Harden IsMoreGeneralElementsKindTransition.

src/elements-kind.cc

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 160 matching lines @@
   return TERMINAL_FAST_ELEMENTS_KIND;
 }
 
 
 static bool IsTypedArrayElementsKind(ElementsKind elements_kind) {
   return IsFixedTypedArrayElementsKind(elements_kind) ||
       IsExternalArrayElementsKind(elements_kind);
 }
 
 
+static inline bool IsFastTransitionTarget(ElementsKind elements_kind) {
+  return IsFastElementsKind(elements_kind) ||
+      elements_kind == DICTIONARY_ELEMENTS;
+}
+
 bool IsMoreGeneralElementsKindTransition(ElementsKind from_kind,
                                          ElementsKind to_kind) {
   if (IsTypedArrayElementsKind(from_kind) ||
       IsTypedArrayElementsKind(to_kind)) {
     switch (from_kind) {
 #define FIXED_TYPED_ARRAY_CASE(Type, type, TYPE, ctype, size) \
       case TYPE##_ELEMENTS:                                   \
         return to_kind == EXTERNAL_##TYPE##_ELEMENTS;
 
       TYPED_ARRAYS(FIXED_TYPED_ARRAY_CASE);
 #undef FIXED_TYPED_ARRAY_CASE
       default:
         return false;
     }
   }
-  switch (from_kind) {
-    case FAST_SMI_ELEMENTS:
-      return to_kind != FAST_SMI_ELEMENTS;
-    case FAST_HOLEY_SMI_ELEMENTS:
-      return to_kind != FAST_SMI_ELEMENTS &&
-          to_kind != FAST_HOLEY_SMI_ELEMENTS;
-    case FAST_DOUBLE_ELEMENTS:
-      return to_kind != FAST_SMI_ELEMENTS &&
-          to_kind != FAST_HOLEY_SMI_ELEMENTS &&
-          to_kind != FAST_DOUBLE_ELEMENTS;
-    case FAST_HOLEY_DOUBLE_ELEMENTS:
-      return to_kind == FAST_ELEMENTS ||
-          to_kind == FAST_HOLEY_ELEMENTS;
-    case FAST_ELEMENTS:
-      return to_kind == FAST_HOLEY_ELEMENTS;
-    case FAST_HOLEY_ELEMENTS:
-      return false;
-    default:
-      return false;
+  if (IsFastElementsKind(from_kind) && IsFastTransitionTarget(to_kind)) {
+    switch (from_kind) {
+      case FAST_SMI_ELEMENTS:
+        return to_kind != FAST_SMI_ELEMENTS;
+      case FAST_HOLEY_SMI_ELEMENTS:
+        return to_kind != FAST_SMI_ELEMENTS &&
+            to_kind != FAST_HOLEY_SMI_ELEMENTS;
+      case FAST_DOUBLE_ELEMENTS:
+        return to_kind != FAST_SMI_ELEMENTS &&
+            to_kind != FAST_HOLEY_SMI_ELEMENTS &&
+            to_kind != FAST_DOUBLE_ELEMENTS;
+      case FAST_HOLEY_DOUBLE_ELEMENTS:
+        return to_kind == FAST_ELEMENTS ||
+            to_kind == FAST_HOLEY_ELEMENTS;
+      case FAST_ELEMENTS:
+        return to_kind == FAST_HOLEY_ELEMENTS;
+      case FAST_HOLEY_ELEMENTS:
+        return false;
+      default:
+        return false;
+    }
   }
+  return false;
 }
 
 
 } }  // namespace v8::internal