Correctify instanceof and make it optimizable.
authorbmeurer <bmeurer@chromium.org>
Tue, 25 Aug 2015 04:48:36 +0000 (21:48 -0700)
committerCommit bot <commit-bot@chromium.org>
Tue, 25 Aug 2015 04:48:54 +0000 (04:48 +0000)
commit5d875a57fa2e65c1a4a6b50aeb23c38299c3cfbc
tree30764e0c366e3b526102fd32f4747582791a7e07
parent2090c08d3ebafbabf5e2a85a58d605d60cbf6650
Correctify instanceof and make it optimizable.

The previous hack with HInstanceOfKnownGlobal was not only slower,
but also very brittle and required a lot of weird hacks to support it. And
what's even more important it wasn't even correct (because a map check
on the lhs is never enough for instanceof).

The new implementation provides a sane runtime implementation
for InstanceOf plus a fast case in the InstanceOfStub, combined with
a proper specialization in the case of a known global in CrankShaft,
which does only the prototype chain walk (coupled with a code
dependency on the known global).

As a drive-by-fix: Also fix the incorrect Object.prototype.isPrototypeOf
implementation.

BUG=v8:4376
LOG=y

Review URL: https://codereview.chromium.org/1304633002

Cr-Commit-Position: refs/heads/master@{#30342}
76 files changed:
src/arm/code-stubs-arm.cc
src/arm/interface-descriptors-arm.cc
src/arm/lithium-arm.cc
src/arm/lithium-arm.h
src/arm/lithium-codegen-arm.cc
src/arm/lithium-codegen-arm.h
src/arm/macro-assembler-arm.cc
src/arm/macro-assembler-arm.h
src/arm64/code-stubs-arm64.cc
src/arm64/interface-descriptors-arm64.cc
src/arm64/lithium-arm64.cc
src/arm64/lithium-arm64.h
src/arm64/lithium-codegen-arm64.cc
src/arm64/lithium-codegen-arm64.h
src/arm64/macro-assembler-arm64.cc
src/arm64/macro-assembler-arm64.h
src/bailout-reason.h
src/builtins.h
src/code-factory.cc
src/code-factory.h
src/code-stubs.cc
src/code-stubs.h
src/compiler/js-generic-lowering.cc
src/full-codegen/arm/full-codegen-arm.cc
src/full-codegen/arm64/full-codegen-arm64.cc
src/full-codegen/ia32/full-codegen-ia32.cc
src/full-codegen/mips/full-codegen-mips.cc
src/full-codegen/mips64/full-codegen-mips64.cc
src/full-codegen/x64/full-codegen-x64.cc
src/hydrogen-instructions.cc
src/hydrogen-instructions.h
src/hydrogen.cc
src/hydrogen.h
src/ia32/code-stubs-ia32.cc
src/ia32/interface-descriptors-ia32.cc
src/ia32/lithium-codegen-ia32.cc
src/ia32/lithium-codegen-ia32.h
src/ia32/lithium-ia32.cc
src/ia32/lithium-ia32.h
src/ia32/macro-assembler-ia32.cc
src/ia32/macro-assembler-ia32.h
src/interface-descriptors.cc
src/interface-descriptors.h
src/mips/code-stubs-mips.cc
src/mips/interface-descriptors-mips.cc
src/mips/lithium-codegen-mips.cc
src/mips/lithium-codegen-mips.h
src/mips/lithium-mips.cc
src/mips/lithium-mips.h
src/mips/macro-assembler-mips.cc
src/mips/macro-assembler-mips.h
src/mips64/code-stubs-mips64.cc
src/mips64/interface-descriptors-mips64.cc
src/mips64/lithium-codegen-mips64.cc
src/mips64/lithium-codegen-mips64.h
src/mips64/lithium-mips64.cc
src/mips64/lithium-mips64.h
src/mips64/macro-assembler-mips64.cc
src/mips64/macro-assembler-mips64.h
src/objects.h
src/runtime.js
src/runtime/runtime-object.cc
src/runtime/runtime.h
src/v8natives.js
src/x64/code-stubs-x64.cc
src/x64/interface-descriptors-x64.cc
src/x64/lithium-codegen-x64.cc
src/x64/lithium-codegen-x64.h
src/x64/lithium-x64.cc
src/x64/lithium-x64.h
src/x64/macro-assembler-x64.cc
src/x64/macro-assembler-x64.h
test/mjsunit/regress/regress-4376-1.js [new file with mode: 0644]
test/mjsunit/regress/regress-4376-2.js [new file with mode: 0644]
test/mjsunit/regress/regress-4376-3.js [new file with mode: 0644]
test/webkit/fast/js/object-prototype-properties-expected.txt