src/3rdparty/v8/src/ic.cc

   1 // Copyright 2012 the V8 project authors. All rights reserved.
   2 // Redistribution and use in source and binary forms, with or without
   3 // modification, are permitted provided that the following conditions are
   4 // met:
   5 //
   6 //     * Redistributions of source code must retain the above copyright
   7 //       notice, this list of conditions and the following disclaimer.
   8 //     * Redistributions in binary form must reproduce the above
   9 //       copyright notice, this list of conditions and the following
  10 //       disclaimer in the documentation and/or other materials provided
  11 //       with the distribution.
  12 //     * Neither the name of Google Inc. nor the names of its
  13 //       contributors may be used to endorse or promote products derived
  14 //       from this software without specific prior written permission.
  15 //
  16 // THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  17 // "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  18 // LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
  19 // A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
  20 // OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
  21 // SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
  22 // LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
  23 // DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
  24 // THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  25 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
  26 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  27
  28 #include "v8.h"
  29
  30 #include "accessors.h"
  31 #include "api.h"
  32 #include "arguments.h"
  33 #include "codegen.h"
  34 #include "execution.h"
  35 #include "ic-inl.h"
  36 #include "runtime.h"
  37 #include "stub-cache.h"
  38
  39 namespace v8 {
  40 namespace internal {
  41
  42 #ifdef DEBUG
  43 char IC::TransitionMarkFromState(IC::State state) {
  44   switch (state) {
  45     case UNINITIALIZED: return '0';
  46     case PREMONOMORPHIC: return 'P';
  47     case MONOMORPHIC: return '1';
  48     case MONOMORPHIC_PROTOTYPE_FAILURE: return '^';
  49     case MEGAMORPHIC: return IsGeneric() ? 'G' : 'N';
  50
  51     // We never see the debugger states here, because the state is
  52     // computed from the original code - not the patched code. Let
  53     // these cases fall through to the unreachable code below.
  54     case DEBUG_BREAK: break;
  55     case DEBUG_PREPARE_STEP_IN: break;
  56   }
  57   UNREACHABLE();
  58   return 0;
  59 }
  60
  61 void IC::TraceIC(const char* type,
  62                  Handle<Object> name,
  63                  State old_state,
  64                  Code* new_target) {
  65   if (FLAG_trace_ic) {
  66     State new_state = StateFrom(new_target,
  67                                 HEAP->undefined_value(),
  68                                 HEAP->undefined_value());
  69     PrintF("[%s in ", type);
  70     StackFrameIterator it;
  71     while (it.frame()->fp() != this->fp()) it.Advance();
  72     StackFrame* raw_frame = it.frame();
  73     if (raw_frame->is_internal()) {
  74       Isolate* isolate = new_target->GetIsolate();
  75       Code* apply_builtin = isolate->builtins()->builtin(
  76           Builtins::kFunctionApply);
  77       if (raw_frame->unchecked_code() == apply_builtin) {
  78         PrintF("apply from ");
  79         it.Advance();
  80         raw_frame = it.frame();
  81       }
  82     }
  83     JavaScriptFrame::PrintTop(stdout, false, true);
  84     bool new_can_grow =
  85         Code::GetKeyedAccessGrowMode(new_target->extra_ic_state()) ==
  86         ALLOW_JSARRAY_GROWTH;
  87     PrintF(" (%c->%c%s)",
  88            TransitionMarkFromState(old_state),
  89            TransitionMarkFromState(new_state),
  90            new_can_grow ? ".GROW" : "");
  91     name->Print();
  92     PrintF("]\n");
  93   }
  94 }
  95
  96 #define TRACE_GENERIC_IC(type, reason)                          \
  97   do {                                                          \
  98     if (FLAG_trace_ic) {                                        \
  99       PrintF("[%s patching generic stub in ", type);            \
 100       JavaScriptFrame::PrintTop(stdout, false, true);           \
 101       PrintF(" (%s)]\n", reason);                               \
 102     }                                                           \
 103   } while (false)
 104
 105 #else
 106 #define TRACE_GENERIC_IC(type, reason)
 107 #endif  // DEBUG
 108
 109 #define TRACE_IC(type, name, old_state, new_target)             \
 110   ASSERT((TraceIC(type, name, old_state, new_target), true))
 111
 112 IC::IC(FrameDepth depth, Isolate* isolate) : isolate_(isolate) {
 113   ASSERT(isolate == Isolate::Current());
 114   // To improve the performance of the (much used) IC code, we unfold
 115   // a few levels of the stack frame iteration code. This yields a
 116   // ~35% speedup when running DeltaBlue with the '--nouse-ic' flag.
 117   const Address entry =
 118       Isolate::c_entry_fp(isolate->thread_local_top());
 119   Address* pc_address =
 120       reinterpret_cast<Address*>(entry + ExitFrameConstants::kCallerPCOffset);
 121   Address fp = Memory::Address_at(entry + ExitFrameConstants::kCallerFPOffset);
 122   // If there's another JavaScript frame on the stack, we need to look
 123   // one frame further down the stack to find the frame pointer and
 124   // the return address stack slot.
 125   if (depth == EXTRA_CALL_FRAME) {
 126     const int kCallerPCOffset = StandardFrameConstants::kCallerPCOffset;
 127     pc_address = reinterpret_cast<Address*>(fp + kCallerPCOffset);
 128     fp = Memory::Address_at(fp + StandardFrameConstants::kCallerFPOffset);
 129   }
 130 #ifdef DEBUG
 131   StackFrameIterator it;
 132   for (int i = 0; i < depth + 1; i++) it.Advance();
 133   StackFrame* frame = it.frame();
 134   ASSERT(fp == frame->fp() && pc_address == frame->pc_address());
 135 #endif
 136   fp_ = fp;
 137   pc_address_ = pc_address;
 138 }
 139
 140
 141 #ifdef ENABLE_DEBUGGER_SUPPORT
 142 Address IC::OriginalCodeAddress() const {
 143   HandleScope scope;
 144   // Compute the JavaScript frame for the frame pointer of this IC
 145   // structure. We need this to be able to find the function
 146   // corresponding to the frame.
 147   StackFrameIterator it;
 148   while (it.frame()->fp() != this->fp()) it.Advance();
 149   JavaScriptFrame* frame = JavaScriptFrame::cast(it.frame());
 150   // Find the function on the stack and both the active code for the
 151   // function and the original code.
 152   JSFunction* function = JSFunction::cast(frame->function());
 153   Handle<SharedFunctionInfo> shared(function->shared());
 154   Code* code = shared->code();
 155   ASSERT(Debug::HasDebugInfo(shared));
 156   Code* original_code = Debug::GetDebugInfo(shared)->original_code();
 157   ASSERT(original_code->IsCode());
 158   // Get the address of the call site in the active code. This is the
 159   // place where the call to DebugBreakXXX is and where the IC
 160   // normally would be.
 161   Address addr = pc() - Assembler::kCallTargetAddressOffset;
 162   // Return the address in the original code. This is the place where
 163   // the call which has been overwritten by the DebugBreakXXX resides
 164   // and the place where the inline cache system should look.
 165   intptr_t delta =
 166       original_code->instruction_start() - code->instruction_start();
 167   return addr + delta;
 168 }
 169 #endif
 170
 171
 172 static bool HasNormalObjectsInPrototypeChain(Isolate* isolate,
 173                                              LookupResult* lookup,
 174                                              Object* receiver) {
 175   Object* end = lookup->IsProperty()
 176       ? lookup->holder() : Object::cast(isolate->heap()->null_value());
 177   for (Object* current = receiver;
 178        current != end;
 179        current = current->GetPrototype()) {
 180     if (current->IsJSObject() &&
 181         !JSObject::cast(current)->HasFastProperties() &&
 182         !current->IsJSGlobalProxy() &&
 183         !current->IsJSGlobalObject()) {
 184       return true;
 185     }
 186   }
 187
 188   return false;
 189 }
 190
 191
 192 static bool TryRemoveInvalidPrototypeDependentStub(Code* target,
 193                                                    Object* receiver,
 194                                                    Object* name) {
 195   InlineCacheHolderFlag cache_holder =
 196       Code::ExtractCacheHolderFromFlags(target->flags());
 197
 198   if (cache_holder == OWN_MAP && !receiver->IsJSObject()) {
 199     // The stub was generated for JSObject but called for non-JSObject.
 200     // IC::GetCodeCacheHolder is not applicable.
 201     return false;
 202   } else if (cache_holder == PROTOTYPE_MAP &&
 203              receiver->GetPrototype()->IsNull()) {
 204     // IC::GetCodeCacheHolder is not applicable.
 205     return false;
 206   }
 207   Map* map = IC::GetCodeCacheHolder(receiver, cache_holder)->map();
 208
 209   // Decide whether the inline cache failed because of changes to the
 210   // receiver itself or changes to one of its prototypes.
 211   //
 212   // If there are changes to the receiver itself, the map of the
 213   // receiver will have changed and the current target will not be in
 214   // the receiver map's code cache.  Therefore, if the current target
 215   // is in the receiver map's code cache, the inline cache failed due
 216   // to prototype check failure.
 217   int index = map->IndexInCodeCache(name, target);
 218   if (index >= 0) {
 219     map->RemoveFromCodeCache(String::cast(name), target, index);
 220     return true;
 221   }
 222
 223   return false;
 224 }
 225
 226
 227 IC::State IC::StateFrom(Code* target, Object* receiver, Object* name) {
 228   IC::State state = target->ic_state();
 229
 230   if (state != MONOMORPHIC || !name->IsString()) return state;
 231   if (receiver->IsUndefined() || receiver->IsNull()) return state;
 232
 233   // For keyed load/store/call, the most likely cause of cache failure is
 234   // that the key has changed.  We do not distinguish between
 235   // prototype and non-prototype failures for keyed access.
 236   Code::Kind kind = target->kind();
 237   if (kind == Code::KEYED_LOAD_IC ||
 238       kind == Code::KEYED_STORE_IC ||
 239       kind == Code::KEYED_CALL_IC) {
 240     return MONOMORPHIC;
 241   }
 242
 243   // Remove the target from the code cache if it became invalid
 244   // because of changes in the prototype chain to avoid hitting it
 245   // again.
 246   // Call stubs handle this later to allow extra IC state
 247   // transitions.
 248   if (kind != Code::CALL_IC &&
 249       TryRemoveInvalidPrototypeDependentStub(target, receiver, name)) {
 250     return MONOMORPHIC_PROTOTYPE_FAILURE;
 251   }
 252
 253   // The builtins object is special.  It only changes when JavaScript
 254   // builtins are loaded lazily.  It is important to keep inline
 255   // caches for the builtins object monomorphic.  Therefore, if we get
 256   // an inline cache miss for the builtins object after lazily loading
 257   // JavaScript builtins, we return uninitialized as the state to
 258   // force the inline cache back to monomorphic state.
 259   if (receiver->IsJSBuiltinsObject()) {
 260     return UNINITIALIZED;
 261   }
 262
 263   return MONOMORPHIC;
 264 }
 265
 266
 267 RelocInfo::Mode IC::ComputeMode() {
 268   Address addr = address();
 269   Code* code = Code::cast(isolate()->heap()->FindCodeObject(addr));
 270   for (RelocIterator it(code, RelocInfo::kCodeTargetMask);
 271        !it.done(); it.next()) {
 272     RelocInfo* info = it.rinfo();
 273     if (info->pc() == addr) return info->rmode();
 274   }
 275   UNREACHABLE();
 276   return RelocInfo::NONE;
 277 }
 278
 279
 280 Failure* IC::TypeError(const char* type,
 281                        Handle<Object> object,
 282                        Handle<Object> key) {
 283   HandleScope scope(isolate());
 284   Handle<Object> args[2] = { key, object };
 285   Handle<Object> error = isolate()->factory()->NewTypeError(
 286       type, HandleVector(args, 2));
 287   return isolate()->Throw(*error);
 288 }
 289
 290
 291 Failure* IC::ReferenceError(const char* type, Handle<String> name) {
 292   HandleScope scope(isolate());
 293   Handle<Object> error = isolate()->factory()->NewReferenceError(
 294       type, HandleVector(&name, 1));
 295   return isolate()->Throw(*error);
 296 }
 297
 298
 299 static int ComputeTypeInfoCountDelta(IC::State old_state, IC::State new_state) {
 300   bool was_uninitialized =
 301       old_state == UNINITIALIZED || old_state == PREMONOMORPHIC;
 302   bool is_uninitialized =
 303       new_state == UNINITIALIZED || new_state == PREMONOMORPHIC;
 304   return (was_uninitialized && !is_uninitialized) ?  1 :
 305          (!was_uninitialized && is_uninitialized) ? -1 : 0;
 306 }
 307
 308
 309 void IC::PostPatching(Address address, Code* target, Code* old_target) {
 310   if (FLAG_type_info_threshold == 0 && !FLAG_watch_ic_patching) {
 311     return;
 312   }
 313   Code* host = target->GetHeap()->isolate()->
 314       inner_pointer_to_code_cache()->GetCacheEntry(address)->code;
 315   if (host->kind() != Code::FUNCTION) return;
 316
 317   if (FLAG_type_info_threshold > 0 &&
 318       old_target->is_inline_cache_stub() &&
 319       target->is_inline_cache_stub()) {
 320     int delta = ComputeTypeInfoCountDelta(old_target->ic_state(),
 321                                           target->ic_state());
 322     // Not all Code objects have TypeFeedbackInfo.
