1 // Copyright 2014 the V8 project authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file.
7 #include "src/cpu-profiler.h"
8 #include "src/ic/call-optimization.h"
9 #include "src/ic/handler-compiler.h"
10 #include "src/ic/ic.h"
11 #include "src/ic/ic-inl.h"
17 Handle<Code> PropertyHandlerCompiler::Find(Handle<Name> name,
18 Handle<Map> stub_holder,
20 CacheHolderFlag cache_holder,
21 Code::StubType type) {
22 Code::Flags flags = Code::ComputeHandlerFlags(kind, type, cache_holder);
23 Object* probe = stub_holder->FindInCodeCache(*name, flags);
24 if (probe->IsCode()) return handle(Code::cast(probe));
25 return Handle<Code>::null();
29 Handle<Code> NamedLoadHandlerCompiler::ComputeLoadNonexistent(
30 Handle<Name> name, Handle<Map> receiver_map) {
31 Isolate* isolate = name->GetIsolate();
32 if (receiver_map->prototype()->IsNull()) {
33 // TODO(jkummerow/verwaest): If there is no prototype and the property
34 // is nonexistent, introduce a builtin to handle this (fast properties
35 // -> return undefined, dictionary properties -> do negative lookup).
36 return Handle<Code>();
39 Handle<Map> stub_holder_map =
40 IC::GetHandlerCacheHolder(receiver_map, false, isolate, &flag);
42 // If no dictionary mode objects are present in the prototype chain, the load
43 // nonexistent IC stub can be shared for all names for a given map and we use
44 // the empty string for the map cache in that case. If there are dictionary
45 // mode objects involved, we need to do negative lookups in the stub and
46 // therefore the stub will be specific to the name.
47 Handle<Name> cache_name =
48 receiver_map->is_dictionary_map()
50 : Handle<Name>::cast(isolate->factory()->nonexistent_symbol());
51 Handle<Map> current_map = stub_holder_map;
52 Handle<JSObject> last(JSObject::cast(receiver_map->prototype()));
54 if (current_map->is_dictionary_map()) cache_name = name;
55 if (current_map->prototype()->IsNull()) break;
56 if (name->IsPrivate()) {
57 // TODO(verwaest): Use nonexistent_private_symbol.
59 JSReceiver* prototype = JSReceiver::cast(current_map->prototype());
60 if (!prototype->map()->is_hidden_prototype() &&
61 !prototype->map()->IsGlobalObjectMap()) {
66 last = handle(JSObject::cast(current_map->prototype()));
67 current_map = handle(last->map());
69 // Compile the stub that is either shared for all names or
70 // name specific if there are global objects involved.
71 Handle<Code> handler = PropertyHandlerCompiler::Find(
72 cache_name, stub_holder_map, Code::LOAD_IC, flag, Code::FAST);
73 if (!handler.is_null()) return handler;
75 NamedLoadHandlerCompiler compiler(isolate, receiver_map, last, flag);
76 handler = compiler.CompileLoadNonexistent(cache_name);
77 Map::UpdateCodeCache(stub_holder_map, cache_name, handler);
82 Handle<Code> PropertyHandlerCompiler::GetCode(Code::Kind kind,
85 Code::Flags flags = Code::ComputeHandlerFlags(kind, type, cache_holder());
86 Handle<Code> code = GetCodeWithFlags(flags, name);
87 PROFILE(isolate(), CodeCreateEvent(Logger::HANDLER_TAG, *code, *name));
89 code->VerifyEmbeddedObjects();
95 #define __ ACCESS_MASM(masm())
98 Register NamedLoadHandlerCompiler::FrontendHeader(Register object_reg,
101 ReturnHolder return_what) {
102 PrototypeCheckType check_type = CHECK_ALL_MAPS;
103 int function_index = -1;
104 if (map()->instance_type() < FIRST_NONSTRING_TYPE) {
105 function_index = Context::STRING_FUNCTION_INDEX;
106 } else if (map()->instance_type() == SYMBOL_TYPE) {
107 function_index = Context::SYMBOL_FUNCTION_INDEX;
108 } else if (map()->instance_type() == HEAP_NUMBER_TYPE) {
109 function_index = Context::NUMBER_FUNCTION_INDEX;
110 } else if (map()->instance_type() == FLOAT32X4_TYPE) {
111 function_index = Context::FLOAT32X4_FUNCTION_INDEX;
112 } else if (*map() == isolate()->heap()->boolean_map()) {
113 function_index = Context::BOOLEAN_FUNCTION_INDEX;
115 check_type = SKIP_RECEIVER;
118 if (check_type == CHECK_ALL_MAPS) {
119 GenerateDirectLoadGlobalFunctionPrototype(masm(), function_index,
121 Object* function = isolate()->native_context()->get(function_index);
122 Object* prototype = JSFunction::cast(function)->instance_prototype();
123 Handle<Map> map(JSObject::cast(prototype)->map());
125 object_reg = scratch1();
128 // Check that the maps starting from the prototype haven't changed.
