Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(248)

Unified Diff: src/builtins.cc

Issue 1052253003: Revert of Revert of Protect the emptiness of Array prototype elements with a PropertyCell. (Closed) Base URL: https://chromium.googlesource.com/v8/v8.git@master
Patch Set: Created 5 years, 8 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View side-by-side diff with in-line comments
Download patch
« no previous file with comments | « no previous file | src/compilation-dependencies.h » ('j') | no next file with comments »
Expand Comments ('e') | Collapse Comments ('c') | Show Comments Hide Comments ('s')
Index: src/builtins.cc
diff --git a/src/builtins.cc b/src/builtins.cc
index 3c3c7dda1196e095594936a4a71ed4eb21b4f186..5b1eeed15403b945cea5a5d6cf495e16cd5d12c9 100644
--- a/src/builtins.cc
+++ b/src/builtins.cc
@@ -199,7 +199,21 @@
static inline bool IsJSArrayFastElementMovingAllowed(Heap* heap,
JSArray* receiver) {
DisallowHeapAllocation no_gc;
- PrototypeIterator iter(heap->isolate(), receiver);
+ Isolate* isolate = heap->isolate();
+ if (!isolate->IsFastArrayConstructorPrototypeChainIntact()) {
+ return false;
+ }
+
+ // If the array prototype chain is intact (and free of elements), and if the
+ // receiver's prototype is the array prototype, then we are done.
+ Object* prototype = receiver->map()->prototype();
+ if (prototype->IsJSArray() &&
+ isolate->is_initial_array_prototype(JSArray::cast(prototype))) {
+ return true;
+ }
+
+ // Slow case.
+ PrototypeIterator iter(isolate, receiver);
return ArrayPrototypeHasNoElements(heap, &iter);
}
@@ -236,7 +250,7 @@
// Adding elements to the array prototype would break code that makes sure
// it has no elements. Handle that elsewhere.
- if (array->GetIsolate()->is_initial_array_prototype(*array)) {
+ if (isolate->IsAnyInitialArrayPrototype(array)) {
return MaybeHandle<FixedArrayBase>();
}
« no previous file with comments | « no previous file | src/compilation-dependencies.h » ('j') | no next file with comments »

Powered by Google App Engine
This is Rietveld 408576698