[proxies] Remove "fix" functionality, add (still unused) target property.

src/factory.cc

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/factory.h"
 
 #include "src/allocation-site-scopes.h"
 #include "src/base/bits.h"
 #include "src/bootstrapper.h"
 #include "src/conversions.h"
@@ skipping 1918 matching lines @@
 
 Handle<JSDataView> Factory::NewJSDataView(Handle<JSArrayBuffer> buffer,
                                           size_t byte_offset,
                                           size_t byte_length) {
   Handle<JSDataView> obj = NewJSDataView();
   SetupArrayBufferView(isolate(), obj, buffer, byte_offset, byte_length);
   return obj;
 }
 
 
-Handle<JSProxy> Factory::NewJSProxy(Handle<Object> handler,
+Handle<JSProxy> Factory::NewJSProxy(Handle<JSReceiver> target,
+                                    Handle<JSReceiver> handler,
                                     Handle<Object> prototype) {
   // Allocate map.
   // TODO(rossberg): Once we optimize proxies, think about a scheme to share
   // maps. Will probably depend on the identity of the handler object, too.
   Handle<Map> map = NewMap(JS_PROXY_TYPE, JSProxy::kSize);
   Map::SetPrototype(map, prototype);
 
   // Allocate the proxy object.
   Handle<JSProxy> result = New<JSProxy>(map, NEW_SPACE);
-  result->InitializeBody(map->instance_size(), Smi::FromInt(0));
+  result->set_target(*target);
   result->set_handler(*handler);
   result->set_hash(*undefined_value(), SKIP_WRITE_BARRIER);
   return result;
 }
 
 
-Handle<JSProxy> Factory::NewJSFunctionProxy(Handle<Object> handler,
+Handle<JSProxy> Factory::NewJSFunctionProxy(Handle<JSReceiver> target,
+                                            Handle<JSReceiver> handler,
                                             Handle<JSReceiver> call_trap,
                                             Handle<Object> construct_trap,
                                             Handle<Object> prototype) {
   // Allocate map.
   // TODO(rossberg): Once we optimize proxies, think about a scheme to share
   // maps. Will probably depend on the identity of the handler object, too.
   Handle<Map> map = NewMap(JS_FUNCTION_PROXY_TYPE, JSFunctionProxy::kSize);
   Map::SetPrototype(map, prototype);
   map->set_is_callable();
   map->set_is_constructor(construct_trap->IsCallable());
 
   // Allocate the proxy object.
   Handle<JSFunctionProxy> result = New<JSFunctionProxy>(map, NEW_SPACE);
-  result->InitializeBody(map->instance_size(), Smi::FromInt(0));
+  result->set_target(*target);
   result->set_handler(*handler);
   result->set_hash(*undefined_value(), SKIP_WRITE_BARRIER);
   result->set_call_trap(*call_trap);
   result->set_construct_trap(*construct_trap);
   return result;
 }
 
