Handle changes to the Object prototype in fast handling of arrays

src/builtins.cc

Index: src/builtins.cc
diff --git a/src/builtins.cc b/src/builtins.cc
index c398aa30fbbd4142324453e5ee56b1dd2da37aa5..3f78283388c8671048b1e1c60f3ddb7ff007a1e4 100644
--- a/src/builtins.cc
+++ b/src/builtins.cc
@@ -378,8 +378,7 @@ static bool ArrayPrototypeHasNoElements(Heap* heap,
   array_proto = JSObject::cast(proto);
   if (array_proto != global_context->initial_object_prototype()) return false;

[antonm, 2011/05/24 10:38:20]

while you're here, may you swap these two lines?  I am concerned with the
following case: Array.prototype.__proto__ = 2;

[Søren Thygesen Gjesse, 2011/05/24 12:25:52]

Not sure which two lines you mean. Also

  Array.prototype.__proto__ = 2

does not have any effect.

[antonm, 2011/05/24 12:33:59]

Sorry, I mean JSObject::cast and != global_context->initial_object_prototype()
check.  But if don't allow anything except for null and JSObject as a prototype
value, then it's not mandatory.

On 2011/05/24 12:25:52, Søren Gjesse wrote:

   if (array_proto->elements() != heap->empty_fixed_array()) return false;
-  ASSERT(array_proto->GetPrototype()->IsNull());
-  return true;
+  return array_proto->GetPrototype()->IsNull();
 }