Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(3)

Side by Side Diff: src/elements.cc

Issue 9808111: Fix missing write barrier in CopyObjectToObjectElements. (Closed) Base URL: https://v8.googlecode.com/svn/branches/bleeding_edge
Patch Set: Created 8 years, 9 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View unified diff | Download patch | Annotate | Revision Log
« no previous file with comments | « src/elements.h ('k') | src/objects.cc » ('j') | no next file with comments »
Toggle Intra-line Diffs ('i') | Expand Comments ('e') | Collapse Comments ('c') | Show Comments Hide Comments ('s')
OLDNEW
1 // Copyright 2012 the V8 project authors. All rights reserved. 1 // Copyright 2012 the V8 project authors. All rights reserved.
2 // Redistribution and use in source and binary forms, with or without 2 // Redistribution and use in source and binary forms, with or without
3 // modification, are permitted provided that the following conditions are 3 // modification, are permitted provided that the following conditions are
4 // met: 4 // met:
5 // 5 //
6 // * Redistributions of source code must retain the above copyright 6 // * Redistributions of source code must retain the above copyright
7 // notice, this list of conditions and the following disclaimer. 7 // notice, this list of conditions and the following disclaimer.
8 // * Redistributions in binary form must reproduce the above 8 // * Redistributions in binary form must reproduce the above
9 // copyright notice, this list of conditions and the following 9 // copyright notice, this list of conditions and the following
10 // disclaimer in the documentation and/or other materials provided 10 // disclaimer in the documentation and/or other materials provided
(...skipping 119 matching lines...) Expand 10 before | Expand all | Expand 10 after
130 HandleVector<Object>(NULL, 0))); 130 HandleVector<Object>(NULL, 0)));
131 } 131 }
132 132
133 133
134 void CopyObjectToObjectElements(FixedArray* from, 134 void CopyObjectToObjectElements(FixedArray* from,
135 ElementsKind from_kind, 135 ElementsKind from_kind,
136 uint32_t from_start, 136 uint32_t from_start,
137 FixedArray* to, 137 FixedArray* to,
138 ElementsKind to_kind, 138 ElementsKind to_kind,
139 uint32_t to_start, 139 uint32_t to_start,
140 int raw_copy_size, 140 int raw_copy_size) {
141 WriteBarrierMode mode) {
142 ASSERT(to->map() != HEAP->fixed_cow_array_map()); 141 ASSERT(to->map() != HEAP->fixed_cow_array_map());
143 ASSERT(from_kind == FAST_ELEMENTS || from_kind == FAST_SMI_ONLY_ELEMENTS); 142 ASSERT(from_kind == FAST_ELEMENTS || from_kind == FAST_SMI_ONLY_ELEMENTS);
144 ASSERT(to_kind == FAST_ELEMENTS || to_kind == FAST_SMI_ONLY_ELEMENTS); 143 ASSERT(to_kind == FAST_ELEMENTS || to_kind == FAST_SMI_ONLY_ELEMENTS);
145 int copy_size = raw_copy_size; 144 int copy_size = raw_copy_size;
146 if (raw_copy_size < 0) { 145 if (raw_copy_size < 0) {
147 ASSERT(raw_copy_size == ElementsAccessor::kCopyToEnd || 146 ASSERT(raw_copy_size == ElementsAccessor::kCopyToEnd ||
148 raw_copy_size == ElementsAccessor::kCopyToEndAndInitializeToHole); 147 raw_copy_size == ElementsAccessor::kCopyToEndAndInitializeToHole);
149 copy_size = Min(from->length() - from_start, 148 copy_size = Min(from->length() - from_start,
150 to->length() - to_start); 149 to->length() - to_start);
151 #ifdef DEBUG 150 #ifdef DEBUG
152 // FAST_ELEMENT arrays cannot be uninitialized. Ensure they are already 151 // FAST_ELEMENT arrays cannot be uninitialized. Ensure they are already
153 // marked with the hole. 152 // marked with the hole.
