1 // Copyright 2012 the V8 project authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file.
4
5 #if V8_TARGET_ARCH_X64
6
7 #include "src/codegen.h"
8 #include "src/ic/ic.h"
9 #include "src/ic/ic-compiler.h"
10 #include "src/ic/stub-cache.h"
11
12 namespace v8 {
13 namespace internal {
14
15 // ----------------------------------------------------------------------------
16 // Static IC stub generators.
17 //
18
19 #define __ ACCESS_MASM(masm)
20
21 // Helper function used to load a property from a dictionary backing storage.
22 // This function may return false negatives, so miss_label
23 // must always call a backup property load that is complete.
24 // This function is safe to call if name is not an internalized string,
25 // and will jump to the miss_label in that case.
26 // The generated code assumes that the receiver has slow properties,
27 // is not a global object and does not have interceptors.
GenerateDictionaryLoad(MacroAssembler * masm,Label * miss_label,Register elements,Register name,Register r0,Register r1,Register result)28 static void GenerateDictionaryLoad(MacroAssembler* masm, Label* miss_label,
29 Register elements, Register name,
30 Register r0, Register r1, Register result) {
31 // Register use:
32 //
33 // elements - holds the property dictionary on entry and is unchanged.
34 //
35 // name - holds the name of the property on entry and is unchanged.
36 //
37 // r0 - used to hold the capacity of the property dictionary.
38 //
39 // r1 - used to hold the index into the property dictionary.
40 //
41 // result - holds the result on exit if the load succeeded.
42
43 Label done;
44
45 // Probe the dictionary.
46 NameDictionaryLookupStub::GeneratePositiveLookup(masm, miss_label, &done,
47 elements, name, r0, r1);
48
49 // If probing finds an entry in the dictionary, r1 contains the
50 // index into the dictionary. Check that the value is a normal
51 // property.
52 __ bind(&done);
53 const int kElementsStartOffset =
54 NameDictionary::kHeaderSize +
55 NameDictionary::kElementsStartIndex * kPointerSize;
56 const int kDetailsOffset = kElementsStartOffset + 2 * kPointerSize;
57 __ Test(Operand(elements, r1, times_pointer_size,
58 kDetailsOffset - kHeapObjectTag),
59 Smi::FromInt(PropertyDetails::TypeField::kMask));
60 __ j(not_zero, miss_label);
61
62 // Get the value at the masked, scaled index.
63 const int kValueOffset = kElementsStartOffset + kPointerSize;
64 __ movp(result, Operand(elements, r1, times_pointer_size,
65 kValueOffset - kHeapObjectTag));
66 }
67
68
69 // Helper function used to store a property to a dictionary backing
70 // storage. This function may fail to store a property even though it
71 // is in the dictionary, so code at miss_label must always call a
72 // backup property store that is complete. This function is safe to
73 // call if name is not an internalized string, and will jump to the miss_label
74 // in that case. The generated code assumes that the receiver has slow
75 // properties, is not a global object and does not have interceptors.
GenerateDictionaryStore(MacroAssembler * masm,Label * miss_label,Register elements,Register name,Register value,Register scratch0,Register scratch1)76 static void GenerateDictionaryStore(MacroAssembler* masm, Label* miss_label,
77 Register elements, Register name,
78 Register value, Register scratch0,
79 Register scratch1) {
80 // Register use:
81 //
82 // elements - holds the property dictionary on entry and is clobbered.
83 //
84 // name - holds the name of the property on entry and is unchanged.
85 //
86 // value - holds the value to store and is unchanged.
87 //
88 // scratch0 - used during the positive dictionary lookup and is clobbered.
89 //
90 // scratch1 - used for index into the property dictionary and is clobbered.
91 Label done;
92
93 // Probe the dictionary.
94 NameDictionaryLookupStub::GeneratePositiveLookup(
95 masm, miss_label, &done, elements, name, scratch0, scratch1);
96
97 // If probing finds an entry in the dictionary, scratch0 contains the
98 // index into the dictionary. Check that the value is a normal
99 // property that is not read only.