 
-void Factory::ReinitializeJSProxy(Handle<JSProxy> proxy, InstanceType type,
-                                  int size) {
-  DCHECK(type == JS_OBJECT_TYPE || type == JS_FUNCTION_TYPE);
-
-  Handle<Map> proxy_map(proxy->map());
-  Handle<Map> map = Map::FixProxy(proxy_map, type, size);
-
-  // Check that the receiver has at least the size of the fresh object.
-  int size_difference = proxy_map->instance_size() - map->instance_size();
-  DCHECK(size_difference >= 0);
-
-  // Allocate the backing storage for the properties.
-  Handle<FixedArray> properties = empty_fixed_array();
-
-  Heap* heap = isolate()->heap();
-  MaybeHandle<SharedFunctionInfo> shared;
-  if (type == JS_FUNCTION_TYPE) {
-    OneByteStringKey key(STATIC_CHAR_VECTOR("<freezing call trap>"),
-                         heap->HashSeed());
-    Handle<String> name = InternalizeStringWithKey(&key);
-    shared = NewSharedFunctionInfo(name, MaybeHandle<Code>());
-  }
-
-  // In order to keep heap in consistent state there must be no allocations
-  // before object re-initialization is finished and filler object is installed.
-  DisallowHeapAllocation no_allocation;
-
-  // Put in filler if the new object is smaller than the old.
-  if (size_difference > 0) {
-    Address address = proxy->address();
-    heap->CreateFillerObjectAt(address + map->instance_size(), size_difference);
-    heap->AdjustLiveBytes(*proxy, -size_difference,
-                          Heap::CONCURRENT_TO_SWEEPER);
-  }
-
-  // Reset the map for the object.
-  proxy->synchronized_set_map(*map);
-  Handle<JSObject> jsobj = Handle<JSObject>::cast(proxy);
-
-  // Reinitialize the object from the constructor map.
-  heap->InitializeJSObjectFromMap(*jsobj, *properties, *map);
-
-  // The current native context is used to set up certain bits.
-  // TODO(adamk): Using the current context seems wrong, it should be whatever
-  // context the JSProxy originated in. But that context isn't stored anywhere.
-  Handle<Context> context(isolate()->native_context());
-
-  // Functions require some minimal initialization.
-  if (type == JS_FUNCTION_TYPE) {
-    map->set_is_constructor(true);
-    map->set_is_callable();
-    Handle<JSFunction> js_function = Handle<JSFunction>::cast(proxy);
-    InitializeFunction(js_function, shared.ToHandleChecked(), context);
-  } else {
-    // Provide JSObjects with a constructor.
-    map->SetConstructor(context->object_function());
-  }
-}
-
-
 Handle<JSGlobalProxy> Factory::NewUninitializedJSGlobalProxy() {
   // Create an empty shell of a JSGlobalProxy that needs to be reinitialized
   // via ReinitializeJSGlobalProxy later.
   Handle<Map> map = NewMap(JS_GLOBAL_PROXY_TYPE, JSGlobalProxy::kSize);
   // Maintain invariant expected from any JSGlobalProxy.
   map->set_is_access_check_needed(true);
   CALL_HEAP_FUNCTION(
       isolate(), isolate()->heap()->AllocateJSObjectFromMap(*map, NOT_TENURED),
       JSGlobalProxy);
 }
@@ skipping 24 matching lines @@
 
   Heap* heap = isolate()->heap();
   // Reinitialize the object from the constructor map.
   heap->InitializeJSObjectFromMap(*object, *properties, *map);
 
   // Restore the saved hash.
   object->set_hash(*hash);
 }
 
 
-void Factory::BecomeJSObject(Handle<JSProxy> proxy) {
-  ReinitializeJSProxy(proxy, JS_OBJECT_TYPE, JSObject::kHeaderSize);
-}
-
-
-void Factory::BecomeJSFunction(Handle<JSProxy> proxy) {
-  ReinitializeJSProxy(proxy, JS_FUNCTION_TYPE, JSFunction::kSize);
-}
-
-
 Handle<SharedFunctionInfo> Factory::NewSharedFunctionInfo(
     Handle<String> name, int number_of_literals, FunctionKind kind,
     Handle<Code> code, Handle<ScopeInfo> scope_info,
     Handle<TypeFeedbackVector> feedback_vector) {
   DCHECK(IsValidFunctionKind(kind));
   Handle<SharedFunctionInfo> shared = NewSharedFunctionInfo(name, code);
   shared->set_scope_info(*scope_info);
   shared->set_feedback_vector(*feedback_vector);
   shared->set_kind(kind);
   shared->set_num_literals(number_of_literals);
@@ skipping 300 matching lines @@
 }
 
 
 Handle<Object> Factory::ToBoolean(bool value) {
   return value ? true_value() : false_value();
 }
 
 
 }  // namespace internal
 }  // namespace v8