1 // Copyright 2012 the V8 project authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file.
8 #if V8_TARGET_ARCH_MIPS
10 #include "src/codegen.h"
11 #include "src/ic/ic.h"
12 #include "src/ic/ic-compiler.h"
13 #include "src/ic/stub-cache.h"
19 // ----------------------------------------------------------------------------
20 // Static IC stub generators.
23 #define __ ACCESS_MASM(masm)
26 static void GenerateGlobalInstanceTypeCheck(MacroAssembler* masm, Register type,
27 Label* global_object) {
29 // type: holds the receiver instance type on entry.
30 __ Branch(global_object, eq, type, Operand(JS_GLOBAL_OBJECT_TYPE));
31 __ Branch(global_object, eq, type, Operand(JS_BUILTINS_OBJECT_TYPE));
32 __ Branch(global_object, eq, type, Operand(JS_GLOBAL_PROXY_TYPE));
36 // Helper function used from LoadIC GenerateNormal.
38 // elements: Property dictionary. It is not clobbered if a jump to the miss
40 // name: Property name. It is not clobbered if a jump to the miss label is
42 // result: Register for the result. It is only updated if a jump to the miss
43 // label is not done. Can be the same as elements or name clobbering
44 // one of these in the case of not jumping to the miss label.
45 // The two scratch registers need to be different from elements, name and
47 // The generated code assumes that the receiver has slow properties,
48 // is not a global object and does not have interceptors.
49 // The address returned from GenerateStringDictionaryProbes() in scratch2
51 static void GenerateDictionaryLoad(MacroAssembler* masm, Label* miss,
52 Register elements, Register name,
53 Register result, Register scratch1,
55 // Main use of the scratch registers.
56 // scratch1: Used as temporary and to hold the capacity of the property
58 // scratch2: Used as temporary.
61 // Probe the dictionary.
62 NameDictionaryLookupStub::GeneratePositiveLookup(masm, miss, &done, elements,
63 name, scratch1, scratch2);
65 // If probing finds an entry check that the value is a normal
67 __ bind(&done); // scratch2 == elements + 4 * index.
68 const int kElementsStartOffset =
69 NameDictionary::kHeaderSize +
70 NameDictionary::kElementsStartIndex * kPointerSize;
71 const int kDetailsOffset = kElementsStartOffset + 2 * kPointerSize;
72 __ lw(scratch1, FieldMemOperand(scratch2, kDetailsOffset));
74 Operand(PropertyDetails::TypeField::kMask << kSmiTagSize));
75 __ Branch(miss, ne, at, Operand(zero_reg));
77 // Get the value at the masked, scaled index and return.
79 FieldMemOperand(scratch2, kElementsStartOffset + 1 * kPointerSize));
83 // Helper function used from StoreIC::GenerateNormal.
85 // elements: Property dictionary. It is not clobbered if a jump to the miss
87 // name: Property name. It is not clobbered if a jump to the miss label is
89 // value: The value to store.
90 // The two scratch registers need to be different from elements, name and
92 // The generated code assumes that the receiver has slow properties,
93 // is not a global object and does not have interceptors.
94 // The address returned from GenerateStringDictionaryProbes() in scratch2
96 static void GenerateDictionaryStore(MacroAssembler* masm, Label* miss,
97 Register elements, Register name,
98 Register value, Register scratch1,
100 // Main use of the scratch registers.
101 // scratch1: Used as temporary and to hold the capacity of the property
103 // scratch2: Used as temporary.
106 // Probe the dictionary.
107 NameDictionaryLookupStub::GeneratePositiveLookup(masm, miss, &done, elements,
108 name, scratch1, scratch2);
110 // If probing finds an entry in the dictionary check that the value
111 // is a normal property that is not read only.
112 __ bind(&done); // scratch2 == elements + 4 * index.
113 const int kElementsStartOffset =
114 NameDictionary::kHeaderSize +
115 NameDictionary::kElementsStartIndex * kPointerSize;
116 const int kDetailsOffset = kElementsStartOffset + 2 * kPointerSize;
117 const int kTypeAndReadOnlyMask =
118 (PropertyDetails::TypeField::kMask |
119 PropertyDetails::AttributesField::encode(READ_ONLY))
121 __ lw(scratch1, FieldMemOperand(scratch2, kDetailsOffset));
122 __ And(at, scratch1, Operand(kTypeAndReadOnlyMask));
123 __ Branch(miss, ne, at, Operand(zero_reg));
125 // Store the value at the masked, scaled index and return.
126 const int kValueOffset = kElementsStartOffset + kPointerSize;
127 __ Addu(scratch2, scratch2, Operand(kValueOffset - kHeapObjectTag));
128 __ sw(value, MemOperand(scratch2));
130 // Update the write barrier. Make sure not to clobber the value.
131 __ mov(scratch1, value);
132 __ RecordWrite(elements, scratch2, scratch1, kRAHasNotBeenSaved,
137 // Checks the receiver for special cases (value type, slow case bits).
138 // Falls through for regular JS object.
139 static void GenerateKeyedLoadReceiverCheck(MacroAssembler* masm,
140 Register receiver, Register map,
142 int interceptor_bit, Label* slow) {
143 // Check that the object isn't a smi.
144 __ JumpIfSmi(receiver, slow);
145 // Get the map of the receiver.
