Fix TypedArray Property optimizations

src/bootstrapper.cc

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/bootstrapper.h"
 
 #include "src/accessors.h"
 #include "src/api-natives.h"
 #include "src/code-stubs.h"
 #include "src/extensions/externalize-string-extension.h"
@@ skipping 1587 matching lines @@
   }
 
   {  // -- A r r a y B u f f e r
     Handle<JSFunction> array_buffer_fun =
         InstallArrayBuffer(global, "ArrayBuffer");
     InstallWithIntrinsicDefaultProto(isolate, array_buffer_fun,
                                      Context::ARRAY_BUFFER_FUN_INDEX);
   }
 
   {  // -- T y p e d A r r a y s
+    // Create the %TypedArrayPrototype%
+    Handle<JSObject> typed_array_prototype =
+        factory->NewJSObject(isolate->object_function(), TENURED);
+    native_context()->set_typed_array_prototype(*typed_array_prototype);
+
+    Handle<JSFunction> typed_array_fun = InstallFunction(
+        global, "TypedArray", JS_OBJECT_TYPE, JSObject::kHeaderSize,

[adamk, 2016/05/04 18:44:36]

I don't think you want to install this on the global, do you? I thought this was
the %TypedArray% function, which doesn't have a name.

[gsathya, 2016/05/05 21:16:06]

Makes sense. But, I still need to create this JSFunction which requires a
target. I chatted with Dan offline and we decided to leave it as such since it's
only the bootstrapper's global object. Is there a better way to do this?

+        typed_array_prototype, Builtins::kIllegal);
+    InstallWithIntrinsicDefaultProto(isolate, typed_array_fun,
+                                     Context::TYPED_ARRAY_FUN_INDEX);
+
 #define INSTALL_TYPED_ARRAY(Type, type, TYPE, ctype, size)             \
   {                                                                    \
     Handle<JSFunction> fun;                                            \
     InstallTypedArray(#Type "Array", TYPE##_ELEMENTS, &fun);           \
     InstallWithIntrinsicDefaultProto(isolate, fun,                     \
                                      Context::TYPE##_ARRAY_FUN_INDEX); \
   }
     TYPED_ARRAYS(INSTALL_TYPED_ARRAY)
 #undef INSTALL_TYPED_ARRAY
 
@@ skipping 302 matching lines @@
         factory->empty_string(), code, JS_OBJECT_TYPE, JSObject::kHeaderSize);
     native_context()->set_call_as_constructor_delegate(*delegate);
     delegate->shared()->DontAdaptArguments();
   }
 }  // NOLINT(readability/fn_size)
 
 
 void Genesis::InstallTypedArray(const char* name, ElementsKind elements_kind,
                                 Handle<JSFunction>* fun) {
   Handle<JSObject> global = Handle<JSObject>(native_context()->global_object());
-  Handle<JSFunction> result = InstallFunction(
-      global, name, JS_TYPED_ARRAY_TYPE, JSTypedArray::kSize,
-      isolate()->initial_object_prototype(), Builtins::kIllegal);
+
+  Handle<JSObject> typed_array_prototype =
+      Handle<JSObject>(native_context()->typed_array_prototype());

[adamk, 2016/05/04 18:44:36]

You can use the shorter "isolate()->typed_array_prototype()" accessor which will
give you back a handle.

[gsathya, 2016/05/05 21:16:06]

Done.

+  Handle<JSFunction> typed_array_function =
+      Handle<JSFunction>(native_context()->typed_array_function());

[adamk, 2016/05/04 18:44:36]

Same here, isolate()->typed_array_function().

[gsathya, 2016/05/05 21:16:06]

Done.

+
+  Handle<JSObject> prototype =
+      factory()->NewJSObject(isolate()->object_function(), TENURED);
+  Handle<JSFunction> result =
+      InstallFunction(global, name, JS_TYPED_ARRAY_TYPE, JSTypedArray::kSize,
+                      prototype, Builtins::kIllegal);
 
   Handle<Map> initial_map = isolate()->factory()->NewMap(
       JS_TYPED_ARRAY_TYPE,
       JSTypedArray::kSizeWithInternalFields,
       elements_kind);
   JSFunction::SetInitialMap(result, initial_map,
                             handle(initial_map->prototype(), isolate()));
+
+  if (JSReceiver::SetPrototype(result, typed_array_function, false,

[adamk, 2016/05/04 18:44:36]

I'd use JSObject::SetPrototype() here since you know you're not operating on a
Proxy.

[gsathya, 2016/05/05 21:16:06]

Done.

+                               Object::THROW_ON_ERROR)
+          .IsNothing()) {
+    DCHECK(false);

[Dan Ehrenberg, 2016/05/04 18:11:13]

Nit: DCHECK(false) is rather unidiomatic (although it is used elsewhere in this
file). Maybe save the result of SetPrototype in a Maybe<bool> and then
DCHECK(!result.IsNothing()) ?

[adamk, 2016/05/04 18:44:36]

I agree with this approach, though a slight modification: change to pass
Object::DONT_THROW, and then restructure to surround in a CHECK (not a DCHECK;
this should never fail, and since it happens during mksnapshot it will just
crash mksnapshot, never actually crash Chrome).

CHECK(JSObject::SetPrototype(..., Object::DONT_THROW).FromJust());

[gsathya, 2016/05/05 21:16:06]

Done.

+  }
+
+  if (JSReceiver::SetPrototype(prototype, typed_array_prototype, false,

[adamk, 2016/05/04 18:44:36]

Same here, JSObject::SetPrototype.

[gsathya, 2016/05/05 21:16:06]

Done.

+                               Object::THROW_ON_ERROR)
+          .IsNothing()) {
+    DCHECK(false);
+  }
+
   *fun = result;
 }
 
 
 void Genesis::InitializeExperimentalGlobal() {
 #define FEATURE_INITIALIZE_GLOBAL(id, descr) InitializeGlobal_##id();
 
   HARMONY_INPROGRESS(FEATURE_INITIALIZE_GLOBAL)
   HARMONY_STAGED(FEATURE_INITIALIZE_GLOBAL)
   HARMONY_SHIPPING(FEATURE_INITIALIZE_GLOBAL)
@@ skipping 1735 matching lines @@
 }
 
 
 // Called when the top-level V8 mutex is destroyed.
 void Bootstrapper::FreeThreadResources() {
   DCHECK(!IsActive());
 }
 
 }  // namespace internal
 }  // namespace v8