |
554 | |
555 CallApiGetterStub stub(isolate()); | |
556 __ TailCallStub(&stub); | |
557 } | |
558 | |
559 | |
560 void NamedLoadHandlerCompiler::GenerateLoadConstant(Handle<Object> value) { | |
561 // Return the constant value. | |
562 __ Move(rax, value); | |
563 __ ret(0); | |
564 } | |
565 | |
566 | |
567 void NamedLoadHandlerCompiler::GenerateLoadInterceptorWithFollowup( | |
568 LookupIterator* it, Register holder_reg) { | |
569 DCHECK(holder()->HasNamedInterceptor()); | |
570 DCHECK(!holder()->GetNamedInterceptor()->getter()->IsUndefined()); | |
571 | |
572 // Compile the interceptor call, followed by inline code to load the | |
573 // property from further up the prototype chain if the call fails. | |
574 // Check that the maps haven't changed. | |
575 DCHECK(holder_reg.is(receiver()) || holder_reg.is(scratch1())); | |
576 | |
577 // Preserve the receiver register explicitly whenever it is different from the | |
578 // holder and it is needed should the interceptor return without any result. | |
579 // The ACCESSOR case needs the receiver to be passed into C++ code, the FIELD | |
580 // case might cause a miss during the prototype check. | |
581 bool must_perform_prototype_check = | |
582 !holder().is_identical_to(it->GetHolder<JSObject>()); | |
583 bool must_preserve_receiver_reg = | |
584 !receiver().is(holder_reg) && | |
585 (it->property_kind() == LookupIterator::ACCESSOR || | |
586 must_perform_prototype_check); | |
587 | |
588 // Save necessary data before invoking an interceptor. | |
589 // Requires a frame to make GC aware of pushed pointers. | |
590 { | |
591 FrameScope frame_scope(masm(), StackFrame::INTERNAL); | |
592 | |
593 if (must_preserve_receiver_reg) { | |
594 __ Push(receiver()); | |
595 } | |
596 __ Push(holder_reg); | |
597 __ Push(this->name()); | |
598 | |
599 // Invoke an interceptor. Note: map checks from receiver to | |
600 // interceptor's holder has been compiled before (see a caller | |
601 // of this method.) | |
602 CompileCallLoadPropertyWithInterceptor( | |
603 masm(), receiver(), holder_reg, this->name(), holder(), | |
604 IC::kLoadPropertyWithInterceptorOnly); | |
605 | |
606 // Check if interceptor provided a value for property. If it's | |
607 // the case, return immediately. | |
608 Label interceptor_failed; | |
609 __ CompareRoot(rax, Heap::kNoInterceptorResultSentinelRootIndex); | |
610 __ j(equal, &interceptor_failed); | |
611 frame_scope.GenerateLeaveFrame(); | |
612 __ ret(0); | |
613 | |
614 __ bind(&interceptor_failed); | |
615 __ Pop(this->name()); | |
616 __ Pop(holder_reg); | |
617 if (must_preserve_receiver_reg) { | |
618 __ Pop(receiver()); | |
619 } | |
620 | |
621 // Leave the internal frame. | |
622 } | |
623 | |
624 GenerateLoadPostInterceptor(it, holder_reg); | |
625 } | |
626 | |
627 | |
628 void NamedLoadHandlerCompiler::GenerateLoadInterceptor(Register holder_reg) { | |
629 // Call the runtime system to load the interceptor. | |
630 DCHECK(holder()->HasNamedInterceptor()); | |
631 DCHECK(!holder()->GetNamedInterceptor()->getter()->IsUndefined()); | |
632 __ PopReturnAddressTo(scratch2()); | |
633 PushInterceptorArguments(masm(), receiver(), holder_reg, this->name(), | |
634 holder()); | |
635 __ PushReturnAddressFrom(scratch2()); | |
636 | |
637 ExternalReference ref = ExternalReference( | |
638 IC_Utility(IC::kLoadPropertyWithInterceptor), isolate()); | |
639 __ TailCallExternalReference( | |
640 ref, NamedLoadHandlerCompiler::kInterceptorArgsLength, 1); | |
641 } | |
642 | |
643 | |
644 Handle<Code> NamedStoreHandlerCompiler::CompileStoreCallback( | |
645 Handle<JSObject> object, Handle<Name> name, | |
646 Handle<ExecutableAccessorInfo> callback) { | |
647 Register holder_reg = Frontend(receiver(), name); | |
