Merge V8 5.2.361.47 DO NOT MERGE
https://chromium.googlesource.com/v8/v8/+/5.2.361.47
FPIIM-449
Change-Id: Ibec421b85a9b88cb3a432ada642e469fe7e78346
(cherry picked from commit bcf72ee8e3b26f1d0726869c7ddb3921c68b09a8)
diff --git a/src/s390/code-stubs-s390.cc b/src/s390/code-stubs-s390.cc
index 1c7d27b..e1e2003 100644
--- a/src/s390/code-stubs-s390.cc
+++ b/src/s390/code-stubs-s390.cc
@@ -51,11 +51,6 @@
}
}
-void ArrayNoArgumentConstructorStub::InitializeDescriptor(
- CodeStubDescriptor* descriptor) {
- InitializeArrayConstructorDescriptor(isolate(), descriptor, 0);
-}
-
void ArraySingleArgumentConstructorStub::InitializeDescriptor(
CodeStubDescriptor* descriptor) {
InitializeArrayConstructorDescriptor(isolate(), descriptor, 1);
@@ -66,11 +61,6 @@
InitializeArrayConstructorDescriptor(isolate(), descriptor, -1);
}
-void InternalArrayNoArgumentConstructorStub::InitializeDescriptor(
- CodeStubDescriptor* descriptor) {
- InitializeInternalArrayConstructorDescriptor(isolate(), descriptor, 0);
-}
-
void FastArrayPushStub::InitializeDescriptor(CodeStubDescriptor* descriptor) {
Address deopt_handler = Runtime::FunctionForId(Runtime::kArrayPush)->entry;
descriptor->Initialize(r2, deopt_handler, -1, JS_FUNCTION_STUB_MODE);
@@ -1377,125 +1367,6 @@
__ b(r14);
}
-void InstanceOfStub::Generate(MacroAssembler* masm) {
- Register const object = r3; // Object (lhs).
- Register const function = r2; // Function (rhs).
- Register const object_map = r4; // Map of {object}.
- Register const function_map = r5; // Map of {function}.
- Register const function_prototype = r6; // Prototype of {function}.
- Register const scratch = r7;
-
- DCHECK(object.is(InstanceOfDescriptor::LeftRegister()));
- DCHECK(function.is(InstanceOfDescriptor::RightRegister()));
-
- // Check if {object} is a smi.
- Label object_is_smi;
- __ JumpIfSmi(object, &object_is_smi);
-
- // Lookup the {function} and the {object} map in the global instanceof cache.
- // Note: This is safe because we clear the global instanceof cache whenever
- // we change the prototype of any object.
- Label fast_case, slow_case;
- __ LoadP(object_map, FieldMemOperand(object, HeapObject::kMapOffset));
- __ CompareRoot(function, Heap::kInstanceofCacheFunctionRootIndex);
- __ bne(&fast_case);
- __ CompareRoot(object_map, Heap::kInstanceofCacheMapRootIndex);
- __ bne(&fast_case);
- __ LoadRoot(r2, Heap::kInstanceofCacheAnswerRootIndex);
- __ Ret();
-
- // If {object} is a smi we can safely return false if {function} is a JS
- // function, otherwise we have to miss to the runtime and throw an exception.
- __ bind(&object_is_smi);
- __ JumpIfSmi(function, &slow_case);
- __ CompareObjectType(function, function_map, scratch, JS_FUNCTION_TYPE);
- __ bne(&slow_case);
- __ LoadRoot(r2, Heap::kFalseValueRootIndex);
- __ Ret();
-
- // Fast-case: The {function} must be a valid JSFunction.
- __ bind(&fast_case);
- __ JumpIfSmi(function, &slow_case);
- __ CompareObjectType(function, function_map, scratch, JS_FUNCTION_TYPE);
- __ bne(&slow_case);
-
- // Go to the runtime if the function is not a constructor.
