Revision: 17474
Author: [email protected]
Date: Tue Nov 5 11:01:31 2013 UTC
Log: Proper fix for the issue exposed by r17459
This reverts r17462 and instead fixes StubCache::ComputeLoadNonexistent by
replacing s/IsGlobalObject/IsJSGlobalObject/ there.
[email protected]
Review URL: https://codereview.chromium.org/59103005
http://code.google.com/p/v8/source/detail?r=17474
Modified:
/branches/bleeding_edge/src/arm/stub-cache-arm.cc
/branches/bleeding_edge/src/ia32/stub-cache-ia32.cc
/branches/bleeding_edge/src/ic.cc
/branches/bleeding_edge/src/mips/stub-cache-mips.cc
/branches/bleeding_edge/src/objects.cc
/branches/bleeding_edge/src/objects.h
/branches/bleeding_edge/src/stub-cache.cc
/branches/bleeding_edge/src/stub-cache.h
/branches/bleeding_edge/src/x64/stub-cache-x64.cc
=======================================
--- /branches/bleeding_edge/src/arm/stub-cache-arm.cc Mon Nov 4 14:14:09
2013 UTC
+++ /branches/bleeding_edge/src/arm/stub-cache-arm.cc Tue Nov 5 11:01:31
2013 UTC
@@ -415,11 +415,11 @@
// the property cell at compilation time if no cell exists for the
// property.
void StubCompiler::GenerateCheckPropertyCell(MacroAssembler* masm,
- Handle<GlobalObject> global,
+ Handle<JSGlobalObject> global,
Handle<Name> name,
Register scratch,
Label* miss) {
- Handle<Cell> cell = GlobalObject::EnsurePropertyCell(global, name);
+ Handle<Cell> cell = JSGlobalObject::EnsurePropertyCell(global, name);
ASSERT(cell->value()->IsTheHole());
__ mov(scratch, Operand(cell));
__ ldr(scratch, FieldMemOperand(scratch, Cell::kValueOffset));
@@ -437,7 +437,7 @@
Label* miss) {
if (holder->IsJSGlobalObject()) {
GenerateCheckPropertyCell(
- masm, Handle<GlobalObject>::cast(holder), name, scratch1(), miss);
+ masm, Handle<JSGlobalObject>::cast(holder), name, scratch1(),
miss);
} else if (!holder->HasFastProperties() && !holder->IsJSGlobalProxy()) {
GenerateDictionaryNegativeLookup(
masm, miss, holder_reg, name, scratch1(), scratch2());
@@ -1160,9 +1160,9 @@
Label* miss) {
Handle<JSObject> current = object;
while (!current.is_identical_to(holder)) {
- if (current->IsGlobalObject()) {
+ if (current->IsJSGlobalObject()) {
GenerateCheckPropertyCell(masm,
- Handle<GlobalObject>::cast(current),
+ Handle<JSGlobalObject>::cast(current),
name,
scratch,
miss);
@@ -2913,7 +2913,7 @@
Handle<JSObject> object,
Handle<JSObject> last,
Handle<Name> name,
- Handle<GlobalObject> global) {
+ Handle<JSGlobalObject> global) {
Label success;
NonexistentHandlerFrontend(object, last, name, &success, global);
=======================================
--- /branches/bleeding_edge/src/ia32/stub-cache-ia32.cc Mon Nov 4 14:14:09
2013 UTC
+++ /branches/bleeding_edge/src/ia32/stub-cache-ia32.cc Tue Nov 5 11:01:31
2013 UTC
@@ -789,12 +789,12 @@
// the property cell at compilation time if no cell exists for the
// property.
void StubCompiler::GenerateCheckPropertyCell(MacroAssembler* masm,
- Handle<GlobalObject> global,
+ Handle<JSGlobalObject> global,
Handle<Name> name,
Register scratch,
Label* miss) {
Handle<PropertyCell> cell =
- GlobalObject::EnsurePropertyCell(global, name);
+ JSGlobalObject::EnsurePropertyCell(global, name);
ASSERT(cell->value()->IsTheHole());
Handle<Oddball> the_hole = masm->isolate()->factory()->the_hole_value();
if (Serializer::enabled()) {
@@ -816,7 +816,7 @@
Label* miss) {
if (holder->IsJSGlobalObject()) {
GenerateCheckPropertyCell(
- masm, Handle<GlobalObject>::cast(holder), name, scratch1(), miss);
+ masm, Handle<JSGlobalObject>::cast(holder), name, scratch1(),
miss);
} else if (!holder->HasFastProperties() && !holder->IsJSGlobalProxy()) {
GenerateDictionaryNegativeLookup(
masm, miss, holder_reg, name, scratch1(), scratch2());
@@ -1126,9 +1126,9 @@
Label* miss) {
Handle<JSObject> current = object;
while (!current.is_identical_to(holder)) {
- if (current->IsGlobalObject()) {
+ if (current->IsJSGlobalObject()) {
GenerateCheckPropertyCell(masm,
- Handle<GlobalObject>::cast(current),
+ Handle<JSGlobalObject>::cast(current),
name,
scratch,
miss);
@@ -3023,7 +3023,7 @@
Handle<JSObject> object,
Handle<JSObject> last,
Handle<Name> name,
- Handle<GlobalObject> global) {
+ Handle<JSGlobalObject> global) {
Label success;
NonexistentHandlerFrontend(object, last, name, &success, global);
=======================================
--- /branches/bleeding_edge/src/ic.cc Mon Nov 4 16:39:58 2013 UTC
+++ /branches/bleeding_edge/src/ic.cc Tue Nov 5 11:01:31 2013 UTC
@@ -370,18 +370,6 @@
void IC::UpdateState(Handle<Object> receiver, Handle<Object> name) {
if (!name->IsString()) return;
-
- // The builtins object is special. It only changes when JavaScript
- // builtins are loaded lazily. It is important to keep inline
- // caches for the builtins object monomorphic. Therefore, if we get
- // an inline cache miss for the builtins object after lazily loading
- // JavaScript builtins, we return uninitialized as the state to
- // force the inline cache back to monomorphic state.
