Handle changes to the Object prototype in fast handling of arrays

src/builtins.cc

 // Copyright 2011 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 348 matching lines @@
   former_start[to_trim + 1] = Smi::FromInt(len - to_trim);
 
   return FixedArray::cast(HeapObject::FromAddress(
       elms->address() + to_trim * kPointerSize));
 }
 
 
 static bool ArrayPrototypeHasNoElements(Heap* heap,
                                         Context* global_context,
                                         JSObject* array_proto) {
   // This method depends on non writability of Object and Array prototype

[antonm, 2011/05/24 10:38:20]

Sigh, but this comment should now go away.  I wonder why I thought that way,
probably it's ECMAScript 5 which doesn't allow to play with protos.  And we
cannot make them not-writable for bug-compatibility I gather :(

[Søren Thygesen Gjesse, 2011/05/24 12:25:52]

Done.

   // fields.
   if (array_proto->elements() != heap->empty_fixed_array()) return false;
   // Hidden prototype
   array_proto = JSObject::cast(array_proto->GetPrototype());
   ASSERT(array_proto->elements() == heap->empty_fixed_array());
   // Object.prototype
   Object* proto = array_proto->GetPrototype();
   if (proto == heap->null_value()) return false;
   array_proto = JSObject::cast(proto);
   if (array_proto != global_context->initial_object_prototype()) return false;

[antonm, 2011/05/24 10:38:20]

while you're here, may you swap these two lines?  I am concerned with the
following case: Array.prototype.__proto__ = 2;

[Søren Thygesen Gjesse, 2011/05/24 12:25:52]

Not sure which two lines you mean. Also

  Array.prototype.__proto__ = 2

does not have any effect.

[antonm, 2011/05/24 12:33:59]

Sorry, I mean JSObject::cast and != global_context->initial_object_prototype()
check.  But if don't allow anything except for null and JSObject as a prototype
value, then it's not mandatory.

On 2011/05/24 12:25:52, Søren Gjesse wrote:

   if (array_proto->elements() != heap->empty_fixed_array()) return false;
-  ASSERT(array_proto->GetPrototype()->IsNull());
-  return true;
+  return array_proto->GetPrototype()->IsNull();
 }
 
 
 MUST_USE_RESULT
 static inline MaybeObject* EnsureJSArrayWithWritableFastElements(
     Heap* heap, Object* receiver) {
   if (!receiver->IsJSArray()) return NULL;
   JSArray* array = JSArray::cast(receiver);
   HeapObject* elms = array->elements();
   if (elms->map() == heap->fixed_array_map()) return elms;
@@ skipping 1328 matching lines @@
   return Handle<Code>(code_address);                        \
 }
 BUILTIN_LIST_C(DEFINE_BUILTIN_ACCESSOR_C)
 BUILTIN_LIST_A(DEFINE_BUILTIN_ACCESSOR_A)
 BUILTIN_LIST_DEBUG_A(DEFINE_BUILTIN_ACCESSOR_A)
 #undef DEFINE_BUILTIN_ACCESSOR_C
 #undef DEFINE_BUILTIN_ACCESSOR_A
 
 
 } }  // namespace v8::internal