1 // Copyright 2012 the V8 project authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file.
8 #if V8_TARGET_ARCH_MIPS64
10 #include "src/codegen.h"
11 #include "src/ic/ic.h"
12 #include "src/ic/ic-compiler.h"
13 #include "src/ic/stub-cache.h"
19 // ----------------------------------------------------------------------------
20 // Static IC stub generators.
23 #define __ ACCESS_MASM(masm)
26 static void GenerateGlobalInstanceTypeCheck(MacroAssembler* masm, Register type,
27 Label* global_object) {
29 // type: holds the receiver instance type on entry.
30 __ Branch(global_object, eq, type, Operand(JS_GLOBAL_OBJECT_TYPE));
31 __ Branch(global_object, eq, type, Operand(JS_BUILTINS_OBJECT_TYPE));
32 __ Branch(global_object, eq, type, Operand(JS_GLOBAL_PROXY_TYPE));
36 // Helper function used from LoadIC GenerateNormal.
38 // elements: Property dictionary. It is not clobbered if a jump to the miss
40 // name: Property name. It is not clobbered if a jump to the miss label is
42 // result: Register for the result. It is only updated if a jump to the miss
43 // label is not done. Can be the same as elements or name clobbering
44 // one of these in the case of not jumping to the miss label.
45 // The two scratch registers need to be different from elements, name and
47 // The generated code assumes that the receiver has slow properties,
48 // is not a global object and does not have interceptors.
49 // The address returned from GenerateStringDictionaryProbes() in scratch2
51 static void GenerateDictionaryLoad(MacroAssembler* masm, Label* miss,
52 Register elements, Register name,
53 Register result, Register scratch1,
55 // Main use of the scratch registers.
56 // scratch1: Used as temporary and to hold the capacity of the property
58 // scratch2: Used as temporary.
61 // Probe the dictionary.
62 NameDictionaryLookupStub::GeneratePositiveLookup(masm, miss, &done, elements,
63 name, scratch1, scratch2);
65 // If probing finds an entry check that the value is a normal
67 __ bind(&done); // scratch2 == elements + 4 * index.
68 const int kElementsStartOffset =
69 NameDictionary::kHeaderSize +
70 NameDictionary::kElementsStartIndex * kPointerSize;
71 const int kDetailsOffset = kElementsStartOffset + 2 * kPointerSize;
72 __ ld(scratch1, FieldMemOperand(scratch2, kDetailsOffset));
74 Operand(Smi::FromInt(PropertyDetails::TypeField::kMask)));
75 __ Branch(miss, ne, at, Operand(zero_reg));
77 // Get the value at the masked, scaled index and return.
79 FieldMemOperand(scratch2, kElementsStartOffset + 1 * kPointerSize));
83 // Helper function used from StoreIC::GenerateNormal.
85 // elements: Property dictionary. It is not clobbered if a jump to the miss
87 // name: Property name. It is not clobbered if a jump to the miss label is
89 // value: The value to store.
90 // The two scratch registers need to be different from elements, name and
92 // The generated code assumes that the receiver has slow properties,
93 // is not a global object and does not have interceptors.
94 // The address returned from GenerateStringDictionaryProbes() in scratch2
96 static void GenerateDictionaryStore(MacroAssembler* masm, Label* miss,
97 Register elements, Register name,
98 Register value, Register scratch1,
100 // Main use of the scratch registers.
101 // scratch1: Used as temporary and to hold the capacity of the property
103 // scratch2: Used as temporary.
106 // Probe the dictionary.
107 NameDictionaryLookupStub::GeneratePositiveLookup(masm, miss, &done, elements,
108 name, scratch1, scratch2);
110 // If probing finds an entry in the dictionary check that the value
111 // is a normal property that is not read only.
112 __ bind(&done); // scratch2 == elements + 4 * index.
113 const int kElementsStartOffset =
114 NameDictionary::kHeaderSize +
115 NameDictionary::kElementsStartIndex * kPointerSize;
116 const int kDetailsOffset = kElementsStartOffset + 2 * kPointerSize;
117 const int kTypeAndReadOnlyMask =
118 (PropertyDetails::TypeField::kMask |
119 PropertyDetails::AttributesField::encode(READ_ONLY));
120 __ ld(scratch1, FieldMemOperand(scratch2, kDetailsOffset));
121 __ And(at, scratch1, Operand(Smi::FromInt(kTypeAndReadOnlyMask)));
122 __ Branch(miss, ne, at, Operand(zero_reg));
124 // Store the value at the masked, scaled index and return.
125 const int kValueOffset = kElementsStartOffset + kPointerSize;
126 __ Daddu(scratch2, scratch2, Operand(kValueOffset - kHeapObjectTag));
127 __ sd(value, MemOperand(scratch2));
129 // Update the write barrier. Make sure not to clobber the value.
130 __ mov(scratch1, value);
131 __ RecordWrite(elements, scratch2, scratch1, kRAHasNotBeenSaved,
136 // Checks the receiver for special cases (value type, slow case bits).
137 // Falls through for regular JS object.
138 static void GenerateKeyedLoadReceiverCheck(MacroAssembler* masm,
139 Register receiver, Register map,
141 int interceptor_bit, Label* slow) {
142 // Check that the object isn't a smi.
143 __ JumpIfSmi(receiver, slow);
144 // Get the map of the receiver.