- __ LoadlB(scratch, FieldMemOperand(function_map, Map::kBitFieldOffset));
- __ TestBit(scratch, Map::kIsConstructor, r0);
- __ beq(&slow_case);
-
- // Ensure that {function} has an instance prototype.
- __ TestBit(scratch, Map::kHasNonInstancePrototype, r0);
- __ bne(&slow_case);
-
- // Get the "prototype" (or initial map) of the {function}.
- __ LoadP(function_prototype,
- FieldMemOperand(function, JSFunction::kPrototypeOrInitialMapOffset));
- __ AssertNotSmi(function_prototype);
-
- // Resolve the prototype if the {function} has an initial map. Afterwards the
- // {function_prototype} will be either the JSReceiver prototype object or the
- // hole value, which means that no instances of the {function} were created so
- // far and hence we should return false.
- Label function_prototype_valid;
- __ CompareObjectType(function_prototype, scratch, scratch, MAP_TYPE);
- __ bne(&function_prototype_valid);
- __ LoadP(function_prototype,
- FieldMemOperand(function_prototype, Map::kPrototypeOffset));
- __ bind(&function_prototype_valid);
- __ AssertNotSmi(function_prototype);
-
- // Update the global instanceof cache with the current {object} map and
- // {function}. The cached answer will be set when it is known below.
- __ StoreRoot(function, Heap::kInstanceofCacheFunctionRootIndex);
- __ StoreRoot(object_map, Heap::kInstanceofCacheMapRootIndex);
-
- // Loop through the prototype chain looking for the {function} prototype.
- // Assume true, and change to false if not found.
- Register const object_instance_type = function_map;
- Register const map_bit_field = function_map;
- Register const null = scratch;
- Register const result = r2;
-
- Label done, loop, fast_runtime_fallback;
- __ LoadRoot(result, Heap::kTrueValueRootIndex);
- __ LoadRoot(null, Heap::kNullValueRootIndex);
- __ bind(&loop);
-
- // Check if the object needs to be access checked.
- __ LoadlB(map_bit_field, FieldMemOperand(object_map, Map::kBitFieldOffset));
- __ TestBit(map_bit_field, Map::kIsAccessCheckNeeded, r0);
- __ bne(&fast_runtime_fallback);
- // Check if the current object is a Proxy.
- __ CompareInstanceType(object_map, object_instance_type, JS_PROXY_TYPE);
- __ beq(&fast_runtime_fallback);
-
- __ LoadP(object, FieldMemOperand(object_map, Map::kPrototypeOffset));
- __ CmpP(object, function_prototype);
- __ beq(&done);
- __ CmpP(object, null);
- __ LoadP(object_map, FieldMemOperand(object, HeapObject::kMapOffset));
- __ bne(&loop);
- __ LoadRoot(result, Heap::kFalseValueRootIndex);
- __ bind(&done);
- __ StoreRoot(result, Heap::kInstanceofCacheAnswerRootIndex);
- __ Ret();
-
- // Found Proxy or access check needed: Call the runtime
- __ bind(&fast_runtime_fallback);
- __ Push(object, function_prototype);
- // Invalidate the instanceof cache.
- __ LoadSmiLiteral(scratch, Smi::FromInt(0));
- __ StoreRoot(scratch, Heap::kInstanceofCacheFunctionRootIndex);
- __ TailCallRuntime(Runtime::kHasInPrototypeChain);
-
- // Slow-case: Call the %InstanceOf runtime function.
