Correct handling of arrays with callbacks in the prototype chain.

src/objects.h

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 2084 matching lines @@
   inline bool HasExternalByteElements();
   inline bool HasExternalUnsignedByteElements();
   inline bool HasExternalShortElements();
   inline bool HasExternalUnsignedShortElements();
   inline bool HasExternalIntElements();
   inline bool HasExternalUnsignedIntElements();
   inline bool HasExternalFloatElements();
   inline bool HasExternalDoubleElements();
   bool HasFastArgumentsElements();
   bool HasDictionaryArgumentsElements();
+  inline bool HasNonStrictArgumentsElementsMap();
   inline SeededNumberDictionary* element_dictionary();  // Gets slow elements.
 
+  // Gets elements from the appropriate location if a normal object or a
+  // non-strict arguments object.
+  inline FixedArrayBase* GetElements();

[danno, 2013/10/30 12:17:45]

Why is elements() not sufficient here?

+
   inline bool ShouldTrackAllocationInfo();
 
   inline void set_map_and_elements(
       Map* map,
       FixedArrayBase* value,
       WriteBarrierMode mode = UPDATE_WRITE_BARRIER);
 
   // Requires: HasFastElements().
   MUST_USE_RESULT inline MaybeObject* EnsureWritableFastElements();
 
@@ skipping 373 matching lines @@
                                   PropertyNormalizationMode mode,
                                   int expected_additional_properties);
 
   // Convert and update the elements backing store to be a
   // SeededNumberDictionary dictionary.  Returns the backing after conversion.
   static Handle<SeededNumberDictionary> NormalizeElements(
       Handle<JSObject> object);
 
   MUST_USE_RESULT MaybeObject* NormalizeElements();
 
+  // Convert the elements backing store as a SeededNumberDictionary dictionary.
+  // Precondition: the elements aren't already a dictionary.
+  // Does not set the new elements in the object.
+  static Handle<SeededNumberDictionary> CreateNormalizedElements(
+      Handle<JSObject> object);
+
+  MUST_USE_RESULT MaybeObject* CreateNormalizedElements();
+
   // Transform slow named properties to fast variants.
   static void TransformToFastProperties(Handle<JSObject> object,
                                         int unused_property_fields);
 
   // Access fast-case object properties at index.
   MUST_USE_RESULT inline MaybeObject* FastPropertyAt(
       Representation representation,
       int index);
   inline Object* RawFastPropertyAt(int index);
   inline void FastPropertyAtPut(int index, Object* value);
@@ skipping 2781 matching lines @@
   int CodeSize() { return SizeFor(body_size()); }
   inline void CodeIterateBody(ObjectVisitor* v);
 
   template<typename StaticVisitor>
   inline void CodeIterateBody(Heap* heap);
 
   DECLARE_PRINTER(Code)
   DECLARE_VERIFIER(Code)
 
   void ClearInlineCaches();
+  void ClearInlineCaches(Kind* kind);

[danno, 2013/10/30 12:17:45]

Shouldn't this one be private?

[mvstanton, 2013/10/30 18:22:28]

Done.

+  void ClearInlineCaches(Kind kind);
+
   void ClearTypeFeedbackCells(Heap* heap);
 
   BailoutId TranslatePcOffsetToAstId(uint32_t pc_offset);
 
 #define DECLARE_CODE_AGE_ENUM(X) k##X##CodeAge,
   enum Age {
     kNotExecutedCodeAge = -2,
     kExecutedOnceCodeAge = -1,
     kNoAgeCodeAge = 0,
     CODE_AGE_LIST(DECLARE_CODE_AGE_ENUM)
@@ skipping 312 matching lines @@
   class IsShared:                   public BitField<bool, 22,  1> {};
   class FunctionWithPrototype:      public BitField<bool, 23,  1> {};
   class DictionaryMap:              public BitField<bool, 24,  1> {};
   class OwnsDescriptors:            public BitField<bool, 25,  1> {};
   class IsObserved:                 public BitField<bool, 26,  1> {};
   class Deprecated:                 public BitField<bool, 27,  1> {};
   class IsFrozen:                   public BitField<bool, 28,  1> {};
   class IsUnstable:                 public BitField<bool, 29,  1> {};
   class IsMigrationTarget:          public BitField<bool, 30,  1> {};
 
+  // Bit field 4.
+  inline uint32_t bit_field4();
+  inline void set_bit_field4(uint32_t bits);
+
+  class HasElementCallbacks:        public BitField<int,   0,  1> {};
+
+  inline void set_has_element_callbacks(bool value);
+  inline bool has_element_callbacks();
+
   // Tells whether the object in the prototype property will be used
   // for instances created from this function.  If the prototype
   // property is set to a value that is not a JSObject, the prototype
   // property will not be used to create instances of the function.
   // See ECMA-262, 13.2.2.
   inline void set_non_instance_prototype(bool value);
   inline bool has_non_instance_prototype();
 