100 __ bind(&done);
101 const int kElementsStartOffset =
102 NameDictionary::kHeaderSize +
103 NameDictionary::kElementsStartIndex * kPointerSize;
104 const int kDetailsOffset = kElementsStartOffset + 2 * kPointerSize;
105 const int kTypeAndReadOnlyMask =
106 PropertyDetails::TypeField::kMask |
107 PropertyDetails::AttributesField::encode(READ_ONLY);
108 __ Test(Operand(elements, scratch1, times_pointer_size,
109 kDetailsOffset - kHeapObjectTag),
110 Smi::FromInt(kTypeAndReadOnlyMask));
111 __ j(not_zero, miss_label);
112
113 // Store the value at the masked, scaled index.
114 const int kValueOffset = kElementsStartOffset + kPointerSize;
115 __ leap(scratch1, Operand(elements, scratch1, times_pointer_size,
116 kValueOffset - kHeapObjectTag));
117 __ movp(Operand(scratch1, 0), value);
118
119 // Update write barrier. Make sure not to clobber the value.
120 __ movp(scratch0, value);
121 __ RecordWrite(elements, scratch1, scratch0, kDontSaveFPRegs);
122 }
123
KeyedStoreGenerateMegamorphicHelper(MacroAssembler * masm,Label * fast_object,Label * fast_double,Label * slow,KeyedStoreCheckMap check_map,KeyedStoreIncrementLength increment_length)124 static void KeyedStoreGenerateMegamorphicHelper(
125 MacroAssembler* masm, Label* fast_object, Label* fast_double, Label* slow,
126 KeyedStoreCheckMap check_map, KeyedStoreIncrementLength increment_length) {
127 Label transition_smi_elements;
128 Label finish_object_store, non_double_value, transition_double_elements;
129 Label fast_double_without_map_check;
130 Register receiver = StoreDescriptor::ReceiverRegister();
131 Register key = StoreDescriptor::NameRegister();
132 Register value = StoreDescriptor::ValueRegister();
133 DCHECK(receiver.is(rdx));
134 DCHECK(key.is(rcx));
135 DCHECK(value.is(rax));
136 // Fast case: Do the store, could be either Object or double.
137 __ bind(fast_object);
138 // rbx: receiver's elements array (a FixedArray)
139 // receiver is a JSArray.
140 // r9: map of receiver
141 if (check_map == kCheckMap) {
142 __ movp(rdi, FieldOperand(rbx, HeapObject::kMapOffset));
143 __ CompareRoot(rdi, Heap::kFixedArrayMapRootIndex);
144 __ j(not_equal, fast_double);
145 }
146
147 // HOLECHECK: guards "A[i] = V"
148 // We have to go to the runtime if the current value is the hole because
149 // there may be a callback on the element
150 Label holecheck_passed1;
151 __ movp(kScratchRegister,
152 FieldOperand(rbx, key, times_pointer_size, FixedArray::kHeaderSize));
153 __ CompareRoot(kScratchRegister, Heap::kTheHoleValueRootIndex);
154 __ j(not_equal, &holecheck_passed1);
155 __ JumpIfDictionaryInPrototypeChain(receiver, rdi, kScratchRegister, slow);
156
157 __ bind(&holecheck_passed1);
158
159 // Smi stores don't require further checks.
160 Label non_smi_value;
161 __ JumpIfNotSmi(value, &non_smi_value);
162 if (increment_length == kIncrementLength) {
163 // Add 1 to receiver->length.
164 __ leal(rdi, Operand(key, 1));
165 __ Integer32ToSmiField(FieldOperand(receiver, JSArray::kLengthOffset), rdi);
166 }
167 // It's irrelevant whether array is smi-only or not when writing a smi.
168 __ movp(FieldOperand(rbx, key, times_pointer_size, FixedArray::kHeaderSize),
169 value);
170 __ ret(0);
171
172 __ bind(&non_smi_value);
173 // Writing a non-smi, check whether array allows non-smi elements.
174 // r9: receiver's map
175 __ CheckFastObjectElements(r9, &transition_smi_elements);
176
177 __ bind(&finish_object_store);
178 if (increment_length == kIncrementLength) {
179 // Add 1 to receiver->length.
