Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(2)

Side by Side Diff: src/runtime/runtime-object.cc

Issue 1189153002: Revert of [strong] Implement strong mode restrictions on property access (Closed) Base URL: https://chromium.googlesource.com/v8/v8.git@master
Patch Set: Created 5 years, 6 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View unified diff | Download patch
« no previous file with comments | « src/runtime/runtime-debug.cc ('k') | src/x64/code-stubs-x64.cc » ('j') | no next file with comments »
Toggle Intra-line Diffs ('i') | Expand Comments ('e') | Collapse Comments ('c') | Show Comments Hide Comments ('s')
OLDNEW
1 // Copyright 2014 the V8 project authors. All rights reserved. 1 // Copyright 2014 the V8 project authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style license that can be 2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file. 3 // found in the LICENSE file.
4 4
5 #include "src/v8.h" 5 #include "src/v8.h"
6 6
7 #include "src/arguments.h" 7 #include "src/arguments.h"
8 #include "src/bootstrapper.h" 8 #include "src/bootstrapper.h"
9 #include "src/debug.h" 9 #include "src/debug.h"
10 #include "src/messages.h" 10 #include "src/messages.h"
11 #include "src/runtime/runtime.h" 11 #include "src/runtime/runtime.h"
12 #include "src/runtime/runtime-utils.h" 12 #include "src/runtime/runtime-utils.h"
13 13
14 namespace v8 { 14 namespace v8 {
15 namespace internal { 15 namespace internal {
16 16
17 // Returns a single character string where first character equals 17 // Returns a single character string where first character equals
18 // string->Get(index). 18 // string->Get(index).
19 static Handle<Object> GetCharAt(Handle<String> string, uint32_t index) { 19 static Handle<Object> GetCharAt(Handle<String> string, uint32_t index) {
20 DCHECK_LT(index, static_cast<uint32_t>(string->length())); 20 DCHECK_LT(index, static_cast<uint32_t>(string->length()));
21 Factory* factory = string->GetIsolate()->factory(); 21 Factory* factory = string->GetIsolate()->factory();
22 return factory->LookupSingleCharacterStringFromCode( 22 return factory->LookupSingleCharacterStringFromCode(
23 String::Flatten(string)->Get(index)); 23 String::Flatten(string)->Get(index));
24 } 24 }
25 25
26 26
27 MaybeHandle<Object> Runtime::GetElementOrCharAt(Isolate* isolate, 27 MaybeHandle<Object> Runtime::GetElementOrCharAt(Isolate* isolate,
28 Handle<Object> object, 28 Handle<Object> object,
29 uint32_t index, 29 uint32_t index) {
30 LanguageMode language_mode) {
31 // Handle [] indexing on Strings 30 // Handle [] indexing on Strings
32 if (object->IsString() && 31 if (object->IsString() &&
33 index < static_cast<uint32_t>(String::cast(*object)->length())) { 32 index < static_cast<uint32_t>(String::cast(*object)->length())) {
34 Handle<Object> result = GetCharAt(Handle<String>::cast(object), index); 33 Handle<Object> result = GetCharAt(Handle<String>::cast(object), index);
35 if (!result->IsUndefined()) return result; 34 if (!result->IsUndefined()) return result;
36 } 35 }
37 36
38 return Object::GetElement(isolate, object, index, language_mode); 37 return Object::GetElement(isolate, object, index);
39 } 38 }
40 39
41 40
42 MaybeHandle<Name> Runtime::ToName(Isolate* isolate, Handle<Object> key) { 41 MaybeHandle<Name> Runtime::ToName(Isolate* isolate, Handle<Object> key) {
43 if (key->IsName()) { 42 if (key->IsName()) {
44 return Handle<Name>::cast(key); 43 return Handle<Name>::cast(key);
45 } else { 44 } else {
46 Handle<Object> converted; 45 Handle<Object> converted;
47 ASSIGN_RETURN_ON_EXCEPTION(isolate, converted, 46 ASSIGN_RETURN_ON_EXCEPTION(isolate, converted,
48 Execution::ToString(isolate, key), Name); 47 Execution::ToString(isolate, key), Name);
49 return Handle<Name>::cast(converted); 48 return Handle<Name>::cast(converted);
50 } 49 }
51 } 50 }
52 51
53 52
54 MaybeHandle<Object> Runtime::GetObjectProperty(Isolate* isolate, 53 MaybeHandle<Object> Runtime::GetObjectProperty(Isolate* isolate,
55 Handle<Object> object, 54 Handle<Object> object,
56 Handle<Object> key, 55 Handle<Object> key) {
57 LanguageMode language_mode) {
58 if (object->IsUndefined() || object->IsNull()) { 56 if (object->IsUndefined() || object->IsNull()) {
59 THROW_NEW_ERROR( 57 THROW_NEW_ERROR(
60 isolate, 58 isolate,
61 NewTypeError(MessageTemplate::kNonObjectPropertyLoad, key, object), 59 NewTypeError(MessageTemplate::kNonObjectPropertyLoad, key, object),
62 Object); 60 Object);
63 } 61 }
64 62
65 // Check if the given key is an array index. 63 // Check if the given key is an array index.
66 uint32_t index = 0; 64 uint32_t index = 0;
67 if (key->ToArrayIndex(&index)) { 65 if (key->ToArrayIndex(&index)) {
68 return GetElementOrCharAt(isolate, object, index, language_mode); 66 return GetElementOrCharAt(isolate, object, index);
69 } 67 }
70 68
71 // Convert the key to a name - possibly by calling back into JavaScript. 69 // Convert the key to a name - possibly by calling back into JavaScript.
72 Handle<Name> name; 70 Handle<Name> name;
73 ASSIGN_RETURN_ON_EXCEPTION(isolate, name, ToName(isolate, key), Object); 71 ASSIGN_RETURN_ON_EXCEPTION(isolate, name, ToName(isolate, key), Object);
74 72
75 // Check if the name is trivially convertible to an index and get 73 // Check if the name is trivially convertible to an index and get
76 // the element if so. 74 // the element if so.
