• Home
  • Line#
  • Scopes#
  • Navigate#
  • Raw
  • Download
1 // Copyright 2012 the V8 project authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file.
4 
5 #if V8_TARGET_ARCH_X64
6 
7 #include "src/codegen.h"
8 #include "src/ic/ic.h"
9 #include "src/ic/ic-compiler.h"
10 #include "src/ic/stub-cache.h"
11 
12 namespace v8 {
13 namespace internal {
14 
15 // ----------------------------------------------------------------------------
16 // Static IC stub generators.
17 //
18 
19 #define __ ACCESS_MASM(masm)
20 
21 // Helper function used to load a property from a dictionary backing storage.
22 // This function may return false negatives, so miss_label
23 // must always call a backup property load that is complete.
24 // This function is safe to call if name is not an internalized string,
25 // and will jump to the miss_label in that case.
26 // The generated code assumes that the receiver has slow properties,
27 // is not a global object and does not have interceptors.
GenerateDictionaryLoad(MacroAssembler * masm,Label * miss_label,Register elements,Register name,Register r0,Register r1,Register result)28 static void GenerateDictionaryLoad(MacroAssembler* masm, Label* miss_label,
29                                    Register elements, Register name,
30                                    Register r0, Register r1, Register result) {
31   // Register use:
32   //
33   // elements - holds the property dictionary on entry and is unchanged.
34   //
35   // name - holds the name of the property on entry and is unchanged.
36   //
37   // r0   - used to hold the capacity of the property dictionary.
38   //
39   // r1   - used to hold the index into the property dictionary.
40   //
41   // result - holds the result on exit if the load succeeded.
42 
43   Label done;
44 
45   // Probe the dictionary.
46   NameDictionaryLookupStub::GeneratePositiveLookup(masm, miss_label, &done,
47                                                    elements, name, r0, r1);
48 
49   // If probing finds an entry in the dictionary, r1 contains the
50   // index into the dictionary. Check that the value is a normal
51   // property.
52   __ bind(&done);
53   const int kElementsStartOffset =
54       NameDictionary::kHeaderSize +
55       NameDictionary::kElementsStartIndex * kPointerSize;
56   const int kDetailsOffset = kElementsStartOffset + 2 * kPointerSize;
57   __ Test(Operand(elements, r1, times_pointer_size,
58                   kDetailsOffset - kHeapObjectTag),
59           Smi::FromInt(PropertyDetails::TypeField::kMask));
60   __ j(not_zero, miss_label);
61 
62   // Get the value at the masked, scaled index.
63   const int kValueOffset = kElementsStartOffset + kPointerSize;
64   __ movp(result, Operand(elements, r1, times_pointer_size,
65                           kValueOffset - kHeapObjectTag));
66 }
67 
68 
69 // Helper function used to store a property to a dictionary backing
70 // storage. This function may fail to store a property even though it
71 // is in the dictionary, so code at miss_label must always call a
72 // backup property store that is complete. This function is safe to
73 // call if name is not an internalized string, and will jump to the miss_label
74 // in that case. The generated code assumes that the receiver has slow
75 // properties, is not a global object and does not have interceptors.
GenerateDictionaryStore(MacroAssembler * masm,Label * miss_label,Register elements,Register name,Register value,Register scratch0,Register scratch1)76 static void GenerateDictionaryStore(MacroAssembler* masm, Label* miss_label,
77                                     Register elements, Register name,
78                                     Register value, Register scratch0,
79                                     Register scratch1) {
80   // Register use:
81   //
82   // elements - holds the property dictionary on entry and is clobbered.
83   //
84   // name - holds the name of the property on entry and is unchanged.
85   //
86   // value - holds the value to store and is unchanged.
87   //
88   // scratch0 - used during the positive dictionary lookup and is clobbered.
89   //
90   // scratch1 - used for index into the property dictionary and is clobbered.
91   Label done;
92 
93   // Probe the dictionary.
94   NameDictionaryLookupStub::GeneratePositiveLookup(
95       masm, miss_label, &done, elements, name, scratch0, scratch1);
96 
97   // If probing finds an entry in the dictionary, scratch0 contains the
98   // index into the dictionary. Check that the value is a normal
99   // property that is not read only.