180 __ leal(rdi, Operand(key, 1));
181 __ Integer32ToSmiField(FieldOperand(receiver, JSArray::kLengthOffset), rdi);
182 }
183 __ movp(FieldOperand(rbx, key, times_pointer_size, FixedArray::kHeaderSize),
184 value);
185 __ movp(rdx, value); // Preserve the value which is returned.
186 __ RecordWriteArray(rbx, rdx, key, kDontSaveFPRegs, EMIT_REMEMBERED_SET,
187 OMIT_SMI_CHECK);
188 __ ret(0);
189
190 __ bind(fast_double);
191 if (check_map == kCheckMap) {
192 // Check for fast double array case. If this fails, call through to the
193 // runtime.
194 // rdi: elements array's map
195 __ CompareRoot(rdi, Heap::kFixedDoubleArrayMapRootIndex);
196 __ j(not_equal, slow);
197 }
198
199 // HOLECHECK: guards "A[i] double hole?"
200 // We have to see if the double version of the hole is present. If so
201 // go to the runtime.
202 uint32_t offset = FixedDoubleArray::kHeaderSize + sizeof(kHoleNanLower32);
203 __ cmpl(FieldOperand(rbx, key, times_8, offset), Immediate(kHoleNanUpper32));
204 __ j(not_equal, &fast_double_without_map_check);
205 __ JumpIfDictionaryInPrototypeChain(receiver, rdi, kScratchRegister, slow);
206
207 __ bind(&fast_double_without_map_check);
208 __ StoreNumberToDoubleElements(value, rbx, key, kScratchDoubleReg,
209 &transition_double_elements);
210 if (increment_length == kIncrementLength) {
211 // Add 1 to receiver->length.
212 __ leal(rdi, Operand(key, 1));
213 __ Integer32ToSmiField(FieldOperand(receiver, JSArray::kLengthOffset), rdi);
214 }
215 __ ret(0);
216
217 __ bind(&transition_smi_elements);
218 __ movp(rbx, FieldOperand(receiver, HeapObject::kMapOffset));
219
220 // Transition the array appropriately depending on the value type.
221 __ movp(r9, FieldOperand(value, HeapObject::kMapOffset));
222 __ CompareRoot(r9, Heap::kHeapNumberMapRootIndex);
223 __ j(not_equal, &non_double_value);
224
225 // Value is a double. Transition FAST_SMI_ELEMENTS ->
226 // FAST_DOUBLE_ELEMENTS and complete the store.
227 __ LoadTransitionedArrayMapConditional(FAST_SMI_ELEMENTS,
228 FAST_DOUBLE_ELEMENTS, rbx, rdi, slow);
229 AllocationSiteMode mode =
230 AllocationSite::GetMode(FAST_SMI_ELEMENTS, FAST_DOUBLE_ELEMENTS);
231 ElementsTransitionGenerator::GenerateSmiToDouble(masm, receiver, key, value,
232 rbx, mode, slow);
233 __ movp(rbx, FieldOperand(receiver, JSObject::kElementsOffset));
234 __ jmp(&fast_double_without_map_check);
235
236 __ bind(&non_double_value);
237 // Value is not a double, FAST_SMI_ELEMENTS -> FAST_ELEMENTS
238 __ LoadTransitionedArrayMapConditional(FAST_SMI_ELEMENTS, FAST_ELEMENTS, rbx,
239 rdi, slow);
240 mode = AllocationSite::GetMode(FAST_SMI_ELEMENTS, FAST_ELEMENTS);
241 ElementsTransitionGenerator::GenerateMapChangeElementsTransition(
242 masm, receiver, key, value, rbx, mode, slow);
243 __ movp(rbx, FieldOperand(receiver, JSObject::kElementsOffset));
244 __ jmp(&finish_object_store);
245
246 __ bind(&transition_double_elements);
247 // Elements are FAST_DOUBLE_ELEMENTS, but value is an Object that's not a
248 // HeapNumber. Make sure that the receiver is a Array with FAST_ELEMENTS and
249 // transition array from FAST_DOUBLE_ELEMENTS to FAST_ELEMENTS
250 __ movp(rbx, FieldOperand(receiver, HeapObject::kMapOffset));
251 __ LoadTransitionedArrayMapConditional(FAST_DOUBLE_ELEMENTS, FAST_ELEMENTS,
252 rbx, rdi, slow);
253 mode = AllocationSite::GetMode(FAST_DOUBLE_ELEMENTS, FAST_ELEMENTS);
254 ElementsTransitionGenerator::GenerateDoubleToObject(masm, receiver, key,
255 value, rbx, mode, slow);
256 __ movp(rbx, FieldOperand(receiver, JSObject::kElementsOffset));
257 __ jmp(&finish_object_store);
258 }
259
260
GenerateMegamorphic(MacroAssembler * masm,LanguageMode language_mode)261 void KeyedStoreIC::GenerateMegamorphic(MacroAssembler* masm,
262 LanguageMode language_mode) {
263 // Return address is on the stack.
