Add map-based read barrier to WeakCell

src/ia32/lithium-codegen-ia32.cc

Index: src/ia32/lithium-codegen-ia32.cc
diff --git a/src/ia32/lithium-codegen-ia32.cc b/src/ia32/lithium-codegen-ia32.cc
index 854e5edfb1a98e1b20d7f4166c08d864cc141275..f4d410ca100f68dc308cd215d6733f699a87330d 100644
--- a/src/ia32/lithium-codegen-ia32.cc
+++ b/src/ia32/lithium-codegen-ia32.cc
@@ -2963,6 +2963,7 @@ void LCodeGen::DoLoadNamedField(LLoadNamedField* instr) {
   int offset = access.offset();
 
   if (access.IsExternalMemory()) {
+    DCHECK(!access.read_barrier());
     Register result = ToRegister(instr->result());
     MemOperand operand = instr->object()->IsConstantOperand()
         ? MemOperand::StaticVariable(ToExternalReference(
@@ -2974,6 +2975,7 @@ void LCodeGen::DoLoadNamedField(LLoadNamedField* instr) {
 
   Register object = ToRegister(instr->object());
   if (instr->hydrogen()->representation().IsDouble()) {
+    DCHECK(!access.read_barrier());
     XMMRegister result = ToDoubleRegister(instr->result());
     __ movsd(result, FieldOperand(object, offset));
     return;
@@ -2981,9 +2983,17 @@ void LCodeGen::DoLoadNamedField(LLoadNamedField* instr) {
 
   Register result = ToRegister(instr->result());
   if (!access.IsInobject()) {
+    DCHECK(!access.read_barrier());
     __ mov(result, FieldOperand(object, JSObject::kPropertiesOffset));
     object = result;
   }
+  if (access.read_barrier()) {
+    DCHECK(!result.is(object));
+    DCHECK(instr->hydrogen()->representation().IsTagged());
+    // Read barrier: Change the map to show we used the weak cell.
+    __ LoadHeapObject(result, factory()->used_weak_cell_map());
+    __ mov(result, FieldOperand(object, HeapObject::kMapOffset));

[ulan, 2015/02/04 09:35:04]

__ mov(FieldOperand(object, HeapObject::kMapOffset), result);

[Erik Corry, 2015/02/04 10:49:42]

This is intended to be a store, not a load.

[ulan, 2015/02/04 11:08:10]

Yep. The destination of the mov is the first argument :)
https://code.google.com/p/chromium/codesearch#chromium/src/v8/src/ia32/assemb...

+  }
   __ Load(result, FieldOperand(object, offset), access.representation());
 }