648 | |
649 __ PopReturnAddressTo(scratch1()); | |
650 __ Push(receiver()); | |
651 __ Push(holder_reg); | |
652 __ Push(callback); // callback info | |
653 __ Push(name); | |
654 __ Push(value()); | |
655 __ PushReturnAddressFrom(scratch1()); | |
656 | |
657 // Do tail-call to the runtime system. | |
658 ExternalReference store_callback_property = | |
659 ExternalReference(IC_Utility(IC::kStoreCallbackProperty), isolate()); | |
660 __ TailCallExternalReference(store_callback_property, 5, 1); | |
661 | |
662 // Return the generated code. | |
663 return GetCode(kind(), Code::FAST, name); | |
664 } | |
665 | |
666 | |
667 #undef __ | |
668 #define __ ACCESS_MASM(masm) | |
669 | |
670 | |
671 void NamedStoreHandlerCompiler::GenerateStoreViaSetter( | |
672 MacroAssembler* masm, Handle<HeapType> type, Register receiver, | |
673 Handle<JSFunction> setter) { | |
674 // ----------- S t a t e ------------- | |
675 // -- rsp[0] : return address | |
676 // ----------------------------------- | |
677 { | |
678 FrameScope scope(masm, StackFrame::INTERNAL); | |
679 | |
680 // Save value register, so we can restore it later. | |
681 __ Push(value()); | |
682 | |
683 if (!setter.is_null()) { | |
684 // Call the JavaScript setter with receiver and value on the stack. | |
685 if (IC::TypeToMap(*type, masm->isolate())->IsJSGlobalObjectMap()) { | |
686 // Swap in the global receiver. | |
687 __ movp(receiver, | |
688 FieldOperand(receiver, JSGlobalObject::kGlobalProxyOffset)); | |
689 } | |
690 __ Push(receiver); | |
691 __ Push(value()); | |
692 ParameterCount actual(1); | |
693 ParameterCount expected(setter); | |
694 __ InvokeFunction(setter, expected, actual, CALL_FUNCTION, | |
695 NullCallWrapper()); | |
696 } else { | |
697 // If we generate a global code snippet for deoptimization only, remember | |
698 // the place to continue after deoptimization. | |
699 masm->isolate()->heap()->SetSetterStubDeoptPCOffset(masm->pc_offset()); | |
700 } | |
701 | |
702 // We have to return the passed value, not the return value of the setter. | |
703 __ Pop(rax); | |
704 | |
705 // Restore context register. | |
706 __ movp(rsi, Operand(rbp, StandardFrameConstants::kContextOffset)); | |
707 } | |
708 __ ret(0); | |
709 } | |
710 | |
711 | |
712 #undef __ | 35 #undef __ |
713 #define __ ACCESS_MASM(masm()) | 36 #define __ ACCESS_MASM(masm()) |
714 | 37 |
715 | 38 |
716 Handle<Code> NamedStoreHandlerCompiler::CompileStoreInterceptor( | |
717 Handle<Name> name) { | |
718 __ PopReturnAddressTo(scratch1()); | |
719 __ Push(receiver()); | |
720 __ Push(this->name()); | |
721 __ Push(value()); | |
722 __ PushReturnAddressFrom(scratch1()); | |
723 | |
724 // Do tail-call to the runtime system. | |
725 ExternalReference store_ic_property = ExternalReference( | |
726 IC_Utility(IC::kStorePropertyWithInterceptor), isolate()); | |
727 __ TailCallExternalReference(store_ic_property, 3, 1); | |
728 | |
729 // Return the generated code. | |
730 return GetCode(kind(), Code::FAST, name); | |
731 } | |
732 | |
733 | |
734 Handle<Code> PropertyICCompiler::CompileKeyedStorePolymorphic( | 39 Handle<Code> PropertyICCompiler::CompileKeyedStorePolymorphic( |
735 MapHandleList* receiver_maps, CodeHandleList* handler_stubs, | 40 MapHandleList* receiver_maps, CodeHandleList* handler_stubs, |
736 MapHandleList* transitioned_maps) { | 41 MapHandleList* transitioned_maps) { |
737 Label miss; | 42 Label miss; |
738 __ JumpIfSmi(receiver(), &miss, Label::kNear); | 43 __ JumpIfSmi(receiver(), &miss, Label::kNear); |
739 | 44 |
740 __ movp(scratch1(), FieldOperand(receiver(), HeapObject::kMapOffset)); | 45 __ movp(scratch1(), FieldOperand(receiver(), HeapObject::kMapOffset)); |
