Reviewers: Toon Verwaest,
Message:
As discussed.
Description:
Restore performance of accesses to JSGlobalProxy after r22802
Please review this at https://codereview.chromium.org/446523002/
SVN Base: https://v8.googlecode.com/svn/branches/bleeding_edge
Affected files (+41, -14 lines):
M src/arm/stub-cache-arm.cc
M src/arm64/stub-cache-arm64.cc
M src/ia32/stub-cache-ia32.cc
M src/ic.cc
M src/mips/stub-cache-mips.cc
M src/mips64/stub-cache-mips64.cc
M src/x64/stub-cache-x64.cc
M src/x87/stub-cache-x87.cc
Index: src/arm/stub-cache-arm.cc
diff --git a/src/arm/stub-cache-arm.cc b/src/arm/stub-cache-arm.cc
index
78cc3382a8178b98effcaa1c45e6ceb01df1527b..c7ce8b32c4bf49352d5e68f1329a0862e2346237
100644
--- a/src/arm/stub-cache-arm.cc
+++ b/src/arm/stub-cache-arm.cc
@@ -740,8 +740,8 @@ Register PropertyHandlerCompiler::CheckPrototypes(
prototype = handle(JSObject::cast(current_map->prototype()));
if (current_map->is_dictionary_map() &&
- !current_map->IsJSGlobalObjectMap() &&
- !current_map->IsJSGlobalProxyMap()) {
+ !current_map->IsJSGlobalObjectMap()) {
+ DCHECK(!current_map->IsJSGlobalProxyMap()); // Proxy maps are fast.
if (!name->IsUniqueName()) {
DCHECK(name->IsString());
name = factory()->InternalizeString(Handle<String>::cast(name));
@@ -768,6 +768,9 @@ Register PropertyHandlerCompiler::CheckPrototypes(
// Check access rights to the global object. This has to happen
after
// the map check so that we know that the object is actually a global
// object.
+ // This allows us to install generated handlers for accesses to the
+ // global proxy (as opposed to using slow ICs). See corresponding
code
+ // in LookupForRead().
if (current_map->IsJSGlobalProxyMap()) {
__ CheckAccessGlobalProxy(reg, scratch2, miss);
} else if (current_map->IsJSGlobalObjectMap()) {
Index: src/arm64/stub-cache-arm64.cc
diff --git a/src/arm64/stub-cache-arm64.cc b/src/arm64/stub-cache-arm64.cc
index
1bd2ac8fed959bbf7fd1595992ae5a52955a8dd6..9c07c0a06ddab645619dc2e025c91aa012f92e78
100644
--- a/src/arm64/stub-cache-arm64.cc
+++ b/src/arm64/stub-cache-arm64.cc
@@ -691,8 +691,8 @@ Register PropertyHandlerCompiler::CheckPrototypes(
prototype = handle(JSObject::cast(current_map->prototype()));
if (current_map->is_dictionary_map() &&
- !current_map->IsJSGlobalObjectMap() &&
- !current_map->IsJSGlobalProxyMap()) {
+ !current_map->IsJSGlobalObjectMap()) {
+ DCHECK(!current_map->IsJSGlobalProxyMap()); // Proxy maps are fast.
if (!name->IsUniqueName()) {
DCHECK(name->IsString());
name = factory()->InternalizeString(Handle<String>::cast(name));
@@ -724,6 +724,9 @@ Register PropertyHandlerCompiler::CheckPrototypes(
// Check access rights to the global object. This has to happen
after
// the map check so that we know that the object is actually a global
// object.
+ // This allows us to install generated handlers for accesses to the
+ // global proxy (as opposed to using slow ICs). See corresponding
code
+ // in LookupForRead().
if (current_map->IsJSGlobalProxyMap()) {
UseScratchRegisterScope temps(masm());
__ CheckAccessGlobalProxy(reg, scratch2, temps.AcquireX(), miss);
Index: src/ia32/stub-cache-ia32.cc
diff --git a/src/ia32/stub-cache-ia32.cc b/src/ia32/stub-cache-ia32.cc
index
7a76e1474209f95b281fed9c242cc438233cad59..e6f2d2b8bf975794e63a183c805604579bdeb78f
100644
--- a/src/ia32/stub-cache-ia32.cc
+++ b/src/ia32/stub-cache-ia32.cc
@@ -708,8 +708,8 @@ Register PropertyHandlerCompiler::CheckPrototypes(
prototype = handle(JSObject::cast(current_map->prototype()));
if (current_map->is_dictionary_map() &&
- !current_map->IsJSGlobalObjectMap() &&
- !current_map->IsJSGlobalProxyMap()) {
+ !current_map->IsJSGlobalObjectMap()) {
+ DCHECK(!current_map->IsJSGlobalProxyMap()); // Proxy maps are fast.