 323     if (delta != 0 && host->type_feedback_info()->IsTypeFeedbackInfo()) {
 324       TypeFeedbackInfo* info =
 325           TypeFeedbackInfo::cast(host->type_feedback_info());
 326       info->set_ic_with_type_info_count(
 327           info->ic_with_type_info_count() + delta);
 328     }
 329   }
 330   if (FLAG_watch_ic_patching) {
 331     host->set_profiler_ticks(0);
 332     Isolate::Current()->runtime_profiler()->NotifyICChanged();
 333   }
 334   // TODO(2029): When an optimized function is patched, it would
 335   // be nice to propagate the corresponding type information to its
 336   // unoptimized version for the benefit of later inlining.
 337 }
 338
 339
 340 void IC::Clear(Address address) {
 341   Code* target = GetTargetAtAddress(address);
 342
 343   // Don't clear debug break inline cache as it will remove the break point.
 344   if (target->ic_state() == DEBUG_BREAK) return;
 345
 346   switch (target->kind()) {
 347     case Code::LOAD_IC: return LoadIC::Clear(address, target);
 348     case Code::KEYED_LOAD_IC:
 349       return KeyedLoadIC::Clear(address, target);
 350     case Code::STORE_IC: return StoreIC::Clear(address, target);
 351     case Code::KEYED_STORE_IC:
 352       return KeyedStoreIC::Clear(address, target);
 353     case Code::CALL_IC: return CallIC::Clear(address, target);
 354     case Code::KEYED_CALL_IC:  return KeyedCallIC::Clear(address, target);
 355     case Code::COMPARE_IC: return CompareIC::Clear(address, target);
 356     case Code::UNARY_OP_IC:
 357     case Code::BINARY_OP_IC:
 358     case Code::TO_BOOLEAN_IC:
 359       // Clearing these is tricky and does not
 360       // make any performance difference.
 361       return;
 362     default: UNREACHABLE();
 363   }
 364 }
 365
 366
 367 void CallICBase::Clear(Address address, Code* target) {
 368   if (target->ic_state() == UNINITIALIZED) return;
 369   bool contextual = CallICBase::Contextual::decode(target->extra_ic_state());
 370   Code* code =
 371       Isolate::Current()->stub_cache()->FindCallInitialize(
 372           target->arguments_count(),
 373           contextual ? RelocInfo::CODE_TARGET_CONTEXT : RelocInfo::CODE_TARGET,
 374           target->kind());
 375   SetTargetAtAddress(address, code);
 376 }
 377
 378
 379 void KeyedLoadIC::Clear(Address address, Code* target) {
 380   if (target->ic_state() == UNINITIALIZED) return;
 381   // Make sure to also clear the map used in inline fast cases.  If we
 382   // do not clear these maps, cached code can keep objects alive
 383   // through the embedded maps.
 384   SetTargetAtAddress(address, initialize_stub());
 385 }
 386
 387
 388 void LoadIC::Clear(Address address, Code* target) {
 389   if (target->ic_state() == UNINITIALIZED) return;
 390   SetTargetAtAddress(address, initialize_stub());
 391 }
 392
 393
 394 void StoreIC::Clear(Address address, Code* target) {
 395   if (target->ic_state() == UNINITIALIZED) return;
 396   SetTargetAtAddress(address,
 397       (Code::GetStrictMode(target->extra_ic_state()) == kStrictMode)
 398         ? initialize_stub_strict()
 399         : initialize_stub());
 400 }
 401
 402
 403 void KeyedStoreIC::Clear(Address address, Code* target) {
 404   if (target->ic_state() == UNINITIALIZED) return;
 405   SetTargetAtAddress(address,
 406       (Code::GetStrictMode(target->extra_ic_state()) == kStrictMode)
 407         ? initialize_stub_strict()
 408         : initialize_stub());
 409 }
 410
 411
 412 void CompareIC::Clear(Address address, Code* target) {
 413   // Only clear ICCompareStubs, we currently cannot clear generic CompareStubs.
 414   if (target->major_key() != CodeStub::CompareIC) return;
 415   // Only clear CompareICs that can retain objects.
 416   if (target->compare_state() != KNOWN_OBJECTS) return;
 417   Token::Value op = CompareIC::ComputeOperation(target);
 418   SetTargetAtAddress(address, GetRawUninitialized(op));
 419   PatchInlinedSmiCode(address, DISABLE_INLINED_SMI_CHECK);
 420 }
 421
 422
 423 static bool HasInterceptorGetter(JSObject* object) {
 424   return !object->GetNamedInterceptor()->getter()->IsUndefined();
 425 }
 426
 427
 428 static void LookupForRead(Handle<Object> object,
 429                           Handle<String> name,
 430                           LookupResult* lookup) {
 431   // Skip all the objects with named interceptors, but
 432   // without actual getter.
 433   while (true) {
 434     object->Lookup(*name, lookup);
 435     // Besides normal conditions (property not found or it's not
 436     // an interceptor), bail out if lookup is not cacheable: we won't
 437     // be able to IC it anyway and regular lookup should work fine.
 438     if (!lookup->IsFound()
 439         || (lookup->type() != INTERCEPTOR)
 440         || !lookup->IsCacheable()) {
 441       return;
 442     }
 443
 444     Handle<JSObject> holder(lookup->holder());
 445     if (HasInterceptorGetter(*holder)) {
 446       return;
 447     }
 448
 449     holder->LocalLookupRealNamedProperty(*name, lookup);
 450     if (lookup->IsProperty()) {
 451       ASSERT(lookup->type() != INTERCEPTOR);
 452       return;
 453     }
 454
 455     Handle<Object> proto(holder->GetPrototype());
 456     if (proto->IsNull()) {
 457       lookup->NotFound();
 458       return;
 459     }
 460
 461     object = proto;
 462   }
 463 }
 464
 465
 466 Handle<Object> CallICBase::TryCallAsFunction(Handle<Object> object) {
 467   Handle<Object> delegate = Execution::GetFunctionDelegate(object);
 468
 469   if (delegate->IsJSFunction() && !object->IsJSFunctionProxy()) {
 470     // Patch the receiver and use the delegate as the function to
 471     // invoke. This is used for invoking objects as if they were functions.
 472     const int argc = target()->arguments_count();
 473     StackFrameLocator locator;
 474     JavaScriptFrame* frame = locator.FindJavaScriptFrame(0);
 475     int index = frame->ComputeExpressionsCount() - (argc + 1);
 476     frame->SetExpression(index, *object);
 477   }
 478
 479   return delegate;
 480 }
 481
 482
 483 void CallICBase::ReceiverToObjectIfRequired(Handle<Object> callee,
 484                                             Handle<Object> object) {
 485   while (callee->IsJSFunctionProxy()) {
 486     callee = Handle<Object>(JSFunctionProxy::cast(*callee)->call_trap());
 487   }
 488
 489   if (callee->IsJSFunction()) {
 490     Handle<JSFunction> function = Handle<JSFunction>::cast(callee);
 491     if (!function->shared()->is_classic_mode() || function->IsBuiltin()) {
 492       // Do not wrap receiver for strict mode functions or for builtins.
 493       return;
 494     }
 495   }
 496
 497   // And only wrap string, number or boolean.
 498   if (object->IsString() || object->IsNumber() || object->IsBoolean()) {
 499     // Change the receiver to the result of calling ToObject on it.
 500     const int argc = this->target()->arguments_count();
 501     StackFrameLocator locator;
 502     JavaScriptFrame* frame = locator.FindJavaScriptFrame(0);
 503     int index = frame->ComputeExpressionsCount() - (argc + 1);
 504     frame->SetExpression(index, *isolate()->factory()->ToObject(object));
 505   }
 506 }
 507
 508
 509 MaybeObject* CallICBase::LoadFunction(State state,
 510                                       Code::ExtraICState extra_ic_state,
 511                                       Handle<Object> object,
 512                                       Handle<String> name) {
 513   // If the object is undefined or null it's illegal to try to get any
 514   // of its properties; throw a TypeError in that case.
 515   if (object->IsUndefined() || object->IsNull()) {
 516     return TypeError("non_object_property_call", object, name);
 517   }
 518
 519   // Check if the name is trivially convertible to an index and get
 520   // the element if so.
 521   uint32_t index;
 522   if (name->AsArrayIndex(&index)) {
 523     Handle<Object> result = Object::GetElement(object, index);
 524     RETURN_IF_EMPTY_HANDLE(isolate(), result);
 525     if (result->IsJSFunction()) return *result;
 526
 527     // Try to find a suitable function delegate for the object at hand.
 528     result = TryCallAsFunction(result);
 529     if (result->IsJSFunction()) return *result;
 530
 531     // Otherwise, it will fail in the lookup step.
 532   }
 533
 534   // Lookup the property in the object.
 535   LookupResult lookup(isolate());
 536   LookupForRead(object, name, &lookup);
 537
 538   if (!lookup.IsProperty()) {
 539     // If the object does not have the requested property, check which
 540     // exception we need to throw.
 541     return IsContextual(object)
 542         ? ReferenceError("not_defined", name)
 543         : TypeError("undefined_method", object, name);
 544   }
 545
 546   // Lookup is valid: Update inline cache and stub cache.
 547   if (FLAG_use_ic) {
 548     UpdateCaches(&lookup, state, extra_ic_state, object, name);
 549   }
 550
 551   // Get the property.
 552   PropertyAttributes attr;
 553   Handle<Object> result =
 554       Object::GetProperty(object, object, &lookup, name, &attr);
 555   RETURN_IF_EMPTY_HANDLE(isolate(), result);
 556
 557   if (lookup.type() == INTERCEPTOR && attr == ABSENT) {
 558     // If the object does not have the requested property, check which
 559     // exception we need to throw.
 560     return IsContextual(object)
 561         ? ReferenceError("not_defined", name)
 562         : TypeError("undefined_method", object, name);
 563   }
 564
 565   ASSERT(!result->IsTheHole());
 566
 567   // Make receiver an object if the callee requires it. Strict mode or builtin
 568   // functions do not wrap the receiver, non-strict functions and objects
 569   // called as functions do.
 570   ReceiverToObjectIfRequired(result, object);
 571
 572   if (result->IsJSFunction()) {
 573     Handle<JSFunction> function = Handle<JSFunction>::cast(result);
 574 #ifdef ENABLE_DEBUGGER_SUPPORT
 575     // Handle stepping into a function if step into is active.
 576     Debug* debug = isolate()->debug();
 577     if (debug->StepInActive()) {
 578       // Protect the result in a handle as the debugger can allocate and might
 579       // cause GC.
 580       debug->HandleStepIn(function, object, fp(), false);
 581     }
 582 #endif
 583     return *function;
 584   }
 585
 586   // Try to find a suitable function delegate for the object at hand.
 587   result = TryCallAsFunction(result);
 588   if (result->IsJSFunction()) return *result;
 589
 590   return TypeError("property_not_function", object, name);
 591 }
 592
 593
 594 bool CallICBase::TryUpdateExtraICState(LookupResult* lookup,
 595                                        Handle<Object> object,
 596                                        Code::ExtraICState* extra_ic_state) {
 597   ASSERT(kind_ == Code::CALL_IC);
 598   if (lookup->type() != CONSTANT_FUNCTION) return false;
 599   JSFunction* function = lookup->GetConstantFunction();
 600   if (!function->shared()->HasBuiltinFunctionId()) return false;
 601
 602   // Fetch the arguments passed to the called function.
 603   const int argc = target()->arguments_count();
 604   Address entry = isolate()->c_entry_fp(isolate()->thread_local_top());
 605   Address fp = Memory::Address_at(entry + ExitFrameConstants::kCallerFPOffset);
 606   Arguments args(argc + 1,
 607                  &Memory::Object_at(fp +
 608                                     StandardFrameConstants::kCallerSPOffset +
 609                                     argc * kPointerSize));
 610   switch (function->shared()->builtin_function_id()) {
 611     case kStringCharCodeAt:
 612     case kStringCharAt:
 613       if (object->IsString()) {
 614         String* string = String::cast(*object);
 615         // Check there's the right string value or wrapper in the receiver slot.
 616         ASSERT(string == args[0] || string == JSValue::cast(args[0])->value());
 617         // If we're in the default (fastest) state and the index is
 618         // out of bounds, update the state to record this fact.
 619         if (StringStubState::decode(*extra_ic_state) == DEFAULT_STRING_STUB &&
 620             argc >= 1 && args[1]->IsNumber()) {
 621           double index = DoubleToInteger(args.number_at(1));
 622           if (index < 0 || index >= string->length()) {
 623             *extra_ic_state =
 624                 StringStubState::update(*extra_ic_state,
 625                                         STRING_INDEX_OUT_OF_BOUNDS);
 626             return true;
 627           }
 628         }
 629       }
 630       break;
 631     default:
 632       return false;
 633   }
 634   return false;
 635 }
 636
 637
 638 Handle<Code> CallICBase::ComputeMonomorphicStub(LookupResult* lookup,
 639                                                 State state,
 640                                                 Code::ExtraICState extra_state,
 641                                                 Handle<Object> object,
 642                                                 Handle<String> name) {
 643   int argc = target()->arguments_count();
 644   Handle<JSObject> holder(lookup->holder());
 645   switch (lookup->type()) {
 646     case FIELD: {
 647       int index = lookup->GetFieldIndex();
 648       return isolate()->stub_cache()->ComputeCallField(
 649           argc, kind_, extra_state, name, object, holder, index);
 650     }
 651     case CONSTANT_FUNCTION: {
 652       // Get the constant function and compute the code stub for this
 653       // call; used for rewriting to monomorphic state and making sure
 654       // that the code stub is in the stub cache.
 655       Handle<JSFunction> function(lookup->GetConstantFunction());
 656       return isolate()->stub_cache()->ComputeCallConstant(
 657           argc, kind_, extra_state, name, object, holder, function);
 658     }
 659     case NORMAL: {
 660       // If we return a null handle, the IC will not be patched.