100   __ bind(&done);
101   const int kElementsStartOffset =
102       NameDictionary::kHeaderSize +
103       NameDictionary::kElementsStartIndex * kPointerSize;
104   const int kDetailsOffset = kElementsStartOffset + 2 * kPointerSize;
105   const int kTypeAndReadOnlyMask =
106       PropertyDetails::TypeField::kMask |
107       PropertyDetails::AttributesField::encode(READ_ONLY);
108   __ Test(Operand(elements, scratch1, times_pointer_size,
109                   kDetailsOffset - kHeapObjectTag),
110           Smi::FromInt(kTypeAndReadOnlyMask));
111   __ j(not_zero, miss_label);
112 
113   // Store the value at the masked, scaled index.
114   const int kValueOffset = kElementsStartOffset + kPointerSize;
115   __ leap(scratch1, Operand(elements, scratch1, times_pointer_size,
116                             kValueOffset - kHeapObjectTag));
117   __ movp(Operand(scratch1, 0), value);
118 
119   // Update write barrier. Make sure not to clobber the value.
120   __ movp(scratch0, value);
121   __ RecordWrite(elements, scratch1, scratch0, kDontSaveFPRegs);
122 }
123 
KeyedStoreGenerateMegamorphicHelper(MacroAssembler * masm,Label * fast_object,Label * fast_double,Label * slow,KeyedStoreCheckMap check_map,KeyedStoreIncrementLength increment_length)124 static void KeyedStoreGenerateMegamorphicHelper(
125     MacroAssembler* masm, Label* fast_object, Label* fast_double, Label* slow,
126     KeyedStoreCheckMap check_map, KeyedStoreIncrementLength increment_length) {
127   Label transition_smi_elements;
128   Label finish_object_store, non_double_value, transition_double_elements;
129   Label fast_double_without_map_check;
130   Register receiver = StoreDescriptor::ReceiverRegister();
131   Register key = StoreDescriptor::NameRegister();
132   Register value = StoreDescriptor::ValueRegister();
133   DCHECK(receiver.is(rdx));
134   DCHECK(key.is(rcx));
135   DCHECK(value.is(rax));
136   // Fast case: Do the store, could be either Object or double.
137   __ bind(fast_object);
138   // rbx: receiver's elements array (a FixedArray)
139   // receiver is a JSArray.
140   // r9: map of receiver
141   if (check_map == kCheckMap) {
142     __ movp(rdi, FieldOperand(rbx, HeapObject::kMapOffset));
143     __ CompareRoot(rdi, Heap::kFixedArrayMapRootIndex);
144     __ j(not_equal, fast_double);
145   }
146 
147   // HOLECHECK: guards "A[i] = V"
148   // We have to go to the runtime if the current value is the hole because
149   // there may be a callback on the element
150   Label holecheck_passed1;
151   __ movp(kScratchRegister,
152           FieldOperand(rbx, key, times_pointer_size, FixedArray::kHeaderSize));
153   __ CompareRoot(kScratchRegister, Heap::kTheHoleValueRootIndex);
154   __ j(not_equal, &holecheck_passed1);
155   __ JumpIfDictionaryInPrototypeChain(receiver, rdi, kScratchRegister, slow);
156 
157   __ bind(&holecheck_passed1);
158 
159   // Smi stores don't require further checks.
160   Label non_smi_value;
161   __ JumpIfNotSmi(value, &non_smi_value);
162   if (increment_length == kIncrementLength) {
163     // Add 1 to receiver->length.
164     __ leal(rdi, Operand(key, 1));
165     __ Integer32ToSmiField(FieldOperand(receiver, JSArray::kLengthOffset), rdi);
166   }
167   // It's irrelevant whether array is smi-only or not when writing a smi.
168   __ movp(FieldOperand(rbx, key, times_pointer_size, FixedArray::kHeaderSize),
169           value);
170   __ ret(0);
171 
172   __ bind(&non_smi_value);
173   // Writing a non-smi, check whether array allows non-smi elements.
174   // r9: receiver's map
175   __ CheckFastObjectElements(r9, &transition_smi_elements);
176 
177   __ bind(&finish_object_store);
178   if (increment_length == kIncrementLength) {
179     // Add 1 to receiver->length.
