// Copyright 2012 the V8 project authors. All rights reserved. // Use of this source code is governed by a BSD-style license that can be // found in the LICENSE file. #include "src/v8.h" #if V8_TARGET_ARCH_IA32 #include "src/ic-inl.h" #include "src/codegen.h" #include "src/stub-cache.h" namespace v8 { namespace internal { #define __ ACCESS_MASM(masm) static void ProbeTable(Isolate* isolate, MacroAssembler* masm, Code::Flags flags, StubCache::Table table, Register name, Register receiver, // Number of the cache entry pointer-size scaled. Register offset, Register extra) { ExternalReference key_offset(isolate->stub_cache()->key_reference(table)); ExternalReference value_offset(isolate->stub_cache()->value_reference(table)); ExternalReference map_offset(isolate->stub_cache()->map_reference(table)); Label miss; // Multiply by 3 because there are 3 fields per entry (name, code, map). __ lea(offset, Operand(offset, offset, times_2, 0)); if (extra.is_valid()) { // Get the code entry from the cache. __ mov(extra, Operand::StaticArray(offset, times_1, value_offset)); // Check that the key in the entry matches the name. __ cmp(name, Operand::StaticArray(offset, times_1, key_offset)); __ j(not_equal, &miss); // Check the map matches. __ mov(offset, Operand::StaticArray(offset, times_1, map_offset)); __ cmp(offset, FieldOperand(receiver, HeapObject::kMapOffset)); __ j(not_equal, &miss); // Check that the flags match what we're looking for. __ mov(offset, FieldOperand(extra, Code::kFlagsOffset)); __ and_(offset, ~Code::kFlagsNotUsedInLookup); __ cmp(offset, flags); __ j(not_equal, &miss); #ifdef DEBUG if (FLAG_test_secondary_stub_cache && table == StubCache::kPrimary) { __ jmp(&miss); } else if (FLAG_test_primary_stub_cache && table == StubCache::kSecondary) { __ jmp(&miss); } #endif // Jump to the first instruction in the code stub. __ add(extra, Immediate(Code::kHeaderSize - kHeapObjectTag)); __ jmp(extra); __ bind(&miss); } else { // Save the offset on the stack. __ push(offset); // Check that the key in the entry matches the name. __ cmp(name, Operand::StaticArray(offset, times_1, key_offset)); __ j(not_equal, &miss); // Check the map matches. __ mov(offset, Operand::StaticArray(offset, times_1, map_offset)); __ cmp(offset, FieldOperand(receiver, HeapObject::kMapOffset)); __ j(not_equal, &miss); // Restore offset register. __ mov(offset, Operand(esp, 0)); // Get the code entry from the cache. __ mov(offset, Operand::StaticArray(offset, times_1, value_offset)); // Check that the flags match what we're looking for. __ mov(offset, FieldOperand(offset, Code::kFlagsOffset)); __ and_(offset, ~Code::kFlagsNotUsedInLookup); __ cmp(offset, flags); __ j(not_equal, &miss); #ifdef DEBUG if (FLAG_test_secondary_stub_cache && table == StubCache::kPrimary) { __ jmp(&miss); } else if (FLAG_test_primary_stub_cache && table == StubCache::kSecondary) { __ jmp(&miss); } #endif // Restore offset and re-load code entry from cache. __ pop(offset); __ mov(offset, Operand::StaticArray(offset, times_1, value_offset)); // Jump to the first instruction in the code stub. __ add(offset, Immediate(Code::kHeaderSize - kHeapObjectTag)); __ jmp(offset); // Pop at miss. __ bind(&miss); __ pop(offset); } } void StubCompiler::GenerateDictionaryNegativeLookup(MacroAssembler* masm, Label* miss_label, Register receiver, Handle name, Register scratch0, Register scratch1) { ASSERT(name->IsUniqueName()); ASSERT(!receiver.is(scratch0)); Counters* counters = masm->isolate()->counters(); __ IncrementCounter(counters->negative_lookups(), 1); __ IncrementCounter(counters->negative_lookups_miss(), 1); __ mov(scratch0, FieldOperand(receiver, HeapObject::kMapOffset)); const int kInterceptorOrAccessCheckNeededMask = (1 << Map::kHasNamedInterceptor) | (1 << Map::kIsAccessCheckNeeded); // Bail out if the receiver has a named interceptor or requires access checks. __ test_b(FieldOperand(scratch0, Map::kBitFieldOffset), kInterceptorOrAccessCheckNeededMask); __ j(not_zero, miss_label); // Check that receiver is a JSObject. __ CmpInstanceType(scratch0, FIRST_SPEC_OBJECT_TYPE); __ j(below, miss_label); // Load properties array. Register properties = scratch0; __ mov(properties, FieldOperand(receiver, JSObject::kPropertiesOffset)); // Check that the properties array is a dictionary. __ cmp(FieldOperand(properties, HeapObject::kMapOffset), Immediate(masm->isolate()->factory()->hash_table_map())); __ j(not_equal, miss_label); Label done; NameDictionaryLookupStub::GenerateNegativeLookup(masm, miss_label, &done, properties, name, scratch1); __ bind(&done); __ DecrementCounter(counters->negative_lookups_miss(), 1); } void StubCache::GenerateProbe(MacroAssembler* masm, Code::Flags flags, Register receiver, Register name, Register scratch, Register extra, Register extra2, Register extra3) { Label miss; // Assert that code is valid. The multiplying code relies on the entry size // being 12. ASSERT(sizeof(Entry) == 12); // Assert the flags do not name a specific type. ASSERT(Code::ExtractTypeFromFlags(flags) == 0); // Assert that there are no register conflicts. ASSERT(!scratch.is(receiver)); ASSERT(!scratch.is(name)); ASSERT(!extra.is(receiver)); ASSERT(!extra.is(name)); ASSERT(!extra.is(scratch)); // Assert scratch and extra registers are valid, and extra2/3 are