145 __ ld(map, FieldMemOperand(receiver, HeapObject::kMapOffset));
147 __ lbu(scratch, FieldMemOperand(map, Map::kBitFieldOffset));
149 Operand((1 << Map::kIsAccessCheckNeeded) | (1 << interceptor_bit)));
150 __ Branch(slow, ne, at, Operand(zero_reg));
151 // Check that the object is some kind of JS object EXCEPT JS Value type.
152 // In the case that the object is a value-wrapper object,
153 // we enter the runtime system to make sure that indexing into string
154 // objects work as intended.
155 DCHECK(JS_OBJECT_TYPE > JS_VALUE_TYPE);
156 __ lbu(scratch, FieldMemOperand(map, Map::kInstanceTypeOffset));
157 __ Branch(slow, lt, scratch, Operand(JS_OBJECT_TYPE));
161 // Loads an indexed element from a fast case array.
162 // If not_fast_array is NULL, doesn't perform the elements map check.
163 static void GenerateFastArrayLoad(MacroAssembler* masm, Register receiver,
164 Register key, Register elements,
165 Register scratch1, Register scratch2,
166 Register result, Label* not_fast_array,
167 Label* out_of_range) {
170 // receiver - holds the receiver on entry.
171 // Unchanged unless 'result' is the same register.
173 // key - holds the smi key on entry.
174 // Unchanged unless 'result' is the same register.
176 // elements - holds the elements of the receiver on exit.
178 // result - holds the result on exit if the load succeeded.
179 // Allowed to be the the same as 'receiver' or 'key'.
180 // Unchanged on bailout so 'receiver' and 'key' can be safely
181 // used by further computation.
183 // Scratch registers:
185 // scratch1 - used to hold elements map and elements length.
186 // Holds the elements map if not_fast_array branch is taken.
188 // scratch2 - used to hold the loaded value.
190 __ ld(elements, FieldMemOperand(receiver, JSObject::kElementsOffset));
191 if (not_fast_array != NULL) {
192 // Check that the object is in fast mode (not dictionary).
193 __ ld(scratch1, FieldMemOperand(elements, HeapObject::kMapOffset));
194 __ LoadRoot(at, Heap::kFixedArrayMapRootIndex);
195 __ Branch(not_fast_array, ne, scratch1, Operand(at));
197 __ AssertFastElements(elements);
200 // Check that the key (index) is within bounds.
201 __ ld(scratch1, FieldMemOperand(elements, FixedArray::kLengthOffset));
202 __ Branch(out_of_range, hs, key, Operand(scratch1));
204 // Fast case: Do the load.
205 __ Daddu(scratch1, elements,
206 Operand(FixedArray::kHeaderSize - kHeapObjectTag));
208 STATIC_ASSERT(kSmiTag == 0 && kSmiTagSize < kPointerSizeLog2);
209 __ SmiScale(at, key, kPointerSizeLog2);
210 __ daddu(at, at, scratch1);
211 __ ld(scratch2, MemOperand(at));
213 __ LoadRoot(at, Heap::kTheHoleValueRootIndex);
214 // In case the loaded value is the_hole we have to consult GetProperty
215 // to ensure the prototype chain is searched.
216 __ Branch(out_of_range, eq, scratch2, Operand(at));
217 __ mov(result, scratch2);
221 // Checks whether a key is an array index string or a unique name.
222 // Falls through if a key is a unique name.
223 static void GenerateKeyNameCheck(MacroAssembler* masm, Register key,
224 Register map, Register hash,
225 Label* index_string, Label* not_unique) {
226 // The key is not a smi.
229 __ GetObjectType(key, map, hash);
230 __ Branch(not_unique, hi, hash, Operand(LAST_UNIQUE_NAME_TYPE));
231 STATIC_ASSERT(LAST_UNIQUE_NAME_TYPE == FIRST_NONSTRING_TYPE);
232 __ Branch(&unique, eq, hash, Operand(LAST_UNIQUE_NAME_TYPE));
234 // Is the string an array index, with cached numeric value?
235 __ lwu(hash, FieldMemOperand(key, Name::kHashFieldOffset));
236 __ And(at, hash, Operand(Name::kContainsCachedArrayIndexMask));
237 __ Branch(index_string, eq, at, Operand(zero_reg));
239 // Is the string internalized? We know it's a string, so a single
240 // bit test is enough.
242 __ lbu(hash, FieldMemOperand(map, Map::kInstanceTypeOffset));
243 STATIC_ASSERT(kInternalizedTag == 0);
244 __ And(at, hash, Operand(kIsNotInternalizedMask));
245 __ Branch(not_unique, ne, at, Operand(zero_reg));
251 void LoadIC::GenerateNormal(MacroAssembler* masm) {
252 Register dictionary = a0;
253 DCHECK(!dictionary.is(LoadDescriptor::ReceiverRegister()));
254 DCHECK(!dictionary.is(LoadDescriptor::NameRegister()));
257 __ ld(dictionary, FieldMemOperand(LoadDescriptor::ReceiverRegister(),
258 JSObject::kPropertiesOffset));
259 GenerateDictionaryLoad(masm, &slow, dictionary,
260 LoadDescriptor::NameRegister(), v0, a3, a4);
263 // Dictionary load failed, go slow (but don't miss).
265 GenerateRuntimeGetProperty(masm);
269 // A register that isn't one of the parameters to the load ic.
270 static const Register LoadIC_TempRegister() { return a3; }
273 void LoadIC::GenerateMiss(MacroAssembler* masm) {
274 // The return address is on the stack.