154 if (raw_copy_size == ElementsAccessor::kCopyToEndAndInitializeToHole) { 153 if (raw_copy_size == ElementsAccessor::kCopyToEndAndInitializeToHole) {
155 for (int i = to_start + copy_size; i < to->length(); ++i) { 154 for (int i = to_start + copy_size; i < to->length(); ++i) {
156 ASSERT(to->get(i)->IsTheHole()); 155 ASSERT(to->get(i)->IsTheHole());
157 } 156 }
158 } 157 }
159 #endif 158 #endif
160 } 159 }
161 ASSERT((copy_size + static_cast<int>(to_start)) <= to->length() && 160 ASSERT((copy_size + static_cast<int>(to_start)) <= to->length() &&
162 (copy_size + static_cast<int>(from_start)) <= from->length()); 161 (copy_size + static_cast<int>(from_start)) <= from->length());
163 if (copy_size == 0) return; 162 if (copy_size == 0) return;
164 Address to_address = to->address() + FixedArray::kHeaderSize; 163 Address to_address = to->address() + FixedArray::kHeaderSize;
165 Address from_address = from->address() + FixedArray::kHeaderSize; 164 Address from_address = from->address() + FixedArray::kHeaderSize;
166 CopyWords(reinterpret_cast<Object**>(to_address) + to_start, 165 CopyWords(reinterpret_cast<Object**>(to_address) + to_start,
167 reinterpret_cast<Object**>(from_address) + from_start, 166 reinterpret_cast<Object**>(from_address) + from_start,
168 copy_size); 167 copy_size);
169 if (from_kind == FAST_ELEMENTS && to_kind == FAST_ELEMENTS && 168 if (from_kind == FAST_ELEMENTS && to_kind == FAST_ELEMENTS) {
170 mode == UPDATE_WRITE_BARRIER) {
171 Heap* heap = from->GetHeap(); 169 Heap* heap = from->GetHeap();
172 if (!heap->InNewSpace(to)) { 170 if (!heap->InNewSpace(to)) {
173 heap->RecordWrites(to->address(), 171 heap->RecordWrites(to->address(),
174 to->OffsetOfElementAt(to_start), 172 to->OffsetOfElementAt(to_start),
175 copy_size); 173 copy_size);
176 } 174 }
177 heap->incremental_marking()->RecordWrites(to); 175 heap->incremental_marking()->RecordWrites(to);
178 } 176 }
179 } 177 }
180 178
181 179
182 static void CopyDictionaryToObjectElements(SeededNumberDictionary* from, 180 static void CopyDictionaryToObjectElements(SeededNumberDictionary* from,
183 uint32_t from_start, 181 uint32_t from_start,
184 FixedArray* to, 182 FixedArray* to,
185 ElementsKind to_kind, 183 ElementsKind to_kind,
186 uint32_t to_start, 184 uint32_t to_start,
187 int raw_copy_size, 185 int raw_copy_size) {
188 WriteBarrierMode mode) {
189 int copy_size = raw_copy_size; 186 int copy_size = raw_copy_size;
190 Heap* heap = from->GetHeap(); 187 Heap* heap = from->GetHeap();
191 if (raw_copy_size < 0) { 188 if (raw_copy_size < 0) {
192 ASSERT(raw_copy_size == ElementsAccessor::kCopyToEnd || 189 ASSERT(raw_copy_size == ElementsAccessor::kCopyToEnd ||
193 raw_copy_size == ElementsAccessor::kCopyToEndAndInitializeToHole); 190 raw_copy_size == ElementsAccessor::kCopyToEndAndInitializeToHole);
194 copy_size = from->max_number_key() + 1 - from_start; 191 copy_size = from->max_number_key() + 1 - from_start;
195 #ifdef DEBUG 192 #ifdef DEBUG
196 // FAST_ELEMENT arrays cannot be uninitialized. Ensure they are already 193 // FAST_ELEMENT arrays cannot be uninitialized. Ensure they are already
197 // marked with the hole. 194 // marked with the hole.
