[accessors] second-chance typed array field lookup

src/accessors.cc

Index: src/accessors.cc
diff --git a/src/accessors.cc b/src/accessors.cc
index 6544e7197c1283f50f9e686643650589f1ff7aab..3d67d8751d8863688aa8a18842945915de1bd3cd 100644
--- a/src/accessors.cc
+++ b/src/accessors.cc
@@ -99,22 +99,52 @@ bool Accessors::IsJSArrayBufferViewFieldAccessor(Handle<Map> map,
   Isolate* isolate = name->GetIsolate();
 
   switch (map->instance_type()) {
-    case JS_TYPED_ARRAY_TYPE:
+    case JS_TYPED_ARRAY_TYPE: {
+      int offset;
+
+      if (Name::Equals(name, isolate->factory()->length_string())) {

[Jakob Kummerow, 2015/09/09 11:51:06]

Let's keep using the existing CheckForName helper:

if (!CheckForName(...) && !CheckForName(...) && !...) { return false; }

[fedor.indutny, 2015/09/09 21:20:36]

Acknowledged.

+        offset = JSTypedArray::kLengthOffset;
+      } else if (Name::Equals(name, isolate->factory()->byte_length_string())) {
+        offset = JSTypedArray::kByteLengthOffset;
+      } else if (Name::Equals(name, isolate->factory()->byte_offset_string())) {
+        offset = JSTypedArray::kByteOffsetOffset;
+      } else {
+        return false;
+      }
+
+      Object* proto = map->prototype();
+      Object* original_proto =
+          JSFunction::cast(map->GetConstructor())->prototype();
+
       // %TypedArray%.prototype is non-configurable, and so are the following

[Jakob Kummerow, 2015/09/09 11:51:06]

outdated comment (there are no "following named properties" any more); also it
correctly describes an incorrect implementation

[fedor.indutny, 2015/09/09 21:20:36]

Acknowledged.

       // named properties on %TypedArray%.prototype, so we can directly inline
       // the field-load for typed array maps that still use their
       // %TypedArray%.prototype.
-      if (JSFunction::cast(map->GetConstructor())->prototype() !=
-          map->prototype()) {
+      if (original_proto == proto) {
+        *object_offset = offset;
+        return true;
+      }
+
+      if (!proto->IsJSObject()) return false;
+
+      JSObject* js_proto = JSObject::cast(proto);
+
+      // Check if the typed array is a second order child of the original
+      // constructor

[Jakob Kummerow, 2015/09/09 11:51:07]

nit: trailing full stop

[fedor.indutny, 2015/09/09 21:20:36]

Remove the comment.

+      if (js_proto->map()->prototype() != original_proto) return false;
+
+      // If the middle-prototype does not override the fast property -

[Jakob Kummerow, 2015/09/09 11:51:06]

s/ -/, then/
s/it's/its/
s/offset/offset./

[fedor.indutny, 2015/09/09 21:20:35]

Removed the comment, added the dot.

+      // return it's offset
+      Maybe<PropertyAttributes> maybe_attr =
+          JSReceiver::GetOwnPropertyAttributes(Handle<JSObject>(js_proto),

[Jakob Kummerow, 2015/09/09 11:51:06]

This should use JSReceiver::HasOwnProperty(), but see overall comment

[fedor.indutny, 2015/09/09 21:20:35]

I did it in a slightly different way... Hope it is ok.

+                                               name);
+      if (maybe_attr.IsJust() && maybe_attr.FromJust() != ABSENT) {
         return false;
       }
-      return CheckForName(name, isolate->factory()->length_string(),
-                          JSTypedArray::kLengthOffset, object_offset) ||
-             CheckForName(name, isolate->factory()->byte_length_string(),
-                          JSTypedArray::kByteLengthOffset, object_offset) ||
-             CheckForName(name, isolate->factory()->byte_offset_string(),
-                          JSTypedArray::kByteOffsetOffset, object_offset);
 
+      *object_offset = offset;
+      return true;
+      }
     case JS_DATA_VIEW_TYPE:
       return CheckForName(name, isolate->factory()->byte_length_string(),
                           JSDataView::kByteLengthOffset, object_offset) ||