Changed runtime system to preserve the global property cells for deleted prop...

src/objects.cc

 // Copyright 2006-2008 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 417 matching lines @@
   }
   return value;
 }
 
 
 Object* JSObject::SetNormalizedProperty(String* name,
                                         Object* value,
                                         PropertyDetails details) {
   ASSERT(!HasFastProperties());
   int entry = property_dictionary()->FindStringEntry(name);
-  if (entry == -1) {
+  if (entry == Dictionary::kNotFound) {
     Object* store_value = value;
     if (IsJSGlobalObject()) {
       store_value = Heap::AllocateJSGlobalPropertyCell(value);
       if (store_value->IsFailure()) return store_value;
     }
     Object* dict =
         property_dictionary()->AddStringEntry(name, store_value, details);
     if (dict->IsFailure()) return dict;
     set_properties(Dictionary::cast(dict));
     return value;
   }
   // Preserve enumeration index.
   details = PropertyDetails(details.attributes(),
                             details.type(),
                             property_dictionary()->DetailsAt(entry).index());
   if (IsJSGlobalObject()) {
     JSGlobalPropertyCell* cell =
         JSGlobalPropertyCell::cast(property_dictionary()->ValueAt(entry));
     cell->set_value(value);
     // Please note we have to update the property details.
-    property_dictionary()->SetStringEntry(entry, name, cell, details);
+    property_dictionary()->DetailsAtPut(entry, details);
   } else {
     property_dictionary()->SetStringEntry(entry, name, value, details);
   }
   return value;
 }
 
 
+Object* JSObject::DeleteNormalizedProperty(String* name) {
+  ASSERT(!HasFastProperties());
+  Dictionary* dictionary = property_dictionary();
+  int entry = dictionary->FindStringEntry(name);
+  if (entry != Dictionary::kNotFound) {
+    PropertyDetails details = dictionary->DetailsAt(entry);
+    if (details.IsDontDelete()) return Heap::false_value();
+    // If we have a global object set the cell to the hole.
+    if (IsJSGlobalObject()) {
+      JSGlobalPropertyCell* cell =
+          JSGlobalPropertyCell::cast(dictionary->ValueAt(entry));
+      cell->set_value(Heap::the_hole_value());
+      dictionary->DetailsAtPut(entry, details.AsDeleted());
+    } else {
+      return dictionary->DeleteProperty(entry);
+    }
+  }
+  return Heap::true_value();
+}
+
+
 Object* Object::GetProperty(Object* receiver,
                             LookupResult* result,
                             String* name,
                             PropertyAttributes* attributes) {
   // Make sure that the top context does not change when doing
   // callbacks or interceptor calls.
   AssertNoContextChange ncc;
 
   // Traverse the prototype chain from the current object (this) to
   // the holder and check for access rights. This avoid traversing the
@@ skipping 839 matching lines @@
   old_map->set_instance_descriptors(DescriptorArray::cast(new_descriptors));
 
   return function;
 }
 
 
 // Add property in slow mode
 Object* JSObject::AddSlowProperty(String* name,
                                   Object* value,
                                   PropertyAttributes attributes) {
-  PropertyDetails details = PropertyDetails(attributes, NORMAL);
+  ASSERT(!HasFastProperties());
+  Dictionary* dict = property_dictionary();
   Object* store_value = value;
   if (IsJSGlobalObject()) {
+    // In case name is an orphaned property reuse the cell.
+    int entry = dict->FindStringEntry(name);
+    if (entry != Dictionary::kNotFound) {
+      store_value = dict->ValueAt(entry);
+      JSGlobalPropertyCell::cast(store_value)->set_value(value);
+      PropertyDetails details = PropertyDetails(attributes, NORMAL);
+      dict->SetStringEntry(entry, name, store_value, details);
+      return value;
+    }
     store_value = Heap::AllocateJSGlobalPropertyCell(value);
     if (store_value->IsFailure()) return store_value;
+    JSGlobalPropertyCell::cast(store_value)->set_value(value);
   }
-  Object* result = property_dictionary()->AddStringEntry(name,
-                                                         store_value,
-                                                         details);
+  PropertyDetails details = PropertyDetails(attributes, NORMAL);
+  Object* result = dict->AddStringEntry(name, store_value, details);
   if (result->IsFailure()) return result;
-  if (property_dictionary() != result) {
-    set_properties(Dictionary::cast(result));
-  }
+  if (dict != result) set_properties(Dictionary::cast(result));
   return value;
 }
 