264 Label slow, slow_with_tagged_index, fast_object, fast_object_grow;
265 Label fast_double, fast_double_grow;
266 Label array, extra, check_if_double_array, maybe_name_key, miss;
267 Register receiver = StoreDescriptor::ReceiverRegister();
268 Register key = StoreDescriptor::NameRegister();
269 DCHECK(receiver.is(rdx));
270 DCHECK(key.is(rcx));
271
272 // Check that the object isn't a smi.
273 __ JumpIfSmi(receiver, &slow_with_tagged_index);
274 // Get the map from the receiver.
275 __ movp(r9, FieldOperand(receiver, HeapObject::kMapOffset));
276 // Check that the receiver does not require access checks.
277 // The generic stub does not perform map checks.
278 __ testb(FieldOperand(r9, Map::kBitFieldOffset),
279 Immediate(1 << Map::kIsAccessCheckNeeded));
280 __ j(not_zero, &slow_with_tagged_index);
281 // Check that the key is a smi.
282 __ JumpIfNotSmi(key, &maybe_name_key);
283 __ SmiToInteger32(key, key);
284
285 __ CmpInstanceType(r9, JS_ARRAY_TYPE);
286 __ j(equal, &array);
287 // Check that the object is some kind of JS object EXCEPT JS Value type. In
288 // the case that the object is a value-wrapper object, we enter the runtime
289 // system to make sure that indexing into string objects works as intended.
290 STATIC_ASSERT(JS_VALUE_TYPE < JS_OBJECT_TYPE);
291 __ CmpInstanceType(r9, JS_OBJECT_TYPE);
292 __ j(below, &slow);
293
294 // Object case: Check key against length in the elements array.
295 __ movp(rbx, FieldOperand(receiver, JSObject::kElementsOffset));
296 // Check array bounds.
297 __ SmiCompareInteger32(FieldOperand(rbx, FixedArray::kLengthOffset), key);
298 // rbx: FixedArray
299 __ j(above, &fast_object);
300
301 // Slow case: call runtime.
302 __ bind(&slow);
303 __ Integer32ToSmi(key, key);
304 __ bind(&slow_with_tagged_index);
305 PropertyICCompiler::GenerateRuntimeSetProperty(masm, language_mode);
306 // Never returns to here.
307
308 __ bind(&maybe_name_key);
309 __ movp(r9, FieldOperand(key, HeapObject::kMapOffset));
310 __ movzxbp(r9, FieldOperand(r9, Map::kInstanceTypeOffset));
311 __ JumpIfNotUniqueNameInstanceType(r9, &slow_with_tagged_index);
312
313 Register vector = StoreWithVectorDescriptor::VectorRegister();
314 Register slot = StoreWithVectorDescriptor::SlotRegister();
315 // The handlers in the stub cache expect a vector and slot. Since we won't
316 // change the IC from any downstream misses, a dummy vector can be used.
317 Handle<TypeFeedbackVector> dummy_vector =
318 TypeFeedbackVector::DummyVector(masm->isolate());
319 int slot_index = dummy_vector->GetIndex(
320 FeedbackVectorSlot(TypeFeedbackVector::kDummyKeyedStoreICSlot));
321 __ Move(vector, dummy_vector);
322 __ Move(slot, Smi::FromInt(slot_index));
323
324 masm->isolate()->store_stub_cache()->GenerateProbe(masm, receiver, key, r9,
325 no_reg);
326 // Cache miss.