77 // TODO(verwaest): Make sure GetProperty(LookupIterator*) can handle this, and 75 // TODO(verwaest): Make sure GetProperty(LookupIterator*) can handle this, and
78 // remove the special casing here. 76 // remove the special casing here.
79 if (name->AsArrayIndex(&index)) { 77 if (name->AsArrayIndex(&index)) {
80 return GetElementOrCharAt(isolate, object, index); 78 return GetElementOrCharAt(isolate, object, index);
81 } else { 79 } else {
82 return Object::GetProperty(object, name, language_mode); 80 return Object::GetProperty(object, name);
83 } 81 }
84 } 82 }
85 83
86 84
85 MaybeHandle<Object> Runtime::SetObjectProperty(Isolate* isolate,
86 Handle<Object> object,
87 Handle<Object> key,
88 Handle<Object> value,
89 LanguageMode language_mode) {
90 if (object->IsUndefined() || object->IsNull()) {
91 THROW_NEW_ERROR(
92 isolate,
93 NewTypeError(MessageTemplate::kNonObjectPropertyStore, key, object),
94 Object);
95 }
96
97 // Check if the given key is an array index.
98 uint32_t index = 0;
99 if (key->ToArrayIndex(&index)) {
100 // TODO(verwaest): Support other objects as well.
101 if (!object->IsJSReceiver()) return value;
102 return JSReceiver::SetElement(Handle<JSReceiver>::cast(object), index,
103 value, language_mode);
104 }
105
106 Handle<Name> name;
107 ASSIGN_RETURN_ON_EXCEPTION(isolate, name, ToName(isolate, key), Object);
108
109 LookupIterator it = LookupIterator::PropertyOrElement(isolate, object, name);
110 // TODO(verwaest): Support other objects as well.
111 if (it.IsElement() && !object->IsJSReceiver()) return value;
112 return Object::SetProperty(&it, value, language_mode,
113 Object::MAY_BE_STORE_FROM_KEYED);
114 }
115
116
117 MaybeHandle<Object> Runtime::GetPrototype(Isolate* isolate,
118 Handle<Object> obj) {
119 // We don't expect access checks to be needed on JSProxy objects.
120 DCHECK(!obj->IsAccessCheckNeeded() || obj->IsJSObject());
121 PrototypeIterator iter(isolate, obj, PrototypeIterator::START_AT_RECEIVER);
122 do {
123 if (PrototypeIterator::GetCurrent(iter)->IsAccessCheckNeeded() &&
124 !isolate->MayAccess(
125 Handle<JSObject>::cast(PrototypeIterator::GetCurrent(iter)))) {
126 isolate->ReportFailedAccessCheck(
127 Handle<JSObject>::cast(PrototypeIterator::GetCurrent(iter)));
128 RETURN_EXCEPTION_IF_SCHEDULED_EXCEPTION(isolate, Object);
129 return isolate->factory()->undefined_value();
130 }
131 iter.AdvanceIgnoringProxies();
132 if (PrototypeIterator::GetCurrent(iter)->IsJSProxy()) {
133 return PrototypeIterator::GetCurrent(iter);
134 }
135 } while (!iter.IsAtEnd(PrototypeIterator::END_AT_NON_HIDDEN));
136 return PrototypeIterator::GetCurrent(iter);
137 }
138
139
140 RUNTIME_FUNCTION(Runtime_GetPrototype) {
141 HandleScope scope(isolate);
142 DCHECK(args.length() == 1);
143 CONVERT_ARG_HANDLE_CHECKED(Object, obj, 0);
144 Handle<Object> result;
145 ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, result,
146 Runtime::GetPrototype(isolate, obj));
147 return *result;
148 }
149
150
151 RUNTIME_FUNCTION(Runtime_InternalSetPrototype) {
152 HandleScope scope(isolate);
153 DCHECK(args.length() == 2);
154 CONVERT_ARG_HANDLE_CHECKED(JSObject, obj, 0);
155 CONVERT_ARG_HANDLE_CHECKED(Object, prototype, 1);
156 DCHECK(!obj->IsAccessCheckNeeded());
157 DCHECK(!obj->map()->is_observed());
158 Handle<Object> result;
159 ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
160 isolate, result, JSObject::SetPrototype(obj, prototype, false));
161 return *result;
162 }
163
164
165 RUNTIME_FUNCTION(Runtime_SetPrototype) {
166 HandleScope scope(isolate);
167 DCHECK(args.length() == 2);
168 CONVERT_ARG_HANDLE_CHECKED(JSObject, obj, 0);
169 CONVERT_ARG_HANDLE_CHECKED(Object, prototype, 1);
170 if (obj->IsAccessCheckNeeded() && !isolate->MayAccess(obj)) {
171 isolate->ReportFailedAccessCheck(obj);
172 RETURN_FAILURE_IF_SCHEDULED_EXCEPTION(isolate);
173 return isolate->heap()->undefined_value();
174 }
175 if (obj->map()->is_observed()) {
176 Handle<Object> old_value =
177 Object::GetPrototypeSkipHiddenPrototypes(isolate, obj);
178 Handle<Object> result;
179 ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
180 isolate, result, JSObject::SetPrototype(obj, prototype, true));
181
182 Handle<Object> new_value =
183 Object::GetPrototypeSkipHiddenPrototypes(isolate, obj);
184 if (!new_value->SameValue(*old_value)) {
185 RETURN_FAILURE_ON_EXCEPTION(
186 isolate, JSObject::EnqueueChangeRecord(
187 obj, "setPrototype", isolate->factory()->proto_string(),
188 old_value));
189 }
190 return *result;
191 }
192 Handle<Object> result;
193 ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
194 isolate, result, JSObject::SetPrototype(obj, prototype, true));
195 return *result;
196 }
197
198
199 RUNTIME_FUNCTION(Runtime_IsInPrototypeChain) {
200 HandleScope shs(isolate);
201 DCHECK(args.length() == 2);
202 // See ECMA-262, section 15.3.5.3, page 88 (steps 5 - 8).
