1 // Copyright 2012 the V8 project authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file.
9 #include "src/codegen.h"
10 #include "src/ic-inl.h"
11 #include "src/stub-cache.h"
16 #define __ ACCESS_MASM(masm)
19 static void ProbeTable(Isolate* isolate,
22 StubCache::Table table,
25 // Number of the cache entry pointer-size scaled.
28 ExternalReference key_offset(isolate->stub_cache()->key_reference(table));
29 ExternalReference value_offset(isolate->stub_cache()->value_reference(table));
30 ExternalReference map_offset(isolate->stub_cache()->map_reference(table));
34 // Multiply by 3 because there are 3 fields per entry (name, code, map).
35 __ lea(offset, Operand(offset, offset, times_2, 0));
37 if (extra.is_valid()) {
38 // Get the code entry from the cache.
39 __ mov(extra, Operand::StaticArray(offset, times_1, value_offset));
41 // Check that the key in the entry matches the name.
42 __ cmp(name, Operand::StaticArray(offset, times_1, key_offset));
43 __ j(not_equal, &miss);
45 // Check the map matches.
46 __ mov(offset, Operand::StaticArray(offset, times_1, map_offset));
47 __ cmp(offset, FieldOperand(receiver, HeapObject::kMapOffset));
48 __ j(not_equal, &miss);
50 // Check that the flags match what we're looking for.
51 __ mov(offset, FieldOperand(extra, Code::kFlagsOffset));
52 __ and_(offset, ~Code::kFlagsNotUsedInLookup);
53 __ cmp(offset, flags);
54 __ j(not_equal, &miss);
57 if (FLAG_test_secondary_stub_cache && table == StubCache::kPrimary) {
59 } else if (FLAG_test_primary_stub_cache && table == StubCache::kSecondary) {
64 // Jump to the first instruction in the code stub.
65 __ add(extra, Immediate(Code::kHeaderSize - kHeapObjectTag));
70 // Save the offset on the stack.
73 // Check that the key in the entry matches the name.
74 __ cmp(name, Operand::StaticArray(offset, times_1, key_offset));
75 __ j(not_equal, &miss);
77 // Check the map matches.
78 __ mov(offset, Operand::StaticArray(offset, times_1, map_offset));
79 __ cmp(offset, FieldOperand(receiver, HeapObject::kMapOffset));
80 __ j(not_equal, &miss);
82 // Restore offset register.
83 __ mov(offset, Operand(esp, 0));
85 // Get the code entry from the cache.
86 __ mov(offset, Operand::StaticArray(offset, times_1, value_offset));
88 // Check that the flags match what we're looking for.
89 __ mov(offset, FieldOperand(offset, Code::kFlagsOffset));
90 __ and_(offset, ~Code::kFlagsNotUsedInLookup);
91 __ cmp(offset, flags);
92 __ j(not_equal, &miss);
95 if (FLAG_test_secondary_stub_cache && table == StubCache::kPrimary) {
97 } else if (FLAG_test_primary_stub_cache && table == StubCache::kSecondary) {
102 // Restore offset and re-load code entry from cache.
104 __ mov(offset, Operand::StaticArray(offset, times_1, value_offset));
106 // Jump to the first instruction in the code stub.
107 __ add(offset, Immediate(Code::kHeaderSize - kHeapObjectTag));
117 void PropertyHandlerCompiler::GenerateDictionaryNegativeLookup(
118 MacroAssembler* masm, Label* miss_label, Register receiver,
119 Handle<Name> name, Register scratch0, Register scratch1) {
120 DCHECK(name->IsUniqueName());
121 DCHECK(!receiver.is(scratch0));
122 Counters* counters = masm->isolate()->counters();
123 __ IncrementCounter(counters->negative_lookups(), 1);
124 __ IncrementCounter(counters->negative_lookups_miss(), 1);
126 __ mov(scratch0, FieldOperand(receiver, HeapObject::kMapOffset));
128 const int kInterceptorOrAccessCheckNeededMask =
129 (1 << Map::kHasNamedInterceptor) | (1 << Map::kIsAccessCheckNeeded);
131 // Bail out if the receiver has a named interceptor or requires access checks.
132 __ test_b(FieldOperand(scratch0, Map::kBitFieldOffset),
133 kInterceptorOrAccessCheckNeededMask);
134 __ j(not_zero, miss_label);
136 // Check that receiver is a JSObject.
137 __ CmpInstanceType(scratch0, FIRST_SPEC_OBJECT_TYPE);
138 __ j(below, miss_label);
140 // Load properties array.
141 Register properties = scratch0;
142 __ mov(properties, FieldOperand(receiver, JSObject::kPropertiesOffset));
144 // Check that the properties array is a dictionary.
145 __ cmp(FieldOperand(properties, HeapObject::kMapOffset),
146 Immediate(masm->isolate()->factory()->hash_table_map()));
147 __ j(not_equal, miss_label);
150 NameDictionaryLookupStub::GenerateNegativeLookup(masm,
157 __ DecrementCounter(counters->negative_lookups_miss(), 1);
161 void StubCache::GenerateProbe(MacroAssembler* masm,
171 // Assert that code is valid. The multiplying code relies on the entry size
173 DCHECK(sizeof(Entry) == 12);
175 // Assert the flags do not name a specific type.
