Reviewers: Weiliang,
Message:
PTAL
Description:
X87: Fix keyed element access wrt string wrappers
port 01f40e6ad6c8137708955494987857fbe489616b (r29618).
original commit message:
BUG=
Please review this at https://codereview.chromium.org/1233033004/
Base URL: https://chromium.googlesource.com/v8/v8.git@master
Affected files (+19, -7 lines):
M src/ic/x87/ic-x87.cc
M src/x87/macro-assembler-x87.cc
Index: src/ic/x87/ic-x87.cc
diff --git a/src/ic/x87/ic-x87.cc b/src/ic/x87/ic-x87.cc
index
b863c69132bbd575336e9954ef0bd92f73837070..1725992ef2865976b56b244ab08e148ba106f0a4
100644
--- a/src/ic/x87/ic-x87.cc
+++ b/src/ic/x87/ic-x87.cc
@@ -157,10 +157,9 @@ static void
GenerateKeyedLoadReceiverCheck(MacroAssembler* masm,
__ test_b(FieldOperand(map, Map::kBitFieldOffset),
(1 << Map::kIsAccessCheckNeeded) | (1 << interceptor_bit));
__ j(not_zero, slow);
- // Check that the object is some kind of JS object EXCEPT JS Value type.
- // In the case that the object is a value-wrapper object,
- // we enter the runtime system to make sure that indexing
- // into string objects works as intended.
+ // Check that the object is some kind of JS object EXCEPT JS Value type.
In
+ // the case that the object is a value-wrapper object, we enter the
runtime
+ // system to make sure that indexing into string objects works as
intended.
DCHECK(JS_OBJECT_TYPE > JS_VALUE_TYPE);
__ CmpInstanceType(map, JS_OBJECT_TYPE);
@@ -539,8 +538,11 @@ void KeyedStoreIC::GenerateMegamorphic(MacroAssembler*
masm,
__ JumpIfNotSmi(key, &maybe_name_key);
__ CmpInstanceType(edi, JS_ARRAY_TYPE);
__ j(equal, &array);
- // Check that the object is some kind of JSObject.
- __ CmpInstanceType(edi, FIRST_JS_OBJECT_TYPE);
+ // Check that the object is some kind of JS object EXCEPT JS Value type.
In
+ // the case that the object is a value-wrapper object, we enter the
runtime
+ // system to make sure that indexing into string objects works as
intended.
+ STATIC_ASSERT(JS_VALUE_TYPE < JS_OBJECT_TYPE);
+ __ CmpInstanceType(edi, JS_OBJECT_TYPE);
__ j(below, &slow);
// Object case: Check key against length in the elements array.
Index: src/x87/macro-assembler-x87.cc
diff --git a/src/x87/macro-assembler-x87.cc b/src/x87/macro-assembler-x87.cc
index
3dc8b74a8115d4d2e707d5c03acc839a15b03a6f..b819424976d9de962e0a7fd04148af4067122f20
100644
--- a/src/x87/macro-assembler-x87.cc
+++ b/src/x87/macro-assembler-x87.cc
@@ -3055,14 +3055,22 @@ void
MacroAssembler::JumpIfDictionaryInPrototypeChain(
DCHECK(!scratch1.is(scratch0));
Factory* factory = isolate()->factory();
Register current = scratch0;
- Label loop_again;
+ Label loop_again, end;
// scratch contained elements pointer.
mov(current, object);
+ mov(current, FieldOperand(current, HeapObject::kMapOffset));
+ mov(current, FieldOperand(current, Map::kPrototypeOffset));
+ cmp(current, Immediate(factory->null_value()));
+ j(equal, &end);
// Loop based on the map going up the prototype chain.
bind(&loop_again);
mov(current, FieldOperand(current, HeapObject::kMapOffset));
+ STATIC_ASSERT(JS_PROXY_TYPE < JS_OBJECT_TYPE);
+ STATIC_ASSERT(JS_VALUE_TYPE < JS_OBJECT_TYPE);
+ CmpInstanceType(current, JS_OBJECT_TYPE);
+ j(below, found);
mov(scratch1, FieldOperand(current, Map::kBitField2Offset));
DecodeField<Map::ElementsKindBits>(scratch1);
cmp(scratch1, Immediate(DICTIONARY_ELEMENTS));
@@ -3070,6 +3078,8 @@ void MacroAssembler::JumpIfDictionaryInPrototypeChain(
mov(current, FieldOperand(current, Map::kPrototypeOffset));
cmp(current, Immediate(factory->null_value()));
j(not_equal, &loop_again);
+
+ bind(&end);
}
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
