| OLD | NEW |
| 1 // Copyright 2012 the V8 project authors. All rights reserved. | 1 // Copyright 2012 the V8 project authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #include "src/isolate.h" | 5 #include "src/isolate.h" |
| 6 | 6 |
| 7 #include <stdlib.h> | 7 #include <stdlib.h> |
| 8 | 8 |
| 9 #include <fstream> // NOLINT(readability/streams) | 9 #include <fstream> // NOLINT(readability/streams) |
| 10 #include <sstream> | 10 #include <sstream> |
| (...skipping 2530 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 2541 DCHECK_EQ(false, cell_reports_intact); | 2541 DCHECK_EQ(false, cell_reports_intact); |
| 2542 return cell_reports_intact; | 2542 return cell_reports_intact; |
| 2543 } | 2543 } |
| 2544 | 2544 |
| 2545 #endif | 2545 #endif |
| 2546 | 2546 |
| 2547 return cell_reports_intact; | 2547 return cell_reports_intact; |
| 2548 } | 2548 } |
| 2549 | 2549 |
| 2550 bool Isolate::IsArraySpeciesLookupChainIntact() { | 2550 bool Isolate::IsArraySpeciesLookupChainIntact() { |
| 2551 if (!FLAG_harmony_species) return true; |
| 2551 // Note: It would be nice to have debug checks to make sure that the | 2552 // Note: It would be nice to have debug checks to make sure that the |
| 2552 // species protector is accurate, but this would be hard to do for most of | 2553 // species protector is accurate, but this would be hard to do for most of |
| 2553 // what the protector stands for: | 2554 // what the protector stands for: |
| 2554 // - You'd need to traverse the heap to check that no Array instance has | 2555 // - You'd need to traverse the heap to check that no Array instance has |
| 2555 // a constructor property or a modified __proto__ | 2556 // a constructor property or a modified __proto__ |
| 2556 // - To check that Array[Symbol.species] == Array, JS code has to execute, | 2557 // - To check that Array[Symbol.species] == Array, JS code has to execute, |
| 2557 // but JS cannot be invoked in callstack overflow situations | 2558 // but JS cannot be invoked in callstack overflow situations |
| 2558 // All that could be checked reliably is that | 2559 // All that could be checked reliably is that |
| 2559 // Array.prototype.constructor == Array. Given that limitation, no check is | 2560 // Array.prototype.constructor == Array. Given that limitation, no check is |
| 2560 // done here. In place, there are mjsunit tests harmony/array-species* which | 2561 // done here. In place, there are mjsunit tests harmony/array-species* which |
| 2561 // ensure that behavior is correct in various invalid protector cases. | 2562 // ensure that behavior is correct in various invalid protector cases. |
| 2562 | 2563 |
| 2563 PropertyCell* species_cell = heap()->species_protector(); | 2564 PropertyCell* species_cell = heap()->species_protector(); |
| 2564 return species_cell->value()->IsSmi() && | 2565 return species_cell->value()->IsSmi() && |
| 2565 Smi::cast(species_cell->value())->value() == kArrayProtectorValid; | 2566 Smi::cast(species_cell->value())->value() == kArrayProtectorValid; |
| 2566 } | 2567 } |
| 2567 | 2568 |
| 2568 void Isolate::InvalidateArraySpeciesProtector() { | 2569 void Isolate::InvalidateArraySpeciesProtector() { |
| 2570 if (!FLAG_harmony_species) return; |
| 2569 DCHECK(factory()->species_protector()->value()->IsSmi()); | 2571 DCHECK(factory()->species_protector()->value()->IsSmi()); |
| 2570 DCHECK(IsArraySpeciesLookupChainIntact()); | 2572 DCHECK(IsArraySpeciesLookupChainIntact()); |
| 2571 PropertyCell::SetValueWithInvalidation( | 2573 PropertyCell::SetValueWithInvalidation( |
| 2572 factory()->species_protector(), | 2574 factory()->species_protector(), |
| 2573 handle(Smi::FromInt(kArrayProtectorInvalid), this)); | 2575 handle(Smi::FromInt(kArrayProtectorInvalid), this)); |
| 2574 DCHECK(!IsArraySpeciesLookupChainIntact()); | 2576 DCHECK(!IsArraySpeciesLookupChainIntact()); |
| 2575 } | 2577 } |
| 2576 | 2578 |
| 2577 void Isolate::UpdateArrayProtectorOnSetElement(Handle<JSObject> object) { | 2579 void Isolate::UpdateArrayProtectorOnSetElement(Handle<JSObject> object) { |
| 2578 DisallowHeapAllocation no_gc; | 2580 DisallowHeapAllocation no_gc; |
| (...skipping 410 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 2989 // Then check whether this scope intercepts. | 2991 // Then check whether this scope intercepts. |
| 2990 if ((flag & intercept_mask_)) { | 2992 if ((flag & intercept_mask_)) { |
| 2991 intercepted_flags_ |= flag; | 2993 intercepted_flags_ |= flag; |
| 2992 return true; | 2994 return true; |
| 2993 } | 2995 } |
| 2994 return false; | 2996 return false; |
| 2995 } | 2997 } |
| 2996 | 2998 |
| 2997 } // namespace internal | 2999 } // namespace internal |
| 2998 } // namespace v8 | 3000 } // namespace v8 |
| OLD | NEW |