Ignore:
Timestamp:
Feb 19, 2010, 1:08:58 PM (15 years ago)
Author:
[email protected]
Message:

2010-02-19 Oliver Hunt <​[email protected]>

RS = Gavin Barraclough.

Split the 32/64 version of JITPropertyAccess into a separate file.

  • GNUmakefile.am:
  • JavaScriptCore.gypi:
  • JavaScriptCore.pri:
  • JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
  • JavaScriptCore.xcodeproj/project.pbxproj:
  • jit/JITPropertyAccess.cpp:
  • jit/JITPropertyAccess32_64.cpp: Added. (JSC::JIT::emit_op_put_by_index): (JSC::JIT::emit_op_put_getter): (JSC::JIT::emit_op_put_setter): (JSC::JIT::emit_op_del_by_id): (JSC::JIT::emit_op_method_check): (JSC::JIT::emitSlow_op_method_check): (JSC::JIT::emit_op_get_by_val): (JSC::JIT::emitSlow_op_get_by_val): (JSC::JIT::emit_op_put_by_val): (JSC::JIT::emitSlow_op_put_by_val): (JSC::JIT::emit_op_get_by_id): (JSC::JIT::emitSlow_op_get_by_id): (JSC::JIT::emit_op_put_by_id): (JSC::JIT::emitSlow_op_put_by_id): (JSC::JIT::compileGetByIdHotPath): (JSC::JIT::compileGetByIdSlowCase): (JSC::JIT::compilePutDirectOffset): (JSC::JIT::compileGetDirectOffset): (JSC::JIT::testPrototype): (JSC::JIT::privateCompilePutByIdTransition): (JSC::JIT::patchGetByIdSelf): (JSC::JIT::patchMethodCallProto): (JSC::JIT::patchPutByIdReplace): (JSC::JIT::privateCompilePatchGetArrayLength): (JSC::JIT::privateCompileGetByIdProto): (JSC::JIT::privateCompileGetByIdSelfList): (JSC::JIT::privateCompileGetByIdProtoList): (JSC::JIT::privateCompileGetByIdChainList): (JSC::JIT::privateCompileGetByIdChain): (JSC::JIT::emit_op_get_by_pname): (JSC::JIT::emitSlow_op_get_by_pname):
File:
1 edited

Legend:

Unmodified
Added
Removed

  • trunk/JavaScriptCore/jit/JITPropertyAccess.cpp

    r54747 r55027  
    2525
    2626#include "config.h"
     27
     28#if !USE(JSVALUE32_64)
     29
    2730#include "JIT.h"
    2831
    … …  
    4851
    4952namespace JSC {
    50 
    51 #if USE(JSVALUE32_64)
    52 
    53 void JIT::emit_op_put_by_index(Instruction* currentInstruction)
    54 {
    55     unsigned base = currentInstruction[1].u.operand;
    56     unsigned property = currentInstruction[2].u.operand;
    57     unsigned value = currentInstruction[3].u.operand;
    58 
    59     JITStubCall stubCall(this, cti_op_put_by_index);
    60     stubCall.addArgument(base);
    61     stubCall.addArgument(Imm32(property));
    62     stubCall.addArgument(value);
    63     stubCall.call();
    64 }
    65 
    66 void JIT::emit_op_put_getter(Instruction* currentInstruction)
    67 {
    68     unsigned base = currentInstruction[1].u.operand;
    69     unsigned property = currentInstruction[2].u.operand;
    70     unsigned function = currentInstruction[3].u.operand;
    71 
    72     JITStubCall stubCall(this, cti_op_put_getter);
    73     stubCall.addArgument(base);
    74     stubCall.addArgument(ImmPtr(&m_codeBlock->identifier(property)));
    75     stubCall.addArgument(function);
    76     stubCall.call();
    77 }
    78 
    79 void JIT::emit_op_put_setter(Instruction* currentInstruction)
    80 {
    81     unsigned base = currentInstruction[1].u.operand;
    82     unsigned property = currentInstruction[2].u.operand;
    83     unsigned function = currentInstruction[3].u.operand;
    84 
    85     JITStubCall stubCall(this, cti_op_put_setter);
    86     stubCall.addArgument(base);
    87     stubCall.addArgument(ImmPtr(&m_codeBlock->identifier(property)));
    88     stubCall.addArgument(function);
    89     stubCall.call();
    90 }
    91 
    92 void JIT::emit_op_del_by_id(Instruction* currentInstruction)
    93 {
    94     unsigned dst = currentInstruction[1].u.operand;
    95     unsigned base = currentInstruction[2].u.operand;
    96     unsigned property = currentInstruction[3].u.operand;
    97 
    98     JITStubCall stubCall(this, cti_op_del_by_id);
    99     stubCall.addArgument(base);
    100     stubCall.addArgument(ImmPtr(&m_codeBlock->identifier(property)));
    101     stubCall.call(dst);
    102 }
    103 
    104 
    105 #if !ENABLE(JIT_OPTIMIZE_PROPERTY_ACCESS)
    106 
    107 /* ------------------------------ BEGIN: !ENABLE(JIT_OPTIMIZE_PROPERTY_ACCESS) ------------------------------ */
    108 
    109 // Treat these as nops - the call will be handed as a regular get_by_id/op_call pair.
    110 void JIT::emit_op_method_check(Instruction*) {}
    111 void JIT::emitSlow_op_method_check(Instruction*, Vector<SlowCaseEntry>::iterator&) { ASSERT_NOT_REACHED(); }
    112 #if ENABLE(JIT_OPTIMIZE_METHOD_CALLS)
    113 #error "JIT_OPTIMIZE_METHOD_CALLS requires JIT_OPTIMIZE_PROPERTY_ACCESS"
    114 #endif
    115 
    116 void JIT::emit_op_get_by_val(Instruction* currentInstruction)
    117 {
    118     unsigned dst = currentInstruction[1].u.operand;
    119     unsigned base = currentInstruction[2].u.operand;
    120     unsigned property = currentInstruction[3].u.operand;
    121 
    122     JITStubCall stubCall(this, cti_op_get_by_val);
    123     stubCall.addArgument(base);
    124     stubCall.addArgument(property);
    125     stubCall.call(dst);
    126 }
    127 
    128 void JIT::emitSlow_op_get_by_val(Instruction*, Vector<SlowCaseEntry>::iterator&)
    129 {
    130     ASSERT_NOT_REACHED();
    131 }
    132 
    133 void JIT::emit_op_put_by_val(Instruction* currentInstruction)
    134 {
    135     unsigned base = currentInstruction[1].u.operand;
    136     unsigned property = currentInstruction[2].u.operand;
    137     unsigned value = currentInstruction[3].u.operand;
    138 
    139     JITStubCall stubCall(this, cti_op_put_by_val);
    140     stubCall.addArgument(base);
    141     stubCall.addArgument(property);
    142     stubCall.addArgument(value);
    143     stubCall.call();
    144 }
    145 
    146 void JIT::emitSlow_op_put_by_val(Instruction*, Vector<SlowCaseEntry>::iterator&)
    147 {
    148     ASSERT_NOT_REACHED();
    149 }
    150 
    151 void JIT::emit_op_get_by_id(Instruction* currentInstruction)
    152 {
    153     int dst = currentInstruction[1].u.operand;
    154     int base = currentInstruction[2].u.operand;
    155     int ident = currentInstruction[3].u.operand;
    156 
    157     JITStubCall stubCall(this, cti_op_get_by_id_generic);
    158     stubCall.addArgument(base);
    159     stubCall.addArgument(ImmPtr(&(m_codeBlock->identifier(ident))));
    160     stubCall.call(dst);
    161 
    162     m_propertyAccessInstructionIndex++;
    163 }
    164 
    165 void JIT::emitSlow_op_get_by_id(Instruction*, Vector<SlowCaseEntry>::iterator&)
    166 {
    167     m_propertyAccessInstructionIndex++;
    168     ASSERT_NOT_REACHED();
    169 }
    170 
    171 void JIT::emit_op_put_by_id(Instruction* currentInstruction)
    172 {
    173     int base = currentInstruction[1].u.operand;
    174     int ident = currentInstruction[2].u.operand;
    175     int value = currentInstruction[3].u.operand;
    176 
    177     JITStubCall stubCall(this, cti_op_put_by_id_generic);
    178     stubCall.addArgument(base);
    179     stubCall.addArgument(ImmPtr(&(m_codeBlock->identifier(ident))));
    180     stubCall.addArgument(value);
    181     stubCall.call();
    182 
    183     m_propertyAccessInstructionIndex++;
    184 }
    185 
    186 void JIT::emitSlow_op_put_by_id(Instruction*, Vector<SlowCaseEntry>::iterator&)
    187 {
    188     m_propertyAccessInstructionIndex++;
    189     ASSERT_NOT_REACHED();
    190 }
    191 
    192 #else // !ENABLE(JIT_OPTIMIZE_PROPERTY_ACCESS)
    193 
    194 /* ------------------------------ BEGIN: ENABLE(JIT_OPTIMIZE_PROPERTY_ACCESS) ------------------------------ */
    195 
    196 #if ENABLE(JIT_OPTIMIZE_METHOD_CALLS)
    197 
    198 void JIT::emit_op_method_check(Instruction* currentInstruction)
    199 {
    200     // Assert that the following instruction is a get_by_id.