if (!name->IsUniqueName()) {
DCHECK(name->IsString());
name = factory()->InternalizeString(Handle<String>::cast(name));
@@ -738,6 +738,9 @@ Register PropertyHandlerCompiler::CheckPrototypes(
// Check access rights to the global object. This has to happen
after
// the map check so that we know that the object is actually a global
// object.
+ // This allows us to install generated handlers for accesses to the
+ // global proxy (as opposed to using slow ICs). See corresponding
code
+ // in LookupForRead().
if (current_map->IsJSGlobalProxyMap()) {
__ CheckAccessGlobalProxy(reg, scratch1, scratch2, miss);
} else if (current_map->IsJSGlobalObjectMap()) {
Index: src/ic.cc
diff --git a/src/ic.cc b/src/ic.cc
index
bbfb2dd781283d5d03b43d3710401fa0e8779d05..a41366daf1e0dac081aba55d7fb8dc5e11e16e9b
100644
--- a/src/ic.cc
+++ b/src/ic.cc
@@ -211,6 +211,12 @@ static void LookupForRead(LookupIterator* it) {
break;
}
case LookupIterator::ACCESS_CHECK:
+ // PropertyHandlerCompiler::CheckPrototypes() knows how to emit
+ // access checks for global proxies.
+ if (it->GetHolder<JSObject>()->IsJSGlobalProxy() &&
+ it->HasAccess(v8::ACCESS_GET)) {
+ break;
+ }
return;
case LookupIterator::PROPERTY:
if (it->HasProperty()) return; // Yay!
Index: src/mips/stub-cache-mips.cc
diff --git a/src/mips/stub-cache-mips.cc b/src/mips/stub-cache-mips.cc
index
6eaa90fb607118e5d2f8ae44564d6bf3b21a7ab9..40222a50f80f05f6de9a05295d500887eab3f19b
100644
--- a/src/mips/stub-cache-mips.cc
+++ b/src/mips/stub-cache-mips.cc
@@ -739,8 +739,8 @@ Register PropertyHandlerCompiler::CheckPrototypes(
prototype = handle(JSObject::cast(current_map->prototype()));
if (current_map->is_dictionary_map() &&
- !current_map->IsJSGlobalObjectMap() &&
- !current_map->IsJSGlobalProxyMap()) {
+ !current_map->IsJSGlobalObjectMap()) {
+ DCHECK(!current_map->IsJSGlobalProxyMap()); // Proxy maps are fast.
if (!name->IsUniqueName()) {
DCHECK(name->IsString());
name = factory()->InternalizeString(Handle<String>::cast(name));
@@ -767,6 +767,9 @@ Register PropertyHandlerCompiler::CheckPrototypes(
// Check access rights to the global object. This has to happen
after
// the map check so that we know that the object is actually a global
// object.
+ // This allows us to install generated handlers for accesses to the
+ // global proxy (as opposed to using slow ICs). See corresponding
code
+ // in LookupForRead().
if (current_map->IsJSGlobalProxyMap()) {
__ CheckAccessGlobalProxy(reg, scratch2, miss);
} else if (current_map->IsJSGlobalObjectMap()) {
Index: src/mips64/stub-cache-mips64.cc
diff --git a/src/mips64/stub-cache-mips64.cc
b/src/mips64/stub-cache-mips64.cc
index
939c28faa0d8d0606b261ea49b9eba732c5bb683..c2efd97b0bb85a7f12dc75ffd954eaa588504351
100644
--- a/src/mips64/stub-cache-mips64.cc
+++ b/src/mips64/stub-cache-mips64.cc
@@ -743,8 +743,8 @@ Register PropertyHandlerCompiler::CheckPrototypes(
prototype = handle(JSObject::cast(current_map->prototype()));
if (current_map->is_dictionary_map() &&
- !current_map->IsJSGlobalObjectMap() &&
- !current_map->IsJSGlobalProxyMap()) {
+ !current_map->IsJSGlobalObjectMap()) {
+ DCHECK(!current_map->IsJSGlobalProxyMap()); // Proxy maps are fast.