 661       if (!object->IsJSObject()) return Handle<Code>::null();
 662       Handle<JSObject> receiver = Handle<JSObject>::cast(object);
 663
 664       if (holder->IsGlobalObject()) {
 665         Handle<GlobalObject> global = Handle<GlobalObject>::cast(holder);
 666         Handle<JSGlobalPropertyCell> cell(global->GetPropertyCell(lookup));
 667         if (!cell->value()->IsJSFunction()) return Handle<Code>::null();
 668         Handle<JSFunction> function(JSFunction::cast(cell->value()));
 669         return isolate()->stub_cache()->ComputeCallGlobal(
 670             argc, kind_, extra_state, name, receiver, global, cell, function);
 671       } else {
 672         // There is only one shared stub for calling normalized
 673         // properties. It does not traverse the prototype chain, so the
 674         // property must be found in the receiver for the stub to be
 675         // applicable.
 676         if (!holder.is_identical_to(receiver)) return Handle<Code>::null();
 677         return isolate()->stub_cache()->ComputeCallNormal(
 678             argc, kind_, extra_state, IsQmlGlobal(holder));
 679       }
 680       break;
 681     }
 682     case INTERCEPTOR:
 683       ASSERT(HasInterceptorGetter(*holder));
 684       return isolate()->stub_cache()->ComputeCallInterceptor(
 685           argc, kind_, extra_state, name, object, holder);
 686     default:
 687       return Handle<Code>::null();
 688   }
 689 }
 690
 691
 692 void CallICBase::UpdateCaches(LookupResult* lookup,
 693                               State state,
 694                               Code::ExtraICState extra_ic_state,
 695                               Handle<Object> object,
 696                               Handle<String> name) {
 697   // Bail out if we didn't find a result.
 698   if (!lookup->IsProperty() || !lookup->IsCacheable()) return;
 699
 700   if (lookup->holder() != *object &&
 701       HasNormalObjectsInPrototypeChain(
 702           isolate(), lookup, object->GetPrototype())) {
 703     // Suppress optimization for prototype chains with slow properties objects
 704     // in the middle.
 705     return;
 706   }
 707
 708   // Compute the number of arguments.
 709   int argc = target()->arguments_count();
 710   bool had_proto_failure = false;
 711   Handle<Code> code;
 712   if (state == UNINITIALIZED) {
 713     // This is the first time we execute this inline cache.
 714     // Set the target to the pre monomorphic stub to delay
 715     // setting the monomorphic state.
 716     code = isolate()->stub_cache()->ComputeCallPreMonomorphic(
 717         argc, kind_, extra_ic_state);
 718   } else if (state == MONOMORPHIC) {
 719     if (kind_ == Code::CALL_IC &&
 720         TryUpdateExtraICState(lookup, object, &extra_ic_state)) {
 721       code = ComputeMonomorphicStub(lookup, state, extra_ic_state,
 722                                     object, name);
 723     } else if (kind_ == Code::CALL_IC &&
 724                TryRemoveInvalidPrototypeDependentStub(target(),
 725                                                       *object,
 726                                                       *name)) {
 727       had_proto_failure = true;
 728       code = ComputeMonomorphicStub(lookup, state, extra_ic_state,
 729                                     object, name);
 730     } else {
 731       code = isolate()->stub_cache()->ComputeCallMegamorphic(
 732           argc, kind_, extra_ic_state);
 733     }
 734   } else {
 735     code = ComputeMonomorphicStub(lookup, state, extra_ic_state,
 736                                   object, name);
 737   }
 738
 739   // If there's no appropriate stub we simply avoid updating the caches.
 740   if (code.is_null()) return;
 741
 742   // Patch the call site depending on the state of the cache.
 743   if (state == UNINITIALIZED ||
 744       state == PREMONOMORPHIC ||
 745       state == MONOMORPHIC ||
 746       state == MONOMORPHIC_PROTOTYPE_FAILURE) {
 747     set_target(*code);
 748   } else if (state == MEGAMORPHIC) {
 749     // Cache code holding map should be consistent with
 750     // GenerateMonomorphicCacheProbe. It is not the map which holds the stub.
 751     Handle<JSObject> cache_object = object->IsJSObject()
 752         ? Handle<JSObject>::cast(object)
 753         : Handle<JSObject>(JSObject::cast(object->GetPrototype()));
 754     // Update the stub cache.
 755     isolate()->stub_cache()->Set(*name, cache_object->map(), *code);
 756   }
 757
 758   if (had_proto_failure) state = MONOMORPHIC_PROTOTYPE_FAILURE;
 759   TRACE_IC(kind_ == Code::CALL_IC ? "CallIC" : "KeyedCallIC",
 760            name, state, target());
 761 }
 762
 763
 764 MaybeObject* KeyedCallIC::LoadFunction(State state,
 765                                        Handle<Object> object,
 766                                        Handle<Object> key) {
 767   if (key->IsSymbol()) {
 768     return CallICBase::LoadFunction(state,
 769                                     Code::kNoExtraICState,
 770                                     object,
 771                                     Handle<String>::cast(key));
 772   }
 773
 774   if (object->IsUndefined() || object->IsNull()) {
 775     return TypeError("non_object_property_call", object, key);
 776   }
 777
 778   if (FLAG_use_ic && state != MEGAMORPHIC && object->IsHeapObject()) {
 779     int argc = target()->arguments_count();
 780     Handle<Map> map =
 781         isolate()->factory()->non_strict_arguments_elements_map();
 782     if (object->IsJSObject() &&
 783         Handle<JSObject>::cast(object)->elements()->map() == *map) {
 784       Handle<Code> code = isolate()->stub_cache()->ComputeCallArguments(
 785           argc, Code::KEYED_CALL_IC);
 786       set_target(*code);
 787       TRACE_IC("KeyedCallIC", key, state, target());
 788     } else if (!object->IsAccessCheckNeeded()) {
 789       Handle<Code> code = isolate()->stub_cache()->ComputeCallMegamorphic(
 790           argc, Code::KEYED_CALL_IC, Code::kNoExtraICState);
 791       set_target(*code);
 792       TRACE_IC("KeyedCallIC", key, state, target());
 793     }
 794   }
 795
 796   Handle<Object> result = GetProperty(object, key);
 797   RETURN_IF_EMPTY_HANDLE(isolate(), result);
 798
 799   // Make receiver an object if the callee requires it. Strict mode or builtin
 800   // functions do not wrap the receiver, non-strict functions and objects
 801   // called as functions do.
 802   ReceiverToObjectIfRequired(result, object);
 803   if (result->IsJSFunction()) return *result;
 804
 805   result = TryCallAsFunction(result);
 806   if (result->IsJSFunction()) return *result;
 807
 808   return TypeError("property_not_function", object, key);
 809 }
 810
 811
 812 MaybeObject* LoadIC::Load(State state,
 813                           Handle<Object> object,
 814                           Handle<String> name) {
 815   // If the object is undefined or null it's illegal to try to get any
 816   // of its properties; throw a TypeError in that case.
 817   if (object->IsUndefined() || object->IsNull()) {
 818     return TypeError("non_object_property_load", object, name);
 819   }
 820
 821   if (FLAG_use_ic) {
 822     // Use specialized code for getting the length of strings and
 823     // string wrapper objects.  The length property of string wrapper
 824     // objects is read-only and therefore always returns the length of
 825     // the underlying string value.  See ECMA-262 15.5.5.1.
 826     if ((object->IsString() || object->IsStringWrapper()) &&
 827         name->Equals(isolate()->heap()->length_symbol())) {
 828       Handle<Code> stub;
 829       if (state == UNINITIALIZED) {
 830         stub = pre_monomorphic_stub();
 831       } else if (state == PREMONOMORPHIC) {
 832         stub = object->IsString()
 833             ? isolate()->builtins()->LoadIC_StringLength()
 834             : isolate()->builtins()->LoadIC_StringWrapperLength();
 835       } else if (state == MONOMORPHIC && object->IsStringWrapper()) {
 836         stub = isolate()->builtins()->LoadIC_StringWrapperLength();
 837       } else if (state != MEGAMORPHIC) {
 838         stub = megamorphic_stub();
 839       }
 840       if (!stub.is_null()) {
 841         set_target(*stub);
 842 #ifdef DEBUG
 843         if (FLAG_trace_ic) PrintF("[LoadIC : +#length /string]\n");
 844 #endif
 845       }
 846       // Get the string if we have a string wrapper object.
 847       Handle<Object> string = object->IsJSValue()
 848           ? Handle<Object>(Handle<JSValue>::cast(object)->value())
 849           : object;
 850       return Smi::FromInt(String::cast(*string)->length());
 851     }
 852
 853     // Use specialized code for getting the length of arrays.
 854     if (object->IsJSArray() &&
 855         name->Equals(isolate()->heap()->length_symbol())) {
 856       Handle<Code> stub;
 857       if (state == UNINITIALIZED) {
 858         stub = pre_monomorphic_stub();
 859       } else if (state == PREMONOMORPHIC) {
 860         stub = isolate()->builtins()->LoadIC_ArrayLength();
 861       } else if (state != MEGAMORPHIC) {
 862         stub = megamorphic_stub();
 863       }
 864       if (!stub.is_null()) {
 865         set_target(*stub);
 866 #ifdef DEBUG
 867         if (FLAG_trace_ic) PrintF("[LoadIC : +#length /array]\n");
 868 #endif
 869       }
 870       return JSArray::cast(*object)->length();
 871     }
 872
 873     // Use specialized code for getting prototype of functions.
 874     if (object->IsJSFunction() &&
 875         name->Equals(isolate()->heap()->prototype_symbol()) &&
 876         Handle<JSFunction>::cast(object)->should_have_prototype()) {
 877       Handle<Code> stub;
 878       if (state == UNINITIALIZED) {
 879         stub = pre_monomorphic_stub();
 880       } else if (state == PREMONOMORPHIC) {
 881         stub = isolate()->builtins()->LoadIC_FunctionPrototype();
 882       } else if (state != MEGAMORPHIC) {
 883         stub = megamorphic_stub();
 884       }
 885       if (!stub.is_null()) {
 886         set_target(*stub);
 887 #ifdef DEBUG
 888         if (FLAG_trace_ic) PrintF("[LoadIC : +#prototype /function]\n");
 889 #endif
 890       }
 891       return Accessors::FunctionGetPrototype(*object, 0);
 892     }
 893   }
 894
 895   // Check if the name is trivially convertible to an index and get
 896   // the element if so.
 897   uint32_t index;
 898   if (name->AsArrayIndex(&index)) return object->GetElement(index);
 899
 900   // Named lookup in the object.
 901   LookupResult lookup(isolate());
 902   LookupForRead(object, name, &lookup);
 903
 904   // If we did not find a property, check if we need to throw an exception.
 905   if (!lookup.IsProperty()) {
 906     if (IsContextual(object)) {
 907       return ReferenceError("not_defined", name);
 908     }
 909     LOG(isolate(), SuspectReadEvent(*name, *object));
 910   }
 911
 912   // Update inline cache and stub cache.
 913   if (FLAG_use_ic) {
 914     UpdateCaches(&lookup, state, object, name);
 915   }
 916
 917   PropertyAttributes attr;
 918   if (lookup.IsFound() &&
 919       (lookup.type() == INTERCEPTOR || lookup.type() == HANDLER)) {
 920     // Get the property.
 921     Handle<Object> result =
 922         Object::GetProperty(object, object, &lookup, name, &attr);
 923     RETURN_IF_EMPTY_HANDLE(isolate(), result);
 924     // If the property is not present, check if we need to throw an
 925     // exception.
 926     if (attr == ABSENT && IsContextual(object)) {
 927       return ReferenceError("not_defined", name);
 928     }
 929     return *result;
 930   }
 931
 932   // Get the property.
 933   return object->GetProperty(*object, &lookup, *name, &attr);
 934 }
 935
 936
 937 void LoadIC::UpdateCaches(LookupResult* lookup,
 938                           State state,
 939                           Handle<Object> object,
 940                           Handle<String> name) {
 941   // Bail out if the result is not cacheable.
 942   if (!lookup->IsCacheable()) return;
 943
 944   // Loading properties from values is not common, so don't try to
 945   // deal with non-JS objects here.
 946   if (!object->IsJSObject()) return;
 947   Handle<JSObject> receiver = Handle<JSObject>::cast(object);
 948
 949   if (HasNormalObjectsInPrototypeChain(isolate(), lookup, *object)) return;
 950
 951   // Compute the code stub for this load.
 952   Handle<Code> code;
 953   if (state == UNINITIALIZED) {
 954     // This is the first time we execute this inline cache.
 955     // Set the target to the pre monomorphic stub to delay
 956     // setting the monomorphic state.
 957     code = pre_monomorphic_stub();
 958   } else if (!lookup->IsProperty()) {
 959     // Nonexistent property. The result is undefined.
 960     code = isolate()->stub_cache()->ComputeLoadNonexistent(name, receiver);
 961   } else {
 962     // Compute monomorphic stub.
 963     Handle<JSObject> holder(lookup->holder());
 964     switch (lookup->type()) {
 965       case FIELD:
 966         code = isolate()->stub_cache()->ComputeLoadField(
 967             name, receiver, holder, lookup->GetFieldIndex());
 968         break;
 969       case CONSTANT_FUNCTION: {
 970         Handle<JSFunction> constant(lookup->GetConstantFunction());
 971         code = isolate()->stub_cache()->ComputeLoadConstant(
 972             name, receiver, holder, constant);
 973         break;
 974       }
 975       case NORMAL:
 976         if (holder->IsGlobalObject()) {
 977           Handle<GlobalObject> global = Handle<GlobalObject>::cast(holder);
 978           Handle<JSGlobalPropertyCell> cell(global->GetPropertyCell(lookup));
 979           code = isolate()->stub_cache()->ComputeLoadGlobal(
 980               name, receiver, global, cell, lookup->IsDontDelete());
 981         } else {
 982           // There is only one shared stub for loading normalized
 983           // properties. It does not traverse the prototype chain, so the
 984           // property must be found in the receiver for the stub to be
 985           // applicable.