    201     ASSERT(m_interpreter->getOpcodeID((currentInstruction + OPCODE_LENGTH(op_method_check))->u.opcode) == op_get_by_id);
    202 
    203     currentInstruction += OPCODE_LENGTH(op_method_check);
    204 
    205     // Do the method check - check the object & its prototype's structure inline (this is the common case).
    206     m_methodCallCompilationInfo.append(MethodCallCompilationInfo(m_propertyAccessInstructionIndex));
    207     MethodCallCompilationInfo& info = m_methodCallCompilationInfo.last();
    208 
    209     int dst = currentInstruction[1].u.operand;
    210     int base = currentInstruction[2].u.operand;
    211 
    212     emitLoad(base, regT1, regT0);
    213     emitJumpSlowCaseIfNotJSCell(base, regT1);
    214 
    215     BEGIN_UNINTERRUPTED_SEQUENCE(sequenceMethodCheck);
    216 
    217     Jump structureCheck = branchPtrWithPatch(NotEqual, Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), info.structureToCompare, ImmPtr(reinterpret_cast<void*>(patchGetByIdDefaultStructure)));
    218     DataLabelPtr protoStructureToCompare, protoObj = moveWithPatch(ImmPtr(0), regT2);
    219     Jump protoStructureCheck = branchPtrWithPatch(NotEqual, Address(regT2, OBJECT_OFFSETOF(JSCell, m_structure)), protoStructureToCompare, ImmPtr(reinterpret_cast<void*>(patchGetByIdDefaultStructure)));
    220 
    221     // This will be relinked to load the function without doing a load.
    222     DataLabelPtr putFunction = moveWithPatch(ImmPtr(0), regT0);
    223  
    224     END_UNINTERRUPTED_SEQUENCE(sequenceMethodCheck);
    225    
    226     move(Imm32(JSValue::CellTag), regT1);
    227     Jump match = jump();
    228 
    229     ASSERT(differenceBetween(info.structureToCompare, protoObj) == patchOffsetMethodCheckProtoObj);
    230     ASSERT(differenceBetween(info.structureToCompare, protoStructureToCompare) == patchOffsetMethodCheckProtoStruct);
    231     ASSERT(differenceBetween(info.structureToCompare, putFunction) == patchOffsetMethodCheckPutFunction);
    232 
    233     // Link the failure cases here.
    234     structureCheck.link(this);
    235     protoStructureCheck.link(this);
    236 
    237     // Do a regular(ish) get_by_id (the slow case will be link to
    238     // cti_op_get_by_id_method_check instead of cti_op_get_by_id.
    239     compileGetByIdHotPath();
    240 
    241     match.link(this);
    242     emitStore(dst, regT1, regT0);
    243     map(m_bytecodeIndex + OPCODE_LENGTH(op_method_check), dst, regT1, regT0);
    244 
    245     // We've already generated the following get_by_id, so make sure it's skipped over.
    246     m_bytecodeIndex += OPCODE_LENGTH(op_get_by_id);
    247 }
    248 
    249 void JIT::emitSlow_op_method_check(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
    250 {
    251     currentInstruction += OPCODE_LENGTH(op_method_check);
    252 
    253     int dst = currentInstruction[1].u.operand;
    254     int base = currentInstruction[2].u.operand;
    255     int ident = currentInstruction[3].u.operand;
    256 
    257     compileGetByIdSlowCase(dst, base, &(m_codeBlock->identifier(ident)), iter, true);
    258 
    259     // We've already generated the following get_by_id, so make sure it's skipped over.
    260     m_bytecodeIndex += OPCODE_LENGTH(op_get_by_id);
    261 }
    262 
    263 #else //!ENABLE(JIT_OPTIMIZE_METHOD_CALLS)
    264 
    265 // Treat these as nops - the call will be handed as a regular get_by_id/op_call pair.