275 Isolate* isolate = masm->isolate();
277 __ IncrementCounter(isolate->counters()->keyed_load_miss(), 1, a3, a4);
279 __ mov(LoadIC_TempRegister(), LoadDescriptor::ReceiverRegister());
280 __ Push(LoadIC_TempRegister(), LoadDescriptor::NameRegister());
282 // Perform tail call to the entry.
283 ExternalReference ref = ExternalReference(IC_Utility(kLoadIC_Miss), isolate);
284 __ TailCallExternalReference(ref, 2, 1);
288 void LoadIC::GenerateRuntimeGetProperty(MacroAssembler* masm) {
289 // The return address is in ra.
291 __ mov(LoadIC_TempRegister(), LoadDescriptor::ReceiverRegister());
292 __ Push(LoadIC_TempRegister(), LoadDescriptor::NameRegister());
294 __ TailCallRuntime(Runtime::kGetProperty, 2, 1);
298 static MemOperand GenerateMappedArgumentsLookup(
299 MacroAssembler* masm, Register object, Register key, Register scratch1,
300 Register scratch2, Register scratch3, Label* unmapped_case,
302 Heap* heap = masm->isolate()->heap();
304 // Check that the receiver is a JSObject. Because of the map check
305 // later, we do not need to check for interceptors or whether it
306 // requires access checks.
307 __ JumpIfSmi(object, slow_case);
308 // Check that the object is some kind of JSObject.
309 __ GetObjectType(object, scratch1, scratch2);
310 __ Branch(slow_case, lt, scratch2, Operand(FIRST_JS_RECEIVER_TYPE));
312 // Check that the key is a positive smi.
313 __ NonNegativeSmiTst(key, scratch1);
314 __ Branch(slow_case, ne, scratch1, Operand(zero_reg));
316 // Load the elements into scratch1 and check its map.
317 Handle<Map> arguments_map(heap->sloppy_arguments_elements_map());
318 __ ld(scratch1, FieldMemOperand(object, JSObject::kElementsOffset));
319 __ CheckMap(scratch1, scratch2, arguments_map, slow_case, DONT_DO_SMI_CHECK);
320 // Check if element is in the range of mapped arguments. If not, jump
321 // to the unmapped lookup with the parameter map in scratch1.
322 __ ld(scratch2, FieldMemOperand(scratch1, FixedArray::kLengthOffset));
323 __ Dsubu(scratch2, scratch2, Operand(Smi::FromInt(2)));
324 __ Branch(unmapped_case, Ugreater_equal, key, Operand(scratch2));
326 // Load element index and check whether it is the hole.
328 FixedArray::kHeaderSize + 2 * kPointerSize - kHeapObjectTag;
330 __ SmiUntag(scratch3, key);
331 __ dsll(scratch3, scratch3, kPointerSizeLog2);
332 __ Daddu(scratch3, scratch3, Operand(kOffset));
334 __ Daddu(scratch2, scratch1, scratch3);
335 __ ld(scratch2, MemOperand(scratch2));
336 __ LoadRoot(scratch3, Heap::kTheHoleValueRootIndex);
337 __ Branch(unmapped_case, eq, scratch2, Operand(scratch3));
339 // Load value from context and return it. We can reuse scratch1 because
340 // we do not jump to the unmapped lookup (which requires the parameter
342 __ ld(scratch1, FieldMemOperand(scratch1, FixedArray::kHeaderSize));
343 __ SmiUntag(scratch3, scratch2);
344 __ dsll(scratch3, scratch3, kPointerSizeLog2);
345 __ Daddu(scratch3, scratch3, Operand(Context::kHeaderSize - kHeapObjectTag));
346 __ Daddu(scratch2, scratch1, scratch3);
347 return MemOperand(scratch2);
351 static MemOperand GenerateUnmappedArgumentsLookup(MacroAssembler* masm,
353 Register parameter_map,
356 // Element is in arguments backing store, which is referenced by the
357 // second element of the parameter_map. The parameter_map register
358 // must be loaded with the parameter map of the arguments object and is
360 const int kBackingStoreOffset = FixedArray::kHeaderSize + kPointerSize;
361 Register backing_store = parameter_map;
362 __ ld(backing_store, FieldMemOperand(parameter_map, kBackingStoreOffset));
363 __ CheckMap(backing_store, scratch, Heap::kFixedArrayMapRootIndex, slow_case,
365 __ ld(scratch, FieldMemOperand(backing_store, FixedArray::kLengthOffset));
366 __ Branch(slow_case, Ugreater_equal, key, Operand(scratch));
367 __ SmiUntag(scratch, key);
368 __ dsll(scratch, scratch, kPointerSizeLog2);
369 __ Daddu(scratch, scratch, Operand(FixedArray::kHeaderSize - kHeapObjectTag));
370 __ Daddu(scratch, backing_store, scratch);
371 return MemOperand(scratch);
375 void KeyedStoreIC::GenerateSloppyArguments(MacroAssembler* masm) {
376 Register receiver = StoreDescriptor::ReceiverRegister();
377 Register key = StoreDescriptor::NameRegister();
378 Register value = StoreDescriptor::ValueRegister();
379 DCHECK(value.is(a0));
382 // Store address is returned in register (of MemOperand) mapped_location.
383 MemOperand mapped_location = GenerateMappedArgumentsLookup(
384 masm, receiver, key, a3, a4, a5, ¬in, &slow);
385 __ sd(value, mapped_location);
387 DCHECK_EQ(mapped_location.offset(), 0);
388 __ RecordWrite(a3, mapped_location.rm(), t1, kRAHasNotBeenSaved,
390 __ Ret(USE_DELAY_SLOT);
391 __ mov(v0, value); // (In delay slot) return the value stored in v0.