unused. ASSERT(!scratch.is(no_reg)); ASSERT(extra2.is(no_reg)); ASSERT(extra3.is(no_reg)); Register offset = scratch; scratch = no_reg; Counters* counters = masm->isolate()->counters(); __ IncrementCounter(counters->megamorphic_stub_cache_probes(), 1); // Check that the receiver isn't a smi. __ JumpIfSmi(receiver, &miss); // Get the map of the receiver and compute the hash. __ mov(offset, FieldOperand(name, Name::kHashFieldOffset)); __ add(offset, FieldOperand(receiver, HeapObject::kMapOffset)); __ xor_(offset, flags); // We mask out the last two bits because they are not part of the hash and // they are always 01 for maps. Also in the two 'and' instructions below. __ and_(offset, (kPrimaryTableSize - 1) << kHeapObjectTagSize); // ProbeTable expects the offset to be pointer scaled, which it is, because // the heap object tag size is 2 and the pointer size log 2 is also 2. ASSERT(kHeapObjectTagSize == kPointerSizeLog2); // Probe the primary table. ProbeTable(isolate(), masm, flags, kPrimary, name, receiver, offset, extra); // Primary miss: Compute hash for secondary probe. __ mov(offset, FieldOperand(name, Name::kHashFieldOffset)); __ add(offset, FieldOperand(receiver, HeapObject::kMapOffset)); __ xor_(offset, flags); __ and_(offset, (kPrimaryTableSize - 1) << kHeapObjectTagSize); __ sub(offset, name); __ add(offset, Immediate(flags)); __ and_(offset, (kSecondaryTableSize - 1) << kHeapObjectTagSize); // Probe the secondary table. ProbeTable( isolate(), masm, flags, kSecondary, name, receiver, offset, extra); // Cache miss: Fall-through and let caller handle the miss by // entering the runtime system. __ bind(&miss); __ IncrementCounter(counters->megamorphic_stub_cache_misses(), 1); } void StubCompiler::GenerateLoadGlobalFunctionPrototype(MacroAssembler* masm, int index, Register prototype) { __ LoadGlobalFunction(index, prototype); __ LoadGlobalFunctionInitialMap(prototype, prototype); // Load the prototype from the initial map. __ mov(prototype, FieldOperand(prototype, Map::kPrototypeOffset)); } void StubCompiler::GenerateDirectLoadGlobalFunctionPrototype( MacroAssembler* masm, int index, Register prototype, Label* miss) { // Get the global function with the given index. Handle function( JSFunction::cast(masm->isolate()->native_context()->get(index))); // Check we're still in the same context. Register scratch = prototype; const int offset = Context::SlotOffset(Context::GLOBAL_OBJECT_INDEX); __ mov(scratch, Operand(esi, offset)); __ mov(scratch, FieldOperand(scratch, GlobalObject::kNativeContextOffset)); __ cmp(Operand(scratch, Context::SlotOffset(index)), function); __ j(not_equal, miss); // Load its initial map. The global functions all have initial maps. __ Move(prototype, Immediate(Handle(function->initial_map()))); // Load the prototype from the initial map. __ mov(prototype, FieldOperand(prototype, Map::kPrototypeOffset)); } void StubCompiler::GenerateLoadArrayLength(MacroAssembler* masm, Register receiver, Register scratch, Label* miss_label) { // Check that the receiver isn't a smi. __ JumpIfSmi(receiver, miss_label); // Check that the object is a JS array. __ CmpObjectType(receiver, JS_ARRAY_TYPE, scratch); __ j(not_equal, miss_label); // Load length directly from the JS array. __ mov(eax, FieldOperand(receiver, JSArray::kLengthOffset)); __ ret(0); } void StubCompiler::GenerateLoadFunctionPrototype(MacroAssembler* masm, Register receiver, Register scratch1, Register scratch2, Label* miss_label) { __ TryGetFunctionPrototype(receiver, scratch1, scratch2, miss_label); __ mov(eax, scratch1); __ ret(0); } void StubCompiler::GenerateFastPropertyLoad(MacroAssembler* masm, Register dst, Register src, bool inobject, int index, Representation representation) { ASSERT(!representation.IsDouble()); int offset = index * kPointerSize; if (!inobject) { // Calculate the offset into the properties array. offset = offset + FixedArray::kHeaderSize; __ mov(dst, FieldOperand(src, JSObject::kPropertiesOffset)); src = dst; } __ mov(dst, FieldOperand(src, offset)); } static void PushInterceptorArguments(MacroAssembler* masm, Register receiver, Register holder, Register name, Handle holder_obj) { STATIC_ASSERT(StubCache::kInterceptorArgsNameIndex == 0); STATIC_ASSERT(StubCache::kInterceptorArgsInfoIndex == 1); STATIC_ASSERT(StubCache::kInterceptorArgsThisIndex == 2); STATIC_ASSERT(StubCache::kInterceptorArgsHolderIndex == 3); STATIC_ASSERT(StubCache::kInterceptorArgsLength == 4); __ push(name); Handle interceptor(holder_obj->GetNamedInterceptor()); ASSERT(!masm->isolate()->heap()->InNewSpace(*interceptor)); Register scratch = name; __ mov(scratch, Immediate(interceptor)); __ push(scratch); __ push(receiver); __ push(holder); } static void CompileCallLoadPropertyWithInterceptor( MacroAssembler* masm, Register receiver, Register holder, Register name, Handle holder_obj, IC::UtilityId id) { PushInterceptorArguments(masm, receiver, holder, name, holder_obj); __ CallExternalReference( ExternalReference(IC_Utility(id), masm->isolate()), StubCache::kInterceptorArgsLength); } // Generate call to api function. // This function uses push() to generate smaller, faster code than // the version above. It is an optimization that should will be removed // when api call ICs are generated in hydrogen. void