Upgrade V8 to 5.1.281.57 DO NOT MERGE
FPIIM-449
Change-Id: Id981b686b4d587ac31697662eb98bb34be42ad90
(cherry picked from commit 3b9bc31999c9787eb726ecdbfd5796bfdec32a18)
diff --git a/src/code-stubs-hydrogen.cc b/src/code-stubs-hydrogen.cc
index 461baaa..1d2fb81 100644
--- a/src/code-stubs-hydrogen.cc
+++ b/src/code-stubs-hydrogen.cc
@@ -78,6 +78,9 @@
Representation representation,
bool transition_to_field);
+ HValue* BuildPushElement(HValue* object, HValue* argc,
+ HValue* argument_elements, ElementsKind kind);
+
enum ArgumentClass {
NONE,
SINGLE,
@@ -294,7 +297,7 @@
if (FLAG_profile_hydrogen_code_stub_compilation) {
timer.Start();
}
- Zone zone;
+ Zone zone(isolate->allocator());
CompilationInfo info(CodeStub::MajorName(stub->MajorKey()), isolate, &zone,
stub->GetCodeFlags());
// Parameter count is number of stack parameters.
@@ -780,6 +783,214 @@
return DoGenerateCode(this);
}
+HValue* CodeStubGraphBuilderBase::BuildPushElement(HValue* object, HValue* argc,
+ HValue* argument_elements,
+ ElementsKind kind) {
+ // Precheck whether all elements fit into the array.
+ if (!IsFastObjectElementsKind(kind)) {
+ LoopBuilder builder(this, context(), LoopBuilder::kPostIncrement);
+ HValue* start = graph()->GetConstant0();
+ HValue* key = builder.BeginBody(start, argc, Token::LT);
+ {
+ HInstruction* argument =
+ Add<HAccessArgumentsAt>(argument_elements, argc, key);
+ IfBuilder can_store(this);
+ can_store.IfNot<HIsSmiAndBranch>(argument);
+ if (IsFastDoubleElementsKind(kind)) {
+ can_store.And();
+ can_store.IfNot<HCompareMap>(argument,
+ isolate()->factory()->heap_number_map());
+ }
+ can_store.ThenDeopt(Deoptimizer::kFastArrayPushFailed);
+ can_store.End();
+ }
+ builder.EndBody();
+ }
+
+ HValue* length = Add<HLoadNamedField>(object, nullptr,
+ HObjectAccess::ForArrayLength(kind));
+ HValue* new_length = AddUncasted<HAdd>(length, argc);
+ HValue* max_key = AddUncasted<HSub>(new_length, graph()->GetConstant1());
+
+ HValue* elements = Add<HLoadNamedField>(object, nullptr,
+ HObjectAccess::ForElementsPointer());
+ elements = BuildCheckForCapacityGrow(object, elements, kind, length, max_key,
+ true, STORE);
+
+ LoopBuilder builder(this, context(), LoopBuilder::kPostIncrement);
+ HValue* start = graph()->GetConstant0();
+ HValue* key = builder.BeginBody(start, argc, Token::LT);
+ {
+ HValue* argument = Add<HAccessArgumentsAt>(argument_elements, argc, key);
+ HValue* index = AddUncasted<HAdd>(key, length);
+ AddElementAccess(elements, index, argument, object, nullptr, kind, STORE);
+ }
+ builder.EndBody();
+ return new_length;
+}
+
+template <>
+HValue* CodeStubGraphBuilder<FastArrayPushStub>::BuildCodeStub() {
+ // TODO(verwaest): Fix deoptimizer messages.
+ HValue* argc = GetArgumentsLength();
+ HInstruction* argument_elements = Add<HArgumentsElements>(false, false);
+ HInstruction* object = Add<HAccessArgumentsAt>(argument_elements, argc,
+ graph()->GetConstantMinus1());
+ BuildCheckHeapObject(object);
+ HValue* map = Add<HLoadNamedField>(object, nullptr, HObjectAccess::ForMap());
+ Add<HCheckInstanceType>(object, HCheckInstanceType::IS_JS_ARRAY);
+
+ // Disallow pushing onto prototypes. It might be the JSArray prototype.