180     __ leal(rdi, Operand(key, 1));
181     __ Integer32ToSmiField(FieldOperand(receiver, JSArray::kLengthOffset), rdi);
182   }
183   __ movp(FieldOperand(rbx, key, times_pointer_size, FixedArray::kHeaderSize),
184           value);
185   __ movp(rdx, value);  // Preserve the value which is returned.
186   __ RecordWriteArray(rbx, rdx, key, kDontSaveFPRegs, EMIT_REMEMBERED_SET,
187                       OMIT_SMI_CHECK);
188   __ ret(0);
189 
190   __ bind(fast_double);
191   if (check_map == kCheckMap) {
192     // Check for fast double array case. If this fails, call through to the
193     // runtime.
194     // rdi: elements array's map
195     __ CompareRoot(rdi, Heap::kFixedDoubleArrayMapRootIndex);
196     __ j(not_equal, slow);
197   }
198 
199   // HOLECHECK: guards "A[i] double hole?"
200   // We have to see if the double version of the hole is present. If so
201   // go to the runtime.
202   uint32_t offset = FixedDoubleArray::kHeaderSize + sizeof(kHoleNanLower32);
203   __ cmpl(FieldOperand(rbx, key, times_8, offset), Immediate(kHoleNanUpper32));
204   __ j(not_equal, &fast_double_without_map_check);
205   __ JumpIfDictionaryInPrototypeChain(receiver, rdi, kScratchRegister, slow);
206 
207   __ bind(&fast_double_without_map_check);
208   __ StoreNumberToDoubleElements(value, rbx, key, kScratchDoubleReg,
209                                  &transition_double_elements);
210   if (increment_length == kIncrementLength) {
211     // Add 1 to receiver->length.
212     __ leal(rdi, Operand(key, 1));
213     __ Integer32ToSmiField(FieldOperand(receiver, JSArray::kLengthOffset), rdi);
214   }
215   __ ret(0);
216 
217   __ bind(&transition_smi_elements);
218   __ movp(rbx, FieldOperand(receiver, HeapObject::kMapOffset));
219 
220   // Transition the array appropriately depending on the value type.
221   __ movp(r9, FieldOperand(value, HeapObject::kMapOffset));
222   __ CompareRoot(r9, Heap::kHeapNumberMapRootIndex);
223   __ j(not_equal, &non_double_value);
224 
225   // Value is a double. Transition FAST_SMI_ELEMENTS ->
226   // FAST_DOUBLE_ELEMENTS and complete the store.
227   __ LoadTransitionedArrayMapConditional(FAST_SMI_ELEMENTS,
228                                          FAST_DOUBLE_ELEMENTS, rbx, rdi, slow);
229   AllocationSiteMode mode =
230       AllocationSite::GetMode(FAST_SMI_ELEMENTS, FAST_DOUBLE_ELEMENTS);
231   ElementsTransitionGenerator::GenerateSmiToDouble(masm, receiver, key, value,
232                                                    rbx, mode, slow);
233   __ movp(rbx, FieldOperand(receiver, JSObject::kElementsOffset));
234   __ jmp(&fast_double_without_map_check);
235 
236   __ bind(&non_double_value);
237   // Value is not a double, FAST_SMI_ELEMENTS -> FAST_ELEMENTS
238   __ LoadTransitionedArrayMapConditional(FAST_SMI_ELEMENTS, FAST_ELEMENTS, rbx,
239                                          rdi, slow);
240   mode = AllocationSite::GetMode(FAST_SMI_ELEMENTS, FAST_ELEMENTS);
241   ElementsTransitionGenerator::GenerateMapChangeElementsTransition(
242       masm, receiver, key, value, rbx, mode, slow);
243   __ movp(rbx, FieldOperand(receiver, JSObject::kElementsOffset));
244   __ jmp(&finish_object_store);
245 
246   __ bind(&transition_double_elements);
247   // Elements are FAST_DOUBLE_ELEMENTS, but value is an Object that's not a
248   // HeapNumber. Make sure that the receiver is a Array with FAST_ELEMENTS and
249   // transition array from FAST_DOUBLE_ELEMENTS to FAST_ELEMENTS
250   __ movp(rbx, FieldOperand(receiver, HeapObject::kMapOffset));
251   __ LoadTransitionedArrayMapConditional(FAST_DOUBLE_ELEMENTS, FAST_ELEMENTS,
252                                          rbx, rdi, slow);
253   mode = AllocationSite::GetMode(FAST_DOUBLE_ELEMENTS, FAST_ELEMENTS);
254   ElementsTransitionGenerator::GenerateDoubleToObject(masm, receiver, key,
255                                                       value, rbx, mode, slow);
256   __ movp(rbx, FieldOperand(receiver, JSObject::kElementsOffset));
257   __ jmp(&finish_object_store);
258 }
259 
260 
GenerateMegamorphic(MacroAssembler * masm,LanguageMode language_mode)261 void KeyedStoreIC::GenerateMegamorphic(MacroAssembler* masm,
262                                        LanguageMode language_mode) {
263   // Return address is on the stack.
