Avoid duplication of a hidden & inherited prototype's properties.

src/runtime.cc

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 5708 matching lines @@
       GetKeysInFixedArrayFor(object, INCLUDE_PROTOS, &threw);
   if (threw) return Failure::Exception();
 
   // Test again, since cache may have been built by preceding call.
   if (object->IsSimpleEnum()) return object->map();
 
   return *content;
 }
 
 
+// Returns true if inherited accessors have been copied down
+// to obj from proto's function template.
+static bool IsInheritedApiFunctionOf(JSObject *obj, Object *proto) {
+  Object *constructor = HeapObject::cast(proto)->map()->constructor();

[rossberg, 2013/12/20 12:54:54]

Note that .constructor is a mutable property, so I'm not sure this test is
actually correct.

+  if (!constructor->IsJSFunction()) return false;
+  JSFunction *constructor_fun = JSFunction::cast(constructor);
+  if (!constructor_fun->shared()->IsApiFunction()) return false;
+  return constructor_fun->shared()
+      ->get_api_func_data()->IsTemplateFor(obj);
+}
+
+
 // Find the length of the prototype chain that is to to handled as one. If a
 // prototype object is hidden it is to be viewed as part of the the object it
 // is prototype for.
 static int LocalPrototypeChainLength(JSObject* obj) {
   int count = 1;
   Object* proto = obj->GetPrototype();
   while (proto->IsJSObject() &&
-         JSObject::cast(proto)->map()->is_hidden_prototype()) {
+         JSObject::cast(proto)->map()->is_hidden_prototype() &&
+         !IsInheritedApiFunctionOf(obj, proto)) {

[dcarney, 2013/12/19 19:46:12]

filtering here is problematic as there could be properties higher up the chain
that should be included or even properties set on this proto that should be
included

you need to do the full chain walk here and filter correctly in
Runtime_GetLocalPropertyNames by not inserting duplicate names into the list. 
It'll be expensive, but you only need to pay the cost for objects with hidden
prototype links, which are rare.

[sof, 2013/12/22 08:39:55]

Thanks, the initial version wasn't general enough nor complete. As you suggest,
I've switched to explicitly removing duplicates instead.

Spotting those dupes isn't without cost, but if we assume them being rare,
perhaps acceptable?

     count++;
     proto = JSObject::cast(proto)->GetPrototype();
   }
   return count;
 }
 
 
 // Return the names of the local named properties.
 // args[0]: object
 RUNTIME_FUNCTION(MaybeObject*, Runtime_GetLocalPropertyNames) {
@@ skipping 9156 matching lines @@
     // Handle last resort GC and make sure to allow future allocations
     // to grow the heap without causing GCs (if possible).
     isolate->counters()->gc_last_resort_from_js()->Increment();
     isolate->heap()->CollectAllGarbage(Heap::kNoGCFlags,
                                        "Runtime::PerformGC");
   }
 }
 
 
 } }  // namespace v8::internal