OLD | NEW |
---|---|
1 // Copyright 2012 the V8 project authors. All rights reserved. | 1 // Copyright 2012 the V8 project authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include "src/builtins.h" | 5 #include "src/builtins.h" |
6 | 6 |
7 #include "src/api.h" | 7 #include "src/api.h" |
8 #include "src/api-arguments.h" | 8 #include "src/api-arguments.h" |
9 #include "src/api-natives.h" | 9 #include "src/api-natives.h" |
10 #include "src/base/once.h" | 10 #include "src/base/once.h" |
(...skipping 205 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... | |
216 | 216 |
217 | 217 |
218 inline bool PrototypeHasNoElements(PrototypeIterator* iter) { | 218 inline bool PrototypeHasNoElements(PrototypeIterator* iter) { |
219 DisallowHeapAllocation no_gc; | 219 DisallowHeapAllocation no_gc; |
220 for (; !iter->IsAtEnd(); iter->Advance()) { | 220 for (; !iter->IsAtEnd(); iter->Advance()) { |
221 if (iter->GetCurrent()->IsJSProxy()) return false; | 221 if (iter->GetCurrent()->IsJSProxy()) return false; |
222 JSObject* current = iter->GetCurrent<JSObject>(); | 222 JSObject* current = iter->GetCurrent<JSObject>(); |
223 if (current->IsAccessCheckNeeded()) return false; | 223 if (current->IsAccessCheckNeeded()) return false; |
224 if (current->HasIndexedInterceptor()) return false; | 224 if (current->HasIndexedInterceptor()) return false; |
225 if (current->elements()->length() != 0) return false; | 225 if (current->elements()->length() != 0) return false; |
226 if (current->HasStringWrapperElements()) return false; | |
226 } | 227 } |
227 return true; | 228 return true; |
228 } | 229 } |
229 | 230 |
230 | |
231 inline bool IsJSArrayFastElementMovingAllowed(Isolate* isolate, | 231 inline bool IsJSArrayFastElementMovingAllowed(Isolate* isolate, |
232 JSArray* receiver) { | 232 JSArray* receiver) { |
233 DisallowHeapAllocation no_gc; | 233 DisallowHeapAllocation no_gc; |
234 // If the array prototype chain is intact (and free of elements), and if the | 234 // If the array prototype chain is intact (and free of elements), and if the |
235 // receiver's prototype is the array prototype, then we are done. | 235 // receiver's prototype is the array prototype, then we are done. |
236 Object* prototype = receiver->map()->prototype(); | 236 Object* prototype = receiver->map()->prototype(); |
237 if (prototype->IsJSArray() && | 237 if (prototype->IsJSArray() && |
238 isolate->is_initial_array_prototype(JSArray::cast(prototype)) && | 238 isolate->is_initial_array_prototype(JSArray::cast(prototype)) && |
239 isolate->IsFastArrayConstructorPrototypeChainIntact()) { | 239 isolate->IsFastArrayConstructorPrototypeChainIntact()) { |
240 return true; | 240 return true; |
241 } | 241 } |
242 | |
243 // Slow case. | 242 // Slow case. |
244 PrototypeIterator iter(isolate, receiver); | 243 PrototypeIterator iter(isolate, receiver); |
245 return PrototypeHasNoElements(&iter); | 244 return PrototypeHasNoElements(&iter); |
246 } | 245 } |
247 | 246 |
247 inline bool HasOnlySimpleReceiverElements(Isolate* isolate, | |
248 JSReceiver* receiver) { | |
249 // Check that we have no accessors on the receiver's elements. | |
250 JSObject* object = JSObject::cast(receiver); | |
251 if (object->GetElementsAccessor()->HasAccessors(object)) return false; | |
