Use GetProperty for getting elements.

src/objects-inl.h

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 //
 // Review notes:
 //
 // - The use of macros in these inline functions may seem superfluous
 // but it is absolutely needed to make sure gcc generates optimal
 // code. gcc is not happy when attempting to inline too deep.
 //
@@ skipping 1150 matching lines @@
 MaybeHandle<Object> Object::GetProperty(Handle<Object> object,
                                         Handle<Name> name) {
   LookupIterator it(object, name);
   return GetProperty(&it);
 }
 
 
 MaybeHandle<Object> Object::GetElement(Isolate* isolate,
                                        Handle<Object> object,
                                        uint32_t index) {
-  // GetElement can trigger a getter which can cause allocation.
-  // This was not always the case. This DCHECK is here to catch
-  // leftover incorrect uses.
-  DCHECK(AllowHeapAllocation::IsAllowed());
-  return Object::GetElementWithReceiver(isolate, object, object, index);
+  LookupIterator it(isolate, object, index);
+  return GetProperty(&it);
 }
 
 
 Handle<Object> Object::GetPrototypeSkipHiddenPrototypes(
     Isolate* isolate, Handle<Object> receiver) {
   PrototypeIterator iter(isolate, receiver);
   while (!iter.IsAtEnd(PrototypeIterator::END_AT_NON_HIDDEN)) {
     if (PrototypeIterator::GetCurrent(iter)->IsJSProxy()) {
       return PrototypeIterator::GetCurrent(iter);
     }
@@ skipping 18 matching lines @@
   Handle<String> str = isolate->factory()->InternalizeUtf8String(name);
   DCHECK(!str.is_null());
 #ifdef DEBUG
   uint32_t index;  // Assert that the name is not an array index.
   DCHECK(!str->AsArrayIndex(&index));
 #endif  // DEBUG
   return GetProperty(object, str);
 }
 
 
-MaybeHandle<Object> JSProxy::GetElementWithHandler(Handle<JSProxy> proxy,
-                                                   Handle<Object> receiver,
-                                                   uint32_t index) {
-  return GetPropertyWithHandler(
-      proxy, receiver, proxy->GetIsolate()->factory()->Uint32ToString(index));
-}
-
-
 MaybeHandle<Object> JSProxy::SetElementWithHandler(Handle<JSProxy> proxy,
                                                    Handle<JSReceiver> receiver,
                                                    uint32_t index,
                                                    Handle<Object> value,
                                                    LanguageMode language_mode) {
   Isolate* isolate = proxy->GetIsolate();
   Handle<String> name = isolate->factory()->Uint32ToString(index);
   return SetPropertyWithHandler(proxy, receiver, name, value, language_mode);
 }
 
@@ skipping 986 matching lines @@
 
 
 void Struct::InitializeBody(int object_size) {
   Object* value = GetHeap()->undefined_value();
   for (int offset = kHeaderSize; offset < object_size; offset += kPointerSize) {
     WRITE_FIELD(this, offset, value);
   }
 }
 
 
-bool Object::ToArrayIndex(uint32_t* index) {
+bool Object::ToArrayLength(uint32_t* index) {
   if (IsSmi()) {
     int value = Smi::cast(this)->value();
     if (value < 0) return false;
     *index = value;
     return true;
   }
   if (IsHeapNumber()) {
     double value = HeapNumber::cast(this)->value();
     uint32_t uint_value = static_cast<uint32_t>(value);
     if (value == static_cast<double>(uint_value)) {
       *index = uint_value;
       return true;
     }
   }
   return false;
 }
 
 
+bool Object::ToArrayIndex(uint32_t* index) {
+  return ToArrayLength(index) && *index != kMaxUInt32;
+}
+
+
 bool Object::IsStringObjectWithCharacterAt(uint32_t index) {
   if (!this->IsJSValue()) return false;
 
   JSValue* js_value = JSValue::cast(this);
   if (!js_value->value()->IsString()) return false;
 
   String* str = String::cast(js_value->value());
   if (index >= static_cast<uint32_t>(str->length())) return false;
 
   return true;
@@ skipping 4261 matching lines @@
   return JSArrayBuffer::cast(buffer())->was_neutered();
 }
 
 
 Object* JSTypedArray::length() const {
   if (WasNeutered()) return Smi::FromInt(0);
   return Object::cast(READ_FIELD(this, kLengthOffset));
 }
 
 
+uint32_t JSTypedArray::length_value() const {
+  if (WasNeutered()) return 0;
+  uint32_t index;
+  CHECK(Object::cast(READ_FIELD(this, kLengthOffset))->ToArrayIndex(&index));

[Igor Sheludko, 2015/05/26 17:11:56]

ToArrayLength()?

+  return index;
+}
+
+
 void JSTypedArray::set_length(Object* value, WriteBarrierMode mode) {
   WRITE_FIELD(this, kLengthOffset, value);
   CONDITIONAL_WRITE_BARRIER(GetHeap(), this, kLengthOffset, value, mode);
 }
 
 
 #ifdef VERIFY_HEAP
 ACCESSORS(JSTypedArray, raw_length, Object, kLengthOffset)
 #endif
 
@@ skipping 283 matching lines @@
     return false;
   }
   int d = c - '0';
   if (is_first_char_) {
     is_first_char_ = false;
     if (c == '0' && length_ > 1) {
       is_array_index_ = false;
       return false;
     }
   }
-  if (array_index_ > 429496729U - ((d + 2) >> 3)) {
+  if (array_index_ > 429496729U - ((d + 3) >> 3)) {
     is_array_index_ = false;
     return false;
   }
   array_index_ = array_index_ * 10 + d;
   return true;
 }
 
 
 template<typename Char>
 inline void StringHasher::AddCharacters(const Char* chars, int length) {
@@ skipping 784 matching lines @@
 #undef READ_SHORT_FIELD
 #undef WRITE_SHORT_FIELD
 #undef READ_BYTE_FIELD
 #undef WRITE_BYTE_FIELD
 #undef NOBARRIER_READ_BYTE_FIELD
 #undef NOBARRIER_WRITE_BYTE_FIELD
 
 } }  // namespace v8::internal
 
 #endif  // V8_OBJECTS_INL_H_