741 int receiver_count = receiver_maps->length(); | 46 int receiver_count = receiver_maps->length(); |
742 for (int i = 0; i < receiver_count; ++i) { | 47 for (int i = 0; i < receiver_count; ++i) { |
743 // Check map and tail call if there's a match | 48 // Check map and tail call if there's a match |
(...skipping 12 matching lines...) Expand all Loading... |
756 | 61 |
757 __ bind(&miss); | 62 __ bind(&miss); |
758 | 63 |
759 TailCallBuiltin(masm(), MissBuiltin(kind())); | 64 TailCallBuiltin(masm(), MissBuiltin(kind())); |
760 | 65 |
761 // Return the generated code. | 66 // Return the generated code. |
762 return GetCode(kind(), Code::NORMAL, factory()->empty_string(), POLYMORPHIC); | 67 return GetCode(kind(), Code::NORMAL, factory()->empty_string(), POLYMORPHIC); |
763 } | 68 } |
764 | 69 |
765 | 70 |
766 Register NamedStoreHandlerCompiler::value() { return StoreIC::ValueRegister(); } | |
767 | |
768 | |
769 #undef __ | |
770 #define __ ACCESS_MASM(masm) | |
771 | |
772 | |
773 void NamedLoadHandlerCompiler::GenerateLoadViaGetter( | |
774 MacroAssembler* masm, Handle<HeapType> type, Register receiver, | |
775 Handle<JSFunction> getter) { | |
776 // ----------- S t a t e ------------- | |
777 // -- rax : receiver | |
778 // -- rcx : name | |
779 // -- rsp[0] : return address | |
780 // ----------------------------------- | |
781 { | |
782 FrameScope scope(masm, StackFrame::INTERNAL); | |
783 | |
784 if (!getter.is_null()) { | |
785 // Call the JavaScript getter with the receiver on the stack. | |
786 if (IC::TypeToMap(*type, masm->isolate())->IsJSGlobalObjectMap()) { | |
787 // Swap in the global receiver. | |
788 __ movp(receiver, | |
789 FieldOperand(receiver, JSGlobalObject::kGlobalProxyOffset)); | |
790 } | |
791 __ Push(receiver); | |
792 ParameterCount actual(0); | |
793 ParameterCount expected(getter); | |
794 __ InvokeFunction(getter, expected, actual, CALL_FUNCTION, | |
795 NullCallWrapper()); | |
796 } else { | |
797 // If we generate a global code snippet for deoptimization only, remember | |
798 // the place to continue after deoptimization. | |
799 masm->isolate()->heap()->SetGetterStubDeoptPCOffset(masm->pc_offset()); | |
800 } | |
801 | |
802 // Restore context register. | |
803 __ movp(rsi, Operand(rbp, StandardFrameConstants::kContextOffset)); | |
804 } | |
805 __ ret(0); | |
806 } | |
807 | |
808 | |
809 #undef __ | |
810 #define __ ACCESS_MASM(masm()) | |
811 | |
812 | |
813 Handle<Code> NamedLoadHandlerCompiler::CompileLoadGlobal( | |
814 Handle<PropertyCell> cell, Handle<Name> name, bool is_configurable) { | |
815 Label miss; | |
816 FrontendHeader(receiver(), name, &miss); | |
817 | |
818 // Get the value from the cell. | |
819 Register result = StoreIC::ValueRegister(); | |
820 __ Move(result, cell); | |
821 __ movp(result, FieldOperand(result, PropertyCell::kValueOffset)); | |
822 | |
823 // Check for deleted property if property can actually be deleted. | |
824 if (is_configurable) { | |
825 __ CompareRoot(result, Heap::kTheHoleValueRootIndex); | |
826 __ j(equal, &miss); | |
827 } else if (FLAG_debug_code) { | |
828 __ CompareRoot(result, Heap::kTheHoleValueRootIndex); | |
829 __ Check(not_equal, kDontDeleteCellsCannotContainTheHole); | |
830 } | |
831 | |
832 Counters* counters = isolate()->counters(); | |
833 __ IncrementCounter(counters->named_load_global_stub(), 1); | |
834 __ ret(0); | |
835 | |
836 FrontendFooter(name, &miss); | |
837 | |
838 // Return the generated code. | |
839 return GetCode(kind(), Code::NORMAL, name); | |
840 } | |
841 | |
842 | |
843 Handle<Code> PropertyICCompiler::CompilePolymorphic(TypeHandleList* types, | 71 Handle<Code> PropertyICCompiler::CompilePolymorphic(TypeHandleList* types, |