146 __ lw(map, FieldMemOperand(receiver, HeapObject::kMapOffset));
148 __ lbu(scratch, FieldMemOperand(map, Map::kBitFieldOffset));
150 Operand((1 << Map::kIsAccessCheckNeeded) | (1 << interceptor_bit)));
151 __ Branch(slow, ne, at, Operand(zero_reg));
152 // Check that the object is some kind of JS object EXCEPT JS Value type.
153 // In the case that the object is a value-wrapper object,
154 // we enter the runtime system to make sure that indexing into string
155 // objects work as intended.
156 DCHECK(JS_OBJECT_TYPE > JS_VALUE_TYPE);
157 __ lbu(scratch, FieldMemOperand(map, Map::kInstanceTypeOffset));
158 __ Branch(slow, lt, scratch, Operand(JS_OBJECT_TYPE));
162 // Loads an indexed element from a fast case array.
163 // If not_fast_array is NULL, doesn't perform the elements map check.
164 static void GenerateFastArrayLoad(MacroAssembler* masm, Register receiver,
165 Register key, Register elements,
166 Register scratch1, Register scratch2,
167 Register result, Label* not_fast_array,
168 Label* out_of_range) {
171 // receiver - holds the receiver on entry.
172 // Unchanged unless 'result' is the same register.
174 // key - holds the smi key on entry.
175 // Unchanged unless 'result' is the same register.
177 // elements - holds the elements of the receiver on exit.
179 // result - holds the result on exit if the load succeeded.
180 // Allowed to be the the same as 'receiver' or 'key'.
181 // Unchanged on bailout so 'receiver' and 'key' can be safely
182 // used by further computation.
184 // Scratch registers:
186 // scratch1 - used to hold elements map and elements length.
187 // Holds the elements map if not_fast_array branch is taken.
189 // scratch2 - used to hold the loaded value.
191 __ lw(elements, FieldMemOperand(receiver, JSObject::kElementsOffset));
192 if (not_fast_array != NULL) {
193 // Check that the object is in fast mode (not dictionary).
194 __ lw(scratch1, FieldMemOperand(elements, HeapObject::kMapOffset));
195 __ LoadRoot(at, Heap::kFixedArrayMapRootIndex);
196 __ Branch(not_fast_array, ne, scratch1, Operand(at));
198 __ AssertFastElements(elements);
201 // Check that the key (index) is within bounds.
202 __ lw(scratch1, FieldMemOperand(elements, FixedArray::kLengthOffset));
203 __ Branch(out_of_range, hs, key, Operand(scratch1));
205 // Fast case: Do the load.
206 __ Addu(scratch1, elements,
207 Operand(FixedArray::kHeaderSize - kHeapObjectTag));
209 STATIC_ASSERT(kSmiTag == 0 && kSmiTagSize < kPointerSizeLog2);
210 __ sll(at, key, kPointerSizeLog2 - kSmiTagSize);
211 __ addu(at, at, scratch1);
212 __ lw(scratch2, MemOperand(at));
214 __ LoadRoot(at, Heap::kTheHoleValueRootIndex);
215 // In case the loaded value is the_hole we have to consult GetProperty
216 // to ensure the prototype chain is searched.
217 __ Branch(out_of_range, eq, scratch2, Operand(at));
218 __ mov(result, scratch2);
222 // Checks whether a key is an array index string or a unique name.
223 // Falls through if a key is a unique name.
224 static void GenerateKeyNameCheck(MacroAssembler* masm, Register key,
225 Register map, Register hash,
226 Label* index_string, Label* not_unique) {
227 // The key is not a smi.
230 __ GetObjectType(key, map, hash);
231 __ Branch(not_unique, hi, hash, Operand(LAST_UNIQUE_NAME_TYPE));
232 STATIC_ASSERT(LAST_UNIQUE_NAME_TYPE == FIRST_NONSTRING_TYPE);
233 __ Branch(&unique, eq, hash, Operand(LAST_UNIQUE_NAME_TYPE));
235 // Is the string an array index, with cached numeric value?
236 __ lw(hash, FieldMemOperand(key, Name::kHashFieldOffset));
237 __ And(at, hash, Operand(Name::kContainsCachedArrayIndexMask));
238 __ Branch(index_string, eq, at, Operand(zero_reg));
240 // Is the string internalized? We know it's a string, so a single
241 // bit test is enough.
243 __ lbu(hash, FieldMemOperand(map, Map::kInstanceTypeOffset));
244 STATIC_ASSERT(kInternalizedTag == 0);
245 __ And(at, hash, Operand(kIsNotInternalizedMask));
246 __ Branch(not_unique, ne, at, Operand(zero_reg));
252 void LoadIC::GenerateNormal(MacroAssembler* masm) {
253 Register dictionary = a0;
254 DCHECK(!dictionary.is(LoadDescriptor::ReceiverRegister()));
255 DCHECK(!dictionary.is(LoadDescriptor::NameRegister()));
259 __ lw(dictionary, FieldMemOperand(LoadDescriptor::ReceiverRegister(),
260 JSObject::kPropertiesOffset));
261 GenerateDictionaryLoad(masm, &slow, dictionary,
262 LoadDescriptor::NameRegister(), v0, a3, t0);
265 // Dictionary load failed, go slow (but don't miss).
267 GenerateRuntimeGetProperty(masm);
271 // A register that isn't one of the parameters to the load ic.
272 static const Register LoadIC_TempRegister() { return a3; }
275 void LoadIC::GenerateMiss(MacroAssembler* masm) {
276 // The return address is in ra.
