diff --git a/src/x64/macro-assembler-x64.cc b/src/x64/macro-assembler-x64.cc index 099a46103c..457011be88 100644 --- a/src/x64/macro-assembler-x64.cc +++ b/src/x64/macro-assembler-x64.cc @@ -882,4 +882,154 @@ void MacroAssembler::LeaveExitFrame(StackFrame::Type type) { } +Register MacroAssembler::CheckMaps(JSObject* object, Register object_reg, + JSObject* holder, Register holder_reg, + Register scratch, + Label* miss) { + // Make sure there's no overlap between scratch and the other + // registers. + ASSERT(!scratch.is(object_reg) && !scratch.is(holder_reg)); + + // Keep track of the current object in register reg. On the first + // iteration, reg is an alias for object_reg, on later iterations, + // it is an alias for holder_reg. + Register reg = object_reg; + int depth = 1; + + // Check the maps in the prototype chain. + // Traverse the prototype chain from the object and do map checks. + while (object != holder) { + depth++; + + // Only global objects and objects that do not require access + // checks are allowed in stubs. + ASSERT(object->IsJSGlobalProxy() || !object->IsAccessCheckNeeded()); + + JSObject* prototype = JSObject::cast(object->GetPrototype()); + if (Heap::InNewSpace(prototype)) { + // Get the map of the current object. + movq(scratch, FieldOperand(reg, HeapObject::kMapOffset)); + Cmp(scratch, Handle(object->map())); + // Branch on the result of the map check. + j(not_equal, miss); + // Check access rights to the global object. This has to happen + // after the map check so that we know that the object is + // actually a global object. + if (object->IsJSGlobalProxy()) { + CheckAccessGlobalProxy(reg, scratch, miss); + + // Restore scratch register to be the map of the object. + // We load the prototype from the map in the scratch register. + movq(scratch, FieldOperand(reg, HeapObject::kMapOffset)); + } + // The prototype is in new space; we cannot store a reference + // to it in the code. Load it from the map. + reg = holder_reg; // from now the object is in holder_reg + movq(reg, FieldOperand(scratch, Map::kPrototypeOffset)); + + } else { + // Check the map of the current object. + Cmp(FieldOperand(reg, HeapObject::kMapOffset), + Handle(object->map())); + // Branch on the result of the map check. + j(not_equal, miss); + // Check access rights to the global object. This has to happen + // after the map check so that we know that the object is + // actually a global object. + if (object->IsJSGlobalProxy()) { + CheckAccessGlobalProxy(reg, scratch, miss); + } + // The prototype is in old space; load it directly. + reg = holder_reg; // from now the object is in holder_reg + Move(reg, Handle(prototype)); + } + + // Go to the next object in the prototype chain. + object = prototype; + } + + // Check the holder map. + Cmp(FieldOperand(reg, HeapObject::kMapOffset), + Handle(holder->map())); + j(not_equal, miss); + + // Log the check depth. + LOG(IntEvent("check-maps-depth", depth)); + + // Perform security check for access to the global object and return + // the holder register. + ASSERT(object == holder); + ASSERT(object->IsJSGlobalProxy() || !object->IsAccessCheckNeeded()); + if (object->IsJSGlobalProxy()) { + CheckAccessGlobalProxy(reg, scratch, miss); + } + return reg; +} + + + + +void MacroAssembler::CheckAccessGlobalProxy(Register holder_reg, + Register scratch, + Label* miss) { + Label same_contexts; + + ASSERT(!holder_reg.is(scratch)); + ASSERT(!scratch.is(kScratchRegister)); + // Load current lexical context from the stack frame. + movq(scratch, Operand(rbp, StandardFrameConstants::kContextOffset)); + + // When generating debug code, make sure the lexical context is set. + if (FLAG_debug_code) { + cmpq(scratch, Immediate(0)); + Check(not_equal, "we should not have an empty lexical context"); + } + // Load the global context of the current context. + int offset = Context::kHeaderSize + Context::GLOBAL_INDEX * kPointerSize; + movq(scratch, FieldOperand(scratch, offset)); + movq(scratch, FieldOperand(scratch, GlobalObject::kGlobalContextOffset)); + + // Check the context is a global context. + if (FLAG_debug_code) { + Cmp(FieldOperand(scratch, HeapObject::kMapOffset), + Factory::global_context_map()); + Check(equal, "JSGlobalObject::global_context should