+ // Disallow pushing onto non-extensible objects.
+ {
+ HValue* bit_field2 =
+ Add<HLoadNamedField>(map, nullptr, HObjectAccess::ForMapBitField2());
+ HValue* mask =
+ Add<HConstant>(static_cast<int>(Map::IsPrototypeMapBits::kMask) |
+ (1 << Map::kIsExtensible));
+ HValue* bits = AddUncasted<HBitwise>(Token::BIT_AND, bit_field2, mask);
+ IfBuilder check(this);
+ check.If<HCompareNumericAndBranch>(
+ bits, Add<HConstant>(1 << Map::kIsExtensible), Token::NE);
+ check.ThenDeopt(Deoptimizer::kFastArrayPushFailed);
+ check.End();
+ }
+
+ // Disallow pushing onto observed objects.
+ {
+ HValue* bit_field =
+ Add<HLoadNamedField>(map, nullptr, HObjectAccess::ForMapBitField());
+ HValue* mask = Add<HConstant>(1 << Map::kIsObserved);
+ HValue* bit = AddUncasted<HBitwise>(Token::BIT_AND, bit_field, mask);
+ IfBuilder check(this);
+ check.If<HCompareNumericAndBranch>(bit, mask, Token::EQ);
+ check.ThenDeopt(Deoptimizer::kFastArrayPushFailed);
+ check.End();
+ }
+
+ // Disallow pushing onto arrays in dictionary named property mode. We need to
+ // figure out whether the length property is still writable.
+ {
+ HValue* bit_field3 =
+ Add<HLoadNamedField>(map, nullptr, HObjectAccess::ForMapBitField3());
+ HValue* mask = Add<HConstant>(static_cast<int>(Map::DictionaryMap::kMask));
+ HValue* bit = AddUncasted<HBitwise>(Token::BIT_AND, bit_field3, mask);
+ IfBuilder check(this);
+ check.If<HCompareNumericAndBranch>(bit, mask, Token::EQ);
+ check.ThenDeopt(Deoptimizer::kFastArrayPushFailed);
+ check.End();
+ }
+
+ // Check whether the length property is writable. The length property is the
+ // only default named property on arrays. It's nonconfigurable, hence is
+ // guaranteed to stay the first property.
+ {
+ HValue* descriptors =
+ Add<HLoadNamedField>(map, nullptr, HObjectAccess::ForMapDescriptors());
+ HValue* details = Add<HLoadKeyed>(
+ descriptors, Add<HConstant>(DescriptorArray::ToDetailsIndex(0)),
+ nullptr, nullptr, FAST_SMI_ELEMENTS);
+ HValue* mask =
+ Add<HConstant>(READ_ONLY << PropertyDetails::AttributesField::kShift);
+ HValue* bit = AddUncasted<HBitwise>(Token::BIT_AND, details, mask);
+ IfBuilder readonly(this);
+ readonly.If<HCompareNumericAndBranch>(bit, mask, Token::EQ);
+ readonly.ThenDeopt(Deoptimizer::kFastArrayPushFailed);
+ readonly.End();
+ }
+
+ HValue* null = Add<HLoadRoot>(Heap::kNullValueRootIndex);
+ HValue* empty = Add<HLoadRoot>(Heap::kEmptyFixedArrayRootIndex);
+ environment()->Push(map);
+ LoopBuilder check_prototypes(this);
+ check_prototypes.BeginBody(1);
+ {
+ HValue* parent_map = environment()->Pop();
+ HValue* prototype = Add<HLoadNamedField>(parent_map, nullptr,
+ HObjectAccess::ForPrototype());
+
+ IfBuilder is_null(this);
+ is_null.If<HCompareObjectEqAndBranch>(prototype, null);
+ is_null.Then();
+ check_prototypes.Break();
+ is_null.End();
+
+ HValue* prototype_map =
+ Add<HLoadNamedField>(prototype, nullptr, HObjectAccess::ForMap());
+ HValue* instance_type = Add<HLoadNamedField>(
+ prototype_map, nullptr, HObjectAccess::ForMapInstanceType());
+ IfBuilder check_instance_type(this);
+ check_instance_type.If<HCompareNumericAndBranch>(
+ instance_type, Add<HConstant>(LAST_CUSTOM_ELEMENTS_RECEIVER),
+ Token::LTE);
+ check_instance_type.ThenDeopt(Deoptimizer::kFastArrayPushFailed);
+ check_instance_type.End();
+
+ HValue* elements = Add<HLoadNamedField>(
+ prototype, nullptr, HObjectAccess::ForElementsPointer());
+ IfBuilder no_elements(this);
+ no_elements.IfNot<HCompareObjectEqAndBranch>(elements, empty);
+ no_elements.ThenDeopt(Deoptimizer::kFastArrayPushFailed);
+ no_elements.End();
+
+ environment()->Push(prototype_map);
+ }
+ check_prototypes.EndBody();
+
+ HValue* bit_field2 =
+ Add<HLoadNamedField>(map, nullptr, HObjectAccess::ForMapBitField2());
+ HValue* kind = BuildDecodeField<Map::ElementsKindBits>(bit_field2);
+
+ // Below we only check the upper bound of the relevant ranges to include both
+ // holey and non-holey versions. We check them in order smi, object, double
+ // since smi < object < double.
