X64: Implement inline cache of monomorphic constant function call. Mark a debugger test on X64 as failing.
Review URL: http://codereview.chromium.org/155631 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@2485 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
This commit is contained in:
whesse@chromium.org
parent
e21d0b510c
commit
263acb4d02
@ -882,4 +882,154 @@ void MacroAssembler::LeaveExitFrame(StackFrame::Type type) {
|
||||
}
|
||||
|
||||
|
||||
Register MacroAssembler::CheckMaps(JSObject* object, Register object_reg,
|
||||
JSObject* holder, Register holder_reg,
|
||||
Register scratch,
|
||||
Label* miss) {
|
||||
// Make sure there's no overlap between scratch and the other
|
||||
// registers.
|
||||
ASSERT(!scratch.is(object_reg) && !scratch.is(holder_reg));
|
||||
|
||||
// Keep track of the current object in register reg. On the first
|
||||
// iteration, reg is an alias for object_reg, on later iterations,
|
||||
// it is an alias for holder_reg.
|
||||
Register reg = object_reg;
|
||||
int depth = 1;
|
||||
|
||||
// Check the maps in the prototype chain.
|
||||
// Traverse the prototype chain from the object and do map checks.
|
||||
while (object != holder) {
|
||||
depth++;
|
||||
|
||||
// Only global objects and objects that do not require access
|
||||
// checks are allowed in stubs.
|
||||
ASSERT(object->IsJSGlobalProxy() || !object->IsAccessCheckNeeded());
|
||||
|
||||
JSObject* prototype = JSObject::cast(object->GetPrototype());
|
||||
if (Heap::InNewSpace(prototype)) {
|
||||
// Get the map of the current object.
|
||||
movq(scratch, FieldOperand(reg, HeapObject::kMapOffset));
|
||||
Cmp(scratch, Handle<Map>(object->map()));
|
||||
// Branch on the result of the map check.
|
||||
j(not_equal, miss);
|
||||
// Check access rights to the global object. This has to happen
|
||||
// after the map check so that we know that the object is
|
||||
// actually a global object.
|
||||
if (object->IsJSGlobalProxy()) {
|
||||
CheckAccessGlobalProxy(reg, scratch, miss);
|
||||
|
||||
// Restore scratch register to be the map of the object.
|
||||
// We load the prototype from the map in the scratch register.
|
||||
movq(scratch, FieldOperand(reg, HeapObject::kMapOffset));
|
||||
}
|
||||
// The prototype is in new space; we cannot store a reference
|
||||
// to it in the code. Load it from the map.
|
||||
reg = holder_reg; // from now the object is in holder_reg
|
||||
movq(reg, FieldOperand(scratch, Map::kPrototypeOffset));
|
||||
|
||||
} else {
|
||||
// Check the map of the current object.
|
||||
Cmp(FieldOperand(reg, HeapObject::kMapOffset),
|
||||
Handle<Map>(object->map()));
|
||||
// Branch on the result of the map check.
|
||||
j(not_equal, miss);
|
||||
// Check access rights to the global object. This has to happen
|
||||
// after the map check so that we know that the object is
|
||||
// actually a global object.
|
||||
if (object->IsJSGlobalProxy()) {
|
||||
CheckAccessGlobalProxy(reg, scratch, miss);
|
||||
}
|
||||
// The prototype is in old space; load it directly.
|
||||
reg = holder_reg; // from now the object is in holder_reg
|
||||
Move(reg, Handle<JSObject>(prototype));
|
||||
}
|
||||
|
||||
// Go to the next object in the prototype chain.
|
||||
object = prototype;
|
||||
}
|
||||
|
||||
// Check the holder map.
|
||||
Cmp(FieldOperand(reg, HeapObject::kMapOffset),
|
||||
Handle<Map>(holder->map()));
|
||||
j(not_equal, miss);
|
||||
|
||||
// Log the check depth.
|
||||
LOG(IntEvent("check-maps-depth", depth));
|
||||
|
||||
// Perform security check for access to the global object and return
|
||||
// the holder register.
|
||||
ASSERT(object == holder);
|
||||
ASSERT(object->IsJSGlobalProxy() || !object->IsAccessCheckNeeded());
|
||||
if (object->IsJSGlobalProxy()) {
|
||||
CheckAccessGlobalProxy(reg, scratch, miss);
|
||||
}
|
||||
return reg;
|
||||
}
|
||||
|
||||
|
||||
|
||||
|
||||
void MacroAssembler::CheckAccessGlobalProxy(Register holder_reg,
|
||||
Register scratch,
|
||||
Label* miss) {
|
||||
Label same_contexts;
|
||||
|
||||
ASSERT(!holder_reg.is(scratch));
|
||||
ASSERT(!scratch.is(kScratchRegister));
|
||||
// Load current lexical context from the stack frame.