264   Label slow, slow_with_tagged_index, fast_object, fast_object_grow;
265   Label fast_double, fast_double_grow;
266   Label array, extra, check_if_double_array, maybe_name_key, miss;
267   Register receiver = StoreDescriptor::ReceiverRegister();
268   Register key = StoreDescriptor::NameRegister();
269   DCHECK(receiver.is(rdx));
270   DCHECK(key.is(rcx));
271 
272   // Check that the object isn't a smi.
273   __ JumpIfSmi(receiver, &slow_with_tagged_index);
274   // Get the map from the receiver.
275   __ movp(r9, FieldOperand(receiver, HeapObject::kMapOffset));
276   // Check that the receiver does not require access checks.
277   // The generic stub does not perform map checks.
278   __ testb(FieldOperand(r9, Map::kBitFieldOffset),
279            Immediate(1 << Map::kIsAccessCheckNeeded));
280   __ j(not_zero, &slow_with_tagged_index);
281   // Check that the key is a smi.
282   __ JumpIfNotSmi(key, &maybe_name_key);
283   __ SmiToInteger32(key, key);
284 
285   __ CmpInstanceType(r9, JS_ARRAY_TYPE);
286   __ j(equal, &array);
287   // Check that the object is some kind of JS object EXCEPT JS Value type. In
288   // the case that the object is a value-wrapper object, we enter the runtime
289   // system to make sure that indexing into string objects works as intended.
290   STATIC_ASSERT(JS_VALUE_TYPE < JS_OBJECT_TYPE);
291   __ CmpInstanceType(r9, JS_OBJECT_TYPE);
292   __ j(below, &slow);
293 
294   // Object case: Check key against length in the elements array.
295   __ movp(rbx, FieldOperand(receiver, JSObject::kElementsOffset));
296   // Check array bounds.
297   __ SmiCompareInteger32(FieldOperand(rbx, FixedArray::kLengthOffset), key);
298   // rbx: FixedArray
299   __ j(above, &fast_object);
300 
301   // Slow case: call runtime.
302   __ bind(&slow);
303   __ Integer32ToSmi(key, key);
304   __ bind(&slow_with_tagged_index);
305   PropertyICCompiler::GenerateRuntimeSetProperty(masm, language_mode);
306   // Never returns to here.
307 
308   __ bind(&maybe_name_key);
309   __ movp(r9, FieldOperand(key, HeapObject::kMapOffset));
310   __ movzxbp(r9, FieldOperand(r9, Map::kInstanceTypeOffset));
311   __ JumpIfNotUniqueNameInstanceType(r9, &slow_with_tagged_index);
312 
313   Register vector = StoreWithVectorDescriptor::VectorRegister();
314   Register slot = StoreWithVectorDescriptor::SlotRegister();
315   // The handlers in the stub cache expect a vector and slot. Since we won't
316   // change the IC from any downstream misses, a dummy vector can be used.
317   Handle<TypeFeedbackVector> dummy_vector =
318       TypeFeedbackVector::DummyVector(masm->isolate());
319   int slot_index = dummy_vector->GetIndex(
320       FeedbackVectorSlot(TypeFeedbackVector::kDummyKeyedStoreICSlot));
321   __ Move(vector, dummy_vector);
322   __ Move(slot, Smi::FromInt(slot_index));
323 
324   masm->isolate()->store_stub_cache()->GenerateProbe(masm, receiver, key, r9,
325                                                      no_reg);
326   // Cache miss.
