// Copyright 2012 the V8 project authors. All rights reserved.

// Use of this source code is governed by a BSD-style license that can be

// found in the LICENSE file.

#include "src/v8.h"

#include "src/accessors.h"

#include "src/api.h"

#include "src/arguments.h"

#include "src/base/bits.h"

#include "src/codegen.h"

#include "src/conversions.h"

#include "src/execution.h"

#include "src/ic/call-optimization.h"

#include "src/ic/handler-compiler.h"

#include "src/ic/ic-inl.h"

#include "src/ic/ic-compiler.h"

#include "src/ic/stub-cache.h"

#include "src/prototype.h"

#include "src/runtime/runtime.h"

namespace v8 {

namespace internal {

char IC::TransitionMarkFromState(IC::State state) {

switch (state) {

case UNINITIALIZED:

return '0';

case PREMONOMORPHIC:

return '.';

case MONOMORPHIC:

return '1';

case PROTOTYPE_FAILURE:

return '^';

case POLYMORPHIC:

return 'P';

case MEGAMORPHIC:

return 'N';

case GENERIC:

return 'G';

// We never see the debugger states here, because the state is

// computed from the original code - not the patched code. Let

// these cases fall through to the unreachable code below.

case DEBUG_STUB:

break;

// Type-vector-based ICs resolve state to one of the above.

case DEFAULT:

break;

}

UNREACHABLE();

return 0;

}

const char* GetTransitionMarkModifier(KeyedAccessStoreMode mode) {

if (mode == STORE_NO_TRANSITION_HANDLE_COW) return ".COW";

if (mode == STORE_NO_TRANSITION_IGNORE_OUT_OF_BOUNDS) {

return ".IGNORE_OOB";

}

if (IsGrowStoreMode(mode)) return ".GROW";

return "";

}

#ifdef DEBUG

#define TRACE_GENERIC_IC(isolate, type, reason) \

do { \

if (FLAG_trace_ic) { \

PrintF("[%s patching generic stub in ", type); \

JavaScriptFrame::PrintTop(isolate, stdout, false, true); \

PrintF(" (%s)]\n", reason); \

} \

} while (false)

#else

#define TRACE_GENERIC_IC(isolate, type, reason) \

do { \

if (FLAG_trace_ic) { \

PrintF("[%s patching generic stub in ", type); \

PrintF("(see below) (%s)]\n", reason); \

} \

} while (false)

#endif // DEBUG

void IC::TraceIC(const char* type, Handle<Object> name) {

if (FLAG_trace_ic) {

State new_state =

UseVector() ? nexus()->StateFromFeedback() : raw_target()->ic_state();

TraceIC(type, name, state(), new_state);

}

}

void IC::TraceIC(const char* type, Handle<Object> name, State old_state,

State new_state) {

if (FLAG_trace_ic) {

Code* new_target = raw_target();

PrintF("[%s%s in ", new_target->is_keyed_stub() ? "Keyed" : "", type);

// TODO(jkummerow): Add support for "apply". The logic is roughly:

// marker = [fp_ + kMarkerOffset];

// if marker is smi and marker.value == INTERNAL and

// the frame's code == builtin(Builtins::kFunctionApply):

// then print "apply from" and advance one frame

Object* maybe_function =

Memory::Object_at(fp_ + JavaScriptFrameConstants::kFunctionOffset);

if (maybe_function->IsJSFunction()) {

JSFunction* function = JSFunction::cast(maybe_function);

JavaScriptFrame::PrintFunctionAndOffset(function, function->code(), pc(),

stdout, true);

}

ExtraICState extra_state = new_target->extra_ic_state();

const char* modifier = "";

if (new_target->kind() == Code::KEYED_STORE_IC) {

modifier = GetTransitionMarkModifier(

KeyedStoreIC::GetKeyedAccessStoreMode(extra_state));

}

PrintF(" (%c->%c%s) ", TransitionMarkFromState(old_state),

TransitionMarkFromState(new_state), modifier);

#ifdef OBJECT_PRINT

OFStream os(stdout);

name->Print(os);

#else

name->ShortPrint(stdout);

#endif

PrintF("]\n");

}

}

#define TRACE_IC(type, name) TraceIC(type, name)

IC::IC(FrameDepth depth, Isolate* isolate, FeedbackNexus* nexus,

bool for_queries_only)

