[elements] update Dictionary in IncludesValue if own elements change

src/elements.cc

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/elements.h"
 
 #include "src/arguments.h"
 #include "src/conversions.h"
 #include "src/factory.h"
 #include "src/isolate-inl.h"
@@ skipping 1501 matching lines @@
         SeededNumberDictionary::cast(receiver->elements()), isolate);
     // Iterate through entire range, as accessing elements out of order is
     // observable
     for (uint32_t k = start_from; k < length; ++k) {
       int entry = dictionary->FindEntry(k);
       if (entry == SeededNumberDictionary::kNotFound) {
         if (search_for_hole) return Just(true);
         continue;
       }
 
-      PropertyDetails details = GetDetailsImpl(receiver->elements(), entry);
+      PropertyDetails details = GetDetailsImpl(*dictionary, entry);
       switch (details.kind()) {
         case kData: {
           Object* element_k = dictionary->ValueAt(entry);
           if (value->SameValueZero(element_k)) return Just(true);
           break;
         }
         case kAccessor: {
           LookupIterator it(isolate, receiver, k,
                             LookupIterator::OWN_SKIP_INTERCEPTOR);
           DCHECK(it.IsFound());
           DCHECK_EQ(it.state(), LookupIterator::ACCESSOR);
           Handle<Object> element_k;
 
           ASSIGN_RETURN_ON_EXCEPTION_VALUE(
               isolate, element_k, JSObject::GetPropertyWithAccessor(&it),
               Nothing<bool>());
 
           if (value->SameValueZero(*element_k)) return Just(true);
 
-          // Some mutation to the prototype elements may have occurred in
-          // accessor.
-          if (!JSObject::PrototypeHasNoElements(isolate, *receiver)) {
+          // Some mutation to prototype or own elements may have occurred in the
+          // accessor. If so, bailout to slow path.
+          if (*dictionary != receiver->elements() ||

[Camillo Bruni, 2016/08/04 15:51:57]

as long as we stay in dictionary mode (which is always the case as we do not
migrate dict-elements to fast elements) you could just refresh the dictionary
(probably won't matter though in this corner case).

[caitp, 2016/08/04 16:13:06]

You're saying the elements kind can't change, so just update the handle instead
of bailing out, right? will do

[caitp, 2016/08/04 17:01:58]

This seems to be untrue, JSObject::ResetElements() (called if `length` is 0 in
ElementsAccessor::SetLength()) can reset the elements kind and fixed array to
something empty. There might be other cases that could break, too.

+              !JSObject::PrototypeHasNoElements(isolate, *receiver)) {
             return IncludesValueSlowPath(isolate, receiver, value, k + 1,
                                          length);
           }
           break;
         }
       }
     }
     return Just(false);
   }
 };
@@ skipping 1888 matching lines @@
     insertion_index += len;
   }
 
   DCHECK_EQ(insertion_index, result_len);
   return result_array;
 }
 
 ElementsAccessor** ElementsAccessor::elements_accessors_ = NULL;
 }  // namespace internal
 }  // namespace v8