277 Isolate* isolate = masm->isolate();
279 __ IncrementCounter(isolate->counters()->keyed_load_miss(), 1, a3, t0);
281 __ mov(LoadIC_TempRegister(), LoadDescriptor::ReceiverRegister());
282 __ Push(LoadIC_TempRegister(), LoadDescriptor::NameRegister());
284 // Perform tail call to the entry.
285 ExternalReference ref = ExternalReference(IC_Utility(kLoadIC_Miss), isolate);
286 __ TailCallExternalReference(ref, 2, 1);
290 void LoadIC::GenerateRuntimeGetProperty(MacroAssembler* masm) {
291 // The return address is in ra.
293 __ mov(LoadIC_TempRegister(), LoadDescriptor::ReceiverRegister());
294 __ Push(LoadIC_TempRegister(), LoadDescriptor::NameRegister());
296 __ TailCallRuntime(Runtime::kGetProperty, 2, 1);
300 static MemOperand GenerateMappedArgumentsLookup(
301 MacroAssembler* masm, Register object, Register key, Register scratch1,
302 Register scratch2, Register scratch3, Label* unmapped_case,
304 Heap* heap = masm->isolate()->heap();
306 // Check that the receiver is a JSObject. Because of the map check
307 // later, we do not need to check for interceptors or whether it
308 // requires access checks.
309 __ JumpIfSmi(object, slow_case);
310 // Check that the object is some kind of JSObject.
311 __ GetObjectType(object, scratch1, scratch2);
312 __ Branch(slow_case, lt, scratch2, Operand(FIRST_JS_RECEIVER_TYPE));
314 // Check that the key is a positive smi.
315 __ And(scratch1, key, Operand(0x80000001));
316 __ Branch(slow_case, ne, scratch1, Operand(zero_reg));
318 // Load the elements into scratch1 and check its map.
319 Handle<Map> arguments_map(heap->sloppy_arguments_elements_map());
320 __ lw(scratch1, FieldMemOperand(object, JSObject::kElementsOffset));
321 __ CheckMap(scratch1, scratch2, arguments_map, slow_case, DONT_DO_SMI_CHECK);
322 // Check if element is in the range of mapped arguments. If not, jump
323 // to the unmapped lookup with the parameter map in scratch1.
324 __ lw(scratch2, FieldMemOperand(scratch1, FixedArray::kLengthOffset));
325 __ Subu(scratch2, scratch2, Operand(Smi::FromInt(2)));
326 __ Branch(unmapped_case, Ugreater_equal, key, Operand(scratch2));
328 // Load element index and check whether it is the hole.
330 FixedArray::kHeaderSize + 2 * kPointerSize - kHeapObjectTag;
332 __ li(scratch3, Operand(kPointerSize >> 1));
333 __ Mul(scratch3, key, scratch3);
334 __ Addu(scratch3, scratch3, Operand(kOffset));
336 __ Addu(scratch2, scratch1, scratch3);
337 __ lw(scratch2, MemOperand(scratch2));
338 __ LoadRoot(scratch3, Heap::kTheHoleValueRootIndex);
339 __ Branch(unmapped_case, eq, scratch2, Operand(scratch3));
341 // Load value from context and return it. We can reuse scratch1 because
342 // we do not jump to the unmapped lookup (which requires the parameter
344 __ lw(scratch1, FieldMemOperand(scratch1, FixedArray::kHeaderSize));
345 __ li(scratch3, Operand(kPointerSize >> 1));
346 __ Mul(scratch3, scratch2, scratch3);
347 __ Addu(scratch3, scratch3, Operand(Context::kHeaderSize - kHeapObjectTag));
348 __ Addu(scratch2, scratch1, scratch3);
349 return MemOperand(scratch2);
353 static MemOperand GenerateUnmappedArgumentsLookup(MacroAssembler* masm,
355 Register parameter_map,
358 // Element is in arguments backing store, which is referenced by the
359 // second element of the parameter_map. The parameter_map register
360 // must be loaded with the parameter map of the arguments object and is
362 const int kBackingStoreOffset = FixedArray::kHeaderSize + kPointerSize;
363 Register backing_store = parameter_map;
364 __ lw(backing_store, FieldMemOperand(parameter_map, kBackingStoreOffset));
365 __ CheckMap(backing_store, scratch, Heap::kFixedArrayMapRootIndex, slow_case,
367 __ lw(scratch, FieldMemOperand(backing_store, FixedArray::kLengthOffset));
368 __ Branch(slow_case, Ugreater_equal, key, Operand(scratch));
369 __ li(scratch, Operand(kPointerSize >> 1));
370 __ Mul(scratch, key, scratch);
371 __ Addu(scratch, scratch, Operand(FixedArray::kHeaderSize - kHeapObjectTag));
372 __ Addu(scratch, backing_store, scratch);
373 return MemOperand(scratch);
377 void KeyedStoreIC::GenerateSloppyArguments(MacroAssembler* masm) {
378 Register receiver = StoreDescriptor::ReceiverRegister();
379 Register key = StoreDescriptor::NameRegister();
380 Register value = StoreDescriptor::ValueRegister();
381 DCHECK(value.is(a0));
384 // Store address is returned in register (of MemOperand) mapped_location.
385 MemOperand mapped_location = GenerateMappedArgumentsLookup(
386 masm, receiver, key, a3, t0, t1, ¬in, &slow);
387 __ sw(value, mapped_location);
389 DCHECK_EQ(mapped_location.offset(), 0);
390 __ RecordWrite(a3, mapped_location.rm(), t5, kRAHasNotBeenSaved,
392 __ Ret(USE_DELAY_SLOT);
393 __ mov(v0, value); // (In delay slot) return the value stored in v0.