: isolate_(isolate),

target_set_(false),

vector_set_(false),

target_maps_set_(false),

nexus_(nexus) {

// To improve the performance of the (much used) IC code, we unfold a few

// levels of the stack frame iteration code. This yields a ~35% speedup when

// running DeltaBlue and a ~25% speedup of gbemu with the '--nouse-ic' flag.

const Address entry = Isolate::c_entry_fp(isolate->thread_local_top());

Address constant_pool = NULL;

if (FLAG_enable_ool_constant_pool) {

constant_pool =

Memory::Address_at(entry + ExitFrameConstants::kConstantPoolOffset);

}

Address* pc_address =

reinterpret_cast<Address*>(entry + ExitFrameConstants::kCallerPCOffset);

Address fp = Memory::Address_at(entry + ExitFrameConstants::kCallerFPOffset);

// If there's another JavaScript frame on the stack or a

// StubFailureTrampoline, we need to look one frame further down the stack to

// find the frame pointer and the return address stack slot.

if (depth == EXTRA_CALL_FRAME) {

if (FLAG_enable_ool_constant_pool) {

constant_pool =

Memory::Address_at(fp + StandardFrameConstants::kConstantPoolOffset);

}

const int kCallerPCOffset = StandardFrameConstants::kCallerPCOffset;

pc_address = reinterpret_cast<Address*>(fp + kCallerPCOffset);

fp = Memory::Address_at(fp + StandardFrameConstants::kCallerFPOffset);

}

#ifdef DEBUG

StackFrameIterator it(isolate);

for (int i = 0; i < depth + 1; i++) it.Advance();

StackFrame* frame = it.frame();

DCHECK(fp == frame->fp() && pc_address == frame->pc_address());

#endif

fp_ = fp;

if (FLAG_enable_ool_constant_pool) {

raw_constant_pool_ = handle(

ConstantPoolArray::cast(reinterpret_cast<Object*>(constant_pool)),

isolate);

}

pc_address_ = StackFrame::ResolveReturnAddressLocation(pc_address);

target_ = handle(raw_target(), isolate);

kind_ = target_->kind();

state_ = (!for_queries_only && UseVector()) ? nexus->StateFromFeedback()

: target_->ic_state();

old_state_ = state_;

extra_ic_state_ = target_->extra_ic_state();

}

SharedFunctionInfo* IC::GetSharedFunctionInfo() const {

// Compute the JavaScript frame for the frame pointer of this IC

// structure. We need this to be able to find the function

// corresponding to the frame.

StackFrameIterator it(isolate());

while (it.frame()->fp() != this->fp()) it.Advance();

JavaScriptFrame* frame = JavaScriptFrame::cast(it.frame());

// Find the function on the stack and both the active code for the

// function and the original code.

JSFunction* function = frame->function();

return function->shared();

}

Code* IC::GetCode() const {

HandleScope scope(isolate());

Handle<SharedFunctionInfo> shared(GetSharedFunctionInfo(), isolate());

Code* code = shared->code();

return code;

}

Code* IC::GetOriginalCode() const {

HandleScope scope(isolate());

Handle<SharedFunctionInfo> shared(GetSharedFunctionInfo(), isolate());

DCHECK(Debug::HasDebugInfo(shared));

Code* original_code = Debug::GetDebugInfo(shared)->original_code();

DCHECK(original_code->IsCode());

return original_code;

}

bool IC::AddressIsOptimizedCode() const {

Code* host =

isolate()->inner_pointer_to_code_cache()->GetCacheEntry(address())->code;

return host->kind() == Code::OPTIMIZED_FUNCTION;

}

static void LookupForRead(LookupIterator* it) {

for (; it->IsFound(); it->Next()) {

switch (it->state()) {

case LookupIterator::NOT_FOUND:

case LookupIterator::TRANSITION:

UNREACHABLE();

case LookupIterator::JSPROXY:

return;

case LookupIterator::INTERCEPTOR: {

// If there is a getter, return; otherwise loop to perform the lookup.

