[ic] Don't check full prototype chain if name is a private symbol.

src/ic/ic.cc

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/ic/ic.h"
 
 #include <iostream>
 
 #include "src/accessors.h"
 #include "src/api-arguments-inl.h"
@@ skipping 837 matching lines @@
   }
   TRACE_HANDLER_STATS(isolate(), LoadIC_LoadFieldStub);
   LoadFieldStub stub(isolate(), index);
   return stub.GetCode();
 }
 
 namespace {
 
 template <bool fill_array = true>
 int InitPrototypeChecks(Isolate* isolate, Handle<Map> receiver_map,
-                        Handle<JSObject> holder, Handle<FixedArray> array,
-                        Handle<Name> name, int first_index) {
+                        Handle<JSObject> holder, Handle<Name> name,
+                        Handle<FixedArray> array, int first_index) {
   DCHECK(holder.is_null() || holder->HasFastProperties());
 
   // We don't encode the requirement to check access rights because we already
   // passed the access check for current native context and the access
   // can't be revoked.
 
   HandleScope scope(isolate);
   int checks_count = 0;
 
   if (receiver_map->IsPrimitiveMap() || receiver_map->IsJSGlobalProxyMap()) {
@@ skipping 17 matching lines @@
           global, name, PropertyCellType::kInvalidated);
       DCHECK(cell->value()->IsTheHole(isolate));
       Handle<WeakCell> weak_cell = isolate->factory()->NewWeakCell(cell);
       array->set(LoadHandler::kFirstPrototypeIndex + checks_count, *weak_cell);
     }
     checks_count++;
   }
 
   // Create/count entries for each global or dictionary prototype appeared in
   // the prototype chain contains from receiver till holder.
-  for (PrototypeIterator iter(receiver_map); !iter.IsAtEnd(); iter.Advance()) {
+  PrototypeIterator::WhereToEnd end = name->IsPrivate()
+                                          ? PrototypeIterator::END_AT_NON_HIDDEN
+                                          : PrototypeIterator::END_AT_NULL;
+  for (PrototypeIterator iter(receiver_map, end); !iter.IsAtEnd();
+       iter.Advance()) {
     Handle<JSObject> current = PrototypeIterator::GetCurrent<JSObject>(iter);
     if (holder.is_identical_to(current)) break;
     Handle<Map> current_map(current->map(), isolate);
 
     if (current_map->IsJSGlobalObjectMap()) {
       if (fill_array) {
         Handle<JSGlobalObject> global = Handle<JSGlobalObject>::cast(current);
         Handle<PropertyCell> cell = JSGlobalObject::EnsureEmptyPropertyCell(
             global, name, PropertyCellType::kInvalidated);
         DCHECK(cell->value()->IsTheHole(isolate));
@@ skipping 17 matching lines @@
   return checks_count;
 }
 
 // Returns 0 if the validity cell check is enough to ensure that the
 // prototype chain from |receiver_map| till |holder| did not change.
 // If the |holder| is an empty handle then the full prototype chain is
 // checked.
 // Returns -1 if the handler has to be compiled or the number of prototype
 // checks otherwise.
 int GetPrototypeCheckCount(Isolate* isolate, Handle<Map> receiver_map,
-                           Handle<JSObject> holder) {
-  return InitPrototypeChecks<false>(isolate, receiver_map, holder,
-                                    Handle<FixedArray>(), Handle<Name>(), 0);
+                           Handle<JSObject> holder, Handle<Name> name) {
+  return InitPrototypeChecks<false>(isolate, receiver_map, holder, name,
+                                    Handle<FixedArray>(), 0);
 }
 