 986           if (!holder.is_identical_to(receiver)) return;
 987           code = isolate()->stub_cache()->ComputeLoadNormal();
 988         }
 989         break;
 990       case CALLBACKS: {
 991         Handle<Object> callback_object(lookup->GetCallbackObject());
 992         if (!callback_object->IsAccessorInfo()) return;
 993         Handle<AccessorInfo> callback =
 994             Handle<AccessorInfo>::cast(callback_object);
 995         if (v8::ToCData<Address>(callback->getter()) == 0) return;
 996         code = isolate()->stub_cache()->ComputeLoadCallback(
 997             name, receiver, holder, callback);
 998         break;
 999       }
1000       case INTERCEPTOR:
1001         ASSERT(HasInterceptorGetter(*holder));
1002         code = isolate()->stub_cache()->ComputeLoadInterceptor(
1003             name, receiver, holder);
1004         break;
1005       default:
1006         return;
1007     }
1008   }
1009
1010   // Patch the call site depending on the state of the cache.
1011   if (state == UNINITIALIZED ||
1012       state == PREMONOMORPHIC ||
1013       state == MONOMORPHIC_PROTOTYPE_FAILURE) {
1014     set_target(*code);
1015   } else if (state == MONOMORPHIC) {
1016     // We are transitioning from monomorphic to megamorphic case.
1017     // Place the current monomorphic stub and stub compiled for
1018     // the receiver into stub cache.
1019     Map* map = target()->FindFirstMap();
1020     if (map != NULL) {
1021       isolate()->stub_cache()->Set(*name, map, target());
1022     }
1023     isolate()->stub_cache()->Set(*name, receiver->map(), *code);
1024
1025     set_target(*megamorphic_stub());
1026   } else if (state == MEGAMORPHIC) {
1027     // Cache code holding map should be consistent with
1028     // GenerateMonomorphicCacheProbe.
1029     isolate()->stub_cache()->Set(*name, receiver->map(), *code);
1030   }
1031
1032   TRACE_IC("LoadIC", name, state, target());
1033 }
1034
1035
1036 Handle<Code> KeyedLoadIC::GetElementStubWithoutMapCheck(
1037     bool is_js_array,
1038     ElementsKind elements_kind,
1039     KeyedAccessGrowMode grow_mode) {
1040   ASSERT(grow_mode == DO_NOT_ALLOW_JSARRAY_GROWTH);
1041   return KeyedLoadElementStub(elements_kind).GetCode();
1042 }
1043
1044
1045 Handle<Code> KeyedLoadIC::ComputePolymorphicStub(
1046     MapHandleList* receiver_maps,
1047     StrictModeFlag strict_mode,
1048     KeyedAccessGrowMode growth_mode) {
1049   CodeHandleList handler_ics(receiver_maps->length());
1050   for (int i = 0; i < receiver_maps->length(); ++i) {
1051     Handle<Map> receiver_map = receiver_maps->at(i);
1052     Handle<Code> cached_stub = ComputeMonomorphicStubWithoutMapCheck(
1053         receiver_map, strict_mode, growth_mode);
1054     handler_ics.Add(cached_stub);
1055   }
1056   KeyedLoadStubCompiler compiler(isolate());
1057   Handle<Code> code = compiler.CompileLoadPolymorphic(
1058       receiver_maps, &handler_ics);
1059   isolate()->counters()->keyed_load_polymorphic_stubs()->Increment();
1060   PROFILE(isolate(),
1061           CodeCreateEvent(Logger::KEYED_LOAD_MEGAMORPHIC_IC_TAG, *code, 0));
1062   return code;
1063 }
1064
1065
1066 static Handle<Object> TryConvertKey(Handle<Object> key, Isolate* isolate) {
1067   // This helper implements a few common fast cases for converting
1068   // non-smi keys of keyed loads/stores to a smi or a string.
1069   if (key->IsHeapNumber()) {
1070     double value = Handle<HeapNumber>::cast(key)->value();
1071     if (isnan(value)) {
1072       key = isolate->factory()->nan_symbol();
1073     } else {
1074       int int_value = FastD2I(value);
1075       if (value == int_value && Smi::IsValid(int_value)) {
1076         key = Handle<Smi>(Smi::FromInt(int_value));
1077       }
1078     }
1079   } else if (key->IsUndefined()) {
1080     key = isolate->factory()->undefined_symbol();
1081   }
1082   return key;
1083 }
1084
1085
1086 MaybeObject* KeyedLoadIC::Load(State state,
1087                                Handle<Object> object,
1088                                Handle<Object> key,
1089                                bool force_generic_stub) {
1090   // Check for values that can be converted into a symbol directly or
1091   // is representable as a smi.
1092   key = TryConvertKey(key, isolate());
1093
1094   if (key->IsSymbol()) {
1095     Handle<String> name = Handle<String>::cast(key);
1096
1097     // If the object is undefined or null it's illegal to try to get any
1098     // of its properties; throw a TypeError in that case.
1099     if (object->IsUndefined() || object->IsNull()) {
1100       return TypeError("non_object_property_load", object, name);
1101     }
1102
1103     if (FLAG_use_ic) {
1104       // TODO(1073): don't ignore the current stub state.
1105
1106       // Use specialized code for getting the length of strings.
1107       if (object->IsString() &&
1108           name->Equals(isolate()->heap()->length_symbol())) {
1109         Handle<String> string = Handle<String>::cast(object);
1110         Handle<Code> code =
1111             isolate()->stub_cache()->ComputeKeyedLoadStringLength(name, string);
1112         ASSERT(!code.is_null());
1113         set_target(*code);
1114         TRACE_IC("KeyedLoadIC", name, state, target());
1115         return Smi::FromInt(string->length());
1116       }
1117
1118       // Use specialized code for getting the length of arrays.
1119       if (object->IsJSArray() &&
1120           name->Equals(isolate()->heap()->length_symbol())) {
1121         Handle<JSArray> array = Handle<JSArray>::cast(object);
1122         Handle<Code> code =
1123             isolate()->stub_cache()->ComputeKeyedLoadArrayLength(name, array);
1124         ASSERT(!code.is_null());
1125         set_target(*code);
1126         TRACE_IC("KeyedLoadIC", name, state, target());
1127         return array->length();
1128       }
1129
1130       // Use specialized code for getting prototype of functions.
1131       if (object->IsJSFunction() &&
1132           name->Equals(isolate()->heap()->prototype_symbol()) &&
1133           Handle<JSFunction>::cast(object)->should_have_prototype()) {
1134         Handle<JSFunction> function = Handle<JSFunction>::cast(object);
1135         Handle<Code> code =
1136             isolate()->stub_cache()->ComputeKeyedLoadFunctionPrototype(
1137                 name, function);
1138         ASSERT(!code.is_null());
1139         set_target(*code);
1140         TRACE_IC("KeyedLoadIC", name, state, target());
1141         return Accessors::FunctionGetPrototype(*object, 0);
1142       }
1143     }
1144
1145     // Check if the name is trivially convertible to an index and get
1146     // the element or char if so.
1147     uint32_t index = 0;
1148     if (name->AsArrayIndex(&index)) {
1149       // Rewrite to the generic keyed load stub.
1150       if (FLAG_use_ic) set_target(*generic_stub());
1151       return Runtime::GetElementOrCharAt(isolate(), object, index);
1152     }
1153
1154     // Named lookup.
1155     LookupResult lookup(isolate());
1156     LookupForRead(object, name, &lookup);
1157
1158     // If we did not find a property, check if we need to throw an exception.
1159     if (!lookup.IsProperty() && IsContextual(object)) {
1160       return ReferenceError("not_defined", name);
1161     }
1162
1163     if (FLAG_use_ic) {
1164       UpdateCaches(&lookup, state, object, name);
1165     }
1166
1167     PropertyAttributes attr;
1168     if (lookup.IsFound() && lookup.type() == INTERCEPTOR) {
1169       // Get the property.
1170       Handle<Object> result =
1171           Object::GetProperty(object, object, &lookup, name, &attr);
1172       RETURN_IF_EMPTY_HANDLE(isolate(), result);
1173       // If the property is not present, check if we need to throw an
1174       // exception.
1175       if (attr == ABSENT && IsContextual(object)) {
1176         return ReferenceError("not_defined", name);
1177       }
1178       return *result;
1179     }
1180
1181     return object->GetProperty(*object, &lookup, *name, &attr);
1182   }
1183
1184   // Do not use ICs for objects that require access checks (including
1185   // the global object).
1186   bool use_ic = FLAG_use_ic && !object->IsAccessCheckNeeded();
1187
1188   if (use_ic) {
1189     Handle<Code> stub = generic_stub();
1190     if (!force_generic_stub) {
1191       if (object->IsString() && key->IsNumber()) {
1192         if (state == UNINITIALIZED) {
1193           stub = string_stub();
1194         }
1195       } else if (object->IsJSObject()) {
1196         Handle<JSObject> receiver = Handle<JSObject>::cast(object);
1197         if (receiver->elements()->map() ==
1198             isolate()->heap()->non_strict_arguments_elements_map()) {
1199           stub = non_strict_arguments_stub();
1200         } else if (receiver->HasIndexedInterceptor()) {
1201           stub = indexed_interceptor_stub();
1202         } else if (key->IsSmi() && (target() != *non_strict_arguments_stub())) {
1203           stub = ComputeStub(receiver, LOAD, kNonStrictMode, stub);
1204         }
1205       }
1206     } else {
1207       TRACE_GENERIC_IC("KeyedLoadIC", "force generic");
1208     }
1209     if (!stub.is_null()) set_target(*stub);
1210   }
1211
1212   TRACE_IC("KeyedLoadIC", key, state, target());
1213
1214   // Get the property.
1215   return Runtime::GetObjectProperty(isolate(), object, key);
1216 }
1217
1218
1219 void KeyedLoadIC::UpdateCaches(LookupResult* lookup,
1220                                State state,
1221                                Handle<Object> object,
1222                                Handle<String> name) {
1223   // Bail out if we didn't find a result.
1224   if (!lookup->IsProperty() || !lookup->IsCacheable()) return;
1225
1226   if (!object->IsJSObject()) return;
1227   Handle<JSObject> receiver = Handle<JSObject>::cast(object);
1228
1229   if (HasNormalObjectsInPrototypeChain(isolate(), lookup, *object)) return;
1230
1231   // Compute the code stub for this load.
1232   Handle<Code> code;
1233
1234   if (state == UNINITIALIZED) {
1235     // This is the first time we execute this inline cache.
1236     // Set the target to the pre monomorphic stub to delay
1237     // setting the monomorphic state.
1238     code = pre_monomorphic_stub();
1239   } else {
1240     // Compute a monomorphic stub.
1241     Handle<JSObject> holder(lookup->holder());
1242     switch (lookup->type()) {
1243       case FIELD:
1244         code = isolate()->stub_cache()->ComputeKeyedLoadField(
1245             name, receiver, holder, lookup->GetFieldIndex());
1246         break;
1247       case CONSTANT_FUNCTION: {
1248         Handle<JSFunction> constant(lookup->GetConstantFunction());
1249         code = isolate()->stub_cache()->ComputeKeyedLoadConstant(
1250             name, receiver, holder, constant);
1251         break;
1252       }
1253       case CALLBACKS: {
1254         Handle<Object> callback_object(lookup->GetCallbackObject());
1255         if (!callback_object->IsAccessorInfo()) return;
1256         Handle<AccessorInfo> callback =
1257             Handle<AccessorInfo>::cast(callback_object);
1258         if (v8::ToCData<Address>(callback->getter()) == 0) return;
1259         code = isolate()->stub_cache()->ComputeKeyedLoadCallback(
1260             name, receiver, holder, callback);
1261         break;
1262       }
1263       case INTERCEPTOR:
1264         ASSERT(HasInterceptorGetter(lookup->holder()));
1265         code = isolate()->stub_cache()->ComputeKeyedLoadInterceptor(
1266             name, receiver, holder);
1267         break;
1268       default:
1269         // Always rewrite to the generic case so that we do not
1270         // repeatedly try to rewrite.
1271         code = generic_stub();
1272         break;
1273     }
1274   }
1275
1276   // Patch the call site depending on the state of the cache.  Make
1277   // sure to always rewrite from monomorphic to megamorphic.
1278   ASSERT(state != MONOMORPHIC_PROTOTYPE_FAILURE);
1279   if (state == UNINITIALIZED || state == PREMONOMORPHIC) {
1280     set_target(*code);
1281   } else if (state == MONOMORPHIC) {
1282     set_target(*megamorphic_stub());
1283   }
1284
1285   TRACE_IC("KeyedLoadIC", name, state, target());
1286 }
1287
1288
1289 static bool StoreICableLookup(LookupResult* lookup) {
1290   // Bail out if we didn't find a result.
1291   if (!lookup->IsFound() || lookup->type() == NULL_DESCRIPTOR) return false;
1292
1293   // Bail out if inline caching is not allowed.
1294   if (!lookup->IsCacheable()) return false;
1295
1296   // If the property is read-only, we leave the IC in its current state.
1297   if (lookup->IsReadOnly()) return false;
1298
1299   return true;
1300 }
1301
1302
1303 static bool LookupForWrite(Handle<JSObject> receiver,
1304                            Handle<String> name,
1305                            LookupResult* lookup) {
1306   receiver->LocalLookup(*name, lookup);
1307   if (!StoreICableLookup(lookup)) {
1308     return false;
1309   }
1310
1311   if (lookup->type() == INTERCEPTOR &&
1312       receiver->GetNamedInterceptor()->setter()->IsUndefined()) {
1313     receiver->LocalLookupRealNamedProperty(*name, lookup);
1314     return StoreICableLookup(lookup);
1315   }
1316
1317   return true;
1318 }
1319
1320
1321 MaybeObject* StoreIC::Store(State state,
1322                             StrictModeFlag strict_mode,
1323                             Handle<Object> object,
1324                             Handle<String> name,
1325                             Handle<Object> value) {
1326   if (!object->IsJSObject()) {
1327     // Handle proxies.