Handle<JSObject> holder = it->GetHolder<JSObject>();

if (!holder->GetNamedInterceptor()->getter()->IsUndefined()) {

return;

}

break;

}

case LookupIterator::ACCESS_CHECK:

// PropertyHandlerCompiler::CheckPrototypes() knows how to emit

// access checks for global proxies.

if (it->GetHolder<JSObject>()->IsJSGlobalProxy() &&

it->HasAccess(v8::ACCESS_GET)) {

break;

}

return;

case LookupIterator::ACCESSOR:

case LookupIterator::DATA:

return;

}

}

}

bool IC::TryRemoveInvalidPrototypeDependentStub(Handle<Object> receiver,

Handle<String> name) {

if (!IsNameCompatibleWithPrototypeFailure(name)) return false;

Handle<Map> receiver_map = TypeToMap(*receiver_type(), isolate());

if (UseVector()) {

maybe_handler_ = nexus()->FindHandlerForMap(receiver_map);

} else {

maybe_handler_ = target()->FindHandlerForMap(*receiver_map);

}

// The current map wasn't handled yet. There's no reason to stay monomorphic,

// *unless* we're moving from a deprecated map to its replacement, or

// to a more general elements kind.

// TODO(verwaest): Check if the current map is actually what the old map

// would transition to.

if (maybe_handler_.is_null()) {

if (!receiver_map->IsJSObjectMap()) return false;

Map* first_map = FirstTargetMap();

if (first_map == NULL) return false;

Handle<Map> old_map(first_map);

if (old_map->is_deprecated()) return true;

if (IsMoreGeneralElementsKindTransition(old_map->elements_kind(),

receiver_map->elements_kind())) {

return true;

}

return false;

}

CacheHolderFlag flag;

Handle<Map> ic_holder_map(

GetICCacheHolder(*receiver_type(), isolate(), &flag));

DCHECK(flag != kCacheOnReceiver || receiver->IsJSObject());

DCHECK(flag != kCacheOnPrototype || !receiver->IsJSReceiver());

DCHECK(flag != kCacheOnPrototypeReceiverIsDictionary);

if (state() == MONOMORPHIC) {

int index = ic_holder_map->IndexInCodeCache(*name, *target());

if (index >= 0) {

ic_holder_map->RemoveFromCodeCache(*name, *target(), index);

}

}

if (receiver->IsGlobalObject()) {

Handle<GlobalObject> global = Handle<GlobalObject>::cast(receiver);

LookupIterator it(global, name, LookupIterator::OWN_SKIP_INTERCEPTOR);

if (it.state() == LookupIterator::ACCESS_CHECK) return false;

if (!it.IsFound()) return false;

Handle<PropertyCell> cell = it.GetPropertyCell();

return cell->type()->IsConstant();

}

return true;

}

bool IC::IsNameCompatibleWithPrototypeFailure(Handle<Object> name) {

if (target()->is_keyed_stub()) {

// Determine whether the failure is due to a name failure.

if (!name->IsName()) return false;

Name* stub_name =

UseVector() ? nexus()->FindFirstName() : target()->FindFirstName();

if (*name != stub_name) return false;

}

return true;

}

void IC::UpdateState(Handle<Object> receiver, Handle<Object> name) {

update_receiver_type(receiver);

if (!name->IsString()) return;

if (state() != MONOMORPHIC && state() != POLYMORPHIC) return;

if (receiver->IsUndefined() || receiver->IsNull()) return;

// Remove the target from the code cache if it became invalid

// because of changes in the prototype chain to avoid hitting it

// again.

if (TryRemoveInvalidPrototypeDependentStub(receiver,

Handle<String>::cast(name))) {

MarkPrototypeFailure(name);

return;

}

// The builtins object is special. It only changes when JavaScript

// builtins are loaded lazily. It is important to keep inline

// caches for the builtins object monomorphic. Therefore, if we get

// an inline cache miss for the builtins object after lazily loading

// JavaScript builtins, we return uninitialized as the state to

// force the inline cache back to monomorphic state.

if (receiver->IsJSBuiltinsObject()) state_ = PREMONOMORPHIC;

}

MaybeHandle<Object> IC::TypeError(const char* type, Handle<Object> object,

Handle<Object> key) {

HandleScope scope(isolate());

Handle<Object> args[2] = {key, object};

THROW_NEW_ERROR(isolate(), NewTypeError(type, HandleVector(args, 2)), Object);

}

MaybeHandle<Object> IC::ReferenceError(const char* type, Handle<Name> name) {

HandleScope scope(isolate());

THROW_NEW_ERROR(isolate(), NewReferenceError(type, HandleVector(&name, 1)),

Object);

}

static void ComputeTypeInfoCountDelta(IC::State old_state, IC::State new_state,

int* polymorphic_delta,

int* generic_delta) {

switch (old_state) {

case UNINITIALIZED:

case PREMONOMORPHIC:

if (new_state == UNINITIALIZED || new_state == PREMONOMORPHIC) break;

if (new_state == MONOMORPHIC || new_state == POLYMORPHIC) {

*polymorphic_delta = 1;

