Reviewers: Toon Verwaest,
Message:
PTAL
Description:
Use weak cell to embed function in DirectLoadGlobalFunctionPrototype.
BUG=v8:3629
LOG=N
Please review this at https://codereview.chromium.org/778673002/
Base URL: https://chromium.googlesource.com/v8/v8.git@master
Affected files (+44, -33 lines):
M src/ic/arm/handler-compiler-arm.cc
M src/ic/arm64/handler-compiler-arm64.cc
M src/ic/handler-compiler.h
M src/ic/handler-compiler.cc
M src/ic/ia32/handler-compiler-ia32.cc
M src/ic/x64/handler-compiler-x64.cc
Index: src/ic/arm/handler-compiler-arm.cc
diff --git a/src/ic/arm/handler-compiler-arm.cc
b/src/ic/arm/handler-compiler-arm.cc
index
8827d36bf26fa50d13601de6b2c212b80fd081c4..c71e948d631447cac7090698c80f7bc1c6e07b28
100644
--- a/src/ic/arm/handler-compiler-arm.cc
+++ b/src/ic/arm/handler-compiler-arm.cc
@@ -140,26 +140,26 @@ void
PropertyHandlerCompiler::GenerateDictionaryNegativeLookup(
void NamedLoadHandlerCompiler::GenerateDirectLoadGlobalFunctionPrototype(
- MacroAssembler* masm, int index, Register prototype, Label* miss) {
+ MacroAssembler* masm, int index, Register prototype, Register scratch,
+ Label* miss) {
Isolate* isolate = masm->isolate();
// Get the global function with the given index.
- Handle<JSFunction> function(
+ Handle<JSFunction> jsfunction(
JSFunction::cast(isolate->native_context()->get(index)));
-
+ Handle<WeakCell> cell = isolate->factory()->NewWeakCell(jsfunction);
// Check we're still in the same context.
- Register scratch = prototype;
+ Register function = prototype;
const int offset = Context::SlotOffset(Context::GLOBAL_OBJECT_INDEX);
__ ldr(scratch, MemOperand(cp, offset));
__ ldr(scratch, FieldMemOperand(scratch,
GlobalObject::kNativeContextOffset));
- __ ldr(scratch, MemOperand(scratch, Context::SlotOffset(index)));
- __ Move(ip, function);
- __ cmp(ip, scratch);
+ __ ldr(function, MemOperand(scratch, Context::SlotOffset(index)));
+ __ CmpWeakValue(function, cell, scratch);
__ b(ne, miss);
-
// Load its initial map. The global functions all have initial maps.
- __ Move(prototype, Handle<Map>(function->initial_map()));
+ __ ldr(scratch,
+ FieldMemOperand(function,
JSFunction::kPrototypeOrInitialMapOffset));
// Load the prototype from the initial map.
- __ ldr(prototype, FieldMemOperand(prototype, Map::kPrototypeOffset));
+ __ ldr(prototype, FieldMemOperand(scratch, Map::kPrototypeOffset));
}
Index: src/ic/arm64/handler-compiler-arm64.cc
diff --git a/src/ic/arm64/handler-compiler-arm64.cc
b/src/ic/arm64/handler-compiler-arm64.cc
index
8571faec714fa05b8a250b4d88310d21aa15cb6b..64f615841698718d651d3f842a66293246623426
100644
--- a/src/ic/arm64/handler-compiler-arm64.cc
+++ b/src/ic/arm64/handler-compiler-arm64.cc
@@ -57,24 +57,27 @@ void
PropertyHandlerCompiler::GenerateDictionaryNegativeLookup(
void NamedLoadHandlerCompiler::GenerateDirectLoadGlobalFunctionPrototype(
- MacroAssembler* masm, int index, Register prototype, Label* miss) {
+ MacroAssembler* masm, int index, Register prototype, Register scratch,
+ Label* miss) {
Isolate* isolate = masm->isolate();
// Get the global function with the given index.
- Handle<JSFunction> function(
+ Handle<JSFunction> jsfunction(
JSFunction::cast(isolate->native_context()->get(index)));
+ Handle<WeakCell> cell = isolate->factory()->NewWeakCell(jsfunction);
// Check we're still in the same context.
- Register scratch = prototype;
+ Register function = prototype;
__ Ldr(scratch, GlobalObjectMemOperand());
__ Ldr(scratch, FieldMemOperand(scratch,
GlobalObject::kNativeContextOffset));
- __ Ldr(scratch, ContextMemOperand(scratch, index));
- __ Cmp(scratch, Operand(function));
+ __ Ldr(function, ContextMemOperand(scratch, index));
+ __ CmpWeakValue(function, cell, scratch);
__ B(ne, miss);
// Load its initial map. The global functions all have initial maps.
- __ Mov(prototype, Operand(Handle<Map>(function->initial_map())));
+ __ Ldr(scratch,
+ FieldMemOperand(function,
JSFunction::kPrototypeOrInitialMapOffset));
// Load the prototype from the initial map.
