// Copyright 2009 the V8 project authors. All rights reserved. // Redistribution and use in source and binary forms, with or without // modification, are permitted provided that the following conditions are // met: // // * Redistributions of source code must retain the above copyright // notice, this list of conditions and the following disclaimer. // * Redistributions in binary form must reproduce the above // copyright notice, this list of conditions and the following // disclaimer in the documentation and/or other materials provided // with the distribution. // * Neither the name of Google Inc. nor the names of its // contributors may be used to endorse or promote products derived // from this software without specific prior written permission. // // THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS // "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT // LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR // A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT // OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, // SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT // LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, // DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY // THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. #include "v8.h" #include "ic-inl.h" #include "codegen-inl.h" #include "stub-cache.h" #include "macro-assembler-x64.h" namespace v8 { namespace internal { #define __ ACCESS_MASM((masm())) Object* CallStubCompiler::CompileCallConstant(Object* object, JSObject* holder, JSFunction* function, String* name, StubCompiler::CheckType check) { // ----------- S t a t e ------------- // ----------------------------------- // rsp[0] return address // rsp[8] argument argc // rsp[16] argument argc - 1 // ... // rsp[argc * 8] argument 1 // rsp[(argc + 1) * 8] argument 0 = reciever // rsp[(argc + 2) * 8] function name Label miss; // Get the receiver from the stack. const int argc = arguments().immediate(); __ movq(rdx, Operand(rsp, (argc + 1) * kPointerSize)); // Check that the receiver isn't a smi. if (check != NUMBER_CHECK) { __ testl(rdx, Immediate(kSmiTagMask)); __ j(zero, &miss); } // Make sure that it's okay not to patch the on stack receiver // unless we're doing a receiver map check. ASSERT(!object->IsGlobalObject() || check == RECEIVER_MAP_CHECK); switch (check) { case RECEIVER_MAP_CHECK: // Check that the maps haven't changed. CheckPrototypes(JSObject::cast(object), rdx, holder, rbx, rcx, name, &miss); // Patch the receiver on the stack with the global proxy if // necessary. if (object->IsGlobalObject()) { __ movq(rdx, FieldOperand(rdx, GlobalObject::kGlobalReceiverOffset)); __ movq(Operand(rsp, (argc + 1) * kPointerSize), rdx); } break; case STRING_CHECK: // Check that the object is a two-byte string or a symbol. __ CmpObjectType(rdx, FIRST_NONSTRING_TYPE, rcx); __ j(above_equal, &miss); // Check that the maps starting from the prototype haven't changed. GenerateLoadGlobalFunctionPrototype(masm(), Context::STRING_FUNCTION_INDEX, rcx); CheckPrototypes(JSObject::cast(object->GetPrototype()), rcx, holder, rbx, rdx, name, &miss); break; case NUMBER_CHECK: { Label fast; // Check that the object is a smi or a heap number. __ testl(rdx, Immediate(kSmiTagMask)); __ j(zero, &fast); __ CmpObjectType(rdx, HEAP_NUMBER_TYPE, rcx); __ j(not_equal, &miss); __ bind(&fast); // Check that the maps starting from the prototype haven't changed. GenerateLoadGlobalFunctionPrototype(masm(), Context::NUMBER_FUNCTION_INDEX, rcx); CheckPrototypes(JSObject::cast(object->GetPrototype()), rcx, holder, rbx, rdx, name, &miss); break; } case BOOLEAN_CHECK: { Label fast; // Check that the object is a boolean. __ Cmp(rdx, Factory::true_value()); __ j(equal, &fast); __ Cmp(rdx, Factory::false_value()); __ j(not_equal, &miss); __ bind(&fast); // Check that the maps starting from the prototype haven't changed. GenerateLoadGlobalFunctionPrototype(masm(), Context::BOOLEAN_FUNCTION_INDEX, rcx); CheckPrototypes(JSObject::cast(object->GetPrototype()), rcx, holder, rbx, rdx, name, &miss); break; } case JSARRAY_HAS_FAST_ELEMENTS_CHECK: CheckPrototypes(JSObject::cast(object), rdx, holder, rbx, rcx, name, &miss); // Make sure object->elements()->map() != Heap::dictionary_array_map() // Get the elements array of the object. __ movq(rbx, FieldOperand(rdx, JSObject::kElementsOffset)); // Check that the object is in fast mode (not dictionary). __ Cmp(FieldOperand(rbx, HeapObject::kMapOffset), Factory::hash_table_map()); __ j(equal, &miss); break; default: UNREACHABLE(); } // Get