   // Tells whether function has special prototype property. If not, prototype
   // property will not be created when accessed (will return undefined),
@@ skipping 114 matching lines @@
   static bool IsValidElementsTransition(ElementsKind from_kind,
                                         ElementsKind to_kind);
 
   inline bool HasTransitionArray();
   inline bool HasElementsTransition();
   inline Map* elements_transition_map();
   MUST_USE_RESULT inline MaybeObject* set_elements_transition_map(
       Map* transitioned_map);
   inline void SetTransition(int transition_index, Map* target);
   inline Map* GetTransition(int transition_index);
-
   static Handle<TransitionArray> AddTransition(Handle<Map> map,
                                                Handle<Name> key,
                                                Handle<Map> target,
                                                SimpleTransitionFlag flag);
 
   MUST_USE_RESULT inline MaybeObject* AddTransition(Name* key,
                                                     Map* target,
                                                     SimpleTransitionFlag flag);
+  inline bool HasElementCallbacksTransition();
+  inline Map* element_callbacks_map();
+  MUST_USE_RESULT inline MaybeObject* set_element_callbacks_map(
+      Map* callbacks_map);
+
   DECL_ACCESSORS(transitions, TransitionArray)
   inline void ClearTransitions(Heap* heap,
                                WriteBarrierMode mode = UPDATE_WRITE_BARRIER);
 
   void DeprecateTransitionTree();
   void DeprecateTarget(Name* key, DescriptorArray* new_descriptors);
 
   Map* FindRootMap();
   Map* FindUpdatedMap(int verbatim, int length, DescriptorArray* descriptors);
   Map* FindLastMatchMap(int verbatim, int length, DescriptorArray* descriptors);
 
   int NumberOfFields();
 
+  bool MayHaveIndexedCallbacksInPrototypeChain();
+
   bool InstancesNeedRewriting(Map* target,
                               int target_number_of_fields,
                               int target_inobject,
                               int target_unused);
   static Handle<Map> GeneralizeAllFieldRepresentations(
       Handle<Map> map,
       Representation new_representation);
   static Handle<Map> GeneralizeRepresentation(
       Handle<Map> map,
       int modify_index,
@@ skipping 197 matching lines @@
                                                     TransitionFlag flag);
   MUST_USE_RESULT MaybeObject* CopyReplaceDescriptor(
       DescriptorArray* descriptors,
       Descriptor* descriptor,
       int index,
       TransitionFlag flag);
   MUST_USE_RESULT MaybeObject* AsElementsKind(ElementsKind kind);
 
   MUST_USE_RESULT MaybeObject* CopyAsElementsKind(ElementsKind kind,
                                                   TransitionFlag flag);
+  MUST_USE_RESULT MaybeObject* CopyAsElementCallbacksTransition(
+      bool with_dictionary_elements);
+  static Handle<Map> CopyAsElementCallbacksTransition(
+      Handle<Map> map, bool with_dictionary_elements);
 
   static Handle<Map> CopyForObserved(Handle<Map> map);
 
   static Handle<Map> CopyNormalized(Handle<Map> map,
                                     PropertyNormalizationMode mode,
                                     NormalizedMapSharingMode sharing);
 
   inline void AppendDescriptor(Descriptor* desc,
                                const DescriptorArray::WhitenessWitness&);
 
@@ skipping 157 matching lines @@
   // pointer if unused. When the map has transitions, the back pointer is
   // transferred to the transition array and accessed through an extra
   // indirection.
   static const int kTransitionsOrBackPointerOffset =
       kConstructorOffset + kPointerSize;
   static const int kDescriptorsOffset =
       kTransitionsOrBackPointerOffset + kPointerSize;
   static const int kCodeCacheOffset = kDescriptorsOffset + kPointerSize;
   static const int kDependentCodeOffset = kCodeCacheOffset + kPointerSize;
   static const int kBitField3Offset = kDependentCodeOffset + kPointerSize;
-  static const int kSize = kBitField3Offset + kPointerSize;
+  static const int kBitField4Offset = kBitField3Offset + kPointerSize;
+  static const int kSize = kBitField4Offset + kPointerSize;
 
   // Layout of pointer fields. Heap iteration code relies on them
   // being continuously allocated.
   static const int kPointerFieldsBeginOffset = Map::kPrototypeOffset;
   static const int kPointerFieldsEndOffset = kBitField3Offset + kPointerSize;
 
   // Byte offsets within kInstanceSizesOffset.
   static const int kInstanceSizeOffset = kInstanceSizesOffset + 0;
   static const int kInObjectPropertiesByte = 1;
   static const int kInObjectPropertiesOffset =
@@ skipping 4238 matching lines @@
     } else {
       value &= ~(1 << bit_position);
     }
     return value;
   }
 };
 
 } }  // namespace v8::internal
 
 #endif  // V8_OBJECTS_H_