From e1030fc97dd7e6eb8e096b8f845a68c7648023d7 Mon Sep 17 00:00:00 2001
From: cdai2 <chunyang.dai@intel.com>
Date: Fri, 27 Feb 2015 15:02:59 +0800
Subject: [PATCH] X87: Move Maps' back pointers from "transitions" to
 "constructor" field.

port affcfaf42801414d25b3e57271a9803a026f40ed (r26835).

original commit message:

  Move Maps' back pointers from "transitions" to "constructor" field

BUG=
R=weiliang.lin@intel.com

Review URL: https://codereview.chromium.org/964783002

Cr-Commit-Position: refs/heads/master@{#26904}
---
 src/x87/full-codegen-x87.cc    |  4 ++--
 src/x87/lithium-codegen-x87.cc |  4 ++--
 src/x87/macro-assembler-x87.cc | 16 +++++++++++++++-
 src/x87/macro-assembler-x87.h  |  4 ++++
 4 files changed, 23 insertions(+), 5 deletions(-)

diff --git a/src/x87/full-codegen-x87.cc b/src/x87/full-codegen-x87.cc
index 3bfde7661..c2ac01546 100644
--- a/src/x87/full-codegen-x87.cc
+++ b/src/x87/full-codegen-x87.cc
@@ -3652,8 +3652,8 @@ void FullCodeGenerator::EmitClassOf(CallRuntime* expr) {
   STATIC_ASSERT(LAST_NONCALLABLE_SPEC_OBJECT_TYPE == LAST_TYPE - 1);
 
   // Check if the constructor in the map is a JS function.
-  __ mov(eax, FieldOperand(eax, Map::kConstructorOffset));
-  __ CmpObjectType(eax, JS_FUNCTION_TYPE, ebx);
+  __ GetMapConstructor(eax, eax, ebx);
+  __ CmpInstanceType(ebx, JS_FUNCTION_TYPE);
   __ j(not_equal, &non_function_constructor);
 
   // eax now contains the constructor function. Grab the
diff --git a/src/x87/lithium-codegen-x87.cc b/src/x87/lithium-codegen-x87.cc
index f6f5958f5..4c2a15afc 100644
--- a/src/x87/lithium-codegen-x87.cc
+++ b/src/x87/lithium-codegen-x87.cc
@@ -2855,9 +2855,9 @@ void LCodeGen::EmitClassOfTest(Label* is_true,
 
   // Now we are in the FIRST-LAST_NONCALLABLE_SPEC_OBJECT_TYPE range.
   // Check if the constructor in the map is a function.
-  __ mov(temp, FieldOperand(temp, Map::kConstructorOffset));
+  __ GetMapConstructor(temp, temp, temp2);
   // Objects with a non-function constructor have class 'Object'.
-  __ CmpObjectType(temp, JS_FUNCTION_TYPE, temp2);
+  __ CmpInstanceType(temp2, JS_FUNCTION_TYPE);
   if (String::Equals(class_name, isolate()->factory()->Object_string())) {
     __ j(not_equal, is_true);
   } else {
diff --git a/src/x87/macro-assembler-x87.cc b/src/x87/macro-assembler-x87.cc
index 41b93d923..47713b8e3 100644
--- a/src/x87/macro-assembler-x87.cc
+++ b/src/x87/macro-assembler-x87.cc
@@ -1883,6 +1883,20 @@ void MacroAssembler::NegativeZeroTest(Register result,
 }
 
 
+void MacroAssembler::GetMapConstructor(Register result, Register map,
+                                       Register temp) {
+  Label done, loop;
+  mov(result, FieldOperand(map, Map::kConstructorOrBackPointerOffset));
+  bind(&loop);
+  JumpIfSmi(result, &done);
+  CmpObjectType(result, MAP_TYPE, temp);
+  j(not_equal, &done);
+  mov(result, FieldOperand(result, Map::kConstructorOrBackPointerOffset));
+  jmp(&loop);
+  bind(&done);
+}
+
+
 void MacroAssembler::TryGetFunctionPrototype(Register function,
                                              Register result,
                                              Register scratch,
@@ -1934,7 +1948,7 @@ void MacroAssembler::TryGetFunctionPrototype(Register function,
     // Non-instance prototype: Fetch prototype from constructor field
     // in initial map.
     bind(&non_instance);
-    mov(result, FieldOperand(result, Map::kConstructorOffset));
+    GetMapConstructor(result, result, scratch);
   }
 
   // All done.
diff --git a/src/x87/macro-assembler-x87.h b/src/x87/macro-assembler-x87.h
index c25203f2d..9d9556c5f 100644
--- a/src/x87/macro-assembler-x87.h
+++ b/src/x87/macro-assembler-x87.h
@@ -683,6 +683,10 @@ class MacroAssembler: public Assembler {
   void NegativeZeroTest(Register result, Register op1, Register op2,
                         Register scratch, Label* then_label);
 
+  // Machine code version of Map::GetConstructor().
+  // |temp| holds |result|'s map when done.
+  void GetMapConstructor(Register result, Register map, Register temp);
+
   // Try to get function prototype of a function and puts the value in
   // the result register. Checks that the function really is a
   // function and jumps to the miss label if the fast checks fail. The
-- 
2.34.1