176 DCHECK(Code::ExtractTypeFromFlags(flags) == 0);
178 // Assert that there are no register conflicts.
179 DCHECK(!scratch.is(receiver));
180 DCHECK(!scratch.is(name));
181 DCHECK(!extra.is(receiver));
182 DCHECK(!extra.is(name));
183 DCHECK(!extra.is(scratch));
185 // Assert scratch and extra registers are valid, and extra2/3 are unused.
186 DCHECK(!scratch.is(no_reg));
187 DCHECK(extra2.is(no_reg));
188 DCHECK(extra3.is(no_reg));
190 Register offset = scratch;
193 Counters* counters = masm->isolate()->counters();
194 __ IncrementCounter(counters->megamorphic_stub_cache_probes(), 1);
196 // Check that the receiver isn't a smi.
197 __ JumpIfSmi(receiver, &miss);
199 // Get the map of the receiver and compute the hash.
200 __ mov(offset, FieldOperand(name, Name::kHashFieldOffset));
201 __ add(offset, FieldOperand(receiver, HeapObject::kMapOffset));
202 __ xor_(offset, flags);
203 // We mask out the last two bits because they are not part of the hash and
204 // they are always 01 for maps. Also in the two 'and' instructions below.
205 __ and_(offset, (kPrimaryTableSize - 1) << kCacheIndexShift);
206 // ProbeTable expects the offset to be pointer scaled, which it is, because
207 // the heap object tag size is 2 and the pointer size log 2 is also 2.
208 DCHECK(kCacheIndexShift == kPointerSizeLog2);
210 // Probe the primary table.
211 ProbeTable(isolate(), masm, flags, kPrimary, name, receiver, offset, extra);
213 // Primary miss: Compute hash for secondary probe.
214 __ mov(offset, FieldOperand(name, Name::kHashFieldOffset));
215 __ add(offset, FieldOperand(receiver, HeapObject::kMapOffset));
216 __ xor_(offset, flags);
217 __ and_(offset, (kPrimaryTableSize - 1) << kCacheIndexShift);
218 __ sub(offset, name);
219 __ add(offset, Immediate(flags));
220 __ and_(offset, (kSecondaryTableSize - 1) << kCacheIndexShift);
222 // Probe the secondary table.
224 isolate(), masm, flags, kSecondary, name, receiver, offset, extra);
226 // Cache miss: Fall-through and let caller handle the miss by
227 // entering the runtime system.
229 __ IncrementCounter(counters->megamorphic_stub_cache_misses(), 1);
233 void NamedLoadHandlerCompiler::GenerateDirectLoadGlobalFunctionPrototype(
234 MacroAssembler* masm, int index, Register prototype, Label* miss) {
235 // Get the global function with the given index.
236 Handle<JSFunction> function(
237 JSFunction::cast(masm->isolate()->native_context()->get(index)));
238 // Check we're still in the same context.
239 Register scratch = prototype;
240 const int offset = Context::SlotOffset(Context::GLOBAL_OBJECT_INDEX);
241 __ mov(scratch, Operand(esi, offset));
242 __ mov(scratch, FieldOperand(scratch, GlobalObject::kNativeContextOffset));
243 __ cmp(Operand(scratch, Context::SlotOffset(index)), function);
244 __ j(not_equal, miss);
246 // Load its initial map. The global functions all have initial maps.
247 __ Move(prototype, Immediate(Handle<Map>(function->initial_map())));
248 // Load the prototype from the initial map.
249 __ mov(prototype, FieldOperand(prototype, Map::kPrototypeOffset));
253 void NamedLoadHandlerCompiler::GenerateLoadFunctionPrototype(
254 MacroAssembler* masm, Register receiver, Register scratch1,
255 Register scratch2, Label* miss_label) {
256 __ TryGetFunctionPrototype(receiver, scratch1, scratch2, miss_label);
257 __ mov(eax, scratch1);
262 static void PushInterceptorArguments(MacroAssembler* masm,
266 Handle<JSObject> holder_obj) {
267 STATIC_ASSERT(NamedLoadHandlerCompiler::kInterceptorArgsNameIndex == 0);
268 STATIC_ASSERT(NamedLoadHandlerCompiler::kInterceptorArgsInfoIndex == 1);
269 STATIC_ASSERT(NamedLoadHandlerCompiler::kInterceptorArgsThisIndex == 2);
270 STATIC_ASSERT(NamedLoadHandlerCompiler::kInterceptorArgsHolderIndex == 3);
271 STATIC_ASSERT(NamedLoadHandlerCompiler::kInterceptorArgsLength == 4);
273 Handle<InterceptorInfo> interceptor(holder_obj->GetNamedInterceptor());
274 DCHECK(!masm->isolate()->heap()->InNewSpace(*interceptor));
275 Register scratch = name;
276 __ mov(scratch, Immediate(interceptor));
283 static void CompileCallLoadPropertyWithInterceptor(
284 MacroAssembler* masm,
288 Handle<JSObject> holder_obj,
290 PushInterceptorArguments(masm, receiver, holder, name, holder_obj);
291 __ CallExternalReference(ExternalReference(IC_Utility(id), masm->isolate()),
292 NamedLoadHandlerCompiler::kInterceptorArgsLength);
296 // Generate call to api function.
