[elements] Precisely estimate elements size for large-object limits

src/elements.h

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef V8_ELEMENTS_H_
 #define V8_ELEMENTS_H_
 
 #include "src/elements-kind.h"
 #include "src/heap/heap.h"
 #include "src/isolate.h"
@@ skipping 38 matching lines @@
 
   inline bool HasElement(Handle<JSObject> holder, uint32_t index,
                          PropertyFilter filter = ALL_PROPERTIES) {
     return HasElement(holder, index, handle(holder->elements()), filter);
   }
 
   virtual Handle<Object> Get(Handle<JSObject> holder, uint32_t entry) = 0;
 
   virtual PropertyDetails GetDetails(JSObject* holder, uint32_t entry) = 0;
   virtual bool HasAccessors(JSObject* holder) = 0;
+  virtual uint32_t NumberOfElements(JSObject* holder) = 0;
 
   // Modifies the length data property as specified for JSArrays and resizes the
   // underlying backing store accordingly. The method honors the semantics of
   // changing array sizes as defined in EcmaScript 5.1 15.4.5.2, i.e. array that
   // have non-deletable elements can only be shrunk to the size of highest
   // element that is non-deletable.
   virtual void SetLength(Handle<JSArray> holder, uint32_t new_length) = 0;
 
   // Deletes an element in an object.
   virtual void Delete(Handle<JSObject> holder, uint32_t entry) = 0;
@@ skipping 109 matching lines @@
   friend class LookupIterator;
 
   // Element handlers distinguish between entries and indices when they
   // manipulate elements. Entries refer to elements in terms of their location
   // in the underlying storage's backing store representation, and are between 0
   // and GetCapacity. Indices refer to elements in terms of the value that would
   // be specified in JavaScript to access the element. In most implementations,
   // indices are equivalent to entries. In the NumberDictionary
   // ElementsAccessor, entries are mapped to an index using the KeyAt method on
   // the NumberDictionary.
-  virtual uint32_t GetEntryForIndex(JSObject* holder,
+  virtual uint32_t GetEntryForIndex(Isolate* isolate, JSObject* holder,
                                     FixedArrayBase* backing_store,
                                     uint32_t index) = 0;
 
   // NOTE: this method violates the handlified function signature convention:
   // raw pointer parameter |source_holder| in the function that allocates.
   // This is done intentionally to avoid ArrayConcat() builtin performance
   // degradation.
   virtual void CopyElements(JSObject* source_holder, uint32_t source_start,
                             ElementsKind source_kind,
                             Handle<FixedArrayBase> destination,
@@ skipping 10 matching lines @@
                      bool allow_appending = false);
 
 MUST_USE_RESULT MaybeHandle<Object> ArrayConstructInitializeElements(
     Handle<JSArray> array,
     Arguments* args);
 
 }  // namespace internal
 }  // namespace v8
 
 #endif  // V8_ELEMENTS_H_