1328     if (object->IsJSProxy()) {
1329       return JSProxy::cast(*object)->
1330           SetProperty(*name, *value, NONE, strict_mode);
1331     }
1332
1333     // If the object is undefined or null it's illegal to try to set any
1334     // properties on it; throw a TypeError in that case.
1335     if (object->IsUndefined() || object->IsNull()) {
1336       return TypeError("non_object_property_store", object, name);
1337     }
1338
1339     // The length property of string values is read-only. Throw in strict mode.
1340     if (strict_mode == kStrictMode && object->IsString() &&
1341         name->Equals(isolate()->heap()->length_symbol())) {
1342       return TypeError("strict_read_only_property", object, name);
1343     }
1344     // Ignore other stores where the receiver is not a JSObject.
1345     // TODO(1475): Must check prototype chains of object wrappers.
1346     return *value;
1347   }
1348
1349   Handle<JSObject> receiver = Handle<JSObject>::cast(object);
1350
1351   // Check if the given name is an array index.
1352   uint32_t index;
1353   if (name->AsArrayIndex(&index)) {
1354     Handle<Object> result =
1355         JSObject::SetElement(receiver, index, value, NONE, strict_mode);
1356     RETURN_IF_EMPTY_HANDLE(isolate(), result);
1357     return *value;
1358   }
1359
1360   // Use specialized code for setting the length of arrays with fast
1361   // properties.  Slow properties might indicate redefinition of the
1362   // length property.
1363   if (receiver->IsJSArray() &&
1364       name->Equals(isolate()->heap()->length_symbol()) &&
1365       Handle<JSArray>::cast(receiver)->AllowsSetElementsLength() &&
1366       receiver->HasFastProperties()) {
1367 #ifdef DEBUG
1368     if (FLAG_trace_ic) PrintF("[StoreIC : +#length /array]\n");
1369 #endif
1370     Handle<Code> stub = (strict_mode == kStrictMode)
1371         ? isolate()->builtins()->StoreIC_ArrayLength_Strict()
1372         : isolate()->builtins()->StoreIC_ArrayLength();
1373     set_target(*stub);
1374     return receiver->SetProperty(*name, *value, NONE, strict_mode);
1375   }
1376
1377   // Lookup the property locally in the receiver.
1378   if (FLAG_use_ic && !receiver->IsJSGlobalProxy()) {
1379     LookupResult lookup(isolate());
1380
1381     if (LookupForWrite(receiver, name, &lookup)) {
1382       // Generate a stub for this store.
1383       UpdateCaches(&lookup, state, strict_mode, receiver, name, value);
1384     } else {
1385       // Strict mode doesn't allow setting non-existent global property
1386       // or an assignment to a read only property.
1387       if (strict_mode == kStrictMode) {
1388         if (lookup.IsProperty() && lookup.IsReadOnly()) {
1389           return TypeError("strict_read_only_property", object, name);
1390         } else if (IsContextual(object)) {
1391           return ReferenceError("not_defined", name);
1392         }
1393       }
1394     }
1395   }
1396
1397   if (receiver->IsJSGlobalProxy()) {
1398     // TODO(ulan): find out why we patch this site even with --no-use-ic
1399     // Generate a generic stub that goes to the runtime when we see a global
1400     // proxy as receiver.
1401     Handle<Code> stub = (strict_mode == kStrictMode)
1402         ? global_proxy_stub_strict()
1403         : global_proxy_stub();
1404     if (target() != *stub) {
1405       set_target(*stub);
1406       TRACE_IC("StoreIC", name, state, target());
1407     }
1408   }
1409
1410   // Set the property.
1411   return receiver->SetProperty(*name, *value, NONE, strict_mode);
1412 }
1413
1414
1415 void StoreIC::UpdateCaches(LookupResult* lookup,
1416                            State state,
1417                            StrictModeFlag strict_mode,
1418                            Handle<JSObject> receiver,
1419                            Handle<String> name,
1420                            Handle<Object> value) {
1421   ASSERT(!receiver->IsJSGlobalProxy());
1422   ASSERT(StoreICableLookup(lookup));
1423   // These are not cacheable, so we never see such LookupResults here.
1424   ASSERT(lookup->type() != HANDLER);
1425   // We get only called for properties or transitions, see StoreICableLookup.
1426   ASSERT(lookup->type() != NULL_DESCRIPTOR);
1427
1428   // If the property has a non-field type allowing map transitions
1429   // where there is extra room in the object, we leave the IC in its
1430   // current state.
1431   PropertyType type = lookup->type();
1432
1433   // Compute the code stub for this store; used for rewriting to
1434   // monomorphic state and making sure that the code stub is in the
1435   // stub cache.
1436   Handle<Code> code;
1437   switch (type) {
1438     case FIELD:
1439       code = isolate()->stub_cache()->ComputeStoreField(name,
1440                                                         receiver,
1441                                                         lookup->GetFieldIndex(),
1442                                                         Handle<Map>::null(),
1443                                                         strict_mode);
1444       break;
1445     case MAP_TRANSITION: {
1446       if (lookup->GetAttributes() != NONE) return;
1447       Handle<Map> transition(lookup->GetTransitionMap());
1448       int index = transition->PropertyIndexFor(*name);
1449       code = isolate()->stub_cache()->ComputeStoreField(
1450           name, receiver, index, transition, strict_mode);
1451       break;
1452     }
1453     case NORMAL:
1454       if (receiver->IsGlobalObject()) {
1455         // The stub generated for the global object picks the value directly
1456         // from the property cell. So the property must be directly on the
1457         // global object.
1458         Handle<GlobalObject> global = Handle<GlobalObject>::cast(receiver);
1459         Handle<JSGlobalPropertyCell> cell(global->GetPropertyCell(lookup));
1460         code = isolate()->stub_cache()->ComputeStoreGlobal(
1461             name, global, cell, strict_mode);
1462       } else {
1463         if (lookup->holder() != *receiver) return;
1464         code = isolate()->stub_cache()->ComputeStoreNormal(strict_mode);
1465       }
1466       break;
1467     case CALLBACKS: {
1468       Handle<Object> callback_object(lookup->GetCallbackObject());
1469       if (!callback_object->IsAccessorInfo()) return;
1470       Handle<AccessorInfo> callback =
1471           Handle<AccessorInfo>::cast(callback_object);
1472       if (v8::ToCData<Address>(callback->setter()) == 0) return;
1473       code = isolate()->stub_cache()->ComputeStoreCallback(
1474           name, receiver, callback, strict_mode);
1475       break;
1476     }
1477     case INTERCEPTOR:
1478       ASSERT(!receiver->GetNamedInterceptor()->setter()->IsUndefined());
1479       code = isolate()->stub_cache()->ComputeStoreInterceptor(
1480           name, receiver, strict_mode);
1481       break;
1482     case CONSTANT_FUNCTION:
1483     case CONSTANT_TRANSITION:
1484     case ELEMENTS_TRANSITION:
1485       return;
1486     case HANDLER:
1487     case NULL_DESCRIPTOR:
1488       UNREACHABLE();
1489       return;
1490   }
1491
1492   // Patch the call site depending on the state of the cache.
1493   if (state == UNINITIALIZED || state == MONOMORPHIC_PROTOTYPE_FAILURE) {
1494     set_target(*code);
1495   } else if (state == MONOMORPHIC) {
1496     // Only move to megamorphic if the target changes.
1497     if (target() != *code) {
1498       set_target((strict_mode == kStrictMode)
1499                    ? megamorphic_stub_strict()
1500                    : megamorphic_stub());
1501     }
1502   } else if (state == MEGAMORPHIC) {
1503     // Update the stub cache.
1504     isolate()->stub_cache()->Set(*name, receiver->map(), *code);
1505   }
1506
1507   TRACE_IC("StoreIC", name, state, target());
1508 }
1509
1510
1511 static bool AddOneReceiverMapIfMissing(MapHandleList* receiver_maps,
1512                                        Handle<Map> new_receiver_map) {
1513   ASSERT(!new_receiver_map.is_null());
1514   for (int current = 0; current < receiver_maps->length(); ++current) {
1515     if (!receiver_maps->at(current).is_null() &&
1516         receiver_maps->at(current).is_identical_to(new_receiver_map)) {
1517       return false;
1518     }
1519   }
1520   receiver_maps->Add(new_receiver_map);
1521   return true;
1522 }
1523
1524
1525 void KeyedIC::GetReceiverMapsForStub(Handle<Code> stub,
1526                                      MapHandleList* result) {
1527   ASSERT(stub->is_inline_cache_stub());
1528   if (!string_stub().is_null() && stub.is_identical_to(string_stub())) {
1529     return result->Add(isolate()->factory()->string_map());
1530   } else if (stub->is_keyed_load_stub() || stub->is_keyed_store_stub()) {
1531     if (stub->ic_state() == MONOMORPHIC) {
1532       result->Add(Handle<Map>(stub->FindFirstMap()));
1533     } else {
1534       ASSERT(stub->ic_state() == MEGAMORPHIC);
1535       AssertNoAllocation no_allocation;
1536       int mask = RelocInfo::ModeMask(RelocInfo::EMBEDDED_OBJECT);
1537       for (RelocIterator it(*stub, mask); !it.done(); it.next()) {
1538         RelocInfo* info = it.rinfo();
1539         Handle<Object> object(info->target_object());
1540         ASSERT(object->IsMap());
1541         AddOneReceiverMapIfMissing(result, Handle<Map>::cast(object));
1542       }
1543     }
1544   }
1545 }
1546
1547
1548 Handle<Code> KeyedIC::ComputeStub(Handle<JSObject> receiver,
1549                                   StubKind stub_kind,
1550                                   StrictModeFlag strict_mode,
1551                                   Handle<Code> generic_stub) {
1552   State ic_state = target()->ic_state();
1553   KeyedAccessGrowMode grow_mode = IsGrowStubKind(stub_kind)
1554       ? ALLOW_JSARRAY_GROWTH
1555       : DO_NOT_ALLOW_JSARRAY_GROWTH;
1556
1557   // Don't handle megamorphic property accesses for INTERCEPTORS or CALLBACKS
1558   // via megamorphic stubs, since they don't have a map in their relocation info
1559   // and so the stubs can't be harvested for the object needed for a map check.
1560   if (target()->type() != NORMAL) {
1561     TRACE_GENERIC_IC("KeyedIC", "non-NORMAL target type");
1562     return generic_stub;
1563   }
1564
1565   bool monomorphic = false;
1566   MapHandleList target_receiver_maps;
1567   if (ic_state != UNINITIALIZED && ic_state != PREMONOMORPHIC) {
1568     GetReceiverMapsForStub(Handle<Code>(target()), &target_receiver_maps);
1569   }
1570   if (!IsTransitionStubKind(stub_kind)) {
1571     if (ic_state == UNINITIALIZED || ic_state == PREMONOMORPHIC) {
1572       monomorphic = true;
1573     } else {
1574       if (ic_state == MONOMORPHIC) {
1575         // The first time a receiver is seen that is a transitioned version of
1576         // the previous monomorphic receiver type, assume the new ElementsKind
1577         // is the monomorphic type. This benefits global arrays that only
1578         // transition once, and all call sites accessing them are faster if they
1579         // remain monomorphic. If this optimistic assumption is not true, the IC
1580         // will miss again and it will become polymorphic and support both the
1581         // untransitioned and transitioned maps.
1582         monomorphic = IsMoreGeneralElementsKindTransition(
1583             target_receiver_maps.at(0)->elements_kind(),
1584             receiver->GetElementsKind());
1585       }
1586     }
1587   }
1588
1589   if (monomorphic) {
1590     return ComputeMonomorphicStub(
1591         receiver, stub_kind, strict_mode, generic_stub);
1592   }
1593   ASSERT(target() != *generic_stub);
1594
1595   // Determine the list of receiver maps that this call site has seen,
1596   // adding the map that was just encountered.
1597   Handle<Map> receiver_map(receiver->map());
1598   bool map_added =
1599       AddOneReceiverMapIfMissing(&target_receiver_maps, receiver_map);
1600   if (IsTransitionStubKind(stub_kind)) {
1601     Handle<Map> new_map = ComputeTransitionedMap(receiver, stub_kind);
1602     map_added |= AddOneReceiverMapIfMissing(&target_receiver_maps, new_map);
1603   }
1604   if (!map_added) {
1605     // If the miss wasn't due to an unseen map, a polymorphic stub
1606     // won't help, use the generic stub.
1607     TRACE_GENERIC_IC("KeyedIC", "same map added twice");
1608     return generic_stub;
1609   }
1610
1611   // If the maximum number of receiver maps has been exceeded, use the generic
1612   // version of the IC.
