Bubble up the transitions associated with PreventExtensionsWithTransition

src/objects.cc

 // Copyright 2013 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include <iomanip>
 #include <sstream>
 
 #include "src/v8.h"
 
 #include "src/accessors.h"
@@ skipping 2343 matching lines @@
 Handle<Map> Map::ReconfigureProperty(Handle<Map> old_map, int modify_index,
                                      PropertyKind new_kind,
                                      PropertyAttributes new_attributes,
                                      Representation new_representation,
                                      Handle<HeapType> new_field_type,
                                      StoreMode store_mode) {
   DCHECK_NE(kAccessor, new_kind);  // TODO(ishell): not supported yet.
   DCHECK(store_mode != FORCE_FIELD || modify_index >= 0);
   Isolate* isolate = old_map->GetIsolate();
 
+  Handle<Map> real_old_map = old_map;
+  Handle<Object> prev_object = handle(old_map->GetBackPointer(), isolate);
+  PropertyAttributes extra_attributes = NONE;
+  if (!prev_object->IsUndefined()) {

[Igor Sheludko, 2015/09/16 13:09:15]

How about adding "!old_map->is_extensible() &&" to avoid unnecessary transition
array queries?

+    Handle<Map> prev_map = Handle<Map>::cast(prev_object);
+    Map* transition = TransitionArray::SearchSpecial(
+        *prev_map, *isolate->factory()->nonextensible_symbol());
+    if (transition == *old_map) {
+      old_map = prev_map;
+    } else {
+      transition = TransitionArray::SearchSpecial(
+          *prev_map, *isolate->factory()->sealed_symbol());
+      if (transition == *old_map) {
+        extra_attributes = SEALED;
+        old_map = prev_map;
+      } else {
+        Map* transition = TransitionArray::SearchSpecial(
+            *prev_map, *isolate->factory()->frozen_symbol());
+        if (transition == *old_map) {
+          extra_attributes = FROZEN;
+          old_map = prev_map;
+        }
+      }
+    }
+  }
+
   Handle<DescriptorArray> old_descriptors(
       old_map->instance_descriptors(), isolate);
   int old_nof = old_map->NumberOfOwnDescriptors();
 
   // If it's just a representation generalization case (i.e. property kind and
   // attributes stays unchanged) it's fine to transition from None to anything
   // but double without any modification to the object, because the default
   // uninitialized value for representation None can be overwritten by both
   // smi and tagged values. Doubles, however, would require a box allocation.
   if (modify_index >= 0 && !new_representation.IsNone() &&
@@ skipping 15 matching lines @@
       }
       Handle<Map> field_owner(old_map->FindFieldOwner(modify_index), isolate);
 
       GeneralizeFieldType(field_owner, modify_index, new_representation,
                           new_field_type);
       DCHECK(old_descriptors->GetDetails(modify_index)
                  .representation()
                  .Equals(new_representation));
       DCHECK(
           old_descriptors->GetFieldType(modify_index)->NowIs(new_field_type));
-      return old_map;
+      return real_old_map;
     }
   }
 
   // Check the state of the root map.
   Handle<Map> root_map(old_map->FindRootMap(), isolate);
   if (!old_map->EquivalentToForTransition(*root_map)) {
-    return CopyGeneralizeAllRepresentations(old_map, modify_index, store_mode,
-                                            new_kind, new_attributes,
-                                            "GenAll_NotEquivalent");
+    return CopyGeneralizeAllRepresentations(
+        real_old_map, modify_index, store_mode, new_kind, new_attributes,
+        "GenAll_NotEquivalent");
   }
 