    266 void JIT::emit_op_method_check(Instruction*) {}
    267 void JIT::emitSlow_op_method_check(Instruction*, Vector<SlowCaseEntry>::iterator&) { ASSERT_NOT_REACHED(); }
    268 
    269 #endif
    270 
    271 void JIT::emit_op_get_by_val(Instruction* currentInstruction)
    272 {
    273     unsigned dst = currentInstruction[1].u.operand;
    274     unsigned base = currentInstruction[2].u.operand;
    275     unsigned property = currentInstruction[3].u.operand;
    276    
    277     emitLoad2(base, regT1, regT0, property, regT3, regT2);
    278 
    279     addSlowCase(branch32(NotEqual, regT3, Imm32(JSValue::Int32Tag)));
    280     emitJumpSlowCaseIfNotJSCell(base, regT1);
    281     addSlowCase(branchPtr(NotEqual, Address(regT0), ImmPtr(m_globalData->jsArrayVPtr)));
    282 
    283     loadPtr(Address(regT0, OBJECT_OFFSETOF(JSArray, m_storage)), regT3);
    284     addSlowCase(branch32(AboveOrEqual, regT2, Address(regT0, OBJECT_OFFSETOF(JSArray, m_vectorLength))));
    285 
    286     load32(BaseIndex(regT3, regT2, TimesEight, OBJECT_OFFSETOF(ArrayStorage, m_vector[0]) + 4), regT1); // tag
    287     load32(BaseIndex(regT3, regT2, TimesEight, OBJECT_OFFSETOF(ArrayStorage, m_vector[0])), regT0); // payload
    288     addSlowCase(branch32(Equal, regT1, Imm32(JSValue::EmptyValueTag)));
    289 
    290     emitStore(dst, regT1, regT0);
    291     map(m_bytecodeIndex + OPCODE_LENGTH(op_get_by_val), dst, regT1, regT0);
    292 }
    293 
    294 void JIT::emitSlow_op_get_by_val(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
    295 {
    296     unsigned dst = currentInstruction[1].u.operand;
    297     unsigned base = currentInstruction[2].u.operand;
    298     unsigned property = currentInstruction[3].u.operand;
    299 
    300     linkSlowCase(iter); // property int32 check
    301     linkSlowCaseIfNotJSCell(iter, base); // base cell check
    302     linkSlowCase(iter); // base array check
    303     linkSlowCase(iter); // vector length check
    304     linkSlowCase(iter); // empty value
    305 
    306     JITStubCall stubCall(this, cti_op_get_by_val);
    307     stubCall.addArgument(base);
    308     stubCall.addArgument(property);
    309     stubCall.call(dst);
    310 }
    311 
    312 void JIT::emit_op_put_by_val(Instruction* currentInstruction)
    313 {
    314     unsigned base = currentInstruction[1].u.operand;
    315     unsigned property = currentInstruction[2].u.operand;
    316     unsigned value = currentInstruction[3].u.operand;
    317 
    318     emitLoad2(base, regT1, regT0, property, regT3, regT2);
    319 
    320     addSlowCase(branch32(NotEqual, regT3, Imm32(JSValue::Int32Tag)));
    321     emitJumpSlowCaseIfNotJSCell(base, regT1);
    322     addSlowCase(branchPtr(NotEqual, Address(regT0), ImmPtr(m_globalData->jsArrayVPtr)));
    323     addSlowCase(branch32(AboveOrEqual, regT2, Address(regT0, OBJECT_OFFSETOF(JSArray, m_vectorLength))));
    324 
    325     loadPtr(Address(regT0, OBJECT_OFFSETOF(JSArray, m_storage)), regT3);
    326 
    327     Jump empty = branch32(Equal, BaseIndex(regT3, regT2, TimesEight, OBJECT_OFFSETOF(ArrayStorage, m_vector[0]) + 4), Imm32(JSValue::EmptyValueTag));
    328 
    329     Label storeResult(this);
    330     emitLoad(value, regT1, regT0);
    331     store32(regT0, BaseIndex(regT3, regT2, TimesEight, OBJECT_OFFSETOF(ArrayStorage, m_vector[0]))); // payload
    332     store32(regT1, BaseIndex(regT3, regT2, TimesEight, OBJECT_OFFSETOF(ArrayStorage, m_vector[0]) + 4)); // tag
    333     Jump end = jump();
    334 
    335     empty.link(this);
    336     add32(Imm32(1), Address(regT3, OBJECT_OFFSETOF(ArrayStorage, m_numValuesInVector)));
    337     branch32(Below, regT2, Address(regT3, OBJECT_OFFSETOF(ArrayStorage, m_length))).linkTo(storeResult, this);
    338 
    339     add32(Imm32(1), regT2, regT0);
    340     store32(regT0, Address(regT3, OBJECT_OFFSETOF(ArrayStorage, m_length)));
    341     jump().linkTo(storeResult, this);
    342 
    343     end.link(this);
    344 }
    345 
    346 void JIT::emitSlow_op_put_by_val(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
    347 {
    348     unsigned base = currentInstruction[1].u.operand;
    349     unsigned property = currentInstruction[2].u.operand;
    350     unsigned value = currentInstruction[3].u.operand;
    351 
    352     linkSlowCase(iter); // property int32 check
    353     linkSlowCaseIfNotJSCell(iter, base); // base cell check
    354     linkSlowCase(iter); // base not array check
    355     linkSlowCase(iter); // in vector check
    356 
    357     JITStubCall stubPutByValCall(this, cti_op_put_by_val);
    358     stubPutByValCall.addArgument(base);
    359     stubPutByValCall.addArgument(property);
    360     stubPutByValCall.addArgument(value);
    361     stubPutByValCall.call();
    362 }
    363 
    364 void JIT::emit_op_get_by_id(Instruction* currentInstruction)
    365 {
    366     int dst = currentInstruction[1].u.operand;
    367     int base = currentInstruction[2].u.operand;
    368    
    369     emitLoad(base, regT1, regT0);
    370     emitJumpSlowCaseIfNotJSCell(base, regT1);
    371     compileGetByIdHotPath();
    372     emitStore(dst, regT1, regT0);
    373     map(m_bytecodeIndex + OPCODE_LENGTH(op_get_by_id), dst, regT1, regT0);
    374 }
    375 
    376 void JIT::compileGetByIdHotPath()
    377 {
    378     // As for put_by_id, get_by_id requires the offset of the Structure and the offset of the access to be patched.
    379     // Additionally, for get_by_id we need patch the offset of the branch to the slow case (we patch this to jump
    380     // to array-length / prototype access tranpolines, and finally we also the the property-map access offset as a label
    381     // to jump back to if one of these trampolies finds a match.
    382 
    383     BEGIN_UNINTERRUPTED_SEQUENCE(sequenceGetByIdHotPath);
    384    
    385     Label hotPathBegin(this);
    386     m_propertyAccessCompilationInfo[m_propertyAccessInstructionIndex].hotPathBegin = hotPathBegin;
    387     m_propertyAccessInstructionIndex++;
    388 
    389     DataLabelPtr structureToCompare;
    390     Jump structureCheck = branchPtrWithPatch(NotEqual, Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), structureToCompare, ImmPtr(reinterpret_cast<void*>(patchGetByIdDefaultStructure)));
    391     addSlowCase(structureCheck);
    392     ASSERT(differenceBetween(hotPathBegin, structureToCompare) == patchOffsetGetByIdStructure);
    393     ASSERT(differenceBetween(hotPathBegin, structureCheck) == patchOffsetGetByIdBranchToSlowCase);
    394 
    395     Label externalLoad = loadPtrWithPatchToLEA(Address(regT0, OBJECT_OFFSETOF(JSObject, m_externalStorage)), regT2);
    396     Label externalLoadComplete(this);
    397     ASSERT(differenceBetween(hotPathBegin, externalLoad) == patchOffsetGetByIdExternalLoad);
    398     ASSERT(differenceBetween(externalLoad, externalLoadComplete) == patchLengthGetByIdExternalLoad);
    399 
    400     DataLabel32 displacementLabel1 = loadPtrWithAddressOffsetPatch(Address(regT2, patchGetByIdDefaultOffset), regT0); // payload
    401     ASSERT(differenceBetween(hotPathBegin, displacementLabel1) == patchOffsetGetByIdPropertyMapOffset1);
    402     DataLabel32 displacementLabel2 = loadPtrWithAddressOffsetPatch(Address(regT2, patchGetByIdDefaultOffset), regT1); // tag
    403     ASSERT(differenceBetween(hotPathBegin, displacementLabel2) == patchOffsetGetByIdPropertyMapOffset2);
    404 
    405     Label putResult(this);
    406     ASSERT(differenceBetween(hotPathBegin, putResult) == patchOffsetGetByIdPutResult);
    407 
    408     END_UNINTERRUPTED_SEQUENCE(sequenceGetByIdHotPath);
    409 }
    410 
    411 void JIT::emitSlow_op_get_by_id(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
    412 {
    413     int dst = currentInstruction[1].u.operand;
    414     int base = currentInstruction[2].u.operand;
    415     int ident = currentInstruction[3].u.operand;
    416 
    417     compileGetByIdSlowCase(dst, base, &(m_codeBlock->identifier(ident)), iter);
    418 }
    419 
    420 void JIT::compileGetByIdSlowCase(int dst, int base, Identifier* ident, Vector<SlowCaseEntry>::iterator& iter, bool isMethodCheck)
    421 {
    422     // As for the hot path of get_by_id, above, we ensure that we can use an architecture specific offset
    423     // so that we only need track one pointer into the slow case code - we track a pointer to the location
    424     // of the call (which we can use to look up the patch information), but should a array-length or
    425     // prototype access trampoline fail we want to bail out back to here.  To do so we can subtract back
    426     // the distance from the call to the head of the slow case.