 }  // namespace
 
 Handle<Object> LoadIC::LoadFromPrototype(Handle<Map> receiver_map,
                                          Handle<JSObject> holder,
                                          Handle<Name> name,
                                          Handle<Object> smi_handler) {
-  int checks_count = GetPrototypeCheckCount(isolate(), receiver_map, holder);
+  int checks_count =
+      GetPrototypeCheckCount(isolate(), receiver_map, holder, name);
   DCHECK_LE(0, checks_count);
 
   if (receiver_map->IsPrimitiveMap() || receiver_map->IsJSGlobalProxyMap()) {
     DCHECK(!receiver_map->is_dictionary_map());
     DCHECK_LE(1, checks_count);  // For native context.
     smi_handler =
         LoadHandler::EnableAccessCheckOnReceiver(isolate(), smi_handler);
   } else if (receiver_map->is_dictionary_map() &&
              !receiver_map->IsJSGlobalObjectMap()) {
     smi_handler =
         LoadHandler::EnableNegativeLookupOnReceiver(isolate(), smi_handler);
   }
 
   Handle<Cell> validity_cell =
       Map::GetOrCreatePrototypeChainValidityCell(receiver_map, isolate());
   DCHECK(!validity_cell.is_null());
 
   Handle<WeakCell> holder_cell =
       Map::GetOrCreatePrototypeWeakCell(holder, isolate());
 
   if (checks_count == 0) {
     return isolate()->factory()->NewTuple3(holder_cell, smi_handler,
                                            validity_cell);
   }
   Handle<FixedArray> handler_array(isolate()->factory()->NewFixedArray(
       LoadHandler::kFirstPrototypeIndex + checks_count, TENURED));
   handler_array->set(LoadHandler::kSmiHandlerIndex, *smi_handler);
   handler_array->set(LoadHandler::kValidityCellIndex, *validity_cell);
   handler_array->set(LoadHandler::kHolderCellIndex, *holder_cell);
-  InitPrototypeChecks(isolate(), receiver_map, holder, handler_array, name,
+  InitPrototypeChecks(isolate(), receiver_map, holder, name, handler_array,
                       LoadHandler::kFirstPrototypeIndex);
   return handler_array;
 }
 
 Handle<Object> LoadIC::LoadNonExistent(Handle<Map> receiver_map,
                                        Handle<Name> name) {
   Handle<JSObject> holder;  // null handle
-  int checks_count = GetPrototypeCheckCount(isolate(), receiver_map, holder);
+  int checks_count =
+      GetPrototypeCheckCount(isolate(), receiver_map, holder, name);
   DCHECK_LE(0, checks_count);
 
   bool do_negative_lookup_on_receiver =
       receiver_map->is_dictionary_map() && !receiver_map->IsJSGlobalObjectMap();
   Handle<Object> smi_handler =
       LoadHandler::LoadNonExistent(isolate(), do_negative_lookup_on_receiver);
 
   if (receiver_map->IsPrimitiveMap() || receiver_map->IsJSGlobalProxyMap()) {
     DCHECK(!receiver_map->is_dictionary_map());
     DCHECK_LE(1, checks_count);  // For native context.
     smi_handler =
         LoadHandler::EnableAccessCheckOnReceiver(isolate(), smi_handler);
   }
 
   Handle<Object> validity_cell =
       Map::GetOrCreatePrototypeChainValidityCell(receiver_map, isolate());
   if (validity_cell.is_null()) {
-    // This must be a case when receiver's prototype is null.
-    DCHECK_EQ(*isolate()->factory()->null_value(),
-              receiver_map->GetPrototypeChainRootMap(isolate())->prototype());
     DCHECK_EQ(0, checks_count);
     validity_cell = handle(Smi::FromInt(0), isolate());
   }
 
