[runtime] Object.create(null) creates a slow object

src/builtins/builtins-object.cc

 // Copyright 2016 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/builtins/builtins.h"
 #include "src/builtins/builtins-utils.h"
 
 #include "src/code-factory.h"
 #include "src/property-descriptor.h"
 
@@ skipping 487 matching lines @@
         a->WordEqual(
             a->BitFieldDecodeWord<Map::NumberOfOwnDescriptorsBits>(bit_field3),
             a->IntPtrConstant(0)),
         &no_properties, &call_runtime);
   }
 
   // Create a new object with the given prototype.
   a->Bind(&no_properties);
   {
     Variable map(a, MachineRepresentation::kTagged);
+    Variable properties(a, MachineRepresentation::kTagged);
     Label non_null_proto(a), instantiate_map(a), good(a);
 
     a->Branch(a->WordEqual(prototype, a->NullConstant()), &good,
               &non_null_proto);
 
     a->Bind(&good);
     {
-      map.Bind(a->LoadContextElement(context,
-                                     Context::OBJECT_WITH_NULL_PROTOTYPE_MAP));
+      map.Bind(a->LoadContextElement(
+          context, Context::SLOW_OBJECT_WITH_NULL_PROTOTYPE_MAP));
+      properties.Bind(
+          a->AllocateNameDictionary(NameDictionary::kInitialCapacity));

[Camillo Bruni, 2016/10/21 13:37:15]

How can I make sure the GC updates the properties pointer correctly if we
trigger a GC later-on when allocating the JSObject in AllocateJSObjectFromMap?

[Igor Sheludko, 2016/10/21 15:01:09]

You marked the variable as kTagged, so the compiler will make GC know about yet
another value to update. 

       a->Goto(&instantiate_map);
     }
 
     a->Bind(&non_null_proto);
     {
+      properties.Bind(a->EmptyFixedArrayConstant());
       Node* object_function =
           a->LoadContextElement(context, Context::OBJECT_FUNCTION_INDEX);
       Node* object_function_map = a->LoadObjectField(
           object_function, JSFunction::kPrototypeOrInitialMapOffset);
       map.Bind(object_function_map);
       a->GotoIf(a->WordEqual(prototype, a->LoadMapPrototype(map.value())),
                 &instantiate_map);
       // Try loading the prototype info.
       Node* prototype_info =
           a->LoadMapPrototypeInfo(a->LoadMap(prototype), &call_runtime);
       a->Comment("Load ObjectCreateMap from PrototypeInfo");
       Node* weak_cell =
           a->LoadObjectField(prototype_info, PrototypeInfo::kObjectCreateMap);
       a->GotoIf(a->WordEqual(weak_cell, a->UndefinedConstant()), &call_runtime);
       map.Bind(a->LoadWeakCellValue(weak_cell, &call_runtime));
       a->Goto(&instantiate_map);
     }
 
     a->Bind(&instantiate_map);
     {
-      Node* instance = a->AllocateJSObjectFromMap(map.value());
+      Node* instance =
+          a->AllocateJSObjectFromMap(map.value(), properties.value());
       a->Return(instance);
     }
   }
 
   a->Bind(&call_runtime);
   {
     a->Return(
         a->CallRuntime(Runtime::kObjectCreate, context, prototype, properties));
   }
 }
@@ skipping 499 matching lines @@
   typedef CompareDescriptor Descriptor;
   Node* object = assembler->Parameter(Descriptor::kLeft);
   Node* callable = assembler->Parameter(Descriptor::kRight);
   Node* context = assembler->Parameter(Descriptor::kContext);
 
   assembler->Return(assembler->InstanceOf(object, callable, context));
 }
 
 }  // namespace internal
 }  // namespace v8