   ElementsKind from_kind = root_map->elements_kind();
   ElementsKind to_kind = old_map->elements_kind();
   // TODO(ishell): Add a test for SLOW_SLOPPY_ARGUMENTS_ELEMENTS.
   if (from_kind != to_kind && to_kind != DICTIONARY_ELEMENTS &&
       to_kind != SLOW_SLOPPY_ARGUMENTS_ELEMENTS &&
       !(IsTransitionableFastElementsKind(from_kind) &&
         IsMoreGeneralElementsKindTransition(from_kind, to_kind))) {
-    return CopyGeneralizeAllRepresentations(old_map, modify_index, store_mode,
-                                            new_kind, new_attributes,
-                                            "GenAll_InvalidElementsTransition");
+    return CopyGeneralizeAllRepresentations(
+        real_old_map, modify_index, store_mode, new_kind, new_attributes,
+        "GenAll_InvalidElementsTransition");
   }
   int root_nof = root_map->NumberOfOwnDescriptors();
   if (modify_index >= 0 && modify_index < root_nof) {
     PropertyDetails old_details = old_descriptors->GetDetails(modify_index);
     if (old_details.kind() != new_kind ||
         old_details.attributes() != new_attributes) {
-      return CopyGeneralizeAllRepresentations(old_map, modify_index, store_mode,
-                                              new_kind, new_attributes,
-                                              "GenAll_RootModification1");
+      return CopyGeneralizeAllRepresentations(
+          real_old_map, modify_index, store_mode, new_kind, new_attributes,
+          "GenAll_RootModification1");
     }
     if ((old_details.type() != DATA && store_mode == FORCE_FIELD) ||
         (old_details.type() == DATA &&
          (!new_field_type->NowIs(old_descriptors->GetFieldType(modify_index)) ||
           !new_representation.fits_into(old_details.representation())))) {
-      return CopyGeneralizeAllRepresentations(old_map, modify_index, store_mode,
-                                              new_kind, new_attributes,
-                                              "GenAll_RootModification2");
+      return CopyGeneralizeAllRepresentations(
+          real_old_map, modify_index, store_mode, new_kind, new_attributes,
+          "GenAll_RootModification2");
     }
   }
 
   // From here on, use the map with correct elements kind as root map.
   if (from_kind != to_kind) {
     root_map = Map::AsElementsKind(root_map, to_kind);
   }
 
   Handle<Map> target_map = root_map;
   for (int i = root_nof; i < old_nof; ++i) {
@@ skipping 33 matching lines @@
     Handle<DescriptorArray> tmp_descriptors = handle(
         tmp_map->instance_descriptors(), isolate);
 
     // Check if target map is incompatible.
     PropertyDetails tmp_details = tmp_descriptors->GetDetails(i);
     DCHECK_EQ(next_kind, tmp_details.kind());
     DCHECK_EQ(next_attributes, tmp_details.attributes());
     if (next_kind == kAccessor &&
         !EqualImmutableValues(old_descriptors->GetValue(i),
                               tmp_descriptors->GetValue(i))) {
-      return CopyGeneralizeAllRepresentations(old_map, modify_index, store_mode,
-                                              new_kind, new_attributes,
-                                              "GenAll_Incompatible");
+      return CopyGeneralizeAllRepresentations(
+          real_old_map, modify_index, store_mode, new_kind, new_attributes,
+          "GenAll_Incompatible");
     }
     if (next_location == kField && tmp_details.location() == kDescriptor) break;
 
     Representation tmp_representation = tmp_details.representation();
     if (!next_representation.fits_into(tmp_representation)) break;
 
     PropertyLocation old_location = old_details.location();
     PropertyLocation tmp_location = tmp_details.location();
     if (tmp_location == kField) {
       if (next_kind == kData) {
@@ skipping 36 matching lines @@
     if (modify_index >= 0) {
       PropertyDetails details = target_descriptors->GetDetails(modify_index);
       DCHECK_EQ(new_kind, details.kind());
       DCHECK_EQ(new_attributes, details.attributes());
       DCHECK(new_representation.fits_into(details.representation()));
       DCHECK(details.location() != kField ||
              new_field_type->NowIs(
                  target_descriptors->GetFieldType(modify_index)));
     }
 #endif
+
     if (*target_map != *old_map) {
+      // Add any preventExtensions/seal/freeze transition back onto the end.
+      if (!old_map.is_identical_to(real_old_map)) {
+        MaybeHandle<Map> transition_map = TransitionForPreventExtensions(
+            target_map, extra_attributes,
+            AsTransitionMarker(isolate, extra_attributes));
+        if (!transition_map.ToHandle(&target_map)) {
+          return CopyGeneralizeAllRepresentations(
+              real_old_map, modify_index, store_mode, new_kind, new_attributes,
+              "GenAll_CantHaveMoreTransitions");
+        }

[Igor Sheludko, 2015/09/16 13:09:15]

You should add
  if (*target_map != *real_old_map) {
    real_old_map->NotifyLeafMapLayoutChange();
  }
here.