297 // This function uses push() to generate smaller, faster code than
298 // the version above. It is an optimization that should will be removed
299 // when api call ICs are generated in hydrogen.
300 void PropertyHandlerCompiler::GenerateFastApiCall(
301 MacroAssembler* masm, const CallOptimization& optimization,
302 Handle<Map> receiver_map, Register receiver, Register scratch_in,
303 bool is_store, int argc, Register* values) {
304 // Copy return value.
308 // Write the arguments to stack frame.
309 for (int i = 0; i < argc; i++) {
310 Register arg = values[argc-1-i];
311 DCHECK(!receiver.is(arg));
312 DCHECK(!scratch_in.is(arg));
316 // Stack now matches JSFunction abi.
317 DCHECK(optimization.is_simple_api_call());
319 // Abi for CallApiFunctionStub.
320 Register callee = eax;
321 Register call_data = ebx;
322 Register holder = ecx;
323 Register api_function_address = edx;
324 Register scratch = edi; // scratch_in is no longer valid.
326 // Put holder in place.
327 CallOptimization::HolderLookup holder_lookup;
328 Handle<JSObject> api_holder = optimization.LookupHolderOfExpectedType(
331 switch (holder_lookup) {
332 case CallOptimization::kHolderIsReceiver:
333 __ Move(holder, receiver);
335 case CallOptimization::kHolderFound:
336 __ LoadHeapObject(holder, api_holder);
338 case CallOptimization::kHolderNotFound:
343 Isolate* isolate = masm->isolate();
344 Handle<JSFunction> function = optimization.constant_function();
345 Handle<CallHandlerInfo> api_call_info = optimization.api_call_info();
346 Handle<Object> call_data_obj(api_call_info->data(), isolate);
348 // Put callee in place.
349 __ LoadHeapObject(callee, function);
351 bool call_data_undefined = false;
352 // Put call_data in place.
353 if (isolate->heap()->InNewSpace(*call_data_obj)) {
354 __ mov(scratch, api_call_info);
355 __ mov(call_data, FieldOperand(scratch, CallHandlerInfo::kDataOffset));
356 } else if (call_data_obj->IsUndefined()) {
357 call_data_undefined = true;
358 __ mov(call_data, Immediate(isolate->factory()->undefined_value()));
360 __ mov(call_data, call_data_obj);
363 // Put api_function_address in place.
364 Address function_address = v8::ToCData<Address>(api_call_info->callback());
365 __ mov(api_function_address, Immediate(function_address));
368 CallApiFunctionStub stub(isolate, is_store, call_data_undefined, argc);
369 __ TailCallStub(&stub);
373 // Generate code to check that a global property cell is empty. Create
374 // the property cell at compilation time if no cell exists for the
376 void PropertyHandlerCompiler::GenerateCheckPropertyCell(
377 MacroAssembler* masm, Handle<JSGlobalObject> global, Handle<Name> name,
378 Register scratch, Label* miss) {
379 Handle<PropertyCell> cell =
380 JSGlobalObject::EnsurePropertyCell(global, name);
381 DCHECK(cell->value()->IsTheHole());
382 Handle<Oddball> the_hole = masm->isolate()->factory()->the_hole_value();
383 if (masm->serializer_enabled()) {
384 __ mov(scratch, Immediate(cell));
385 __ cmp(FieldOperand(scratch, PropertyCell::kValueOffset),
386 Immediate(the_hole));
388 __ cmp(Operand::ForCell(cell), Immediate(the_hole));
390 __ j(not_equal, miss);
394 void PropertyAccessCompiler::GenerateTailCall(MacroAssembler* masm,
396 __ jmp(code, RelocInfo::CODE_TARGET);
401 #define __ ACCESS_MASM(masm())
404 void NamedStoreHandlerCompiler::GenerateRestoreName(Label* label,
406 if (!label->is_unused()) {
408 __ mov(this->name(), Immediate(name));
413 // Receiver_reg is preserved on jumps to miss_label, but may be destroyed if
414 // store is successful.
415 void NamedStoreHandlerCompiler::GenerateStoreTransition(
416 Handle<Map> transition, Handle<Name> name, Register receiver_reg,
417 Register storage_reg, Register value_reg, Register scratch1,
418 Register scratch2, Register unused, Label* miss_label, Label* slow) {
419 int descriptor = transition->LastAdded();
420 DescriptorArray* descriptors = transition->instance_descriptors();
421 PropertyDetails details = descriptors->GetDetails(descriptor);
422 Representation representation = details.representation();
423 DCHECK(!representation.IsNone());
425 if (details.type() == CONSTANT) {
426 Handle<Object> constant(descriptors->GetValue(descriptor), isolate());
427 __ CmpObject(value_reg, constant);
428 __ j(not_equal, miss_label);
429 } else if (representation.IsSmi()) {
430 __ JumpIfNotSmi(value_reg, miss_label);
431 } else if (representation.IsHeapObject()) {
432 __ JumpIfSmi(value_reg, miss_label);
433 HeapType* field_type = descriptors->GetFieldType(descriptor);
434 HeapType::Iterator<Map> it = field_type->Classes();
438 __ CompareMap(value_reg, it.Current());
441 __ j(not_equal, miss_label);
444 __ j(equal, &do_store, Label::kNear);
448 } else if (representation.IsDouble()) {
449 Label do_store, heap_number;
450 __ AllocateHeapNumber(storage_reg, scratch1, scratch2, slow, MUTABLE);
452 __ JumpIfNotSmi(value_reg, &heap_number);
453 __ SmiUntag(value_reg);
455 __ fild_s(Operand(esp, 0));
457 __ SmiTag(value_reg);
460 __ bind(&heap_number);
461 __ CheckMap(value_reg, isolate()->factory()->heap_number_map(), miss_label,
463 __ fld_d(FieldOperand(value_reg, HeapNumber::kValueOffset));
466 __ fstp_d(FieldOperand(storage_reg, HeapNumber::kValueOffset));
469 // Stub never generated for objects that require access checks.