} else if (new_state == MEGAMORPHIC || new_state == GENERIC) {

*generic_delta = 1;

}

break;

case MONOMORPHIC:

case POLYMORPHIC:

if (new_state == MONOMORPHIC || new_state == POLYMORPHIC) break;

*polymorphic_delta = -1;

if (new_state == MEGAMORPHIC || new_state == GENERIC) {

*generic_delta = 1;

}

break;

case MEGAMORPHIC:

case GENERIC:

if (new_state == MEGAMORPHIC || new_state == GENERIC) break;

*generic_delta = -1;

if (new_state == MONOMORPHIC || new_state == POLYMORPHIC) {

*polymorphic_delta = 1;

}

break;

case PROTOTYPE_FAILURE:

case DEBUG_STUB:

case DEFAULT:

UNREACHABLE();

}

}

void IC::OnTypeFeedbackChanged(Isolate* isolate, Address address,

State old_state, State new_state,

bool target_remains_ic_stub) {

Code* host =

isolate->inner_pointer_to_code_cache()->GetCacheEntry(address)->code;

if (host->kind() != Code::FUNCTION) return;

if (FLAG_type_info_threshold > 0 && target_remains_ic_stub &&

// Not all Code objects have TypeFeedbackInfo.

host->type_feedback_info()->IsTypeFeedbackInfo()) {

int polymorphic_delta = 0; // "Polymorphic" here includes monomorphic.

int generic_delta = 0; // "Generic" here includes megamorphic.

ComputeTypeInfoCountDelta(old_state, new_state, &polymorphic_delta,

&generic_delta);

TypeFeedbackInfo* info = TypeFeedbackInfo::cast(host->type_feedback_info());

info->change_ic_with_type_info_count(polymorphic_delta);

info->change_ic_generic_count(generic_delta);

}

if (host->type_feedback_info()->IsTypeFeedbackInfo()) {

TypeFeedbackInfo* info = TypeFeedbackInfo::cast(host->type_feedback_info());

info->change_own_type_change_checksum();

}

host->set_profiler_ticks(0);

isolate->runtime_profiler()->NotifyICChanged();

// TODO(2029): When an optimized function is patched, it would

// be nice to propagate the corresponding type information to its

// unoptimized version for the benefit of later inlining.

}

// static

void IC::OnTypeFeedbackChanged(Isolate* isolate, Code* host,

TypeFeedbackVector* vector, State old_state,

State new_state) {

if (host->kind() != Code::FUNCTION) return;

if (FLAG_type_info_threshold > 0) {

int polymorphic_delta = 0; // "Polymorphic" here includes monomorphic.

int generic_delta = 0; // "Generic" here includes megamorphic.

ComputeTypeInfoCountDelta(old_state, new_state, &polymorphic_delta,

&generic_delta);

vector->change_ic_with_type_info_count(polymorphic_delta);

vector->change_ic_generic_count(generic_delta);

}

TypeFeedbackInfo* info = TypeFeedbackInfo::cast(host->type_feedback_info());

info->change_own_type_change_checksum();

host->set_profiler_ticks(0);

isolate->runtime_profiler()->NotifyICChanged();

// TODO(2029): When an optimized function is patched, it would

// be nice to propagate the corresponding type information to its

// unoptimized version for the benefit of later inlining.

}

void IC::PostPatching(Address address, Code* target, Code* old_target) {

// Type vector based ICs update these statistics at a different time because

// they don't always patch on state change.

if (ICUseVector(target->kind())) return;

Isolate* isolate = target->GetHeap()->isolate();

State old_state = UNINITIALIZED;

State new_state = UNINITIALIZED;

bool target_remains_ic_stub = false;

if (old_target->is_inline_cache_stub() && target->is_inline_cache_stub()) {

old_state = old_target->ic_state();

new_state = target->ic_state();

target_remains_ic_stub = true;

}

OnTypeFeedbackChanged(isolate, address, old_state, new_state,

target_remains_ic_stub);

}

void IC::Clear(Isolate* isolate, Address address,

ConstantPoolArray* constant_pool) {

Code* target = GetTargetAtAddress(address, constant_pool);

// Don't clear debug break inline cache as it will remove the break point.