+      }
       old_map->NotifyLeafMapLayoutChange();
+      return target_map;
     }
-    return target_map;
+    return real_old_map;
   }
 
   // Find the last compatible target map in the transition tree.
   for (int i = target_nof; i < old_nof; ++i) {
     PropertyDetails old_details = old_descriptors->GetDetails(i);
     PropertyKind next_kind;
     PropertyAttributes next_attributes;
     if (modify_index == i) {
       next_kind = new_kind;
       next_attributes = new_attributes;
@@ skipping 10 matching lines @@
 
     // Check if target map is compatible.
 #ifdef DEBUG
     PropertyDetails tmp_details = tmp_descriptors->GetDetails(i);
     DCHECK_EQ(next_kind, tmp_details.kind());
     DCHECK_EQ(next_attributes, tmp_details.attributes());
 #endif
     if (next_kind == kAccessor &&
         !EqualImmutableValues(old_descriptors->GetValue(i),
                               tmp_descriptors->GetValue(i))) {
-      return CopyGeneralizeAllRepresentations(old_map, modify_index, store_mode,
-                                              new_kind, new_attributes,
-                                              "GenAll_Incompatible");
+      return CopyGeneralizeAllRepresentations(
+          real_old_map, modify_index, store_mode, new_kind, new_attributes,
+          "GenAll_Incompatible");
     }
     DCHECK(!tmp_map->is_deprecated());
     target_map = tmp_map;
   }
   target_nof = target_map->NumberOfOwnDescriptors();
   target_descriptors = handle(target_map->instance_descriptors(), isolate);
 
   // Allocate a new descriptor array large enough to hold the required
   // descriptors, with minimally the exact same size as the old descriptor
   // array.
@@ skipping 204 matching lines @@
   }
   bool transition_target_deprecated = split_map->DeprecateTarget(
       split_kind, old_descriptors->GetKey(split_nof), split_attributes,
       *new_descriptors, *new_layout_descriptor);
 
   // If |transition_target_deprecated| is true then the transition array
   // already contains entry for given descriptor. This means that the transition
   // could be inserted regardless of whether transitions array is full or not.
   if (!transition_target_deprecated &&
       !TransitionArray::CanHaveMoreTransitions(split_map)) {
-    return CopyGeneralizeAllRepresentations(old_map, modify_index, store_mode,
-                                            new_kind, new_attributes,
-                                            "GenAll_CantHaveMoreTransitions");
+    return CopyGeneralizeAllRepresentations(
+        real_old_map, modify_index, store_mode, new_kind, new_attributes,
+        "GenAll_CantHaveMoreTransitions");
+  }
+
+  // Add missing transitions.
+  Handle<Map> new_map = split_map;
+  for (int i = split_nof; i < old_nof; ++i) {
+    new_map = CopyInstallDescriptors(new_map, i, new_descriptors,
+                                     new_layout_descriptor);
+  }
+  new_map->set_owns_descriptors(true);
+
+  // Add any preventExtensions/seal/freeze transition back onto the end.
+  if (!old_map.is_identical_to(real_old_map)) {
+    MaybeHandle<Map> transition_map = TransitionForPreventExtensions(

[Igor Sheludko, 2015/09/16 13:09:15]

It does not make sense to search for transition here because they do not exist.
At this point we do CopyInstallDescriptors at lease once which creates new map
without transitions. So I think you should just call
Map::CopyForPreventExtensions() here instead which will also call necessary
"real_old_map->NotifyLeafMapLayoutChange()".

