AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

X87: VectorICs: keyed element loads were kicking out non-smi keys unnecessarily

Browse Source 
port 6689cc27eb (r27377)

original commit message:

    Handlers should be in charge of this work. The change uncovered a bug in
    vector-ics related to keyed loads into strings. It's important for
    StringCharCodeAtGenerator, a helper used in full code and in
    LoadIndexedStringStub (a handler) to protect the vector and slot registers
    when it makes a runtime call to convert a HeapNumber to a Smi.

    It's still possible for the handler to MISS after this call, perhaps due
    to out of bounds access. In that case, the vector and slot registers need
    to be delivered safely to the MISS handler.

BUG=

Review URL: https://codereview.chromium.org/1033733005

Cr-Commit-Position: refs/heads/master@{#27461}
This commit is contained in:
chunyang.dai 2015-03-25 19:52:59 -07:00 committed by Commit bot
parent a21cc19eef
commit 5d5bf2b77f
2 changed files with 13 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
src/x87/code-stubs-x87.cc
View File

@ -411,7 +411,7 @@ void LoadIndexedStringStub::Generate(MacroAssembler* masm) {
__ ret(0);
StubRuntimeCallHelper call_helper;
char_at_generator.GenerateSlow(masm, call_helper);
char_at_generator.GenerateSlow(masm, PART_OF_IC_HANDLER, call_helper);
__ bind(&miss);
PropertyAccessCompiler::TailCallBuiltin(
@ -2626,7 +2626,7 @@ void StringCharCodeAtGenerator::GenerateFast(MacroAssembler* masm) {
void StringCharCodeAtGenerator::GenerateSlow(
MacroAssembler* masm,
MacroAssembler* masm, EmbedMode embed_mode,
const RuntimeCallHelper& call_helper) {
__ Abort(kUnexpectedFallthroughToCharCodeAtSlowCase);
@ -2638,6 +2638,10 @@ void StringCharCodeAtGenerator::GenerateSlow(
index_not_number_,
DONT_DO_SMI_CHECK);
call_helper.BeforeCall(masm);
if (FLAG_vector_ics && embed_mode == PART_OF_IC_HANDLER) {
__ push(VectorLoadICDescriptor::VectorRegister());
__ push(VectorLoadICDescriptor::SlotRegister());
}
__ push(object_);
__ push(index_); // Consumed by runtime conversion function.
if (index_flags_ == STRING_INDEX_IS_NUMBER) {
@ -2653,6 +2657,10 @@ void StringCharCodeAtGenerator::GenerateSlow(
__ mov(index_, eax);
}
__ pop(object_);
if (FLAG_vector_ics && embed_mode == PART_OF_IC_HANDLER) {
__ pop(VectorLoadICDescriptor::SlotRegister());
__ pop(VectorLoadICDescriptor::VectorRegister());
}
// Reload the instance type.
__ mov(result_, FieldOperand(object_, HeapObject::kMapOffset));
__ movzx_b(result_, FieldOperand(result_, Map::kInstanceTypeOffset));
@ -4249,16 +4257,14 @@ void VectorRawKeyedLoadStub::GenerateImpl(MacroAssembler* masm, bool in_frame) {
Label not_array, smi_key, key_okay, miss;
__ CompareRoot(FieldOperand(feedback, 0), Heap::kWeakCellMapRootIndex);
__ j(not_equal, &try_array);
__ JumpIfNotSmi(key, &miss);
HandleMonomorphicCase(masm, receiver, key, vector, slot, feedback, &miss);
__ bind(&try_array);
// Is it a fixed array?
__ CompareRoot(FieldOperand(feedback, 0), Heap::kFixedArrayMapRootIndex);
__ j(not_equal, &not_array);
// We have a polymorphic element handler.
__ JumpIfNotSmi(key, &miss);
// We have a polymorphic element handler.
Label polymorphic, try_poly_name;
__ bind(&polymorphic);
HandleArrayCases(masm, receiver, key, vector, slot, feedback, true, &miss);

4
src/x87/full-codegen-x87.cc
View File

@ -3993,7 +3993,7 @@ void FullCodeGenerator::EmitStringCharCodeAt(CallRuntime* expr) {
__ jmp(&done);
NopRuntimeCallHelper call_helper;
generator.GenerateSlow(masm_, call_helper);
generator.GenerateSlow(masm_, NOT_PART_OF_IC_HANDLER, call_helper);
__ bind(&done);
context()->Plug(result);
@ -4041,7 +4041,7 @@ void FullCodeGenerator::EmitStringCharAt(CallRuntime* expr) {
__ jmp(&done);
NopRuntimeCallHelper call_helper;
generator.GenerateSlow(masm_, call_helper);
generator.GenerateSlow(masm_, NOT_PART_OF_IC_HANDLER, call_helper);
__ bind(&done);
context()->Plug(result);