StubCompiler::GenerateFastApiCall(MacroAssembler* masm, const CallOptimization& optimization, Handle receiver_map, Register receiver, Register scratch_in, bool is_store, int argc, Register* values) { // Copy return value. __ pop(scratch_in); // receiver __ push(receiver); // Write the arguments to stack frame. for (int i = 0; i < argc; i++) { Register arg = values[argc-1-i]; ASSERT(!receiver.is(arg)); ASSERT(!scratch_in.is(arg)); __ push(arg); } __ push(scratch_in); // Stack now matches JSFunction abi. ASSERT(optimization.is_simple_api_call()); // Abi for CallApiFunctionStub. Register callee = eax; Register call_data = ebx; Register holder = ecx; Register api_function_address = edx; Register scratch = edi; // scratch_in is no longer valid. // Put holder in place. CallOptimization::HolderLookup holder_lookup; Handle api_holder = optimization.LookupHolderOfExpectedType( receiver_map, &holder_lookup); switch (holder_lookup) { case CallOptimization::kHolderIsReceiver: __ Move(holder, receiver); break; case CallOptimization::kHolderFound: __ LoadHeapObject(holder, api_holder); break; case CallOptimization::kHolderNotFound: UNREACHABLE(); break; } Isolate* isolate = masm->isolate(); Handle function = optimization.constant_function(); Handle api_call_info = optimization.api_call_info(); Handle call_data_obj(api_call_info->data(), isolate); // Put callee in place. __ LoadHeapObject(callee, function); bool call_data_undefined = false; // Put call_data in place. if (isolate->heap()->InNewSpace(*call_data_obj)) { __ mov(scratch, api_call_info); __ mov(call_data, FieldOperand(scratch, CallHandlerInfo::kDataOffset)); } else if (call_data_obj->IsUndefined()) { call_data_undefined = true; __ mov(call_data, Immediate(isolate->factory()->undefined_value())); } else { __ mov(call_data, call_data_obj); } // Put api_function_address in place. Address function_address = v8::ToCData
(api_call_info->callback()); __ mov(api_function_address, Immediate(function_address)); // Jump to stub. CallApiFunctionStub stub(isolate, is_store, call_data_undefined, argc); __ TailCallStub(&stub); } void StoreStubCompiler::GenerateRestoreName(MacroAssembler* masm, Label* label, Handle name) { if (!label->is_unused()) { __ bind(label); __ mov(this->name(), Immediate(name)); } } // Generate code to check that a global property cell is empty. Create // the property cell at compilation time if no cell exists for the // property. void StubCompiler::GenerateCheckPropertyCell(MacroAssembler* masm, Handle global, Handle name, Register scratch, Label* miss) { Handle cell = JSGlobalObject::EnsurePropertyCell(global, name); ASSERT(cell->value()->IsTheHole()); Handle the_hole = masm->isolate()->factory()->the_hole_value(); if (masm->serializer_enabled()) { __ mov(scratch, Immediate(cell)); __ cmp(FieldOperand(scratch, PropertyCell::kValueOffset), Immediate(the_hole)); } else { __ cmp(Operand::ForCell(cell), Immediate(the_hole)); } __ j(not_equal, miss); } void StoreStubCompiler::GenerateNegativeHolderLookup( MacroAssembler* masm, Handle holder, Register holder_reg, Handle name, Label* miss) { if (holder->IsJSGlobalObject()) { GenerateCheckPropertyCell( masm, Handle::cast(holder), name, scratch1(), miss); } else if (!holder->HasFastProperties() && !holder->IsJSGlobalProxy()) { GenerateDictionaryNegativeLookup( masm, miss, holder_reg, name, scratch1(), scratch2()); } } // Receiver_reg is preserved on jumps to miss_label, but may be destroyed if // store is successful. void StoreStubCompiler::GenerateStoreTransition(MacroAssembler* masm, Handle object, LookupResult* lookup, Handle transition, Handle name, Register receiver_reg, Register storage_reg, Register value_reg, Register scratch1, Register scratch2, Register unused, Label* miss_label, Label* slow) { int descriptor = transition->LastAdded(); DescriptorArray* descriptors = transition->instance_descriptors(); PropertyDetails details = descriptors->GetDetails(descriptor); Representation representation = details.representation(); ASSERT(!representation.IsNone()); if (details.type() == CONSTANT) { Handle constant(descriptors->GetValue(descriptor), masm->isolate()); __ CmpObject(value_reg, constant); __ j(not_equal, miss_label); } else if (representation.IsSmi()) { __ JumpIfNotSmi(value_reg, miss_label); } else if (representation.IsHeapObject()) { __ JumpIfSmi(value_reg, miss_label); HeapType* field_type = descriptors->GetFieldType(descriptor); HeapType::Iterator it = field_type->Classes(); if (!it.Done()) { Label do_store; while (true) { __ CompareMap(value_reg, it.Current()); it.Advance(); if (it.Done()) { __ j(not_equal, miss_label); break; } __ j(equal, &do_store, Label::kNear); } __ bind(&do_store); } } else if (representation.IsDouble()) { Label do_store, heap_number; __ AllocateHeapNumber(storage_reg, scratch1, scratch2, slow); __ JumpIfNotSmi(value_reg, &heap_number); __ SmiUntag(value_reg); __ Cvtsi2sd(xmm0, value_reg); __ SmiTag(value_reg); __ jmp(&do_store); __ bind(&heap_number); __ CheckMap(value_reg, masm->isolate()->factory()->heap_number_map(), miss_label, DONT_DO_SMI_CHECK); __ movsd(xmm0, FieldOperand(value_reg, HeapNumber::kValueOffset)); __ bind(&do_store); __ movsd(FieldOperand(storage_reg, HeapNumber::kValueOffset), xmm0); } // Stub never generated for non-global objects that require access // checks. ASSERT(object->IsJSGlobalProxy() || !object->IsAccessCheckNeeded()); // Perform map transition for the receiver if necessary. if (details.type() == FIELD && object->map()->unused_property_fields() == 0) { // The properties must be extended before we can store the value. // We jump to a runtime call that extends the properties array. __ pop(scratch1); // Return address. __ push(receiver_reg); __ push(Immediate(transition)); __ push(value_reg); __ push(scratch1); __ TailCallExternalReference( ExternalReference(IC_Utility(IC::kSharedStoreIC_ExtendStorage), masm->isolate()), 3, 1); return; } // Update the map of the object. __ mov(scratch1, Immediate(transition)); __ mov(FieldOperand(receiver_reg, HeapObject::kMapOffset), scratch1); // Update the write barrier for the map field. __ RecordWriteField(receiver_reg, HeapObject::kMapOffset, scratch1, scratch2, kDontSaveFPRegs, OMIT_REMEMBERED_SET, OMIT_SMI_CHECK); if (details.type() == CONSTANT) { ASSERT(value_reg.is(eax)); __ ret(0); return; } int index = transition->instance_descriptors()->GetFieldIndex( transition->LastAdded()); // Adjust for the number of properties stored in the object. Even in the // face of a transition we can use the old map here because the size of the // object and the number of in-object properties is not going to change. index -= object->map()->inobject_properties(); SmiCheck smi_check = representation.IsTagged() ? INLINE_SMI_CHECK : OMIT_SMI_CHECK; // TODO(verwaest): Share this code as a code stub. if (index < 0) { // Set the property straight into the object. int offset = object->map()->instance_size() + (index * kPointerSize); if (representation.IsDouble()) { __ mov(FieldOperand(receiver_reg, offset), storage_reg); } else { __ mov(FieldOperand(receiver_reg, offset), value_reg); } if (!representation.IsSmi()) { // Update the write barrier for the array address. if (!representation.IsDouble()) { __ mov(storage_reg, value_reg); } __ RecordWriteField(receiver_reg, offset, storage_reg, scratch1, kDontSaveFPRegs, EMIT_REMEMBERED_SET, smi_check); } } else { // Write to the properties array. int offset = index * kPointerSize + FixedArray::kHeaderSize; // Get the properties array (optimistically). __ mov(scratch1, FieldOperand(receiver_reg, JSObject::kPropertiesOffset)); if (representation.IsDouble()) { __ mov(FieldOperand(scratch1, offset), storage_reg); } else { __ mov(FieldOperand(scratch1, offset), value_reg); } if (!representation.IsSmi()) { // Update the write barrier for the array address. if (!representation.IsDouble()) { __ mov(storage_reg, value_reg); } __ RecordWriteField(scratch1, offset, storage_reg, receiver_reg, kDontSaveFPRegs, EMIT_REMEMBERED_SET, smi_check); } } // Return the value (register eax). ASSERT(value_reg.is(eax)); __ ret(0); } // Both name_reg and receiver_reg are preserved on jumps to miss_label, // but may be destroyed if store is successful. void StoreStubCompiler::GenerateStoreField(MacroAssembler* masm, Handle object, LookupResult* lookup, Register receiver_reg, Register name_reg, Register value_reg, Register scratch1, Register scratch2, Label* miss_label) { // Stub never generated for non-global objects that require access // checks. ASSERT(object->IsJSGlobalProxy() || !object->IsAccessCheckNeeded()); FieldIndex index = lookup->GetFieldIndex(); Representation representation = lookup->representation(); ASSERT(!representation.IsNone()); if (representation.IsSmi()) { __ JumpIfNotSmi(value_reg, miss_label); } else if (representation.IsHeapObject()) { __ JumpIfSmi(value_reg, miss_label); HeapType* field_type = lookup->GetFieldType(); HeapType::Iterator it = field_type->Classes(); if (!it.Done()) { Label do_store; while (true) { __ CompareMap(value_reg, it.Current()); it.Advance(); if (it.Done()) { __ j(not_equal, miss_label); break; } __ j(equal, &do_store, Label::kNear); } __ bind(&do_store); } } else if (representation.IsDouble()) { // Load the double storage. if (index.is_inobject()) { __ mov(scratch1, FieldOperand(receiver_reg, index.offset())); } else { __ mov(scratch1, FieldOperand(receiver_reg, JSObject::kPropertiesOffset)); __ mov(scratch1, FieldOperand(scratch1, index.offset())); } // Store the value into the storage. Label do_store, heap_number; __ JumpIfNotSmi(value_reg, &heap_number); __ SmiUntag(value_reg); __ Cvtsi2sd(xmm0, value_reg); __ SmiTag(value_reg); __ jmp(&do_store); __ bind(&heap_number); __ CheckMap(value_reg, masm->isolate()->factory()->heap_number_map(), miss_label, DONT_DO_SMI_CHECK); __ movsd(xmm0, FieldOperand(value_reg, HeapNumber::kValueOffset)); __ bind(&do_store); __ movsd(FieldOperand(scratch1, HeapNumber::kValueOffset), xmm0); // Return the value (register eax). ASSERT(value_reg.is(eax)); __ ret(0); return; } ASSERT(!representation.IsDouble()); // TODO(verwaest): Share this code as a code stub. SmiCheck smi_check = representation.IsTagged() ? INLINE_SMI_CHECK : OMIT_SMI_CHECK; if (index.is_inobject()) { // Set the property straight into the object. __ mov(FieldOperand(receiver_reg, index.offset()), value_reg); if (!representation.IsSmi()) { // Update the write barrier for the array address. // Pass the value being stored in the now unused name_reg. __ mov(name_reg, value_reg); __ RecordWriteField(receiver_reg, index.offset(), name_reg, scratch1, kDontSaveFPRegs, EMIT_REMEMBERED_SET, smi_check); } } else { // Write to the properties array. // Get the properties array (optimistically). __ mov(scratch1, FieldOperand(receiver_reg, JSObject::kPropertiesOffset)); __ mov(FieldOperand(scratch1, index.offset()), value_reg); if (!representation.IsSmi()) { // Update the write barrier for the array address. // Pass the value being stored in the now unused name_reg. __ mov(name_reg, value_reg); __ RecordWriteField(scratch1, index.offset(), name_reg, receiver_reg, kDontSaveFPRegs, EMIT_REMEMBERED_SET, smi_check); } } // Return the value (register eax). ASSERT(value_reg.is(eax)); __ ret(0); } void StubCompiler::GenerateTailCall(MacroAssembler* masm, Handle code) { __ jmp(code, RelocInfo::CODE_TARGET); } #undef __ #define __ ACCESS_MASM(masm()) Register StubCompiler::CheckPrototypes(Handle type, Register object_reg, Handle holder, Register holder_reg, Register scratch1, Register scratch2, Handle name, Label* miss, PrototypeCheckType check) { Handle receiver_map(IC::TypeToMap(*type, isolate())); // Make sure there's no overlap between holder and object registers. ASSERT(!scratch1.is(object_reg) && !scratch1.is(holder_reg)); ASSERT(!scratch2.is(object_reg) && !scratch2.is(holder_reg) && !scratch2.is(scratch1)); // Keep track of the current object in register reg. Register reg = object_reg; int depth = 0; Handle current = Handle::null(); if (type->IsConstant()) current = Handle::cast(type->AsConstant()->Value()); Handle prototype = Handle::null(); Handle current_map = receiver_map; Handle holder_map(holder->map()); // Traverse the prototype chain and check the maps in the prototype chain for // fast and global objects or do negative lookup for normal objects. while (!current_map.is_identical_to(holder_map)) { ++depth; // Only global objects and objects that do not require access // checks are allowed in stubs. ASSERT(current_map->IsJSGlobalProxyMap() || !current_map->is_access_check_needed()); prototype = handle(JSObject::cast(current_map->prototype())); if (current_map->is_dictionary_map() && !current_map->IsJSGlobalObjectMap() && !current_map->IsJSGlobalProxyMap()) { if (!name->IsUniqueName()) { ASSERT(name->IsString()); name = factory()->InternalizeString(Handle::cast(name)); } ASSERT(current.is_null() || current->property_dictionary()->FindEntry(name) == NameDictionary::kNotFound); GenerateDictionaryNegativeLookup(masm(), miss, reg, name, scratch1, scratch2); __ mov(scratch1, FieldOperand(reg, HeapObject::kMapOffset)); reg = holder_reg; // From now on the object will be in holder_reg. __ mov(reg, FieldOperand(scratch1, Map::kPrototypeOffset)); } else { bool in_new_space = heap()->InNewSpace(*prototype); if (depth != 1 || check == CHECK_ALL_MAPS) { __ CheckMap(reg, current_map, miss, DONT_DO_SMI_CHECK); } // Check access rights to the global object. This has to happen after // the map check so that we know that the object is actually a global // object. if (current_map->IsJSGlobalProxyMap()) { __ CheckAccessGlobalProxy(reg, scratch1, scratch2, miss); } else if (current_map->IsJSGlobalObjectMap()) { GenerateCheckPropertyCell( masm(), Handle::cast(current), name, scratch2, miss); } if (in_new_space) { // Save the map in scratch1 for later. __ mov(scratch1, FieldOperand(reg, HeapObject::kMapOffset)); } reg = holder_reg; // From now on the object will be in holder_reg. if (in_new_space) { // The prototype is in new space; we cannot store a reference to it // in the code. Load it from the map. __ mov(reg, FieldOperand(scratch1, Map::kPrototypeOffset)); } else { // The prototype is in old space; load it directly. __ mov(reg, prototype); } } // Go to the next object in the prototype chain. current = prototype; current_map = handle(current->map()); } // Log the check depth. LOG(isolate(), IntEvent("check-maps-depth", depth + 1)); if (depth != 0 || check == CHECK_ALL_MAPS) { // Check the holder map. __ CheckMap(reg, current_map, miss, DONT_DO_SMI_CHECK); } // Perform security check for access to the global object. ASSERT(current_map->IsJSGlobalProxyMap() || !current_map->is_access_check_needed()); if (current_map->IsJSGlobalProxyMap()) { __ CheckAccessGlobalProxy(reg, scratch1, scratch2, miss); } // Return the register containing the holder. return reg; } void LoadStubCompiler::HandlerFrontendFooter(Handle name, Label* miss) { if (!miss->is_unused()) { Label success; __ jmp(&success); __ bind(miss); TailCallBuiltin(masm(), MissBuiltin(kind())); __ bind(&success); } } void StoreStubCompiler::HandlerFrontendFooter(Handle name, Label* miss) { if (!miss->is_unused()) { Label success; __ jmp(&success); GenerateRestoreName(masm(), miss, name); TailCallBuiltin(masm(), MissBuiltin(kind())); __ bind(&success); } } Register LoadStubCompiler::CallbackHandlerFrontend( Handle type, Register object_reg, Handle holder, Handle name, Handle callback) { Label miss; Register reg = HandlerFrontendHeader(type, object_reg, holder, name, &miss); if (!holder->HasFastProperties() && !holder->IsJSGlobalObject()) { ASSERT(!reg.is(scratch2())); ASSERT(!reg.is(scratch3())); Register dictionary = scratch1(); bool must_preserve_dictionary_reg = reg.is(dictionary); // Load the properties dictionary. if (must_preserve_dictionary_reg) { __ push(dictionary); } __ mov(dictionary, FieldOperand(reg, JSObject::kPropertiesOffset)); // Probe