| OLD | NEW |
| 1 // Copyright 2012 the V8 project authors. All rights reserved. | 1 // Copyright 2012 the V8 project authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #include "src/isolate.h" | 5 #include "src/isolate.h" |
| 6 | 6 |
| 7 #include <stdlib.h> | 7 #include <stdlib.h> |
| 8 | 8 |
| 9 #include <fstream> // NOLINT(readability/streams) | 9 #include <fstream> // NOLINT(readability/streams) |
| 10 #include <sstream> | 10 #include <sstream> |
| (...skipping 2494 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 2505 DCHECK_EQ(false, cell_reports_intact); | 2505 DCHECK_EQ(false, cell_reports_intact); |
| 2506 return cell_reports_intact; | 2506 return cell_reports_intact; |
| 2507 } | 2507 } |
| 2508 | 2508 |
| 2509 #endif | 2509 #endif |
| 2510 | 2510 |
| 2511 return cell_reports_intact; | 2511 return cell_reports_intact; |
| 2512 } | 2512 } |
| 2513 | 2513 |
| 2514 bool Isolate::IsArraySpeciesLookupChainIntact() { | 2514 bool Isolate::IsArraySpeciesLookupChainIntact() { |
| 2515 if (!FLAG_harmony_species) return true; |
| 2515 // Note: It would be nice to have debug checks to make sure that the | 2516 // Note: It would be nice to have debug checks to make sure that the |
| 2516 // species protector is accurate, but this would be hard to do for most of | 2517 // species protector is accurate, but this would be hard to do for most of |
| 2517 // what the protector stands for: | 2518 // what the protector stands for: |
| 2518 // - You'd need to traverse the heap to check that no Array instance has | 2519 // - You'd need to traverse the heap to check that no Array instance has |
| 2519 // a constructor property or a modified __proto__ | 2520 // a constructor property or a modified __proto__ |
| 2520 // - To check that Array[Symbol.species] == Array, JS code has to execute, | 2521 // - To check that Array[Symbol.species] == Array, JS code has to execute, |
| 2521 // but JS cannot be invoked in callstack overflow situations | 2522 // but JS cannot be invoked in callstack overflow situations |
| 2522 // All that could be checked reliably is that | 2523 // All that could be checked reliably is that |
| 2523 // Array.prototype.constructor == Array. Given that limitation, no check is | 2524 // Array.prototype.constructor == Array. Given that limitation, no check is |
| 2524 // done here. In place, there are mjsunit tests harmony/array-species* which | 2525 // done here. In place, there are mjsunit tests harmony/array-species* which |
| 2525 // ensure that behavior is correct in various invalid protector cases. | 2526 // ensure that behavior is correct in various invalid protector cases. |
| 2526 | 2527 |
| 2527 PropertyCell* species_cell = heap()->species_protector(); | 2528 PropertyCell* species_cell = heap()->species_protector(); |
| 2528 return species_cell->value()->IsSmi() && | 2529 return species_cell->value()->IsSmi() && |
| 2529 Smi::cast(species_cell->value())->value() == kArrayProtectorValid; | 2530 Smi::cast(species_cell->value())->value() == kArrayProtectorValid; |
| 2530 } | 2531 } |
| 2531 | 2532 |
| 2532 void Isolate::InvalidateArraySpeciesProtector() { | 2533 void Isolate::InvalidateArraySpeciesProtector() { |
| 2534 if (!FLAG_harmony_species) return; |
| 2533 DCHECK(factory()->species_protector()->value()->IsSmi()); | 2535 DCHECK(factory()->species_protector()->value()->IsSmi()); |
| 2534 DCHECK(IsArraySpeciesLookupChainIntact()); | 2536 DCHECK(IsArraySpeciesLookupChainIntact()); |
| 2535 PropertyCell::SetValueWithInvalidation( | 2537 PropertyCell::SetValueWithInvalidation( |
| 2536 factory()->species_protector(), | 2538 factory()->species_protector(), |
| 2537 handle(Smi::FromInt(kArrayProtectorInvalid), this)); | 2539 handle(Smi::FromInt(kArrayProtectorInvalid), this)); |
| 2538 DCHECK(!IsArraySpeciesLookupChainIntact()); | 2540 DCHECK(!IsArraySpeciesLookupChainIntact()); |
| 2539 } | 2541 } |
| 2540 | 2542 |
| 2541 void Isolate::UpdateArrayProtectorOnSetElement(Handle<JSObject> object) { | 2543 void Isolate::UpdateArrayProtectorOnSetElement(Handle<JSObject> object) { |
| 2542 DisallowHeapAllocation no_gc; | 2544 DisallowHeapAllocation no_gc; |
| (...skipping 367 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 2910 // Then check whether this scope intercepts. | 2912 // Then check whether this scope intercepts. |
| 2911 if ((flag & intercept_mask_)) { | 2913 if ((flag & intercept_mask_)) { |
| 2912 intercepted_flags_ |= flag; | 2914 intercepted_flags_ |= flag; |
| 2913 return true; | 2915 return true; |
| 2914 } | 2916 } |
| 2915 return false; | 2917 return false; |
| 2916 } | 2918 } |
| 2917 | 2919 |
| 2918 } // namespace internal | 2920 } // namespace internal |
| 2919 } // namespace v8 | 2921 } // namespace v8 |
| OLD | NEW |