470 DCHECK(!transition->is_access_check_needed());
472 // Perform map transition for the receiver if necessary.
473 if (details.type() == FIELD &&
474 Map::cast(transition->GetBackPointer())->unused_property_fields() == 0) {
475 // The properties must be extended before we can store the value.
476 // We jump to a runtime call that extends the properties array.
477 __ pop(scratch1); // Return address.
478 __ push(receiver_reg);
479 __ push(Immediate(transition));
482 __ TailCallExternalReference(
483 ExternalReference(IC_Utility(IC::kSharedStoreIC_ExtendStorage),
489 // Update the map of the object.
490 __ mov(scratch1, Immediate(transition));
491 __ mov(FieldOperand(receiver_reg, HeapObject::kMapOffset), scratch1);
493 // Update the write barrier for the map field.
494 __ RecordWriteField(receiver_reg,
495 HeapObject::kMapOffset,
501 if (details.type() == CONSTANT) {
502 DCHECK(value_reg.is(eax));
507 int index = transition->instance_descriptors()->GetFieldIndex(
508 transition->LastAdded());
510 // Adjust for the number of properties stored in the object. Even in the
511 // face of a transition we can use the old map here because the size of the
512 // object and the number of in-object properties is not going to change.
513 index -= transition->inobject_properties();
515 SmiCheck smi_check = representation.IsTagged()
516 ? INLINE_SMI_CHECK : OMIT_SMI_CHECK;
517 // TODO(verwaest): Share this code as a code stub.
519 // Set the property straight into the object.
520 int offset = transition->instance_size() + (index * kPointerSize);
521 if (representation.IsDouble()) {
522 __ mov(FieldOperand(receiver_reg, offset), storage_reg);
524 __ mov(FieldOperand(receiver_reg, offset), value_reg);
527 if (!representation.IsSmi()) {
528 // Update the write barrier for the array address.
529 if (!representation.IsDouble()) {
530 __ mov(storage_reg, value_reg);
532 __ RecordWriteField(receiver_reg,
540 // Write to the properties array.
541 int offset = index * kPointerSize + FixedArray::kHeaderSize;
542 // Get the properties array (optimistically).
543 __ mov(scratch1, FieldOperand(receiver_reg, JSObject::kPropertiesOffset));
544 if (representation.IsDouble()) {
545 __ mov(FieldOperand(scratch1, offset), storage_reg);
547 __ mov(FieldOperand(scratch1, offset), value_reg);
550 if (!representation.IsSmi()) {
551 // Update the write barrier for the array address.
552 if (!representation.IsDouble()) {
553 __ mov(storage_reg, value_reg);
555 __ RecordWriteField(scratch1,
564 // Return the value (register eax).
565 DCHECK(value_reg.is(eax));
570 void NamedStoreHandlerCompiler::GenerateStoreField(LookupResult* lookup,
573 DCHECK(lookup->representation().IsHeapObject());
574 __ JumpIfSmi(value_reg, miss_label);
575 HeapType::Iterator<Map> it = lookup->GetFieldType()->Classes();
578 __ CompareMap(value_reg, it.Current());
581 __ j(not_equal, miss_label);
584 __ j(equal, &do_store, Label::kNear);
588 StoreFieldStub stub(isolate(), lookup->GetFieldIndex(),
589 lookup->representation());
590 GenerateTailCall(masm(), stub.GetCode());
594 Register PropertyHandlerCompiler::CheckPrototypes(
595 Register object_reg, Register holder_reg, Register scratch1,
596 Register scratch2, Handle<Name> name, Label* miss,
597 PrototypeCheckType check) {
598 Handle<Map> receiver_map(IC::TypeToMap(*type(), isolate()));
600 // Make sure there's no overlap between holder and object registers.
601 DCHECK(!scratch1.is(object_reg) && !scratch1.is(holder_reg));
602 DCHECK(!scratch2.is(object_reg) && !scratch2.is(holder_reg)
603 && !scratch2.is(scratch1));
605 // Keep track of the current object in register reg.
606 Register reg = object_reg;
609 Handle<JSObject> current = Handle<JSObject>::null();
610 if (type()->IsConstant())
611 current = Handle<JSObject>::cast(type()->AsConstant()->Value());
612 Handle<JSObject> prototype = Handle<JSObject>::null();
613 Handle<Map> current_map = receiver_map;
614 Handle<Map> holder_map(holder()->map());
615 // Traverse the prototype chain and check the maps in the prototype chain for
616 // fast and global objects or do negative lookup for normal objects.