    427     linkSlowCaseIfNotJSCell(iter, base);
    428     linkSlowCase(iter);
    429 
    430     BEGIN_UNINTERRUPTED_SEQUENCE(sequenceGetByIdSlowCase);
    431 
    432 #ifndef NDEBUG
    433     Label coldPathBegin(this);
    434 #endif
    435     JITStubCall stubCall(this, isMethodCheck ? cti_op_get_by_id_method_check : cti_op_get_by_id);
    436     stubCall.addArgument(regT1, regT0);
    437     stubCall.addArgument(ImmPtr(ident));
    438     Call call = stubCall.call(dst);
    439 
    440     END_UNINTERRUPTED_SEQUENCE(sequenceGetByIdSlowCase);
    441 
    442     ASSERT(differenceBetween(coldPathBegin, call) == patchOffsetGetByIdSlowCaseCall);
    443 
    444     // Track the location of the call; this will be used to recover patch information.
    445     m_propertyAccessCompilationInfo[m_propertyAccessInstructionIndex].callReturnLocation = call;
    446     m_propertyAccessInstructionIndex++;
    447 }
    448 
    449 void JIT::emit_op_put_by_id(Instruction* currentInstruction)
    450 {
    451     // In order to be able to patch both the Structure, and the object offset, we store one pointer,
    452     // to just after the arguments have been loaded into registers 'hotPathBegin', and we generate code
    453     // such that the Structure & offset are always at the same distance from this.
    454 
    455     int base = currentInstruction[1].u.operand;
    456     int value = currentInstruction[3].u.operand;
    457 
    458     emitLoad2(base, regT1, regT0, value, regT3, regT2);
    459 
    460     emitJumpSlowCaseIfNotJSCell(base, regT1);
    461 
    462     BEGIN_UNINTERRUPTED_SEQUENCE(sequencePutById);
    463 
    464     Label hotPathBegin(this);
    465     m_propertyAccessCompilationInfo[m_propertyAccessInstructionIndex].hotPathBegin = hotPathBegin;
    466     m_propertyAccessInstructionIndex++;
    467 
    468     // It is important that the following instruction plants a 32bit immediate, in order that it can be patched over.
    469     DataLabelPtr structureToCompare;
    470     addSlowCase(branchPtrWithPatch(NotEqual, Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), structureToCompare, ImmPtr(reinterpret_cast<void*>(patchGetByIdDefaultStructure))));
    471     ASSERT(differenceBetween(hotPathBegin, structureToCompare) == patchOffsetPutByIdStructure);
    472 
    473     // Plant a load from a bogus ofset in the object's property map; we will patch this later, if it is to be used.
    474     Label externalLoad = loadPtrWithPatchToLEA(Address(regT0, OBJECT_OFFSETOF(JSObject, m_externalStorage)), regT0);
    475     Label externalLoadComplete(this);
    476     ASSERT(differenceBetween(hotPathBegin, externalLoad) == patchOffsetPutByIdExternalLoad);
    477     ASSERT(differenceBetween(externalLoad, externalLoadComplete) == patchLengthPutByIdExternalLoad);
    478 
    479     DataLabel32 displacementLabel1 = storePtrWithAddressOffsetPatch(regT2, Address(regT0, patchGetByIdDefaultOffset)); // payload
    480     DataLabel32 displacementLabel2 = storePtrWithAddressOffsetPatch(regT3, Address(regT0, patchGetByIdDefaultOffset)); // tag
    481 
    482     END_UNINTERRUPTED_SEQUENCE(sequencePutById);
    483 
    484     ASSERT(differenceBetween(hotPathBegin, displacementLabel1) == patchOffsetPutByIdPropertyMapOffset1);
    485     ASSERT(differenceBetween(hotPathBegin, displacementLabel2) == patchOffsetPutByIdPropertyMapOffset2);
    486 }
    487 
    488 void JIT::emitSlow_op_put_by_id(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
    489 {
    490     int base = currentInstruction[1].u.operand;
    491     int ident = currentInstruction[2].u.operand;
    492 
    493     linkSlowCaseIfNotJSCell(iter, base);
    494     linkSlowCase(iter);
    495 
    496     JITStubCall stubCall(this, cti_op_put_by_id);
    497     stubCall.addArgument(regT1, regT0);
    498     stubCall.addArgument(ImmPtr(&(m_codeBlock->identifier(ident))));
    499     stubCall.addArgument(regT3, regT2);
    500     Call call = stubCall.call();
    501 
    502     // Track the location of the call; this will be used to recover patch information.
    503     m_propertyAccessCompilationInfo[m_propertyAccessInstructionIndex].callReturnLocation = call;
    504     m_propertyAccessInstructionIndex++;
    505 }
    506 
    507 // Compile a store into an object's property storage.  May overwrite base.
    508 void JIT::compilePutDirectOffset(RegisterID base, RegisterID valueTag, RegisterID valuePayload, Structure* structure, size_t cachedOffset)
    509 {
    510     int offset = cachedOffset;
    511     if (structure->isUsingInlineStorage())
    512         offset += OBJECT_OFFSETOF(JSObject, m_inlineStorage) /  sizeof(Register);
    513     else
    514         loadPtr(Address(base, OBJECT_OFFSETOF(JSObject, m_externalStorage)), base);
    515     emitStore(offset, valueTag, valuePayload, base);
    516 }
    517 
    518 // Compile a load from an object's property storage.  May overwrite base.
    519 void JIT::compileGetDirectOffset(RegisterID base, RegisterID resultTag, RegisterID resultPayload, Structure* structure, size_t cachedOffset)
    520 {
    521     int offset = cachedOffset;
    522     if (structure->isUsingInlineStorage())
    523         offset += OBJECT_OFFSETOF(JSObject, m_inlineStorage) / sizeof(Register);
    524     else
    525         loadPtr(Address(base, OBJECT_OFFSETOF(JSObject, m_externalStorage)), base);
    526     emitLoad(offset, resultTag, resultPayload, base);
    527 }
    528 
    529 void JIT::compileGetDirectOffset(JSObject* base, RegisterID temp, RegisterID resultTag, RegisterID resultPayload, size_t cachedOffset)
    530 {
    531     if (base->isUsingInlineStorage()) {
    532         load32(reinterpret_cast<char*>(&base->m_inlineStorage[cachedOffset]), resultPayload);
    533         load32(reinterpret_cast<char*>(&base->m_inlineStorage[cachedOffset]) + 4, resultTag);
    534         return;
    535     }
    536 
    537     size_t offset = cachedOffset * sizeof(JSValue);
    538 
    539     PropertyStorage* protoPropertyStorage = &base->m_externalStorage;
    540     loadPtr(static_cast<void*>(protoPropertyStorage), temp);
    541     load32(Address(temp, offset), resultPayload);
    542     load32(Address(temp, offset + 4), resultTag);
    543 }
    544 
    545 void JIT::testPrototype(Structure* structure, JumpList& failureCases)
    546 {
    547     if (structure->m_prototype.isNull())
    548         return;
    549 
    550     failureCases.append(branchPtr(NotEqual, AbsoluteAddress(&asCell(structure->m_prototype)->m_structure), ImmPtr(asCell(structure->m_prototype)->m_structure)));
    551 }
    552 
    553 void JIT::privateCompilePutByIdTransition(StructureStubInfo* stubInfo, Structure* oldStructure, Structure* newStructure, size_t cachedOffset, StructureChain* chain, ReturnAddressPtr returnAddress)
    554 {
    555     // It is assumed that regT0 contains the basePayload and regT1 contains the baseTag.  The value can be found on the stack.
