[accessors] second-chance typed array field lookup

src/accessors.cc

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/accessors.h"
 
 #include "src/api.h"
 #include "src/contexts.h"
 #include "src/deoptimizer.h"
 #include "src/execution.h"
@@ skipping 81 matching lines @@
   }
 }
 
 
 bool Accessors::IsJSArrayBufferViewFieldAccessor(Handle<Map> map,
                                                  Handle<Name> name,
                                                  int* object_offset) {
   Isolate* isolate = name->GetIsolate();
 
   switch (map->instance_type()) {
-    case JS_TYPED_ARRAY_TYPE:
+    case JS_TYPED_ARRAY_TYPE: {
+      int offset;
+
+      if (Name::Equals(name, isolate->factory()->length_string())) {

[Jakob Kummerow, 2015/09/09 11:51:06]

Let's keep using the existing CheckForName helper:

if (!CheckForName(...) && !CheckForName(...) && !...) { return false; }

[fedor.indutny, 2015/09/09 21:20:36]

Acknowledged.

+        offset = JSTypedArray::kLengthOffset;
+      } else if (Name::Equals(name, isolate->factory()->byte_length_string())) {
+        offset = JSTypedArray::kByteLengthOffset;
+      } else if (Name::Equals(name, isolate->factory()->byte_offset_string())) {
+        offset = JSTypedArray::kByteOffsetOffset;
+      } else {
+        return false;
+      }
+
+      Object* proto = map->prototype();
+      Object* original_proto =
+          JSFunction::cast(map->GetConstructor())->prototype();
+
       // %TypedArray%.prototype is non-configurable, and so are the following

[Jakob Kummerow, 2015/09/09 11:51:06]

outdated comment (there are no "following named properties" any more); also it
correctly describes an incorrect implementation

[fedor.indutny, 2015/09/09 21:20:36]

Acknowledged.

       // named properties on %TypedArray%.prototype, so we can directly inline
       // the field-load for typed array maps that still use their
       // %TypedArray%.prototype.
-      if (JSFunction::cast(map->GetConstructor())->prototype() !=
-          map->prototype()) {
+      if (original_proto == proto) {
+        *object_offset = offset;
+        return true;
+      }
+
+      if (!proto->IsJSObject()) return false;
+
+      JSObject* js_proto = JSObject::cast(proto);
+
+      // Check if the typed array is a second order child of the original
+      // constructor

[Jakob Kummerow, 2015/09/09 11:51:07]

nit: trailing full stop

[fedor.indutny, 2015/09/09 21:20:36]

Remove the comment.

+      if (js_proto->map()->prototype() != original_proto) return false;
+
+      // If the middle-prototype does not override the fast property -

[Jakob Kummerow, 2015/09/09 11:51:06]

s/ -/, then/
s/it's/its/
s/offset/offset./

[fedor.indutny, 2015/09/09 21:20:35]

Removed the comment, added the dot.

+      // return it's offset
+      Maybe<PropertyAttributes> maybe_attr =
+          JSReceiver::GetOwnPropertyAttributes(Handle<JSObject>(js_proto),

[Jakob Kummerow, 2015/09/09 11:51:06]

This should use JSReceiver::HasOwnProperty(), but see overall comment

[fedor.indutny, 2015/09/09 21:20:35]

I did it in a slightly different way... Hope it is ok.

+                                               name);
+      if (maybe_attr.IsJust() && maybe_attr.FromJust() != ABSENT) {
         return false;
       }
-      return CheckForName(name, isolate->factory()->length_string(),
-                          JSTypedArray::kLengthOffset, object_offset) ||
-             CheckForName(name, isolate->factory()->byte_length_string(),
-                          JSTypedArray::kByteLengthOffset, object_offset) ||
-             CheckForName(name, isolate->factory()->byte_offset_string(),
-                          JSTypedArray::kByteOffsetOffset, object_offset);
 
+      *object_offset = offset;
+      return true;
+      }
     case JS_DATA_VIEW_TYPE:
       return CheckForName(name, isolate->factory()->byte_length_string(),
                           JSDataView::kByteLengthOffset, object_offset) ||
              CheckForName(name, isolate->factory()->byte_offset_string(),
                           JSDataView::kByteOffsetOffset, object_offset);
     default:
       return false;
   }
 }
 
@@ skipping 1361 matching lines @@
   Handle<Object> getter = v8::FromCData(isolate, &ModuleGetExport);
   Handle<Object> setter = v8::FromCData(isolate, &ModuleSetExport);
   info->set_getter(*getter);
   if (!(attributes & ReadOnly)) info->set_setter(*setter);
   return info;
 }
 
 
 }  // namespace internal
 }  // namespace v8