Remove JSReceiver::GetPrototype and replace it with PrototypeIterator calls

src/builtins.cc

Index: src/builtins.cc
diff --git a/src/builtins.cc b/src/builtins.cc
index 925e8a97b8029b4713adc5abc4cc15c402dadf51..d127fc0cf329ee2f492d8e75d6a068b35e8bc50b 100644
--- a/src/builtins.cc
+++ b/src/builtins.cc
@@ -254,12 +254,14 @@ static bool ArrayPrototypeHasNoElements(Heap* heap,
   // fields.
   if (array_proto->elements() != heap->empty_fixed_array()) return false;
   // Object.prototype
-  Object* proto = array_proto->GetPrototype();
-  if (proto == heap->null_value()) return false;
-  array_proto = JSObject::cast(proto);
+  PrototypeIterator iter(heap->isolate(), array_proto);
+  if (iter.IsAtEnd()) {
+    return false;
+  }
+  array_proto = JSObject::cast(iter.GetCurrent());
   if (array_proto != native_context->initial_object_prototype()) return false;
   if (array_proto->elements() != heap->empty_fixed_array()) return false;
-  return array_proto->GetPrototype()->IsNull();
+  return true;

[Toon Verwaest, 2014/07/16 15:41:01]

We still need to check whether we are actually at the end after array_proto.
Otherwise you could sneak something above Object.prototype with element
accessors.

[jochen (gone - plz use gerrit), 2014/07/17 06:58:02]

that's handled by the check in line 258. The prototype iterator always goes to
the first prototype (unless you pass START_AT_RECEIVER to the ctor).

[Toon Verwaest, 2014/07/17 08:00:37]

No it's not, due to line 259. We are checking Object.prototype, and ensuring
that's the last object in the chain.

On 2014/07/17 06:58:02, jochen wrote:

 }
 
 
@@ -332,7 +334,8 @@ static inline bool IsJSArrayFastElementMovingAllowed(Heap* heap,
   Context* native_context = heap->isolate()->context()->native_context();
   JSObject* array_proto =
       JSObject::cast(native_context->array_function()->prototype());
-  return receiver->GetPrototype() == array_proto &&
+  PrototypeIterator iter(heap->isolate(), receiver);
+  return iter.GetCurrent() == array_proto &&
          ArrayPrototypeHasNoElements(heap, native_context, array_proto);
 }
 
@@ -1000,9 +1003,9 @@ BUILTIN(ArrayConcat) {
     bool is_holey = false;
     for (int i = 0; i < n_arguments; i++) {
       Object* arg = args[i];
-      if (!arg->IsJSArray() ||
-          !JSArray::cast(arg)->HasFastElements() ||
-          JSArray::cast(arg)->GetPrototype() != array_proto) {
+      PrototypeIterator iter(isolate, arg);
+      if (!arg->IsJSArray() || !JSArray::cast(arg)->HasFastElements() ||
+          iter.GetCurrent() != array_proto) {
         AllowHeapAllocation allow_allocation;
         return CallJsBuiltin(isolate, "ArrayConcatJS", args);
       }