617 while (!current_map.is_identical_to(holder_map)) {
620 // Only global objects and objects that do not require access
621 // checks are allowed in stubs.
622 DCHECK(current_map->IsJSGlobalProxyMap() ||
623 !current_map->is_access_check_needed());
625 prototype = handle(JSObject::cast(current_map->prototype()));
626 if (current_map->is_dictionary_map() &&
627 !current_map->IsJSGlobalObjectMap()) {
628 DCHECK(!current_map->IsJSGlobalProxyMap()); // Proxy maps are fast.
629 if (!name->IsUniqueName()) {
630 DCHECK(name->IsString());
631 name = factory()->InternalizeString(Handle<String>::cast(name));
633 DCHECK(current.is_null() ||
634 current->property_dictionary()->FindEntry(name) ==
635 NameDictionary::kNotFound);
637 GenerateDictionaryNegativeLookup(masm(), miss, reg, name,
640 __ mov(scratch1, FieldOperand(reg, HeapObject::kMapOffset));
641 reg = holder_reg; // From now on the object will be in holder_reg.
642 __ mov(reg, FieldOperand(scratch1, Map::kPrototypeOffset));
644 bool in_new_space = heap()->InNewSpace(*prototype);
645 // Two possible reasons for loading the prototype from the map:
646 // (1) Can't store references to new space in code.
647 // (2) Handler is shared for all receivers with the same prototype
648 // map (but not necessarily the same prototype instance).
649 bool load_prototype_from_map = in_new_space || depth == 1;
650 if (depth != 1 || check == CHECK_ALL_MAPS) {
651 __ CheckMap(reg, current_map, miss, DONT_DO_SMI_CHECK);
654 // Check access rights to the global object. This has to happen after
655 // the map check so that we know that the object is actually a global
657 // This allows us to install generated handlers for accesses to the
658 // global proxy (as opposed to using slow ICs). See corresponding code
659 // in LookupForRead().
660 if (current_map->IsJSGlobalProxyMap()) {
661 __ CheckAccessGlobalProxy(reg, scratch1, scratch2, miss);
662 } else if (current_map->IsJSGlobalObjectMap()) {
663 GenerateCheckPropertyCell(
664 masm(), Handle<JSGlobalObject>::cast(current), name,
668 if (load_prototype_from_map) {
669 // Save the map in scratch1 for later.
670 __ mov(scratch1, FieldOperand(reg, HeapObject::kMapOffset));
673 reg = holder_reg; // From now on the object will be in holder_reg.
675 if (load_prototype_from_map) {
676 __ mov(reg, FieldOperand(scratch1, Map::kPrototypeOffset));
678 __ mov(reg, prototype);
682 // Go to the next object in the prototype chain.
684 current_map = handle(current->map());
687 // Log the check depth.
688 LOG(isolate(), IntEvent("check-maps-depth", depth + 1));
690 if (depth != 0 || check == CHECK_ALL_MAPS) {
691 // Check the holder map.
692 __ CheckMap(reg, current_map, miss, DONT_DO_SMI_CHECK);
695 // Perform security check for access to the global object.
696 DCHECK(current_map->IsJSGlobalProxyMap() ||
697 !current_map->is_access_check_needed());
698 if (current_map->IsJSGlobalProxyMap()) {
699 __ CheckAccessGlobalProxy(reg, scratch1, scratch2, miss);
702 // Return the register containing the holder.
707 void NamedLoadHandlerCompiler::FrontendFooter(Handle<Name> name, Label* miss) {
708 if (!miss->is_unused()) {
712 TailCallBuiltin(masm(), MissBuiltin(kind()));
718 void NamedStoreHandlerCompiler::FrontendFooter(Handle<Name> name, Label* miss) {
719 if (!miss->is_unused()) {
722 GenerateRestoreName(miss, name);
723 TailCallBuiltin(masm(), MissBuiltin(kind()));
729 void NamedLoadHandlerCompiler::GenerateLoadCallback(
730 Register reg, Handle<ExecutableAccessorInfo> callback) {
731 // Insert additional parameters into the stack frame above return address.
732 DCHECK(!scratch3().is(reg));
733 __ pop(scratch3()); // Get return address to place it below.
735 STATIC_ASSERT(PropertyCallbackArguments::kHolderIndex == 0);
736 STATIC_ASSERT(PropertyCallbackArguments::kIsolateIndex == 1);
737 STATIC_ASSERT(PropertyCallbackArguments::kReturnValueDefaultValueIndex == 2);
738 STATIC_ASSERT(PropertyCallbackArguments::kReturnValueOffset == 3);
739 STATIC_ASSERT(PropertyCallbackArguments::kDataIndex == 4);
740 STATIC_ASSERT(PropertyCallbackArguments::kThisIndex == 5);
741 __ push(receiver()); // receiver
742 // Push data from ExecutableAccessorInfo.
