Correct handling of arrays with callbacks in the prototype chain.

src/objects-inl.h

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 4269 matching lines @@
   WRITE_FIELD(this, kBitField3Offset, Smi::FromInt(value >> 1));
 }
 
 
 uint32_t Map::bit_field3() {
   Object* value = READ_FIELD(this, kBitField3Offset);
   return Smi::cast(value)->value();
 }
 
 
+void Map::set_bit_field4(uint32_t bits) {
+  // Ensure the upper 2 bits have the same value by sign extending it. This is
+  // necessary to be able to use the 31st bit.
+  int value = bits << 1;
+  WRITE_FIELD(this, kBitField4Offset, Smi::FromInt(value >> 1));
+}
+
+
+uint32_t Map::bit_field4() {
+  Object* value = READ_FIELD(this, kBitField4Offset);
+  return Smi::cast(value)->value();
+}
+
+
+void Map::set_has_element_callbacks(bool value) {
+  set_bit_field4(HasElementCallbacks::update(bit_field4(), value));
+}
+
+
+bool Map::has_element_callbacks() {
+  return HasElementCallbacks::decode(bit_field4());
+}
+
+
 void Map::ClearTransitions(Heap* heap, WriteBarrierMode mode) {
   Object* back_pointer = GetBackPointer();
 
   if (Heap::ShouldZapGarbage() && HasTransitionArray()) {
     ZapTransitions();
   }
 
   WRITE_FIELD(this, kTransitionsOrBackPointerOffset, back_pointer);
   CONDITIONAL_WRITE_BARRIER(
       heap, this, kTransitionsOrBackPointerOffset, back_pointer, mode);
@@ skipping 19 matching lines @@
     return object;
   }
 }
 
 
 bool Map::HasElementsTransition() {
   return HasTransitionArray() && transitions()->HasElementsTransition();
 }
 
 
+bool Map::HasElementCallbacksTransition() {
+  return HasTransitionArray() && transitions()->HasElementCallbacksTransition();
+}
+
+
 bool Map::HasTransitionArray() {
   Object* object = READ_FIELD(this, kTransitionsOrBackPointerOffset);
   return object->IsTransitionArray();
 }
 
 
 Map* Map::elements_transition_map() {
   int index = transitions()->Search(GetHeap()->elements_transition_symbol());
   return transitions()->GetTarget(index);
 }
@@ skipping 30 matching lines @@
   MaybeObject* maybe_transitions = AddTransition(
       GetHeap()->elements_transition_symbol(),
       transitioned_map,
       FULL_TRANSITION);
   if (!maybe_transitions->To(&transitions)) return maybe_transitions;
   set_transitions(transitions);
   return transitions;
 }
 
 
+MaybeObject* Map::set_element_callbacks_map(Map* callback_map) {
+  TransitionArray* transitions;
+  MaybeObject* maybe_transitions = AddTransition(
+      GetHeap()->element_callbacks_symbol(),
+      callback_map,
+      FULL_TRANSITION);
+  if (!maybe_transitions->To(&transitions)) return maybe_transitions;
+  set_transitions(transitions);
+  return transitions;
+}
+
+
 FixedArray* Map::GetPrototypeTransitions() {
   if (!HasTransitionArray()) return GetHeap()->empty_fixed_array();
   if (!transitions()->HasPrototypeTransitions()) {
     return GetHeap()->empty_fixed_array();
   }
   return transitions()->GetPrototypeTransitions();
 }
 
 
 MaybeObject* Map::SetPrototypeTransitions(FixedArray* proto_transitions) {
@@ skipping 1188 matching lines @@
 bool JSObject::HasDictionaryElements() {
   return GetElementsKind() == DICTIONARY_ELEMENTS;
 }
 
 
 bool JSObject::HasNonStrictArgumentsElements() {
   return GetElementsKind() == NON_STRICT_ARGUMENTS_ELEMENTS;
 }
 
 
+bool JSObject::HasNonStrictArgumentsElementsMap() {
+  return elements()->map() == GetHeap()->non_strict_arguments_elements_map();
+}
+
+
+
+FixedArrayBase* JSObject::GetElements() {
+  // Find the backing store.
+  FixedArrayBase* array = FixedArrayBase::cast(elements());
+  if (HasNonStrictArgumentsElementsMap()) {
+    array = FixedArrayBase::cast(FixedArray::cast(array)->get(1));
+  }
+  return array;
+}
+
+
 bool JSObject::HasExternalArrayElements() {
   HeapObject* array = elements();
   ASSERT(array != NULL);
   return array->IsExternalArray();
 }
 
 
 #define EXTERNAL_ELEMENTS_CHECK(name, type)          \
 bool JSObject::HasExternal##name##Elements() {       \
   HeapObject* array = elements();                    \
@@ skipping 801 matching lines @@
 #undef WRITE_UINT32_FIELD
 #undef READ_SHORT_FIELD
 #undef WRITE_SHORT_FIELD
 #undef READ_BYTE_FIELD
 #undef WRITE_BYTE_FIELD
 
 
 } }  // namespace v8::internal
 
 #endif  // V8_OBJECTS_INL_H_