Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(1)

Side by Side Diff: src/x64/stub-cache-x64.cc

Issue 57433003: Add missing negative dictionary lookup to NonexistentHandlerFrontend (Closed) Base URL: https://v8.googlecode.com/svn/branches/bleeding_edge
Patch Set: also upload test case Created 7 years, 1 month ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View unified diff | Download patch | Annotate | Revision Log
« no previous file with comments | « src/stub-cache.cc ('k') | test/mjsunit/regress/regress-2980.js » ('j') | no next file with comments »
Toggle Intra-line Diffs ('i') | Expand Comments ('e') | Collapse Comments ('c') | Show Comments Hide Comments ('s')
OLDNEW
1 // Copyright 2012 the V8 project authors. All rights reserved. 1 // Copyright 2012 the V8 project authors. All rights reserved.
2 // Redistribution and use in source and binary forms, with or without 2 // Redistribution and use in source and binary forms, with or without
3 // modification, are permitted provided that the following conditions are 3 // modification, are permitted provided that the following conditions are
4 // met: 4 // met:
5 // 5 //
6 // * Redistributions of source code must retain the above copyright 6 // * Redistributions of source code must retain the above copyright
7 // notice, this list of conditions and the following disclaimer. 7 // notice, this list of conditions and the following disclaimer.
8 // * Redistributions in binary form must reproduce the above 8 // * Redistributions in binary form must reproduce the above
9 // copyright notice, this list of conditions and the following 9 // copyright notice, this list of conditions and the following
10 // disclaimer in the documentation and/or other materials provided 10 // disclaimer in the documentation and/or other materials provided
(...skipping 89 matching lines...) Expand 10 before | Expand all | Expand 10 after
100 #endif 100 #endif
101 101
102 // Jump to the first instruction in the code stub. 102 // Jump to the first instruction in the code stub.
103 __ addq(kScratchRegister, Immediate(Code::kHeaderSize - kHeapObjectTag)); 103 __ addq(kScratchRegister, Immediate(Code::kHeaderSize - kHeapObjectTag));
104 __ jmp(kScratchRegister); 104 __ jmp(kScratchRegister);
105 105
106 __ bind(&miss); 106 __ bind(&miss);
107 } 107 }
108 108
109 109
110 // Helper function used to check that the dictionary doesn't contain 110 void StubCompiler::GenerateDictionaryNegativeLookup(MacroAssembler* masm,
111 // the property. This function may return false negatives, so miss_label 111 Label* miss_label,
112 // must always call a backup property check that is complete. 112 Register receiver,
113 // This function is safe to call if the receiver has fast properties. 113 Handle<Name> name,
114 // Name must be unique and receiver must be a heap object. 114 Register scratch0,
115 static void GenerateDictionaryNegativeLookup(MacroAssembler* masm, 115 Register scratch1) {
116 Label* miss_label,
117 Register receiver,
118 Handle<Name> name,
119 Register r0,
120 Register r1) {
121 ASSERT(name->IsUniqueName()); 116 ASSERT(name->IsUniqueName());
117 ASSERT(!receiver.is(scratch0));
122 Counters* counters = masm->isolate()->counters(); 118 Counters* counters = masm->isolate()->counters();
123 __ IncrementCounter(counters->negative_lookups(), 1); 119 __ IncrementCounter(counters->negative_lookups(), 1);
124 __ IncrementCounter(counters->negative_lookups_miss(), 1); 120 __ IncrementCounter(counters->negative_lookups_miss(), 1);
125 121
126 __ movq(r0, FieldOperand(receiver, HeapObject::kMapOffset)); 122 __ movq(scratch0, FieldOperand(receiver, HeapObject::kMapOffset));
127 123
128 const int kInterceptorOrAccessCheckNeededMask = 124 const int kInterceptorOrAccessCheckNeededMask =
129 (1 << Map::kHasNamedInterceptor) | (1 << Map::kIsAccessCheckNeeded); 125 (1 << Map::kHasNamedInterceptor) | (1 << Map::kIsAccessCheckNeeded);
130 126
131 // Bail out if the receiver has a named interceptor or requires access checks. 127 // Bail out if the receiver has a named interceptor or requires access checks.
132 __ testb(FieldOperand(r0, Map::kBitFieldOffset), 128 __ testb(FieldOperand(scratch0, Map::kBitFieldOffset),
133 Immediate(kInterceptorOrAccessCheckNeededMask)); 129 Immediate(kInterceptorOrAccessCheckNeededMask));
134 __ j(not_zero, miss_label); 130 __ j(not_zero, miss_label);
135 131
136 // Check that receiver is a JSObject. 132 // Check that receiver is a JSObject.