the dictionary. Label probe_done, pop_and_miss; NameDictionaryLookupStub::GeneratePositiveLookup(masm(), &pop_and_miss, &probe_done, dictionary, this->name(), scratch2(), scratch3()); __ bind(&pop_and_miss); if (must_preserve_dictionary_reg) { __ pop(dictionary); } __ jmp(&miss); __ bind(&probe_done); // If probing finds an entry in the dictionary, scratch2 contains the // index into the dictionary. Check that the value is the callback. Register index = scratch2(); const int kElementsStartOffset = NameDictionary::kHeaderSize + NameDictionary::kElementsStartIndex * kPointerSize; const int kValueOffset = kElementsStartOffset + kPointerSize; __ mov(scratch3(), Operand(dictionary, index, times_4, kValueOffset - kHeapObjectTag)); if (must_preserve_dictionary_reg) { __ pop(dictionary); } __ cmp(scratch3(), callback); __ j(not_equal, &miss); } HandlerFrontendFooter(name, &miss); return reg; } void LoadStubCompiler::GenerateLoadField(Register reg, Handle holder, FieldIndex field, Representation representation) { if (!reg.is(receiver())) __ mov(receiver(), reg); if (kind() == Code::LOAD_IC) { LoadFieldStub stub(isolate(), field); GenerateTailCall(masm(), stub.GetCode()); } else { KeyedLoadFieldStub stub(isolate(), field); GenerateTailCall(masm(), stub.GetCode()); } } void LoadStubCompiler::GenerateLoadCallback( Register reg, Handle callback) { // Insert additional parameters into the stack frame above return address. ASSERT(!scratch3().is(reg)); __ pop(scratch3()); // Get return address to place it below. STATIC_ASSERT(PropertyCallbackArguments::kHolderIndex == 0); STATIC_ASSERT(PropertyCallbackArguments::kIsolateIndex == 1); STATIC_ASSERT(PropertyCallbackArguments::kReturnValueDefaultValueIndex == 2); STATIC_ASSERT(PropertyCallbackArguments::kReturnValueOffset == 3); STATIC_ASSERT(PropertyCallbackArguments::kDataIndex == 4); STATIC_ASSERT(PropertyCallbackArguments::kThisIndex == 5); __ push(receiver()); // receiver // Push data from ExecutableAccessorInfo. if (isolate()->heap()->InNewSpace(callback->data())) { ASSERT(!scratch2().is(reg)); __ mov(scratch2(), Immediate(callback)); __ push(FieldOperand(scratch2(), ExecutableAccessorInfo::kDataOffset)); } else { __ push(Immediate(Handle(callback->data(), isolate()))); } __ push(Immediate(isolate()->factory()->undefined_value())); // ReturnValue // ReturnValue default value __ push(Immediate(isolate()->factory()->undefined_value())); __ push(Immediate(reinterpret_cast(isolate()))); __ push(reg); // holder // Save a pointer to where we pushed the arguments. This will be // passed as the const PropertyAccessorInfo& to the C++ callback. __ push(esp); __ push(name()); // name __ push(scratch3()); // Restore return address. // Abi for CallApiGetter Register getter_address = edx; Address function_address = v8::ToCData
(callback->getter()); __ mov(getter_address, Immediate(function_address)); CallApiGetterStub stub(isolate()); __ TailCallStub(&stub); } void LoadStubCompiler::GenerateLoadConstant(Handle value) { // Return the constant value. __ LoadObject(eax, value); __ ret(0); } void LoadStubCompiler::GenerateLoadInterceptor( Register holder_reg, Handle object, Handle interceptor_holder, LookupResult* lookup, Handle name) { ASSERT(interceptor_holder->HasNamedInterceptor()); ASSERT(!interceptor_holder->GetNamedInterceptor()->getter()->IsUndefined()); // So far the most popular follow ups for interceptor loads are FIELD // and CALLBACKS, so inline only them, other cases may be added // later. bool compile_followup_inline = false; if (lookup->IsFound() && lookup->IsCacheable()) { if (lookup->IsField()) { compile_followup_inline = true; } else if (lookup->type() == CALLBACKS && lookup->GetCallbackObject()->IsExecutableAccessorInfo()) { ExecutableAccessorInfo* callback = ExecutableAccessorInfo::cast(lookup->GetCallbackObject()); compile_followup_inline = callback->getter() != NULL && callback->IsCompatibleReceiver(*object); } } if (compile_followup_inline) { // Compile the interceptor call, followed by inline code to load the // property from further up the prototype chain if the call fails. // Check that the maps haven't changed. ASSERT(holder_reg.is(receiver()) || holder_reg.is(scratch1())); // Preserve the receiver register explicitly whenever it is different from // the holder and it is needed should the interceptor return without any // result. The CALLBACKS case needs the receiver to be passed into C++ code, // the FIELD case might cause a miss during the prototype check. bool must_perfrom_prototype_check = *interceptor_holder != lookup->holder(); bool must_preserve_receiver_reg = !receiver().is(holder_reg) && (lookup->type() == CALLBACKS || must_perfrom_prototype_check); // Save necessary data before invoking an interceptor. // Requires a frame to make GC aware of pushed pointers. { FrameScope frame_scope(masm(), StackFrame::INTERNAL); if (must_preserve_receiver_reg) { __ push(receiver()); } __ push(holder_reg); __ push(this->name()); // Invoke an interceptor. Note: map checks from receiver to // interceptor's holder has been compiled before (see a caller // of this method.) CompileCallLoadPropertyWithInterceptor( masm(), receiver(), holder_reg, this->name(), interceptor_holder, IC::kLoadPropertyWithInterceptorOnly); // Check if