327 __ jmp(&miss);
328
329 // Extra capacity case: Check if there is extra capacity to
330 // perform the store and update the length. Used for adding one
331 // element to the array by writing to array[array.length].
332 __ bind(&extra);
333 // receiver is a JSArray.
334 // rbx: receiver's elements array (a FixedArray)
335 // flags: smicompare (receiver.length(), rbx)
336 __ j(not_equal, &slow); // do not leave holes in the array
337 __ SmiCompareInteger32(FieldOperand(rbx, FixedArray::kLengthOffset), key);
338 __ j(below_equal, &slow);
339 // Increment index to get new length.
340 __ movp(rdi, FieldOperand(rbx, HeapObject::kMapOffset));
341 __ CompareRoot(rdi, Heap::kFixedArrayMapRootIndex);
342 __ j(not_equal, &check_if_double_array);
343 __ jmp(&fast_object_grow);
344
345 __ bind(&check_if_double_array);
346 // rdi: elements array's map
347 __ CompareRoot(rdi, Heap::kFixedDoubleArrayMapRootIndex);
348 __ j(not_equal, &slow);
349 __ jmp(&fast_double_grow);
350
351 // Array case: Get the length and the elements array from the JS
352 // array. Check that the array is in fast mode (and writable); if it
353 // is the length is always a smi.
354 __ bind(&array);
355 // receiver is a JSArray.
356 __ movp(rbx, FieldOperand(receiver, JSObject::kElementsOffset));
357
358 // Check the key against the length in the array, compute the
359 // address to store into and fall through to fast case.
360 __ SmiCompareInteger32(FieldOperand(receiver, JSArray::kLengthOffset), key);
361 __ j(below_equal, &extra);
362
363 KeyedStoreGenerateMegamorphicHelper(masm, &fast_object, &fast_double, &slow,
364 kCheckMap, kDontIncrementLength);
365 KeyedStoreGenerateMegamorphicHelper(masm, &fast_object_grow,
366 &fast_double_grow, &slow, kDontCheckMap,
367 kIncrementLength);
368
369 __ bind(&miss);
370 GenerateMiss(masm);
371 }
372
GenerateNormal(MacroAssembler * masm)373 void LoadIC::GenerateNormal(MacroAssembler* masm) {
374 Register dictionary = rax;
375 DCHECK(!dictionary.is(LoadDescriptor::ReceiverRegister()));
376 DCHECK(!dictionary.is(LoadDescriptor::NameRegister()));
377
378 Label slow;
379
380 __ movp(dictionary, FieldOperand(LoadDescriptor::ReceiverRegister(),
381 JSObject::kPropertiesOffset));
382 GenerateDictionaryLoad(masm, &slow, dictionary,
383 LoadDescriptor::NameRegister(), rbx, rdi, rax);
384 __ ret(0);
385
386 // Dictionary load failed, go slow (but don't miss).
387 __ bind(&slow);
388 LoadIC::GenerateRuntimeGetProperty(masm);
389 }
390
391
LoadIC_PushArgs(MacroAssembler * masm)392 static void LoadIC_PushArgs(MacroAssembler* masm) {
393 Register receiver = LoadDescriptor::ReceiverRegister();
394 Register name = LoadDescriptor::NameRegister();
395 Register slot = LoadDescriptor::SlotRegister();
396 Register vector = LoadWithVectorDescriptor::VectorRegister();
397 DCHECK(!rdi.is(receiver) && !rdi.is(name) && !rdi.is(slot) &&
398 !rdi.is(vector));
399
400 __ PopReturnAddressTo(rdi);
401 __ Push(receiver);
402 __ Push(name);
403 __ Push(slot);
404 __ Push(vector);
405 __ PushReturnAddressFrom(rdi);
406 }
407
408
GenerateMiss(MacroAssembler * masm)409 void LoadIC::GenerateMiss(MacroAssembler* masm) {
410 // The return address is on the stack.