if (target->is_debug_stub()) return;

switch (target->kind()) {

case Code::LOAD_IC:

if (FLAG_vector_ics) return;

return LoadIC::Clear(isolate, address, target, constant_pool);

case Code::KEYED_LOAD_IC:

if (FLAG_vector_ics) return;

return KeyedLoadIC::Clear(isolate, address, target, constant_pool);

case Code::STORE_IC:

return StoreIC::Clear(isolate, address, target, constant_pool);

case Code::KEYED_STORE_IC:

return KeyedStoreIC::Clear(isolate, address, target, constant_pool);

case Code::COMPARE_IC:

return CompareIC::Clear(isolate, address, target, constant_pool);

case Code::COMPARE_NIL_IC:

return CompareNilIC::Clear(address, target, constant_pool);

case Code::CALL_IC: // CallICs are vector-based and cleared differently.

case Code::BINARY_OP_IC:

case Code::TO_BOOLEAN_IC:

// Clearing these is tricky and does not

// make any performance difference.

return;

default:

UNREACHABLE();

}

}

void KeyedLoadIC::Clear(Isolate* isolate, Address address, Code* target,

ConstantPoolArray* constant_pool) {

DCHECK(!FLAG_vector_ics);

if (IsCleared(target)) return;

// Make sure to also clear the map used in inline fast cases. If we

// do not clear these maps, cached code can keep objects alive

// through the embedded maps.

SetTargetAtAddress(address, *pre_monomorphic_stub(isolate), constant_pool);

}

void KeyedLoadIC::Clear(Isolate* isolate, Code* host, KeyedLoadICNexus* nexus) {

if (IsCleared(nexus)) return;

// Make sure to also clear the map used in inline fast cases. If we

// do not clear these maps, cached code can keep objects alive

// through the embedded maps.

State state = nexus->StateFromFeedback();

nexus->ConfigurePremonomorphic();

OnTypeFeedbackChanged(isolate, host, nexus->vector(), state, PREMONOMORPHIC);

}

void CallIC::Clear(Isolate* isolate, Code* host, CallICNexus* nexus) {

// Determine our state.

Object* feedback = nexus->vector()->Get(nexus->slot());

State state = nexus->StateFromFeedback();

if (state != UNINITIALIZED && !feedback->IsAllocationSite()) {

nexus->ConfigureUninitialized();

// The change in state must be processed.

OnTypeFeedbackChanged(isolate, host, nexus->vector(), state, UNINITIALIZED);

}

}

void LoadIC::Clear(Isolate* isolate, Address address, Code* target,

ConstantPoolArray* constant_pool) {

DCHECK(!FLAG_vector_ics);

if (IsCleared(target)) return;

Code* code = PropertyICCompiler::FindPreMonomorphic(isolate, Code::LOAD_IC,

target->extra_ic_state());

SetTargetAtAddress(address, code, constant_pool);

}

void LoadIC::Clear(Isolate* isolate, Code* host, LoadICNexus* nexus) {

if (IsCleared(nexus)) return;

State state = nexus->StateFromFeedback();

nexus->ConfigurePremonomorphic();

OnTypeFeedbackChanged(isolate, host, nexus->vector(), state, PREMONOMORPHIC);

}

void StoreIC::Clear(Isolate* isolate, Address address, Code* target,

ConstantPoolArray* constant_pool) {

if (IsCleared(target)) return;

Code* code = PropertyICCompiler::FindPreMonomorphic(isolate, Code::STORE_IC,

target->extra_ic_state());

SetTargetAtAddress(address, code, constant_pool);

}

void KeyedStoreIC::Clear(Isolate* isolate, Address address, Code* target,

ConstantPoolArray* constant_pool) {

if (IsCleared(target)) return;

SetTargetAtAddress(

address, *pre_monomorphic_stub(

isolate, StoreIC::GetLanguageMode(target->extra_ic_state())),

constant_pool);

}

void CompareIC::Clear(Isolate* isolate, Address address, Code* target,

ConstantPoolArray* constant_pool) {

DCHECK(CodeStub::GetMajorKey(target) == CodeStub::CompareIC);

CompareICStub stub(target->stub_key(), isolate);

// Only clear CompareICs that can retain objects.

if (stub.state() != CompareICState::KNOWN_OBJECT) return;

SetTargetAtAddress(address, GetRawUninitialized(isolate, stub.op()),

constant_pool);

PatchInlinedSmiCode(address, DISABLE_INLINED_SMI_CHECK);