be a global context."); + } + + // Check if both contexts are the same. + cmpq(scratch, FieldOperand(holder_reg, JSGlobalProxy::kContextOffset)); + j(equal, &same_contexts); + + // Compare security tokens. + // Check that the security token in the calling global object is + // compatible with the security token in the receiving global + // object. + + // Check the context is a global context. + if (FLAG_debug_code) { + // Preserve original value of holder_reg. + push(holder_reg); + movq(holder_reg, FieldOperand(holder_reg, JSGlobalProxy::kContextOffset)); + Cmp(holder_reg, Factory::null_value()); + Check(not_equal, "JSGlobalProxy::context() should not be null."); + + // Read the first word and compare to global_context_map(), + movq(holder_reg, FieldOperand(holder_reg, HeapObject::kMapOffset)); + Cmp(holder_reg, Factory::global_context_map()); + Check(equal, "JSGlobalObject::global_context should be a global context."); + pop(holder_reg); + } + + movq(kScratchRegister, + FieldOperand(holder_reg, JSGlobalProxy::kContextOffset)); + int token_offset = Context::kHeaderSize + + Context::SECURITY_TOKEN_INDEX * kPointerSize; + movq(scratch, FieldOperand(scratch, token_offset)); + cmpq(scratch, FieldOperand(kScratchRegister, token_offset)); + j(not_equal, miss); + + bind(&same_contexts); +} + + } } // namespace v8::internal diff --git a/src/x64/stub-cache-x64.cc b/src/x64/stub-cache-x64.cc index 0985dbce55..915ff6372f 100644 --- a/src/x64/stub-cache-x64.cc +++ b/src/x64/stub-cache-x64.cc @@ -36,18 +36,141 @@ namespace v8 { namespace internal { -#define __ ACCESS_MASM((&masm_)) +#define __ ACCESS_MASM((masm())) -Object* CallStubCompiler::CompileCallConstant(Object* a, - JSObject* b, - JSFunction* c, - String* d, - StubCompiler::CheckType e) { - // TODO(X64): Implement a real stub. - return Failure::InternalError(); +Object* CallStubCompiler::CompileCallConstant(Object* object, + JSObject* holder, + JSFunction* function, + String* name, + StubCompiler::CheckType check) { + // ----------- S t a t e ------------- + // ----------------------------------- + // rsp[0] return address + // rsp[8] argument argc + // rsp[16] argument argc - 1 + // ... + // rsp[argc * 8] argument 1 + // rsp[(argc + 1) * 8] argument 0 = reciever + // rsp[(argc + 2) * 8] function name + + Label miss; + + // Get the receiver from the stack. + const int argc = arguments().immediate(); + __ movq(rdx, Operand(rsp, (argc + 1) * kPointerSize)); + + // Check that the receiver isn't a smi. + if (check != NUMBER_CHECK) { + __ testl(rdx, Immediate(kSmiTagMask)); + __ j(zero, &miss); + } + + // Make sure that it's okay not to patch the on stack receiver + // unless we're doing a receiver map check. + ASSERT(!object->IsGlobalObject() || check == RECEIVER_MAP_CHECK); + + switch (check) { + case RECEIVER_MAP_CHECK: + // Check that the maps haven't changed. + CheckPrototypes(JSObject::cast(object), rdx, holder, + rbx, rcx, name, &miss); + + // Patch the receiver on the stack with the global proxy if + // necessary. + if (object->IsGlobalObject()) { + __ movq(rdx, FieldOperand(rdx, GlobalObject::kGlobalReceiverOffset)); + __ movq(Operand(rsp, (argc + 1) * kPointerSize), rdx); + } + break; + + case STRING_CHECK: + // Check that the object is a two-byte string or a symbol. + __ CmpObjectType(rdx, FIRST_NONSTRING_TYPE, rcx); + __ j(above_equal, &miss); + // Check that the maps starting from the prototype haven't changed. + GenerateLoadGlobalFunctionPrototype(masm(), + Context::STRING_FUNCTION_INDEX, + rcx); + CheckPrototypes(JSObject::cast(object->GetPrototype()), rcx, holder, + rbx, rdx, name, &miss); + break; + + case NUMBER_CHECK: { + Label fast; + // Check that the object is a smi or a heap number. + __ testl(rdx, Immediate(kSmiTagMask)); + __ j(zero, &fast); + __ CmpObjectType(rdx, HEAP_NUMBER_TYPE, rcx); + __ j(not_equal, &miss); + __ bind(&fast); + // Check that the maps starting from the prototype haven't changed. + GenerateLoadGlobalFunctionPrototype(masm(), + Context::NUMBER_FUNCTION_INDEX, + rcx); + CheckPrototypes(JSObject::cast(object->GetPrototype()), rcx, holder, + rbx, rdx, name, &miss); + break; + } + + case BOOLEAN_CHECK: { + Label fast; + // Check that the object is a boolean. + __ Cmp(rdx, Factory::true_value()); + __ j(equal, &fast); + __ Cmp(rdx, Factory::false_value()); + __ j(not_equal, &miss); + __ bind(&fast); + // Check that the maps starting from the prototype haven't changed. + GenerateLoadGlobalFunctionPrototype(masm(), + Context::BOOLEAN_FUNCTION_INDEX, + rcx); + CheckPrototypes(JSObject::cast(object->GetPrototype()), rcx, holder, + rbx, rdx, name, &miss); + break; + } + + case JSARRAY_HAS_FAST_ELEMENTS_CHECK: + CheckPrototypes(JSObject::cast(object), rdx, holder, + rbx, rcx, name, &miss); + // Make sure object->elements()->map() != Heap::dictionary_array_map() + // Get the elements array of the object. + __ movq(rbx, FieldOperand(rdx, JSObject::kElementsOffset)); + // Check that the object is in fast mode (not dictionary). + __ Cmp(FieldOperand(rbx, HeapObject::kMapOffset), + Factory::hash_table_map()); + __ j(equal, &miss); + break; + + default: + UNREACHABLE(); + } + + // Get the function and setup the context. + __ Move(rdi, Handle(function)); + __ movq(rsi, FieldOperand(rdi, JSFunction::kContextOffset)); + + // Jump to the cached code (tail call). + ASSERT(function->is_compiled()); + Handle code(function->code()); + ParameterCount expected(function->shared()->formal_parameter_count()); + __ InvokeCode(code, expected, arguments(), + RelocInfo::CODE_TARGET, JUMP_FUNCTION); + + // Handle call cache miss. + __ bind(&miss); + Handle ic = ComputeCallMiss(arguments().immediate()); + __ Jump(ic, RelocInfo::CODE_TARGET); + + // Return the generated code. + String* function_name = NULL; + if (function->shared()->name()->IsString()) { + function_name = String::cast(function->shared()->name()); + } + return GetCode(CONSTANT_FUNCTION, function_name); } + Object* CallStubCompiler::CompileCallField(Object* a, JSObject* b, int c, @@ -175,6 +298,61 @@ Object* StubCompiler::CompileLazyCompile(Code::Flags flags) { return GetCodeWithFlags(flags, "LazyCompileStub"); } + +Register StubCompiler::CheckPrototypes(JSObject* object, + Register object_reg, + JSObject* holder, + Register holder_reg, + Register scratch, + String* name, + Label* miss) { + // Check that the maps haven't changed. + Register result = + __ CheckMaps(object, object_reg, holder, holder_reg, scratch, miss); + + // If we've skipped any global objects, it's not enough to verify + // that their maps haven't changed. + while (object != holder) { + if (object->IsGlobalObject()) { + GlobalObject* global = GlobalObject::cast(object); + Object* probe = global->EnsurePropertyCell(name); + if (probe->IsFailure()) { + set_failure(Failure::cast(probe)); + return result; + } + JSGlobalPropertyCell* cell = JSGlobalPropertyCell::cast(probe); + ASSERT(cell->value()->IsTheHole()); + __ Move(scratch, Handle(cell)); + __ Cmp(FieldOperand(scratch, JSGlobalPropertyCell::kValueOffset), + Factory::the_hole_value()); + __ j(not_equal, miss); + } + object = JSObject::cast(object->GetPrototype()); + } + + // Return the register containing the holder. + return result; +} + + +void StubCompiler::GenerateLoadGlobalFunctionPrototype(MacroAssembler* masm, + int index, + Register prototype) { + // Load the global or builtins object from the current context. + masm->movq(prototype, + Operand(rsi, Context::SlotOffset(Context::GLOBAL_INDEX))); + // Load the global context from the global or builtins object. + masm->movq(prototype, + FieldOperand(prototype, GlobalObject::kGlobalContextOffset)); + // Load the function from the global context. + masm->movq(prototype, Operand(prototype, Context::SlotOffset(index))); + // Load the initial map. The global functions all have initial maps. + masm->movq(prototype, + FieldOperand(prototype, JSFunction::kPrototypeOrInitialMapOffset)); + // Load the prototype from the initial map. + masm->movq(prototype, FieldOperand(prototype, Map::kPrototypeOffset)); +} + #undef __ diff --git a/test/mjsunit/mjsunit.status b/test/mjsunit/mjsunit.status index fe952a4663..d30e78c580 100644 --- a/test/mjsunit/mjsunit.status +++ b/test/mjsunit/mjsunit.status @@ -97,6 +97,7 @@ mirror-date: CRASH || FAIL invalid-lhs: PASS || CRASH || FAIL debug-stepin-constructor: CRASH || FAIL debug-stepin-function-call: CRASH || FAIL +debug-stepin-accessor: CRASH || FAIL new: CRASH || FAIL fuzz-natives: PASS || TIMEOUT greedy: PASS || TIMEOUT