203 CONVERT_ARG_HANDLE_CHECKED(Object, O, 0);
204 CONVERT_ARG_HANDLE_CHECKED(Object, V, 1);
205 PrototypeIterator iter(isolate, V, PrototypeIterator::START_AT_RECEIVER);
206 while (true) {
207 iter.AdvanceIgnoringProxies();
208 if (iter.IsAtEnd()) return isolate->heap()->false_value();
209 if (iter.IsAtEnd(O)) return isolate->heap()->true_value();
210 }
211 }
212
213
214 // Enumerator used as indices into the array returned from GetOwnProperty
215 enum PropertyDescriptorIndices {
216 IS_ACCESSOR_INDEX,
217 VALUE_INDEX,
218 GETTER_INDEX,
219 SETTER_INDEX,
220 WRITABLE_INDEX,
221 ENUMERABLE_INDEX,
222 CONFIGURABLE_INDEX,
223 DESCRIPTOR_SIZE
224 };
225
226
227 MUST_USE_RESULT static MaybeHandle<Object> GetOwnProperty(Isolate* isolate,
228 Handle<JSObject> obj,
229 Handle<Name> name) {
230 Heap* heap = isolate->heap();
231 Factory* factory = isolate->factory();
232
233 PropertyAttributes attrs;
234 // Get attributes.
235 LookupIterator it = LookupIterator::PropertyOrElement(isolate, obj, name,
236 LookupIterator::HIDDEN);
237 Maybe<PropertyAttributes> maybe = JSObject::GetPropertyAttributes(&it);
238
239 if (!maybe.IsJust()) return MaybeHandle<Object>();
240 attrs = maybe.FromJust();
241 if (attrs == ABSENT) return factory->undefined_value();
242
243 DCHECK(!isolate->has_pending_exception());
244 Handle<FixedArray> elms = factory->NewFixedArray(DESCRIPTOR_SIZE);
245 elms->set(ENUMERABLE_INDEX, heap->ToBoolean((attrs & DONT_ENUM) == 0));
246 elms->set(CONFIGURABLE_INDEX, heap->ToBoolean((attrs & DONT_DELETE) == 0));
247
248 bool is_accessor_pair = it.state() == LookupIterator::ACCESSOR &&
249 it.GetAccessors()->IsAccessorPair();
250 elms->set(IS_ACCESSOR_INDEX, heap->ToBoolean(is_accessor_pair));
251
252 if (is_accessor_pair) {
253 Handle<AccessorPair> accessors =
254 Handle<AccessorPair>::cast(it.GetAccessors());
255 Handle<Object> getter(accessors->GetComponent(ACCESSOR_GETTER), isolate);
256 Handle<Object> setter(accessors->GetComponent(ACCESSOR_SETTER), isolate);
257 elms->set(GETTER_INDEX, *getter);
258 elms->set(SETTER_INDEX, *setter);
259 } else {
260 Handle<Object> value;
261 ASSIGN_RETURN_ON_EXCEPTION(isolate, value, Object::GetProperty(&it),
262 Object);
263 elms->set(WRITABLE_INDEX, heap->ToBoolean((attrs & READ_ONLY) == 0));
264 elms->set(VALUE_INDEX, *value);
265 }
266
267 return factory->NewJSArrayWithElements(elms);
268 }
269
270
271 // Returns an array with the property description:
272 // if args[1] is not a property on args[0]
273 // returns undefined
274 // if args[1] is a data property on args[0]
275 // [false, value, Writeable, Enumerable, Configurable]
276 // if args[1] is an accessor on args[0]
277 // [true, GetFunction, SetFunction, Enumerable, Configurable]
278 RUNTIME_FUNCTION(Runtime_GetOwnProperty) {
279 HandleScope scope(isolate);
280 DCHECK(args.length() == 2);
281 CONVERT_ARG_HANDLE_CHECKED(JSObject, obj, 0);
282 CONVERT_ARG_HANDLE_CHECKED(Name, name, 1);
283 Handle<Object> result;
284 ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, result,
285 GetOwnProperty(isolate, obj, name));
286 return *result;
287 }
288
289
290 RUNTIME_FUNCTION(Runtime_PreventExtensions) {
291 HandleScope scope(isolate);
292 DCHECK(args.length() == 1);
293 CONVERT_ARG_HANDLE_CHECKED(JSObject, obj, 0);
294 Handle<Object> result;
295 ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, result,
296 JSObject::PreventExtensions(obj));
297 return *result;
298 }
299
300
301 RUNTIME_FUNCTION(Runtime_IsExtensible) {
302 SealHandleScope shs(isolate);
303 DCHECK(args.length() == 1);
304 CONVERT_ARG_CHECKED(JSObject, obj, 0);
305 return isolate->heap()->ToBoolean(obj->IsExtensible());
306 }
307
308
309 RUNTIME_FUNCTION(Runtime_DisableAccessChecks) {
310 HandleScope scope(isolate);
311 DCHECK(args.length() == 1);
312 CONVERT_ARG_HANDLE_CHECKED(HeapObject, object, 0);
313 Handle<Map> old_map(object->map());
314 bool needs_access_checks = old_map->is_access_check_needed();
315 if (needs_access_checks) {
316 // Copy map so it won't interfere constructor's initial map.
317 Handle<Map> new_map = Map::Copy(old_map, "DisableAccessChecks");
318 new_map->set_is_access_check_needed(false);
319 JSObject::MigrateToMap(Handle<JSObject>::cast(object), new_map);
320 }
321 return isolate->heap()->ToBoolean(needs_access_checks);
322 }
323
324
325 RUNTIME_FUNCTION(Runtime_EnableAccessChecks) {
326 HandleScope scope(isolate);
327 DCHECK(args.length() == 1);
328 CONVERT_ARG_HANDLE_CHECKED(JSObject, object, 0);
329 Handle<Map> old_map(object->map());
330 RUNTIME_ASSERT(!old_map->is_access_check_needed());
331 // Copy map so it won't interfere constructor's initial map.