- if (receiver->IsJSBuiltinsObject()) {
- state_ = UNINITIALIZED;
- return;
- }
-
if (state() != MONOMORPHIC) {
if (state() == POLYMORPHIC && receiver->IsHeapObject()) {
TryRemoveInvalidHandlers(
@@ -399,6 +387,14 @@
receiver, Handle<String>::cast(name))) {
return MarkMonomorphicPrototypeFailure();
}
+
+ // The builtins object is special. It only changes when JavaScript
+ // builtins are loaded lazily. It is important to keep inline
+ // caches for the builtins object monomorphic. Therefore, if we get
+ // an inline cache miss for the builtins object after lazily loading
+ // JavaScript builtins, we return uninitialized as the state to
+ // force the inline cache back to monomorphic state.
+ if (receiver->IsJSBuiltinsObject()) state_ = UNINITIALIZED;
}
=======================================
--- /branches/bleeding_edge/src/mips/stub-cache-mips.cc Tue Nov 5 01:31:22
2013 UTC
+++ /branches/bleeding_edge/src/mips/stub-cache-mips.cc Tue Nov 5 11:01:31
2013 UTC
@@ -405,11 +405,11 @@
void StubCompiler::GenerateCheckPropertyCell(MacroAssembler* masm,
- Handle<GlobalObject> global,
+ Handle<JSGlobalObject> global,
Handle<Name> name,
Register scratch,
Label* miss) {
- Handle<Cell> cell = GlobalObject::EnsurePropertyCell(global, name);
+ Handle<Cell> cell = JSGlobalObject::EnsurePropertyCell(global, name);
ASSERT(cell->value()->IsTheHole());
__ li(scratch, Operand(cell));
__ lw(scratch, FieldMemOperand(scratch, Cell::kValueOffset));
@@ -426,7 +426,7 @@
Label* miss) {
if (holder->IsJSGlobalObject()) {
GenerateCheckPropertyCell(
- masm, Handle<GlobalObject>::cast(holder), name, scratch1(), miss);
+ masm, Handle<JSGlobalObject>::cast(holder), name, scratch1(),
miss);
} else if (!holder->HasFastProperties() && !holder->IsJSGlobalProxy()) {
GenerateDictionaryNegativeLookup(
masm, miss, holder_reg, name, scratch1(), scratch2());
@@ -1150,9 +1150,9 @@
Label* miss) {
Handle<JSObject> current = object;
while (!current.is_identical_to(holder)) {
- if (current->IsGlobalObject()) {
+ if (current->IsJSGlobalObject()) {
GenerateCheckPropertyCell(masm,
- Handle<GlobalObject>::cast(current),
+ Handle<JSGlobalObject>::cast(current),
name,
scratch,
miss);
@@ -2928,7 +2928,7 @@
Handle<JSObject> object,
Handle<JSObject> last,
Handle<Name> name,
- Handle<GlobalObject> global) {
+ Handle<JSGlobalObject> global) {
Label success;
NonexistentHandlerFrontend(object, last, name, &success, global);
=======================================
--- /branches/bleeding_edge/src/objects.cc Tue Nov 5 09:54:59 2013 UTC
+++ /branches/bleeding_edge/src/objects.cc Tue Nov 5 11:01:31 2013 UTC
@@ -14752,8 +14752,8 @@
}
-Handle<PropertyCell> GlobalObject::EnsurePropertyCell(
- Handle<GlobalObject> global,
+Handle<PropertyCell> JSGlobalObject::EnsurePropertyCell(
+ Handle<JSGlobalObject> global,
Handle<Name> name) {
ASSERT(!global->HasFastProperties());
int entry = global->property_dictionary()->FindEntry(*name);
=======================================
--- /branches/bleeding_edge/src/objects.h Tue Nov 5 10:14:48 2013 UTC
+++ /branches/bleeding_edge/src/objects.h Tue Nov 5 11:01:31 2013 UTC
@@ -7399,10 +7399,6 @@
Object* answer = GetProperty(key)->ToObjectUnchecked();
return answer;
}
-
- // Ensure that the global object has a cell for the given property name.