- __ bind(&slow_case);
- __ Push(object, function);
- __ TailCallRuntime(is_es6_instanceof() ? Runtime::kOrdinaryHasInstance
- : Runtime::kInstanceOf);
-}
-
void FunctionPrototypeStub::Generate(MacroAssembler* masm) {
Label miss;
Register receiver = LoadDescriptor::ReceiverRegister();
@@ -3898,8 +3769,8 @@
__ bind(¬_array);
__ CompareRoot(feedback, Heap::kmegamorphic_symbolRootIndex);
__ bne(&miss);
- Code::Flags code_flags = Code::RemoveTypeAndHolderFromFlags(
- Code::ComputeHandlerFlags(Code::LOAD_IC));
+ Code::Flags code_flags =
+ Code::RemoveHolderFromFlags(Code::ComputeHandlerFlags(Code::LOAD_IC));
masm->isolate()->stub_cache()->GenerateProbe(masm, Code::LOAD_IC, code_flags,
receiver, name, feedback,
receiver_map, scratch1, r9);
@@ -4033,8 +3904,8 @@
__ bind(¬_array);
__ CompareRoot(feedback, Heap::kmegamorphic_symbolRootIndex);
__ bne(&miss);
- Code::Flags code_flags = Code::RemoveTypeAndHolderFromFlags(
- Code::ComputeHandlerFlags(Code::STORE_IC));
+ Code::Flags code_flags =
+ Code::RemoveHolderFromFlags(Code::ComputeHandlerFlags(Code::STORE_IC));
masm->isolate()->stub_cache()->GenerateProbe(
masm, Code::STORE_IC, code_flags, receiver, key, feedback, receiver_map,
scratch1, scratch2);
@@ -4625,15 +4496,15 @@
__ bind(&done_allocate);
// Initialize the JSObject fields.
- __ StoreP(r4, MemOperand(r2, JSObject::kMapOffset));
+ __ StoreP(r4, FieldMemOperand(r2, JSObject::kMapOffset));
__ LoadRoot(r5, Heap::kEmptyFixedArrayRootIndex);
- __ StoreP(r5, MemOperand(r2, JSObject::kPropertiesOffset));
- __ StoreP(r5, MemOperand(r2, JSObject::kElementsOffset));
+ __ StoreP(r5, FieldMemOperand(r2, JSObject::kPropertiesOffset));
+ __ StoreP(r5, FieldMemOperand(r2, JSObject::kElementsOffset));
STATIC_ASSERT(JSObject::kHeaderSize == 3 * kPointerSize);
- __ AddP(r3, r2, Operand(JSObject::kHeaderSize));
+ __ AddP(r3, r2, Operand(JSObject::kHeaderSize - kHeapObjectTag));
// ----------- S t a t e -------------
- // -- r2 : result (untagged)
+ // -- r2 : result (tagged)
// -- r3 : result fields (untagged)
// -- r7 : result end (untagged)
// -- r4 : initial map
@@ -4653,8 +4524,6 @@
// Initialize all in-object fields with undefined.
__ InitializeFieldsWithFiller(r3, r7, r8);
- // Add the object tag to make the JSObject real.
- __ AddP(r2, r2, Operand(kHeapObjectTag));
__ Ret();
}
__ bind(&slack_tracking);
@@ -4674,9 +4543,6 @@
__ LoadRoot(r8, Heap::kOnePointerFillerMapRootIndex);
__ InitializeFieldsWithFiller(r3, r7, r8);
- // Add the object tag to make the JSObject real.
- __ AddP(r2, r2, Operand(kHeapObjectTag));
-
// Check if we can finalize the instance size.
__ CmpP(r9, Operand(Map::kSlackTrackingCounterEnd));
__ Ret(ne);
@@ -4702,10 +4568,10 @@
__ CallRuntime(Runtime::kAllocateInNewSpace);
__ Pop(r4);
}
- __ SubP(r2, r2, Operand(kHeapObjectTag));
__ LoadlB(r7, FieldMemOperand(r4, Map::kInstanceSizeOffset));
__ ShiftLeftP(r7, r7, Operand(kPointerSizeLog2));
__ AddP(r7, r2, r7);
+ __ SubP(r7, r7, Operand(kHeapObjectTag));
__ b(&done_allocate);
// Fall back to %NewObject.
@@ -4723,20 +4589,20 @@
// -----------------------------------
__ AssertFunction(r3);
- // For Ignition we need to skip all possible handler/stub frames until
- // we reach the JavaScript frame for the function (similar to what the
- // runtime fallback implementation does). So make r4 point to that
- // JavaScript frame.