327   __ jmp(&miss);
328 
329   // Extra capacity case: Check if there is extra capacity to
330   // perform the store and update the length. Used for adding one
331   // element to the array by writing to array[array.length].
332   __ bind(&extra);
333   // receiver is a JSArray.
334   // rbx: receiver's elements array (a FixedArray)
335   // flags: smicompare (receiver.length(), rbx)
336   __ j(not_equal, &slow);  // do not leave holes in the array
337   __ SmiCompareInteger32(FieldOperand(rbx, FixedArray::kLengthOffset), key);
338   __ j(below_equal, &slow);
339   // Increment index to get new length.
340   __ movp(rdi, FieldOperand(rbx, HeapObject::kMapOffset));
341   __ CompareRoot(rdi, Heap::kFixedArrayMapRootIndex);
342   __ j(not_equal, &check_if_double_array);
343   __ jmp(&fast_object_grow);
344 
345   __ bind(&check_if_double_array);
346   // rdi: elements array's map
347   __ CompareRoot(rdi, Heap::kFixedDoubleArrayMapRootIndex);
348   __ j(not_equal, &slow);
349   __ jmp(&fast_double_grow);
350 
351   // Array case: Get the length and the elements array from the JS
352   // array. Check that the array is in fast mode (and writable); if it
353   // is the length is always a smi.
354   __ bind(&array);
355   // receiver is a JSArray.
356   __ movp(rbx, FieldOperand(receiver, JSObject::kElementsOffset));
357 
358   // Check the key against the length in the array, compute the
359   // address to store into and fall through to fast case.
360   __ SmiCompareInteger32(FieldOperand(receiver, JSArray::kLengthOffset), key);
361   __ j(below_equal, &extra);
362 
363   KeyedStoreGenerateMegamorphicHelper(masm, &fast_object, &fast_double, &slow,
364                                       kCheckMap, kDontIncrementLength);
365   KeyedStoreGenerateMegamorphicHelper(masm, &fast_object_grow,
366                                       &fast_double_grow, &slow, kDontCheckMap,
367                                       kIncrementLength);
368 
369   __ bind(&miss);
370   GenerateMiss(masm);
371 }
372 
GenerateNormal(MacroAssembler * masm)373 void LoadIC::GenerateNormal(MacroAssembler* masm) {
374   Register dictionary = rax;
375   DCHECK(!dictionary.is(LoadDescriptor::ReceiverRegister()));
376   DCHECK(!dictionary.is(LoadDescriptor::NameRegister()));
377 
378   Label slow;
379 
380   __ movp(dictionary, FieldOperand(LoadDescriptor::ReceiverRegister(),
381                                    JSObject::kPropertiesOffset));
382   GenerateDictionaryLoad(masm, &slow, dictionary,
383                          LoadDescriptor::NameRegister(), rbx, rdi, rax);
384   __ ret(0);
385 
386   // Dictionary load failed, go slow (but don't miss).
387   __ bind(&slow);
388   LoadIC::GenerateRuntimeGetProperty(masm);
389 }
390 
391 
LoadIC_PushArgs(MacroAssembler * masm)392 static void LoadIC_PushArgs(MacroAssembler* masm) {
393   Register receiver = LoadDescriptor::ReceiverRegister();
394   Register name = LoadDescriptor::NameRegister();
395   Register slot = LoadDescriptor::SlotRegister();
396   Register vector = LoadWithVectorDescriptor::VectorRegister();
397   DCHECK(!rdi.is(receiver) && !rdi.is(name) && !rdi.is(slot) &&
398          !rdi.is(vector));
399 
400   __ PopReturnAddressTo(rdi);
401   __ Push(receiver);
402   __ Push(name);
403   __ Push(slot);
404   __ Push(vector);
405   __ PushReturnAddressFrom(rdi);
406 }
407 
408 
GenerateMiss(MacroAssembler * masm)409 void LoadIC::GenerateMiss(MacroAssembler* masm) {
410   // The return address is on the stack.
