Fix TypedArray Property optimizations

src/bootstrapper.cc

Index: src/bootstrapper.cc
diff --git a/src/bootstrapper.cc b/src/bootstrapper.cc
index 9af851f710d25c5476ab924bbbe8850adb9986cb..57735940be2b21f5bfae05ffbd9b151a0b7da9ce 100644
--- a/src/bootstrapper.cc
+++ b/src/bootstrapper.cc
@@ -1605,6 +1605,17 @@ void Genesis::InitializeGlobal(Handle<JSGlobalObject> global_object,
   }
 
   {  // -- T y p e d A r r a y s
+    // Create the %TypedArrayPrototype%
+    Handle<JSObject> typed_array_prototype =
+        factory->NewJSObject(isolate->object_function(), TENURED);
+    native_context()->set_typed_array_prototype(*typed_array_prototype);
+
+    Handle<JSFunction> typed_array_fun = InstallFunction(
+        global, "TypedArray", JS_OBJECT_TYPE, JSObject::kHeaderSize,
+        typed_array_prototype, Builtins::kIllegal);

[Dan Ehrenberg, 2016/05/05 23:37:31]

Use CreateFunction rather than InstallFunction in order to not expose this to
the global object.

[gsathya, 2016/05/06 11:10:27]

Thanks Dan! Done.

+    InstallWithIntrinsicDefaultProto(isolate, typed_array_fun,
+                                     Context::TYPED_ARRAY_FUN_INDEX);
+
 #define INSTALL_TYPED_ARRAY(Type, type, TYPE, ctype, size)             \
   {                                                                    \
     Handle<JSFunction> fun;                                            \
@@ -1927,9 +1938,17 @@ void Genesis::InitializeGlobal(Handle<JSGlobalObject> global_object,
 void Genesis::InstallTypedArray(const char* name, ElementsKind elements_kind,
                                 Handle<JSFunction>* fun) {
   Handle<JSObject> global = Handle<JSObject>(native_context()->global_object());
-  Handle<JSFunction> result = InstallFunction(
-      global, name, JS_TYPED_ARRAY_TYPE, JSTypedArray::kSize,
-      isolate()->initial_object_prototype(), Builtins::kIllegal);
+
+  Handle<JSObject> typed_array_prototype =
+      Handle<JSObject>(isolate()->typed_array_prototype());
+  Handle<JSFunction> typed_array_function =
+      Handle<JSFunction>(isolate()->typed_array_function());
+
+  Handle<JSObject> prototype =
+      factory()->NewJSObject(isolate()->object_function(), TENURED);
+  Handle<JSFunction> result =
+      InstallFunction(global, name, JS_TYPED_ARRAY_TYPE, JSTypedArray::kSize,
+                      prototype, Builtins::kIllegal);
 
   Handle<Map> initial_map = isolate()->factory()->NewMap(
       JS_TYPED_ARRAY_TYPE,
@@ -1937,6 +1956,15 @@ void Genesis::InstallTypedArray(const char* name, ElementsKind elements_kind,
       elements_kind);
   JSFunction::SetInitialMap(result, initial_map,
                             handle(initial_map->prototype(), isolate()));
+
+  CHECK(JSObject::SetPrototype(result, typed_array_function, false,
+                               Object::DONT_THROW)
+            .FromJust());
+
+  CHECK(JSObject::SetPrototype(prototype, typed_array_prototype, false,
+                               Object::DONT_THROW)
+            .FromJust());
+
   *fun = result;
 }