- __ Ldr(prototype, FieldMemOperand(prototype, Map::kPrototypeOffset));
+ __ Ldr(prototype, FieldMemOperand(scratch, Map::kPrototypeOffset));
}
Index: src/ic/handler-compiler.cc
diff --git a/src/ic/handler-compiler.cc b/src/ic/handler-compiler.cc
index
22135735f32fdca0639856c2d0a20563612d4da4..e4ae2ffd2d5330043d8e520d56781f23f2928de7
100644
--- a/src/ic/handler-compiler.cc
+++ b/src/ic/handler-compiler.cc
@@ -106,7 +106,7 @@ Register
NamedLoadHandlerCompiler::FrontendHeader(Register object_reg,
if (check_type == CHECK_ALL_MAPS) {
GenerateDirectLoadGlobalFunctionPrototype(masm(), function_index,
- scratch1(), miss);
+ scratch1(), scratch2(),
miss);
Object* function = isolate()->native_context()->get(function_index);
Object* prototype = JSFunction::cast(function)->instance_prototype();
set_type_for_object(handle(prototype, isolate()));
Index: src/ic/handler-compiler.h
diff --git a/src/ic/handler-compiler.h b/src/ic/handler-compiler.h
index
4fedd4e8d78c7127bff6feef5becf58dd724ecb8..9bab6c69b7cb63c5a135f89db9d4debc28582ddd
100644
--- a/src/ic/handler-compiler.h
+++ b/src/ic/handler-compiler.h
@@ -184,6 +184,7 @@ class NamedLoadHandlerCompiler : public
PropertyHandlerCompiler {
static void GenerateDirectLoadGlobalFunctionPrototype(MacroAssembler*
masm,
int index,
Register prototype,
+ Register scratch,
Label* miss);
Index: src/ic/ia32/handler-compiler-ia32.cc
diff --git a/src/ic/ia32/handler-compiler-ia32.cc
b/src/ic/ia32/handler-compiler-ia32.cc
index
356244ee5377184face7d53615706f60e2ddb406..67552bd6b982ad52c3d5dc2c3375820d3e3caa52
100644
--- a/src/ic/ia32/handler-compiler-ia32.cc
+++ b/src/ic/ia32/handler-compiler-ia32.cc
@@ -88,22 +88,27 @@ void
PropertyHandlerCompiler::GenerateDictionaryNegativeLookup(
void NamedLoadHandlerCompiler::GenerateDirectLoadGlobalFunctionPrototype(
- MacroAssembler* masm, int index, Register prototype, Label* miss) {
+ MacroAssembler* masm, int index, Register prototype, Register scratch,
+ Label* miss) {
// Get the global function with the given index.
- Handle<JSFunction> function(
- JSFunction::cast(masm->isolate()->native_context()->get(index)));
+ Isolate* isolate = masm->isolate();
+ Handle<JSFunction> jsfunction(
+ JSFunction::cast(isolate->native_context()->get(index)));
+ Handle<WeakCell> cell = isolate->factory()->NewWeakCell(jsfunction);
// Check we're still in the same context.
- Register scratch = prototype;
+ Register function = prototype;
const int offset = Context::SlotOffset(Context::GLOBAL_OBJECT_INDEX);
__ mov(scratch, Operand(esi, offset));
__ mov(scratch, FieldOperand(scratch,
GlobalObject::kNativeContextOffset));
- __ cmp(Operand(scratch, Context::SlotOffset(index)), function);
+ __ mov(function, Operand(scratch, Context::SlotOffset(index)));
+ __ CmpWeakValue(function, cell, scratch);
__ j(not_equal, miss);
// Load its initial map. The global functions all have initial maps.
- __ Move(prototype, Immediate(Handle<Map>(function->initial_map())));
+ __ mov(scratch,
+ FieldOperand(function, JSFunction::kPrototypeOrInitialMapOffset));
// Load the prototype from the initial map.
- __ mov(prototype, FieldOperand(prototype, Map::kPrototypeOffset));
+ __ mov(prototype, FieldOperand(scratch, Map::kPrototypeOffset));
}
Index: src/ic/x64/handler-compiler-x64.cc
diff --git a/src/ic/x64/handler-compiler-x64.cc
b/src/ic/x64/handler-compiler-x64.cc
index
ae1454b48fa6cfed31b1fe4b24e66df57899b409..dd6349ddd7dec6d662de6b2f4670bcfd1621bdaf
100644
--- a/src/ic/x64/handler-compiler-x64.cc
+++ b/src/ic/x64/handler-compiler-x64.cc
@@ -56,24 +56,26 @@ void
PropertyHandlerCompiler::GenerateDictionaryNegativeLookup(
void NamedLoadHandlerCompiler::GenerateDirectLoadGlobalFunctionPrototype(
- MacroAssembler* masm, int index, Register prototype, Label* miss) {
+ MacroAssembler* masm, int index, Register prototype, Register scratch,
+ Label* miss) {
Isolate* isolate = masm->isolate();
// Get the global function with the given index.
- Handle<JSFunction> function(
+ Handle<JSFunction> jsfunction(
JSFunction::cast(isolate->native_context()->get(index)));
-
+ Handle<WeakCell> cell = isolate->factory()->NewWeakCell(jsfunction);
// Check we're still in the same context.
- Register scratch = prototype;
+ Register function = prototype;
const int offset = Context::SlotOffset(Context::GLOBAL_OBJECT_INDEX);
__ movp(scratch, Operand(rsi, offset));
__ movp(scratch, FieldOperand(scratch,
GlobalObject::kNativeContextOffset));
- __ Cmp(Operand(scratch, Context::SlotOffset(index)), function);
+ __ movp(function, Operand(scratch, Context::SlotOffset(index)));
+ __ CmpWeakValue(function, cell, scratch);
__ j(not_equal, miss);
-
// Load its initial map. The global functions all have initial maps.
- __ Move(prototype, Handle<Map>(function->initial_map()));
+ __ movp(scratch,
+ FieldOperand(function,
JSFunction::kPrototypeOrInitialMapOffset));
// Load the prototype from the initial map.
- __ movp(prototype, FieldOperand(prototype, Map::kPrototypeOffset));
+ __ movp(prototype, FieldOperand(scratch, Map::kPrototypeOffset));
}
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