the function and setup the context. __ Move(rdi, Handle(function)); __ movq(rsi, FieldOperand(rdi, JSFunction::kContextOffset)); // Jump to the cached code (tail call). ASSERT(function->is_compiled()); Handle code(function->code()); ParameterCount expected(function->shared()->formal_parameter_count()); __ InvokeCode(code, expected, arguments(), RelocInfo::CODE_TARGET, JUMP_FUNCTION); // Handle call cache miss. __ bind(&miss); Handle ic = ComputeCallMiss(arguments().immediate()); __ Jump(ic, RelocInfo::CODE_TARGET); // Return the generated code. String* function_name = NULL; if (function->shared()->name()->IsString()) { function_name = String::cast(function->shared()->name()); } return GetCode(CONSTANT_FUNCTION, function_name); } Object* CallStubCompiler::CompileCallField(Object* object, JSObject* holder, int index, String* name) { // ----------- S t a t e ------------- // ----------------------------------- // rsp[0] return address // rsp[8] argument argc // rsp[16] argument argc - 1 // ... // rsp[argc * 8] argument 1 // rsp[(argc + 1) * 8] argument 0 = receiver // rsp[(argc + 2) * 8] function name Label miss; // Get the receiver from the stack. const int argc = arguments().immediate(); __ movq(rdx, Operand(rsp, (argc + 1) * kPointerSize)); // Check that the receiver isn't a smi. __ testl(rdx, Immediate(kSmiTagMask)); __ j(zero, &miss); // Do the right check and compute the holder register. Register reg = CheckPrototypes(JSObject::cast(object), rdx, holder, rbx, rcx, name, &miss); GenerateFastPropertyLoad(masm(), rdi, reg, holder, index); // Check that the function really is a function. __ testl(rdi, Immediate(kSmiTagMask)); __ j(zero, &miss); __ CmpObjectType(rdi, JS_FUNCTION_TYPE, rbx); __ j(not_equal, &miss); // Patch the receiver on the stack with the global proxy if // necessary. if (object->IsGlobalObject()) { __ movq(rdx, FieldOperand(rdx, GlobalObject::kGlobalReceiverOffset)); __ movq(Operand(rsp, (argc + 1) * kPointerSize), rdx); } // Invoke the function. __ InvokeFunction(rdi, arguments(), JUMP_FUNCTION); // Handle call cache miss. __ bind(&miss); Handle ic = ComputeCallMiss(arguments().immediate()); __ Jump(ic, RelocInfo::CODE_TARGET); // Return the generated code. return GetCode(FIELD, name); } Object* CallStubCompiler::CompileCallInterceptor(Object* a, JSObject* b, String* c) { // TODO(X64): Implement a real stub. return Failure::InternalError(); } Object* CallStubCompiler::CompileCallGlobal(JSObject* object, GlobalObject* holder, JSGlobalPropertyCell* cell, JSFunction* function, String* name) { // ----------- S t a t e ------------- // ----------------------------------- // rsp[0] return address // rsp[8] argument argc // rsp[16] argument argc - 1 // ... // rsp[argc * 8] argument 1 // rsp[(argc + 1) * 8] argument 0 = receiver // rsp[(argc + 2) * 8] function name Label miss; __ IncrementCounter(&Counters::call_global_inline, 1); // Get the number of arguments. const int argc = arguments().immediate(); // Get the receiver from the stack. __ movq(rdx, Operand(rsp, (argc + 1) * kPointerSize)); // If the object is the holder then we know that it's a global // object which can only happen for contextual calls. In this case, // the receiver cannot be a smi. if (object != holder) { __ testl(rdx, Immediate(kSmiTagMask)); __ j(zero, &miss); } // Check that the maps haven't changed. CheckPrototypes(object, rdx, holder, rbx, rcx, name, &miss); // Get the value from the cell. __ Move(rdi, Handle(cell)); __ movq(rdi, FieldOperand(rdi, JSGlobalPropertyCell::kValueOffset)); // Check that the cell contains the same function. __ Cmp(rdi, Handle(function)); __ j(not_equal, &miss); // Patch the receiver on the stack with the global proxy. if (object->IsGlobalObject()) { __ movq(rdx, FieldOperand(rdx, GlobalObject::kGlobalReceiverOffset)); __ movq(Operand(rsp, (argc + 1) * kPointerSize), rdx); } // Setup the context (function already in edi). __ movq(rsi, FieldOperand(rdi, JSFunction::kContextOffset)); // Jump to the cached code (tail call). ASSERT(function->is_compiled()); Handle code(function->code()); ParameterCount expected(function->shared()->formal_parameter_count()); __ InvokeCode(code, expected, arguments(), RelocInfo::CODE_TARGET, JUMP_FUNCTION); // Handle call cache miss. __ bind(&miss); __ DecrementCounter(&Counters::call_global_inline, 1); __ IncrementCounter(&Counters::call_global_inline_miss, 1); Handle ic = ComputeCallMiss(arguments().immediate()); __ Jump(ic, RelocInfo::CODE_TARGET); // Return the generated code. return