1613   if (target_receiver_maps.length() > kMaxKeyedPolymorphism) {
1614     TRACE_GENERIC_IC("KeyedIC", "max polymorph exceeded");
1615     return generic_stub;
1616   }
1617
1618   if ((Code::GetKeyedAccessGrowMode(target()->extra_ic_state()) ==
1619        ALLOW_JSARRAY_GROWTH)) {
1620     grow_mode = ALLOW_JSARRAY_GROWTH;
1621   }
1622
1623   Handle<PolymorphicCodeCache> cache =
1624       isolate()->factory()->polymorphic_code_cache();
1625   Code::ExtraICState extra_state = Code::ComputeExtraICState(grow_mode,
1626                                                              strict_mode);
1627   Code::Flags flags = Code::ComputeFlags(kind(), MEGAMORPHIC, extra_state);
1628   Handle<Object> probe = cache->Lookup(&target_receiver_maps, flags);
1629   if (probe->IsCode()) return Handle<Code>::cast(probe);
1630
1631   Handle<Code> stub =
1632       ComputePolymorphicStub(&target_receiver_maps, strict_mode, grow_mode);
1633   PolymorphicCodeCache::Update(cache, &target_receiver_maps, flags, stub);
1634   return stub;
1635 }
1636
1637
1638 Handle<Code> KeyedIC::ComputeMonomorphicStubWithoutMapCheck(
1639     Handle<Map> receiver_map,
1640     StrictModeFlag strict_mode,
1641     KeyedAccessGrowMode grow_mode) {
1642   if ((receiver_map->instance_type() & kNotStringTag) == 0) {
1643     ASSERT(!string_stub().is_null());
1644     return string_stub();
1645   } else {
1646     ASSERT(receiver_map->has_dictionary_elements() ||
1647            receiver_map->has_fast_elements() ||
1648            receiver_map->has_fast_smi_only_elements() ||
1649            receiver_map->has_fast_double_elements() ||
1650            receiver_map->has_external_array_elements());
1651     bool is_js_array = receiver_map->instance_type() == JS_ARRAY_TYPE;
1652     return GetElementStubWithoutMapCheck(is_js_array,
1653                                          receiver_map->elements_kind(),
1654                                          grow_mode);
1655   }
1656 }
1657
1658
1659 Handle<Code> KeyedIC::ComputeMonomorphicStub(Handle<JSObject> receiver,
1660                                              StubKind stub_kind,
1661                                              StrictModeFlag strict_mode,
1662                                              Handle<Code> generic_stub) {
1663   if (receiver->HasFastElements() ||
1664       receiver->HasFastSmiOnlyElements() ||
1665       receiver->HasExternalArrayElements() ||
1666       receiver->HasFastDoubleElements() ||
1667       receiver->HasDictionaryElements()) {
1668     return isolate()->stub_cache()->ComputeKeyedLoadOrStoreElement(
1669         receiver, stub_kind, strict_mode);
1670   } else {
1671     return generic_stub;
1672   }
1673 }
1674
1675
1676 Handle<Map> KeyedIC::ComputeTransitionedMap(Handle<JSObject> receiver,
1677                                             StubKind stub_kind) {
1678   switch (stub_kind) {
1679     case KeyedIC::STORE_TRANSITION_SMI_TO_OBJECT:
1680     case KeyedIC::STORE_TRANSITION_DOUBLE_TO_OBJECT:
1681     case KeyedIC::STORE_AND_GROW_TRANSITION_SMI_TO_OBJECT:
1682     case KeyedIC::STORE_AND_GROW_TRANSITION_DOUBLE_TO_OBJECT:
1683       return JSObject::GetElementsTransitionMap(receiver, FAST_ELEMENTS);
1684       break;
1685     case KeyedIC::STORE_TRANSITION_SMI_TO_DOUBLE:
1686     case KeyedIC::STORE_AND_GROW_TRANSITION_SMI_TO_DOUBLE:
1687       return JSObject::GetElementsTransitionMap(receiver, FAST_DOUBLE_ELEMENTS);
1688       break;
1689     default:
1690       UNREACHABLE();
1691       return Handle<Map>::null();
1692   }
1693 }
1694
1695
1696 Handle<Code> KeyedStoreIC::GetElementStubWithoutMapCheck(
1697     bool is_js_array,
1698     ElementsKind elements_kind,
1699     KeyedAccessGrowMode grow_mode) {
1700   return KeyedStoreElementStub(is_js_array, elements_kind, grow_mode).GetCode();
1701 }
1702
1703
1704 Handle<Code> KeyedStoreIC::ComputePolymorphicStub(
1705     MapHandleList* receiver_maps,
1706     StrictModeFlag strict_mode,
1707     KeyedAccessGrowMode grow_mode) {
1708   // Collect MONOMORPHIC stubs for all target_receiver_maps.
1709   CodeHandleList handler_ics(receiver_maps->length());
1710   MapHandleList transitioned_maps(receiver_maps->length());
1711   for (int i = 0; i < receiver_maps->length(); ++i) {
1712     Handle<Map> receiver_map(receiver_maps->at(i));
1713     Handle<Code> cached_stub;
1714     Handle<Map> transitioned_map =
1715         receiver_map->FindTransitionedMap(receiver_maps);
1716     if (!transitioned_map.is_null()) {
1717       cached_stub = ElementsTransitionAndStoreStub(
1718           receiver_map->elements_kind(),  // original elements_kind
1719           transitioned_map->elements_kind(),
1720           receiver_map->instance_type() == JS_ARRAY_TYPE,  // is_js_array
1721           strict_mode, grow_mode).GetCode();
1722     } else {
1723       cached_stub = ComputeMonomorphicStubWithoutMapCheck(receiver_map,
1724                                                           strict_mode,
1725                                                           grow_mode);
1726     }
1727     ASSERT(!cached_stub.is_null());
1728     handler_ics.Add(cached_stub);
1729     transitioned_maps.Add(transitioned_map);
1730   }
1731   KeyedStoreStubCompiler compiler(isolate(), strict_mode, grow_mode);
1732   Handle<Code> code = compiler.CompileStorePolymorphic(
1733       receiver_maps, &handler_ics, &transitioned_maps);
1734   isolate()->counters()->keyed_store_polymorphic_stubs()->Increment();
1735   PROFILE(isolate(),
1736           CodeCreateEvent(Logger::KEYED_STORE_MEGAMORPHIC_IC_TAG, *code, 0));
1737   return code;
1738 }
1739
1740
1741 KeyedIC::StubKind KeyedStoreIC::GetStubKind(Handle<JSObject> receiver,
1742                                             Handle<Object> key,
1743                                             Handle<Object> value) {
1744   ASSERT(key->IsSmi());
1745   int index = Smi::cast(*key)->value();
1746   bool allow_growth = receiver->IsJSArray() &&
1747       JSArray::cast(*receiver)->length()->IsSmi() &&
1748       index >= Smi::cast(JSArray::cast(*receiver)->length())->value();
1749
1750   if (allow_growth) {
1751     // Handle growing array in stub if necessary.
1752     if (receiver->HasFastSmiOnlyElements()) {
1753       if (value->IsHeapNumber()) {
1754         return STORE_AND_GROW_TRANSITION_SMI_TO_DOUBLE;
1755       }
1756       if (value->IsHeapObject()) {
1757         return STORE_AND_GROW_TRANSITION_SMI_TO_OBJECT;
1758       }
1759     } else if (receiver->HasFastDoubleElements()) {
1760       if (!value->IsSmi() && !value->IsHeapNumber()) {
1761         return STORE_AND_GROW_TRANSITION_DOUBLE_TO_OBJECT;
1762       }
1763     }
1764     return STORE_AND_GROW_NO_TRANSITION;
1765   } else {
1766     // Handle only in-bounds elements accesses.
1767     if (receiver->HasFastSmiOnlyElements()) {
1768       if (value->IsHeapNumber()) {
1769         return STORE_TRANSITION_SMI_TO_DOUBLE;
1770       } else if (value->IsHeapObject()) {
1771         return STORE_TRANSITION_SMI_TO_OBJECT;
1772       }
1773     } else if (receiver->HasFastDoubleElements()) {
1774       if (!value->IsSmi() && !value->IsHeapNumber()) {
1775         return STORE_TRANSITION_DOUBLE_TO_OBJECT;
1776       }
1777     }
1778     return STORE_NO_TRANSITION;
1779   }
1780 }
1781
1782
1783 MaybeObject* KeyedStoreIC::Store(State state,
1784                                  StrictModeFlag strict_mode,
1785                                  Handle<Object> object,
1786                                  Handle<Object> key,
1787                                  Handle<Object> value,
1788                                  bool force_generic) {
1789   // Check for values that can be converted into a symbol directly or
1790   // is representable as a smi.
1791   key = TryConvertKey(key, isolate());
1792
1793   if (key->IsSymbol()) {
1794     Handle<String> name = Handle<String>::cast(key);
1795
1796     // Handle proxies.
1797     if (object->IsJSProxy()) {
1798       return JSProxy::cast(*object)->SetProperty(
1799           *name, *value, NONE, strict_mode);
1800     }
1801
1802     // If the object is undefined or null it's illegal to try to set any
1803     // properties on it; throw a TypeError in that case.
1804     if (object->IsUndefined() || object->IsNull()) {
1805       return TypeError("non_object_property_store", object, name);
1806     }
1807
1808     // Ignore stores where the receiver is not a JSObject.
1809     if (!object->IsJSObject()) return *value;
1810     Handle<JSObject> receiver = Handle<JSObject>::cast(object);
1811
1812     // Check if the given name is an array index.
1813     uint32_t index;
1814     if (name->AsArrayIndex(&index)) {
1815       Handle<Object> result =
1816           JSObject::SetElement(receiver, index, value, NONE, strict_mode);
1817       RETURN_IF_EMPTY_HANDLE(isolate(), result);
1818       return *value;
1819     }
1820
1821     // Update inline cache and stub cache.
1822     if (FLAG_use_ic && !receiver->IsJSGlobalProxy()) {
1823       LookupResult lookup(isolate());
1824       if (LookupForWrite(receiver, name, &lookup)) {
1825         UpdateCaches(&lookup, state, strict_mode, receiver, name, value);
1826       }
1827     }
1828
1829     // Set the property.
1830     return receiver->SetProperty(*name, *value, NONE, strict_mode);
1831   }
1832
1833   // Do not use ICs for objects that require access checks (including
1834   // the global object).
1835   bool use_ic = FLAG_use_ic && !object->IsAccessCheckNeeded();
1836   ASSERT(!(use_ic && object->IsJSGlobalProxy()));
1837
1838   if (use_ic) {
1839     Handle<Code> stub = (strict_mode == kStrictMode)
1840         ? generic_stub_strict()
1841         : generic_stub();
1842     if (object->IsJSObject()) {
1843       Handle<JSObject> receiver = Handle<JSObject>::cast(object);
1844       if (receiver->elements()->map() ==
1845           isolate()->heap()->non_strict_arguments_elements_map()) {
1846         stub = non_strict_arguments_stub();
1847       } else if (!force_generic) {
1848         if (key->IsSmi() && (target() != *non_strict_arguments_stub())) {
1849           StubKind stub_kind = GetStubKind(receiver, key, value);
1850           stub = ComputeStub(receiver, stub_kind, strict_mode, stub);
1851         }
1852       } else {
1853         TRACE_GENERIC_IC("KeyedStoreIC", "force generic");
1854       }
1855     }
1856     if (!stub.is_null()) set_target(*stub);
1857   }
1858
1859   TRACE_IC("KeyedStoreIC", key, state, target());
1860
1861   // Set the property.
1862   return Runtime::SetObjectProperty(
1863       isolate(), object , key, value, NONE, strict_mode);
1864 }
1865
1866
1867 void KeyedStoreIC::UpdateCaches(LookupResult* lookup,
1868                                 State state,
1869                                 StrictModeFlag strict_mode,
1870                                 Handle<JSObject> receiver,
1871                                 Handle<String> name,
1872                                 Handle<Object> value) {
1873   ASSERT(!receiver->IsJSGlobalProxy());
1874   ASSERT(StoreICableLookup(lookup));
1875   // These are not cacheable, so we never see such LookupResults here.
1876   ASSERT(lookup->type() != HANDLER);
1877   // We get only called for properties or transitions, see StoreICableLookup.
1878   ASSERT(lookup->type() != NULL_DESCRIPTOR);
1879
1880   // If the property has a non-field type allowing map transitions
1881   // where there is extra room in the object, we leave the IC in its
1882   // current state.
1883   PropertyType type = lookup->type();
1884
1885   // Compute the code stub for this store; used for rewriting to
1886   // monomorphic state and making sure that the code stub is in the
1887   // stub cache.
1888   Handle<Code> code;
1889
1890   switch (type) {
1891     case FIELD:
1892       code = isolate()->stub_cache()->ComputeKeyedStoreField(
1893           name, receiver, lookup->GetFieldIndex(),
1894           Handle<Map>::null(), strict_mode);
1895       break;
1896     case MAP_TRANSITION:
1897       if (lookup->GetAttributes() == NONE) {
1898         Handle<Map> transition(lookup->GetTransitionMap());
1899         int index = transition->PropertyIndexFor(*name);
1900         code = isolate()->stub_cache()->ComputeKeyedStoreField(
1901             name, receiver, index, transition, strict_mode);
1902         break;
1903       }
1904       // fall through.
1905     case NORMAL:
1906     case CONSTANT_FUNCTION:
1907     case CALLBACKS:
1908     case INTERCEPTOR:
1909     case CONSTANT_TRANSITION:
1910     case ELEMENTS_TRANSITION:
1911       // Always rewrite to the generic case so that we do not
1912       // repeatedly try to rewrite.
1913       code = (strict_mode == kStrictMode)
1914           ? generic_stub_strict()
1915           : generic_stub();
1916       break;
1917     case HANDLER:
1918     case NULL_DESCRIPTOR:
1919       UNREACHABLE();
1920       return;
1921   }
1922
1923   ASSERT(!code.is_null());
1924
1925   // Patch the call site depending on the state of the cache.  Make
1926   // sure to always rewrite from monomorphic to megamorphic.
1927   ASSERT(state != MONOMORPHIC_PROTOTYPE_FAILURE);
1928   if (state == UNINITIALIZED || state == PREMONOMORPHIC) {
1929     set_target(*code);
1930   } else if (state == MONOMORPHIC) {
1931     set_target((strict_mode == kStrictMode)
1932                  ? *megamorphic_stub_strict()
1933                  : *megamorphic_stub());
1934   }
1935
1936   TRACE_IC("KeyedStoreIC", name, state, target());
1937 }
1938
1939
1940 #undef TRACE_IC
1941
1942
1943 // ----------------------------------------------------------------------------
1944 // Static IC stub generators.