411
412 Counters* counters = masm->isolate()->counters();
413 __ IncrementCounter(counters->ic_load_miss(), 1);
414
415 LoadIC_PushArgs(masm);
416
417 // Perform tail call to the entry.
418 __ TailCallRuntime(Runtime::kLoadIC_Miss);
419 }
420
GenerateRuntimeGetProperty(MacroAssembler * masm)421 void LoadIC::GenerateRuntimeGetProperty(MacroAssembler* masm) {
422 // The return address is on the stack.
423 Register receiver = LoadDescriptor::ReceiverRegister();
424 Register name = LoadDescriptor::NameRegister();
425
426 DCHECK(!rbx.is(receiver) && !rbx.is(name));
427
428 __ PopReturnAddressTo(rbx);
429 __ Push(receiver);
430 __ Push(name);
431 __ PushReturnAddressFrom(rbx);
432
433 // Do tail-call to runtime routine.
434 __ TailCallRuntime(Runtime::kGetProperty);
435 }
436
437
GenerateMiss(MacroAssembler * masm)438 void KeyedLoadIC::GenerateMiss(MacroAssembler* masm) {
439 // The return address is on the stack.
440 Counters* counters = masm->isolate()->counters();
441 __ IncrementCounter(counters->ic_keyed_load_miss(), 1);
442
443 LoadIC_PushArgs(masm);
444
445 // Perform tail call to the entry.
446 __ TailCallRuntime(Runtime::kKeyedLoadIC_Miss);
447 }
448
GenerateRuntimeGetProperty(MacroAssembler * masm)449 void KeyedLoadIC::GenerateRuntimeGetProperty(MacroAssembler* masm) {
450 // The return address is on the stack.
451 Register receiver = LoadDescriptor::ReceiverRegister();
452 Register name = LoadDescriptor::NameRegister();
453
454 DCHECK(!rbx.is(receiver) && !rbx.is(name));
455
456 __ PopReturnAddressTo(rbx);
457 __ Push(receiver);
458 __ Push(name);
459 __ PushReturnAddressFrom(rbx);
460
461 // Do tail-call to runtime routine.
462 __ TailCallRuntime(Runtime::kKeyedGetProperty);
463 }
464
StoreIC_PushArgs(MacroAssembler * masm)465 static void StoreIC_PushArgs(MacroAssembler* masm) {
466 Register receiver = StoreWithVectorDescriptor::ReceiverRegister();
467 Register name = StoreWithVectorDescriptor::NameRegister();
468 Register value = StoreWithVectorDescriptor::ValueRegister();
469 Register slot = StoreWithVectorDescriptor::SlotRegister();
470 Register vector = StoreWithVectorDescriptor::VectorRegister();
471 Register temp = r11;
472 DCHECK(!AreAliased(receiver, name, value, slot, vector, temp));
473
474 __ PopReturnAddressTo(temp);
475 __ Push(value);
476 __ Push(slot);
477 __ Push(vector);
478 __ Push(receiver);
479 __ Push(name);
480 __ PushReturnAddressFrom(temp);
481 }
482
483
GenerateMiss(MacroAssembler * masm)484 void StoreIC::GenerateMiss(MacroAssembler* masm) {
485 // Return address is on the stack.
486 StoreIC_PushArgs(masm);
487
488 // Perform tail call to the entry.
489 __ TailCallRuntime(Runtime::kStoreIC_Miss);
490 }
491
492
GenerateNormal(MacroAssembler * masm)493 void StoreIC::GenerateNormal(MacroAssembler* masm) {
494 Register receiver = StoreDescriptor::ReceiverRegister();
495 Register name = StoreDescriptor::NameRegister();
496 Register value = StoreDescriptor::ValueRegister();
497 Register dictionary = r11;
498 DCHECK(!AreAliased(dictionary, StoreWithVectorDescriptor::VectorRegister(),
499 StoreWithVectorDescriptor::SlotRegister()));
500
501 Label miss;
502
503 __ movp(dictionary, FieldOperand(receiver, JSObject::kPropertiesOffset));
504 GenerateDictionaryStore(masm, &miss, dictionary, name, value, r8, r9);
505 Counters* counters = masm->isolate()->counters();
506 __ IncrementCounter(counters->ic_store_normal_hit(), 1);
507 __ ret(0);
508
509 __ bind(&miss);
510 __ IncrementCounter(counters->ic_store_normal_miss(), 1);
511 GenerateMiss(masm);
512 }
513
514
GenerateMiss(MacroAssembler * masm)515 void KeyedStoreIC::GenerateMiss(MacroAssembler* masm) {
516 // Return address is on the stack.