+ STATIC_ASSERT(FAST_SMI_ELEMENTS < FAST_HOLEY_SMI_ELEMENTS);
+ STATIC_ASSERT(FAST_HOLEY_SMI_ELEMENTS < FAST_HOLEY_ELEMENTS);
+ STATIC_ASSERT(FAST_ELEMENTS < FAST_HOLEY_ELEMENTS);
+ STATIC_ASSERT(FAST_HOLEY_ELEMENTS < FAST_HOLEY_DOUBLE_ELEMENTS);
+ STATIC_ASSERT(FAST_DOUBLE_ELEMENTS < FAST_HOLEY_DOUBLE_ELEMENTS);
+ IfBuilder has_smi_elements(this);
+ has_smi_elements.If<HCompareNumericAndBranch>(
+ kind, Add<HConstant>(FAST_HOLEY_SMI_ELEMENTS), Token::LTE);
+ has_smi_elements.Then();
+ {
+ HValue* new_length = BuildPushElement(object, argc, argument_elements,
+ FAST_HOLEY_SMI_ELEMENTS);
+ environment()->Push(new_length);
+ }
+ has_smi_elements.Else();
+ {
+ IfBuilder has_object_elements(this);
+ has_object_elements.If<HCompareNumericAndBranch>(
+ kind, Add<HConstant>(FAST_HOLEY_ELEMENTS), Token::LTE);
+ has_object_elements.Then();
+ {
+ HValue* new_length = BuildPushElement(object, argc, argument_elements,
+ FAST_HOLEY_ELEMENTS);
+ environment()->Push(new_length);
+ }
+ has_object_elements.Else();
+ {
+ IfBuilder has_double_elements(this);
+ has_double_elements.If<HCompareNumericAndBranch>(
+ kind, Add<HConstant>(FAST_HOLEY_DOUBLE_ELEMENTS), Token::LTE);
+ has_double_elements.Then();
+ {
+ HValue* new_length = BuildPushElement(object, argc, argument_elements,
+ FAST_HOLEY_DOUBLE_ELEMENTS);
+ environment()->Push(new_length);
+ }
+ has_double_elements.ElseDeopt(Deoptimizer::kFastArrayPushFailed);
+ has_double_elements.End();
+ }
+ has_object_elements.End();
+ }
+ has_smi_elements.End();
+
+ return environment()->Pop();
+}
+
+Handle<Code> FastArrayPushStub::GenerateCode() { return DoGenerateCode(this); }
template <>
HValue* CodeStubGraphBuilder<GrowArrayElementsStub>::BuildCodeStub() {
@@ -1185,36 +1396,6 @@
template <>
-HValue* CodeStubGraphBuilder<AllocateHeapNumberStub>::BuildCodeStub() {
- HValue* result =
- Add<HAllocate>(Add<HConstant>(HeapNumber::kSize), HType::HeapNumber(),
- NOT_TENURED, HEAP_NUMBER_TYPE);
- AddStoreMapConstant(result, isolate()->factory()->heap_number_map());
- return result;
-}
-
-
-Handle<Code> AllocateHeapNumberStub::GenerateCode() {
- return DoGenerateCode(this);
-}
-
-
-template <>
-HValue* CodeStubGraphBuilder<AllocateMutableHeapNumberStub>::BuildCodeStub() {
- HValue* result =
- Add<HAllocate>(Add<HConstant>(HeapNumber::kSize), HType::HeapObject(),
- NOT_TENURED, MUTABLE_HEAP_NUMBER_TYPE);
- AddStoreMapConstant(result, isolate()->factory()->mutable_heap_number_map());
- return result;
-}
-
-
-Handle<Code> AllocateMutableHeapNumberStub::GenerateCode() {
- return DoGenerateCode(this);