    556 
    557     JumpList failureCases;
    558     failureCases.append(branch32(NotEqual, regT1, Imm32(JSValue::CellTag)));
    559     failureCases.append(branchPtr(NotEqual, Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), ImmPtr(oldStructure)));
    560     testPrototype(oldStructure, failureCases);
    561 
    562     // Verify that nothing in the prototype chain has a setter for this property.
    563     for (RefPtr<Structure>* it = chain->head(); *it; ++it)
    564         testPrototype(it->get(), failureCases);
    565 
    566     // Reallocate property storage if needed.
    567     Call callTarget;
    568     bool willNeedStorageRealloc = oldStructure->propertyStorageCapacity() != newStructure->propertyStorageCapacity();
    569     if (willNeedStorageRealloc) {
    570         // This trampoline was called to like a JIT stub; before we can can call again we need to
    571         // remove the return address from the stack, to prevent the stack from becoming misaligned.
    572         preserveReturnAddressAfterCall(regT3);
    573  
    574         JITStubCall stubCall(this, cti_op_put_by_id_transition_realloc);
    575         stubCall.skipArgument(); // base
    576         stubCall.skipArgument(); // ident
    577         stubCall.skipArgument(); // value
    578         stubCall.addArgument(Imm32(oldStructure->propertyStorageCapacity()));
    579         stubCall.addArgument(Imm32(newStructure->propertyStorageCapacity()));
    580         stubCall.call(regT0);
    581 
    582         restoreReturnAddressBeforeReturn(regT3);
    583     }
    584 
    585     sub32(Imm32(1), AbsoluteAddress(oldStructure->addressOfCount()));
    586     add32(Imm32(1), AbsoluteAddress(newStructure->addressOfCount()));
    587     storePtr(ImmPtr(newStructure), Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)));
    588  
    589     load32(Address(stackPointerRegister, offsetof(struct JITStackFrame, args[2]) + sizeof(void*)), regT3);
    590     load32(Address(stackPointerRegister, offsetof(struct JITStackFrame, args[2]) + sizeof(void*) + 4), regT2);
    591 
    592     // Write the value
    593     compilePutDirectOffset(regT0, regT2, regT3, newStructure, cachedOffset);
    594 
    595     ret();
    596    
    597     ASSERT(!failureCases.empty());
    598     failureCases.link(this);
    599     restoreArgumentReferenceForTrampoline();
    600     Call failureCall = tailRecursiveCall();
    601 
    602     LinkBuffer patchBuffer(this, m_codeBlock->executablePool());
    603 
    604     patchBuffer.link(failureCall, FunctionPtr(cti_op_put_by_id_fail));
    605 
    606     if (willNeedStorageRealloc) {
    607         ASSERT(m_calls.size() == 1);
    608         patchBuffer.link(m_calls[0].from, FunctionPtr(cti_op_put_by_id_transition_realloc));
    609     }
    610    
    611     CodeLocationLabel entryLabel = patchBuffer.finalizeCodeAddendum();
    612     stubInfo->stubRoutine = entryLabel;
    613     RepatchBuffer repatchBuffer(m_codeBlock);
    614     repatchBuffer.relinkCallerToTrampoline(returnAddress, entryLabel);
    615 }
    616 
    617 void JIT::patchGetByIdSelf(CodeBlock* codeBlock, StructureStubInfo* stubInfo, Structure* structure, size_t cachedOffset, ReturnAddressPtr returnAddress)
    618 {
    619     RepatchBuffer repatchBuffer(codeBlock);
    620 
    621     // We don't want to patch more than once - in future go to cti_op_get_by_id_generic.
    622     // Should probably go to JITStubs::cti_op_get_by_id_fail, but that doesn't do anything interesting right now.
    623     repatchBuffer.relinkCallerToFunction(returnAddress, FunctionPtr(cti_op_get_by_id_self_fail));
    624 
    625     int offset = sizeof(JSValue) * cachedOffset;
    626 
    627     // If we're patching to use inline storage, convert the initial load to a lea; this avoids the extra load
    628     // and makes the subsequent load's offset automatically correct
    629     if (structure->isUsingInlineStorage())
    630         repatchBuffer.repatchLoadPtrToLEA(stubInfo->hotPathBegin.instructionAtOffset(patchOffsetGetByIdExternalLoad));
    631 
    632     // Patch the offset into the propoerty map to load from, then patch the Structure to look for.
    633     repatchBuffer.repatch(stubInfo->hotPathBegin.dataLabelPtrAtOffset(patchOffsetGetByIdStructure), structure);
    634     repatchBuffer.repatch(stubInfo->hotPathBegin.dataLabel32AtOffset(patchOffsetGetByIdPropertyMapOffset1), offset); // payload
    635     repatchBuffer.repatch(stubInfo->hotPathBegin.dataLabel32AtOffset(patchOffsetGetByIdPropertyMapOffset2), offset + 4); // tag
    636 }
    637 
    638 void JIT::patchMethodCallProto(CodeBlock* codeBlock, MethodCallLinkInfo& methodCallLinkInfo, JSFunction* callee, Structure* structure, JSObject* proto, ReturnAddressPtr returnAddress)
    639 {
    640     RepatchBuffer repatchBuffer(codeBlock);
    641 
    642     ASSERT(!methodCallLinkInfo.cachedStructure);
    643     methodCallLinkInfo.cachedStructure = structure;
    644     structure->ref();
    645 
    646     Structure* prototypeStructure = proto->structure();
    647     methodCallLinkInfo.cachedPrototypeStructure = prototypeStructure;
    648     prototypeStructure->ref();
    649 
    650     repatchBuffer.repatch(methodCallLinkInfo.structureLabel, structure);
    651     repatchBuffer.repatch(methodCallLinkInfo.structureLabel.dataLabelPtrAtOffset(patchOffsetMethodCheckProtoObj), proto);
    652     repatchBuffer.repatch(methodCallLinkInfo.structureLabel.dataLabelPtrAtOffset(patchOffsetMethodCheckProtoStruct), prototypeStructure);
    653     repatchBuffer.repatch(methodCallLinkInfo.structureLabel.dataLabelPtrAtOffset(patchOffsetMethodCheckPutFunction), callee);
    654 
    655     repatchBuffer.relinkCallerToFunction(returnAddress, FunctionPtr(cti_op_get_by_id));
    656 }
    657 
    658 void JIT::patchPutByIdReplace(CodeBlock* codeBlock, StructureStubInfo* stubInfo, Structure* structure, size_t cachedOffset, ReturnAddressPtr returnAddress)
    659 {
    660     RepatchBuffer repatchBuffer(codeBlock);
    661 
    662     // We don't want to patch more than once - in future go to cti_op_put_by_id_generic.