393 // The unmapped lookup expects that the parameter map is in a3.
394 // Store address is returned in register (of MemOperand) unmapped_location.
395 MemOperand unmapped_location =
396 GenerateUnmappedArgumentsLookup(masm, key, a3, a4, &slow);
397 __ sd(value, unmapped_location);
399 DCHECK_EQ(unmapped_location.offset(), 0);
400 __ RecordWrite(a3, unmapped_location.rm(), t1, kRAHasNotBeenSaved,
402 __ Ret(USE_DELAY_SLOT);
403 __ mov(v0, a0); // (In delay slot) return the value stored in v0.
409 void KeyedLoadIC::GenerateMiss(MacroAssembler* masm) {
410 // The return address is in ra.
411 Isolate* isolate = masm->isolate();
413 __ IncrementCounter(isolate->counters()->keyed_load_miss(), 1, a3, a4);
415 __ Push(LoadDescriptor::ReceiverRegister(), LoadDescriptor::NameRegister());
417 // Perform tail call to the entry.
418 ExternalReference ref =
419 ExternalReference(IC_Utility(kKeyedLoadIC_Miss), isolate);
421 __ TailCallExternalReference(ref, 2, 1);
425 void KeyedLoadIC::GenerateRuntimeGetProperty(MacroAssembler* masm) {
426 // The return address is in ra.
428 __ Push(LoadDescriptor::ReceiverRegister(), LoadDescriptor::NameRegister());
430 __ TailCallRuntime(Runtime::kKeyedGetProperty, 2, 1);
434 void KeyedLoadIC::GenerateGeneric(MacroAssembler* masm) {
435 // The return address is in ra.
436 Label slow, check_name, index_smi, index_name, property_array_property;
437 Label probe_dictionary, check_number_dictionary;
439 Register key = LoadDescriptor::NameRegister();
440 Register receiver = LoadDescriptor::ReceiverRegister();
442 DCHECK(receiver.is(a1));
444 Isolate* isolate = masm->isolate();
446 // Check that the key is a smi.
447 __ JumpIfNotSmi(key, &check_name);
449 // Now the key is known to be a smi. This place is also jumped to from below
450 // where a numeric string is converted to a smi.
452 GenerateKeyedLoadReceiverCheck(masm, receiver, a0, a3,
453 Map::kHasIndexedInterceptor, &slow);
455 // Check the receiver's map to see if it has fast elements.
456 __ CheckFastElements(a0, a3, &check_number_dictionary);
458 GenerateFastArrayLoad(masm, receiver, key, a0, a3, a4, v0, NULL, &slow);
459 __ IncrementCounter(isolate->counters()->keyed_load_generic_smi(), 1, a4, a3);
462 __ bind(&check_number_dictionary);
463 __ ld(a4, FieldMemOperand(receiver, JSObject::kElementsOffset));
464 __ ld(a3, FieldMemOperand(a4, JSObject::kMapOffset));
466 // Check whether the elements is a number dictionary.
469 __ LoadRoot(at, Heap::kHashTableMapRootIndex);
470 __ Branch(&slow, ne, a3, Operand(at));
471 __ dsra32(a0, key, 0);
472 __ LoadFromNumberDictionary(&slow, a4, key, v0, a0, a3, a5);
475 // Slow case, key and receiver still in a2 and a1.
477 __ IncrementCounter(isolate->counters()->keyed_load_generic_slow(), 1, a4,
479 GenerateRuntimeGetProperty(masm);
481 __ bind(&check_name);
482 GenerateKeyNameCheck(masm, key, a0, a3, &index_name, &slow);
484 GenerateKeyedLoadReceiverCheck(masm, receiver, a0, a3,
485 Map::kHasNamedInterceptor, &slow);
488 // If the receiver is a fast-case object, check the keyed lookup
489 // cache. Otherwise probe the dictionary.
490 __ ld(a3, FieldMemOperand(receiver, JSObject::kPropertiesOffset));
491 __ ld(a4, FieldMemOperand(a3, HeapObject::kMapOffset));
492 __ LoadRoot(at, Heap::kHashTableMapRootIndex);
493 __ Branch(&probe_dictionary, eq, a4, Operand(at));
495 // Load the map of the receiver, compute the keyed lookup cache hash
496 // based on 32 bits of the map pointer and the name hash.
