diff options
Diffstat (limited to 'deps/v8/src/ic/x64/handler-compiler-x64.cc')
-rw-r--r-- | deps/v8/src/ic/x64/handler-compiler-x64.cc | 40 |
1 files changed, 19 insertions, 21 deletions
diff --git a/deps/v8/src/ic/x64/handler-compiler-x64.cc b/deps/v8/src/ic/x64/handler-compiler-x64.cc index 485d87dc57..b6add9d2bc 100644 --- a/deps/v8/src/ic/x64/handler-compiler-x64.cc +++ b/deps/v8/src/ic/x64/handler-compiler-x64.cc @@ -209,7 +209,8 @@ void PropertyHandlerCompiler::GenerateCheckPropertyCell( Factory* factory = masm->isolate()->factory(); Handle<WeakCell> weak_cell = factory->NewWeakCell(cell); __ LoadWeakValue(scratch, weak_cell, miss); - __ Cmp(FieldOperand(scratch, Cell::kValueOffset), factory->the_hole_value()); + __ Cmp(FieldOperand(scratch, PropertyCell::kValueOffset), + factory->the_hole_value()); __ j(not_equal, miss); } @@ -431,6 +432,17 @@ Register PropertyHandlerCompiler::CheckPrototypes( if (receiver_map->IsJSGlobalObjectMap()) { current = isolate()->global_object(); } + + // Check access rights to the global object. This has to happen after + // the map check so that we know that the object is actually a global + // object. + // This allows us to install generated handlers for accesses to the + // global proxy (as opposed to using slow ICs). See corresponding code + // in LookupForRead(). + if (receiver_map->IsJSGlobalProxyMap()) { + __ CheckAccessGlobalProxy(reg, scratch2, miss); + } + Handle<JSObject> prototype = Handle<JSObject>::null(); Handle<Map> current_map = receiver_map; Handle<Map> holder_map(holder()->map()); @@ -466,24 +478,15 @@ Register PropertyHandlerCompiler::CheckPrototypes( Register map_reg = scratch1; __ movp(map_reg, FieldOperand(reg, HeapObject::kMapOffset)); - if (depth != 1 || check == CHECK_ALL_MAPS) { + if (current_map->IsJSGlobalObjectMap()) { + GenerateCheckPropertyCell(masm(), Handle<JSGlobalObject>::cast(current), + name, scratch2, miss); + } else if (depth != 1 || check == CHECK_ALL_MAPS) { Handle<WeakCell> cell = Map::WeakCellForMap(current_map); __ CmpWeakValue(map_reg, cell, scratch2); __ j(not_equal, miss); } - // Check access rights to the global object. This has to happen after - // the map check so that we know that the object is actually a global - // object. - // This allows us to install generated handlers for accesses to the - // global proxy (as opposed to using slow ICs). See corresponding code - // in LookupForRead(). - if (current_map->IsJSGlobalProxyMap()) { - __ CheckAccessGlobalProxy(reg, scratch2, miss); - } else if (current_map->IsJSGlobalObjectMap()) { - GenerateCheckPropertyCell(masm(), Handle<JSGlobalObject>::cast(current), - name, scratch2, miss); - } reg = holder_reg; // From now on the object will be in holder_reg. __ movp(reg, FieldOperand(map_reg, Map::kPrototypeOffset)); @@ -494,6 +497,8 @@ Register PropertyHandlerCompiler::CheckPrototypes( current_map = handle(current->map()); } + DCHECK(!current_map->IsJSGlobalProxyMap()); + // Log the check depth. LOG(isolate(), IntEvent("check-maps-depth", depth + 1)); @@ -504,13 +509,6 @@ Register PropertyHandlerCompiler::CheckPrototypes( __ j(not_equal, miss); } - // Perform security check for access to the global object. - DCHECK(current_map->IsJSGlobalProxyMap() || - !current_map->is_access_check_needed()); - if (current_map->IsJSGlobalProxyMap()) { - __ CheckAccessGlobalProxy(reg, scratch1, miss); - } - // Return the register containing the holder. return reg; } |