Reviewers: mtbrandyberry,
Message:
Next PPC patch
Description:
PPC: Ensure object literal element boilerplates aren't modified.
Port 7c347c545e33d279b5aa476e754a5358201be846
Original commit message:
A bug allows JSObject literals with elements to have the elements in the
boilerplate modified.
[email protected]
BUG=466993
LOG=N
Please review this at https://codereview.chromium.org/1046223002/
Base URL: https://chromium.googlesource.com/v8/v8.git@master
Affected files (+10, -21 lines):
M src/ppc/full-codegen-ppc.cc
Index: src/ppc/full-codegen-ppc.cc
diff --git a/src/ppc/full-codegen-ppc.cc b/src/ppc/full-codegen-ppc.cc
index
3082504cf8cd72878b26381e45e58514c61220cd..a12f17eba397401495bfe3e2b3106250c96dd51c
100644
--- a/src/ppc/full-codegen-ppc.cc
+++ b/src/ppc/full-codegen-ppc.cc
@@ -1651,19 +1651,13 @@ void
FullCodeGenerator::VisitObjectLiteral(ObjectLiteral* expr) {
__ LoadP(r6, FieldMemOperand(r6, JSFunction::kLiteralsOffset));
__ LoadSmiLiteral(r5, Smi::FromInt(expr->literal_index()));
__ mov(r4, Operand(constant_properties));
- int flags = expr->fast_elements() ? ObjectLiteral::kFastElements
- : ObjectLiteral::kNoFlags;
- flags |= expr->has_function() ? ObjectLiteral::kHasFunction
- : ObjectLiteral::kNoFlags;
+ int flags = expr->ComputeFlags();
__ LoadSmiLiteral(r3, Smi::FromInt(flags));
- int properties_count = constant_properties->length() / 2;
- if (expr->may_store_doubles() || expr->depth() > 1 ||
- masm()->serializer_enabled() || flags !=
ObjectLiteral::kFastElements ||
- properties_count >
FastCloneShallowObjectStub::kMaximumClonedProperties) {
+ if (MustCreateObjectLiteralWithRuntime(expr)) {
__ Push(r6, r5, r4, r3);
__ CallRuntime(Runtime::kCreateObjectLiteral, 4);
} else {
- FastCloneShallowObjectStub stub(isolate(), properties_count);
+ FastCloneShallowObjectStub stub(isolate(), expr->properties_count());
__ CallStub(&stub);
}
PrepareForBailoutForId(expr->CreateLiteralId(), TOS_REG);
@@ -1853,16 +1847,9 @@ void
FullCodeGenerator::VisitArrayLiteral(ArrayLiteral* expr) {
Comment cmnt(masm_, "[ ArrayLiteral");
expr->BuildConstantElements(isolate());
- int flags = expr->depth() == 1 ? ArrayLiteral::kShallowElements
- : ArrayLiteral::kNoFlags;
-
- ZoneList<Expression*>* subexprs = expr->values();
- int length = subexprs->length();
Handle<FixedArray> constant_elements = expr->constant_elements();
- DCHECK_EQ(2, constant_elements->length());
- ElementsKind constant_elements_kind =
-
static_cast<ElementsKind>(Smi::cast(constant_elements->get(0))->value());
- bool has_fast_elements =
IsFastObjectElementsKind(constant_elements_kind);
+ bool has_fast_elements =
+ IsFastObjectElementsKind(expr->constant_elements_kind());
Handle<FixedArrayBase> constant_elements_values(
FixedArrayBase::cast(constant_elements->get(1)));
@@ -1877,8 +1864,8 @@ void
FullCodeGenerator::VisitArrayLiteral(ArrayLiteral* expr) {
__ LoadP(r6, FieldMemOperand(r6, JSFunction::kLiteralsOffset));
__ LoadSmiLiteral(r5, Smi::FromInt(expr->literal_index()));
__ mov(r4, Operand(constant_elements));
- if (expr->depth() > 1 || length > JSObject::kInitialMaxFastElementArray)
{
- __ LoadSmiLiteral(r3, Smi::FromInt(flags));
+ if (MustCreateArrayLiteralWithRuntime(expr)) {
+ __ LoadSmiLiteral(r3, Smi::FromInt(expr->ComputeFlags()));
__ Push(r6, r5, r4, r3);
__ CallRuntime(Runtime::kCreateArrayLiteral, 4);
} else {
@@ -1888,6 +1875,8 @@ void
FullCodeGenerator::VisitArrayLiteral(ArrayLiteral* expr) {
PrepareForBailoutForId(expr->CreateLiteralId(), TOS_REG);
bool result_saved = false; // Is the result saved to the stack?
+ ZoneList<Expression*>* subexprs = expr->values();
+ int length = subexprs->length();
// Emit code to evaluate all the non-constant subexpressions and to store
// them into the newly cloned array.
@@ -1904,7 +1893,7 @@ void
FullCodeGenerator::VisitArrayLiteral(ArrayLiteral* expr) {
}
VisitForAccumulatorValue(subexpr);
- if (IsFastObjectElementsKind(constant_elements_kind)) {
+ if (has_fast_elements) {
int offset = FixedArray::kHeaderSize + (i * kPointerSize);
__ LoadP(r8, MemOperand(sp, kPointerSize)); // Copy of array
literal.
__ LoadP(r4, FieldMemOperand(r8, JSObject::kElementsOffset));
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