497 __ ld(a0, FieldMemOperand(receiver, HeapObject::kMapOffset));
498 __ dsll32(a3, a0, 0);
499 __ dsrl32(a3, a3, 0);
500 __ dsra(a3, a3, KeyedLookupCache::kMapHashShift);
501 __ lwu(a4, FieldMemOperand(key, Name::kHashFieldOffset));
502 __ dsra(at, a4, Name::kHashShift);
504 int mask = KeyedLookupCache::kCapacityMask & KeyedLookupCache::kHashMask;
505 __ And(a3, a3, Operand(mask));
507 // Load the key (consisting of map and unique name) from the cache and
509 Label load_in_object_property;
510 static const int kEntriesPerBucket = KeyedLookupCache::kEntriesPerBucket;
511 Label hit_on_nth_entry[kEntriesPerBucket];
512 ExternalReference cache_keys =
513 ExternalReference::keyed_lookup_cache_keys(isolate);
514 __ li(a4, Operand(cache_keys));
515 __ dsll(at, a3, kPointerSizeLog2 + 1);
516 __ daddu(a4, a4, at);
518 for (int i = 0; i < kEntriesPerBucket - 1; i++) {
519 Label try_next_entry;
520 __ ld(a5, MemOperand(a4, kPointerSize * i * 2));
521 __ Branch(&try_next_entry, ne, a0, Operand(a5));
522 __ ld(a5, MemOperand(a4, kPointerSize * (i * 2 + 1)));
523 __ Branch(&hit_on_nth_entry[i], eq, key, Operand(a5));
524 __ bind(&try_next_entry);
527 __ ld(a5, MemOperand(a4, kPointerSize * (kEntriesPerBucket - 1) * 2));
528 __ Branch(&slow, ne, a0, Operand(a5));
529 __ ld(a5, MemOperand(a4, kPointerSize * ((kEntriesPerBucket - 1) * 2 + 1)));
530 __ Branch(&slow, ne, key, Operand(a5));
533 // a0 : receiver's map
534 // a3 : lookup cache index
535 ExternalReference cache_field_offsets =
536 ExternalReference::keyed_lookup_cache_field_offsets(isolate);
539 for (int i = kEntriesPerBucket - 1; i >= 0; i--) {
540 __ bind(&hit_on_nth_entry[i]);
541 __ li(a4, Operand(cache_field_offsets));
543 // TODO(yy) This data structure does NOT follow natural pointer size.
544 __ dsll(at, a3, kPointerSizeLog2 - 1);
545 __ daddu(at, a4, at);
546 __ lwu(a5, MemOperand(at, kPointerSize / 2 * i));
548 __ lbu(a6, FieldMemOperand(a0, Map::kInObjectPropertiesOffset));
549 __ Dsubu(a5, a5, a6);
550 __ Branch(&property_array_property, ge, a5, Operand(zero_reg));
552 __ Branch(&load_in_object_property);
556 // Load in-object property.
557 __ bind(&load_in_object_property);
558 __ lbu(a6, FieldMemOperand(a0, Map::kInstanceSizeOffset));
559 // Index from start of object.
560 __ daddu(a6, a6, a5);
561 // Remove the heap tag.
562 __ Dsubu(receiver, receiver, Operand(kHeapObjectTag));
563 __ dsll(at, a6, kPointerSizeLog2);
564 __ daddu(at, receiver, at);
565 __ ld(v0, MemOperand(at));
566 __ IncrementCounter(isolate->counters()->keyed_load_generic_lookup_cache(), 1,
570 // Load property array property.
571 __ bind(&property_array_property);
572 __ ld(receiver, FieldMemOperand(receiver, JSObject::kPropertiesOffset));
573 __ Daddu(receiver, receiver, FixedArray::kHeaderSize - kHeapObjectTag);
574 __ dsll(v0, a5, kPointerSizeLog2);
575 __ Daddu(v0, v0, a1);
576 __ ld(v0, MemOperand(v0));
577 __ IncrementCounter(isolate->counters()->keyed_load_generic_lookup_cache(), 1,
582 // Do a quick inline probe of the receiver's dictionary, if it
584 __ bind(&probe_dictionary);
586 __ ld(a0, FieldMemOperand(receiver, HeapObject::kMapOffset));
587 __ lbu(a0, FieldMemOperand(a0, Map::kInstanceTypeOffset));
588 GenerateGlobalInstanceTypeCheck(masm, a0, &slow);
589 // Load the property to v0.
590 GenerateDictionaryLoad(masm, &slow, a3, key, v0, a5, a4);
591 __ IncrementCounter(isolate->counters()->keyed_load_generic_symbol(), 1, a4,
595 __ bind(&index_name);
596 __ IndexFromHash(a3, key);
597 // Now jump to the place where smi keys are handled.
598 __ Branch(&index_smi);
602 static void KeyedStoreGenerateMegamorphicHelper(
603 MacroAssembler* masm, Label* fast_object, Label* fast_double, Label* slow,
604 KeyedStoreCheckMap check_map, KeyedStoreIncrementLength increment_length,
605 Register value, Register key, Register receiver, Register receiver_map,
606 Register elements_map, Register elements) {
607 Label transition_smi_elements;
608 Label finish_object_store, non_double_value, transition_double_elements;
609 Label fast_double_without_map_check;
611 // Fast case: Do the store, could be either Object or double.
612 __ bind(fast_object);
613 Register scratch_value = a4;
614 Register address = a5;
615 if (check_map == kCheckMap) {
616 __ ld(elements_map, FieldMemOperand(elements, HeapObject::kMapOffset));
617 __ Branch(fast_double, ne, elements_map,
618 Operand(masm->isolate()->factory()->fixed_array_map()));
621 // HOLECHECK: guards "A[i] = V"
622 // We have to go to the runtime if the current value is the hole because
623 // there may be a callback on the element.
624 Label holecheck_passed1;
625 __ Daddu(address, elements, FixedArray::kHeaderSize - kHeapObjectTag);
626 __ SmiScale(at, key, kPointerSizeLog2);
627 __ daddu(address, address, at);
628 __ ld(scratch_value, MemOperand(address));
630 __ Branch(&holecheck_passed1, ne, scratch_value,
631 Operand(masm->isolate()->factory()->the_hole_value()));
632 __ JumpIfDictionaryInPrototypeChain(receiver, elements_map, scratch_value,
635 __ bind(&holecheck_passed1);
637 // Smi stores don't require further checks.
639 __ JumpIfNotSmi(value, &non_smi_value);
641 if (increment_length == kIncrementLength) {
642 // Add 1 to receiver->length.