129 return CheckPrototypes(object_reg, scratch1(), scratch2(), scratch3(), name,
130 miss, check_type, return_what);
134 // Frontend for store uses the name register. It has to be restored before a
136 Register NamedStoreHandlerCompiler::FrontendHeader(Register object_reg,
139 ReturnHolder return_what) {
140 return CheckPrototypes(object_reg, this->name(), scratch1(), scratch2(), name,
141 miss, SKIP_RECEIVER, return_what);
145 Register PropertyHandlerCompiler::Frontend(Handle<Name> name) {
147 if (IC::ICUseVector(kind())) {
150 Register reg = FrontendHeader(receiver(), name, &miss, RETURN_HOLDER);
151 FrontendFooter(name, &miss);
152 // The footer consumes the vector and slot from the stack if miss occurs.
153 if (IC::ICUseVector(kind())) {
154 DiscardVectorAndSlot();
160 void PropertyHandlerCompiler::NonexistentFrontendHeader(Handle<Name> name,
165 Handle<Map> last_map;
166 if (holder().is_null()) {
167 holder_reg = receiver();
169 // If |type| has null as its prototype, |holder()| is
170 // Handle<JSObject>::null().
171 DCHECK(last_map->prototype() == isolate()->heap()->null_value());
173 last_map = handle(holder()->map());
174 // This condition matches the branches below.
176 last_map->is_dictionary_map() && !last_map->IsJSGlobalObjectMap();
178 FrontendHeader(receiver(), name, miss,
179 need_holder ? RETURN_HOLDER : DONT_RETURN_ANYTHING);
182 if (last_map->is_dictionary_map()) {
183 if (last_map->IsJSGlobalObjectMap()) {
184 Handle<JSGlobalObject> global =
186 ? Handle<JSGlobalObject>::cast(isolate()->global_object())
187 : Handle<JSGlobalObject>::cast(holder());
188 GenerateCheckPropertyCell(masm(), global, name, scratch1, miss);
190 if (!name->IsUniqueName()) {
191 DCHECK(name->IsString());
192 name = factory()->InternalizeString(Handle<String>::cast(name));
194 DCHECK(holder().is_null() ||
195 holder()->property_dictionary()->FindEntry(name) ==
196 NameDictionary::kNotFound);
197 GenerateDictionaryNegativeLookup(masm(), miss, holder_reg, name, scratch1,
204 Handle<Code> NamedLoadHandlerCompiler::CompileLoadField(Handle<Name> name,
206 Register reg = Frontend(name);
207 __ Move(receiver(), reg);
208 LoadFieldStub stub(isolate(), field);
209 GenerateTailCall(masm(), stub.GetCode());
210 return GetCode(kind(), Code::FAST, name);
214 Handle<Code> NamedLoadHandlerCompiler::CompileLoadConstant(Handle<Name> name,
215 int constant_index) {
216 Register reg = Frontend(name);
217 __ Move(receiver(), reg);
218 LoadConstantStub stub(isolate(), constant_index);
219 GenerateTailCall(masm(), stub.GetCode());
220 return GetCode(kind(), Code::FAST, name);
224 Handle<Code> NamedLoadHandlerCompiler::CompileLoadNonexistent(
227 if (IC::ICUseVector(kind())) {
228 DCHECK(kind() == Code::LOAD_IC);
231 NonexistentFrontendHeader(name, &miss, scratch2(), scratch3());
232 if (IC::ICUseVector(kind())) {
233 DiscardVectorAndSlot();
235 GenerateLoadConstant(isolate()->factory()->undefined_value());
236 FrontendFooter(name, &miss);
237 return GetCode(kind(), Code::FAST, name);
241 Handle<Code> NamedLoadHandlerCompiler::CompileLoadCallback(
242 Handle<Name> name, Handle<ExecutableAccessorInfo> callback) {
243 Register reg = Frontend(name);
244 GenerateLoadCallback(reg, callback);
245 return GetCode(kind(), Code::FAST, name);
249 Handle<Code> NamedLoadHandlerCompiler::CompileLoadCallback(
250 Handle<Name> name, const CallOptimization& call_optimization,
251 int accessor_index) {
252 DCHECK(call_optimization.is_simple_api_call());
253 Register holder = Frontend(name);
