AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

X87: Fix keyed element access wrt string wrappers

Browse Source 
port 01f40e6ad6 (r29618).

original commit message:

BUG=

Review URL: https://codereview.chromium.org/1233033004

Cr-Commit-Position: refs/heads/master@{#29644}
This commit is contained in:
chunyang.dai 2015-07-14 03:12:57 -07:00 committed by Commit bot
parent 4fc51603b7
commit f3b843bb98
2 changed files with 19 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
src/ic/x87/ic-x87.cc
View File

@ -157,10 +157,9 @@ static void GenerateKeyedLoadReceiverCheck(MacroAssembler* masm,
__ test_b(FieldOperand(map, Map::kBitFieldOffset),
(1 << Map::kIsAccessCheckNeeded) | (1 << interceptor_bit));
__ j(not_zero, slow);
// Check that the object is some kind of JS object EXCEPT JS Value type.
// In the case that the object is a value-wrapper object,
// we enter the runtime system to make sure that indexing
// into string objects works as intended.
// Check that the object is some kind of JS object EXCEPT JS Value type. In
// the case that the object is a value-wrapper object, we enter the runtime
// system to make sure that indexing into string objects works as intended.
DCHECK(JS_OBJECT_TYPE > JS_VALUE_TYPE);
__ CmpInstanceType(map, JS_OBJECT_TYPE);
@ -539,8 +538,11 @@ void KeyedStoreIC::GenerateMegamorphic(MacroAssembler* masm,
__ JumpIfNotSmi(key, &maybe_name_key);
__ CmpInstanceType(edi, JS_ARRAY_TYPE);
__ j(equal, &array);
// Check that the object is some kind of JSObject.
__ CmpInstanceType(edi, FIRST_JS_OBJECT_TYPE);
// Check that the object is some kind of JS object EXCEPT JS Value type. In
// the case that the object is a value-wrapper object, we enter the runtime
// system to make sure that indexing into string objects works as intended.
STATIC_ASSERT(JS_VALUE_TYPE < JS_OBJECT_TYPE);
__ CmpInstanceType(edi, JS_OBJECT_TYPE);
__ j(below, &slow);
// Object case: Check key against length in the elements array.

12
src/x87/macro-assembler-x87.cc
View File

@ -3055,14 +3055,22 @@ void MacroAssembler::JumpIfDictionaryInPrototypeChain(
DCHECK(!scratch1.is(scratch0));
Factory* factory = isolate()->factory();
Register current = scratch0;
Label loop_again;
Label loop_again, end;
// scratch contained elements pointer.
mov(current, object);
mov(current, FieldOperand(current, HeapObject::kMapOffset));
mov(current, FieldOperand(current, Map::kPrototypeOffset));
cmp(current, Immediate(factory->null_value()));
j(equal, &end);
// Loop based on the map going up the prototype chain.
bind(&loop_again);
mov(current, FieldOperand(current, HeapObject::kMapOffset));
STATIC_ASSERT(JS_PROXY_TYPE < JS_OBJECT_TYPE);
STATIC_ASSERT(JS_VALUE_TYPE < JS_OBJECT_TYPE);
CmpInstanceType(current, JS_OBJECT_TYPE);
j(below, found);
mov(scratch1, FieldOperand(current, Map::kBitField2Offset));
DecodeField<Map::ElementsKindBits>(scratch1);
cmp(scratch1, Immediate(DICTIONARY_ELEMENTS));
@ -3070,6 +3078,8 @@ void MacroAssembler::JumpIfDictionaryInPrototypeChain(
mov(current, FieldOperand(current, Map::kPrototypeOffset));
cmp(current, Immediate(factory->null_value()));
j(not_equal, &loop_again);
bind(&end);
}