|
||||
movq(scratch, Operand(rbp, StandardFrameConstants::kContextOffset));
|
||||
|
||||
// When generating debug code, make sure the lexical context is set.
|
||||
if (FLAG_debug_code) {
|
||||
cmpq(scratch, Immediate(0));
|
||||
Check(not_equal, "we should not have an empty lexical context");
|
||||
}
|
||||
// Load the global context of the current context.
|
||||
int offset = Context::kHeaderSize + Context::GLOBAL_INDEX * kPointerSize;
|
||||
movq(scratch, FieldOperand(scratch, offset));
|
||||
movq(scratch, FieldOperand(scratch, GlobalObject::kGlobalContextOffset));
|
||||
|
||||
// Check the context is a global context.
|
||||
if (FLAG_debug_code) {
|
||||
Cmp(FieldOperand(scratch, HeapObject::kMapOffset),
|
||||
Factory::global_context_map());
|
||||
Check(equal, "JSGlobalObject::global_context should be a global context.");
|
||||
}
|
||||
|
||||
// Check if both contexts are the same.
|
||||
cmpq(scratch, FieldOperand(holder_reg, JSGlobalProxy::kContextOffset));
|
||||
j(equal, &same_contexts);
|
||||
|
||||
// Compare security tokens.
|
||||
// Check that the security token in the calling global object is
|
||||
// compatible with the security token in the receiving global
|
||||
// object.
|
||||
|
||||
// Check the context is a global context.
|
||||
if (FLAG_debug_code) {
|
||||
// Preserve original value of holder_reg.
|
||||
push(holder_reg);
|
||||
movq(holder_reg, FieldOperand(holder_reg, JSGlobalProxy::kContextOffset));
|
||||
Cmp(holder_reg, Factory::null_value());
|
||||
Check(not_equal, "JSGlobalProxy::context() should not be null.");
|
||||
|
||||
// Read the first word and compare to global_context_map(),
|
||||
movq(holder_reg, FieldOperand(holder_reg, HeapObject::kMapOffset));
|
||||
Cmp(holder_reg, Factory::global_context_map());
|
||||
Check(equal, "JSGlobalObject::global_context should be a global context.");
|
||||
pop(holder_reg);
|
||||
}
|
||||
|
||||
movq(kScratchRegister,
|
||||
FieldOperand(holder_reg, JSGlobalProxy::kContextOffset));
|
||||
int token_offset = Context::kHeaderSize +
|
||||
Context::SECURITY_TOKEN_INDEX * kPointerSize;
|
||||
movq(scratch, FieldOperand(scratch, token_offset));
|
||||
cmpq(scratch, FieldOperand(kScratchRegister, token_offset));
|
||||
j(not_equal, miss);
|
||||
|
||||
bind(&same_contexts);
|
||||
}
|
||||
|
||||
|
||||
} } // namespace v8::internal
|
||||
|
||||
@ -36,18 +36,141 @@
|
||||
namespace v8 {
|
||||
namespace internal {
|
||||
|
||||
#define __ ACCESS_MASM((&masm_))
|
||||
#define __ ACCESS_MASM((masm()))
|
||||
|
||||
|
||||
Object* CallStubCompiler::CompileCallConstant(Object* a,
|
||||
JSObject* b,
|
||||
JSFunction* c,
|
||||
String* d,
|
||||
StubCompiler::CheckType e) {
|
||||
// TODO(X64): Implement a real stub.
|
||||
return Failure::InternalError();
|
||||
Object* CallStubCompiler::CompileCallConstant(Object* object,
|
||||
JSObject* holder,
|
||||
JSFunction* function,
|
||||
String* name,
|
||||
StubCompiler::CheckType check) {
|
||||
// ----------- S t a t e -------------
|
||||
// -----------------------------------
|
||||
// rsp[0] return address
|
||||
// rsp[8] argument argc
|
||||
// rsp[16] argument argc - 1
|
||||
// ...
|
||||
// rsp[argc * 8] argument 1
|
||||
// rsp[(argc + 1) * 8] argument 0 = reciever
|
||||
// rsp[(argc + 2) * 8] function name
|
||||
|
||||
Label miss;
|
||||
|
||||
// Get the receiver from the stack.
|
||||
const int argc = arguments().immediate();
|
||||
__ movq(rdx, Operand(rsp, (argc + 1) * kPointerSize));
|
||||
|
||||
// Check that the receiver isn't a smi.