- {
- Label loop, loop_entry;
- __ LoadRR(r4, fp);
- __ b(&loop_entry);
- __ bind(&loop);
+ // Make r4 point to the JavaScript frame.
+ __ LoadRR(r4, fp);
+ if (skip_stub_frame()) {
+ // For Ignition we need to skip the handler/stub frame to reach the
+ // JavaScript frame for the function.
__ LoadP(r4, MemOperand(r4, StandardFrameConstants::kCallerFPOffset));
- __ bind(&loop_entry);
+ }
+ if (FLAG_debug_code) {
+ Label ok;
__ LoadP(ip, MemOperand(r4, StandardFrameConstants::kFunctionOffset));
__ CmpP(ip, r3);
- __ bne(&loop);
+ __ b(&ok, Label::kNear);
+ __ Abort(kInvalidFrameForFastNewRestArgumentsStub);
+ __ bind(&ok);
}
// Check if we have rest parameters (only possible if we have an
@@ -4770,7 +4636,7 @@
// Allocate an empty rest parameter array.
Label allocate, done_allocate;
- __ Allocate(JSArray::kSize, r2, r3, r4, &allocate, TAG_OBJECT);
+ __ Allocate(JSArray::kSize, r2, r3, r4, &allocate, NO_ALLOCATION_FLAGS);
__ bind(&done_allocate);
// Setup the rest parameter array in r0.
@@ -4813,7 +4679,7 @@
Label allocate, done_allocate;
__ mov(r3, Operand(JSArray::kSize + FixedArray::kHeaderSize));
__ AddP(r3, r3, r8);
- __ Allocate(r3, r5, r6, r7, &allocate, TAG_OBJECT);
+ __ Allocate(r3, r5, r6, r7, &allocate, NO_ALLOCATION_FLAGS);
__ bind(&done_allocate);
// Setup the elements array in r5.
@@ -4870,6 +4736,22 @@
// -----------------------------------
__ AssertFunction(r3);
+ // Make r9 point to the JavaScript frame.
+ __ LoadRR(r9, fp);
+ if (skip_stub_frame()) {
+ // For Ignition we need to skip the handler/stub frame to reach the
+ // JavaScript frame for the function.
+ __ LoadP(r9, MemOperand(r9, StandardFrameConstants::kCallerFPOffset));
+ }
+ if (FLAG_debug_code) {
+ Label ok;
+ __ LoadP(ip, MemOperand(r9, StandardFrameConstants::kFunctionOffset));
+ __ CmpP(ip, r3);
+ __ beq(&ok, Label::kNear);
+ __ Abort(kInvalidFrameForFastNewRestArgumentsStub);
+ __ bind(&ok);
+ }
+
// TODO(bmeurer): Cleanup to match the FastNewStrictArgumentsStub.
__ LoadP(r4, FieldMemOperand(r3, JSFunction::kSharedFunctionInfoOffset));
__ LoadW(
@@ -4878,19 +4760,20 @@
__ SmiTag(r4);
#endif
__ SmiToPtrArrayOffset(r5, r4);
- __ AddP(r5, fp, r5);
+ __ AddP(r5, r9, r5);
__ AddP(r5, r5, Operand(StandardFrameConstants::kCallerSPOffset));
// r3 : function
// r4 : number of parameters (tagged)
// r5 : parameters pointer
+ // r9 : JavaScript frame pointer
// Registers used over whole function:
// r7 : arguments count (tagged)
// r8 : mapped parameter count (tagged)
// Check if the calling frame is an arguments adaptor frame.
Label adaptor_frame, try_allocate, runtime;
- __ LoadP(r6, MemOperand(fp, StandardFrameConstants::kCallerFPOffset));
+ __ LoadP(r6, MemOperand(r9, StandardFrameConstants::kCallerFPOffset));
__ LoadP(r2, MemOperand(r6, CommonFrameConstants::kContextOrFrameTypeOffset));
__ CmpSmiLiteral(r2, Smi::FromInt(StackFrame::ARGUMENTS_ADAPTOR), r0);
__ beq(&adaptor_frame);
@@ -4943,7 +4826,7 @@
__ AddP(r1, r1, Operand(JSSloppyArgumentsObject::kSize));
// Do the allocation of all three objects in one go.