332 Handle<Map> new_map = Map::Copy(old_map, "EnableAccessChecks");
333 new_map->set_is_access_check_needed(true);
334 JSObject::MigrateToMap(object, new_map);
335 return isolate->heap()->undefined_value();
336 }
337
338
339 RUNTIME_FUNCTION(Runtime_OptimizeObjectForAddingMultipleProperties) {
340 HandleScope scope(isolate);
341 DCHECK(args.length() == 2);
342 CONVERT_ARG_HANDLE_CHECKED(JSObject, object, 0);
343 CONVERT_SMI_ARG_CHECKED(properties, 1);
344 // Conservative upper limit to prevent fuzz tests from going OOM.
345 RUNTIME_ASSERT(properties <= 100000);
346 if (object->HasFastProperties() && !object->IsJSGlobalProxy()) {
347 JSObject::NormalizeProperties(object, KEEP_INOBJECT_PROPERTIES, properties,
348 "OptimizeForAdding");
349 }
350 return *object;
351 }
352
353
354 RUNTIME_FUNCTION(Runtime_ObjectFreeze) {
355 HandleScope scope(isolate);
356 DCHECK(args.length() == 1);
357 CONVERT_ARG_HANDLE_CHECKED(JSObject, object, 0);
358
359 // %ObjectFreeze is a fast path and these cases are handled elsewhere.
360 RUNTIME_ASSERT(!object->HasSloppyArgumentsElements() &&
361 !object->map()->is_observed() && !object->IsJSProxy());
362
363 Handle<Object> result;
364 ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, result, JSObject::Freeze(object));
365 return *result;
366 }
367
368
369 RUNTIME_FUNCTION(Runtime_ObjectSeal) {
370 HandleScope scope(isolate);
371 DCHECK(args.length() == 1);
372 CONVERT_ARG_HANDLE_CHECKED(JSObject, object, 0);
373
374 // %ObjectSeal is a fast path and these cases are handled elsewhere.
375 RUNTIME_ASSERT(!object->HasSloppyArgumentsElements() &&
376 !object->map()->is_observed() && !object->IsJSProxy());
377
378 Handle<Object> result;
379 ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, result, JSObject::Seal(object));
380 return *result;
381 }
382
383
384 RUNTIME_FUNCTION(Runtime_GetProperty) {
385 HandleScope scope(isolate);
386 DCHECK(args.length() == 2);
387
388 CONVERT_ARG_HANDLE_CHECKED(Object, object, 0);
389 CONVERT_ARG_HANDLE_CHECKED(Object, key, 1);
390 Handle<Object> result;
391 ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
392 isolate, result, Runtime::GetObjectProperty(isolate, object, key));
393 return *result;
394 }
395
396
87 MUST_USE_RESULT static MaybeHandle<Object> TransitionElements( 397 MUST_USE_RESULT static MaybeHandle<Object> TransitionElements(
88 Handle<Object> object, ElementsKind to_kind, Isolate* isolate) { 398 Handle<Object> object, ElementsKind to_kind, Isolate* isolate) {
89 HandleScope scope(isolate); 399 HandleScope scope(isolate);
90 if (!object->IsJSObject()) { 400 if (!object->IsJSObject()) {
91 isolate->ThrowIllegalOperation(); 401 isolate->ThrowIllegalOperation();
92 return MaybeHandle<Object>(); 402 return MaybeHandle<Object>();
93 } 403 }
94 ElementsKind from_kind = 404 ElementsKind from_kind =
95 Handle<JSObject>::cast(object)->map()->elements_kind(); 405 Handle<JSObject>::cast(object)->map()->elements_kind();
96 if (Map::IsValidElementsTransition(from_kind, to_kind)) { 406 if (Map::IsValidElementsTransition(from_kind, to_kind)) {
97 JSObject::TransitionElementsKind(Handle<JSObject>::cast(object), to_kind); 407 JSObject::TransitionElementsKind(Handle<JSObject>::cast(object), to_kind);
98 return object; 408 return object;
99 } 409 }
100 isolate->ThrowIllegalOperation(); 410 isolate->ThrowIllegalOperation();
101 return MaybeHandle<Object>(); 411 return MaybeHandle<Object>();
102 } 412 }
103 413
104 414
105 MaybeHandle<Object> Runtime::KeyedGetObjectProperty( 415 // KeyedGetProperty is called from KeyedLoadIC::GenerateGeneric.
106 Isolate* isolate, Handle<Object> receiver_obj, Handle<Object> key_obj, 416 RUNTIME_FUNCTION(Runtime_KeyedGetProperty) {
107 LanguageMode language_mode) { 417 HandleScope scope(isolate);
418 DCHECK(args.length() == 2);
419
420 CONVERT_ARG_HANDLE_CHECKED(Object, receiver_obj, 0);
421 CONVERT_ARG_HANDLE_CHECKED(Object, key_obj, 1);
422
108 // Fast cases for getting named properties of the receiver JSObject 423 // Fast cases for getting named properties of the receiver JSObject
109 // itself. 424 // itself.
110 // 425 //
111 // The global proxy objects has to be excluded since LookupOwn on 426 // The global proxy objects has to be excluded since LookupOwn on
112 // the global proxy object can return a valid result even though the 427 // the global proxy object can return a valid result even though the
113 // global proxy object never has properties. This is the case 428 // global proxy object never has properties. This is the case
114 // because the global proxy object forwards everything to its hidden 429 // because the global proxy object forwards everything to its hidden
115 // prototype including own lookups. 430 // prototype including own lookups.
116 // 431 //
117 // Additionally, we need to make sure that we do not cache results 432 // Additionally, we need to make sure that we do not cache results
118 // for objects that require access checks. 433 // for objects that require access checks.