}

// static

Handle<Code> KeyedLoadIC::ChooseMegamorphicStub(Isolate* isolate) {

if (FLAG_compiled_keyed_generic_loads) {

return KeyedLoadGenericStub(isolate).GetCode();

} else {

return isolate->builtins()->KeyedLoadIC_Megamorphic();

}

}

static bool MigrateDeprecated(Handle<Object> object) {

if (!object->IsJSObject()) return false;

Handle<JSObject> receiver = Handle<JSObject>::cast(object);

if (!receiver->map()->is_deprecated()) return false;

JSObject::MigrateInstance(Handle<JSObject>::cast(object));

return true;

}

void IC::ConfigureVectorState(IC::State new_state) {

DCHECK(UseVector());

if (kind() == Code::LOAD_IC) {

LoadICNexus* nexus = casted_nexus<LoadICNexus>();

if (new_state == PREMONOMORPHIC) {

nexus->ConfigurePremonomorphic();

} else if (new_state == MEGAMORPHIC) {

nexus->ConfigureMegamorphic();

} else {

UNREACHABLE();

}

} else if (kind() == Code::KEYED_LOAD_IC) {

KeyedLoadICNexus* nexus = casted_nexus<KeyedLoadICNexus>();

if (new_state == PREMONOMORPHIC) {

nexus->ConfigurePremonomorphic();

} else if (new_state == MEGAMORPHIC) {

nexus->ConfigureMegamorphic();

} else {

UNREACHABLE();

}

} else {

UNREACHABLE();

}

vector_set_ = true;

OnTypeFeedbackChanged(isolate(), get_host(), *vector(), saved_state(),

new_state);

}

void IC::ConfigureVectorState(Handle<Name> name, Handle<HeapType> type,

Handle<Code> handler) {

DCHECK(UseVector());

if (kind() == Code::LOAD_IC) {

LoadICNexus* nexus = casted_nexus<LoadICNexus>();

nexus->ConfigureMonomorphic(type, handler);

} else {

DCHECK(kind() == Code::KEYED_LOAD_IC);

KeyedLoadICNexus* nexus = casted_nexus<KeyedLoadICNexus>();

nexus->ConfigureMonomorphic(name, type, handler);

}

vector_set_ = true;

OnTypeFeedbackChanged(isolate(), get_host(), *vector(), saved_state(),

MONOMORPHIC);

}

void IC::ConfigureVectorState(Handle<Name> name, TypeHandleList* types,

CodeHandleList* handlers) {

DCHECK(UseVector());

if (kind() == Code::LOAD_IC) {

LoadICNexus* nexus = casted_nexus<LoadICNexus>();

nexus->ConfigurePolymorphic(types, handlers);

} else {

DCHECK(kind() == Code::KEYED_LOAD_IC);

KeyedLoadICNexus* nexus = casted_nexus<KeyedLoadICNexus>();

nexus->ConfigurePolymorphic(name, types, handlers);

}

vector_set_ = true;

OnTypeFeedbackChanged(isolate(), get_host(), *vector(), saved_state(),

POLYMORPHIC);

}

MaybeHandle<Object> LoadIC::Load(Handle<Object> object, Handle<Name> name) {

// If the object is undefined or null it's illegal to try to get any

// of its properties; throw a TypeError in that case.

if (object->IsUndefined() || object->IsNull()) {

return TypeError("non_object_property_load", object, name);

}

// Check if the name is trivially convertible to an index and get

// the element or char if so.

uint32_t index;

if (kind() == Code::KEYED_LOAD_IC && name->AsArrayIndex(&index)) {

// Rewrite to the generic keyed load stub.

if (FLAG_use_ic) {

if (UseVector()) {

ConfigureVectorState(MEGAMORPHIC);

} else {

set_target(*megamorphic_stub());

}

TRACE_IC("LoadIC", name);

TRACE_GENERIC_IC(isolate(), "LoadIC", "name as array index");

}

Handle<Object> result;

ASSIGN_RETURN_ON_EXCEPTION(

isolate(), result,

Runtime::GetElementOrCharAt(isolate(), object, index), Object);

return result;

}

bool use_ic = MigrateDeprecated(object) ? false : FLAG_use_ic;

if (FLAG_harmony_scoping && object->IsGlobalObject() && name->IsString()) {

// Look up in script context table.