    663     // Should probably go to cti_op_put_by_id_fail, but that doesn't do anything interesting right now.
    664     repatchBuffer.relinkCallerToFunction(returnAddress, FunctionPtr(cti_op_put_by_id_generic));
    665 
    666     int offset = sizeof(JSValue) * cachedOffset;
    667 
    668     // If we're patching to use inline storage, convert the initial load to a lea; this avoids the extra load
    669     // and makes the subsequent load's offset automatically correct
    670     if (structure->isUsingInlineStorage())
    671         repatchBuffer.repatchLoadPtrToLEA(stubInfo->hotPathBegin.instructionAtOffset(patchOffsetPutByIdExternalLoad));
    672 
    673     // Patch the offset into the propoerty map to load from, then patch the Structure to look for.
    674     repatchBuffer.repatch(stubInfo->hotPathBegin.dataLabelPtrAtOffset(patchOffsetPutByIdStructure), structure);
    675     repatchBuffer.repatch(stubInfo->hotPathBegin.dataLabel32AtOffset(patchOffsetPutByIdPropertyMapOffset1), offset); // payload
    676     repatchBuffer.repatch(stubInfo->hotPathBegin.dataLabel32AtOffset(patchOffsetPutByIdPropertyMapOffset2), offset + 4); // tag
    677 }
    678 
    679 void JIT::privateCompilePatchGetArrayLength(ReturnAddressPtr returnAddress)
    680 {
    681     StructureStubInfo* stubInfo = &m_codeBlock->getStubInfo(returnAddress);
    682    
    683     // regT0 holds a JSCell*
    684 
    685     // Check for array
    686     Jump failureCases1 = branchPtr(NotEqual, Address(regT0), ImmPtr(m_globalData->jsArrayVPtr));
    687 
    688     // Checks out okay! - get the length from the storage
    689     loadPtr(Address(regT0, OBJECT_OFFSETOF(JSArray, m_storage)), regT2);
    690     load32(Address(regT2, OBJECT_OFFSETOF(ArrayStorage, m_length)), regT2);
    691 
    692     Jump failureCases2 = branch32(Above, regT2, Imm32(INT_MAX));
    693     move(regT2, regT0);
    694     move(Imm32(JSValue::Int32Tag), regT1);
    695     Jump success = jump();
    696 
    697     LinkBuffer patchBuffer(this, m_codeBlock->executablePool());
    698 
    699     // Use the patch information to link the failure cases back to the original slow case routine.
    700     CodeLocationLabel slowCaseBegin = stubInfo->callReturnLocation.labelAtOffset(-patchOffsetGetByIdSlowCaseCall);
    701     patchBuffer.link(failureCases1, slowCaseBegin);
    702     patchBuffer.link(failureCases2, slowCaseBegin);
    703 
    704     // On success return back to the hot patch code, at a point it will perform the store to dest for us.
    705     patchBuffer.link(success, stubInfo->hotPathBegin.labelAtOffset(patchOffsetGetByIdPutResult));
    706 
    707     // Track the stub we have created so that it will be deleted later.
    708     CodeLocationLabel entryLabel = patchBuffer.finalizeCodeAddendum();
    709     stubInfo->stubRoutine = entryLabel;
    710 
    711     // Finally patch the jump to slow case back in the hot path to jump here instead.
    712     CodeLocationJump jumpLocation = stubInfo->hotPathBegin.jumpAtOffset(patchOffsetGetByIdBranchToSlowCase);
    713     RepatchBuffer repatchBuffer(m_codeBlock);
    714     repatchBuffer.relink(jumpLocation, entryLabel);
    715 
    716     // We don't want to patch more than once - in future go to cti_op_put_by_id_generic.
    717     repatchBuffer.relinkCallerToFunction(returnAddress, FunctionPtr(cti_op_get_by_id_array_fail));
    718 }
    719 
    720 void JIT::privateCompileGetByIdProto(StructureStubInfo* stubInfo, Structure* structure, Structure* prototypeStructure, size_t cachedOffset, ReturnAddressPtr returnAddress, CallFrame* callFrame)
    721 {
    722     // regT0 holds a JSCell*
    723 
    724     // The prototype object definitely exists (if this stub exists the CodeBlock is referencing a Structure that is
    725     // referencing the prototype object - let's speculatively load it's table nice and early!)
    726     JSObject* protoObject = asObject(structure->prototypeForLookup(callFrame));
    727 
    728     Jump failureCases1 = checkStructure(regT0, structure);
    729 
    730     // Check the prototype object's Structure had not changed.
    731     Structure** prototypeStructureAddress = &(protoObject->m_structure);
    732 #if CPU(X86_64)
    733     move(ImmPtr(prototypeStructure), regT3);
    734     Jump failureCases2 = branchPtr(NotEqual, AbsoluteAddress(prototypeStructureAddress), regT3);
    735 #else
    736     Jump failureCases2 = branchPtr(NotEqual, AbsoluteAddress(prototypeStructureAddress), ImmPtr(prototypeStructure));
    737 #endif
    738 
    739     // Checks out okay! - getDirectOffset
    740     compileGetDirectOffset(protoObject, regT2, regT1, regT0, cachedOffset);
    741 
    742     Jump success = jump();
    743 
    744     LinkBuffer patchBuffer(this, m_codeBlock->executablePool());
    745 
    746     // Use the patch information to link the failure cases back to the original slow case routine.
    747     CodeLocationLabel slowCaseBegin = stubInfo->callReturnLocation.labelAtOffset(-patchOffsetGetByIdSlowCaseCall);
    748     patchBuffer.link(failureCases1, slowCaseBegin);
    749     patchBuffer.link(failureCases2, slowCaseBegin);
    750 
    751     // On success return back to the hot patch code, at a point it will perform the store to dest for us.
    752     patchBuffer.link(success, stubInfo->hotPathBegin.labelAtOffset(patchOffsetGetByIdPutResult));
    753 
    754     // Track the stub we have created so that it will be deleted later.
    755     CodeLocationLabel entryLabel = patchBuffer.finalizeCodeAddendum();
    756     stubInfo->stubRoutine = entryLabel;
    757 
    758     // Finally patch the jump to slow case back in the hot path to jump here instead.
    759     CodeLocationJump jumpLocation = stubInfo->hotPathBegin.jumpAtOffset(patchOffsetGetByIdBranchToSlowCase);
    760     RepatchBuffer repatchBuffer(m_codeBlock);
    761     repatchBuffer.relink(jumpLocation, entryLabel);
    762 
    763     // We don't want to patch more than once - in future go to cti_op_put_by_id_generic.
    764     repatchBuffer.relinkCallerToFunction(returnAddress, FunctionPtr(cti_op_get_by_id_proto_list));
    765 }
    766 
    767 
    768 void JIT::privateCompileGetByIdSelfList(StructureStubInfo* stubInfo, PolymorphicAccessStructureList* polymorphicStructures, int currentIndex, Structure* structure, size_t cachedOffset)
    769 {
    770     // regT0 holds a JSCell*
    771    
    772     Jump failureCase = checkStructure(regT0, structure);
    773     compileGetDirectOffset(regT0, regT1, regT0, structure, cachedOffset);
    774     Jump success = jump();
    775 
    776     LinkBuffer patchBuffer(this, m_codeBlock->executablePool());
    777 
    778     // Use the patch information to link the failure cases back to the original slow case routine.
