OLD | NEW |
1 // Copyright 2013 the V8 project authors. All rights reserved. | 1 // Copyright 2013 the V8 project authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include "src/hydrogen.h" | 5 #include "src/hydrogen.h" |
6 | 6 |
7 #include <sstream> | 7 #include <sstream> |
8 | 8 |
9 #include "src/v8.h" | 9 #include "src/v8.h" |
10 | 10 |
(...skipping 8433 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
8444 // inlined version can't be used. | 8444 // inlined version can't be used. |
8445 if (receiver_map->DictionaryElementsInPrototypeChainOnly()) return false; | 8445 if (receiver_map->DictionaryElementsInPrototypeChainOnly()) return false; |
8446 // If there currently can be no elements accessors on the prototype chain, | 8446 // If there currently can be no elements accessors on the prototype chain, |
8447 // it doesn't mean that there won't be any later. Install a full prototype | 8447 // it doesn't mean that there won't be any later. Install a full prototype |
8448 // chain check to trap element accessors being installed on the prototype | 8448 // chain check to trap element accessors being installed on the prototype |
8449 // chain, which would cause elements to go to dictionary mode and result | 8449 // chain, which would cause elements to go to dictionary mode and result |
8450 // in a map change. | 8450 // in a map change. |
8451 Handle<JSObject> prototype(JSObject::cast(receiver_map->prototype())); | 8451 Handle<JSObject> prototype(JSObject::cast(receiver_map->prototype())); |
8452 BuildCheckPrototypeMaps(prototype, Handle<JSObject>()); | 8452 BuildCheckPrototypeMaps(prototype, Handle<JSObject>()); |
8453 | 8453 |
| 8454 // Protect against adding elements to the Array prototype, which needs to |
| 8455 // route through appropriate bottlenecks. |
| 8456 if (isolate()->IsFastArrayConstructorPrototypeChainIntact() && |
| 8457 !prototype->IsJSArray()) { |
| 8458 return false; |
| 8459 } |
| 8460 |
8454 const int argc = args_count_no_receiver; | 8461 const int argc = args_count_no_receiver; |
8455 if (argc != 1) return false; | 8462 if (argc != 1) return false; |
8456 | 8463 |
8457 HValue* value_to_push = Pop(); | 8464 HValue* value_to_push = Pop(); |
8458 HValue* array = Pop(); | 8465 HValue* array = Pop(); |
8459 Drop(1); // Drop function. | 8466 Drop(1); // Drop function. |
8460 | 8467 |
8461 HInstruction* new_size = NULL; | 8468 HInstruction* new_size = NULL; |
8462 HValue* length = NULL; | 8469 HValue* length = NULL; |
8463 | 8470 |
(...skipping 4501 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
12965 if (ShouldProduceTraceOutput()) { | 12972 if (ShouldProduceTraceOutput()) { |
12966 isolate()->GetHTracer()->TraceHydrogen(name(), graph_); | 12973 isolate()->GetHTracer()->TraceHydrogen(name(), graph_); |
12967 } | 12974 } |
12968 | 12975 |
12969 #ifdef DEBUG | 12976 #ifdef DEBUG |
12970 graph_->Verify(false); // No full verify. | 12977 graph_->Verify(false); // No full verify. |
12971 #endif | 12978 #endif |
12972 } | 12979 } |
12973 | 12980 |
12974 } } // namespace v8::internal | 12981 } } // namespace v8::internal |
OLD | NEW |