252 // Check that ther are not elements on the prototype. | |
253 DisallowHeapAllocation no_gc; | |
254 PrototypeIterator iter(isolate, receiver); | |
255 return PrototypeHasNoElements(&iter); | |
256 } | |
257 | |
258 inline bool HasOnlySimpleElements(Isolate* isolate, JSReceiver* receiver) { | |
259 // Check that ther are not elements on the prototype. | |
260 DisallowHeapAllocation no_gc; | |
261 PrototypeIterator iter(isolate, receiver, | |
262 PrototypeIterator::START_AT_RECEIVER); | |
263 for (; !iter.IsAtEnd(); iter.Advance()) { | |
264 if (iter.GetCurrent()->IsJSProxy()) return false; | |
265 JSObject* current = iter.GetCurrent<JSObject>(); | |
266 if (current->IsAccessCheckNeeded()) return false; | |
267 if (current->HasIndexedInterceptor()) return false; | |
268 if (current->HasStringWrapperElements()) return false; | |
269 if (current->GetElementsAccessor()->HasAccessors(current)) return false; | |
270 } | |
271 return true; | |
272 } | |
273 | |
248 // Returns |false| if not applicable. | 274 // Returns |false| if not applicable. |
249 MUST_USE_RESULT | 275 MUST_USE_RESULT |
250 inline bool EnsureJSArrayWithWritableFastElements(Isolate* isolate, | 276 inline bool EnsureJSArrayWithWritableFastElements(Isolate* isolate, |
251 Handle<Object> receiver, | 277 Handle<Object> receiver, |
252 Arguments* args, | 278 Arguments* args, |
253 int first_added_arg) { | 279 int first_added_arg) { |
254 if (!receiver->IsJSArray()) return false; | 280 if (!receiver->IsJSArray()) return false; |
255 Handle<JSArray> array = Handle<JSArray>::cast(receiver); | 281 Handle<JSArray> array = Handle<JSArray>::cast(receiver); |
256 // If there may be elements accessors in the prototype chain, the fast path | 282 // If there may be elements accessors in the prototype chain, the fast path |
257 // cannot be used if there arguments to add to the array. | 283 // cannot be used if there arguments to add to the array. |
258 if (args != nullptr && !IsJSArrayFastElementMovingAllowed(isolate, *array)) { | 284 if (args != nullptr && !IsJSArrayFastElementMovingAllowed(isolate, *array)) { |
259 return false; | 285 return false; |
260 } | 286 } |
261 ElementsKind origin_kind = array->map()->elements_kind(); | 287 ElementsKind origin_kind = array->GetElementsKind(); |
262 if (IsDictionaryElementsKind(origin_kind)) return false; | 288 if (IsDictionaryElementsKind(origin_kind)) return false; |
263 if (array->map()->is_observed()) return false; | 289 if (array->map()->is_observed()) return false; |
264 if (!array->map()->is_extensible()) return false; | 290 if (!array->map()->is_extensible()) return false; |
265 if (args == nullptr) return true; | 291 if (args == nullptr) return true; |
266 | 292 |
267 // Adding elements to the array prototype would break code that makes sure | 293 // Adding elements to the array prototype would break code that makes sure |
268 // it has no elements. Handle that elsewhere. | 294 // it has no elements. Handle that elsewhere. |
269 if (isolate->IsAnyInitialArrayPrototype(array)) return false; | 295 if (isolate->IsAnyInitialArrayPrototype(array)) return false; |
270 | 296 |
271 // Need to ensure that the arguments passed in args can be contained in | 297 // Need to ensure that the arguments passed in args can be contained in |