    779     CodeLocationLabel lastProtoBegin = polymorphicStructures->list[currentIndex - 1].stubRoutine;
    780     if (!lastProtoBegin)
    781         lastProtoBegin = stubInfo->callReturnLocation.labelAtOffset(-patchOffsetGetByIdSlowCaseCall);
    782 
    783     patchBuffer.link(failureCase, lastProtoBegin);
    784 
    785     // On success return back to the hot patch code, at a point it will perform the store to dest for us.
    786     patchBuffer.link(success, stubInfo->hotPathBegin.labelAtOffset(patchOffsetGetByIdPutResult));
    787 
    788     CodeLocationLabel entryLabel = patchBuffer.finalizeCodeAddendum();
    789 
    790     structure->ref();
    791     polymorphicStructures->list[currentIndex].set(entryLabel, structure);
    792 
    793     // Finally patch the jump to slow case back in the hot path to jump here instead.
    794     CodeLocationJump jumpLocation = stubInfo->hotPathBegin.jumpAtOffset(patchOffsetGetByIdBranchToSlowCase);
    795     RepatchBuffer repatchBuffer(m_codeBlock);
    796     repatchBuffer.relink(jumpLocation, entryLabel);
    797 }
    798 
    799 void JIT::privateCompileGetByIdProtoList(StructureStubInfo* stubInfo, PolymorphicAccessStructureList* prototypeStructures, int currentIndex, Structure* structure, Structure* prototypeStructure, size_t cachedOffset, CallFrame* callFrame)
    800 {
    801     // regT0 holds a JSCell*
    802    
    803     // The prototype object definitely exists (if this stub exists the CodeBlock is referencing a Structure that is
    804     // referencing the prototype object - let's speculatively load it's table nice and early!)
    805     JSObject* protoObject = asObject(structure->prototypeForLookup(callFrame));
    806 
    807     // Check eax is an object of the right Structure.
    808     Jump failureCases1 = checkStructure(regT0, structure);
    809 
    810     // Check the prototype object's Structure had not changed.
    811     Structure** prototypeStructureAddress = &(protoObject->m_structure);
    812 #if CPU(X86_64)
    813     move(ImmPtr(prototypeStructure), regT3);
    814     Jump failureCases2 = branchPtr(NotEqual, AbsoluteAddress(prototypeStructureAddress), regT3);
    815 #else
    816     Jump failureCases2 = branchPtr(NotEqual, AbsoluteAddress(prototypeStructureAddress), ImmPtr(prototypeStructure));
    817 #endif
    818 
    819     compileGetDirectOffset(protoObject, regT2, regT1, regT0, cachedOffset);
    820 
    821     Jump success = jump();
    822 
    823     LinkBuffer patchBuffer(this, m_codeBlock->executablePool());
    824 
    825     // Use the patch information to link the failure cases back to the original slow case routine.
    826     CodeLocationLabel lastProtoBegin = prototypeStructures->list[currentIndex - 1].stubRoutine;
    827     patchBuffer.link(failureCases1, lastProtoBegin);
    828     patchBuffer.link(failureCases2, lastProtoBegin);
    829 
    830     // On success return back to the hot patch code, at a point it will perform the store to dest for us.
    831     patchBuffer.link(success, stubInfo->hotPathBegin.labelAtOffset(patchOffsetGetByIdPutResult));
    832 
    833     CodeLocationLabel entryLabel = patchBuffer.finalizeCodeAddendum();
    834 
    835     structure->ref();
    836     prototypeStructure->ref();
    837     prototypeStructures->list[currentIndex].set(entryLabel, structure, prototypeStructure);
    838 
    839     // Finally patch the jump to slow case back in the hot path to jump here instead.
    840     CodeLocationJump jumpLocation = stubInfo->hotPathBegin.jumpAtOffset(patchOffsetGetByIdBranchToSlowCase);
    841     RepatchBuffer repatchBuffer(m_codeBlock);
    842     repatchBuffer.relink(jumpLocation, entryLabel);
    843 }
    844 
    845 void JIT::privateCompileGetByIdChainList(StructureStubInfo* stubInfo, PolymorphicAccessStructureList* prototypeStructures, int currentIndex, Structure* structure, StructureChain* chain, size_t count, size_t cachedOffset, CallFrame* callFrame)
    846 {
    847     // regT0 holds a JSCell*
    848    
    849     ASSERT(count);
    850    
    851     JumpList bucketsOfFail;
    852 
    853     // Check eax is an object of the right Structure.
    854     bucketsOfFail.append(checkStructure(regT0, structure));
    855 
    856     Structure* currStructure = structure;
    857     RefPtr<Structure>* chainEntries = chain->head();
    858     JSObject* protoObject = 0;
    859     for (unsigned i = 0; i < count; ++i) {
    860         protoObject = asObject(currStructure->prototypeForLookup(callFrame));
    861         currStructure = chainEntries[i].get();
    862 
    863         // Check the prototype object's Structure had not changed.
    864         Structure** prototypeStructureAddress = &(protoObject->m_structure);
    865 #if CPU(X86_64)
    866         move(ImmPtr(currStructure), regT3);
    867         bucketsOfFail.append(branchPtr(NotEqual, AbsoluteAddress(prototypeStructureAddress), regT3));
    868 #else
    869         bucketsOfFail.append(branchPtr(NotEqual, AbsoluteAddress(prototypeStructureAddress), ImmPtr(currStructure)));
    870 #endif
    871     }
    872     ASSERT(protoObject);
    873 
    874     compileGetDirectOffset(protoObject, regT2, regT1, regT0, cachedOffset);
    875     Jump success = jump();
    876 
    877     LinkBuffer patchBuffer(this, m_codeBlock->executablePool());
    878 
    879     // Use the patch information to link the failure cases back to the original slow case routine.
    880     CodeLocationLabel lastProtoBegin = prototypeStructures->list[currentIndex - 1].stubRoutine;
    881 
    882     patchBuffer.link(bucketsOfFail, lastProtoBegin);
    883 
    884     // On success return back to the hot patch code, at a point it will perform the store to dest for us.
    885     patchBuffer.link(success, stubInfo->hotPathBegin.labelAtOffset(patchOffsetGetByIdPutResult));
    886 
    887     CodeLocationLabel entryLabel = patchBuffer.finalizeCodeAddendum();
    888 
    889     // Track the stub we have created so that it will be deleted later.
    890     structure->ref();
    891     chain->ref();
    892     prototypeStructures->list[currentIndex].set(entryLabel, structure, chain);
    893 
    894     // Finally patch the jump to slow case back in the hot path to jump here instead.
    895     CodeLocationJump jumpLocation = stubInfo->hotPathBegin.jumpAtOffset(patchOffsetGetByIdBranchToSlowCase);
    896     RepatchBuffer repatchBuffer(m_codeBlock);
    897     repatchBuffer.relink(jumpLocation, entryLabel);
    898 }
    899 
    900 void JIT::privateCompileGetByIdChain(StructureStubInfo* stubInfo, Structure* structure, StructureChain* chain, size_t count, size_t cachedOffset, ReturnAddressPtr returnAddress, CallFrame* callFrame)
    901 {
    902     // regT0 holds a JSCell*
    903    
    904     ASSERT(count);
    905    
    906     JumpList bucketsOfFail;
    907 
    908     // Check eax is an object of the right Structure.