254 GenerateApiAccessorCall(masm(), call_optimization, map(), receiver(),
255 scratch2(), false, no_reg, holder, accessor_index);
256 return GetCode(kind(), Code::FAST, name);
260 void NamedLoadHandlerCompiler::InterceptorVectorSlotPush(Register holder_reg) {
261 if (IC::ICUseVector(kind())) {
262 if (holder_reg.is(receiver())) {
265 DCHECK(holder_reg.is(scratch1()));
266 PushVectorAndSlot(scratch2(), scratch3());
272 void NamedLoadHandlerCompiler::InterceptorVectorSlotPop(Register holder_reg,
274 if (IC::ICUseVector(kind())) {
275 if (mode == DISCARD) {
276 DiscardVectorAndSlot();
278 if (holder_reg.is(receiver())) {
281 DCHECK(holder_reg.is(scratch1()));
282 PopVectorAndSlot(scratch2(), scratch3());
289 Handle<Code> NamedLoadHandlerCompiler::CompileLoadInterceptor(
290 LookupIterator* it) {
291 // So far the most popular follow ups for interceptor loads are DATA and
292 // ExecutableAccessorInfo, so inline only them. Other cases may be added
294 bool inline_followup = false;
295 switch (it->state()) {
296 case LookupIterator::TRANSITION:
298 case LookupIterator::ACCESS_CHECK:
299 case LookupIterator::INTERCEPTOR:
300 case LookupIterator::JSPROXY:
301 case LookupIterator::NOT_FOUND:
302 case LookupIterator::INTEGER_INDEXED_EXOTIC:
304 case LookupIterator::DATA:
306 it->property_details().type() == DATA && !it->is_dictionary_holder();
308 case LookupIterator::ACCESSOR: {
309 Handle<Object> accessors = it->GetAccessors();
310 if (accessors->IsExecutableAccessorInfo()) {
311 Handle<ExecutableAccessorInfo> info =
312 Handle<ExecutableAccessorInfo>::cast(accessors);
313 inline_followup = info->getter() != NULL &&
314 ExecutableAccessorInfo::IsCompatibleReceiverMap(
315 isolate(), info, map());
316 } else if (accessors->IsAccessorPair()) {
317 Handle<JSObject> property_holder(it->GetHolder<JSObject>());
318 Handle<Object> getter(Handle<AccessorPair>::cast(accessors)->getter(),
320 if (!getter->IsJSFunction()) break;
321 if (!property_holder->HasFastProperties()) break;
322 auto function = Handle<JSFunction>::cast(getter);
323 CallOptimization call_optimization(function);
324 Handle<Map> receiver_map = map();
325 inline_followup = call_optimization.is_simple_api_call() &&
326 call_optimization.IsCompatibleReceiverMap(
327 receiver_map, property_holder);
333 InterceptorVectorSlotPush(receiver());
334 bool lost_holder_register = false;
335 auto holder_orig = holder();
336 // non masking interceptors must check the entire chain, so temporarily reset
337 // the holder to be that last element for the FrontendHeader call.
338 if (holder()->GetNamedInterceptor()->non_masking()) {
339 DCHECK(!inline_followup);
340 JSObject* last = *holder();
341 PrototypeIterator iter(isolate(), last);
342 while (!iter.IsAtEnd()) {
343 lost_holder_register = true;
344 last = JSObject::cast(iter.GetCurrent());
347 auto last_handle = handle(last);
348 set_holder(last_handle);
350 Register reg = FrontendHeader(receiver(), it->name(), &miss, RETURN_HOLDER);
351 // Reset the holder so further calculations are correct.
352 set_holder(holder_orig);
353 if (lost_holder_register) {
354 if (*it->GetReceiver() == *holder()) {
357 // Reload lost holder register.
358 auto cell = isolate()->factory()->NewWeakCell(holder());
359 __ LoadWeakValue(reg, cell, &miss);
362 FrontendFooter(it->name(), &miss);
363 InterceptorVectorSlotPop(reg);
364 if (inline_followup) {
365 // TODO(368): Compile in the whole chain: all the interceptors in
366 // prototypes and ultimate answer.