119 if (receiver_obj->IsJSObject()) { 434 if (receiver_obj->IsJSObject()) {
120 if (!receiver_obj->IsJSGlobalProxy() && 435 if (!receiver_obj->IsJSGlobalProxy() &&
121 !receiver_obj->IsAccessCheckNeeded() && key_obj->IsName()) { 436 !receiver_obj->IsAccessCheckNeeded() && key_obj->IsName()) {
122 DisallowHeapAllocation no_allocation; 437 DisallowHeapAllocation no_allocation;
123 Handle<JSObject> receiver = Handle<JSObject>::cast(receiver_obj); 438 Handle<JSObject> receiver = Handle<JSObject>::cast(receiver_obj);
124 Handle<Name> key = Handle<Name>::cast(key_obj); 439 Handle<Name> key = Handle<Name>::cast(key_obj);
125 if (receiver->IsGlobalObject()) { 440 if (receiver->IsGlobalObject()) {
126 // Attempt dictionary lookup. 441 // Attempt dictionary lookup.
127 GlobalDictionary* dictionary = receiver->global_dictionary(); 442 GlobalDictionary* dictionary = receiver->global_dictionary();
128 int entry = dictionary->FindEntry(key); 443 int entry = dictionary->FindEntry(key);
129 if (entry != GlobalDictionary::kNotFound) { 444 if (entry != GlobalDictionary::kNotFound) {
130 DCHECK(dictionary->ValueAt(entry)->IsPropertyCell()); 445 DCHECK(dictionary->ValueAt(entry)->IsPropertyCell());
131 PropertyCell* cell = PropertyCell::cast(dictionary->ValueAt(entry)); 446 PropertyCell* cell = PropertyCell::cast(dictionary->ValueAt(entry));
132 if (cell->property_details().type() == DATA) { 447 if (cell->property_details().type() == DATA) {
133 Object* value = cell->value(); 448 Object* value = cell->value();
134 if (!value->IsTheHole()) return Handle<Object>(value, isolate); 449 if (!value->IsTheHole()) return value;
135 // If value is the hole (meaning, absent) do the general lookup. 450 // If value is the hole (meaning, absent) do the general lookup.
136 } 451 }
137 } 452 }
138 } else if (!receiver->HasFastProperties()) { 453 } else if (!receiver->HasFastProperties()) {
139 // Attempt dictionary lookup. 454 // Attempt dictionary lookup.
140 NameDictionary* dictionary = receiver->property_dictionary(); 455 NameDictionary* dictionary = receiver->property_dictionary();
141 int entry = dictionary->FindEntry(key); 456 int entry = dictionary->FindEntry(key);
142 if ((entry != NameDictionary::kNotFound) && 457 if ((entry != NameDictionary::kNotFound) &&
143 (dictionary->DetailsAt(entry).type() == DATA)) { 458 (dictionary->DetailsAt(entry).type() == DATA)) {
144 Object* value = dictionary->ValueAt(entry); 459 Object* value = dictionary->ValueAt(entry);
145 return Handle<Object>(value, isolate); 460 return value;
146 } 461 }
147 } 462 }
148 } else if (key_obj->IsSmi()) { 463 } else if (key_obj->IsSmi()) {
149 // JSObject without a name key. If the key is a Smi, check for a 464 // JSObject without a name key. If the key is a Smi, check for a
150 // definite out-of-bounds access to elements, which is a strong indicator 465 // definite out-of-bounds access to elements, which is a strong indicator
151 // that subsequent accesses will also call the runtime. Proactively 466 // that subsequent accesses will also call the runtime. Proactively
152 // transition elements to FAST_*_ELEMENTS to avoid excessive boxing of 467 // transition elements to FAST_*_ELEMENTS to avoid excessive boxing of
153 // doubles for those future calls in the case that the elements would 468 // doubles for those future calls in the case that the elements would
154 // become FAST_DOUBLE_ELEMENTS. 469 // become FAST_DOUBLE_ELEMENTS.
155 Handle<JSObject> js_object = Handle<JSObject>::cast(receiver_obj); 470 Handle<JSObject> js_object = Handle<JSObject>::cast(receiver_obj);
156 ElementsKind elements_kind = js_object->GetElementsKind(); 471 ElementsKind elements_kind = js_object->GetElementsKind();
157 if (IsFastDoubleElementsKind(elements_kind)) { 472 if (IsFastDoubleElementsKind(elements_kind)) {
158 Handle<Smi> key = Handle<Smi>::cast(key_obj); 473 Handle<Smi> key = Handle<Smi>::cast(key_obj);
159 if (key->value() >= js_object->elements()->length()) { 474 if (key->value() >= js_object->elements()->length()) {
160 if (IsFastHoleyElementsKind(elements_kind)) { 475 if (IsFastHoleyElementsKind(elements_kind)) {
161 elements_kind = FAST_HOLEY_ELEMENTS; 476 elements_kind = FAST_HOLEY_ELEMENTS;
162 } else { 477 } else {
163 elements_kind = FAST_ELEMENTS; 478 elements_kind = FAST_ELEMENTS;
164 } 479 }
165 RETURN_ON_EXCEPTION( 480 RETURN_FAILURE_ON_EXCEPTION(
166 isolate, TransitionElements(js_object, elements_kind, isolate), 481 isolate, TransitionElements(js_object, elements_kind, isolate));
167 Object);
168 } 482 }
169 } else { 483 } else {
170 DCHECK(IsFastSmiOrObjectElementsKind(elements_kind) || 484 DCHECK(IsFastSmiOrObjectElementsKind(elements_kind) ||
171 !IsFastElementsKind(elements_kind)); 485 !IsFastElementsKind(elements_kind));
172 } 486 }
173 } 487 }
174 } else if (receiver_obj->IsString() && key_obj->IsSmi()) { 488 } else if (receiver_obj->IsString() && key_obj->IsSmi()) {
175 // Fast case for string indexing using [] with a smi index. 489 // Fast case for string indexing using [] with a smi index.