- __ Allocate(r1, r2, r1, r6, &runtime, TAG_OBJECT);
+ __ Allocate(r1, r2, r1, r6, &runtime, NO_ALLOCATION_FLAGS);
// r2 = address of new object(s) (tagged)
// r4 = argument count (smi-tagged)
@@ -5107,20 +4990,20 @@
// -----------------------------------
__ AssertFunction(r3);
- // For Ignition we need to skip all possible handler/stub frames until
- // we reach the JavaScript frame for the function (similar to what the
- // runtime fallback implementation does). So make r4 point to that
- // JavaScript frame.
- {
- Label loop, loop_entry;
- __ LoadRR(r4, fp);
- __ b(&loop_entry);
- __ bind(&loop);
+ // Make r4 point to the JavaScript frame.
+ __ LoadRR(r4, fp);
+ if (skip_stub_frame()) {
+ // For Ignition we need to skip the handler/stub frame to reach the
+ // JavaScript frame for the function.
__ LoadP(r4, MemOperand(r4, StandardFrameConstants::kCallerFPOffset));
- __ bind(&loop_entry);
+ }
+ if (FLAG_debug_code) {
+ Label ok;
__ LoadP(ip, MemOperand(r4, StandardFrameConstants::kFunctionOffset));
__ CmpP(ip, r3);
- __ bne(&loop);
+ __ beq(&ok, Label::kNear);
+ __ Abort(kInvalidFrameForFastNewRestArgumentsStub);
+ __ bind(&ok);
}
// Check if we have an arguments adaptor frame below the function frame.
@@ -5161,7 +5044,7 @@
Label allocate, done_allocate;
__ mov(r3, Operand(JSStrictArgumentsObject::kSize + FixedArray::kHeaderSize));
__ AddP(r3, r3, r8);
- __ Allocate(r3, r5, r6, r7, &allocate, TAG_OBJECT);
+ __ Allocate(r3, r5, r6, r7, &allocate, NO_ALLOCATION_FLAGS);
__ bind(&done_allocate);
// Setup the elements array in r5.
@@ -5533,7 +5416,11 @@
STATIC_ASSERT(FCA::kReturnValueDefaultValueIndex == 2);
STATIC_ASSERT(FCA::kIsolateIndex == 1);
STATIC_ASSERT(FCA::kHolderIndex == 0);
- STATIC_ASSERT(FCA::kArgsLength == 7);
+ STATIC_ASSERT(FCA::kNewTargetIndex == 7);
+ STATIC_ASSERT(FCA::kArgsLength == 8);
+
+ // new target
+ __ PushRoot(Heap::kUndefinedValueRootIndex);
// context save
__ push(context);
@@ -5569,10 +5456,10 @@
// it's not controlled by GC.