|
||||
if (check != NUMBER_CHECK) {
|
||||
__ testl(rdx, Immediate(kSmiTagMask));
|
||||
__ j(zero, &miss);
|
||||
}
|
||||
|
||||
// Make sure that it's okay not to patch the on stack receiver
|
||||
// unless we're doing a receiver map check.
|
||||
ASSERT(!object->IsGlobalObject() || check == RECEIVER_MAP_CHECK);
|
||||
|
||||
switch (check) {
|
||||
case RECEIVER_MAP_CHECK:
|
||||
// Check that the maps haven't changed.
|
||||
CheckPrototypes(JSObject::cast(object), rdx, holder,
|
||||
rbx, rcx, name, &miss);
|
||||
|
||||
// Patch the receiver on the stack with the global proxy if
|
||||
// necessary.
|
||||
if (object->IsGlobalObject()) {
|
||||
__ movq(rdx, FieldOperand(rdx, GlobalObject::kGlobalReceiverOffset));
|
||||
__ movq(Operand(rsp, (argc + 1) * kPointerSize), rdx);
|
||||
}
|
||||
break;
|
||||
|
||||
case STRING_CHECK:
|
||||
// Check that the object is a two-byte string or a symbol.
|
||||
__ CmpObjectType(rdx, FIRST_NONSTRING_TYPE, rcx);
|
||||
__ j(above_equal, &miss);
|
||||
// Check that the maps starting from the prototype haven't changed.
|
||||
GenerateLoadGlobalFunctionPrototype(masm(),
|
||||
Context::STRING_FUNCTION_INDEX,
|
||||
rcx);
|
||||
CheckPrototypes(JSObject::cast(object->GetPrototype()), rcx, holder,
|
||||
rbx, rdx, name, &miss);
|
||||
break;
|
||||
|
||||
case NUMBER_CHECK: {
|
||||
Label fast;
|
||||
// Check that the object is a smi or a heap number.
|
||||
__ testl(rdx, Immediate(kSmiTagMask));
|
||||
__ j(zero, &fast);
|
||||
__ CmpObjectType(rdx, HEAP_NUMBER_TYPE, rcx);
|
||||
__ j(not_equal, &miss);
|
||||
__ bind(&fast);
|
||||
// Check that the maps starting from the prototype haven't changed.
|
||||
GenerateLoadGlobalFunctionPrototype(masm(),
|
||||
Context::NUMBER_FUNCTION_INDEX,
|
||||
rcx);
|
||||
CheckPrototypes(JSObject::cast(object->GetPrototype()), rcx, holder,
|
||||
rbx, rdx, name, &miss);
|
||||
break;
|
||||
}
|
||||
|
||||
case BOOLEAN_CHECK: {
|
||||
Label fast;
|
||||
// Check that the object is a boolean.
|
||||
__ Cmp(rdx, Factory::true_value());
|
||||
__ j(equal, &fast);
|
||||
__ Cmp(rdx, Factory::false_value());
|
||||
__ j(not_equal, &miss);
|
||||
__ bind(&fast);
|
||||
// Check that the maps starting from the prototype haven't changed.
|
||||
GenerateLoadGlobalFunctionPrototype(masm(),
|
||||
Context::BOOLEAN_FUNCTION_INDEX,
|
||||
rcx);
|
||||
CheckPrototypes(JSObject::cast(object->GetPrototype()), rcx, holder,
|
||||
rbx, rdx, name, &miss);
|
||||
break;
|
||||
}
|
||||
|
||||
case JSARRAY_HAS_FAST_ELEMENTS_CHECK:
|
||||
CheckPrototypes(JSObject::cast(object), rdx, holder,
|
||||
rbx, rcx, name, &miss);
|
||||
// Make sure object->elements()->map() != Heap::dictionary_array_map()
|
||||
// Get the elements array of the object.
|
||||
__ movq(rbx, FieldOperand(rdx, JSObject::kElementsOffset));
|
||||
// Check that the object is in fast mode (not dictionary).
|
||||
__ Cmp(FieldOperand(rbx, HeapObject::kMapOffset),
|
||||
Factory::hash_table_map());
|
||||
__ j(equal, &miss);
|
||||
break;
|
||||
|
||||
default:
|
||||
UNREACHABLE();
|
||||
}
|
||||
|
||||
// Get the function and setup the context.
|
||||
__ Move(rdi, Handle<JSFunction>(function));
|
||||
__ movq(rsi, FieldOperand(rdi, JSFunction::kContextOffset));
|
||||
|
||||
// Jump to the cached code (tail call).