137 __ CmpInstanceType(r0, FIRST_SPEC_OBJECT_TYPE); 133 __ CmpInstanceType(scratch0, FIRST_SPEC_OBJECT_TYPE);
138 __ j(below, miss_label); 134 __ j(below, miss_label);
139 135
140 // Load properties array. 136 // Load properties array.
141 Register properties = r0; 137 Register properties = scratch0;
142 __ movq(properties, FieldOperand(receiver, JSObject::kPropertiesOffset)); 138 __ movq(properties, FieldOperand(receiver, JSObject::kPropertiesOffset));
143 139
144 // Check that the properties array is a dictionary. 140 // Check that the properties array is a dictionary.
145 __ CompareRoot(FieldOperand(properties, HeapObject::kMapOffset), 141 __ CompareRoot(FieldOperand(properties, HeapObject::kMapOffset),
146 Heap::kHashTableMapRootIndex); 142 Heap::kHashTableMapRootIndex);
147 __ j(not_equal, miss_label); 143 __ j(not_equal, miss_label);
148 144
149 Label done; 145 Label done;
150 NameDictionaryLookupStub::GenerateNegativeLookup(masm, 146 NameDictionaryLookupStub::GenerateNegativeLookup(masm,
151 miss_label, 147 miss_label,
152 &done, 148 &done,
153 properties, 149 properties,
154 name, 150 name,
155 r1); 151 scratch1);
156 __ bind(&done); 152 __ bind(&done);
157 __ DecrementCounter(counters->negative_lookups_miss(), 1); 153 __ DecrementCounter(counters->negative_lookups_miss(), 1);
158 } 154 }
159 155
160 156
161 void StubCache::GenerateProbe(MacroAssembler* masm, 157 void StubCache::GenerateProbe(MacroAssembler* masm,
162 Code::Flags flags, 158 Code::Flags flags,
163 Register receiver, 159 Register receiver,
164 Register name, 160 Register name,
165 Register scratch, 161 Register scratch,
(...skipping 604 matching lines...) Expand 10 before | Expand all | Expand 10 after
770 void StoreStubCompiler::GenerateRestoreName(MacroAssembler* masm, 766 void StoreStubCompiler::GenerateRestoreName(MacroAssembler* masm,
771 Label* label, 767 Label* label,
772 Handle<Name> name) { 768 Handle<Name> name) {
773 if (!label->is_unused()) { 769 if (!label->is_unused()) {
774 __ bind(label); 770 __ bind(label);
775 __ Move(this->name(), name); 771 __ Move(this->name(), name);
776 } 772 }
777 } 773 }
778 774
779 775
780 // Generate code to check that a global property cell is empty. Create 776 void StubCompiler::GenerateCheckPropertyCell(MacroAssembler* masm,
781 // the property cell at compilation time if no cell exists for the 777 Handle<GlobalObject> global,
782 // property. 778 Handle<Name> name,
783 static void GenerateCheckPropertyCell(MacroAssembler* masm, 779 Register scratch,
784 Handle<GlobalObject> global, 780 Label* miss) {
785 Handle<Name> name,
786 Register scratch,
787 Label* miss) {
788 Handle<PropertyCell> cell = 781 Handle<PropertyCell> cell =
789 GlobalObject::EnsurePropertyCell(global, name); 782 GlobalObject::EnsurePropertyCell(global, name);
790 ASSERT(cell->value()->IsTheHole()); 783 ASSERT(cell->value()->IsTheHole());
791 __ Move(scratch, cell); 784 __ Move(scratch, cell);
792 __ Cmp(FieldOperand(scratch, Cell::kValueOffset), 785 __ Cmp(FieldOperand(scratch, Cell::kValueOffset),
793 masm->isolate()->factory()->the_hole_value()); 786 masm->isolate()->factory()->the_hole_value());
794 __ j(not_equal, miss); 787 __ j(not_equal, miss);
795 } 788 }
796 789
797 790
(...skipping 249 matching lines...) Expand 10 before | Expand all | Expand 10 after
1047 EMIT_REMEMBERED_SET, smi_check); 1040 EMIT_REMEMBERED_SET, smi_check);
1048 } 1041 }
1049 } 1042 }
1050 1043
1051 // Return the value (register rax). 1044 // Return the value (register rax).