(...skipping 784 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... | |
1056 Handle<Object> key = isolate->factory()->length_string(); | 1082 Handle<Object> key = isolate->factory()->length_string(); |
1057 ASSIGN_RETURN_ON_EXCEPTION_VALUE( | 1083 ASSIGN_RETURN_ON_EXCEPTION_VALUE( |
1058 isolate, val, Runtime::GetObjectProperty(isolate, receiver, key), | 1084 isolate, val, Runtime::GetObjectProperty(isolate, receiver, key), |
1059 false); | 1085 false); |
1060 ASSIGN_RETURN_ON_EXCEPTION_VALUE(isolate, val, | 1086 ASSIGN_RETURN_ON_EXCEPTION_VALUE(isolate, val, |
1061 Object::ToLength(isolate, val), false); | 1087 Object::ToLength(isolate, val), false); |
1062 // TODO(caitp): Support larger element indexes (up to 2^53-1). | 1088 // TODO(caitp): Support larger element indexes (up to 2^53-1). |
1063 if (!val->ToUint32(&length)) { | 1089 if (!val->ToUint32(&length)) { |
1064 length = 0; | 1090 length = 0; |
1065 } | 1091 } |
1092 // TODO(cbruni): handle other element kind as well | |
1093 return IterateElementsSlow(isolate, receiver, length, visitor); | |
1066 } | 1094 } |
1067 | 1095 |
1068 if (!receiver->IsJSArray()) { | 1096 if (!HasOnlySimpleElements(isolate, *receiver)) { |
Toon Verwaest
2016/03/15 19:10:15
I'd keep the IsJSArray for now to ensure that the
| |
1069 // For classes which are not known to be safe to access via elements alone, | |
1070 // use the slow case. | |
1071 return IterateElementsSlow(isolate, receiver, length, visitor); | 1097 return IterateElementsSlow(isolate, receiver, length, visitor); |
1072 } | 1098 } |
1073 Handle<JSObject> array = Handle<JSObject>::cast(receiver); | 1099 Handle<JSObject> array = Handle<JSObject>::cast(receiver); |
1074 | 1100 |
1075 switch (array->GetElementsKind()) { | 1101 switch (array->GetElementsKind()) { |
1076 case FAST_SMI_ELEMENTS: | 1102 case FAST_SMI_ELEMENTS: |
1077 case FAST_ELEMENTS: | 1103 case FAST_ELEMENTS: |
1078 case FAST_HOLEY_SMI_ELEMENTS: | 1104 case FAST_HOLEY_SMI_ELEMENTS: |
1079 case FAST_HOLEY_ELEMENTS: { | 1105 case FAST_HOLEY_ELEMENTS: { |
1080 // Run through the elements FixedArray and use HasElement and GetElement | 1106 // Run through the elements FixedArray and use HasElement and GetElement |
1081 // to check the prototype for missing elements. | 1107 // to check the prototype for missing elements. |
1082 Handle<FixedArray> elements(FixedArray::cast(array->elements())); | 1108 Handle<FixedArray> elements(FixedArray::cast(array->elements())); |
1083 int fast_length = static_cast<int>(length); | 1109 int fast_length = static_cast<int>(length); |
1084 DCHECK(fast_length <= elements->length()); | 1110 fast_length = Min(fast_length, elements->length()); |
1085 for (int j = 0; j < fast_length; j++) { | 1111 for (int j = 0; j < fast_length; j++) { |
1086 HandleScope loop_scope(isolate); | 1112 HandleScope loop_scope(isolate); |
1087 Handle<Object> element_value(elements->get(j), isolate); | 1113 Handle<Object> element_value(elements->get(j), isolate); |
1088 if (!element_value->IsTheHole()) { | 1114 if (!element_value->IsTheHole()) { |
1089 if (!visitor->visit(j, element_value)) return false; | 1115 if (!visitor->visit(j, element_value)) return false; |
1090 } else { | 1116 } else { |