395 // The unmapped lookup expects that the parameter map is in a3.
396 // Store address is returned in register (of MemOperand) unmapped_location.
397 MemOperand unmapped_location =
398 GenerateUnmappedArgumentsLookup(masm, key, a3, t0, &slow);
399 __ sw(value, unmapped_location);
401 DCHECK_EQ(unmapped_location.offset(), 0);
402 __ RecordWrite(a3, unmapped_location.rm(), t5, kRAHasNotBeenSaved,
404 __ Ret(USE_DELAY_SLOT);
405 __ mov(v0, a0); // (In delay slot) return the value stored in v0.
411 void KeyedLoadIC::GenerateMiss(MacroAssembler* masm) {
412 // The return address is in ra.
413 Isolate* isolate = masm->isolate();
415 __ IncrementCounter(isolate->counters()->keyed_load_miss(), 1, a3, t0);
417 __ Push(LoadDescriptor::ReceiverRegister(), LoadDescriptor::NameRegister());
419 // Perform tail call to the entry.
420 ExternalReference ref =
421 ExternalReference(IC_Utility(kKeyedLoadIC_Miss), isolate);
423 __ TailCallExternalReference(ref, 2, 1);
427 void KeyedLoadIC::GenerateRuntimeGetProperty(MacroAssembler* masm) {
428 // The return address is in ra.
430 __ Push(LoadDescriptor::ReceiverRegister(), LoadDescriptor::NameRegister());
432 __ TailCallRuntime(Runtime::kKeyedGetProperty, 2, 1);
436 void KeyedLoadIC::GenerateGeneric(MacroAssembler* masm) {
437 // The return address is in ra.
438 Label slow, check_name, index_smi, index_name, property_array_property;
439 Label probe_dictionary, check_number_dictionary;
441 Register key = LoadDescriptor::NameRegister();
442 Register receiver = LoadDescriptor::ReceiverRegister();
444 DCHECK(receiver.is(a1));
446 Isolate* isolate = masm->isolate();
448 // Check that the key is a smi.
449 __ JumpIfNotSmi(key, &check_name);
451 // Now the key is known to be a smi. This place is also jumped to from below
452 // where a numeric string is converted to a smi.
454 GenerateKeyedLoadReceiverCheck(masm, receiver, a0, a3,
455 Map::kHasIndexedInterceptor, &slow);
457 // Check the receiver's map to see if it has fast elements.
458 __ CheckFastElements(a0, a3, &check_number_dictionary);
460 GenerateFastArrayLoad(masm, receiver, key, a0, a3, t0, v0, NULL, &slow);
461 __ IncrementCounter(isolate->counters()->keyed_load_generic_smi(), 1, t0, a3);
464 __ bind(&check_number_dictionary);
465 __ lw(t0, FieldMemOperand(receiver, JSObject::kElementsOffset));
466 __ lw(a3, FieldMemOperand(t0, JSObject::kMapOffset));
468 // Check whether the elements is a number dictionary.
471 __ LoadRoot(at, Heap::kHashTableMapRootIndex);
472 __ Branch(&slow, ne, a3, Operand(at));
473 __ sra(a0, key, kSmiTagSize);
474 __ LoadFromNumberDictionary(&slow, t0, key, v0, a0, a3, t1);
477 // Slow case, key and receiver still in a2 and a1.
479 __ IncrementCounter(isolate->counters()->keyed_load_generic_slow(), 1, t0,
481 GenerateRuntimeGetProperty(masm);
483 __ bind(&check_name);
484 GenerateKeyNameCheck(masm, key, a0, a3, &index_name, &slow);
486 GenerateKeyedLoadReceiverCheck(masm, receiver, a0, a3,
487 Map::kHasNamedInterceptor, &slow);
490 // If the receiver is a fast-case object, check the keyed lookup
491 // cache. Otherwise probe the dictionary.
492 __ lw(a3, FieldMemOperand(receiver, JSObject::kPropertiesOffset));
493 __ lw(t0, FieldMemOperand(a3, HeapObject::kMapOffset));
494 __ LoadRoot(at, Heap::kHashTableMapRootIndex);
495 __ Branch(&probe_dictionary, eq, t0, Operand(at));
497 // Load the map of the receiver, compute the keyed lookup cache hash
498 // based on 32 bits of the map pointer and the name hash.