643 __ Daddu(scratch_value, key, Operand(Smi::FromInt(1)));
644 __ sd(scratch_value, FieldMemOperand(receiver, JSArray::kLengthOffset));
646 // It's irrelevant whether array is smi-only or not when writing a smi.
647 __ Daddu(address, elements,
648 Operand(FixedArray::kHeaderSize - kHeapObjectTag));
649 __ SmiScale(scratch_value, key, kPointerSizeLog2);
650 __ Daddu(address, address, scratch_value);
651 __ sd(value, MemOperand(address));
654 __ bind(&non_smi_value);
655 // Escape to elements kind transition case.
656 __ CheckFastObjectElements(receiver_map, scratch_value,
657 &transition_smi_elements);
659 // Fast elements array, store the value to the elements backing store.
660 __ bind(&finish_object_store);
661 if (increment_length == kIncrementLength) {
662 // Add 1 to receiver->length.
663 __ Daddu(scratch_value, key, Operand(Smi::FromInt(1)));
664 __ sd(scratch_value, FieldMemOperand(receiver, JSArray::kLengthOffset));
666 __ Daddu(address, elements,
667 Operand(FixedArray::kHeaderSize - kHeapObjectTag));
668 __ SmiScale(scratch_value, key, kPointerSizeLog2);
669 __ Daddu(address, address, scratch_value);
670 __ sd(value, MemOperand(address));
671 // Update write barrier for the elements array address.
672 __ mov(scratch_value, value); // Preserve the value which is returned.
673 __ RecordWrite(elements, address, scratch_value, kRAHasNotBeenSaved,
674 kDontSaveFPRegs, EMIT_REMEMBERED_SET, OMIT_SMI_CHECK);
677 __ bind(fast_double);
678 if (check_map == kCheckMap) {
679 // Check for fast double array case. If this fails, call through to the
681 __ LoadRoot(at, Heap::kFixedDoubleArrayMapRootIndex);
682 __ Branch(slow, ne, elements_map, Operand(at));
685 // HOLECHECK: guards "A[i] double hole?"
686 // We have to see if the double version of the hole is present. If so
687 // go to the runtime.
688 __ Daddu(address, elements,
689 Operand(FixedDoubleArray::kHeaderSize + sizeof(kHoleNanLower32) -
691 __ SmiScale(at, key, kPointerSizeLog2);
692 __ daddu(address, address, at);
693 __ lw(scratch_value, MemOperand(address));
694 __ Branch(&fast_double_without_map_check, ne, scratch_value,
695 Operand(kHoleNanUpper32));
696 __ JumpIfDictionaryInPrototypeChain(receiver, elements_map, scratch_value,
699 __ bind(&fast_double_without_map_check);
700 __ StoreNumberToDoubleElements(value, key,
701 elements, // Overwritten.
702 a3, // Scratch regs...
703 a4, a5, &transition_double_elements);
704 if (increment_length == kIncrementLength) {
705 // Add 1 to receiver->length.
706 __ Daddu(scratch_value, key, Operand(Smi::FromInt(1)));
707 __ sd(scratch_value, FieldMemOperand(receiver, JSArray::kLengthOffset));
711 __ bind(&transition_smi_elements);
712 // Transition the array appropriately depending on the value type.
713 __ ld(a4, FieldMemOperand(value, HeapObject::kMapOffset));
714 __ LoadRoot(at, Heap::kHeapNumberMapRootIndex);
715 __ Branch(&non_double_value, ne, a4, Operand(at));
717 // Value is a double. Transition FAST_SMI_ELEMENTS ->
718 // FAST_DOUBLE_ELEMENTS and complete the store.
719 __ LoadTransitionedArrayMapConditional(
720 FAST_SMI_ELEMENTS, FAST_DOUBLE_ELEMENTS, receiver_map, a4, slow);
721 AllocationSiteMode mode =
722 AllocationSite::GetMode(FAST_SMI_ELEMENTS, FAST_DOUBLE_ELEMENTS);
723 ElementsTransitionGenerator::GenerateSmiToDouble(masm, receiver, key, value,
724 receiver_map, mode, slow);
725 __ ld(elements, FieldMemOperand(receiver, JSObject::kElementsOffset));
726 __ jmp(&fast_double_without_map_check);
728 __ bind(&non_double_value);
729 // Value is not a double, FAST_SMI_ELEMENTS -> FAST_ELEMENTS
730 __ LoadTransitionedArrayMapConditional(FAST_SMI_ELEMENTS, FAST_ELEMENTS,
731 receiver_map, a4, slow);
732 mode = AllocationSite::GetMode(FAST_SMI_ELEMENTS, FAST_ELEMENTS);
733 ElementsTransitionGenerator::GenerateMapChangeElementsTransition(
734 masm, receiver, key, value, receiver_map, mode, slow);
735 __ ld(elements, FieldMemOperand(receiver, JSObject::kElementsOffset));
736 __ jmp(&finish_object_store);
738 __ bind(&transition_double_elements);
739 // Elements are FAST_DOUBLE_ELEMENTS, but value is an Object that's not a
740 // HeapNumber. Make sure that the receiver is a Array with FAST_ELEMENTS and
741 // transition array from FAST_DOUBLE_ELEMENTS to FAST_ELEMENTS
742 __ LoadTransitionedArrayMapConditional(FAST_DOUBLE_ELEMENTS, FAST_ELEMENTS,
743 receiver_map, a4, slow);
744 mode = AllocationSite::GetMode(FAST_DOUBLE_ELEMENTS, FAST_ELEMENTS);
745 ElementsTransitionGenerator::GenerateDoubleToObject(
746 masm, receiver, key, value, receiver_map, mode, slow);
747 __ ld(elements, FieldMemOperand(receiver, JSObject::kElementsOffset));
748 __ jmp(&finish_object_store);