176 Handle<String> str = Handle<String>::cast(receiver_obj); 490 Handle<String> str = Handle<String>::cast(receiver_obj);
177 int index = Handle<Smi>::cast(key_obj)->value(); 491 int index = args.smi_at(1);
178 if (index >= 0 && index < str->length()) { 492 if (index >= 0 && index < str->length()) {
179 return GetCharAt(str, index); 493 return *GetCharAt(str, index);
180 } 494 }
181 } 495 }
182 496
183 // Fall back to GetObjectProperty. 497 // Fall back to GetObjectProperty.
184 return GetObjectProperty(isolate, receiver_obj, key_obj, language_mode);
185 }
186
187
188 MaybeHandle<Object> Runtime::SetObjectProperty(Isolate* isolate,
189 Handle<Object> object,
190 Handle<Object> key,
191 Handle<Object> value,
192 LanguageMode language_mode) {
193 if (object->IsUndefined() || object->IsNull()) {
194 THROW_NEW_ERROR(
195 isolate,
196 NewTypeError(MessageTemplate::kNonObjectPropertyStore, key, object),
197 Object);
198 }
199
200 // Check if the given key is an array index.
201 uint32_t index = 0;
202 if (key->ToArrayIndex(&index)) {
203 // TODO(verwaest): Support other objects as well.
204 if (!object->IsJSReceiver()) return value;
205 return JSReceiver::SetElement(Handle<JSReceiver>::cast(object), index,
206 value, language_mode);
207 }
208
209 Handle<Name> name;
210 ASSIGN_RETURN_ON_EXCEPTION(isolate, name, ToName(isolate, key), Object);
211
212 LookupIterator it = LookupIterator::PropertyOrElement(isolate, object, name);
213 // TODO(verwaest): Support other objects as well.
214 if (it.IsElement() && !object->IsJSReceiver()) return value;
215 return Object::SetProperty(&it, value, language_mode,
216 Object::MAY_BE_STORE_FROM_KEYED);
217 }
218
219
220 MaybeHandle<Object> Runtime::GetPrototype(Isolate* isolate,
221 Handle<Object> obj) {
222 // We don't expect access checks to be needed on JSProxy objects.
223 DCHECK(!obj->IsAccessCheckNeeded() || obj->IsJSObject());
224 PrototypeIterator iter(isolate, obj, PrototypeIterator::START_AT_RECEIVER);
225 do {
226 if (PrototypeIterator::GetCurrent(iter)->IsAccessCheckNeeded() &&
227 !isolate->MayAccess(
228 Handle<JSObject>::cast(PrototypeIterator::GetCurrent(iter)))) {
229 isolate->ReportFailedAccessCheck(
230 Handle<JSObject>::cast(PrototypeIterator::GetCurrent(iter)));
231 RETURN_EXCEPTION_IF_SCHEDULED_EXCEPTION(isolate, Object);
232 return isolate->factory()->undefined_value();
233 }
234 iter.AdvanceIgnoringProxies();
235 if (PrototypeIterator::GetCurrent(iter)->IsJSProxy()) {
236 return PrototypeIterator::GetCurrent(iter);
237 }
238 } while (!iter.IsAtEnd(PrototypeIterator::END_AT_NON_HIDDEN));
239 return PrototypeIterator::GetCurrent(iter);
240 }
241
242
243 RUNTIME_FUNCTION(Runtime_GetPrototype) {
244 HandleScope scope(isolate);
245 DCHECK(args.length() == 1);
246 CONVERT_ARG_HANDLE_CHECKED(Object, obj, 0);
247 Handle<Object> result; 498 Handle<Object> result;
248 ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, result, 499 ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
249 Runtime::GetPrototype(isolate, obj)); 500 isolate, result,
501 Runtime::GetObjectProperty(isolate, receiver_obj, key_obj));
250 return *result; 502 return *result;
251 } 503 }
252 504
253
254 RUNTIME_FUNCTION(Runtime_InternalSetPrototype) {
255 HandleScope scope(isolate);
256 DCHECK(args.length() == 2);
257 CONVERT_ARG_HANDLE_CHECKED(JSObject, obj, 0);
258 CONVERT_ARG_HANDLE_CHECKED(Object, prototype, 1);
259 DCHECK(!obj->IsAccessCheckNeeded());
260 DCHECK(!obj->map()->is_observed());
261 Handle<Object> result;
262 ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
263 isolate, result, JSObject::SetPrototype(obj, prototype, false));
264 return *result;
265 }
266
267
268 RUNTIME_FUNCTION(Runtime_SetPrototype) {
269 HandleScope scope(isolate);
270 DCHECK(args.length() == 2);
271 CONVERT_ARG_HANDLE_CHECKED(JSObject, obj, 0);
272 CONVERT_ARG_HANDLE_CHECKED(Object, prototype, 1);
273 if (obj->IsAccessCheckNeeded() && !isolate->MayAccess(obj)) {
274 isolate->ReportFailedAccessCheck(obj);
275 RETURN_FAILURE_IF_SCHEDULED_EXCEPTION(isolate);
276 return isolate->heap()->undefined_value();
277 }
278 if (obj->map()->is_observed()) {
279 Handle<Object> old_value =
280 Object::GetPrototypeSkipHiddenPrototypes(isolate, obj);
281 Handle<Object> result;
282 ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
283 isolate, result, JSObject::SetPrototype(obj, prototype, true));
284
285 Handle<Object> new_value =
286 Object::GetPrototypeSkipHiddenPrototypes(isolate, obj);
287 if (!new_value->SameValue(*old_value)) {
288 RETURN_FAILURE_ON_EXCEPTION(
289 isolate, JSObject::EnqueueChangeRecord(
290 obj, "setPrototype", isolate->factory()->proto_string(),
291 old_value));
292 }
293 return *result;
294 }
295 Handle<Object> result;
296 ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
297 isolate, result, JSObject::SetPrototype(obj, prototype, true));
298 return *result;
299 }
300
301
302 RUNTIME_FUNCTION(Runtime_IsInPrototypeChain) {
303 HandleScope shs(isolate);
304 DCHECK(args.length() == 2);
305 // See ECMA-262, section 15.3.5.3, page 88 (steps 5 - 8).
