Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(102)

Side by Side Diff: src/ic/arm/handler-compiler-arm.cc

Issue 965723002: Ensure we can reliably check the cell for validity of global property (Closed) Base URL: https://chromium.googlesource.com/v8/v8.git@master
Patch Set: Created 5 years, 9 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View unified diff | Download patch
« no previous file with comments | « src/deoptimizer.h ('k') | src/ic/arm64/handler-compiler-arm64.cc » ('j') | no next file with comments »
Toggle Intra-line Diffs ('i') | Expand Comments ('e') | Collapse Comments ('c') | Show Comments Hide Comments ('s')
OLDNEW
1 // Copyright 2014 the V8 project authors. All rights reserved. 1 // Copyright 2014 the V8 project authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style license that can be 2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file. 3 // found in the LICENSE file.
4 4
5 #include "src/v8.h" 5 #include "src/v8.h"
6 6
7 #if V8_TARGET_ARCH_ARM 7 #if V8_TARGET_ARCH_ARM
8 8
9 #include "src/ic/call-optimization.h" 9 #include "src/ic/call-optimization.h"
10 #include "src/ic/handler-compiler.h" 10 #include "src/ic/handler-compiler.h"
(...skipping 480 matching lines...) Expand 10 before | Expand all | Expand 10 after
491 // Go to the next object in the prototype chain. 491 // Go to the next object in the prototype chain.
492 current = prototype; 492 current = prototype;
493 current_map = handle(current->map()); 493 current_map = handle(current->map());
494 } 494 }
495 495
496 DCHECK(!current_map->IsJSGlobalProxyMap()); 496 DCHECK(!current_map->IsJSGlobalProxyMap());
497 497
498 // Log the check depth. 498 // Log the check depth.
499 LOG(isolate(), IntEvent("check-maps-depth", depth + 1)); 499 LOG(isolate(), IntEvent("check-maps-depth", depth + 1));
500 500
501 if (depth != 0 || check == CHECK_ALL_MAPS) { 501 if (!current_map->IsJSGlobalObjectMap() &&
502 (depth != 0 || check == CHECK_ALL_MAPS)) {
502 // Check the holder map. 503 // Check the holder map.
503 __ ldr(scratch1, FieldMemOperand(reg, HeapObject::kMapOffset)); 504 __ ldr(scratch1, FieldMemOperand(reg, HeapObject::kMapOffset));
504 Handle<WeakCell> cell = Map::WeakCellForMap(current_map); 505 Handle<WeakCell> cell = Map::WeakCellForMap(current_map);
505 __ CmpWeakValue(scratch1, cell, scratch2); 506 __ CmpWeakValue(scratch1, cell, scratch2);
506 __ b(ne, miss); 507 __ b(ne, miss);
507 } 508 }
508 509
509 // Return the register containing the holder. 510 // Return the register containing the holder.
510 return reg; 511 return reg;
511 } 512 }
(...skipping 198 matching lines...) Expand 10 before | Expand all | Expand 10 after
710 return GetCode(kind(), Code::FAST, name); 711 return GetCode(kind(), Code::FAST, name);
711 } 712 }
712 713
713 714
714 Register NamedStoreHandlerCompiler::value() { 715 Register NamedStoreHandlerCompiler::value() {
715 return StoreDescriptor::ValueRegister(); 716 return StoreDescriptor::ValueRegister();
716 } 717 }
717 718
718 719
719 Handle<Code> NamedLoadHandlerCompiler::CompileLoadGlobal( 720 Handle<Code> NamedLoadHandlerCompiler::CompileLoadGlobal(
720 Handle<PropertyCell> cell, Handle<Name> name, bool is_configurable) { 721 Handle<PropertyCell> cell, Handle<Name> name) {
721 Label miss; 722 Label miss;
722 if (IC::ICUseVector(kind())) { 723 if (IC::ICUseVector(kind())) {
723 PushVectorAndSlot(); 724 PushVectorAndSlot();
724 } 725 }
725 FrontendHeader(receiver(), name, &miss); 726 FrontendHeader(receiver(), name, &miss);
726 727
727 // Get the value from the cell. 728 // Get the value from the cell.
728 Register result = StoreDescriptor::ValueRegister(); 729 Register result = StoreDescriptor::ValueRegister();
729 Handle<WeakCell> weak_cell = factory()->NewWeakCell(cell); 730 Handle<WeakCell> weak_cell = factory()->NewWeakCell(cell);
730 __ LoadWeakValue(result, weak_cell, &miss); 731 __ LoadWeakValue(result, weak_cell, &miss);
731 __ ldr(result, FieldMemOperand(result, Cell::kValueOffset)); 732 __ ldr(result, FieldMemOperand(result, Cell::kValueOffset));
732 733
733 // Check for deleted property if property can actually be deleted. 734 __ LoadRoot(ip, Heap::kTheHoleValueRootIndex);
734 if (is_configurable) { 735 __ cmp(result, ip);
735 __ LoadRoot(ip, Heap::kTheHoleValueRootIndex); 736 __ b(eq, &miss);
736 __ cmp(result, ip);
737 __ b(eq, &miss);
738 }
739 737
740 Counters* counters = isolate()->counters(); 738 Counters* counters = isolate()->counters();
741 __ IncrementCounter(counters->named_load_global_stub(), 1, r1, r3); 739 __ IncrementCounter(counters->named_load_global_stub(), 1, r1, r3);
742 if (IC::ICUseVector(kind())) { 740 if (IC::ICUseVector(kind())) {
743 DiscardVectorAndSlot(); 741 DiscardVectorAndSlot();
744 } 742 }
745 __ Ret(); 743 __ Ret();
746 744
747 FrontendFooter(name, &miss); 745 FrontendFooter(name, &miss);
748 746
749 // Return the generated code. 747 // Return the generated code.
750 return GetCode(kind(), Code::NORMAL, name); 748 return GetCode(kind(), Code::NORMAL, name);
751 } 749 }
752 750
753 751
754 #undef __ 752 #undef __
755 } 753 }
756 } // namespace v8::internal 754 } // namespace v8::internal
757 755
758 #endif // V8_TARGET_ARCH_ARM 756 #endif // V8_TARGET_ARCH_ARM
OLDNEW
« no previous file with comments | « src/deoptimizer.h ('k') | src/ic/arm64/handler-compiler-arm64.cc » ('j') | no next file with comments »

Powered by Google App Engine
This is Rietveld 408576698