198 if (raw_copy_size == ElementsAccessor::kCopyToEndAndInitializeToHole) { 195 if (raw_copy_size == ElementsAccessor::kCopyToEndAndInitializeToHole) {
(...skipping 270 matching lines...) Expand 10 before | Expand all | Expand 10 after
469 466
470 virtual MaybeObject* Delete(JSObject* obj, 467 virtual MaybeObject* Delete(JSObject* obj,
471 uint32_t key, 468 uint32_t key,
472 JSReceiver::DeleteMode mode) = 0; 469 JSReceiver::DeleteMode mode) = 0;
473 470
474 static MaybeObject* CopyElementsImpl(FixedArrayBase* from, 471 static MaybeObject* CopyElementsImpl(FixedArrayBase* from,
475 uint32_t from_start, 472 uint32_t from_start,
476 FixedArrayBase* to, 473 FixedArrayBase* to,
477 ElementsKind to_kind, 474 ElementsKind to_kind,
478 uint32_t to_start, 475 uint32_t to_start,
479 int copy_size, 476 int copy_size) {
480 WriteBarrierMode mode) {
481 UNREACHABLE(); 477 UNREACHABLE();
482 return NULL; 478 return NULL;
483 } 479 }
484 480
485 virtual MaybeObject* CopyElements(JSObject* from_holder, 481 virtual MaybeObject* CopyElements(JSObject* from_holder,
486 uint32_t from_start, 482 uint32_t from_start,
487 FixedArrayBase* to, 483 FixedArrayBase* to,
488 ElementsKind to_kind, 484 ElementsKind to_kind,
489 uint32_t to_start, 485 uint32_t to_start,
490 int copy_size, 486 int copy_size,
491 WriteBarrierMode mode,
492 FixedArrayBase* from) { 487 FixedArrayBase* from) {
493 if (from == NULL) { 488 if (from == NULL) {
494 from = from_holder->elements(); 489 from = from_holder->elements();
495 } 490 }
496 if (from->length() == 0) { 491 if (from->length() == 0) {
497 return from; 492 return from;
498 } 493 }
499 return ElementsAccessorSubclass::CopyElementsImpl( 494 return ElementsAccessorSubclass::CopyElementsImpl(
500 from, from_start, to, to_kind, to_start, copy_size, mode); 495 from, from_start, to, to_kind, to_start, copy_size);
501 } 496 }
502 497
503 virtual MaybeObject* AddElementsToFixedArray(Object* receiver, 498 virtual MaybeObject* AddElementsToFixedArray(Object* receiver,
504 JSObject* holder, 499 JSObject* holder,
505 FixedArray* to, 500 FixedArray* to,
506 FixedArrayBase* from) { 501 FixedArrayBase* from) {
507 int len0 = to->length(); 502 int len0 = to->length();
508 #ifdef DEBUG 503 #ifdef DEBUG
509 if (FLAG_enable_slow_asserts) { 504 if (FLAG_enable_slow_asserts) {
510 for (int i = 0; i < len0; i++) { 505 for (int i = 0; i < len0; i++) {
(...skipping 216 matching lines...) Expand 10 before | Expand all | Expand 10 after
727 } 722 }
728 } 723 }
729 return heap->true_value(); 724 return heap->true_value();
730 } 725 }
731 726
732 static MaybeObject* CopyElementsImpl(FixedArrayBase* from, 727 static MaybeObject* CopyElementsImpl(FixedArrayBase* from,
733 uint32_t from_start, 728 uint32_t from_start,
734 FixedArrayBase* to, 729 FixedArrayBase* to,
735 ElementsKind to_kind, 730 ElementsKind to_kind,
736 uint32_t to_start, 731 uint32_t to_start,
737 int copy_size, 732 int copy_size) {
738 WriteBarrierMode mode) {
739 switch (to_kind) { 733 switch (to_kind) {
740 case FAST_SMI_ONLY_ELEMENTS: 734 case FAST_SMI_ONLY_ELEMENTS:
741 case FAST_ELEMENTS: { 735 case FAST_ELEMENTS: {
742 CopyObjectToObjectElements( 736 CopyObjectToObjectElements(
743 FixedArray::cast(from), ElementsTraits::Kind, from_start, 737 FixedArray::cast(from), ElementsTraits::Kind, from_start,