1052 ASSERT(value_reg.is(rax)); 1045 ASSERT(value_reg.is(rax));
1053 __ ret(0); 1046 __ ret(0);
1054 } 1047 }
1055 1048
1056 1049
1057 // Calls GenerateCheckPropertyCell for each global object in the prototype chain 1050 void StubCompiler::GenerateCheckPropertyCells(MacroAssembler* masm,
1058 // from object to (but not including) holder. 1051 Handle<JSObject> object,
1059 static void GenerateCheckPropertyCells(MacroAssembler* masm, 1052 Handle<JSObject> holder,
1060 Handle<JSObject> object, 1053 Handle<Name> name,
1061 Handle<JSObject> holder, 1054 Register scratch,
1062 Handle<Name> name, 1055 Label* miss) {
1063 Register scratch,
1064 Label* miss) {
1065 Handle<JSObject> current = object; 1056 Handle<JSObject> current = object;
1066 while (!current.is_identical_to(holder)) { 1057 while (!current.is_identical_to(holder)) {
1067 if (current->IsGlobalObject()) { 1058 if (current->IsGlobalObject()) {
1068 GenerateCheckPropertyCell(masm, 1059 GenerateCheckPropertyCell(masm,
1069 Handle<GlobalObject>::cast(current), 1060 Handle<GlobalObject>::cast(current),
1070 name, 1061 name,
1071 scratch, 1062 scratch,
1072 miss); 1063 miss);
1073 } 1064 }
1074 current = Handle<JSObject>(JSObject::cast(current->GetPrototype())); 1065 current = Handle<JSObject>(JSObject::cast(current->GetPrototype()));
(...skipping 200 matching lines...) Expand 10 before | Expand all | Expand 10 after
1275 __ movq(scratch3(), callback, RelocInfo::EMBEDDED_OBJECT); 1266 __ movq(scratch3(), callback, RelocInfo::EMBEDDED_OBJECT);
1276 __ cmpq(scratch2(), scratch3()); 1267 __ cmpq(scratch2(), scratch3());
1277 __ j(not_equal, &miss); 1268 __ j(not_equal, &miss);
1278 } 1269 }
1279 1270
1280 HandlerFrontendFooter(name, success, &miss); 1271 HandlerFrontendFooter(name, success, &miss);
1281 return reg; 1272 return reg;
1282 } 1273 }
1283 1274
1284 1275
1285 void LoadStubCompiler::NonexistentHandlerFrontend(
1286 Handle<JSObject> object,
1287 Handle<JSObject> last,
1288 Handle<Name> name,
1289 Label* success,
1290 Handle<GlobalObject> global) {
1291 Label miss;
1292
1293 HandlerFrontendHeader(object, receiver(), last, name, &miss);
1294
1295 // If the last object in the prototype chain is a global object,
1296 // check that the global property cell is empty.
1297 if (!global.is_null()) {
1298 GenerateCheckPropertyCell(masm(), global, name, scratch2(), &miss);
1299 }
1300
1301 HandlerFrontendFooter(name, success, &miss);
1302 }
1303
1304
1305 void LoadStubCompiler::GenerateLoadField(Register reg, 1276 void LoadStubCompiler::GenerateLoadField(Register reg,
1306 Handle<JSObject> holder, 1277 Handle<JSObject> holder,
1307 PropertyIndex field, 1278 PropertyIndex field,
1308 Representation representation) { 1279 Representation representation) {
1309 if (!reg.is(receiver())) __ movq(receiver(), reg); 1280 if (!reg.is(receiver())) __ movq(receiver(), reg);
1310 if (kind() == Code::LOAD_IC) { 1281 if (kind() == Code::LOAD_IC) {
1311 LoadFieldStub stub(field.is_inobject(holder), 1282 LoadFieldStub stub(field.is_inobject(holder),
1312 field.translate(holder), 1283 field.translate(holder),
1313 representation); 1284 representation);
1314 GenerateTailCall(masm(), stub.GetCode(isolate())); 1285 GenerateTailCall(masm(), stub.GetCode(isolate()));
1315 } else { 1286 } else {
1316 KeyedLoadFieldStub stub(field.is_inobject(holder), 1287 KeyedLoadFieldStub stub(field.is_inobject(holder),
1317 field.translate(holder), 1288 field.translate(holder),
1318 representation); 1289 representation);
(...skipping 1860 matching lines...) Expand 10 before | Expand all | Expand 10 after
3179 // ----------------------------------- 3150 // -----------------------------------
3180 TailCallBuiltin(masm, Builtins::kKeyedLoadIC_MissForceGeneric); 3151 TailCallBuiltin(masm, Builtins::kKeyedLoadIC_MissForceGeneric);
3181 } 3152 }
3182 3153
3183 3154
3184 #undef __ 3155 #undef __
3185 3156
3186 } } // namespace v8::internal 3157 } } // namespace v8::internal
3187 3158
3188 #endif // V8_TARGET_ARCH_X64 3159 #endif // V8_TARGET_ARCH_X64
OLDNEW
« no previous file with comments | « src/stub-cache.cc ('k') | test/mjsunit/regress/regress-2980.js » ('j') | no next file with comments »

Powered by Google App Engine
This is Rietveld 408576698