1091 Maybe<bool> maybe = JSReceiver::HasElement(array, j); | 1117 Maybe<bool> maybe = JSReceiver::HasElement(array, j); |
1092 if (!maybe.IsJust()) return false; | 1118 if (!maybe.IsJust()) return false; |
1093 if (maybe.FromJust()) { | 1119 if (maybe.FromJust()) { |
1094 // Call GetElement on array, not its prototype, or getters won't | 1120 // Call GetElement on array, not its prototype, or getters won't |
(...skipping 39 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... | |
1134 isolate, element_value, | 1160 isolate, element_value, |
1135 JSReceiver::GetElement(isolate, array, j), false); | 1161 JSReceiver::GetElement(isolate, array, j), false); |
1136 if (!visitor->visit(j, element_value)) return false; | 1162 if (!visitor->visit(j, element_value)) return false; |
1137 } | 1163 } |
1138 } | 1164 } |
1139 } | 1165 } |
1140 break; | 1166 break; |
1141 } | 1167 } |
1142 | 1168 |
1143 case DICTIONARY_ELEMENTS: { | 1169 case DICTIONARY_ELEMENTS: { |
1144 // CollectElementIndices() can't be called when there's a JSProxy | |
1145 // on the prototype chain. | |
1146 for (PrototypeIterator iter(isolate, array); !iter.IsAtEnd(); | |
1147 iter.Advance()) { | |
1148 if (PrototypeIterator::GetCurrent(iter)->IsJSProxy()) { | |
1149 return IterateElementsSlow(isolate, array, length, visitor); | |
1150 } | |
1151 } | |
1152 Handle<SeededNumberDictionary> dict(array->element_dictionary()); | 1170 Handle<SeededNumberDictionary> dict(array->element_dictionary()); |
1153 List<uint32_t> indices(dict->Capacity() / 2); | 1171 List<uint32_t> indices(dict->Capacity() / 2); |
1154 // Collect all indices in the object and the prototypes less | 1172 // Collect all indices in the object and the prototypes less |
1155 // than length. This might introduce duplicates in the indices list. | 1173 // than length. This might introduce duplicates in the indices list. |
1156 CollectElementIndices(array, length, &indices); | 1174 CollectElementIndices(array, length, &indices); |
1157 indices.Sort(&compareUInt32); | 1175 indices.Sort(&compareUInt32); |
1158 int j = 0; | 1176 int j = 0; |
1159 int n = indices.length(); | 1177 int n = indices.length(); |
1160 while (j < n) { | 1178 while (j < n) { |
1161 HandleScope loop_scope(isolate); | 1179 HandleScope loop_scope(isolate); |
(...skipping 20 matching lines...) Expand all Loading... | |
1182 false); | 1200 false); |
1183 if (!visitor->visit(index, element)) return false; | 1201 if (!visitor->visit(index, element)) return false; |
1184 } | 1202 } |
1185 break; | 1203 break; |
1186 } | 1204 } |
1187 case NO_ELEMENTS: | 1205 case NO_ELEMENTS: |
1188 break; | 1206 break; |
1189 #define TYPED_ARRAY_CASE(Type, type, TYPE, ctype, size) case TYPE##_ELEMENTS: | 1207 #define TYPED_ARRAY_CASE(Type, type, TYPE, ctype, size) case TYPE##_ELEMENTS: |
1190 TYPED_ARRAYS(TYPED_ARRAY_CASE) | 1208 TYPED_ARRAYS(TYPED_ARRAY_CASE) |
1191 #undef TYPED_ARRAY_CASE | 1209 #undef TYPED_ARRAY_CASE |
1210 return IterateElementsSlow(isolate, receiver, length, visitor); | |
1192 case FAST_STRING_WRAPPER_ELEMENTS: | 1211 case FAST_STRING_WRAPPER_ELEMENTS: |
1193 case SLOW_STRING_WRAPPER_ELEMENTS: | 1212 case SLOW_STRING_WRAPPER_ELEMENTS: |