744 FixedArray::cast(to), to_kind, to_start, copy_size, mode); 738 FixedArray::cast(to), to_kind, to_start, copy_size);
745 return from; 739 return from;
746 } 740 }
747 case FAST_DOUBLE_ELEMENTS: 741 case FAST_DOUBLE_ELEMENTS:
748 CopyObjectToDoubleElements( 742 CopyObjectToDoubleElements(
749 FixedArray::cast(from), from_start, 743 FixedArray::cast(from), from_start,
750 FixedDoubleArray::cast(to), to_start, copy_size); 744 FixedDoubleArray::cast(to), to_start, copy_size);
751 return from; 745 return from;
752 default: 746 default:
753 UNREACHABLE(); 747 UNREACHABLE();
754 } 748 }
(...skipping 47 matching lines...) Expand 10 before | Expand all | Expand 10 after
802 ElementsKindTraits<FAST_DOUBLE_ELEMENTS> >; 796 ElementsKindTraits<FAST_DOUBLE_ELEMENTS> >;
803 friend class FastElementsAccessor<FastDoubleElementsAccessor, 797 friend class FastElementsAccessor<FastDoubleElementsAccessor,
804 ElementsKindTraits<FAST_DOUBLE_ELEMENTS>, 798 ElementsKindTraits<FAST_DOUBLE_ELEMENTS>,
805 kDoubleSize>; 799 kDoubleSize>;
806 800
807 static MaybeObject* CopyElementsImpl(FixedArrayBase* from, 801 static MaybeObject* CopyElementsImpl(FixedArrayBase* from,
808 uint32_t from_start, 802 uint32_t from_start,
809 FixedArrayBase* to, 803 FixedArrayBase* to,
810 ElementsKind to_kind, 804 ElementsKind to_kind,
811 uint32_t to_start, 805 uint32_t to_start,
812 int copy_size, 806 int copy_size) {
813 WriteBarrierMode mode) {
814 switch (to_kind) { 807 switch (to_kind) {
815 case FAST_SMI_ONLY_ELEMENTS: 808 case FAST_SMI_ONLY_ELEMENTS:
816 case FAST_ELEMENTS: 809 case FAST_ELEMENTS:
817 return CopyDoubleToObjectElements( 810 return CopyDoubleToObjectElements(
818 FixedDoubleArray::cast(from), from_start, FixedArray::cast(to), 811 FixedDoubleArray::cast(from), from_start, FixedArray::cast(to),
819 to_kind, to_start, copy_size); 812 to_kind, to_start, copy_size);
820 case FAST_DOUBLE_ELEMENTS: 813 case FAST_DOUBLE_ELEMENTS:
821 CopyDoubleToDoubleElements(FixedDoubleArray::cast(from), from_start, 814 CopyDoubleToDoubleElements(FixedDoubleArray::cast(from), from_start,
822 FixedDoubleArray::cast(to), 815 FixedDoubleArray::cast(to),
823 to_start, copy_size); 816 to_start, copy_size);
(...skipping 276 matching lines...) Expand 10 before | Expand all | Expand 10 after
1100 } 1093 }
1101 } 1094 }
1102 return heap->true_value(); 1095 return heap->true_value();
1103 } 1096 }
1104 1097
1105 static MaybeObject* CopyElementsImpl(FixedArrayBase* from, 1098 static MaybeObject* CopyElementsImpl(FixedArrayBase* from,
1106 uint32_t from_start, 1099 uint32_t from_start,
1107 FixedArrayBase* to, 1100 FixedArrayBase* to,
1108 ElementsKind to_kind, 1101 ElementsKind to_kind,
1109 uint32_t to_start, 1102 uint32_t to_start,
1110 int copy_size, 1103 int copy_size) {
1111 WriteBarrierMode mode) {
1112 switch (to_kind) { 1104 switch (to_kind) {
1113 case FAST_SMI_ONLY_ELEMENTS: 1105 case FAST_SMI_ONLY_ELEMENTS:
1114 case FAST_ELEMENTS: 1106 case FAST_ELEMENTS:
1115 CopyDictionaryToObjectElements( 1107 CopyDictionaryToObjectElements(
1116 SeededNumberDictionary::cast(from), from_start, 1108 SeededNumberDictionary::cast(from), from_start,
1117 FixedArray::cast(to), to_kind, to_start, copy_size, mode); 1109 FixedArray::cast(to), to_kind, to_start, copy_size);
1118 return from; 1110 return from;
1119 case FAST_DOUBLE_ELEMENTS: 1111 case FAST_DOUBLE_ELEMENTS:
1120 CopyDictionaryToDoubleElements( 1112 CopyDictionaryToDoubleElements(
1121 SeededNumberDictionary::cast(from), from_start, 1113 SeededNumberDictionary::cast(from), from_start,
1122 FixedDoubleArray::cast(to), to_start, copy_size); 1114 FixedDoubleArray::cast(to), to_start, copy_size);
1123 return from; 1115 return from;
1124 default: 1116 default:
1125 UNREACHABLE(); 1117 UNREACHABLE();
1126 } 1118 }
1127 return to->GetHeap()->undefined_value(); 1119 return to->GetHeap()->undefined_value();
(...skipping 117 matching lines...) Expand 10 before | Expand all | Expand 10 after
1245 } 1237 }
1246 } 1238 }
1247 return obj->GetHeap()->true_value(); 1239 return obj->GetHeap()->true_value();
1248 } 1240 }
1249 1241
1250 static MaybeObject* CopyElementsImpl(FixedArrayBase* from, 1242 static MaybeObject* CopyElementsImpl(FixedArrayBase* from,
1251 uint32_t from_start, 1243 uint32_t from_start,
1252 FixedArrayBase* to, 1244 FixedArrayBase* to,
1253 ElementsKind to_kind, 1245 ElementsKind to_kind,
1254 uint32_t to_start, 1246 uint32_t to_start,
1255 int copy_size, 1247 int copy_size) {
1256 WriteBarrierMode mode) {
1257 FixedArray* parameter_map = FixedArray::cast(from); 1248 FixedArray* parameter_map = FixedArray::cast(from);
1258 FixedArray* arguments = FixedArray::cast(parameter_map->get(1)); 1249 FixedArray* arguments = FixedArray::cast(parameter_map->get(1));
1259 ElementsAccessor* accessor = ElementsAccessor::ForArray(arguments); 1250 ElementsAccessor* accessor = ElementsAccessor::ForArray(arguments);
1260 return accessor->CopyElements(NULL, from_start, to, to_kind, 1251 return accessor->CopyElements(NULL, from_start, to, to_kind,
1261 to_start, copy_size, mode, arguments); 1252 to_start, copy_size, arguments);
1262 } 1253 }
1263 1254
1264 static uint32_t GetCapacityImpl(FixedArray* parameter_map) { 1255 static uint32_t GetCapacityImpl(FixedArray* parameter_map) {
1265 FixedArrayBase* arguments = FixedArrayBase::cast(parameter_map->get(1)); 1256 FixedArrayBase* arguments = FixedArrayBase::cast(parameter_map->get(1));
1266 return Max(static_cast<uint32_t>(parameter_map->length() - 2), 1257 return Max(static_cast<uint32_t>(parameter_map->length() - 2),
1267 ForArray(arguments)->GetCapacity(arguments)); 1258 ForArray(arguments)->GetCapacity(arguments));
1268 } 1259 }
1269 1260
1270 static uint32_t GetKeyForIndexImpl(FixedArray* dict, 1261 static uint32_t GetKeyForIndexImpl(FixedArray* dict,
1271 uint32_t index) { 1262 uint32_t index) {
(...skipping 140 matching lines...) Expand 10 before | Expand all | Expand 10 after
1412 if (!maybe_obj->To(&new_backing_store)) return maybe_obj; 1403 if (!maybe_obj->To(&new_backing_store)) return maybe_obj;
1413 new_backing_store->set(0, length); 1404 new_backing_store->set(0, length);
1414 { MaybeObject* result = array->SetContent(new_backing_store); 1405 { MaybeObject* result = array->SetContent(new_backing_store);
1415 if (result->IsFailure()) return result; 1406 if (result->IsFailure()) return result;
1416 } 1407 }
1417 return array; 1408 return array;
1418 } 1409 }
1419 1410
1420 1411
1421 } } // namespace v8::internal 1412 } } // namespace v8::internal
OLDNEW
« no previous file with comments | « src/elements.h ('k') | src/objects.cc » ('j') | no next file with comments »

Powered by Google App Engine
This is Rietveld 408576698