743 if (isolate()->heap()->InNewSpace(callback->data())) {
744 DCHECK(!scratch2().is(reg));
745 __ mov(scratch2(), Immediate(callback));
746 __ push(FieldOperand(scratch2(), ExecutableAccessorInfo::kDataOffset));
748 __ push(Immediate(Handle<Object>(callback->data(), isolate())));
750 __ push(Immediate(isolate()->factory()->undefined_value())); // ReturnValue
751 // ReturnValue default value
752 __ push(Immediate(isolate()->factory()->undefined_value()));
753 __ push(Immediate(reinterpret_cast<int>(isolate())));
754 __ push(reg); // holder
756 // Save a pointer to where we pushed the arguments. This will be
757 // passed as the const PropertyAccessorInfo& to the C++ callback.
760 __ push(name()); // name
762 __ push(scratch3()); // Restore return address.
764 // Abi for CallApiGetter
765 Register getter_address = edx;
766 Address function_address = v8::ToCData<Address>(callback->getter());
767 __ mov(getter_address, Immediate(function_address));
769 CallApiGetterStub stub(isolate());
770 __ TailCallStub(&stub);
774 void NamedLoadHandlerCompiler::GenerateLoadConstant(Handle<Object> value) {
775 // Return the constant value.
776 __ LoadObject(eax, value);
781 void NamedLoadHandlerCompiler::GenerateLoadInterceptor(Register holder_reg,
782 LookupResult* lookup,
784 DCHECK(holder()->HasNamedInterceptor());
785 DCHECK(!holder()->GetNamedInterceptor()->getter()->IsUndefined());
787 // So far the most popular follow ups for interceptor loads are FIELD
788 // and CALLBACKS, so inline only them, other cases may be added
790 bool compile_followup_inline = false;
791 if (lookup->IsFound() && lookup->IsCacheable()) {
792 if (lookup->IsField()) {
793 compile_followup_inline = true;
794 } else if (lookup->type() == CALLBACKS &&
795 lookup->GetCallbackObject()->IsExecutableAccessorInfo()) {
796 Handle<ExecutableAccessorInfo> callback(
797 ExecutableAccessorInfo::cast(lookup->GetCallbackObject()));
798 compile_followup_inline =
799 callback->getter() != NULL &&
800 ExecutableAccessorInfo::IsCompatibleReceiverType(isolate(), callback,
805 if (compile_followup_inline) {
806 // Compile the interceptor call, followed by inline code to load the
807 // property from further up the prototype chain if the call fails.
808 // Check that the maps haven't changed.
809 DCHECK(holder_reg.is(receiver()) || holder_reg.is(scratch1()));
811 // Preserve the receiver register explicitly whenever it is different from
812 // the holder and it is needed should the interceptor return without any
813 // result. The CALLBACKS case needs the receiver to be passed into C++ code,
814 // the FIELD case might cause a miss during the prototype check.
815 bool must_perfrom_prototype_check = *holder() != lookup->holder();
816 bool must_preserve_receiver_reg = !receiver().is(holder_reg) &&
817 (lookup->type() == CALLBACKS || must_perfrom_prototype_check);
819 // Save necessary data before invoking an interceptor.
820 // Requires a frame to make GC aware of pushed pointers.
822 FrameScope frame_scope(masm(), StackFrame::INTERNAL);
824 if (must_preserve_receiver_reg) {
828 __ push(this->name());
830 // Invoke an interceptor. Note: map checks from receiver to
831 // interceptor's holder has been compiled before (see a caller
833 CompileCallLoadPropertyWithInterceptor(
834 masm(), receiver(), holder_reg, this->name(), holder(),
835 IC::kLoadPropertyWithInterceptorOnly);
837 // Check if interceptor provided a value for property. If it's
838 // the case, return immediately.
839 Label interceptor_failed;
840 __ cmp(eax, factory()->no_interceptor_result_sentinel());
841 __ j(equal, &interceptor_failed);
842 frame_scope.GenerateLeaveFrame();
845 // Clobber registers when generating debug-code to provoke errors.
846 __ bind(&interceptor_failed);
847 if (FLAG_debug_code) {
848 __ mov(receiver(), Immediate(BitCast<int32_t>(kZapValue)));
849 __ mov(holder_reg, Immediate(BitCast<int32_t>(kZapValue)));
850 __ mov(this->name(), Immediate(BitCast<int32_t>(kZapValue)));
853 __ pop(this->name());
855 if (must_preserve_receiver_reg) {
859 // Leave the internal frame.
862 GenerateLoadPostInterceptor(holder_reg, name, lookup);
863 } else { // !compile_followup_inline
864 // Call the runtime system to load the interceptor.
865 // Check that the maps haven't changed.
866 __ pop(scratch2()); // save old return address
867 PushInterceptorArguments(masm(), receiver(), holder_reg, this->name(),
869 __ push(scratch2()); // restore old return address
871 ExternalReference ref =
872 ExternalReference(IC_Utility(IC::kLoadPropertyWithInterceptor),
874 __ TailCallExternalReference(
875 ref, NamedLoadHandlerCompiler::kInterceptorArgsLength, 1);
880 Handle<Code> NamedStoreHandlerCompiler::CompileStoreCallback(
881 Handle<JSObject> object, Handle<Name> name,
882 Handle<ExecutableAccessorInfo> callback) {
883 Register holder_reg = Frontend(receiver(), name);
885 __ pop(scratch1()); // remove the return address
891 __ push(scratch1()); // restore return address
893 // Do tail-call to the runtime system.