interceptor provided a value for property. If it's // the case, return immediately. Label interceptor_failed; __ cmp(eax, factory()->no_interceptor_result_sentinel()); __ j(equal, &interceptor_failed); frame_scope.GenerateLeaveFrame(); __ ret(0); // Clobber registers when generating debug-code to provoke errors. __ bind(&interceptor_failed); if (FLAG_debug_code) { __ mov(receiver(), Immediate(BitCast(kZapValue))); __ mov(holder_reg, Immediate(BitCast(kZapValue))); __ mov(this->name(), Immediate(BitCast(kZapValue))); } __ pop(this->name()); __ pop(holder_reg); if (must_preserve_receiver_reg) { __ pop(receiver()); } // Leave the internal frame. } GenerateLoadPostInterceptor(holder_reg, interceptor_holder, name, lookup); } else { // !compile_followup_inline // Call the runtime system to load the interceptor. // Check that the maps haven't changed. __ pop(scratch2()); // save old return address PushInterceptorArguments(masm(), receiver(), holder_reg, this->name(), interceptor_holder); __ push(scratch2()); // restore old return address ExternalReference ref = ExternalReference(IC_Utility(IC::kLoadPropertyWithInterceptor), isolate()); __ TailCallExternalReference(ref, StubCache::kInterceptorArgsLength, 1); } } Handle StoreStubCompiler::CompileStoreCallback( Handle object, Handle holder, Handle name, Handle callback) { Register holder_reg = HandlerFrontend( IC::CurrentTypeOf(object, isolate()), receiver(), holder, name); __ pop(scratch1()); // remove the return address __ push(receiver()); __ push(holder_reg); __ Push(callback); __ Push(name); __ push(value()); __ push(scratch1()); // restore return address // Do tail-call to the runtime system. ExternalReference store_callback_property = ExternalReference(IC_Utility(IC::kStoreCallbackProperty), isolate()); __ TailCallExternalReference(store_callback_property, 5, 1); // Return the generated code. return GetCode(kind(), Code::FAST, name); } #undef __ #define __ ACCESS_MASM(masm) void StoreStubCompiler::GenerateStoreViaSetter( MacroAssembler* masm, Handle type, Register receiver, Handle setter) { // ----------- S t a t e ------------- // -- esp[0] : return address // ----------------------------------- { FrameScope scope(masm, StackFrame::INTERNAL); // Save value register, so we can restore it later. __ push(value()); if (!setter.is_null()) { // Call the JavaScript setter with receiver and value on the stack. if (IC::TypeToMap(*type, masm->isolate())->IsJSGlobalObjectMap()) { // Swap in the global receiver. __ mov(receiver, FieldOperand(receiver, JSGlobalObject::kGlobalReceiverOffset)); } __ push(receiver); __ push(value()); ParameterCount actual(1); ParameterCount expected(setter); __ InvokeFunction(setter, expected, actual, CALL_FUNCTION, NullCallWrapper()); } else { // If we generate a global code snippet for deoptimization only, remember // the place to continue after deoptimization. masm->isolate()->heap()->SetSetterStubDeoptPCOffset(masm->pc_offset()); } // We have to return the passed value, not the return value of the setter. __ pop(eax); // Restore context register. __ mov(esi, Operand(ebp, StandardFrameConstants::kContextOffset)); } __ ret(0); } #undef __ #define __ ACCESS_MASM(masm()) Handle StoreStubCompiler::CompileStoreInterceptor( Handle object, Handle name) { __ pop(scratch1()); // remove the return address __ push(receiver()); __ push(this->name()); __ push(value()); __ push(scratch1()); // restore return address // Do tail-call to the runtime system. ExternalReference store_ic_property = ExternalReference(IC_Utility(IC::kStoreInterceptorProperty), isolate()); __ TailCallExternalReference(store_ic_property, 3, 1); // Return the generated code. return GetCode(kind(), Code::FAST, name); } void StoreStubCompiler::GenerateStoreArrayLength() { // Prepare tail call to StoreIC_ArrayLength. __ pop(scratch1()); // remove the return address __ push(receiver()); __ push(value()); __ push(scratch1()); // restore return address ExternalReference ref = ExternalReference(IC_Utility(IC::kStoreIC_ArrayLength), masm()->isolate()); __ TailCallExternalReference(ref, 2, 1); } Handle KeyedStoreStubCompiler::CompileStorePolymorphic( MapHandleList* receiver_maps, CodeHandleList* handler_stubs, MapHandleList* transitioned_maps) { Label miss; __ JumpIfSmi(receiver(), &miss, Label::kNear); __ mov(scratch1(), FieldOperand(receiver(), HeapObject::kMapOffset)); for (int i = 0; i < receiver_maps->length(); ++i) { __ cmp(scratch1(), receiver_maps->at(i)); if (transitioned_maps->at(i).is_null()) { __ j(equal, handler_stubs->at(i)); } else { Label next_map; __ j(not_equal, &next_map, Label::kNear); __ mov(transition_map(), Immediate(transitioned_maps->at(i))); __ jmp(handler_stubs->at(i), RelocInfo::CODE_TARGET); __ bind(&next_map); } } __ bind(&miss); TailCallBuiltin(masm(), MissBuiltin(kind())); // Return the generated code. return GetICCode( kind(), Code::NORMAL, factory()->empty_string(), POLYMORPHIC); } Handle LoadStubCompiler::CompileLoadNonexistent(Handle type, Handle last, Handle name) { NonexistentHandlerFrontend(type, last, name); // Return undefined if maps of the full prototype chain are still the // same and no global property with this name contains a value. __ mov(eax, isolate()->factory()->undefined_value()); __ ret(0); // Return the generated code. return