src/ia32/lithium-codegen-ia32.cc - Issue 14403015: Disallow dereferencing deferred handles when generating optimized code.

Unified Diff: src/ia32/lithium-codegen-ia32.cc

Issue 14403015: Disallow dereferencing deferred handles when generating optimized code. (Closed) Base URL: https://v8.googlecode.com/svn/branches/bleeding_edge

Patch Set: addressed comments Created 7 years, 8 months ago

Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.

Jump to:

View side-by-side diff with in-line comments

Download patch

Index: src/ia32/lithium-codegen-ia32.cc

diff --git a/src/ia32/lithium-codegen-ia32.cc b/src/ia32/lithium-codegen-ia32.cc

index ce51ec7b3239348f747e94d8f8ef2c7e93c27824..94614e043d4101fa710feefe8170194c6d040bd9 100644

--- a/src/ia32/lithium-codegen-ia32.cc

+++ b/src/ia32/lithium-codegen-ia32.cc

@@ -635,7 +635,7 @@ void LCodeGen::WriteTranslation(LEnvironment* environment,

pushed_arguments_index,

pushed_arguments_count);

bool has_closure_id = !info()->closure().is_null() &&

- *info()->closure() != *environment->closure();

+ !info()->closure().is_identical_to(environment->closure());

int closure_id = has_closure_id

? DefineDeoptimizationLiteral(environment->closure())

: Translation::kSelfLiteralId;

@@ -1002,10 +1002,13 @@ void LCodeGen::PopulateDeoptimizationData(Handle<Code> code) {

Handle<FixedArray> literals =

factory()->NewFixedArray(deoptimization_literals_.length(), TENURED);

- for (int i = 0; i < deoptimization_literals_.length(); i++) {

- literals->set(i, *deoptimization_literals_[i]);

+ { ALLOW_HANDLE_DEREF(isolate(),

+ "copying a ZoneList of handles into a FixedArray");

+ for (int i = 0; i < deoptimization_literals_.length(); i++) {

+ literals->set(i, *deoptimization_literals_[i]);

+ }

+ data->SetLiteralArray(*literals);

}

- data->SetLiteralArray(*literals);

data->SetOsrAstId(Smi::FromInt(info_->osr_ast_id().ToInt()));

data->SetOsrPcOffset(Smi::FromInt(osr_pc_offset_));

@@ -1787,6 +1790,7 @@ void LCodeGen::DoConstantD(LConstantD* instr) {

void LCodeGen::DoConstantT(LConstantT* instr) {

Handle<Object> handle = instr->value();

+ ALLOW_HANDLE_DEREF(isolate(), "smi check");

if (handle->IsHeapObject()) {

__ LoadHeapObject(reg, Handle<HeapObject>::cast(handle));

} else {

@@ -3006,6 +3010,7 @@ void LCodeGen::EmitPushTaggedOperand(LOperand* operand) {

ASSERT(!operand->IsDoubleRegister());

if (operand->IsConstantOperand()) {

Handle<Object> object = ToHandle(LConstantOperand::cast(operand));

+ ALLOW_HANDLE_DEREF(isolate(), "smi check");

if (object->IsSmi()) {

__ Push(Handle<Smi>::cast(object));

} else {

@@ -3590,12 +3595,15 @@ void LCodeGen::DoGlobalReceiver(LGlobalReceiver* instr) {

void LCodeGen::CallKnownFunction(Handle<JSFunction> function,

+ int formal_parameter_count,

int arity,

LInstruction* instr,

CallKind call_kind,

EDIState edi_state) {

- bool can_invoke_directly = !function->NeedsArgumentsAdaption() ||

- function->shared()->formal_parameter_count() == arity;

+ bool dont_adapt_arguments =

+ formal_parameter_count == SharedFunctionInfo::kDontAdaptArgumentsSentinel;

+ bool can_invoke_directly =

+ dont_adapt_arguments || formal_parameter_count == arity;

LPointerMap* pointers = instr->pointer_map();

RecordPosition(pointers->position());

@@ -3610,13 +3618,13 @@ void LCodeGen::CallKnownFunction(Handle<JSFunction> function,

// Set eax to arguments count if adaption is not needed. Assumes that eax

// is available to write to at this point.

- if (!function->NeedsArgumentsAdaption()) {

+ if (dont_adapt_arguments) {

__ mov(eax, arity);

}

// Invoke function directly.

__ SetCallKind(ecx, call_kind);

- if (*function == *info()->closure()) {

+ if (function.is_identical_to(info()->closure())) {

__ CallSelf();

} else {

__ call(FieldOperand(edi, JSFunction::kCodeEntryOffset));

@@ -3627,14 +3635,17 @@ void LCodeGen::CallKnownFunction(Handle<JSFunction> function,

SafepointGenerator generator(

this, pointers, Safepoint::kLazyDeopt);

ParameterCount count(arity);

- __ InvokeFunction(function, count, CALL_FUNCTION, generator, call_kind);

+ ParameterCount expected(formal_parameter_count);

+ __ InvokeFunction(

+ function, expected, count, CALL_FUNCTION, generator, call_kind);

}

void LCodeGen::DoCallConstantFunction(LCallConstantFunction* instr) {

ASSERT(ToRegister(instr->result()).is(eax));

- CallKnownFunction(instr->function(),

+ CallKnownFunction(instr->hydrogen()->function(),

+ instr->hydrogen()->formal_parameter_count(),

instr->arity(),

instr,

CALL_AS_METHOD,

@@ -4096,7 +4107,8 @@ void LCodeGen::DoInvokeFunction(LInvokeFunction* instr) {

ASSERT(ToRegister(instr->function()).is(edi));

ASSERT(instr->HasPointerMap());