+        new_map, extra_attributes,
+        AsTransitionMarker(isolate, extra_attributes));
+    if (!transition_map.ToHandle(&new_map)) {
+      return CopyGeneralizeAllRepresentations(
+          real_old_map, modify_index, store_mode, new_kind, new_attributes,
+          "GenAll_CantHaveMoreTransitions");
+    }
   }
 
   old_map->NotifyLeafMapLayoutChange();
 
   if (FLAG_trace_generalization && modify_index >= 0) {
     PropertyDetails old_details = old_descriptors->GetDetails(modify_index);
     PropertyDetails new_details = new_descriptors->GetDetails(modify_index);
     Handle<HeapType> old_field_type =
         (old_details.type() == DATA)
             ? handle(old_descriptors->GetFieldType(modify_index), isolate)
             : HeapType::Constant(
                   handle(old_descriptors->GetValue(modify_index), isolate),
                   isolate);
     Handle<HeapType> new_field_type =
         (new_details.type() == DATA)
             ? handle(new_descriptors->GetFieldType(modify_index), isolate)
             : HeapType::Constant(
                   handle(new_descriptors->GetValue(modify_index), isolate),
                   isolate);
     old_map->PrintGeneralization(
         stdout, "", modify_index, split_nof, old_nof,
         old_details.location() == kDescriptor && store_mode == FORCE_FIELD,
         old_details.representation(), new_details.representation(),
         *old_field_type, *new_field_type);
   }
 
-  // Add missing transitions.
-  Handle<Map> new_map = split_map;
-  for (int i = split_nof; i < old_nof; ++i) {
-    new_map = CopyInstallDescriptors(new_map, i, new_descriptors,
-                                     new_layout_descriptor);
-  }
-  new_map->set_owns_descriptors(true);
   return new_map;
 }
 
 
 // Generalize the representation of all DATA descriptors.
 Handle<Map> Map::GeneralizeAllFieldRepresentations(
     Handle<Map> map) {
   Handle<DescriptorArray> descriptors(map->instance_descriptors());
   for (int i = 0; i < map->NumberOfOwnDescriptors(); ++i) {
     PropertyDetails details = descriptors->GetDetails(i);
@@ skipping 2695 matching lines @@
         isolate, NewTypeError(MessageTemplate::kCannotPreventExtExternalArray),
         Object);
   }
 
   Handle<SeededNumberDictionary> new_element_dictionary;
   if (!object->elements()->IsDictionary()) {
     new_element_dictionary = GetNormalizedElementDictionary(object);
     isolate->UpdateArrayProtectorOnNormalizeElements(object);
   }
 
-  Handle<Symbol> transition_marker;
-  if (attrs == NONE) {
-    transition_marker = isolate->factory()->nonextensible_symbol();
-  } else if (attrs == SEALED) {
-    transition_marker = isolate->factory()->sealed_symbol();
-  } else {
-    DCHECK(attrs == FROZEN);
-    transition_marker = isolate->factory()->frozen_symbol();
-  }
+  Handle<Symbol> transition_marker = Map::AsTransitionMarker(isolate, attrs);
 
   Handle<Map> old_map(object->map(), isolate);
-  Map* transition =
-      TransitionArray::SearchSpecial(*old_map, *transition_marker);
-  if (transition != NULL) {
-    Handle<Map> transition_map(transition, isolate);
-    DCHECK(transition_map->has_dictionary_elements());
-    DCHECK(!transition_map->is_extensible());
-    JSObject::MigrateToMap(object, transition_map);
-  } else if (TransitionArray::CanHaveMoreTransitions(old_map)) {
-    // Create a new descriptor array with the appropriate property attributes
-    Handle<Map> new_map = Map::CopyForPreventExtensions(
-        old_map, attrs, transition_marker, "CopyForPreventExtensions");
-    JSObject::MigrateToMap(object, new_map);
-  } else {
+  MaybeHandle<Map> transition_map =
+      Map::TransitionForPreventExtensions(old_map, attrs, transition_marker);
+  Handle<Map> new_map;
+  if (!transition_map.ToHandle(&new_map)) {
     DCHECK(old_map->is_dictionary_map() || !old_map->is_prototype_map());
     // Slow path: need to normalize properties for safety
     NormalizeProperties(object, CLEAR_INOBJECT_PROPERTIES, 0,
                         "SlowPreventExtensions");
 