GetCode(kind(), Code::FAST, name); } Register* LoadStubCompiler::registers() { // receiver, name, scratch1, scratch2, scratch3, scratch4. static Register registers[] = { edx, ecx, ebx, eax, edi, no_reg }; return registers; } Register* KeyedLoadStubCompiler::registers() { // receiver, name, scratch1, scratch2, scratch3, scratch4. static Register registers[] = { edx, ecx, ebx, eax, edi, no_reg }; return registers; } Register StoreStubCompiler::value() { return eax; } Register* StoreStubCompiler::registers() { // receiver, name, scratch1, scratch2, scratch3. static Register registers[] = { edx, ecx, ebx, edi, no_reg }; return registers; } Register* KeyedStoreStubCompiler::registers() { // receiver, name, scratch1, scratch2, scratch3. static Register registers[] = { edx, ecx, ebx, edi, no_reg }; return registers; } #undef __ #define __ ACCESS_MASM(masm) void LoadStubCompiler::GenerateLoadViaGetter(MacroAssembler* masm, Handle type, Register receiver, Handle getter) { { FrameScope scope(masm, StackFrame::INTERNAL); if (!getter.is_null()) { // Call the JavaScript getter with the receiver on the stack. if (IC::TypeToMap(*type, masm->isolate())->IsJSGlobalObjectMap()) { // Swap in the global receiver. __ mov(receiver, FieldOperand(receiver, JSGlobalObject::kGlobalReceiverOffset)); } __ push(receiver); ParameterCount actual(0); ParameterCount expected(getter); __ InvokeFunction(getter, expected, actual, CALL_FUNCTION, NullCallWrapper()); } else { // If we generate a global code snippet for deoptimization only, remember // the place to continue after deoptimization. masm->isolate()->heap()->SetGetterStubDeoptPCOffset(masm->pc_offset()); } // Restore context register. __ mov(esi, Operand(ebp, StandardFrameConstants::kContextOffset)); } __ ret(0); } #undef __ #define __ ACCESS_MASM(masm()) Handle LoadStubCompiler::CompileLoadGlobal( Handle type, Handle global, Handle cell, Handle name, bool is_dont_delete) { Label miss; HandlerFrontendHeader(type, receiver(), global, name, &miss); // Get the value from the cell. if (masm()->serializer_enabled()) { __ mov(eax, Immediate(cell)); __ mov(eax, FieldOperand(eax, PropertyCell::kValueOffset)); } else { __ mov(eax, Operand::ForCell(cell)); } // Check for deleted property if property can actually be deleted. if (!is_dont_delete) { __ cmp(eax, factory()->the_hole_value()); __ j(equal, &miss); } else if (FLAG_debug_code) { __ cmp(eax, factory()->the_hole_value()); __ Check(not_equal, kDontDeleteCellsCannotContainTheHole); } Counters* counters = isolate()->counters(); __ IncrementCounter(counters->named_load_global_stub(), 1); // The code above already loads the result into the return register. __ ret(0); HandlerFrontendFooter(name, &miss); // Return the generated code. return GetCode(kind(), Code::NORMAL, name); } Handle BaseLoadStoreStubCompiler::CompilePolymorphicIC( TypeHandleList* types, CodeHandleList* handlers, Handle name, Code::StubType type, IcCheckType check) { Label miss; if (check == PROPERTY && (kind() == Code::KEYED_LOAD_IC || kind() == Code::KEYED_STORE_IC)) { __ cmp(this->name(), Immediate(name)); __ j(not_equal, &miss); } Label number_case; Label* smi_target = IncludesNumberType(types) ? &number_case : &miss; __ JumpIfSmi(receiver(), smi_target); Register map_reg = scratch1(); __ mov(map_reg, FieldOperand(receiver(), HeapObject::kMapOffset)); int receiver_count = types->length(); int number_of_handled_maps = 0; for (int current = 0; current < receiver_count; ++current) { Handle type = types->at(current); Handle map = IC::TypeToMap(*type, isolate()); if (!map->is_deprecated()) { number_of_handled_maps++; __ cmp(map_reg, map); if (type->Is(HeapType::Number())) { ASSERT(!number_case.is_unused()); __ bind(&number_case); } __ j(equal, handlers->at(current)); } } ASSERT(number_of_handled_maps != 0); __ bind(&miss); TailCallBuiltin(masm(), MissBuiltin(kind())); // Return the generated code. InlineCacheState state = number_of_handled_maps > 1 ? POLYMORPHIC : MONOMORPHIC; return GetICCode(kind(), type, name, state); } #undef __ #define __ ACCESS_MASM(masm) void KeyedLoadStubCompiler::GenerateLoadDictionaryElement( MacroAssembler* masm) { // ----------- S t a t e ------------- // -- ecx : key // -- edx : receiver // -- esp[0] : return address // ----------------------------------- Label slow, miss; // This stub is meant to be tail-jumped to, the receiver must already // have been verified by the caller to not be a smi. __ JumpIfNotSmi(ecx, &miss); __ mov(ebx, ecx); __ SmiUntag(ebx); __ mov(eax, FieldOperand(edx, JSObject::kElementsOffset)); // Push receiver on the stack to free up a register for the dictionary // probing. __ push(edx); __ LoadFromNumberDictionary(&slow, eax, ecx, ebx, edx, edi, eax); // Pop receiver before returning. __ pop(edx); __ ret(0); __ bind(&slow); __ pop(edx); // ----------- S t a t e ------------- // -- ecx : key // -- edx : receiver // -- esp[0] : return address // ----------------------------------- TailCallBuiltin(masm, Builtins::kKeyedLoadIC_Slow); __ bind(&miss); // ----------- S t a t e ------------- // -- ecx : key // -- edx : receiver // -- esp[0] : return address // ----------------------------------- TailCallBuiltin(masm, Builtins::kKeyedLoadIC_Miss); } #undef __ } } // namespace v8::internal #endif // V8_TARGET_ARCH_IA32