306 CONVERT_ARG_HANDLE_CHECKED(Object, O, 0);
307 CONVERT_ARG_HANDLE_CHECKED(Object, V, 1);
308 PrototypeIterator iter(isolate, V, PrototypeIterator::START_AT_RECEIVER);
309 while (true) {
310 iter.AdvanceIgnoringProxies();
311 if (iter.IsAtEnd()) return isolate->heap()->false_value();
312 if (iter.IsAtEnd(O)) return isolate->heap()->true_value();
313 }
314 }
315
316
317 // Enumerator used as indices into the array returned from GetOwnProperty
318 enum PropertyDescriptorIndices {
319 IS_ACCESSOR_INDEX,
320 VALUE_INDEX,
321 GETTER_INDEX,
322 SETTER_INDEX,
323 WRITABLE_INDEX,
324 ENUMERABLE_INDEX,
325 CONFIGURABLE_INDEX,
326 DESCRIPTOR_SIZE
327 };
328
329
330 MUST_USE_RESULT static MaybeHandle<Object> GetOwnProperty(Isolate* isolate,
331 Handle<JSObject> obj,
332 Handle<Name> name) {
333 Heap* heap = isolate->heap();
334 Factory* factory = isolate->factory();
335
336 PropertyAttributes attrs;
337 // Get attributes.
338 LookupIterator it = LookupIterator::PropertyOrElement(isolate, obj, name,
339 LookupIterator::HIDDEN);
340 Maybe<PropertyAttributes> maybe = JSObject::GetPropertyAttributes(&it);
341
342 if (!maybe.IsJust()) return MaybeHandle<Object>();
343 attrs = maybe.FromJust();
344 if (attrs == ABSENT) return factory->undefined_value();
345
346 DCHECK(!isolate->has_pending_exception());
347 Handle<FixedArray> elms = factory->NewFixedArray(DESCRIPTOR_SIZE);
348 elms->set(ENUMERABLE_INDEX, heap->ToBoolean((attrs & DONT_ENUM) == 0));
349 elms->set(CONFIGURABLE_INDEX, heap->ToBoolean((attrs & DONT_DELETE) == 0));
350
351 bool is_accessor_pair = it.state() == LookupIterator::ACCESSOR &&
352 it.GetAccessors()->IsAccessorPair();
353 elms->set(IS_ACCESSOR_INDEX, heap->ToBoolean(is_accessor_pair));
354
355 if (is_accessor_pair) {
356 Handle<AccessorPair> accessors =
357 Handle<AccessorPair>::cast(it.GetAccessors());
358 Handle<Object> getter(accessors->GetComponent(ACCESSOR_GETTER), isolate);
359 Handle<Object> setter(accessors->GetComponent(ACCESSOR_SETTER), isolate);
360 elms->set(GETTER_INDEX, *getter);
361 elms->set(SETTER_INDEX, *setter);
362 } else {
363 Handle<Object> value;
364 ASSIGN_RETURN_ON_EXCEPTION(isolate, value, Object::GetProperty(&it),
365 Object);
366 elms->set(WRITABLE_INDEX, heap->ToBoolean((attrs & READ_ONLY) == 0));
367 elms->set(VALUE_INDEX, *value);
368 }
369
370 return factory->NewJSArrayWithElements(elms);
371 }
372
373
374 // Returns an array with the property description:
375 // if args[1] is not a property on args[0]
376 // returns undefined
377 // if args[1] is a data property on args[0]
378 // [false, value, Writeable, Enumerable, Configurable]
379 // if args[1] is an accessor on args[0]
380 // [true, GetFunction, SetFunction, Enumerable, Configurable]
381 RUNTIME_FUNCTION(Runtime_GetOwnProperty) {
382 HandleScope scope(isolate);
383 DCHECK(args.length() == 2);
384 CONVERT_ARG_HANDLE_CHECKED(JSObject, obj, 0);
385 CONVERT_ARG_HANDLE_CHECKED(Name, name, 1);
386 Handle<Object> result;
387 ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, result,
388 GetOwnProperty(isolate, obj, name));
389 return *result;
390 }
391
392
393 RUNTIME_FUNCTION(Runtime_PreventExtensions) {
394 HandleScope scope(isolate);
395 DCHECK(args.length() == 1);
396 CONVERT_ARG_HANDLE_CHECKED(JSObject, obj, 0);
397 Handle<Object> result;
398 ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, result,
399 JSObject::PreventExtensions(obj));
400 return *result;
401 }
402
403
404 RUNTIME_FUNCTION(Runtime_IsExtensible) {
405 SealHandleScope shs(isolate);
406 DCHECK(args.length() == 1);
407 CONVERT_ARG_CHECKED(JSObject, obj, 0);
408 return isolate->heap()->ToBoolean(obj->IsExtensible());
409 }
410
411
412 RUNTIME_FUNCTION(Runtime_DisableAccessChecks) {
413 HandleScope scope(isolate);
414 DCHECK(args.length() == 1);
415 CONVERT_ARG_HANDLE_CHECKED(HeapObject, object, 0);
416 Handle<Map> old_map(object->map());
417 bool needs_access_checks = old_map->is_access_check_needed();
418 if (needs_access_checks) {
419 // Copy map so it won't interfere constructor's initial map.
420 Handle<Map> new_map = Map::Copy(old_map, "DisableAccessChecks");
421 new_map->set_is_access_check_needed(false);
422 JSObject::MigrateToMap(Handle<JSObject>::cast(object), new_map);
423 }
424 return isolate->heap()->ToBoolean(needs_access_checks);
425 }
426
427
428 RUNTIME_FUNCTION(Runtime_EnableAccessChecks) {
429 HandleScope scope(isolate);
430 DCHECK(args.length() == 1);
431 CONVERT_ARG_HANDLE_CHECKED(JSObject, object, 0);
432 Handle<Map> old_map(object->map());
433 RUNTIME_ASSERT(!old_map->is_access_check_needed());
434 // Copy map so it won't interfere constructor's initial map.