411 
412   Counters* counters = masm->isolate()->counters();
413   __ IncrementCounter(counters->ic_load_miss(), 1);
414 
415   LoadIC_PushArgs(masm);
416 
417   // Perform tail call to the entry.
418   __ TailCallRuntime(Runtime::kLoadIC_Miss);
419 }
420 
GenerateRuntimeGetProperty(MacroAssembler * masm)421 void LoadIC::GenerateRuntimeGetProperty(MacroAssembler* masm) {
422   // The return address is on the stack.
423   Register receiver = LoadDescriptor::ReceiverRegister();
424   Register name = LoadDescriptor::NameRegister();
425 
426   DCHECK(!rbx.is(receiver) && !rbx.is(name));
427 
428   __ PopReturnAddressTo(rbx);
429   __ Push(receiver);
430   __ Push(name);
431   __ PushReturnAddressFrom(rbx);
432 
433   // Do tail-call to runtime routine.
434   __ TailCallRuntime(Runtime::kGetProperty);
435 }
436 
437 
GenerateMiss(MacroAssembler * masm)438 void KeyedLoadIC::GenerateMiss(MacroAssembler* masm) {
439   // The return address is on the stack.
440   Counters* counters = masm->isolate()->counters();
441   __ IncrementCounter(counters->ic_keyed_load_miss(), 1);
442 
443   LoadIC_PushArgs(masm);
444 
445   // Perform tail call to the entry.
446   __ TailCallRuntime(Runtime::kKeyedLoadIC_Miss);
447 }
448 
GenerateRuntimeGetProperty(MacroAssembler * masm)449 void KeyedLoadIC::GenerateRuntimeGetProperty(MacroAssembler* masm) {
450   // The return address is on the stack.
451   Register receiver = LoadDescriptor::ReceiverRegister();
452   Register name = LoadDescriptor::NameRegister();
453 
454   DCHECK(!rbx.is(receiver) && !rbx.is(name));
455 
456   __ PopReturnAddressTo(rbx);
457   __ Push(receiver);
458   __ Push(name);
459   __ PushReturnAddressFrom(rbx);
460 
461   // Do tail-call to runtime routine.
462   __ TailCallRuntime(Runtime::kKeyedGetProperty);
463 }
464 
StoreIC_PushArgs(MacroAssembler * masm)465 static void StoreIC_PushArgs(MacroAssembler* masm) {
466   Register receiver = StoreWithVectorDescriptor::ReceiverRegister();
467   Register name = StoreWithVectorDescriptor::NameRegister();
468   Register value = StoreWithVectorDescriptor::ValueRegister();
469   Register slot = StoreWithVectorDescriptor::SlotRegister();
470   Register vector = StoreWithVectorDescriptor::VectorRegister();
471   Register temp = r11;
472   DCHECK(!AreAliased(receiver, name, value, slot, vector, temp));
473 
474   __ PopReturnAddressTo(temp);
475   __ Push(value);
476   __ Push(slot);
477   __ Push(vector);
478   __ Push(receiver);
479   __ Push(name);
480   __ PushReturnAddressFrom(temp);
481 }
482 
483 
GenerateMiss(MacroAssembler * masm)484 void StoreIC::GenerateMiss(MacroAssembler* masm) {
485   // Return address is on the stack.
486   StoreIC_PushArgs(masm);
487 
488   // Perform tail call to the entry.
489   __ TailCallRuntime(Runtime::kStoreIC_Miss);
490 }
491 
492 
GenerateNormal(MacroAssembler * masm)493 void StoreIC::GenerateNormal(MacroAssembler* masm) {
494   Register receiver = StoreDescriptor::ReceiverRegister();
495   Register name = StoreDescriptor::NameRegister();
496   Register value = StoreDescriptor::ValueRegister();
497   Register dictionary = r11;
498   DCHECK(!AreAliased(dictionary, StoreWithVectorDescriptor::VectorRegister(),
499                      StoreWithVectorDescriptor::SlotRegister()));
500 
501   Label miss;
502 
503   __ movp(dictionary, FieldOperand(receiver, JSObject::kPropertiesOffset));
504   GenerateDictionaryStore(masm, &miss, dictionary, name, value, r8, r9);
505   Counters* counters = masm->isolate()->counters();
506   __ IncrementCounter(counters->ic_store_normal_hit(), 1);
507   __ ret(0);
508 
509   __ bind(&miss);
510   __ IncrementCounter(counters->ic_store_normal_miss(), 1);
511   GenerateMiss(masm);
512 }
513 
514 
GenerateMiss(MacroAssembler * masm)515 void KeyedStoreIC::GenerateMiss(MacroAssembler* masm) {
516   // Return address is on the stack.