if (!name->IsUniqueName()) {
DCHECK(name->IsString());
name = factory()->InternalizeString(Handle<String>::cast(name));
@@ -777,6 +777,9 @@ Register PropertyHandlerCompiler::CheckPrototypes(
// Check access rights to the global object. This has to happen
after
// the map check so that we know that the object is actually a global
// object.
+ // This allows us to install generated handlers for accesses to the
+ // global proxy (as opposed to using slow ICs). See corresponding
code
+ // in LookupForRead().
if (current_map->IsJSGlobalProxyMap()) {
__ CheckAccessGlobalProxy(reg, scratch2, miss);
} else if (current_map->IsJSGlobalObjectMap()) {
Index: src/x64/stub-cache-x64.cc
diff --git a/src/x64/stub-cache-x64.cc b/src/x64/stub-cache-x64.cc
index
69781ebea1551a7e8c18906b3fe8e755ffd1833e..7ef59cd8202705afa528a2d1aa1fbabaf35b3f26
100644
--- a/src/x64/stub-cache-x64.cc
+++ b/src/x64/stub-cache-x64.cc
@@ -651,8 +651,8 @@ Register PropertyHandlerCompiler::CheckPrototypes(
prototype = handle(JSObject::cast(current_map->prototype()));
if (current_map->is_dictionary_map() &&
- !current_map->IsJSGlobalObjectMap() &&
- !current_map->IsJSGlobalProxyMap()) {
+ !current_map->IsJSGlobalObjectMap()) {
+ DCHECK(!current_map->IsJSGlobalProxyMap()); // Proxy maps are fast.
if (!name->IsUniqueName()) {
DCHECK(name->IsString());
name = factory()->InternalizeString(Handle<String>::cast(name));
@@ -685,6 +685,9 @@ Register PropertyHandlerCompiler::CheckPrototypes(
// Check access rights to the global object. This has to happen
after
// the map check so that we know that the object is actually a global
// object.
+ // This allows us to install generated handlers for accesses to the
+ // global proxy (as opposed to using slow ICs). See corresponding
code
+ // in LookupForRead().
if (current_map->IsJSGlobalProxyMap()) {
__ CheckAccessGlobalProxy(reg, scratch2, miss);
} else if (current_map->IsJSGlobalObjectMap()) {
Index: src/x87/stub-cache-x87.cc
diff --git a/src/x87/stub-cache-x87.cc b/src/x87/stub-cache-x87.cc
index
0574cb03a42f9fb24e3081e7a85ca3e55b782611..0d67c545c007ff349a483729f96ef85896c9836d
100644
--- a/src/x87/stub-cache-x87.cc
+++ b/src/x87/stub-cache-x87.cc
@@ -710,8 +710,8 @@ Register PropertyHandlerCompiler::CheckPrototypes(
prototype = handle(JSObject::cast(current_map->prototype()));
if (current_map->is_dictionary_map() &&
- !current_map->IsJSGlobalObjectMap() &&
- !current_map->IsJSGlobalProxyMap()) {
+ !current_map->IsJSGlobalObjectMap()) {
+ DCHECK(!current_map->IsJSGlobalProxyMap()); // Proxy maps are fast.
if (!name->IsUniqueName()) {
DCHECK(name->IsString());
name = factory()->InternalizeString(Handle<String>::cast(name));
@@ -740,6 +740,9 @@ Register PropertyHandlerCompiler::CheckPrototypes(
// Check access rights to the global object. This has to happen
after
// the map check so that we know that the object is actually a global
// object.
+ // This allows us to install generated handlers for accesses to the
+ // global proxy (as opposed to using slow ICs). See corresponding
code
+ // in LookupForRead().
if (current_map->IsJSGlobalProxyMap()) {
__ CheckAccessGlobalProxy(reg, scratch1, scratch2, miss);
} else if (current_map->IsJSGlobalObjectMap()) {
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