1194 // |array| is guaranteed to be an array or typed array. | 1213 // |array| is guaranteed to be an array or typed array. |
1195 UNREACHABLE(); | 1214 UNREACHABLE(); |
1196 break; | 1215 break; |
1197 } | 1216 } |
1198 visitor->increase_index_offset(length); | 1217 visitor->increase_index_offset(length); |
1199 return true; | 1218 return true; |
1200 } | 1219 } |
1201 | 1220 |
(...skipping 37 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... | |
1239 for (int i = 0; i < argument_count; i++) { | 1258 for (int i = 0; i < argument_count; i++) { |
1240 HandleScope loop_scope(isolate); | 1259 HandleScope loop_scope(isolate); |
1241 Handle<Object> obj((*args)[i], isolate); | 1260 Handle<Object> obj((*args)[i], isolate); |
1242 uint32_t length_estimate; | 1261 uint32_t length_estimate; |
1243 uint32_t element_estimate; | 1262 uint32_t element_estimate; |
1244 if (obj->IsJSArray()) { | 1263 if (obj->IsJSArray()) { |
1245 Handle<JSArray> array(Handle<JSArray>::cast(obj)); | 1264 Handle<JSArray> array(Handle<JSArray>::cast(obj)); |
1246 length_estimate = static_cast<uint32_t>(array->length()->Number()); | 1265 length_estimate = static_cast<uint32_t>(array->length()->Number()); |
1247 if (length_estimate != 0) { | 1266 if (length_estimate != 0) { |
1248 ElementsKind array_kind = | 1267 ElementsKind array_kind = |
1249 GetPackedElementsKind(array->map()->elements_kind()); | 1268 GetPackedElementsKind(array->GetElementsKind()); |
1250 kind = GetMoreGeneralElementsKind(kind, array_kind); | 1269 kind = GetMoreGeneralElementsKind(kind, array_kind); |
1251 } | 1270 } |
1252 element_estimate = EstimateElementCount(array); | 1271 element_estimate = EstimateElementCount(array); |
1253 } else { | 1272 } else { |
1254 if (obj->IsHeapObject()) { | 1273 if (obj->IsHeapObject()) { |
1255 if (obj->IsNumber()) { | 1274 kind = GetMoreGeneralElementsKind( |
1256 kind = GetMoreGeneralElementsKind(kind, FAST_DOUBLE_ELEMENTS); | 1275 kind, obj->IsNumber() ? FAST_DOUBLE_ELEMENTS : FAST_ELEMENTS); |
1257 } else { | |
1258 kind = GetMoreGeneralElementsKind(kind, FAST_ELEMENTS); | |
1259 } | |
1260 } | 1276 } |
1261 length_estimate = 1; | 1277 length_estimate = 1; |
1262 element_estimate = 1; | 1278 element_estimate = 1; |
1263 } | 1279 } |
1264 // Avoid overflows by capping at kMaxElementCount. | 1280 // Avoid overflows by capping at kMaxElementCount. |
1265 if (JSObject::kMaxElementCount - estimate_result_length < length_estimate) { | 1281 if (JSObject::kMaxElementCount - estimate_result_length < length_estimate) { |
1266 estimate_result_length = JSObject::kMaxElementCount; | 1282 estimate_result_length = JSObject::kMaxElementCount; |
1267 } else { | 1283 } else { |
1268 estimate_result_length += length_estimate; | 1284 estimate_result_length += length_estimate; |
1269 } | 1285 } |
(...skipping 22 matching lines...) Expand all Loading... | |
1292 Handle<Object> obj((*args)[i], isolate); | 1308 Handle<Object> obj((*args)[i], isolate); |
1293 if (obj->IsSmi()) { | 1309 if (obj->IsSmi()) { |
1294 double_storage->set(j, Smi::cast(*obj)->value()); | 1310 double_storage->set(j, Smi::cast(*obj)->value()); |
1295 j++; | 1311 j++; |
1296 } else if (obj->IsNumber()) { | 1312 } else if (obj->IsNumber()) { |
1297 double_storage->set(j, obj->Number()); | 1313 double_storage->set(j, obj->Number()); |