   Factory* factory = isolate()->factory();
   if (checks_count == 0) {
     return factory->NewTuple3(factory->null_value(), smi_handler,
                               validity_cell);
   }
   Handle<FixedArray> handler_array(factory->NewFixedArray(
       LoadHandler::kFirstPrototypeIndex + checks_count, TENURED));
   handler_array->set(LoadHandler::kSmiHandlerIndex, *smi_handler);
   handler_array->set(LoadHandler::kValidityCellIndex, *validity_cell);
   handler_array->set(LoadHandler::kHolderCellIndex, *factory->null_value());
-  InitPrototypeChecks(isolate(), receiver_map, holder, handler_array, name,
+  InitPrototypeChecks(isolate(), receiver_map, holder, name, handler_array,
                       LoadHandler::kFirstPrototypeIndex);
   return handler_array;
 }
 
 bool IsCompatibleReceiver(LookupIterator* lookup, Handle<Map> receiver_map) {
   DCHECK(lookup->state() == LookupIterator::ACCESSOR);
   Isolate* isolate = lookup->isolate();
   Handle<Object> accessors = lookup->GetAccessors();
   if (accessors->IsAccessorInfo()) {
     Handle<AccessorInfo> info = Handle<AccessorInfo>::cast(accessors);
@@ skipping 856 matching lines @@
 
   } else {
     DCHECK_EQ(DATA, details.type());
     bool extend_storage =
         Map::cast(transition->GetBackPointer())->unused_property_fields() == 0;
 
     FieldIndex index = FieldIndex::ForDescriptor(*transition, descriptor);
     smi_handler = StoreHandler::TransitionToField(
         isolate(), descriptor, index, representation, extend_storage);
   }
+  // |holder| is either a receiver if the property is non-existent or
+  // one of the prototypes.
+  DCHECK(!holder.is_null());
+  bool is_nonexistent = holder->map() == transition->GetBackPointer();
+  if (is_nonexistent) holder = Handle<JSObject>::null();
 
-  int checks_count = GetPrototypeCheckCount(isolate(), receiver_map, holder);
+  int checks_count =
+      GetPrototypeCheckCount(isolate(), receiver_map, holder, name);
   DCHECK_LE(0, checks_count);
   DCHECK(!receiver_map->IsJSGlobalObjectMap());
 
   Handle<Object> validity_cell =
       Map::GetOrCreatePrototypeChainValidityCell(receiver_map, isolate());
   if (validity_cell.is_null()) {
-    // This must be a case when receiver's prototype is null.
-    DCHECK_EQ(*isolate()->factory()->null_value(),
-              receiver_map->GetPrototypeChainRootMap(isolate())->prototype());
     DCHECK_EQ(0, checks_count);
     validity_cell = handle(Smi::FromInt(0), isolate());
   }
 
   Handle<WeakCell> transition_cell = Map::WeakCellForMap(transition);
 
   Factory* factory = isolate()->factory();
   if (checks_count == 0) {
     return factory->NewTuple3(transition_cell, smi_handler, validity_cell);
   }
   Handle<FixedArray> handler_array(factory->NewFixedArray(
       StoreHandler::kFirstPrototypeIndex + checks_count, TENURED));
   handler_array->set(StoreHandler::kSmiHandlerIndex, *smi_handler);
   handler_array->set(StoreHandler::kValidityCellIndex, *validity_cell);
   handler_array->set(StoreHandler::kTransitionCellIndex, *transition_cell);
-  InitPrototypeChecks(isolate(), receiver_map, holder, handler_array, name,
+  InitPrototypeChecks(isolate(), receiver_map, holder, name, handler_array,
                       StoreHandler::kFirstPrototypeIndex);
   return handler_array;
 }
 
 static Handle<Code> PropertyCellStoreHandler(
     Isolate* isolate, Handle<JSObject> receiver, Handle<JSGlobalObject> holder,
     Handle<Name> name, Handle<PropertyCell> cell, PropertyCellType type) {
   auto constant_type = Nothing<PropertyCellConstantType>();
   if (type == PropertyCellType::kConstantType) {
     constant_type = Just(cell->GetConstantType());
@@ skipping 1311 matching lines @@
     DCHECK_EQ(LookupIterator::INTERCEPTOR, it.state());
     it.Next();
     ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, result,
                                        Object::GetProperty(&it));
   }
 
   return *result;
 }
 }  // namespace internal
 }  // namespace v8