894 ExternalReference store_callback_property =
895 ExternalReference(IC_Utility(IC::kStoreCallbackProperty), isolate());
896 __ TailCallExternalReference(store_callback_property, 5, 1);
898 // Return the generated code.
899 return GetCode(kind(), Code::FAST, name);
904 #define __ ACCESS_MASM(masm)
907 void NamedStoreHandlerCompiler::GenerateStoreViaSetter(
908 MacroAssembler* masm, Handle<HeapType> type, Register receiver,
909 Handle<JSFunction> setter) {
910 // ----------- S t a t e -------------
911 // -- esp[0] : return address
912 // -----------------------------------
914 FrameScope scope(masm, StackFrame::INTERNAL);
916 // Save value register, so we can restore it later.
919 if (!setter.is_null()) {
920 // Call the JavaScript setter with receiver and value on the stack.
921 if (IC::TypeToMap(*type, masm->isolate())->IsJSGlobalObjectMap()) {
922 // Swap in the global receiver.
924 FieldOperand(receiver, JSGlobalObject::kGlobalProxyOffset));
928 ParameterCount actual(1);
929 ParameterCount expected(setter);
930 __ InvokeFunction(setter, expected, actual,
931 CALL_FUNCTION, NullCallWrapper());
933 // If we generate a global code snippet for deoptimization only, remember
934 // the place to continue after deoptimization.
935 masm->isolate()->heap()->SetSetterStubDeoptPCOffset(masm->pc_offset());
938 // We have to return the passed value, not the return value of the setter.
941 // Restore context register.
942 __ mov(esi, Operand(ebp, StandardFrameConstants::kContextOffset));
949 #define __ ACCESS_MASM(masm())
952 Handle<Code> NamedStoreHandlerCompiler::CompileStoreInterceptor(
954 __ pop(scratch1()); // remove the return address
956 __ push(this->name());
958 __ push(scratch1()); // restore return address
960 // Do tail-call to the runtime system.
961 ExternalReference store_ic_property = ExternalReference(
962 IC_Utility(IC::kStorePropertyWithInterceptor), isolate());
963 __ TailCallExternalReference(store_ic_property, 3, 1);
965 // Return the generated code.
966 return GetCode(kind(), Code::FAST, name);
970 Handle<Code> PropertyICCompiler::CompileKeyedStorePolymorphic(
971 MapHandleList* receiver_maps, CodeHandleList* handler_stubs,
972 MapHandleList* transitioned_maps) {
974 __ JumpIfSmi(receiver(), &miss, Label::kNear);
975 __ mov(scratch1(), FieldOperand(receiver(), HeapObject::kMapOffset));
976 for (int i = 0; i < receiver_maps->length(); ++i) {
977 __ cmp(scratch1(), receiver_maps->at(i));
978 if (transitioned_maps->at(i).is_null()) {
979 __ j(equal, handler_stubs->at(i));
982 __ j(not_equal, &next_map, Label::kNear);
983 __ mov(transition_map(), Immediate(transitioned_maps->at(i)));
984 __ jmp(handler_stubs->at(i), RelocInfo::CODE_TARGET);
989 TailCallBuiltin(masm(), MissBuiltin(kind()));
991 // Return the generated code.
992 return GetCode(kind(), Code::NORMAL, factory()->empty_string(), POLYMORPHIC);
996 Register* PropertyAccessCompiler::load_calling_convention() {
997 // receiver, name, scratch1, scratch2, scratch3, scratch4.
998 Register receiver = LoadIC::ReceiverRegister();
999 Register name = LoadIC::NameRegister();
1000 static Register registers[] = { receiver, name, ebx, eax, edi, no_reg };
1005 Register* PropertyAccessCompiler::store_calling_convention() {
1006 // receiver, name, scratch1, scratch2, scratch3.
1007 Register receiver = StoreIC::ReceiverRegister();
1008 Register name = StoreIC::NameRegister();
1009 DCHECK(ebx.is(KeyedStoreIC::MapRegister()));
1010 static Register registers[] = { receiver, name, ebx, edi, no_reg };
1015 Register NamedStoreHandlerCompiler::value() { return StoreIC::ValueRegister(); }
1019 #define __ ACCESS_MASM(masm)
1022 void NamedLoadHandlerCompiler::GenerateLoadViaGetter(
1023 MacroAssembler* masm, Handle<HeapType> type, Register receiver,
1024 Handle<JSFunction> getter) {
1026 FrameScope scope(masm, StackFrame::INTERNAL);
1028 if (!getter.is_null()) {
1029 // Call the JavaScript getter with the receiver on the stack.
1030 if (IC::TypeToMap(*type, masm->isolate())->IsJSGlobalObjectMap()) {
1031 // Swap in the global receiver.
1033 FieldOperand(receiver, JSGlobalObject::kGlobalProxyOffset));
1036 ParameterCount actual(0);
1037 ParameterCount expected(getter);
1038 __ InvokeFunction(getter, expected, actual,
1039 CALL_FUNCTION, NullCallWrapper());
1041 // If we generate a global code snippet for deoptimization only, remember
1042 // the place to continue after deoptimization.