1945 //
1946
1947 // Used from ic-<arch>.cc.
1948 RUNTIME_FUNCTION(MaybeObject*, CallIC_Miss) {
1949   HandleScope scope(isolate);
1950   ASSERT(args.length() == 2);
1951   CallIC ic(isolate);
1952   IC::State state = IC::StateFrom(ic.target(), args[0], args[1]);
1953   Code::ExtraICState extra_ic_state = ic.target()->extra_ic_state();
1954   MaybeObject* maybe_result = ic.LoadFunction(state,
1955                                               extra_ic_state,
1956                                               args.at<Object>(0),
1957                                               args.at<String>(1));
1958   // Result could be a function or a failure.
1959   JSFunction* raw_function = NULL;
1960   if (!maybe_result->To(&raw_function)) return maybe_result;
1961
1962   // The first time the inline cache is updated may be the first time the
1963   // function it references gets called.  If the function is lazily compiled
1964   // then the first call will trigger a compilation.  We check for this case
1965   // and we do the compilation immediately, instead of waiting for the stub
1966   // currently attached to the JSFunction object to trigger compilation.
1967   if (raw_function->is_compiled()) return raw_function;
1968
1969   Handle<JSFunction> function(raw_function);
1970   JSFunction::CompileLazy(function, CLEAR_EXCEPTION);
1971   return *function;
1972 }
1973
1974
1975 // Used from ic-<arch>.cc.
1976 RUNTIME_FUNCTION(MaybeObject*, KeyedCallIC_Miss) {
1977   HandleScope scope(isolate);
1978   ASSERT(args.length() == 2);
1979   KeyedCallIC ic(isolate);
1980   IC::State state = IC::StateFrom(ic.target(), args[0], args[1]);
1981   MaybeObject* maybe_result =
1982       ic.LoadFunction(state, args.at<Object>(0), args.at<Object>(1));
1983   // Result could be a function or a failure.
1984   JSFunction* raw_function = NULL;
1985   if (!maybe_result->To(&raw_function)) return maybe_result;
1986
1987   if (raw_function->is_compiled()) return raw_function;
1988
1989   Handle<JSFunction> function(raw_function);
1990   JSFunction::CompileLazy(function, CLEAR_EXCEPTION);
1991   return *function;
1992 }
1993
1994
1995 // Used from ic-<arch>.cc.
1996 RUNTIME_FUNCTION(MaybeObject*, LoadIC_Miss) {
1997   HandleScope scope(isolate);
1998   ASSERT(args.length() == 2);
1999   LoadIC ic(isolate);
2000   IC::State state = IC::StateFrom(ic.target(), args[0], args[1]);
2001   return ic.Load(state, args.at<Object>(0), args.at<String>(1));
2002 }
2003
2004
2005 // Used from ic-<arch>.cc
2006 RUNTIME_FUNCTION(MaybeObject*, KeyedLoadIC_Miss) {
2007   HandleScope scope(isolate);
2008   ASSERT(args.length() == 2);
2009   KeyedLoadIC ic(isolate);
2010   IC::State state = IC::StateFrom(ic.target(), args[0], args[1]);
2011   return ic.Load(state, args.at<Object>(0), args.at<Object>(1), false);
2012 }
2013
2014
2015 RUNTIME_FUNCTION(MaybeObject*, KeyedLoadIC_MissForceGeneric) {
2016   HandleScope scope(isolate);
2017   ASSERT(args.length() == 2);
2018   KeyedLoadIC ic(isolate);
2019   IC::State state = IC::StateFrom(ic.target(), args[0], args[1]);
2020   return ic.Load(state, args.at<Object>(0), args.at<Object>(1), true);
2021 }
2022
2023
2024 // Used from ic-<arch>.cc.
2025 RUNTIME_FUNCTION(MaybeObject*, StoreIC_Miss) {
2026   HandleScope scope;
2027   ASSERT(args.length() == 3);
2028   StoreIC ic(isolate);
2029   IC::State state = IC::StateFrom(ic.target(), args[0], args[1]);
2030   Code::ExtraICState extra_ic_state = ic.target()->extra_ic_state();
2031   return ic.Store(state,
2032                   Code::GetStrictMode(extra_ic_state),
2033                   args.at<Object>(0),
2034                   args.at<String>(1),
2035                   args.at<Object>(2));
2036 }
2037
2038
2039 RUNTIME_FUNCTION(MaybeObject*, StoreIC_ArrayLength) {
2040   NoHandleAllocation nha;
2041
2042   ASSERT(args.length() == 2);
2043   JSArray* receiver = JSArray::cast(args[0]);
2044   Object* len = args[1];
2045
2046   // The generated code should filter out non-Smis before we get here.
2047   ASSERT(len->IsSmi());
2048
2049 #ifdef DEBUG
2050   // The length property has to be a writable callback property.
2051   LookupResult debug_lookup(isolate);
2052   receiver->LocalLookup(isolate->heap()->length_symbol(), &debug_lookup);
2053   ASSERT(debug_lookup.type() == CALLBACKS && !debug_lookup.IsReadOnly());
2054 #endif
2055
2056   Object* result;
2057   { MaybeObject* maybe_result = receiver->SetElementsLength(len);
2058     if (!maybe_result->ToObject(&result)) return maybe_result;
2059   }
2060   return len;
2061 }
2062
2063
2064 // Extend storage is called in a store inline cache when
2065 // it is necessary to extend the properties array of a
2066 // JSObject.
2067 RUNTIME_FUNCTION(MaybeObject*, SharedStoreIC_ExtendStorage) {
2068   NoHandleAllocation na;
2069   ASSERT(args.length() == 3);
2070
2071   // Convert the parameters
2072   JSObject* object = JSObject::cast(args[0]);
2073   Map* transition = Map::cast(args[1]);
2074   Object* value = args[2];
2075
2076   // Check the object has run out out property space.
2077   ASSERT(object->HasFastProperties());
2078   ASSERT(object->map()->unused_property_fields() == 0);
2079
2080   // Expand the properties array.
2081   FixedArray* old_storage = object->properties();
2082   int new_unused = transition->unused_property_fields();
2083   int new_size = old_storage->length() + new_unused + 1;
2084   Object* result;
2085   { MaybeObject* maybe_result = old_storage->CopySize(new_size);
2086     if (!maybe_result->ToObject(&result)) return maybe_result;
2087   }
2088   FixedArray* new_storage = FixedArray::cast(result);
2089   new_storage->set(old_storage->length(), value);
2090
2091   // Set the new property value and do the map transition.
2092   object->set_properties(new_storage);
2093   object->set_map(transition);
2094
2095   // Return the stored value.
2096   return value;
2097 }
2098
2099
2100 // Used from ic-<arch>.cc.
2101 RUNTIME_FUNCTION(MaybeObject*, KeyedStoreIC_Miss) {
2102   HandleScope scope(isolate);
2103   ASSERT(args.length() == 3);
2104   KeyedStoreIC ic(isolate);
2105   IC::State state = IC::StateFrom(ic.target(), args[0], args[1]);
2106   Code::ExtraICState extra_ic_state = ic.target()->extra_ic_state();
2107   return ic.Store(state,
2108                   Code::GetStrictMode(extra_ic_state),
2109                   args.at<Object>(0),
2110                   args.at<Object>(1),
2111                   args.at<Object>(2),
2112                   false);
2113 }
2114
2115
2116 RUNTIME_FUNCTION(MaybeObject*, KeyedStoreIC_Slow) {
2117   NoHandleAllocation na;
2118   ASSERT(args.length() == 3);
2119   KeyedStoreIC ic(isolate);
2120   Code::ExtraICState extra_ic_state = ic.target()->extra_ic_state();
2121   Handle<Object> object = args.at<Object>(0);
2122   Handle<Object> key = args.at<Object>(1);
2123   Handle<Object> value = args.at<Object>(2);
2124   StrictModeFlag strict_mode = Code::GetStrictMode(extra_ic_state);
2125   return Runtime::SetObjectProperty(isolate,
2126                                     object,
2127                                     key,
2128                                     value,
2129                                     NONE,
2130                                     strict_mode);
2131 }
2132
2133
2134 RUNTIME_FUNCTION(MaybeObject*, KeyedStoreIC_MissForceGeneric) {
2135   HandleScope scope(isolate);
2136   ASSERT(args.length() == 3);
2137   KeyedStoreIC ic(isolate);
2138   IC::State state = IC::StateFrom(ic.target(), args[0], args[1]);
2139   Code::ExtraICState extra_ic_state = ic.target()->extra_ic_state();
2140   return ic.Store(state,
2141                   Code::GetStrictMode(extra_ic_state),
2142                   args.at<Object>(0),
2143                   args.at<Object>(1),
2144                   args.at<Object>(2),
2145                   true);
2146 }
2147
2148
2149 void UnaryOpIC::patch(Code* code) {
2150   set_target(code);
2151 }
2152
2153
2154 const char* UnaryOpIC::GetName(TypeInfo type_info) {
2155   switch (type_info) {
2156     case UNINITIALIZED: return "Uninitialized";
2157     case SMI: return "Smi";
2158     case HEAP_NUMBER: return "HeapNumbers";
2159     case GENERIC: return "Generic";
2160     default: return "Invalid";
2161   }
2162 }
2163
2164
2165 UnaryOpIC::State UnaryOpIC::ToState(TypeInfo type_info) {
2166   switch (type_info) {
2167     case UNINITIALIZED:
2168       return ::v8::internal::UNINITIALIZED;
2169     case SMI:
2170     case HEAP_NUMBER:
2171       return MONOMORPHIC;
2172     case GENERIC:
2173       return MEGAMORPHIC;
2174   }
2175   UNREACHABLE();
2176   return ::v8::internal::UNINITIALIZED;
2177 }
2178
2179 UnaryOpIC::TypeInfo UnaryOpIC::GetTypeInfo(Handle<Object> operand) {
2180   ::v8::internal::TypeInfo operand_type =
2181       ::v8::internal::TypeInfo::TypeFromValue(operand);
2182   if (operand_type.IsSmi()) {
2183     return SMI;
2184   } else if (operand_type.IsNumber()) {
2185     return HEAP_NUMBER;
2186   } else {
2187     return GENERIC;
2188   }
2189 }
2190
2191
2192 UnaryOpIC::TypeInfo UnaryOpIC::ComputeNewType(
2193     UnaryOpIC::TypeInfo current_type,
2194     UnaryOpIC::TypeInfo previous_type) {
2195   switch (previous_type) {
2196     case UnaryOpIC::UNINITIALIZED:
2197       return current_type;
2198     case UnaryOpIC::SMI:
2199       return (current_type == UnaryOpIC::GENERIC)
2200           ? UnaryOpIC::GENERIC
2201           : UnaryOpIC::HEAP_NUMBER;
2202     case UnaryOpIC::HEAP_NUMBER:
2203       return UnaryOpIC::GENERIC;
2204     case UnaryOpIC::GENERIC:
2205       // We should never do patching if we are in GENERIC state.
2206       UNREACHABLE();
2207       return UnaryOpIC::GENERIC;
2208   }
2209   UNREACHABLE();
2210   return UnaryOpIC::GENERIC;
2211 }
2212
2213
2214 void BinaryOpIC::patch(Code* code) {
2215   set_target(code);
2216 }
2217
2218
2219 const char* BinaryOpIC::GetName(TypeInfo type_info) {
2220   switch (type_info) {
2221     case UNINITIALIZED: return "Uninitialized";
2222     case SMI: return "SMI";
2223     case INT32: return "Int32s";
2224     case HEAP_NUMBER: return "HeapNumbers";
2225     case ODDBALL: return "Oddball";
2226     case BOTH_STRING: return "BothStrings";
2227     case STRING: return "Strings";
2228     case GENERIC: return "Generic";
2229     default: return "Invalid";
2230   }
2231 }
2232
2233
2234 BinaryOpIC::State BinaryOpIC::ToState(TypeInfo type_info) {
2235   switch (type_info) {
2236     case UNINITIALIZED:
2237       return ::v8::internal::UNINITIALIZED;
2238     case SMI:
2239     case INT32:
2240     case HEAP_NUMBER:
2241     case ODDBALL:
2242     case BOTH_STRING:
2243     case STRING:
2244       return MONOMORPHIC;
2245     case GENERIC:
2246       return MEGAMORPHIC;
2247   }
2248   UNREACHABLE();
2249   return ::v8::internal::UNINITIALIZED;
2250 }
2251
2252
2253 BinaryOpIC::TypeInfo BinaryOpIC::JoinTypes(BinaryOpIC::TypeInfo x,
2254                                            BinaryOpIC::TypeInfo y) {
2255   if (x == UNINITIALIZED) return y;
2256   if (y == UNINITIALIZED) return x;
2257   if (x == y) return x;
2258   if (x == BOTH_STRING && y == STRING) return STRING;
2259   if (x == STRING && y == BOTH_STRING) return STRING;
2260   if (x == STRING || x == BOTH_STRING || y == STRING || y == BOTH_STRING) {
2261     return GENERIC;
2262   }
2263   if (x > y) return x;
2264   return y;
2265 }
2266
2267
2268 BinaryOpIC::TypeInfo BinaryOpIC::GetTypeInfo(Handle<Object> left,
2269                                              Handle<Object> right) {
2270   ::v8::internal::TypeInfo left_type =
2271       ::v8::internal::TypeInfo::TypeFromValue(left);
2272   ::v8::internal::TypeInfo right_type =
2273       ::v8::internal::TypeInfo::TypeFromValue(right);
2274
2275   if (left_type.IsSmi() && right_type.IsSmi()) {
2276     return SMI;
2277   }
2278
2279   if (left_type.IsInteger32() && right_type.IsInteger32()) {
2280     // Platforms with 32-bit Smis have no distinct INT32 type.
