Index: src/bootstrapper.cc |
diff --git a/src/bootstrapper.cc b/src/bootstrapper.cc |
index f07e625ec01956ede51834e8616a1e4160e70c84..8c03dd1056829f6c27360a376bf1ad8121e5aa6a 100644 |
--- a/src/bootstrapper.cc |
+++ b/src/bootstrapper.cc |
@@ -1076,6 +1076,11 @@ void Genesis::InitializeGlobal(Handle<GlobalObject> inner_global, |
elements->set(0, *array); |
array = factory->NewFixedArray(0); |
elements->set(1, *array); |
+ Handle<Map> non_strict_arguments_elements_map = |
+ factory->GetElementsTransitionMap(result, |
+ NON_STRICT_ARGUMENTS_ELEMENTS); |
+ result->set_map(*non_strict_arguments_elements_map); |
+ ASSERT(result->HasNonStrictArgumentsElements()); |
result->set_elements(*elements); |
global_context()->set_aliased_arguments_boilerplate(*result); |
} |
@@ -1555,6 +1560,18 @@ bool Genesis::InstallNatives() { |
isolate()->builtins()->builtin(Builtins::kArrayConstructCode)); |
array_function->shared()->DontAdaptArguments(); |
+ // InternalArrays should not use Smi-Only array optimizations. There are too |
+ // many places in the C++ runtime code (e.g. RegEx) that assume that |
+ // elements in InternalArrays can be set to Objects* without going through a |
+ // bottleneck that would make the SMI_ONLY -> FAST_ELEMENT transition easy |
+ // to trap. Moreover, they rarely are only smi-only. |
+ MaybeObject* maybe_map = |
+ array_function->initial_map()->CopyDropTransitions(); |
+ Map* new_map; |
+ if (!maybe_map->To<Map>(&new_map)) return maybe_map; |
+ new_map->set_elements_kind(FAST_ELEMENTS); |
+ array_function->set_initial_map(new_map); |
+ |
// Make "length" magic on instances. |
Handle<DescriptorArray> array_descriptors = |
factory()->CopyAppendForeignDescriptor( |