367 GenerateLoadInterceptorWithFollowup(it, reg);
369 GenerateLoadInterceptor(reg);
371 return GetCode(kind(), Code::FAST, it->name());
375 void NamedLoadHandlerCompiler::GenerateLoadPostInterceptor(
376 LookupIterator* it, Register interceptor_reg) {
377 Handle<JSObject> real_named_property_holder(it->GetHolder<JSObject>());
379 Handle<Map> holder_map(holder()->map());
381 set_holder(real_named_property_holder);
384 InterceptorVectorSlotPush(interceptor_reg);
386 FrontendHeader(interceptor_reg, it->name(), &miss, RETURN_HOLDER);
387 FrontendFooter(it->name(), &miss);
388 // We discard the vector and slot now because we don't miss below this point.
389 InterceptorVectorSlotPop(reg, DISCARD);
391 switch (it->state()) {
392 case LookupIterator::ACCESS_CHECK:
393 case LookupIterator::INTERCEPTOR:
394 case LookupIterator::JSPROXY:
395 case LookupIterator::NOT_FOUND:
396 case LookupIterator::INTEGER_INDEXED_EXOTIC:
397 case LookupIterator::TRANSITION:
399 case LookupIterator::DATA: {
400 DCHECK_EQ(DATA, it->property_details().type());
401 __ Move(receiver(), reg);
402 LoadFieldStub stub(isolate(), it->GetFieldIndex());
403 GenerateTailCall(masm(), stub.GetCode());
406 case LookupIterator::ACCESSOR:
407 if (it->GetAccessors()->IsExecutableAccessorInfo()) {
408 Handle<ExecutableAccessorInfo> info =
409 Handle<ExecutableAccessorInfo>::cast(it->GetAccessors());
410 DCHECK_NOT_NULL(info->getter());
411 GenerateLoadCallback(reg, info);
413 auto function = handle(JSFunction::cast(
414 AccessorPair::cast(*it->GetAccessors())->getter()));
415 CallOptimization call_optimization(function);
416 GenerateApiAccessorCall(masm(), call_optimization, holder_map,
417 receiver(), scratch2(), false, no_reg, reg,
418 it->GetAccessorIndex());
424 Handle<Code> NamedLoadHandlerCompiler::CompileLoadViaGetter(
425 Handle<Name> name, int accessor_index, int expected_arguments) {
426 Register holder = Frontend(name);
427 GenerateLoadViaGetter(masm(), map(), receiver(), holder, accessor_index,
428 expected_arguments, scratch2());
429 return GetCode(kind(), Code::FAST, name);
433 // TODO(verwaest): Cleanup. holder() is actually the receiver.
434 Handle<Code> NamedStoreHandlerCompiler::CompileStoreTransition(
435 Handle<Map> transition, Handle<Name> name) {
438 // Check that we are allowed to write this.
439 bool is_nonexistent = holder()->map() == transition->GetBackPointer();
440 if (is_nonexistent) {
441 // Find the top object.
442 Handle<JSObject> last;
443 PrototypeIterator::WhereToEnd end =
444 name->IsPrivate() ? PrototypeIterator::END_AT_NON_HIDDEN
445 : PrototypeIterator::END_AT_NULL;
446 PrototypeIterator iter(isolate(), holder());
447 while (!iter.IsAtEnd(end)) {
448 last = Handle<JSObject>::cast(PrototypeIterator::GetCurrent(iter));
451 if (!last.is_null()) set_holder(last);
452 NonexistentFrontendHeader(name, &miss, scratch1(), scratch2());
454 FrontendHeader(receiver(), name, &miss, DONT_RETURN_ANYTHING);
455 DCHECK(holder()->HasFastProperties());
458 int descriptor = transition->LastAdded();
459 Handle<DescriptorArray> descriptors(transition->instance_descriptors());
460 PropertyDetails details = descriptors->GetDetails(descriptor);
461 Representation representation = details.representation();
462 DCHECK(!representation.IsNone());
464 // Stub is never generated for objects that require access checks.
465 DCHECK(!transition->is_access_check_needed());
467 // Call to respective StoreTransitionStub.