1298 j++; | 1314 j++; |
1299 } else { | 1315 } else { |
1300 JSArray* array = JSArray::cast(*obj); | 1316 JSArray* array = JSArray::cast(*obj); |
1301 uint32_t length = static_cast<uint32_t>(array->length()->Number()); | 1317 uint32_t length = static_cast<uint32_t>(array->length()->Number()); |
1302 switch (array->map()->elements_kind()) { | 1318 switch (array->GetElementsKind()) { |
1303 case FAST_HOLEY_DOUBLE_ELEMENTS: | 1319 case FAST_HOLEY_DOUBLE_ELEMENTS: |
1304 case FAST_DOUBLE_ELEMENTS: { | 1320 case FAST_DOUBLE_ELEMENTS: { |
1305 // Empty array is FixedArray but not FixedDoubleArray. | 1321 // Empty array is FixedArray but not FixedDoubleArray. |
1306 if (length == 0) break; | 1322 if (length == 0) break; |
1307 FixedDoubleArray* elements = | 1323 FixedDoubleArray* elements = |
1308 FixedDoubleArray::cast(array->elements()); | 1324 FixedDoubleArray::cast(array->elements()); |
1309 for (uint32_t i = 0; i < length; i++) { | 1325 for (uint32_t i = 0; i < length; i++) { |
1310 if (elements->is_the_hole(i)) { | 1326 if (elements->is_the_hole(i)) { |
1311 // TODO(jkummerow/verwaest): We could be a bit more clever | 1327 // TODO(jkummerow/verwaest): We could be a bit more clever |
1312 // here: Check if there are no elements/getters on the | 1328 // here: Check if there are no elements/getters on the |
(...skipping 31 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... | |
1344 DCHECK_EQ(0u, length); | 1360 DCHECK_EQ(0u, length); |
1345 break; | 1361 break; |
1346 default: | 1362 default: |
1347 UNREACHABLE(); | 1363 UNREACHABLE(); |
1348 } | 1364 } |
1349 } | 1365 } |
1350 if (failure) break; | 1366 if (failure) break; |
1351 } | 1367 } |
1352 } | 1368 } |
1353 if (!failure) { | 1369 if (!failure) { |
1354 Handle<JSArray> array = isolate->factory()->NewJSArray(0); | 1370 return *isolate->factory()->NewJSArrayWithElements(storage, kind, j); |
1355 Smi* length = Smi::FromInt(j); | |
1356 Handle<Map> map; | |
1357 map = JSObject::GetElementsTransitionMap(array, kind); | |
1358 array->set_map(*map); | |
1359 array->set_length(length); | |
1360 array->set_elements(*storage); | |
1361 return *array; | |
1362 } | 1371 } |
1363 // In case of failure, fall through. | 1372 // In case of failure, fall through. |
1364 } | 1373 } |
1365 | 1374 |
1366 Handle<Object> storage; | 1375 Handle<Object> storage; |
1367 if (fast_case) { | 1376 if (fast_case) { |
1368 // The backing storage array must have non-existing elements to preserve | 1377 // The backing storage array must have non-existing elements to preserve |
1369 // holes across concat operations. | 1378 // holes across concat operations. |
1370 storage = | 1379 storage = |
1371 isolate->factory()->NewFixedArrayWithHoles(estimate_result_length); | 1380 isolate->factory()->NewFixedArrayWithHoles(estimate_result_length); |
(...skipping 36 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... | |
1408 | 1417 |
1409 if (is_array_species) { | 1418 if (is_array_species) { |
1410 return *visitor.ToArray(); | 1419 return *visitor.ToArray(); |
1411 } else { | 1420 } else { |
1412 return *visitor.storage_jsreceiver(); | 1421 return *visitor.storage_jsreceiver(); |
1413 } | 1422 } |
1414 } | 1423 } |
1415 | 1424 |
1416 | 1425 |