2281     if (kSmiValueSize == 32) return SMI;
2282     return INT32;
2283   }
2284
2285   if (left_type.IsNumber() && right_type.IsNumber()) {
2286     return HEAP_NUMBER;
2287   }
2288
2289   // Patching for fast string ADD makes sense even if only one of the
2290   // arguments is a string.
2291   if (left_type.IsString())  {
2292     return right_type.IsString() ? BOTH_STRING : STRING;
2293   } else if (right_type.IsString()) {
2294     return STRING;
2295   }
2296
2297   // Check for oddball objects.
2298   if (left->IsUndefined() && right->IsNumber()) return ODDBALL;
2299   if (left->IsNumber() && right->IsUndefined()) return ODDBALL;
2300
2301   return GENERIC;
2302 }
2303
2304
2305 RUNTIME_FUNCTION(MaybeObject*, UnaryOp_Patch) {
2306   ASSERT(args.length() == 4);
2307
2308   HandleScope scope(isolate);
2309   Handle<Object> operand = args.at<Object>(0);
2310   Token::Value op = static_cast<Token::Value>(args.smi_at(1));
2311   UnaryOverwriteMode mode = static_cast<UnaryOverwriteMode>(args.smi_at(2));
2312   UnaryOpIC::TypeInfo previous_type =
2313       static_cast<UnaryOpIC::TypeInfo>(args.smi_at(3));
2314
2315   UnaryOpIC::TypeInfo type = UnaryOpIC::GetTypeInfo(operand);
2316   type = UnaryOpIC::ComputeNewType(type, previous_type);
2317
2318   UnaryOpStub stub(op, mode, type);
2319   Handle<Code> code = stub.GetCode();
2320   if (!code.is_null()) {
2321     if (FLAG_trace_ic) {
2322       PrintF("[UnaryOpIC (%s->%s)#%s]\n",
2323              UnaryOpIC::GetName(previous_type),
2324              UnaryOpIC::GetName(type),
2325              Token::Name(op));
2326     }
2327     UnaryOpIC ic(isolate);
2328     ic.patch(*code);
2329   }
2330
2331   Handle<JSBuiltinsObject> builtins = Handle<JSBuiltinsObject>(
2332       isolate->thread_local_top()->context_->builtins(), isolate);
2333   Object* builtin = NULL;  // Initialization calms down the compiler.
2334   switch (op) {
2335     case Token::SUB:
2336       builtin = builtins->javascript_builtin(Builtins::UNARY_MINUS);
2337       break;
2338     case Token::BIT_NOT:
2339       builtin = builtins->javascript_builtin(Builtins::BIT_NOT);
2340       break;
2341     default:
2342       UNREACHABLE();
2343   }
2344
2345   Handle<JSFunction> builtin_function(JSFunction::cast(builtin), isolate);
2346
2347   bool caught_exception;
2348   Handle<Object> result = Execution::Call(builtin_function, operand, 0, NULL,
2349                                           &caught_exception);
2350   if (caught_exception) {
2351     return Failure::Exception();
2352   }
2353   return *result;
2354 }
2355
2356 RUNTIME_FUNCTION(MaybeObject*, BinaryOp_Patch) {
2357   ASSERT(args.length() == 5);
2358
2359   HandleScope scope(isolate);
2360   Handle<Object> left = args.at<Object>(0);
2361   Handle<Object> right = args.at<Object>(1);
2362   int key = args.smi_at(2);
2363   Token::Value op = static_cast<Token::Value>(args.smi_at(3));
2364   BinaryOpIC::TypeInfo previous_type =
2365       static_cast<BinaryOpIC::TypeInfo>(args.smi_at(4));
2366
2367   BinaryOpIC::TypeInfo type = BinaryOpIC::GetTypeInfo(left, right);
2368   type = BinaryOpIC::JoinTypes(type, previous_type);
2369   BinaryOpIC::TypeInfo result_type = BinaryOpIC::UNINITIALIZED;
2370   if ((type == BinaryOpIC::STRING || type == BinaryOpIC::BOTH_STRING) &&
2371       op != Token::ADD) {
2372     type = BinaryOpIC::GENERIC;
2373   }
2374   if (type == BinaryOpIC::SMI && previous_type == BinaryOpIC::SMI) {
2375     if (op == Token::DIV ||
2376         op == Token::MUL ||
2377         op == Token::SHR ||
2378         kSmiValueSize == 32) {
2379       // Arithmetic on two Smi inputs has yielded a heap number.
2380       // That is the only way to get here from the Smi stub.
2381       // With 32-bit Smis, all overflows give heap numbers, but with
2382       // 31-bit Smis, most operations overflow to int32 results.
2383       result_type = BinaryOpIC::HEAP_NUMBER;
2384     } else {
2385       // Other operations on SMIs that overflow yield int32s.
2386       result_type = BinaryOpIC::INT32;
2387     }
2388   }
2389   if (type == BinaryOpIC::INT32 && previous_type == BinaryOpIC::INT32) {
2390     // We must be here because an operation on two INT32 types overflowed.
2391     result_type = BinaryOpIC::HEAP_NUMBER;
2392   }
2393
2394   BinaryOpStub stub(key, type, result_type);
2395   Handle<Code> code = stub.GetCode();
2396   if (!code.is_null()) {
2397     if (FLAG_trace_ic) {
2398       PrintF("[BinaryOpIC (%s->(%s->%s))#%s]\n",
2399              BinaryOpIC::GetName(previous_type),
2400              BinaryOpIC::GetName(type),
2401              BinaryOpIC::GetName(result_type),
2402              Token::Name(op));
2403     }
2404     BinaryOpIC ic(isolate);
2405     ic.patch(*code);
2406
2407     // Activate inlined smi code.
2408     if (previous_type == BinaryOpIC::UNINITIALIZED) {
2409       PatchInlinedSmiCode(ic.address(), ENABLE_INLINED_SMI_CHECK);
2410     }
2411   }
2412
2413   Handle<JSBuiltinsObject> builtins = Handle<JSBuiltinsObject>(
2414       isolate->thread_local_top()->context_->builtins(), isolate);
2415   Object* builtin = NULL;  // Initialization calms down the compiler.
2416   switch (op) {
2417     case Token::ADD:
2418       builtin = builtins->javascript_builtin(Builtins::ADD);
2419       break;
2420     case Token::SUB:
2421       builtin = builtins->javascript_builtin(Builtins::SUB);
2422       break;
2423     case Token::MUL:
2424       builtin = builtins->javascript_builtin(Builtins::MUL);
2425       break;
2426     case Token::DIV:
2427       builtin = builtins->javascript_builtin(Builtins::DIV);
2428       break;
2429     case Token::MOD:
2430       builtin = builtins->javascript_builtin(Builtins::MOD);
2431       break;
2432     case Token::BIT_AND:
2433       builtin = builtins->javascript_builtin(Builtins::BIT_AND);
2434       break;
2435     case Token::BIT_OR:
2436       builtin = builtins->javascript_builtin(Builtins::BIT_OR);
2437       break;
2438     case Token::BIT_XOR:
2439       builtin = builtins->javascript_builtin(Builtins::BIT_XOR);
2440       break;
2441     case Token::SHR:
2442       builtin = builtins->javascript_builtin(Builtins::SHR);
2443       break;
2444     case Token::SAR:
2445       builtin = builtins->javascript_builtin(Builtins::SAR);
2446       break;
2447     case Token::SHL:
2448       builtin = builtins->javascript_builtin(Builtins::SHL);
2449       break;
2450     default:
2451       UNREACHABLE();
2452   }
2453
2454   Handle<JSFunction> builtin_function(JSFunction::cast(builtin), isolate);
2455
2456   bool caught_exception;
2457   Handle<Object> builtin_args[] = { right };
2458   Handle<Object> result = Execution::Call(builtin_function,
2459                                           left,
2460                                           ARRAY_SIZE(builtin_args),
2461                                           builtin_args,
2462                                           &caught_exception);
2463   if (caught_exception) {
2464     return Failure::Exception();
2465   }
2466   return *result;
2467 }
2468
2469
2470 Code* CompareIC::GetRawUninitialized(Token::Value op) {
2471   ICCompareStub stub(op, UNINITIALIZED);
2472   Code* code = NULL;
2473   CHECK(stub.FindCodeInCache(&code));
2474   return code;
2475 }
2476
2477
2478 Handle<Code> CompareIC::GetUninitialized(Token::Value op) {
2479   ICCompareStub stub(op, UNINITIALIZED);
2480   return stub.GetCode();
2481 }
2482
2483
2484 CompareIC::State CompareIC::ComputeState(Code* target) {
2485   int key = target->major_key();
2486   if (key == CodeStub::Compare) return GENERIC;
2487   ASSERT(key == CodeStub::CompareIC);
2488   return static_cast<State>(target->compare_state());
2489 }
2490
2491
2492 Token::Value CompareIC::ComputeOperation(Code* target) {
2493   ASSERT(target->major_key() == CodeStub::CompareIC);
2494   return static_cast<Token::Value>(target->compare_operation());
2495 }
2496
2497
2498 const char* CompareIC::GetStateName(State state) {
2499   switch (state) {
2500     case UNINITIALIZED: return "UNINITIALIZED";
2501     case SMIS: return "SMIS";
2502     case HEAP_NUMBERS: return "HEAP_NUMBERS";
2503     case OBJECTS: return "OBJECTS";
2504     case KNOWN_OBJECTS: return "OBJECTS";
2505     case SYMBOLS: return "SYMBOLS";
2506     case STRINGS: return "STRINGS";
2507     case GENERIC: return "GENERIC";
2508     default:
2509       UNREACHABLE();
2510       return NULL;
2511   }
2512 }
2513
2514
2515 CompareIC::State CompareIC::TargetState(State state,
2516                                         bool has_inlined_smi_code,
2517                                         Handle<Object> x,
2518                                         Handle<Object> y) {
2519   switch (state) {
2520     case UNINITIALIZED:
2521       if (x->IsSmi() && y->IsSmi()) return SMIS;
2522       if (x->IsNumber() && y->IsNumber()) return HEAP_NUMBERS;
2523       if (Token::IsOrderedRelationalCompareOp(op_)) {
2524         // Ordered comparisons treat undefined as NaN, so the
2525         // HEAP_NUMBER stub will do the right thing.
2526         if ((x->IsNumber() && y->IsUndefined()) ||
2527             (y->IsNumber() && x->IsUndefined())) {
2528           return HEAP_NUMBERS;
2529         }
2530       }
2531       if (x->IsSymbol() && y->IsSymbol()) {
2532         // We compare symbols as strings if we need to determine
2533         // the order in a non-equality compare.
2534         return Token::IsEqualityOp(op_) ? SYMBOLS : STRINGS;
2535       }
2536       if (x->IsString() && y->IsString()) return STRINGS;
2537       if (!Token::IsEqualityOp(op_)) return GENERIC;
2538       if (x->IsJSObject() && y->IsJSObject()) {
2539         if (Handle<JSObject>::cast(x)->map() ==
2540             Handle<JSObject>::cast(y)->map() &&
2541             Token::IsEqualityOp(op_)) {
2542           return KNOWN_OBJECTS;
2543         } else {
2544           return OBJECTS;
2545         }
2546       }
2547       return GENERIC;
2548     case SMIS:
2549       return has_inlined_smi_code && x->IsNumber() && y->IsNumber()
2550           ? HEAP_NUMBERS
2551           : GENERIC;
2552     case SYMBOLS:
2553       ASSERT(Token::IsEqualityOp(op_));
2554       return x->IsString() && y->IsString() ? STRINGS : GENERIC;
2555     case HEAP_NUMBERS:
2556     case STRINGS:
2557     case OBJECTS:
2558     case KNOWN_OBJECTS:
2559     case GENERIC:
2560       return GENERIC;
2561   }
2562   UNREACHABLE();
2563   return GENERIC;
2564 }
2565
2566
2567 // Used from ic_<arch>.cc.
2568 RUNTIME_FUNCTION(Code*, CompareIC_Miss) {
2569   NoHandleAllocation na;
2570   ASSERT(args.length() == 3);
2571   CompareIC ic(isolate, static_cast<Token::Value>(args.smi_at(2)));
2572   ic.UpdateCaches(args.at<Object>(0), args.at<Object>(1));
2573   return ic.target();
2574 }
2575
2576
2577 RUNTIME_FUNCTION(MaybeObject*, ToBoolean_Patch) {
2578   ASSERT(args.length() == 3);
2579
2580   HandleScope scope(isolate);
2581   Handle<Object> object = args.at<Object>(0);
2582   Register tos = Register::from_code(args.smi_at(1));
2583   ToBooleanStub::Types old_types(args.smi_at(2));
2584
2585   ToBooleanStub::Types new_types(old_types);
2586   bool to_boolean_value = new_types.Record(object);
2587   old_types.TraceTransition(new_types);
2588
2589   ToBooleanStub stub(tos, new_types);
2590   Handle<Code> code = stub.GetCode();
2591   ToBooleanIC ic(isolate);
2592   ic.patch(*code);
2593   return Smi::FromInt(to_boolean_value ? 1 : 0);
2594 }
2595
2596
2597 void ToBooleanIC::patch(Code* code) {
2598   set_target(code);
2599 }
2600
2601
2602 static const Address IC_utilities[] = {
2603 #define ADDR(name) FUNCTION_ADDR(name),
2604     IC_UTIL_LIST(ADDR)
2605     NULL
2606 #undef ADDR
2607 };
2608
2609
2610 Address IC::AddressFromUtilityId(IC::UtilityId id) {
2611   return IC_utilities[id];
2612 }
2613
2614
2615 } }  // namespace v8::internal