499 __ lw(a0, FieldMemOperand(receiver, HeapObject::kMapOffset));
500 __ sra(a3, a0, KeyedLookupCache::kMapHashShift);
501 __ lw(t0, FieldMemOperand(key, Name::kHashFieldOffset));
502 __ sra(at, t0, Name::kHashShift);
504 int mask = KeyedLookupCache::kCapacityMask & KeyedLookupCache::kHashMask;
505 __ And(a3, a3, Operand(mask));
507 // Load the key (consisting of map and unique name) from the cache and
509 Label load_in_object_property;
510 static const int kEntriesPerBucket = KeyedLookupCache::kEntriesPerBucket;
511 Label hit_on_nth_entry[kEntriesPerBucket];
512 ExternalReference cache_keys =
513 ExternalReference::keyed_lookup_cache_keys(isolate);
514 __ li(t0, Operand(cache_keys));
515 __ sll(at, a3, kPointerSizeLog2 + 1);
518 for (int i = 0; i < kEntriesPerBucket - 1; i++) {
519 Label try_next_entry;
520 __ lw(t1, MemOperand(t0, kPointerSize * i * 2));
521 __ Branch(&try_next_entry, ne, a0, Operand(t1));
522 __ lw(t1, MemOperand(t0, kPointerSize * (i * 2 + 1)));
523 __ Branch(&hit_on_nth_entry[i], eq, key, Operand(t1));
524 __ bind(&try_next_entry);
527 __ lw(t1, MemOperand(t0, kPointerSize * (kEntriesPerBucket - 1) * 2));
528 __ Branch(&slow, ne, a0, Operand(t1));
529 __ lw(t1, MemOperand(t0, kPointerSize * ((kEntriesPerBucket - 1) * 2 + 1)));
530 __ Branch(&slow, ne, key, Operand(t1));
533 // a0 : receiver's map
534 // a3 : lookup cache index
535 ExternalReference cache_field_offsets =
536 ExternalReference::keyed_lookup_cache_field_offsets(isolate);
539 for (int i = kEntriesPerBucket - 1; i >= 0; i--) {
540 __ bind(&hit_on_nth_entry[i]);
541 __ li(t0, Operand(cache_field_offsets));
542 __ sll(at, a3, kPointerSizeLog2);
544 __ lw(t1, MemOperand(at, kPointerSize * i));
545 __ lbu(t2, FieldMemOperand(a0, Map::kInObjectPropertiesOffset));
547 __ Branch(&property_array_property, ge, t1, Operand(zero_reg));
549 __ Branch(&load_in_object_property);
553 // Load in-object property.
554 __ bind(&load_in_object_property);
555 __ lbu(t2, FieldMemOperand(a0, Map::kInstanceSizeOffset));
556 __ addu(t2, t2, t1); // Index from start of object.
557 __ Subu(receiver, receiver, Operand(kHeapObjectTag)); // Remove the heap tag.
558 __ sll(at, t2, kPointerSizeLog2);
559 __ addu(at, receiver, at);
560 __ lw(v0, MemOperand(at));
561 __ IncrementCounter(isolate->counters()->keyed_load_generic_lookup_cache(), 1,
565 // Load property array property.
566 __ bind(&property_array_property);
567 __ lw(receiver, FieldMemOperand(receiver, JSObject::kPropertiesOffset));
568 __ Addu(receiver, receiver, FixedArray::kHeaderSize - kHeapObjectTag);
569 __ sll(v0, t1, kPointerSizeLog2);
570 __ Addu(v0, v0, receiver);
571 __ lw(v0, MemOperand(v0));
572 __ IncrementCounter(isolate->counters()->keyed_load_generic_lookup_cache(), 1,
577 // Do a quick inline probe of the receiver's dictionary, if it
579 __ bind(&probe_dictionary);
581 __ lw(a0, FieldMemOperand(receiver, HeapObject::kMapOffset));
582 __ lbu(a0, FieldMemOperand(a0, Map::kInstanceTypeOffset));
583 GenerateGlobalInstanceTypeCheck(masm, a0, &slow);
584 // Load the property to v0.
585 GenerateDictionaryLoad(masm, &slow, a3, key, v0, t1, t0);
586 __ IncrementCounter(isolate->counters()->keyed_load_generic_symbol(), 1, t0,
590 __ bind(&index_name);
591 __ IndexFromHash(a3, key);
592 // Now jump to the place where smi keys are handled.
593 __ Branch(&index_smi);
597 static void KeyedStoreGenerateMegamorphicHelper(
598 MacroAssembler* masm, Label* fast_object, Label* fast_double, Label* slow,
599 KeyedStoreCheckMap check_map, KeyedStoreIncrementLength increment_length,
600 Register value, Register key, Register receiver, Register receiver_map,
601 Register elements_map, Register elements) {
602 Label transition_smi_elements;
603 Label finish_object_store, non_double_value, transition_double_elements;
604 Label fast_double_without_map_check;
606 // Fast case: Do the store, could be either Object or double.
607 __ bind(fast_object);
608 Register scratch_value = t0;
609 Register address = t1;
610 if (check_map == kCheckMap) {
611 __ lw(elements_map, FieldMemOperand(elements, HeapObject::kMapOffset));
612 __ Branch(fast_double, ne, elements_map,
613 Operand(masm->isolate()->factory()->fixed_array_map()));
616 // HOLECHECK: guards "A[i] = V"
617 // We have to go to the runtime if the current value is the hole because
618 // there may be a callback on the element.
619 Label holecheck_passed1;
620 __ Addu(address, elements, FixedArray::kHeaderSize - kHeapObjectTag);
621 __ sll(at, key, kPointerSizeLog2 - kSmiTagSize);
622 __ addu(address, address, at);
623 __ lw(scratch_value, MemOperand(address));
624 __ Branch(&holecheck_passed1, ne, scratch_value,
625 Operand(masm->isolate()->factory()->the_hole_value()));
626 __ JumpIfDictionaryInPrototypeChain(receiver, elements_map, scratch_value,
629 __ bind(&holecheck_passed1);
631 // Smi stores don't require further checks.
633 __ JumpIfNotSmi(value, &non_smi_value);
635 if (increment_length == kIncrementLength) {
636 // Add 1 to receiver->length.