752 void KeyedStoreIC::GenerateMegamorphic(MacroAssembler* masm,
753 StrictMode strict_mode) {
754 // ---------- S t a t e --------------
758 // -- ra : return address
759 // -----------------------------------
760 Label slow, fast_object, fast_object_grow;
761 Label fast_double, fast_double_grow;
762 Label array, extra, check_if_double_array, maybe_name_key, miss;
765 Register value = StoreDescriptor::ValueRegister();
766 Register key = StoreDescriptor::NameRegister();
767 Register receiver = StoreDescriptor::ReceiverRegister();
768 DCHECK(value.is(a0));
769 Register receiver_map = a3;
770 Register elements_map = a6;
771 Register elements = a7; // Elements array of the receiver.
772 // a4 and a5 are used as general scratch registers.
774 // Check that the key is a smi.
775 __ JumpIfNotSmi(key, &maybe_name_key);
776 // Check that the object isn't a smi.
777 __ JumpIfSmi(receiver, &slow);
778 // Get the map of the object.
779 __ ld(receiver_map, FieldMemOperand(receiver, HeapObject::kMapOffset));
780 // Check that the receiver does not require access checks and is not observed.
781 // The generic stub does not perform map checks or handle observed objects.
782 __ lbu(a4, FieldMemOperand(receiver_map, Map::kBitFieldOffset));
784 Operand(1 << Map::kIsAccessCheckNeeded | 1 << Map::kIsObserved));
785 __ Branch(&slow, ne, a4, Operand(zero_reg));
786 // Check if the object is a JS array or not.
787 __ lbu(a4, FieldMemOperand(receiver_map, Map::kInstanceTypeOffset));
788 __ Branch(&array, eq, a4, Operand(JS_ARRAY_TYPE));
789 // Check that the object is some kind of JSObject.
790 __ Branch(&slow, lt, a4, Operand(FIRST_JS_OBJECT_TYPE));
792 // Object case: Check key against length in the elements array.
793 __ ld(elements, FieldMemOperand(receiver, JSObject::kElementsOffset));
794 // Check array bounds. Both the key and the length of FixedArray are smis.
795 __ ld(a4, FieldMemOperand(elements, FixedArray::kLengthOffset));
796 __ Branch(&fast_object, lo, key, Operand(a4));
798 // Slow case, handle jump to runtime.
800 // Entry registers are intact.
804 PropertyICCompiler::GenerateRuntimeSetProperty(masm, strict_mode);
805 // Never returns to here.
807 __ bind(&maybe_name_key);
808 __ ld(a4, FieldMemOperand(key, HeapObject::kMapOffset));
809 __ lb(a4, FieldMemOperand(a4, Map::kInstanceTypeOffset));
810 __ JumpIfNotUniqueNameInstanceType(a4, &slow);
811 Code::Flags flags = Code::RemoveTypeAndHolderFromFlags(
812 Code::ComputeHandlerFlags(Code::STORE_IC));
813 masm->isolate()->stub_cache()->GenerateProbe(masm, flags, false, receiver,
814 key, a3, a4, a5, a6);
818 // Extra capacity case: Check if there is extra capacity to
819 // perform the store and update the length. Used for adding one
820 // element to the array by writing to array[array.length].
822 // Condition code from comparing key and array length is still available.
823 // Only support writing to array[array.length].
824 __ Branch(&slow, ne, key, Operand(a4));
825 // Check for room in the elements backing store.
826 // Both the key and the length of FixedArray are smis.
827 __ ld(a4, FieldMemOperand(elements, FixedArray::kLengthOffset));
828 __ Branch(&slow, hs, key, Operand(a4));
829 __ ld(elements_map, FieldMemOperand(elements, HeapObject::kMapOffset));
830 __ Branch(&check_if_double_array, ne, elements_map,
831 Heap::kFixedArrayMapRootIndex);
833 __ jmp(&fast_object_grow);
835 __ bind(&check_if_double_array);
836 __ Branch(&slow, ne, elements_map, Heap::kFixedDoubleArrayMapRootIndex);
837 __ jmp(&fast_double_grow);
839 // Array case: Get the length and the elements array from the JS
840 // array. Check that the array is in fast mode (and writable); if it
841 // is the length is always a smi.
843 __ ld(elements, FieldMemOperand(receiver, JSObject::kElementsOffset));
845 // Check the key against the length in the array.
846 __ ld(a4, FieldMemOperand(receiver, JSArray::kLengthOffset));
847 __ Branch(&extra, hs, key, Operand(a4));
849 KeyedStoreGenerateMegamorphicHelper(
850 masm, &fast_object, &fast_double, &slow, kCheckMap, kDontIncrementLength,
851 value, key, receiver, receiver_map, elements_map, elements);
852 KeyedStoreGenerateMegamorphicHelper(masm, &fast_object_grow,
853 &fast_double_grow, &slow, kDontCheckMap,
854 kIncrementLength, value, key, receiver,
855 receiver_map, elements_map, elements);
862 void KeyedStoreIC::GenerateMiss(MacroAssembler* masm) {
863 // Push receiver, key and value for runtime call.