-}
-
-
-template <>
HValue* CodeStubGraphBuilder<AllocateInNewSpaceStub>::BuildCodeStub() {
HValue* result = Add<HAllocate>(GetParameter(0), HType::Tagged(), NOT_TENURED,
JS_OBJECT_TYPE);
@@ -1419,31 +1600,6 @@
template <>
-HValue* CodeStubGraphBuilder<CompareNilICStub>::BuildCodeInitializedStub() {
- Isolate* isolate = graph()->isolate();
- CompareNilICStub* stub = casted_stub();
- HIfContinuation continuation;
- Handle<Map> sentinel_map(isolate->heap()->meta_map());
- Type* type = stub->GetType(zone(), sentinel_map);
- BuildCompareNil(GetParameter(0), type, &continuation, kEmbedMapsViaWeakCells);
- IfBuilder if_nil(this, &continuation);
- if_nil.Then();
- if (continuation.IsFalseReachable()) {
- if_nil.Else();
- if_nil.Return(graph()->GetConstantFalse());
- }
- if_nil.End();
- return continuation.IsTrueReachable() ? graph()->GetConstantTrue()
- : graph()->GetConstantUndefined();
-}
-
-
-Handle<Code> CompareNilICStub::GenerateCode() {
- return DoGenerateCode(this);
-}
-
-
-template <>
HValue* CodeStubGraphBuilder<BinaryOpICStub>::BuildCodeInitializedStub() {
BinaryOpICState state = casted_stub()->state();
@@ -1588,11 +1744,10 @@
}
if_inputisprimitive.End();
// Convert the primitive to a string value.
- ToStringDescriptor descriptor(isolate());
ToStringStub stub(isolate());
HValue* values[] = {context(), Pop()};
Push(AddUncasted<HCallWithDescriptor>(
- Add<HConstant>(stub.GetCode()), 0, descriptor,
+ Add<HConstant>(stub.GetCode()), 0, stub.GetCallInterfaceDescriptor(),
Vector<HValue*>(values, arraysize(values))));
}
if_inputisstring.End();
@@ -1706,10 +1861,9 @@
return DoGenerateCode(this);
}
-
template <>
-HValue* CodeStubGraphBuilder<ToBooleanStub>::BuildCodeInitializedStub() {
- ToBooleanStub* stub = casted_stub();
+HValue* CodeStubGraphBuilder<ToBooleanICStub>::BuildCodeInitializedStub() {
+ ToBooleanICStub* stub = casted_stub();
IfBuilder if_true(this);
if_true.If<HBranch>(GetParameter(0), stub->types());
if_true.Then();
@@ -1719,11 +1873,7 @@
return graph()->GetConstantFalse();
}
-
-Handle<Code> ToBooleanStub::GenerateCode() {
- return DoGenerateCode(this);
-}
-
+Handle<Code> ToBooleanICStub::GenerateCode() { return DoGenerateCode(this); }
template <>
HValue* CodeStubGraphBuilder<StoreGlobalStub>::BuildCodeInitializedStub() {
@@ -1855,7 +2005,7 @@
template <>
HValue* CodeStubGraphBuilder<ToObjectStub>::BuildCodeStub() {
- HValue* receiver = GetParameter(ToObjectDescriptor::kReceiverIndex);
+ HValue* receiver = GetParameter(TypeConversionDescriptor::kArgumentIndex);
return BuildToObject(receiver);
}