1043 masm->isolate()->heap()->SetGetterStubDeoptPCOffset(masm->pc_offset());
1046 // Restore context register.
1047 __ mov(esi, Operand(ebp, StandardFrameConstants::kContextOffset));
1054 #define __ ACCESS_MASM(masm())
1057 Handle<Code> NamedLoadHandlerCompiler::CompileLoadGlobal(
1058 Handle<PropertyCell> cell, Handle<Name> name, bool is_configurable) {
1061 FrontendHeader(receiver(), name, &miss);
1062 // Get the value from the cell.
1063 Register result = StoreIC::ValueRegister();
1064 if (masm()->serializer_enabled()) {
1065 __ mov(result, Immediate(cell));
1066 __ mov(result, FieldOperand(result, PropertyCell::kValueOffset));
1068 __ mov(result, Operand::ForCell(cell));
1071 // Check for deleted property if property can actually be deleted.
1072 if (is_configurable) {
1073 __ cmp(result, factory()->the_hole_value());
1075 } else if (FLAG_debug_code) {
1076 __ cmp(result, factory()->the_hole_value());
1077 __ Check(not_equal, kDontDeleteCellsCannotContainTheHole);
1080 Counters* counters = isolate()->counters();
1081 __ IncrementCounter(counters->named_load_global_stub(), 1);
1082 // The code above already loads the result into the return register.
1085 FrontendFooter(name, &miss);
1087 // Return the generated code.
1088 return GetCode(kind(), Code::NORMAL, name);
1092 Handle<Code> PropertyICCompiler::CompilePolymorphic(TypeHandleList* types,
1093 CodeHandleList* handlers,
1095 Code::StubType type,
1096 IcCheckType check) {
1099 if (check == PROPERTY &&
1100 (kind() == Code::KEYED_LOAD_IC || kind() == Code::KEYED_STORE_IC)) {
1101 // In case we are compiling an IC for dictionary loads and stores, just
1102 // check whether the name is unique.
1103 if (name.is_identical_to(isolate()->factory()->normal_ic_symbol())) {
1104 __ JumpIfNotUniqueName(this->name(), &miss);
1106 __ cmp(this->name(), Immediate(name));
1107 __ j(not_equal, &miss);
1112 Label* smi_target = IncludesNumberType(types) ? &number_case : &miss;
1113 __ JumpIfSmi(receiver(), smi_target);
1115 // Polymorphic keyed stores may use the map register
1116 Register map_reg = scratch1();
1117 DCHECK(kind() != Code::KEYED_STORE_IC ||
1118 map_reg.is(KeyedStoreIC::MapRegister()));
1119 __ mov(map_reg, FieldOperand(receiver(), HeapObject::kMapOffset));
1120 int receiver_count = types->length();
1121 int number_of_handled_maps = 0;
1122 for (int current = 0; current < receiver_count; ++current) {
1123 Handle<HeapType> type = types->at(current);
1124 Handle<Map> map = IC::TypeToMap(*type, isolate());
1125 if (!map->is_deprecated()) {
1126 number_of_handled_maps++;
1127 __ cmp(map_reg, map);
1128 if (type->Is(HeapType::Number())) {
1129 DCHECK(!number_case.is_unused());
1130 __ bind(&number_case);
1132 __ j(equal, handlers->at(current));
1135 DCHECK(number_of_handled_maps != 0);
1138 TailCallBuiltin(masm(), MissBuiltin(kind()));
1140 // Return the generated code.
1141 InlineCacheState state =
1142 number_of_handled_maps > 1 ? POLYMORPHIC : MONOMORPHIC;
1143 return GetCode(kind(), type, name, state);
1148 #define __ ACCESS_MASM(masm)
1151 void ElementHandlerCompiler::GenerateLoadDictionaryElement(
1152 MacroAssembler* masm) {
1153 // ----------- S t a t e -------------
1155 // -- edx : receiver
1156 // -- esp[0] : return address
1157 // -----------------------------------
1158 DCHECK(edx.is(LoadIC::ReceiverRegister()));
1159 DCHECK(ecx.is(LoadIC::NameRegister()));
1162 // This stub is meant to be tail-jumped to, the receiver must already
1163 // have been verified by the caller to not be a smi.
1164 __ JumpIfNotSmi(ecx, &miss);
1167 __ mov(eax, FieldOperand(edx, JSObject::kElementsOffset));
1169 // Push receiver on the stack to free up a register for the dictionary
1172 __ LoadFromNumberDictionary(&slow, eax, ecx, ebx, edx, edi, eax);
1173 // Pop receiver before returning.
1180 // ----------- S t a t e -------------
1182 // -- edx : receiver
1183 // -- esp[0] : return address
1184 // -----------------------------------
1185 TailCallBuiltin(masm, Builtins::kKeyedLoadIC_Slow);
1188 // ----------- S t a t e -------------
1190 // -- edx : receiver
1191 // -- esp[0] : return address
1192 // -----------------------------------
1193 TailCallBuiltin(masm, Builtins::kKeyedLoadIC_Miss);
1199 } } // namespace v8::internal
1201 #endif // V8_TARGET_ARCH_X87