GetCode(NORMAL, name); } Object* LoadStubCompiler::CompileLoadCallback(JSObject* a, JSObject* b, AccessorInfo* c, String* d) { UNIMPLEMENTED(); return NULL; } Object* LoadStubCompiler::CompileLoadConstant(JSObject* a, JSObject* b, Object* c, String* d) { UNIMPLEMENTED(); return NULL; } Object* LoadStubCompiler::CompileLoadField(JSObject* a, JSObject* b, int c, String* d) { UNIMPLEMENTED(); return NULL; } Object* LoadStubCompiler::CompileLoadInterceptor(JSObject* a, JSObject* b, String* c) { UNIMPLEMENTED(); return NULL; } Object* LoadStubCompiler::CompileLoadGlobal(JSObject* object, GlobalObject* holder, JSGlobalPropertyCell* cell, String* name, bool is_dont_delete) { UNIMPLEMENTED(); return NULL; } Object* StoreStubCompiler::CompileStoreCallback(JSObject* a, AccessorInfo* b, String* c) { UNIMPLEMENTED(); return NULL; } Object* StoreStubCompiler::CompileStoreField(JSObject* a, int b, Map* c, String* d) { UNIMPLEMENTED(); return NULL; } Object* StoreStubCompiler::CompileStoreInterceptor(JSObject* a, String* b) { UNIMPLEMENTED(); return NULL; } Object* StoreStubCompiler::CompileStoreGlobal(GlobalObject* object, JSGlobalPropertyCell* cell, String* name) { UNIMPLEMENTED(); return NULL; } // TODO(1241006): Avoid having lazy compile stubs specialized by the // number of arguments. It is not needed anymore. Object* StubCompiler::CompileLazyCompile(Code::Flags flags) { // Enter an internal frame. __ EnterInternalFrame(); // Push a copy of the function onto the stack. __ push(rdi); __ push(rdi); // function is also the parameter to the runtime call __ CallRuntime(Runtime::kLazyCompile, 1); __ pop(rdi); // Tear down temporary frame. __ LeaveInternalFrame(); // Do a tail-call of the compiled function. __ lea(rcx, FieldOperand(rax, Code::kHeaderSize)); __ jmp(rcx); return GetCodeWithFlags(flags, "LazyCompileStub"); } Register StubCompiler::CheckPrototypes(JSObject* object, Register object_reg, JSObject* holder, Register holder_reg, Register scratch, String* name, Label* miss) { // Check that the maps haven't changed. Register result = __ CheckMaps(object, object_reg, holder, holder_reg, scratch, miss); // If we've skipped any global objects, it's not enough to verify // that their maps haven't changed. while (object != holder) { if (object->IsGlobalObject()) { GlobalObject* global = GlobalObject::cast(object); Object* probe = global->EnsurePropertyCell(name); if (probe->IsFailure()) { set_failure(Failure::cast(probe)); return result; } JSGlobalPropertyCell* cell = JSGlobalPropertyCell::cast(probe); ASSERT(cell->value()->IsTheHole()); __ Move(scratch, Handle(cell)); __ Cmp(FieldOperand(scratch, JSGlobalPropertyCell::kValueOffset), Factory::the_hole_value()); __ j(not_equal, miss); } object = JSObject::cast(object->GetPrototype()); } // Return the register containing the holder. return result; } #undef __ //----------------------------------------------------------------------------- // StubCompiler static helper functions #define __ ACCESS_MASM(masm) void StubCompiler::GenerateLoadGlobalFunctionPrototype(MacroAssembler* masm, int index, Register prototype) { // Load the global or builtins object from the current context. __ movq(prototype, Operand(rsi, Context::SlotOffset(Context::GLOBAL_INDEX))); // Load the global context from the global or builtins object. __ movq(prototype, FieldOperand(prototype, GlobalObject::kGlobalContextOffset)); // Load the function from the global context. __ movq(prototype, Operand(prototype, Context::SlotOffset(index))); // Load the initial map. The global functions all have initial maps. __ movq(prototype, FieldOperand(prototype, JSFunction::kPrototypeOrInitialMapOffset)); // Load the prototype from the initial map. __ movq(prototype, FieldOperand(prototype, Map::kPrototypeOffset)); } // Load a fast property out of a holder object (src). In-object properties // are loaded directly otherwise the property is loaded from the properties // fixed array. void StubCompiler::GenerateFastPropertyLoad(MacroAssembler* masm, Register dst, Register src, JSObject* holder, int index) { // Adjust for the number of properties stored in the holder. index -= holder->map()->inobject_properties(); if (index < 0) { // Get the property straight out of the holder. int offset = holder->map()->instance_size() + (index * kPointerSize); __ movq(dst, FieldOperand(src, offset)); } else { // Calculate the offset into the properties array. int offset = index * kPointerSize + FixedArray::kHeaderSize; __ movq(dst, FieldOperand(src, JSObject::kPropertiesOffset)); __ movq(dst, FieldOperand(dst, offset)); } } #undef __ } } // namespace v8::internal