844 CodeHandleList* handlers, | 72 CodeHandleList* handlers, |
845 Handle<Name> name, | 73 Handle<Name> name, |
846 Code::StubType type, | 74 Code::StubType type, |
847 IcCheckType check) { | 75 IcCheckType check) { |
848 Label miss; | 76 Label miss; |
849 | 77 |
850 if (check == PROPERTY && | 78 if (check == PROPERTY && |
851 (kind() == Code::KEYED_LOAD_IC || kind() == Code::KEYED_STORE_IC)) { | 79 (kind() == Code::KEYED_LOAD_IC || kind() == Code::KEYED_STORE_IC)) { |
852 // In case we are compiling an IC for dictionary loads and stores, just | 80 // In case we are compiling an IC for dictionary loads and stores, just |
(...skipping 37 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
890 TailCallBuiltin(masm(), MissBuiltin(kind())); | 118 TailCallBuiltin(masm(), MissBuiltin(kind())); |
891 | 119 |
892 // Return the generated code. | 120 // Return the generated code. |
893 InlineCacheState state = | 121 InlineCacheState state = |
894 number_of_handled_maps > 1 ? POLYMORPHIC : MONOMORPHIC; | 122 number_of_handled_maps > 1 ? POLYMORPHIC : MONOMORPHIC; |
895 return GetCode(kind(), type, name, state); | 123 return GetCode(kind(), type, name, state); |
896 } | 124 } |
897 | 125 |
898 | 126 |
899 #undef __ | 127 #undef __ |
900 #define __ ACCESS_MASM(masm) | |
901 | |
902 | |
903 void ElementHandlerCompiler::GenerateLoadDictionaryElement( | |
904 MacroAssembler* masm) { | |
905 // ----------- S t a t e ------------- | |
906 // -- rcx : key | |
907 // -- rdx : receiver | |
908 // -- rsp[0] : return address | |
909 // ----------------------------------- | |
910 DCHECK(rdx.is(LoadIC::ReceiverRegister())); | |
911 DCHECK(rcx.is(LoadIC::NameRegister())); | |
912 Label slow, miss; | |
913 | |
914 // This stub is meant to be tail-jumped to, the receiver must already | |
915 // have been verified by the caller to not be a smi. | |
916 | |
917 __ JumpIfNotSmi(rcx, &miss); | |
918 __ SmiToInteger32(rbx, rcx); | |
919 __ movp(rax, FieldOperand(rdx, JSObject::kElementsOffset)); | |
920 | |
921 // Check whether the elements is a number dictionary. | |
922 // rdx: receiver | |
923 // rcx: key | |
924 // rbx: key as untagged int32 | |
925 // rax: elements | |
926 __ LoadFromNumberDictionary(&slow, rax, rcx, rbx, r9, rdi, rax); | |
927 __ ret(0); | |
928 | |
929 __ bind(&slow); | |
930 // ----------- S t a t e ------------- | |
931 // -- rcx : key | |
932 // -- rdx : receiver | |
933 // -- rsp[0] : return address | |
934 // ----------------------------------- | |
935 TailCallBuiltin(masm, Builtins::kKeyedLoadIC_Slow); | |
936 | |
937 __ bind(&miss); | |
938 // ----------- S t a t e ------------- | |
939 // -- rcx : key | |
940 // -- rdx : receiver | |
941 // -- rsp[0] : return address | |
942 // ----------------------------------- | |
943 TailCallBuiltin(masm, Builtins::kKeyedLoadIC_Miss); | |
944 } | |
945 | |
946 | |
947 void PropertyICCompiler::GenerateRuntimeSetProperty(MacroAssembler* masm, | |
948 StrictMode strict_mode) { | |
949 // Return address is on the stack. | |
950 DCHECK(!rbx.is(StoreIC::ReceiverRegister()) && | |
951 !rbx.is(StoreIC::NameRegister()) && !rbx.is(StoreIC::ValueRegister())); | |
952 | |
953 __ PopReturnAddressTo(rbx); | |
954 __ Push(StoreIC::ReceiverRegister()); | |
955 __ Push(StoreIC::NameRegister()); | |
956 __ Push(StoreIC::ValueRegister()); | |
957 __ Push(Smi::FromInt(strict_mode)); | |
958 __ PushReturnAddressFrom(rbx); | |
959 | |
960 // Do tail-call to runtime routine. | |
961 __ TailCallRuntime(Runtime::kSetProperty, 4, 1); | |
962 } | |
963 | |
964 | |
965 #undef __ | |
966 } | 128 } |
967 } // namespace v8::internal | 129 } // namespace v8::internal |
968 | 130 |
969 #endif // V8_TARGET_ARCH_X64 | 131 #endif // V8_TARGET_ARCH_X64 |
OLD | NEW |