637 __ Addu(scratch_value, key, Operand(Smi::FromInt(1)));
638 __ sw(scratch_value, FieldMemOperand(receiver, JSArray::kLengthOffset));
640 // It's irrelevant whether array is smi-only or not when writing a smi.
641 __ Addu(address, elements, Operand(FixedArray::kHeaderSize - kHeapObjectTag));
642 __ sll(scratch_value, key, kPointerSizeLog2 - kSmiTagSize);
643 __ Addu(address, address, scratch_value);
644 __ sw(value, MemOperand(address));
647 __ bind(&non_smi_value);
648 // Escape to elements kind transition case.
649 __ CheckFastObjectElements(receiver_map, scratch_value,
650 &transition_smi_elements);
652 // Fast elements array, store the value to the elements backing store.
653 __ bind(&finish_object_store);
654 if (increment_length == kIncrementLength) {
655 // Add 1 to receiver->length.
656 __ Addu(scratch_value, key, Operand(Smi::FromInt(1)));
657 __ sw(scratch_value, FieldMemOperand(receiver, JSArray::kLengthOffset));
659 __ Addu(address, elements, Operand(FixedArray::kHeaderSize - kHeapObjectTag));
660 __ sll(scratch_value, key, kPointerSizeLog2 - kSmiTagSize);
661 __ Addu(address, address, scratch_value);
662 __ sw(value, MemOperand(address));
663 // Update write barrier for the elements array address.
664 __ mov(scratch_value, value); // Preserve the value which is returned.
665 __ RecordWrite(elements, address, scratch_value, kRAHasNotBeenSaved,
666 kDontSaveFPRegs, EMIT_REMEMBERED_SET, OMIT_SMI_CHECK);
669 __ bind(fast_double);
670 if (check_map == kCheckMap) {
671 // Check for fast double array case. If this fails, call through to the
673 __ LoadRoot(at, Heap::kFixedDoubleArrayMapRootIndex);
674 __ Branch(slow, ne, elements_map, Operand(at));
677 // HOLECHECK: guards "A[i] double hole?"
678 // We have to see if the double version of the hole is present. If so
679 // go to the runtime.
680 __ Addu(address, elements, Operand(FixedDoubleArray::kHeaderSize +
681 kHoleNanUpper32Offset - kHeapObjectTag));
682 __ sll(at, key, kPointerSizeLog2);
683 __ addu(address, address, at);
684 __ lw(scratch_value, MemOperand(address));
685 __ Branch(&fast_double_without_map_check, ne, scratch_value,
686 Operand(kHoleNanUpper32));
687 __ JumpIfDictionaryInPrototypeChain(receiver, elements_map, scratch_value,
690 __ bind(&fast_double_without_map_check);
691 __ StoreNumberToDoubleElements(value, key,
692 elements, // Overwritten.
693 a3, // Scratch regs...
694 t0, t1, &transition_double_elements);
695 if (increment_length == kIncrementLength) {
696 // Add 1 to receiver->length.
697 __ Addu(scratch_value, key, Operand(Smi::FromInt(1)));
698 __ sw(scratch_value, FieldMemOperand(receiver, JSArray::kLengthOffset));
702 __ bind(&transition_smi_elements);
703 // Transition the array appropriately depending on the value type.
704 __ lw(t0, FieldMemOperand(value, HeapObject::kMapOffset));
705 __ LoadRoot(at, Heap::kHeapNumberMapRootIndex);
706 __ Branch(&non_double_value, ne, t0, Operand(at));
708 // Value is a double. Transition FAST_SMI_ELEMENTS ->
709 // FAST_DOUBLE_ELEMENTS and complete the store.
710 __ LoadTransitionedArrayMapConditional(
711 FAST_SMI_ELEMENTS, FAST_DOUBLE_ELEMENTS, receiver_map, t0, slow);
712 AllocationSiteMode mode =
713 AllocationSite::GetMode(FAST_SMI_ELEMENTS, FAST_DOUBLE_ELEMENTS);
714 ElementsTransitionGenerator::GenerateSmiToDouble(masm, receiver, key, value,
715 receiver_map, mode, slow);
716 __ lw(elements, FieldMemOperand(receiver, JSObject::kElementsOffset));
717 __ jmp(&fast_double_without_map_check);
719 __ bind(&non_double_value);
720 // Value is not a double, FAST_SMI_ELEMENTS -> FAST_ELEMENTS
721 __ LoadTransitionedArrayMapConditional(FAST_SMI_ELEMENTS, FAST_ELEMENTS,
722 receiver_map, t0, slow);
723 mode = AllocationSite::GetMode(FAST_SMI_ELEMENTS, FAST_ELEMENTS);
724 ElementsTransitionGenerator::GenerateMapChangeElementsTransition(
725 masm, receiver, key, value, receiver_map, mode, slow);
726 __ lw(elements, FieldMemOperand(receiver, JSObject::kElementsOffset));
727 __ jmp(&finish_object_store);
729 __ bind(&transition_double_elements);
730 // Elements are FAST_DOUBLE_ELEMENTS, but value is an Object that's not a
731 // HeapNumber. Make sure that the receiver is a Array with FAST_ELEMENTS and
732 // transition array from FAST_DOUBLE_ELEMENTS to FAST_ELEMENTS
733 __ LoadTransitionedArrayMapConditional(FAST_DOUBLE_ELEMENTS, FAST_ELEMENTS,
734 receiver_map, t0, slow);
735 mode = AllocationSite::GetMode(FAST_DOUBLE_ELEMENTS, FAST_ELEMENTS);
736 ElementsTransitionGenerator::GenerateDoubleToObject(
737 masm, receiver, key, value, receiver_map, mode, slow);
738 __ lw(elements, FieldMemOperand(receiver, JSObject::kElementsOffset));
739 __ jmp(&finish_object_store);