- if (instr->known_function().is_null()) {

+ Handle<JSFunction> known_function = instr->hydrogen()->known_function();

+ if (known_function.is_null()) {

LPointerMap* pointers = instr->pointer_map();

RecordPosition(pointers->position());

SafepointGenerator generator(

@@ -4104,7 +4116,8 @@ void LCodeGen::DoInvokeFunction(LInvokeFunction* instr) {

ParameterCount count(instr->arity());

__ InvokeFunction(edi, count, CALL_FUNCTION, generator, CALL_AS_METHOD);

} else {

- CallKnownFunction(instr->known_function(),

+ CallKnownFunction(known_function,

+ instr->hydrogen()->formal_parameter_count(),

instr->arity(),

instr,

CALL_AS_METHOD,

@@ -4164,7 +4177,8 @@ void LCodeGen::DoCallGlobal(LCallGlobal* instr) {

void LCodeGen::DoCallKnownGlobal(LCallKnownGlobal* instr) {

ASSERT(ToRegister(instr->result()).is(eax));

- CallKnownFunction(instr->target(),

+ CallKnownFunction(instr->hydrogen()->target(),

+ instr->hydrogen()->formal_parameter_count(),

instr->arity(),

instr,

CALL_AS_FUNCTION,

@@ -5890,16 +5904,12 @@ void LCodeGen::DoAllocateObject(LAllocateObject* instr) {

Handle<JSFunction> constructor = instr->hydrogen()->constructor();

- Handle<Map> initial_map(constructor->initial_map());

+ Handle<Map> initial_map = instr->hydrogen()->constructor_initial_map();

int instance_size = initial_map->instance_size();

ASSERT(initial_map->pre_allocated_property_fields() +

initial_map->unused_property_fields() -

initial_map->inobject_properties() == 0);

- // Allocate memory for the object. The initial map might change when

- // the constructor's prototype changes, but instance size and property

- // counts remain unchanged (if slack tracking finished).

- ASSERT(!constructor->shared()->IsInobjectSlackTrackingInProgress());

__ Allocate(instance_size, result, no_reg, scratch, deferred->entry(),

TAG_OBJECT);

@@ -5950,8 +5960,7 @@ void LCodeGen::DoAllocateObject(LAllocateObject* instr) {

void LCodeGen::DoDeferredAllocateObject(LAllocateObject* instr) {

- Handle<JSFunction> constructor = instr->hydrogen()->constructor();

- Handle<Map> initial_map(constructor->initial_map());

+ Handle<Map> initial_map = instr->hydrogen()->constructor_initial_map();

int instance_size = initial_map->instance_size();

// TODO(3095996): Get rid of this. For now, we need to make the

@@ -6030,7 +6039,7 @@ void LCodeGen::DoDeferredAllocate(LAllocate* instr) {

void LCodeGen::DoArrayLiteral(LArrayLiteral* instr) {

ASSERT(ToRegister(instr->context()).is(esi));

- Handle<FixedArray> literals(instr->environment()->closure()->literals());

+ Handle<FixedArray> literals = instr->hydrogen()->literals();

ElementsKind boilerplate_elements_kind =

instr->hydrogen()->boilerplate_elements_kind();

AllocationSiteMode allocation_site_mode =

@@ -6091,7 +6100,7 @@ void LCodeGen::DoArrayLiteral(LArrayLiteral* instr) {

void LCodeGen::DoObjectLiteral(LObjectLiteral* instr) {

ASSERT(ToRegister(instr->context()).is(esi));

- Handle<FixedArray> literals(instr->environment()->closure()->literals());

+ Handle<FixedArray> literals = instr->hydrogen()->literals();

Handle<FixedArray> constant_properties =

instr->hydrogen()->constant_properties();

@@ -6104,7 +6113,7 @@ void LCodeGen::DoObjectLiteral(LObjectLiteral* instr) {

// Set up the parameters to the stub/runtime call and pick the right

// runtime function or stub to call.

- int properties_count = constant_properties->length() / 2;

+ int properties_count = instr->hydrogen()->constant_properties_length() / 2;

if (instr->hydrogen()->depth() > 1) {

__ PushHeapObject(literals);

__ push(Immediate(Smi::FromInt(instr->hydrogen()->literal_index())));

@@ -6192,19 +6201,17 @@ void LCodeGen::DoFunctionLiteral(LFunctionLiteral* instr) {

ASSERT(ToRegister(instr->context()).is(esi));

// Use the fast case closure allocation code that allocates in new

// space for nested functions that don't need literals cloning.

- Handle<SharedFunctionInfo> shared_info = instr->shared_info();

bool pretenure = instr->hydrogen()->pretenure();

- if (!pretenure && shared_info->num_literals() == 0) {

- FastNewClosureStub stub(shared_info->language_mode(),

- shared_info->is_generator());

- __ push(Immediate(shared_info));

+ if (!pretenure && instr->hydrogen()->has_no_literals()) {

+ FastNewClosureStub stub(instr->hydrogen()->language_mode(),

+ instr->hydrogen()->is_generator());

+ __ push(Immediate(instr->hydrogen()->shared_info()));

CallCode(stub.GetCode(isolate()), RelocInfo::CODE_TARGET, instr);

} else {

__ push(esi);

- __ push(Immediate(shared_info));

- __ push(Immediate(pretenure

- ? factory()->true_value()

- : factory()->false_value()));

+ __ push(Immediate(instr->hydrogen()->shared_info()));

+ __ push(Immediate(pretenure ? factory()->true_value()

+ : factory()->false_value()));

CallRuntime(Runtime::kNewClosure, 3, instr);

}

« no previous file with comments | « src/ia32/lithium-codegen-ia32.h ('k') | src/ia32/lithium-ia32.h » ('j') | no next file with comments »