435 Handle<Map> new_map = Map::Copy(old_map, "EnableAccessChecks");
436 new_map->set_is_access_check_needed(true);
437 JSObject::MigrateToMap(object, new_map);
438 return isolate->heap()->undefined_value();
439 }
440
441
442 RUNTIME_FUNCTION(Runtime_OptimizeObjectForAddingMultipleProperties) {
443 HandleScope scope(isolate);
444 DCHECK(args.length() == 2);
445 CONVERT_ARG_HANDLE_CHECKED(JSObject, object, 0);
446 CONVERT_SMI_ARG_CHECKED(properties, 1);
447 // Conservative upper limit to prevent fuzz tests from going OOM.
448 RUNTIME_ASSERT(properties <= 100000);
449 if (object->HasFastProperties() && !object->IsJSGlobalProxy()) {
450 JSObject::NormalizeProperties(object, KEEP_INOBJECT_PROPERTIES, properties,
451 "OptimizeForAdding");
452 }
453 return *object;
454 }
455
456
457 RUNTIME_FUNCTION(Runtime_ObjectFreeze) {
458 HandleScope scope(isolate);
459 DCHECK(args.length() == 1);
460 CONVERT_ARG_HANDLE_CHECKED(JSObject, object, 0);
461
462 // %ObjectFreeze is a fast path and these cases are handled elsewhere.
463 RUNTIME_ASSERT(!object->HasSloppyArgumentsElements() &&
464 !object->map()->is_observed() && !object->IsJSProxy());
465
466 Handle<Object> result;
467 ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, result, JSObject::Freeze(object));
468 return *result;
469 }
470
471
472 RUNTIME_FUNCTION(Runtime_ObjectSeal) {
473 HandleScope scope(isolate);
474 DCHECK(args.length() == 1);
475 CONVERT_ARG_HANDLE_CHECKED(JSObject, object, 0);
476
477 // %ObjectSeal is a fast path and these cases are handled elsewhere.
478 RUNTIME_ASSERT(!object->HasSloppyArgumentsElements() &&
479 !object->map()->is_observed() && !object->IsJSProxy());
480
481 Handle<Object> result;
482 ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, result, JSObject::Seal(object));
483 return *result;
484 }
485
486
487 RUNTIME_FUNCTION(Runtime_GetProperty) {
488 HandleScope scope(isolate);
489 DCHECK(args.length() == 3);
490
491 CONVERT_ARG_HANDLE_CHECKED(Object, object, 0);
492 CONVERT_ARG_HANDLE_CHECKED(Object, key, 1);
493 CONVERT_LANGUAGE_MODE_ARG_CHECKED(language_mode, 2);
494
495 Handle<Object> result;
496 ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
497 isolate, result,
498 Runtime::GetObjectProperty(isolate, object, key, language_mode));
499 return *result;
500 }
501
502
503 RUNTIME_FUNCTION(Runtime_KeyedGetProperty) {
504 HandleScope scope(isolate);
505 DCHECK(args.length() == 3);
506
507 CONVERT_ARG_HANDLE_CHECKED(Object, receiver_obj, 0);
508 CONVERT_ARG_HANDLE_CHECKED(Object, key_obj, 1);
509 CONVERT_LANGUAGE_MODE_ARG_CHECKED(language_mode, 2);
510
511 Handle<Object> result;
512 ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
513 isolate, result, Runtime::KeyedGetObjectProperty(isolate, receiver_obj,
514 key_obj, language_mode));
515 return *result;
516 }
517
518 505
519 RUNTIME_FUNCTION(Runtime_AddNamedProperty) { 506 RUNTIME_FUNCTION(Runtime_AddNamedProperty) {
520 HandleScope scope(isolate); 507 HandleScope scope(isolate);
521 RUNTIME_ASSERT(args.length() == 4); 508 RUNTIME_ASSERT(args.length() == 4);
522 509
523 CONVERT_ARG_HANDLE_CHECKED(JSObject, object, 0); 510 CONVERT_ARG_HANDLE_CHECKED(JSObject, object, 0);
524 CONVERT_ARG_HANDLE_CHECKED(Name, name, 1); 511 CONVERT_ARG_HANDLE_CHECKED(Name, name, 1);
525 CONVERT_ARG_HANDLE_CHECKED(Object, value, 2); 512 CONVERT_ARG_HANDLE_CHECKED(Object, value, 2);
526 CONVERT_PROPERTY_ATTRIBUTES_CHECKED(attrs, 3); 513 CONVERT_PROPERTY_ATTRIBUTES_CHECKED(attrs, 3);
527 514
(...skipping 909 matching lines...) Expand 10 before | Expand all | Expand 10 after
1437 CONVERT_PROPERTY_ATTRIBUTES_CHECKED(attrs, 3); 1424 CONVERT_PROPERTY_ATTRIBUTES_CHECKED(attrs, 3);
1438 1425
1439 RETURN_FAILURE_ON_EXCEPTION( 1426 RETURN_FAILURE_ON_EXCEPTION(
1440 isolate, 1427 isolate,
1441 JSObject::DefineAccessor(object, name, isolate->factory()->null_value(), 1428 JSObject::DefineAccessor(object, name, isolate->factory()->null_value(),
1442 setter, attrs)); 1429 setter, attrs));
1443 return isolate->heap()->undefined_value(); 1430 return isolate->heap()->undefined_value();
1444 } 1431 }
1445 } // namespace internal 1432 } // namespace internal
1446 } // namespace v8 1433 } // namespace v8
OLDNEW
« no previous file with comments | « src/runtime/runtime-debug.cc ('k') | src/x64/code-stubs-x64.cc » ('j') | no next file with comments »

Powered by Google App Engine
This is Rietveld 408576698