Remove JSReceiver::GetPrototype and replace it with PrototypeIterator calls

Remove JSReceiver::GetPrototype and replace it with PrototypeIterator calls

BUG=none
R=verwaest@chromium.org
LOG=n

Committed: https://code.google.com/p/v8/source/detail?r=22442

[Toon Verwaest, 2014-07-16 15:41:01]

https://codereview.chromium.org/390323002/diff/1/src/builtins.cc
File src/builtins.cc (right):

https://codereview.chromium.org/390323002/diff/1/src/builtins.cc#newcode264
src/builtins.cc:264: return true;
We still need to check whether we are actually at the end after array_proto.
Otherwise you could sneak something above Object.prototype with element
accessors.

https://codereview.chromium.org/390323002/diff/1/src/runtime.cc
File src/runtime.cc (right):

https://codereview.chromium.org/390323002/diff/1/src/runtime.cc#newcode5482
src/runtime.cc:5482: return HasOwnPropertyImplementation(
The recursion isn't necessary for keys that are array indices. Should leave a
TODO(verwaest) here to work on removing this.

[jochen (gone - plz use gerrit), 2014-07-17 06:58:02]

https://codereview.chromium.org/390323002/diff/1/src/builtins.cc
File src/builtins.cc (right):

https://codereview.chromium.org/390323002/diff/1/src/builtins.cc#newcode264
src/builtins.cc:264: return true;
On 2014/07/16 15:41:01, Toon Verwaest wrote:
> We still need to check whether we are actually at the end after array_proto.
> Otherwise you could sneak something above Object.prototype with element
> accessors.

that's handled by the check in line 258. The prototype iterator always goes to
the first prototype (unless you pass START_AT_RECEIVER to the ctor).

https://codereview.chromium.org/390323002/diff/1/src/runtime.cc
File src/runtime.cc (right):

https://codereview.chromium.org/390323002/diff/1/src/runtime.cc#newcode5482
src/runtime.cc:5482: return HasOwnPropertyImplementation(
On 2014/07/16 15:41:01, Toon Verwaest wrote:
> The recursion isn't necessary for keys that are array indices. Should leave a
> TODO(verwaest) here to work on removing this.

Done.

[Toon Verwaest, 2014-07-17 08:00:37]

https://codereview.chromium.org/390323002/diff/1/src/builtins.cc
File src/builtins.cc (right):

https://codereview.chromium.org/390323002/diff/1/src/builtins.cc#newcode264
src/builtins.cc:264: return true;
No it's not, due to line 259. We are checking Object.prototype, and ensuring
that's the last object in the chain.

On 2014/07/17 06:58:02, jochen wrote:
> On 2014/07/16 15:41:01, Toon Verwaest wrote:
> > We still need to check whether we are actually at the end after array_proto.
> > Otherwise you could sneak something above Object.prototype with element
> > accessors.
> 
> that's handled by the check in line 258. The prototype iterator always goes to
> the first prototype (unless you pass START_AT_RECEIVER to the ctor).

[jochen (gone - plz use gerrit), 2014-07-17 08:54:22]

ah, indeed. fixed.

[jochen (gone - plz use gerrit), 2014-07-17 08:54:24]

ah, indeed. fixed.

[Toon Verwaest, 2014-07-17 09:05:22]

lgtm

[jochen (gone - plz use gerrit), 2014-07-17 09:44:52]

Committed patchset #3 manually as r22442 (presubmit successful).

[arv (Not doing code reviews), 2014-07-17 16:19:48]

I'm curious if there is a motivation for this change. Is there a bug I can
track?

[jochen (gone - plz use gerrit), 2014-07-17 17:45:48]

On 2014/07/17 at 16:19:48, arv wrote:
> I'm curious if there is a motivation for this change. Is there a bug I can
track?

I've filed https://code.google.com/p/v8/issues/detail?id=3447

the idea right now is to just unify all accesses to the prototype. In my next
CL, I'll look at all places using map()->prototype()