     // Create a new map, since other objects with this map may be extensible.
     // TODO(adamk): Extend the NormalizedMapCache to handle non-extensible maps.
-    Handle<Map> new_map =
-        Map::Copy(handle(object->map()), "SlowCopyForPreventExtensions");
+    new_map = Map::Copy(handle(object->map()), "SlowCopyForPreventExtensions");
     new_map->set_is_extensible(false);
     new_map->set_elements_kind(DICTIONARY_ELEMENTS);
     JSObject::MigrateToMap(object, new_map);
 
     if (attrs != NONE) {
       if (object->IsGlobalObject()) {
         ApplyAttributesToDictionary(object->global_dictionary(), attrs);
       } else {
         ApplyAttributesToDictionary(object->property_dictionary(), attrs);
       }
     }
+  } else {
+    JSObject::MigrateToMap(object, new_map);
   }
 
   DCHECK(object->map()->has_dictionary_elements());
   if (!new_element_dictionary.is_null()) {
     object->set_elements(*new_element_dictionary);
   }
 
   if (object->elements() != isolate->heap()->empty_slow_element_dictionary()) {
     SeededNumberDictionary* dictionary = object->element_dictionary();
     // Make sure we never go back to the fast case
@@ skipping 1283 matching lines @@
                                                  isolate);
   Handle<Map> new_map = CopyReplaceDescriptors(
       map, new_desc, new_layout_descriptor, INSERT_TRANSITION,
       transition_marker, reason, SPECIAL_TRANSITION);
   new_map->set_is_extensible(false);
   new_map->set_elements_kind(DICTIONARY_ELEMENTS);
   return new_map;
 }
 
 
+MaybeHandle<Map> Map::TransitionForPreventExtensions(
+    Handle<Map> old_map, PropertyAttributes attrs,
+    Handle<Symbol> transition_marker) {
+  Isolate* isolate = old_map->GetIsolate();
+  Map* transition =
+      TransitionArray::SearchSpecial(*old_map, *transition_marker);
+  if (transition != NULL) {
+    Handle<Map> transition_map(transition, isolate);
+    DCHECK(transition_map->has_dictionary_elements());
+    DCHECK(!transition_map->is_extensible());
+    return transition_map;
+  } else if (TransitionArray::CanHaveMoreTransitions(old_map)) {
+    // Create a new descriptor array with the appropriate property attributes
+    Handle<Map> new_map = Map::CopyForPreventExtensions(
+        old_map, attrs, transition_marker, "CopyForPreventExtensions");
+    return new_map;
+  }
+  return MaybeHandle<Map>();
+}
+
+
+Handle<Symbol> Map::AsTransitionMarker(Isolate* isolate,
+                                       PropertyAttributes attrs) {
+  if (attrs == NONE) {
+    return isolate->factory()->nonextensible_symbol();
+  } else if (attrs == SEALED) {
+    return isolate->factory()->sealed_symbol();
+  } else {
+    DCHECK(attrs == FROZEN);
+    return isolate->factory()->frozen_symbol();
+  }
+}
+
+
 Handle<Map> Map::FixProxy(Handle<Map> map, InstanceType type, int size) {
   DCHECK(type == JS_OBJECT_TYPE || type == JS_FUNCTION_TYPE);
   DCHECK(map->IsJSProxyMap());
 
   Isolate* isolate = map->GetIsolate();
 
   // Allocate fresh map.
   // TODO(rossberg): Once we optimize proxies, cache these maps.
   Handle<Map> new_map = isolate->factory()->NewMap(type, size);
 
@@ skipping 8988 matching lines @@
                                             Handle<Object> new_value) {
   if (cell->value() != *new_value) {
     cell->set_value(*new_value);
     Isolate* isolate = cell->GetIsolate();
     cell->dependent_code()->DeoptimizeDependentCodeGroup(
         isolate, DependentCode::kPropertyCellChangedGroup);
   }
 }
 }  // namespace internal
 }  // namespace v8