Handle<String> str_name = Handle<String>::cast(name);

Handle<GlobalObject> global = Handle<GlobalObject>::cast(object);

Handle<ScriptContextTable> script_contexts(

global->native_context()->script_context_table());

ScriptContextTable::LookupResult lookup_result;

if (ScriptContextTable::Lookup(script_contexts, str_name, &lookup_result)) {

Handle<Object> result =

FixedArray::get(ScriptContextTable::GetContext(

script_contexts, lookup_result.context_index),

lookup_result.slot_index);

if (*result == *isolate()->factory()->the_hole_value()) {

// Do not install stubs and stay pre-monomorphic for

// uninitialized accesses.

return ReferenceError("not_defined", name);

}

if (use_ic && LoadScriptContextFieldStub::Accepted(&lookup_result)) {

LoadScriptContextFieldStub stub(isolate(), &lookup_result);

PatchCache(name, stub.GetCode());

}

return result;

}

}

// Named lookup in the object.

LookupIterator it(object, name);

LookupForRead(&it);

if (it.IsFound() || !IsUndeclaredGlobal(object)) {

// Update inline cache and stub cache.

if (use_ic) UpdateCaches(&it);

// Get the property.

Handle<Object> result;

ASSIGN_RETURN_ON_EXCEPTION(isolate(), result, Object::GetProperty(&it),

Object);

if (it.IsFound()) {

return result;

} else if (!IsUndeclaredGlobal(object)) {

LOG(isolate(), SuspectReadEvent(*name, *object));

return result;

}

}

return ReferenceError("not_defined", name);

}

static bool AddOneReceiverMapIfMissing(MapHandleList* receiver_maps,

Handle<Map> new_receiver_map) {

DCHECK(!new_receiver_map.is_null());

for (int current = 0; current < receiver_maps->length(); ++current) {

if (!receiver_maps->at(current).is_null() &&

receiver_maps->at(current).is_identical_to(new_receiver_map)) {

return false;

}

}

receiver_maps->Add(new_receiver_map);

return true;

}

bool IC::UpdatePolymorphicIC(Handle<Name> name, Handle<Code> code) {

if (!code->is_handler()) return false;

if (target()->is_keyed_stub() && state() != PROTOTYPE_FAILURE) return false;

Handle<HeapType> type = receiver_type();

TypeHandleList types;

CodeHandleList handlers;

TargetTypes(&types);

int number_of_types = types.length();

int deprecated_types = 0;

int handler_to_overwrite = -1;

for (int i = 0; i < number_of_types; i++) {

Handle<HeapType> current_type = types.at(i);

if (current_type->IsClass() &&

current_type->AsClass()->Map()->is_deprecated()) {

// Filter out deprecated maps to ensure their instances get migrated.

++deprecated_types;

} else if (type->NowIs(current_type)) {

// If the receiver type is already in the polymorphic IC, this indicates

// there was a prototoype chain failure. In that case, just overwrite the

// handler.

handler_to_overwrite = i;

} else if (handler_to_overwrite == -1 && current_type->IsClass() &&

type->IsClass() &&

IsTransitionOfMonomorphicTarget(*current_type->AsClass()->Map(),

*type->AsClass()->Map())) {

handler_to_overwrite = i;

}

}

int number_of_valid_types =

number_of_types - deprecated_types - (handler_to_overwrite != -1);

if (number_of_valid_types >= 4) return false;

if (number_of_types == 0 && state() != MONOMORPHIC &&

state() != POLYMORPHIC) {

return false;

}

if (UseVector()) {

if (!nexus()->FindHandlers(&handlers, types.length())) return false;

} else {

if (!target()->FindHandlers(&handlers, types.length())) return false;

}

number_of_valid_types++;

if (number_of_valid_types > 1 && target()->is_keyed_stub()) return false;

Handle<Code> ic;

if (number_of_valid_types == 1) {

if (UseVector()) {

ConfigureVectorState(name, receiver_type(), code);

} else {

ic = PropertyICCompiler::ComputeMonomorphic(kind(), name, type, code,

extra_ic_state());

}

} else {

if (handler_to_overwrite >= 0) {

handlers.Set(handler_to_overwrite, code);

if (!type->NowIs(types.at(handler_to_overwrite))) {

types.Set(handler_to_overwrite, type);

}

} else {

types.Add(type);

handlers.Add(code);

}

if (UseVector()) {

ConfigureVectorState(name, &types, &handlers);

} else {

ic = PropertyICCompiler::ComputePolymorphic(kind(), &types, &handlers,

number_of_valid_types, name,

extra_ic_state());

