Revision: 2556
Author: [email protected]
Date: Tue Jul 28 05:46:08 2009
Log: Fix pixel array support for x64 and make the fast Array functions
that use JSARRAY_HAS_FAST_ELEMENTS_CHECK a bit safer in the presence
of pixel arrays.
Review URL: http://codereview.chromium.org/159500
http://code.google.com/p/v8/source/detail?r=2556
Modified:
/branches/bleeding_edge/src/arm/stub-cache-arm.cc
/branches/bleeding_edge/src/ia32/stub-cache-ia32.cc
/branches/bleeding_edge/src/x64/ic-x64.cc
/branches/bleeding_edge/src/x64/stub-cache-x64.cc
=======================================
--- /branches/bleeding_edge/src/arm/stub-cache-arm.cc Tue Jul 28 04:42:18
2009
+++ /branches/bleeding_edge/src/arm/stub-cache-arm.cc Tue Jul 28 05:46:08
2009
@@ -678,13 +678,13 @@
case JSARRAY_HAS_FAST_ELEMENTS_CHECK:
CheckPrototypes(JSObject::cast(object), r1, holder, r3, r2, name,
&miss);
- // Make sure object->elements()->map() != Heap::hash_table_map()
+ // Make sure object->HasFastElements().
// Get the elements array of the object.
__ ldr(r3, FieldMemOperand(r1, JSObject::kElementsOffset));
// Check that the object is in fast mode (not dictionary).
__ ldr(r2, FieldMemOperand(r3, HeapObject::kMapOffset));
- __ cmp(r2, Operand(Factory::hash_table_map()));
- __ b(eq, &miss);
+ __ cmp(r2, Operand(Factory::fixed_array_map()));
+ __ b(ne, &miss);
break;
default:
=======================================
--- /branches/bleeding_edge/src/ia32/stub-cache-ia32.cc Tue Jul 28 04:42:18
2009
+++ /branches/bleeding_edge/src/ia32/stub-cache-ia32.cc Tue Jul 28 05:46:08
2009
@@ -680,13 +680,13 @@
case JSARRAY_HAS_FAST_ELEMENTS_CHECK:
CheckPrototypes(JSObject::cast(object), edx, holder,
ebx, ecx, name, &miss);
- // Make sure object->elements()->map() !=
Heap::dictionary_array_map()
+ // Make sure object->HasFastElements().
// Get the elements array of the object.
__ mov(ebx, FieldOperand(edx, JSObject::kElementsOffset));
// Check that the object is in fast mode (not dictionary).
__ cmp(FieldOperand(ebx, HeapObject::kMapOffset),
- Immediate(Factory::hash_table_map()));
- __ j(equal, &miss, not_taken);
+ Immediate(Factory::fixed_array_map()));
+ __ j(not_equal, &miss, not_taken);
break;
default:
=======================================
--- /branches/bleeding_edge/src/x64/ic-x64.cc Tue Jul 28 01:22:48 2009
+++ /branches/bleeding_edge/src/x64/ic-x64.cc Tue Jul 28 05:46:08 2009
@@ -87,8 +87,7 @@
// Check that the properties array is a dictionary.
__ movq(r0, FieldOperand(r1, JSObject::kPropertiesOffset));
- __ Cmp(FieldOperand(r0, HeapObject::kMapOffset),
- Factory::hash_table_map());
+ __ Cmp(FieldOperand(r0, HeapObject::kMapOffset),
Factory::hash_table_map());
__ j(not_equal, miss_label);
// Compute the capacity mask.
@@ -243,8 +242,8 @@
__ bind(&index_int);
__ movq(rcx, FieldOperand(rcx, JSObject::kElementsOffset));
// Check that the object is in fast mode (not dictionary).
- __ Cmp(FieldOperand(rcx, HeapObject::kMapOffset),
Factory::hash_table_map());
- __ j(equal, &slow);
+ __ Cmp(FieldOperand(rcx, HeapObject::kMapOffset),
Factory::fixed_array_map());
+ __ j(not_equal, &slow);
// Check that the key (index) is within bounds.
__ cmpl(rax, FieldOperand(rcx, FixedArray::kLengthOffset));
__ j(below, &fast); // Unsigned comparison rejects negative indices.
@@ -387,8 +386,8 @@
// rbx: index (as a smi)
__ movq(rcx, FieldOperand(rdx, JSObject::kElementsOffset));
// Check that the object is in fast mode (not dictionary).
- __ Cmp(FieldOperand(rcx, HeapObject::kMapOffset),
Factory::hash_table_map());
- __ j(equal, &slow);
+ __ Cmp(FieldOperand(rcx, HeapObject::kMapOffset),
Factory::fixed_array_map());
+ __ j(not_equal, &slow);
// Untag the key (for checking against untagged length in the fixed
array).
__ movl(rdx, rbx);
__ sarl(rdx, Immediate(kSmiTagSize));
@@ -438,8 +437,8 @@
// rdx: JSArray
// rbx: index (as a smi)
__ movq(rcx, FieldOperand(rdx, JSObject::kElementsOffset));
- __ Cmp(FieldOperand(rcx, HeapObject::kMapOffset),
Factory::hash_table_map());
- __ j(equal, &slow);
+ __ Cmp(FieldOperand(rcx, HeapObject::kMapOffset),
Factory::fixed_array_map());
+ __ j(not_equal, &slow);
// Check the key against the length in the array, compute the
// address to store into and fall through to fast case.
=======================================
--- /branches/bleeding_edge/src/x64/stub-cache-x64.cc Tue Jul 28 04:42:18
2009
+++ /branches/bleeding_edge/src/x64/stub-cache-x64.cc Tue Jul 28 05:46:08
2009
@@ -133,13 +133,13 @@
case JSARRAY_HAS_FAST_ELEMENTS_CHECK:
CheckPrototypes(JSObject::cast(object), rdx, holder,
rbx, rcx, name, &miss);
- // Make sure object->elements()->map() !=
Heap::dictionary_array_map()
+ // Make sure object->HasFastElements().
// Get the elements array of the object.
__ movq(rbx, FieldOperand(rdx, JSObject::kElementsOffset));
// Check that the object is in fast mode (not dictionary).
__ Cmp(FieldOperand(rbx, HeapObject::kMapOffset),
- Factory::hash_table_map());
- __ j(equal, &miss);
+ Factory::fixed_array_map());
+ __ j(not_equal, &miss);
break;
default:
--~--~---------~--~----~------------~-------~--~----~
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
-~----------~----~----~----~------~----~------~--~---