468 if (details.type() == DATA_CONSTANT) {
469 GenerateRestoreMap(transition, scratch2(), &miss);
470 DCHECK(descriptors->GetValue(descriptor)->IsJSFunction());
471 Register map_reg = StoreTransitionDescriptor::MapRegister();
472 GenerateConstantCheck(map_reg, descriptor, value(), scratch2(), &miss);
473 GenerateRestoreName(name);
474 StoreTransitionStub stub(isolate());
475 GenerateTailCall(masm(), stub.GetCode());
478 if (representation.IsHeapObject()) {
479 GenerateFieldTypeChecks(descriptors->GetFieldType(descriptor), value(),
482 StoreTransitionStub::StoreMode store_mode =
483 Map::cast(transition->GetBackPointer())->unused_property_fields() == 0
484 ? StoreTransitionStub::ExtendStorageAndStoreMapAndValue
485 : StoreTransitionStub::StoreMapAndValue;
487 GenerateRestoreMap(transition, scratch2(), &miss);
488 GenerateRestoreName(name);
489 StoreTransitionStub stub(isolate(),
490 FieldIndex::ForDescriptor(*transition, descriptor),
491 representation, store_mode);
492 GenerateTailCall(masm(), stub.GetCode());
495 GenerateRestoreName(&miss, name);
496 TailCallBuiltin(masm(), MissBuiltin(kind()));
498 return GetCode(kind(), Code::FAST, name);
502 Handle<Code> NamedStoreHandlerCompiler::CompileStoreField(LookupIterator* it) {
504 DCHECK(it->representation().IsHeapObject());
506 GenerateFieldTypeChecks(*it->GetFieldType(), value(), &miss);
507 StoreFieldStub stub(isolate(), it->GetFieldIndex(), it->representation());
508 GenerateTailCall(masm(), stub.GetCode());
511 TailCallBuiltin(masm(), MissBuiltin(kind()));
512 return GetCode(kind(), Code::FAST, it->name());
516 Handle<Code> NamedStoreHandlerCompiler::CompileStoreViaSetter(
517 Handle<JSObject> object, Handle<Name> name, int accessor_index,
518 int expected_arguments) {
519 Register holder = Frontend(name);
520 GenerateStoreViaSetter(masm(), map(), receiver(), holder, accessor_index,
521 expected_arguments, scratch2());
523 return GetCode(kind(), Code::FAST, name);
527 Handle<Code> NamedStoreHandlerCompiler::CompileStoreCallback(
528 Handle<JSObject> object, Handle<Name> name,
529 const CallOptimization& call_optimization, int accessor_index) {
530 Register holder = Frontend(name);
531 GenerateApiAccessorCall(masm(), call_optimization, handle(object->map()),
532 receiver(), scratch2(), true, value(), holder,
534 return GetCode(kind(), Code::FAST, name);
541 void ElementHandlerCompiler::CompileElementHandlers(
542 MapHandleList* receiver_maps, CodeHandleList* handlers,
543 LanguageMode language_mode) {
544 for (int i = 0; i < receiver_maps->length(); ++i) {
545 Handle<Map> receiver_map = receiver_maps->at(i);
546 Handle<Code> cached_stub;
548 if (receiver_map->IsStringMap()) {
549 cached_stub = LoadIndexedStringStub(isolate()).GetCode();
550 } else if (receiver_map->instance_type() < FIRST_JS_RECEIVER_TYPE) {
551 cached_stub = is_strong(language_mode)
552 ? isolate()->builtins()->KeyedLoadIC_Slow_Strong()
553 : isolate()->builtins()->KeyedLoadIC_Slow();
555 bool is_js_array = receiver_map->instance_type() == JS_ARRAY_TYPE;
556 ElementsKind elements_kind = receiver_map->elements_kind();
558 // No need to check for an elements-free prototype chain here, the
559 // generated stub code needs to check that dynamically anyway.
560 bool convert_hole_to_undefined =
561 (is_js_array && elements_kind == FAST_HOLEY_ELEMENTS &&
563 isolate()->get_initial_js_array_map(elements_kind)) &&
564 !is_strong(language_mode);
566 if (receiver_map->has_indexed_interceptor()) {
567 cached_stub = LoadIndexedInterceptorStub(isolate()).GetCode();
568 } else if (IsSloppyArgumentsElements(elements_kind)) {
569 cached_stub = KeyedLoadSloppyArgumentsStub(isolate()).GetCode();
570 } else if (IsFastElementsKind(elements_kind) ||
571 IsExternalArrayElementsKind(elements_kind) ||
572 IsFixedTypedArrayElementsKind(elements_kind)) {
573 cached_stub = LoadFastElementStub(isolate(), is_js_array, elements_kind,
574 convert_hole_to_undefined).GetCode();
576 DCHECK(elements_kind == DICTIONARY_ELEMENTS);
578 LoadICState(is_strong(language_mode) ? LoadICState::kStrongModeState
580 cached_stub = LoadDictionaryElementStub(isolate(), state).GetCode();
584 handlers->Add(cached_stub);
587 } // namespace internal