743 void KeyedStoreIC::GenerateMegamorphic(MacroAssembler* masm,
744 StrictMode strict_mode) {
745 // ---------- S t a t e --------------
749 // -- ra : return address
750 // -----------------------------------
751 Label slow, fast_object, fast_object_grow;
752 Label fast_double, fast_double_grow;
753 Label array, extra, check_if_double_array, maybe_name_key, miss;
756 Register value = StoreDescriptor::ValueRegister();
757 Register key = StoreDescriptor::NameRegister();
758 Register receiver = StoreDescriptor::ReceiverRegister();
759 DCHECK(value.is(a0));
760 Register receiver_map = a3;
761 Register elements_map = t2;
762 Register elements = t3; // Elements array of the receiver.
763 // t0 and t1 are used as general scratch registers.
765 // Check that the key is a smi.
766 __ JumpIfNotSmi(key, &maybe_name_key);
767 // Check that the object isn't a smi.
768 __ JumpIfSmi(receiver, &slow);
769 // Get the map of the object.
770 __ lw(receiver_map, FieldMemOperand(receiver, HeapObject::kMapOffset));
771 // Check that the receiver does not require access checks and is not observed.
772 // The generic stub does not perform map checks or handle observed objects.
773 __ lbu(t0, FieldMemOperand(receiver_map, Map::kBitFieldOffset));
775 Operand(1 << Map::kIsAccessCheckNeeded | 1 << Map::kIsObserved));
776 __ Branch(&slow, ne, t0, Operand(zero_reg));
777 // Check if the object is a JS array or not.
778 __ lbu(t0, FieldMemOperand(receiver_map, Map::kInstanceTypeOffset));
779 __ Branch(&array, eq, t0, Operand(JS_ARRAY_TYPE));
780 // Check that the object is some kind of JSObject.
781 __ Branch(&slow, lt, t0, Operand(FIRST_JS_OBJECT_TYPE));
783 // Object case: Check key against length in the elements array.
784 __ lw(elements, FieldMemOperand(receiver, JSObject::kElementsOffset));
785 // Check array bounds. Both the key and the length of FixedArray are smis.
786 __ lw(t0, FieldMemOperand(elements, FixedArray::kLengthOffset));
787 __ Branch(&fast_object, lo, key, Operand(t0));
789 // Slow case, handle jump to runtime.
791 // Entry registers are intact.
795 PropertyICCompiler::GenerateRuntimeSetProperty(masm, strict_mode);
796 // Never returns to here.
798 __ bind(&maybe_name_key);
799 __ lw(t0, FieldMemOperand(key, HeapObject::kMapOffset));
800 __ lb(t0, FieldMemOperand(t0, Map::kInstanceTypeOffset));
801 __ JumpIfNotUniqueNameInstanceType(t0, &slow);
802 Code::Flags flags = Code::RemoveTypeAndHolderFromFlags(
803 Code::ComputeHandlerFlags(Code::STORE_IC));
804 masm->isolate()->stub_cache()->GenerateProbe(masm, flags, false, receiver,
805 key, a3, t0, t1, t2);
809 // Extra capacity case: Check if there is extra capacity to
810 // perform the store and update the length. Used for adding one
811 // element to the array by writing to array[array.length].
813 // Condition code from comparing key and array length is still available.
814 // Only support writing to array[array.length].
815 __ Branch(&slow, ne, key, Operand(t0));
816 // Check for room in the elements backing store.
817 // Both the key and the length of FixedArray are smis.
818 __ lw(t0, FieldMemOperand(elements, FixedArray::kLengthOffset));
819 __ Branch(&slow, hs, key, Operand(t0));
820 __ lw(elements_map, FieldMemOperand(elements, HeapObject::kMapOffset));
821 __ Branch(&check_if_double_array, ne, elements_map,
822 Heap::kFixedArrayMapRootIndex);
824 __ jmp(&fast_object_grow);
826 __ bind(&check_if_double_array);
827 __ Branch(&slow, ne, elements_map, Heap::kFixedDoubleArrayMapRootIndex);
828 __ jmp(&fast_double_grow);
830 // Array case: Get the length and the elements array from the JS
831 // array. Check that the array is in fast mode (and writable); if it
832 // is the length is always a smi.
834 __ lw(elements, FieldMemOperand(receiver, JSObject::kElementsOffset));
836 // Check the key against the length in the array.
837 __ lw(t0, FieldMemOperand(receiver, JSArray::kLengthOffset));
838 __ Branch(&extra, hs, key, Operand(t0));
840 KeyedStoreGenerateMegamorphicHelper(
841 masm, &fast_object, &fast_double, &slow, kCheckMap, kDontIncrementLength,
842 value, key, receiver, receiver_map, elements_map, elements);
843 KeyedStoreGenerateMegamorphicHelper(masm, &fast_object_grow,
844 &fast_double_grow, &slow, kDontCheckMap,
845 kIncrementLength, value, key, receiver,
846 receiver_map, elements_map, elements);
853 void KeyedStoreIC::GenerateMiss(MacroAssembler* masm) {
854 // Push receiver, key and value for runtime call.