517   StoreIC_PushArgs(masm);
518 
519   // Do tail-call to runtime routine.
520   __ TailCallRuntime(Runtime::kKeyedStoreIC_Miss);
521 }
522 
GenerateSlow(MacroAssembler * masm)523 void KeyedStoreIC::GenerateSlow(MacroAssembler* masm) {
524   // Return address is on the stack.
525   StoreIC_PushArgs(masm);
526 
527   // Do tail-call to runtime routine.
528   __ TailCallRuntime(Runtime::kKeyedStoreIC_Slow);
529 }
530 
531 #undef __
532 
533 
ComputeCondition(Token::Value op)534 Condition CompareIC::ComputeCondition(Token::Value op) {
535   switch (op) {
536     case Token::EQ_STRICT:
537     case Token::EQ:
538       return equal;
539     case Token::LT:
540       return less;
541     case Token::GT:
542       return greater;
543     case Token::LTE:
544       return less_equal;
545     case Token::GTE:
546       return greater_equal;
547     default:
548       UNREACHABLE();
549       return no_condition;
550   }
551 }
552 
553 
HasInlinedSmiCode(Address address)554 bool CompareIC::HasInlinedSmiCode(Address address) {
555   // The address of the instruction following the call.
556   Address test_instruction_address =
557       address + Assembler::kCallTargetAddressOffset;
558 
559   // If the instruction following the call is not a test al, nothing
560   // was inlined.
561   return *test_instruction_address == Assembler::kTestAlByte;
562 }
563 
564 
PatchInlinedSmiCode(Isolate * isolate,Address address,InlinedSmiCheck check)565 void PatchInlinedSmiCode(Isolate* isolate, Address address,
566                          InlinedSmiCheck check) {
567   // The address of the instruction following the call.
568   Address test_instruction_address =
569       address + Assembler::kCallTargetAddressOffset;
570 
571   // If the instruction following the call is not a test al, nothing
572   // was inlined.
573   if (*test_instruction_address != Assembler::kTestAlByte) {
574     DCHECK(*test_instruction_address == Assembler::kNopByte);
575     return;
576   }
577 
578   Address delta_address = test_instruction_address + 1;
579   // The delta to the start of the map check instruction and the
580   // condition code uses at the patched jump.
581   uint8_t delta = *reinterpret_cast<uint8_t*>(delta_address);
582   if (FLAG_trace_ic) {
583     PrintF("[  patching ic at %p, test=%p, delta=%d\n",
584            static_cast<void*>(address),
585            static_cast<void*>(test_instruction_address), delta);
586   }
587 
588   // Patch with a short conditional jump. Enabling means switching from a short
589   // jump-if-carry/not-carry to jump-if-zero/not-zero, whereas disabling is the
590   // reverse operation of that.
591   Address jmp_address = test_instruction_address - delta;
592   DCHECK((check == ENABLE_INLINED_SMI_CHECK)
593              ? (*jmp_address == Assembler::kJncShortOpcode ||
594                 *jmp_address == Assembler::kJcShortOpcode)
595              : (*jmp_address == Assembler::kJnzShortOpcode ||
596                 *jmp_address == Assembler::kJzShortOpcode));
597   Condition cc =
598       (check == ENABLE_INLINED_SMI_CHECK)
599           ? (*jmp_address == Assembler::kJncShortOpcode ? not_zero : zero)
600           : (*jmp_address == Assembler::kJnzShortOpcode ? not_carry : carry);
601   *jmp_address = static_cast<byte>(Assembler::kJccShortPrefix | cc);
602 }
603 }  // namespace internal
604 }  // namespace v8
605 
606 #endif  // V8_TARGET_ARCH_X64
607