}

}

if (!UseVector()) set_target(*ic);

return true;

}

Handle<HeapType> IC::CurrentTypeOf(Handle<Object> object, Isolate* isolate) {

return object->IsJSGlobalObject()

? HeapType::Constant(Handle<JSGlobalObject>::cast(object), isolate)

: HeapType::NowOf(object, isolate);

}

Handle<Map> IC::TypeToMap(HeapType* type, Isolate* isolate) {

if (type->Is(HeapType::Number()))

return isolate->factory()->heap_number_map();

if (type->Is(HeapType::Boolean())) return isolate->factory()->boolean_map();

if (type->IsConstant()) {

return handle(

Handle<JSGlobalObject>::cast(type->AsConstant()->Value())->map());

}

DCHECK(type->IsClass());

return type->AsClass()->Map();

}

template <class T>

typename T::TypeHandle IC::MapToType(Handle<Map> map,

typename T::Region* region) {

if (map->instance_type() == HEAP_NUMBER_TYPE) {

return T::Number(region);

} else if (map->instance_type() == ODDBALL_TYPE) {

// The only oddballs that can be recorded in ICs are booleans.

return T::Boolean(region);

} else {

return T::Class(map, region);

}

}

template Type* IC::MapToType<Type>(Handle<Map> map, Zone* zone);

template Handle<HeapType> IC::MapToType<HeapType>(Handle<Map> map,

Isolate* region);

void IC::UpdateMonomorphicIC(Handle<Code> handler, Handle<Name> name) {

DCHECK(handler->is_handler());

if (UseVector()) {

ConfigureVectorState(name, receiver_type(), handler);

} else {

Handle<Code> ic = PropertyICCompiler::ComputeMonomorphic(

kind(), name, receiver_type(), handler, extra_ic_state());

set_target(*ic);

}

}

void IC::CopyICToMegamorphicCache(Handle<Name> name) {

TypeHandleList types;

CodeHandleList handlers;

TargetTypes(&types);

if (!target()->FindHandlers(&handlers, types.length())) return;

for (int i = 0; i < types.length(); i++) {

UpdateMegamorphicCache(*types.at(i), *name, *handlers.at(i));

}

}

bool IC::IsTransitionOfMonomorphicTarget(Map* source_map, Map* target_map) {

if (source_map == NULL) return true;

if (target_map == NULL) return false;

ElementsKind target_elements_kind = target_map->elements_kind();

bool more_general_transition = IsMoreGeneralElementsKindTransition(

source_map->elements_kind(), target_elements_kind);

Map* transitioned_map =

more_general_transition

? source_map->LookupElementsTransitionMap(target_elements_kind)

: NULL;

return transitioned_map == target_map;

}

void IC::PatchCache(Handle<Name> name, Handle<Code> code) {

switch (state()) {

case UNINITIALIZED:

case PREMONOMORPHIC:

UpdateMonomorphicIC(code, name);

break;

case PROTOTYPE_FAILURE:

case MONOMORPHIC:

case POLYMORPHIC:

if (!target()->is_keyed_stub() || state() == PROTOTYPE_FAILURE) {

if (UpdatePolymorphicIC(name, code)) break;

// For keyed stubs, we can't know whether old handlers were for the

// same key.

CopyICToMegamorphicCache(name);

}

if (UseVector()) {

ConfigureVectorState(MEGAMORPHIC);

} else {

set_target(*megamorphic_stub());

}

// Fall through.

case MEGAMORPHIC:

UpdateMegamorphicCache(*receiver_type(), *name, *code);

// Indicate that we've handled this case.

if (UseVector()) {

vector_set_ = true;

} else {

target_set_ = true;

}

break;

case DEBUG_STUB:

break;

case DEFAULT:

case GENERIC:

UNREACHABLE();

break;

}

}

Handle<Code> LoadIC::initialize_stub(Isolate* isolate,

ExtraICState extra_state) {

if (FLAG_vector_ics) {

return LoadICTrampolineStub(isolate, LoadICState(extra_state)).GetCode();

}

return PropertyICCompiler::ComputeLoad(isolate, UNINITIALIZED, extra_state);

}

Handle<Code> LoadIC::initialize_stub_in_optimized_code(

Isolate* isolate, ExtraICState extra_state) {

if (FLAG_vector_ics) {

return VectorLoadStub(isolate, LoadICState(extra_state)).GetCode();

}

return initialize_stub(isolate, extra_state);

}