- static Handle<PropertyCell> EnsurePropertyCell(Handle<GlobalObject>
global,
- Handle<Name> name);
// Casting.
static inline GlobalObject* cast(Object* obj);
@@ -7425,6 +7421,10 @@
// Casting.
static inline JSGlobalObject* cast(Object* obj);
+ // Ensure that the global object has a cell for the given property name.
+ static Handle<PropertyCell> EnsurePropertyCell(Handle<JSGlobalObject>
global,
+ Handle<Name> name);
+
// Dispatched behavior.
DECLARE_PRINTER(JSGlobalObject)
DECLARE_VERIFIER(JSGlobalObject)
=======================================
--- /branches/bleeding_edge/src/stub-cache.cc Mon Nov 4 14:14:09 2013 UTC
+++ /branches/bleeding_edge/src/stub-cache.cc Tue Nov 5 11:01:31 2013 UTC
@@ -177,12 +177,12 @@
Handle<Name> cache_name = factory()->empty_string();
Handle<JSObject> current;
Handle<Object> next = receiver;
- Handle<GlobalObject> global;
+ Handle<JSGlobalObject> global;
do {
current = Handle<JSObject>::cast(next);
next = Handle<Object>(current->GetPrototype(), isolate_);
- if (current->IsGlobalObject()) {
- global = Handle<GlobalObject>::cast(current);
+ if (current->IsJSGlobalObject()) {
+ global = Handle<JSGlobalObject>::cast(current);
cache_name = name;
} else if (!current->HasFastProperties()) {
cache_name = name;
@@ -1213,7 +1213,7 @@
Handle<JSObject> last,
Handle<Name> name,
Label* success,
- Handle<GlobalObject> global) {
+ Handle<JSGlobalObject> global) {
Label miss;
Register holder =
=======================================
--- /branches/bleeding_edge/src/stub-cache.h Mon Nov 4 14:14:09 2013 UTC
+++ /branches/bleeding_edge/src/stub-cache.h Tue Nov 5 11:01:31 2013 UTC
@@ -485,7 +485,7 @@
// the property cell at compilation time if no cell exists for the
// property.
static void GenerateCheckPropertyCell(MacroAssembler* masm,
- Handle<GlobalObject> global,
+ Handle<JSGlobalObject> global,
Handle<Name> name,
Register scratch,
Label* miss);
@@ -703,7 +703,7 @@
Handle<Code> CompileLoadNonexistent(Handle<JSObject> object,
Handle<JSObject> last,
Handle<Name> name,
- Handle<GlobalObject> global);
+ Handle<JSGlobalObject> global);
Handle<Code> CompileLoadGlobal(Handle<JSObject> object,
Handle<GlobalObject> holder,
@@ -734,7 +734,7 @@
Handle<JSObject> last,
Handle<Name> name,
Label* success,
- Handle<GlobalObject> global);
+ Handle<JSGlobalObject> global);
void GenerateLoadField(Register reg,
Handle<JSObject> holder,
=======================================
--- /branches/bleeding_edge/src/x64/stub-cache-x64.cc Mon Nov 4 14:14:09
2013 UTC
+++ /branches/bleeding_edge/src/x64/stub-cache-x64.cc Tue Nov 5 11:01:31
2013 UTC
@@ -774,12 +774,12 @@
void StubCompiler::GenerateCheckPropertyCell(MacroAssembler* masm,
- Handle<GlobalObject> global,
+ Handle<JSGlobalObject> global,
Handle<Name> name,
Register scratch,
Label* miss) {
Handle<PropertyCell> cell =
- GlobalObject::EnsurePropertyCell(global, name);
+ JSGlobalObject::EnsurePropertyCell(global, name);
ASSERT(cell->value()->IsTheHole());
__ Move(scratch, cell);
__ Cmp(FieldOperand(scratch, Cell::kValueOffset),
@@ -796,7 +796,7 @@
Label* miss) {
if (holder->IsJSGlobalObject()) {
GenerateCheckPropertyCell(
- masm, Handle<GlobalObject>::cast(holder), name, scratch1(), miss);
+ masm, Handle<JSGlobalObject>::cast(holder), name, scratch1(),
miss);
} else if (!holder->HasFastProperties() && !holder->IsJSGlobalProxy()) {
GenerateDictionaryNegativeLookup(
masm, miss, holder_reg, name, scratch1(), scratch2());
@@ -1055,9 +1055,9 @@
Label* miss) {
Handle<JSObject> current = object;
while (!current.is_identical_to(holder)) {
- if (current->IsGlobalObject()) {
+ if (current->IsJSGlobalObject()) {
GenerateCheckPropertyCell(masm,
- Handle<GlobalObject>::cast(current),
+ Handle<JSGlobalObject>::cast(current),
name,
scratch,
miss);
@@ -2928,7 +2928,7 @@
Handle<JSObject> object,
Handle<JSObject> last,
Handle<Name> name,
- Handle<GlobalObject> global) {
+ Handle<JSGlobalObject> global) {
Label success;
NonexistentHandlerFrontend(object, last, name, &success, global);
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/groups/opt_out.