    909     bucketsOfFail.append(checkStructure(regT0, structure));
    910 
    911     Structure* currStructure = structure;
    912     RefPtr<Structure>* chainEntries = chain->head();
    913     JSObject* protoObject = 0;
    914     for (unsigned i = 0; i < count; ++i) {
    915         protoObject = asObject(currStructure->prototypeForLookup(callFrame));
    916         currStructure = chainEntries[i].get();
    917 
    918         // Check the prototype object's Structure had not changed.
    919         Structure** prototypeStructureAddress = &(protoObject->m_structure);
    920 #if CPU(X86_64)
    921         move(ImmPtr(currStructure), regT3);
    922         bucketsOfFail.append(branchPtr(NotEqual, AbsoluteAddress(prototypeStructureAddress), regT3));
    923 #else
    924         bucketsOfFail.append(branchPtr(NotEqual, AbsoluteAddress(prototypeStructureAddress), ImmPtr(currStructure)));
    925 #endif
    926     }
    927     ASSERT(protoObject);
    928 
    929     compileGetDirectOffset(protoObject, regT2, regT1, regT0, cachedOffset);
    930     Jump success = jump();
    931 
    932     LinkBuffer patchBuffer(this, m_codeBlock->executablePool());
    933 
    934     // Use the patch information to link the failure cases back to the original slow case routine.
    935     patchBuffer.link(bucketsOfFail, stubInfo->callReturnLocation.labelAtOffset(-patchOffsetGetByIdSlowCaseCall));
    936 
    937     // On success return back to the hot patch code, at a point it will perform the store to dest for us.
    938     patchBuffer.link(success, stubInfo->hotPathBegin.labelAtOffset(patchOffsetGetByIdPutResult));
    939 
    940     // Track the stub we have created so that it will be deleted later.
    941     CodeLocationLabel entryLabel = patchBuffer.finalizeCodeAddendum();
    942     stubInfo->stubRoutine = entryLabel;
    943 
    944     // Finally patch the jump to slow case back in the hot path to jump here instead.
    945     CodeLocationJump jumpLocation = stubInfo->hotPathBegin.jumpAtOffset(patchOffsetGetByIdBranchToSlowCase);
    946     RepatchBuffer repatchBuffer(m_codeBlock);
    947     repatchBuffer.relink(jumpLocation, entryLabel);
    948 
    949     // We don't want to patch more than once - in future go to cti_op_put_by_id_generic.
    950     repatchBuffer.relinkCallerToFunction(returnAddress, FunctionPtr(cti_op_get_by_id_proto_list));
    951 }
    952 
    953 /* ------------------------------ END: !ENABLE / ENABLE(JIT_OPTIMIZE_PROPERTY_ACCESS) ------------------------------ */
    954 
    955 #endif // !ENABLE(JIT_OPTIMIZE_PROPERTY_ACCESS)
    956 
    957 void JIT::compileGetDirectOffset(RegisterID base, RegisterID resultTag, RegisterID resultPayload, RegisterID structure, RegisterID offset)
    958 {
    959     ASSERT(sizeof(((Structure*)0)->m_propertyStorageCapacity) == sizeof(int32_t));
    960     ASSERT(sizeof(JSObject::inlineStorageCapacity) == sizeof(int32_t));
    961     ASSERT(sizeof(JSValue) == 8);
    962 
    963     Jump notUsingInlineStorage = branch32(NotEqual, Address(structure, OBJECT_OFFSETOF(Structure, m_propertyStorageCapacity)), Imm32(JSObject::inlineStorageCapacity));
    964     loadPtr(BaseIndex(base, offset, TimesEight, OBJECT_OFFSETOF(JSObject, m_inlineStorage)+OBJECT_OFFSETOF(JSValue, u.asBits.payload)), resultPayload);
    965     loadPtr(BaseIndex(base, offset, TimesEight, OBJECT_OFFSETOF(JSObject, m_inlineStorage)+OBJECT_OFFSETOF(JSValue, u.asBits.tag)), resultTag);
    966     Jump finishedLoad = jump();
    967     notUsingInlineStorage.link(this);
    968     loadPtr(Address(base, OBJECT_OFFSETOF(JSObject, m_externalStorage)), base);
    969     loadPtr(BaseIndex(base, offset, TimesEight, OBJECT_OFFSETOF(JSValue, u.asBits.payload)), resultPayload);
    970     loadPtr(BaseIndex(base, offset, TimesEight, OBJECT_OFFSETOF(JSValue, u.asBits.tag)), resultTag);
    971     finishedLoad.link(this);
    972 }
    973 
    974 void JIT::emit_op_get_by_pname(Instruction* currentInstruction)
    975 {
    976     unsigned dst = currentInstruction[1].u.operand;
    977     unsigned base = currentInstruction[2].u.operand;
    978     unsigned property = currentInstruction[3].u.operand;
    979     unsigned expected = currentInstruction[4].u.operand;
    980     unsigned iter = currentInstruction[5].u.operand;
    981     unsigned i = currentInstruction[6].u.operand;
    982 
    983     emitLoad2(property, regT1, regT0, base, regT3, regT2);
    984     emitJumpSlowCaseIfNotJSCell(property, regT1);
    985     addSlowCase(branchPtr(NotEqual, regT0, payloadFor(expected)));
    986     // Property registers are now available as the property is known
    987     emitJumpSlowCaseIfNotJSCell(base, regT3);
    988     emitLoadPayload(iter, regT1);
    989    
    990     // Test base's structure
    991     loadPtr(Address(regT2, OBJECT_OFFSETOF(JSCell, m_structure)), regT0);
    992     addSlowCase(branchPtr(NotEqual, regT0, Address(regT1, OBJECT_OFFSETOF(JSPropertyNameIterator, m_cachedStructure))));
    993     load32(addressFor(i), regT3);
    994     sub32(Imm32(1), regT3);
    995     addSlowCase(branch32(AboveOrEqual, regT3, Address(regT1, OBJECT_OFFSETOF(JSPropertyNameIterator, m_numCacheableSlots))));
    996     compileGetDirectOffset(regT2, regT1, regT0, regT0, regT3);   
    997 
    998     emitStore(dst, regT1, regT0);
    999     map(m_bytecodeIndex + OPCODE_LENGTH(op_get_by_pname), dst, regT1, regT0);
    1000 }
    1001 
    1002 void JIT::emitSlow_op_get_by_pname(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
    1003 {
    1004     unsigned dst = currentInstruction[1].u.operand;
    1005     unsigned base = currentInstruction[2].u.operand;
    1006     unsigned property = currentInstruction[3].u.operand;
    1007    
    1008     linkSlowCaseIfNotJSCell(iter, property);
    1009     linkSlowCase(iter);
    1010     linkSlowCaseIfNotJSCell(iter, base);
    1011     linkSlowCase(iter);
    1012     linkSlowCase(iter);
    1013    
    1014     JITStubCall stubCall(this, cti_op_get_by_val);
    1015     stubCall.addArgument(base);
    1016     stubCall.addArgument(property);
    1017     stubCall.call(dst);
    1018 }
    1019 
    1020 #else // USE(JSVALUE32_64)
    102153
    102254void JIT::emit_op_get_by_val(Instruction* currentInstruction)
    … …  
    1893925#endif // !ENABLE(JIT_OPTIMIZE_PROPERTY_ACCESS)
    1894926
    1895 #endif // USE(JSVALUE32_64)
    1896 
    1897927} // namespace JSC
    1898928
    1899929#endif // ENABLE(JIT)
     930
     931#endif // !USE(JSVALUE32_64)
Note: See TracChangeset for help on using the changeset viewer.