864 __ Push(StoreDescriptor::ReceiverRegister(), StoreDescriptor::NameRegister(),
865 StoreDescriptor::ValueRegister());
867 ExternalReference ref =
868 ExternalReference(IC_Utility(kKeyedStoreIC_Miss), masm->isolate());
869 __ TailCallExternalReference(ref, 3, 1);
873 void StoreIC::GenerateMegamorphic(MacroAssembler* masm) {
874 Register receiver = StoreDescriptor::ReceiverRegister();
875 Register name = StoreDescriptor::NameRegister();
876 DCHECK(receiver.is(a1));
878 DCHECK(StoreDescriptor::ValueRegister().is(a0));
880 // Get the receiver from the stack and probe the stub cache.
881 Code::Flags flags = Code::RemoveTypeAndHolderFromFlags(
882 Code::ComputeHandlerFlags(Code::STORE_IC));
883 masm->isolate()->stub_cache()->GenerateProbe(masm, flags, false, receiver,
884 name, a3, a4, a5, a6);
886 // Cache miss: Jump to runtime.
891 void StoreIC::GenerateMiss(MacroAssembler* masm) {
892 __ Push(StoreDescriptor::ReceiverRegister(), StoreDescriptor::NameRegister(),
893 StoreDescriptor::ValueRegister());
894 // Perform tail call to the entry.
895 ExternalReference ref =
896 ExternalReference(IC_Utility(kStoreIC_Miss), masm->isolate());
897 __ TailCallExternalReference(ref, 3, 1);
901 void StoreIC::GenerateNormal(MacroAssembler* masm) {
903 Register receiver = StoreDescriptor::ReceiverRegister();
904 Register name = StoreDescriptor::NameRegister();
905 Register value = StoreDescriptor::ValueRegister();
906 Register dictionary = a3;
907 DCHECK(!AreAliased(value, receiver, name, dictionary, a4, a5));
909 __ ld(dictionary, FieldMemOperand(receiver, JSObject::kPropertiesOffset));
911 GenerateDictionaryStore(masm, &miss, a3, name, value, a4, a5);
912 Counters* counters = masm->isolate()->counters();
913 __ IncrementCounter(counters->store_normal_hit(), 1, a4, a5);
917 __ IncrementCounter(counters->store_normal_miss(), 1, a4, a5);
925 Condition CompareIC::ComputeCondition(Token::Value op) {
927 case Token::EQ_STRICT:
945 bool CompareIC::HasInlinedSmiCode(Address address) {
946 // The address of the instruction following the call.
947 Address andi_instruction_address =
948 address + Assembler::kCallTargetAddressOffset;
950 // If the instruction following the call is not a andi at, rx, #yyy, nothing
952 Instr instr = Assembler::instr_at(andi_instruction_address);
953 return Assembler::IsAndImmediate(instr) &&
954 Assembler::GetRt(instr) == static_cast<uint32_t>(zero_reg.code());
958 void PatchInlinedSmiCode(Address address, InlinedSmiCheck check) {
959 Address andi_instruction_address =
960 address + Assembler::kCallTargetAddressOffset;
962 // If the instruction following the call is not a andi at, rx, #yyy, nothing
964 Instr instr = Assembler::instr_at(andi_instruction_address);
965 if (!(Assembler::IsAndImmediate(instr) &&
966 Assembler::GetRt(instr) == static_cast<uint32_t>(zero_reg.code()))) {
970 // The delta to the start of the map check instruction and the
971 // condition code uses at the patched jump.
972 int delta = Assembler::GetImmediate16(instr);
973 delta += Assembler::GetRs(instr) * kImm16Mask;
974 // If the delta is 0 the instruction is andi at, zero_reg, #0 which also
975 // signals that nothing was inlined.
981 PrintF("[ patching ic at %p, andi=%p, delta=%d\n", address,
982 andi_instruction_address, delta);
985 Address patch_address =
986 andi_instruction_address - delta * Instruction::kInstrSize;
987 Instr instr_at_patch = Assembler::instr_at(patch_address);
989 Assembler::instr_at(patch_address + Instruction::kInstrSize);
990 // This is patching a conditional "jump if not smi/jump if smi" site.
991 // Enabling by changing from
993 // Branch <target>, eq, at, Operand(zero_reg)
995 // andi at, rx, #kSmiTagMask
996 // Branch <target>, ne, at, Operand(zero_reg)
997 // and vice-versa to be disabled again.
998 CodePatcher patcher(patch_address, 2);
999 Register reg = Register::from_code(Assembler::GetRs(instr_at_patch));
1000 if (check == ENABLE_INLINED_SMI_CHECK) {
1001 DCHECK(Assembler::IsAndImmediate(instr_at_patch));
1002 DCHECK_EQ(0, Assembler::GetImmediate16(instr_at_patch));
1003 patcher.masm()->andi(at, reg, kSmiTagMask);
1005 DCHECK(check == DISABLE_INLINED_SMI_CHECK);
1006 DCHECK(Assembler::IsAndImmediate(instr_at_patch));
1007 patcher.masm()->andi(at, reg, 0);
1009 DCHECK(Assembler::IsBranch(branch_instr));
1010 if (Assembler::IsBeq(branch_instr)) {
1011 patcher.ChangeBranchCondition(ne);
1013 DCHECK(Assembler::IsBne(branch_instr));
1014 patcher.ChangeBranchCondition(eq);
1018 } // namespace v8::internal
1020 #endif // V8_TARGET_ARCH_MIPS64