|
||||
ASSERT(function->is_compiled());
|
||||
Handle<Code> code(function->code());
|
||||
ParameterCount expected(function->shared()->formal_parameter_count());
|
||||
__ InvokeCode(code, expected, arguments(),
|
||||
RelocInfo::CODE_TARGET, JUMP_FUNCTION);
|
||||
|
||||
// Handle call cache miss.
|
||||
__ bind(&miss);
|
||||
Handle<Code> ic = ComputeCallMiss(arguments().immediate());
|
||||
__ Jump(ic, RelocInfo::CODE_TARGET);
|
||||
|
||||
// Return the generated code.
|
||||
String* function_name = NULL;
|
||||
if (function->shared()->name()->IsString()) {
|
||||
function_name = String::cast(function->shared()->name());
|
||||
}
|
||||
return GetCode(CONSTANT_FUNCTION, function_name);
|
||||
}
|
||||
|
||||
|
||||
Object* CallStubCompiler::CompileCallField(Object* a,
|
||||
JSObject* b,
|
||||
int c,
|
||||
@ -175,6 +298,61 @@ Object* StubCompiler::CompileLazyCompile(Code::Flags flags) {
|
||||
return GetCodeWithFlags(flags, "LazyCompileStub");
|
||||
}
|
||||
|
||||
|
||||
Register StubCompiler::CheckPrototypes(JSObject* object,
|
||||
Register object_reg,
|
||||
JSObject* holder,
|
||||
Register holder_reg,
|
||||
Register scratch,
|
||||
String* name,
|
||||
Label* miss) {
|
||||
// Check that the maps haven't changed.
|
||||
Register result =
|
||||
__ CheckMaps(object, object_reg, holder, holder_reg, scratch, miss);
|
||||
|
||||
// If we've skipped any global objects, it's not enough to verify
|
||||
// that their maps haven't changed.
|
||||
while (object != holder) {
|
||||
if (object->IsGlobalObject()) {
|
||||
GlobalObject* global = GlobalObject::cast(object);
|
||||
Object* probe = global->EnsurePropertyCell(name);
|
||||
if (probe->IsFailure()) {
|
||||
set_failure(Failure::cast(probe));
|
||||
return result;
|
||||
}
|
||||
JSGlobalPropertyCell* cell = JSGlobalPropertyCell::cast(probe);
|
||||
ASSERT(cell->value()->IsTheHole());
|
||||
__ Move(scratch, Handle<Object>(cell));
|
||||
__ Cmp(FieldOperand(scratch, JSGlobalPropertyCell::kValueOffset),
|
||||
Factory::the_hole_value());
|
||||
__ j(not_equal, miss);
|
||||
}
|
||||
object = JSObject::cast(object->GetPrototype());
|
||||
}
|
||||
|
||||
// Return the register containing the holder.
|
||||
return result;
|
||||
}
|
||||
|
||||
|
||||
void StubCompiler::GenerateLoadGlobalFunctionPrototype(MacroAssembler* masm,
|
||||
int index,
|
||||
Register prototype) {
|
||||
// Load the global or builtins object from the current context.
|
||||
masm->movq(prototype,
|
||||
Operand(rsi, Context::SlotOffset(Context::GLOBAL_INDEX)));
|
||||
// Load the global context from the global or builtins object.
|
||||
masm->movq(prototype,
|
||||
FieldOperand(prototype, GlobalObject::kGlobalContextOffset));
|
||||
// Load the function from the global context.
|
||||
masm->movq(prototype, Operand(prototype, Context::SlotOffset(index)));
|
||||
// Load the initial map. The global functions all have initial maps.
|
||||
masm->movq(prototype,
|
||||
FieldOperand(prototype, JSFunction::kPrototypeOrInitialMapOffset));
|
||||
// Load the prototype from the initial map.
|
||||
masm->movq(prototype, FieldOperand(prototype, Map::kPrototypeOffset));
|
||||
}
|
||||
|
||||
#undef __
|
||||
|
||||
|
||||
|
||||
@ -97,6 +97,7 @@ mirror-date: CRASH || FAIL
|
||||
invalid-lhs: PASS || CRASH || FAIL
|
||||
debug-stepin-constructor: CRASH || FAIL
|
||||
debug-stepin-function-call: CRASH || FAIL
|
||||
debug-stepin-accessor: CRASH || FAIL
|
||||
new: CRASH || FAIL
|
||||
fuzz-natives: PASS || TIMEOUT
|
||||
greedy: PASS || TIMEOUT
|
||||
|
||||
Loading…
Reference in New Issue
Block a user