855 __ Push(StoreDescriptor::ReceiverRegister(), StoreDescriptor::NameRegister(),
856 StoreDescriptor::ValueRegister());
858 ExternalReference ref =
859 ExternalReference(IC_Utility(kKeyedStoreIC_Miss), masm->isolate());
860 __ TailCallExternalReference(ref, 3, 1);
864 void StoreIC::GenerateMegamorphic(MacroAssembler* masm) {
865 Register receiver = StoreDescriptor::ReceiverRegister();
866 Register name = StoreDescriptor::NameRegister();
867 DCHECK(receiver.is(a1));
869 DCHECK(StoreDescriptor::ValueRegister().is(a0));
871 // Get the receiver from the stack and probe the stub cache.
872 Code::Flags flags = Code::RemoveTypeAndHolderFromFlags(
873 Code::ComputeHandlerFlags(Code::STORE_IC));
874 masm->isolate()->stub_cache()->GenerateProbe(masm, flags, false, receiver,
875 name, a3, t0, t1, t2);
877 // Cache miss: Jump to runtime.
882 void StoreIC::GenerateMiss(MacroAssembler* masm) {
883 __ Push(StoreDescriptor::ReceiverRegister(), StoreDescriptor::NameRegister(),
884 StoreDescriptor::ValueRegister());
885 // Perform tail call to the entry.
886 ExternalReference ref =
887 ExternalReference(IC_Utility(kStoreIC_Miss), masm->isolate());
888 __ TailCallExternalReference(ref, 3, 1);
892 void StoreIC::GenerateNormal(MacroAssembler* masm) {
894 Register receiver = StoreDescriptor::ReceiverRegister();
895 Register name = StoreDescriptor::NameRegister();
896 Register value = StoreDescriptor::ValueRegister();
897 Register dictionary = a3;
898 DCHECK(receiver.is(a1));
900 DCHECK(value.is(a0));
902 __ lw(dictionary, FieldMemOperand(receiver, JSObject::kPropertiesOffset));
904 GenerateDictionaryStore(masm, &miss, dictionary, name, value, t0, t1);
905 Counters* counters = masm->isolate()->counters();
906 __ IncrementCounter(counters->store_normal_hit(), 1, t0, t1);
910 __ IncrementCounter(counters->store_normal_miss(), 1, t0, t1);
918 Condition CompareIC::ComputeCondition(Token::Value op) {
920 case Token::EQ_STRICT:
938 bool CompareIC::HasInlinedSmiCode(Address address) {
939 // The address of the instruction following the call.
940 Address andi_instruction_address =
941 address + Assembler::kCallTargetAddressOffset;
943 // If the instruction following the call is not a andi at, rx, #yyy, nothing
945 Instr instr = Assembler::instr_at(andi_instruction_address);
946 return Assembler::IsAndImmediate(instr) &&
947 Assembler::GetRt(instr) == static_cast<uint32_t>(zero_reg.code());
951 void PatchInlinedSmiCode(Address address, InlinedSmiCheck check) {
952 Address andi_instruction_address =
953 address + Assembler::kCallTargetAddressOffset;
955 // If the instruction following the call is not a andi at, rx, #yyy, nothing
957 Instr instr = Assembler::instr_at(andi_instruction_address);
958 if (!(Assembler::IsAndImmediate(instr) &&
959 Assembler::GetRt(instr) == static_cast<uint32_t>(zero_reg.code()))) {
963 // The delta to the start of the map check instruction and the
964 // condition code uses at the patched jump.
965 int delta = Assembler::GetImmediate16(instr);
966 delta += Assembler::GetRs(instr) * kImm16Mask;
967 // If the delta is 0 the instruction is andi at, zero_reg, #0 which also
968 // signals that nothing was inlined.
974 PrintF("[ patching ic at %p, andi=%p, delta=%d\n", address,
975 andi_instruction_address, delta);
978 Address patch_address =
979 andi_instruction_address - delta * Instruction::kInstrSize;
980 Instr instr_at_patch = Assembler::instr_at(patch_address);
982 Assembler::instr_at(patch_address + Instruction::kInstrSize);
983 // This is patching a conditional "jump if not smi/jump if smi" site.
984 // Enabling by changing from
986 // Branch <target>, eq, at, Operand(zero_reg)
988 // andi at, rx, #kSmiTagMask
989 // Branch <target>, ne, at, Operand(zero_reg)
990 // and vice-versa to be disabled again.
991 CodePatcher patcher(patch_address, 2);
992 Register reg = Register::from_code(Assembler::GetRs(instr_at_patch));
993 if (check == ENABLE_INLINED_SMI_CHECK) {
994 DCHECK(Assembler::IsAndImmediate(instr_at_patch));
995 DCHECK_EQ(0, Assembler::GetImmediate16(instr_at_patch));
996 patcher.masm()->andi(at, reg, kSmiTagMask);
998 DCHECK(check == DISABLE_INLINED_SMI_CHECK);
999 DCHECK(Assembler::IsAndImmediate(instr_at_patch));
1000 patcher.masm()->andi(at, reg, 0);
1002 DCHECK(Assembler::IsBranch(branch_instr));
1003 if (Assembler::IsBeq(branch_instr)) {
1004 patcher.ChangeBranchCondition(ne);
1006 DCHECK(Assembler::IsBne(branch_instr));
1007 patcher.ChangeBranchCondition(eq);
1011 } // namespace v8::internal
1013 #endif // V8_TARGET_ARCH_MIPS