517 StoreIC_PushArgs(masm);
518
519 // Do tail-call to runtime routine.
520 __ TailCallRuntime(Runtime::kKeyedStoreIC_Miss);
521 }
522
GenerateSlow(MacroAssembler * masm)523 void KeyedStoreIC::GenerateSlow(MacroAssembler* masm) {
524 // Return address is on the stack.
525 StoreIC_PushArgs(masm);
526
527 // Do tail-call to runtime routine.
528 __ TailCallRuntime(Runtime::kKeyedStoreIC_Slow);
529 }
530
531 #undef __
532
533
ComputeCondition(Token::Value op)534 Condition CompareIC::ComputeCondition(Token::Value op) {
535 switch (op) {
536 case Token::EQ_STRICT:
537 case Token::EQ:
538 return equal;
539 case Token::LT:
540 return less;
541 case Token::GT:
542 return greater;
543 case Token::LTE:
544 return less_equal;
545 case Token::GTE:
546 return greater_equal;
547 default:
548 UNREACHABLE();
549 return no_condition;
550 }
551 }
552
553
HasInlinedSmiCode(Address address)554 bool CompareIC::HasInlinedSmiCode(Address address) {
555 // The address of the instruction following the call.
556 Address test_instruction_address =
557 address + Assembler::kCallTargetAddressOffset;
558
559 // If the instruction following the call is not a test al, nothing
560 // was inlined.
561 return *test_instruction_address == Assembler::kTestAlByte;
562 }
563
564
PatchInlinedSmiCode(Isolate * isolate,Address address,InlinedSmiCheck check)565 void PatchInlinedSmiCode(Isolate* isolate, Address address,
566 InlinedSmiCheck check) {
567 // The address of the instruction following the call.
568 Address test_instruction_address =
569 address + Assembler::kCallTargetAddressOffset;
570
571 // If the instruction following the call is not a test al, nothing
572 // was inlined.
573 if (*test_instruction_address != Assembler::kTestAlByte) {
574 DCHECK(*test_instruction_address == Assembler::kNopByte);
575 return;
576 }
577
578 Address delta_address = test_instruction_address + 1;
579 // The delta to the start of the map check instruction and the
580 // condition code uses at the patched jump.
581 uint8_t delta = *reinterpret_cast<uint8_t*>(delta_address);
582 if (FLAG_trace_ic) {
583 PrintF("[ patching ic at %p, test=%p, delta=%d\n",
584 static_cast<void*>(address),
585 static_cast<void*>(test_instruction_address), delta);
586 }
587
588 // Patch with a short conditional jump. Enabling means switching from a short
589 // jump-if-carry/not-carry to jump-if-zero/not-zero, whereas disabling is the
590 // reverse operation of that.
591 Address jmp_address = test_instruction_address - delta;
592 DCHECK((check == ENABLE_INLINED_SMI_CHECK)
593 ? (*jmp_address == Assembler::kJncShortOpcode ||
594 *jmp_address == Assembler::kJcShortOpcode)
595 : (*jmp_address == Assembler::kJnzShortOpcode ||
596 *jmp_address == Assembler::kJzShortOpcode));
597 Condition cc =
598 (check == ENABLE_INLINED_SMI_CHECK)
599 ? (*jmp_address == Assembler::kJncShortOpcode ? not_zero : zero)
600 : (*jmp_address == Assembler::kJnzShortOpcode ? not_carry : carry);
601 *jmp_address = static_cast<byte>(Assembler::kJccShortPrefix | cc);
602 }
603 } // namespace internal
604 } // namespace v8
605
606 #endif // V8_TARGET_ARCH_X64
607