// S390 LINUX ABI:
//
- // Create 5 extra slots on stack:
+ // Create 4 extra slots on stack:
// [0] space for DirectCEntryStub's LR save
- // [1-4] FunctionCallbackInfo
- const int kApiStackSpace = 5;
+ // [1-3] FunctionCallbackInfo
+ const int kApiStackSpace = 4;
const int kFunctionCallbackInfoOffset =
(kStackFrameExtraParamSlot + 1) * kPointerSize;
@@ -5591,9 +5478,6 @@
// FunctionCallbackInfo::length_ = argc
__ LoadImmP(ip, Operand(argc()));
__ StoreW(ip, MemOperand(r2, 2 * kPointerSize));
- // FunctionCallbackInfo::is_construct_call_ = 0
- __ LoadImmP(ip, Operand::Zero());
- __ StoreW(ip, MemOperand(r2, 2 * kPointerSize + kIntSize));
ExternalReference thunk_ref =
ExternalReference::invoke_function_callback(masm->isolate());
@@ -5610,9 +5494,9 @@
}
MemOperand return_value_operand(fp, return_value_offset * kPointerSize);
int stack_space = 0;
- MemOperand is_construct_call_operand =
- MemOperand(sp, kFunctionCallbackInfoOffset + 2 * kPointerSize + kIntSize);
- MemOperand* stack_space_operand = &is_construct_call_operand;
+ MemOperand length_operand =
+ MemOperand(sp, kFunctionCallbackInfoOffset + 2 * kPointerSize);
+ MemOperand* stack_space_operand = &length_operand;
stack_space = argc() + FCA::kArgsLength + 1;
stack_space_operand = NULL;
CallApiFunctionAndReturn(masm, api_function_address, thunk_ref, stack_space,
@@ -5621,18 +5505,39 @@
}
void CallApiGetterStub::Generate(MacroAssembler* masm) {
- // ----------- S t a t e -------------
- // -- sp[0] : name
- // -- sp[4 .. (4 + kArgsLength*4)] : v8::PropertyCallbackInfo::args_
- // -- ...
- // -- r4 : api_function_address
- // -----------------------------------
-
- Register api_function_address = ApiGetterDescriptor::function_address();
int arg0Slot = 0;
int accessorInfoSlot = 0;
int apiStackSpace = 0;
- DCHECK(api_function_address.is(r4));
+ // Build v8::PropertyCallbackInfo::args_ array on the stack and push property
+ // name below the exit frame to make GC aware of them.
+ STATIC_ASSERT(PropertyCallbackArguments::kShouldThrowOnErrorIndex == 0);
+ STATIC_ASSERT(PropertyCallbackArguments::kHolderIndex == 1);
+ STATIC_ASSERT(PropertyCallbackArguments::kIsolateIndex == 2);
+ STATIC_ASSERT(PropertyCallbackArguments::kReturnValueDefaultValueIndex == 3);
+ STATIC_ASSERT(PropertyCallbackArguments::kReturnValueOffset == 4);
+ STATIC_ASSERT(PropertyCallbackArguments::kDataIndex == 5);
+ STATIC_ASSERT(PropertyCallbackArguments::kThisIndex == 6);
+ STATIC_ASSERT(PropertyCallbackArguments::kArgsLength == 7);
+
+ Register receiver = ApiGetterDescriptor::ReceiverRegister();
+ Register holder = ApiGetterDescriptor::HolderRegister();
+ Register callback = ApiGetterDescriptor::CallbackRegister();
+ Register scratch = r6;
+ DCHECK(!AreAliased(receiver, holder, callback, scratch));
+
+ Register api_function_address = r4;
+
+ __ push(receiver);
+ // Push data from AccessorInfo.
+ __ LoadP(scratch, FieldMemOperand(callback, AccessorInfo::kDataOffset));
+ __ push(scratch);
+ __ LoadRoot(scratch, Heap::kUndefinedValueRootIndex);
+ __ Push(scratch, scratch);
+ __ mov(scratch, Operand(ExternalReference::isolate_address(isolate())));
+ __ Push(scratch, holder);
+ __ Push(Smi::FromInt(0)); // should_throw_on_error -> false
+ __ LoadP(scratch, FieldMemOperand(callback, AccessorInfo::kNameOffset));
+ __ push(scratch);
// v8::PropertyCallbackInfo::args_ array and name handle.
const int kStackUnwindSpace = PropertyCallbackArguments::kArgsLength + 1;
@@ -5680,6 +5585,10 @@
ExternalReference thunk_ref =
ExternalReference::invoke_accessor_getter_callback(isolate());
+ __ LoadP(scratch, FieldMemOperand(callback, AccessorInfo::kJsGetterOffset));
+ __ LoadP(api_function_address,
+ FieldMemOperand(scratch, Foreign::kForeignAddressOffset));
+
// +3 is to skip prolog, return address and name handle.
MemOperand return_value_operand(
fp, (PropertyCallbackArguments::kReturnValueOffset + 3) * kPointerSize);