1417 MaybeHandle<JSArray> Fast_ArrayConcat(Isolate* isolate, Arguments* args) { | 1426 MaybeHandle<JSArray> Fast_ArrayConcat(Isolate* isolate, Arguments* args) { |
1418 if (!isolate->IsFastArrayConstructorPrototypeChainIntact()) { | |
1419 return MaybeHandle<JSArray>(); | |
1420 } | |
1421 int n_arguments = args->length(); | 1427 int n_arguments = args->length(); |
1422 int result_len = 0; | 1428 int result_len = 0; |
1423 { | 1429 { |
1424 DisallowHeapAllocation no_gc; | 1430 DisallowHeapAllocation no_gc; |
1425 Object* array_proto = isolate->array_function()->prototype(); | |
1426 // Iterate through all the arguments performing checks | 1431 // Iterate through all the arguments performing checks |
1427 // and calculating total length. | 1432 // and calculating total length. |
1428 for (int i = 0; i < n_arguments; i++) { | 1433 for (int i = 0; i < n_arguments; i++) { |
1429 Object* arg = (*args)[i]; | 1434 Object* arg = (*args)[i]; |
1430 if (!arg->IsJSArray()) return MaybeHandle<JSArray>(); | 1435 if (!arg->IsJSArray()) return MaybeHandle<JSArray>(); |
1436 if (!HasOnlySimpleReceiverElements(isolate, JSObject::cast(arg))) { | |
1437 return MaybeHandle<JSArray>(); | |
1438 } | |
1439 // TODO(cbruni): support fast concatenation of DICTIONARY_ELEMENTS. | |
1440 if (!JSObject::cast(arg)->HasFastElements()) { | |
1441 return MaybeHandle<JSArray>(); | |
1442 } | |
1431 Handle<JSArray> array(JSArray::cast(arg), isolate); | 1443 Handle<JSArray> array(JSArray::cast(arg), isolate); |
1432 if (!array->HasFastElements()) return MaybeHandle<JSArray>(); | |
1433 PrototypeIterator iter(isolate, *array); | |
1434 if (iter.GetCurrent() != array_proto) return MaybeHandle<JSArray>(); | |
1435 if (HasConcatSpreadableModifier(isolate, array)) { | 1444 if (HasConcatSpreadableModifier(isolate, array)) { |
1436 return MaybeHandle<JSArray>(); | 1445 return MaybeHandle<JSArray>(); |
1437 } | 1446 } |
1438 int len = Smi::cast(array->length())->value(); | 1447 int len = Smi::cast(array->length())->value(); |
1439 | 1448 |
1440 // We shouldn't overflow when adding another len. | 1449 // We shouldn't overflow when adding another len. |
1441 const int kHalfOfMaxInt = 1 << (kBitsPerInt - 2); | 1450 const int kHalfOfMaxInt = 1 << (kBitsPerInt - 2); |
1442 STATIC_ASSERT(FixedArray::kMaxLength < kHalfOfMaxInt); | 1451 STATIC_ASSERT(FixedArray::kMaxLength < kHalfOfMaxInt); |
1443 USE(kHalfOfMaxInt); | 1452 USE(kHalfOfMaxInt); |
1444 result_len += len; | 1453 result_len += len; |
(...skipping 3088 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... | |
4533 BUILTIN_LIST_C(DEFINE_BUILTIN_ACCESSOR_C) | 4542 BUILTIN_LIST_C(DEFINE_BUILTIN_ACCESSOR_C) |
4534 BUILTIN_LIST_A(DEFINE_BUILTIN_ACCESSOR_A) | 4543 BUILTIN_LIST_A(DEFINE_BUILTIN_ACCESSOR_A) |
4535 BUILTIN_LIST_H(DEFINE_BUILTIN_ACCESSOR_H) | 4544 BUILTIN_LIST_H(DEFINE_BUILTIN_ACCESSOR_H) |
4536 BUILTIN_LIST_DEBUG_A(DEFINE_BUILTIN_ACCESSOR_A) | 4545 BUILTIN_LIST_DEBUG_A(DEFINE_BUILTIN_ACCESSOR_A) |
4537 #undef DEFINE_BUILTIN_ACCESSOR_C | 4546 #undef DEFINE_BUILTIN_ACCESSOR_C |
4538 #undef DEFINE_BUILTIN_ACCESSOR_A | 4547 #undef DEFINE_BUILTIN_ACCESSOR_A |
4539 | 4548 |
4540 | 4549 |
4541 } // namespace internal | 4550 } // namespace internal |
4542 } // namespace v8 | 4551 } // namespace v8 |
OLD | NEW |