Add map-based read barrier to WeakCell

src/ia32/lithium-codegen-ia32.cc

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/v8.h"
 
 #if V8_TARGET_ARCH_IA32
 
 #include "src/base/bits.h"
 #include "src/code-factory.h"
@@ skipping 2945 matching lines @@
 
   __ bind(&skip_assignment);
 }
 
 
 void LCodeGen::DoLoadNamedField(LLoadNamedField* instr) {
   HObjectAccess access = instr->hydrogen()->access();
   int offset = access.offset();
 
   if (access.IsExternalMemory()) {
+    DCHECK(!access.read_barrier());
     Register result = ToRegister(instr->result());
     MemOperand operand = instr->object()->IsConstantOperand()
         ? MemOperand::StaticVariable(ToExternalReference(
                 LConstantOperand::cast(instr->object())))
         : MemOperand(ToRegister(instr->object()), offset);
     __ Load(result, operand, access.representation());
     return;
   }
 
   Register object = ToRegister(instr->object());
   if (instr->hydrogen()->representation().IsDouble()) {
+    DCHECK(!access.read_barrier());
     XMMRegister result = ToDoubleRegister(instr->result());
     __ movsd(result, FieldOperand(object, offset));
     return;
   }
 
   Register result = ToRegister(instr->result());
   if (!access.IsInobject()) {
+    DCHECK(!access.read_barrier());
     __ mov(result, FieldOperand(object, JSObject::kPropertiesOffset));
     object = result;
   }
+  if (access.read_barrier()) {
+    DCHECK(!result.is(object));
+    DCHECK(instr->hydrogen()->representation().IsTagged());
+    // Read barrier: Change the map to show we used the weak cell.
+    __ LoadHeapObject(result, factory()->used_weak_cell_map());
+    __ mov(result, FieldOperand(object, HeapObject::kMapOffset));

[ulan, 2015/02/04 09:35:04]

__ mov(FieldOperand(object, HeapObject::kMapOffset), result);

[Erik Corry, 2015/02/04 10:49:42]

This is intended to be a store, not a load.

[ulan, 2015/02/04 11:08:10]

Yep. The destination of the mov is the first argument :)
https://code.google.com/p/chromium/codesearch#chromium/src/v8/src/ia32/assemb...

+  }
   __ Load(result, FieldOperand(object, offset), access.representation());
 }
 
 
 void LCodeGen::EmitPushTaggedOperand(LOperand* operand) {
   DCHECK(!operand->IsDoubleRegister());
   if (operand->IsConstantOperand()) {
     Handle<Object> object = ToHandle(LConstantOperand::cast(operand));
     AllowDeferredHandleDereference smi_check;
     if (object->IsSmi()) {
@@ skipping 2775 matching lines @@
   CallRuntime(Runtime::kPushBlockContext, 2, instr);
   RecordSafepoint(Safepoint::kNoLazyDeopt);
 }
 
 
 #undef __
 
 } }  // namespace v8::internal
 
 #endif  // V8_TARGET_ARCH_IA32