 
 Object* JSObject::AddProperty(String* name,
                               Object* value,
                               PropertyAttributes attributes) {
   ASSERT(!IsJSGlobalProxy());
   if (HasFastProperties()) {
     // Ensure the descriptor array does not get too big.
@@ skipping 287 matching lines @@
       // Disallow caching for uninitialized constants. These can only
       // occur as fields.
       if (result->IsReadOnly() && result->type() == FIELD &&
           FastPropertyAt(result->GetFieldIndex())->IsTheHole()) {
         result->DisallowCaching();
       }
       return;
     }
   } else {
     int entry = property_dictionary()->FindStringEntry(name);
-    if (entry != DescriptorArray::kNotFound) {
+    if (entry != Dictionary::kNotFound) {
       // Make sure to disallow caching for uninitialized constants
       // found in the dictionary-mode objects.
       Object* value = property_dictionary()->ValueAt(entry);
       if (IsJSGlobalObject()) {
+        PropertyDetails d = property_dictionary()->DetailsAt(entry);
+        if (d.IsDeleted()) {
+          result->NotFound();
+          return;
+        }
         value = JSGlobalPropertyCell::cast(value)->value();
       }
       if (value->IsTheHole()) {
         result->DisallowCaching();
       }
       result->DictionaryResult(this, entry);
       return;
     }
     // Slow case object skipped during lookup. Do not use inline caching.
     result->DisallowCaching();
@@ skipping 517 matching lines @@
 Object* JSObject::DeletePropertyPostInterceptor(String* name) {
   // Check local property, ignore interceptor.
   LookupResult result;
   LocalLookupRealNamedProperty(name, &result);
   if (!result.IsValid()) return Heap::true_value();
 
   // Normalize object if needed.
   Object* obj = NormalizeProperties(CLEAR_INOBJECT_PROPERTIES);
   if (obj->IsFailure()) return obj;
 
-  ASSERT(!HasFastProperties());
-  // Attempt to remove the property from the property dictionary.
-  Dictionary* dictionary = property_dictionary();
-  int entry = dictionary->FindStringEntry(name);
-  if (entry != -1) return dictionary->DeleteProperty(entry);
-  return Heap::true_value();
+  return DeleteNormalizedProperty(name);
 }
 
 
 Object* JSObject::DeletePropertyWithInterceptor(String* name) {
   HandleScope scope;
   Handle<InterceptorInfo> interceptor(GetNamedInterceptor());
   Handle<String> name_handle(name);
   Handle<JSObject> this_handle(this);
   if (!interceptor->deleter()->IsUndefined()) {
     v8::NamedPropertyDeleter deleter =
@@ skipping 27 matching lines @@
       static_cast<uint32_t>(Smi::cast(JSArray::cast(this)->length())->value()) :
       static_cast<uint32_t>(FixedArray::cast(elements())->length());
     if (index < length) {
       FixedArray::cast(elements())->set_the_hole(index);
     }
     return Heap::true_value();
   }
   ASSERT(!HasFastElements());
   Dictionary* dictionary = element_dictionary();
   int entry = dictionary->FindNumberEntry(index);
-  if (entry != -1) return dictionary->DeleteProperty(entry);
+  if (entry != Dictionary::kNotFound) return dictionary->DeleteProperty(entry);
   return Heap::true_value();
 }
 
 
 Object* JSObject::DeleteElementWithInterceptor(uint32_t index) {
   // Make sure that the top context does not change when doing
   // callbacks or interceptor calls.
   AssertNoContextChange ncc;
   HandleScope scope;
   Handle<InterceptorInfo> interceptor(GetIndexedInterceptor());
@@ skipping 46 matching lines @@
     uint32_t length = IsJSArray() ?
       static_cast<uint32_t>(Smi::cast(JSArray::cast(this)->length())->value()) :
       static_cast<uint32_t>(FixedArray::cast(elements())->length());
     if (index < length) {
       FixedArray::cast(elements())->set_the_hole(index);
     }
     return Heap::true_value();
   } else {
     Dictionary* dictionary = element_dictionary();
     int entry = dictionary->FindNumberEntry(index);
-    if (entry != -1) return dictionary->DeleteProperty(entry);
+    if (entry != Dictionary::kNotFound) {
+      return dictionary->DeleteProperty(entry);
+    }
   }
   return Heap::true_value();
 }
 
 
 Object* JSObject::DeleteProperty(String* name) {
   // ECMA-262, 3rd, 8.6.2.5
   ASSERT(name->IsString());
 
   // Check access rights if needed.
@@ skipping 22 matching lines @@
     if (result.type() == INTERCEPTOR) {
       return DeletePropertyWithInterceptor(name);
     }
     if (!result.IsLoaded()) {
       return JSObject::cast(this)->DeleteLazyProperty(&result, name);
     }
     // Normalize object if needed.
     Object* obj = NormalizeProperties(CLEAR_INOBJECT_PROPERTIES);
     if (obj->IsFailure()) return obj;
     // Make sure the properties are normalized before removing the entry.
-    Dictionary* dictionary = property_dictionary();
-    int entry = dictionary->FindStringEntry(name);
-    if (entry != -1) return dictionary->DeleteProperty(entry);
-    return Heap::true_value();
+    return DeleteNormalizedProperty(name);
   }
 }
 
 
 // Check whether this object references another object.
 bool JSObject::ReferencesObject(Object* obj) {
   AssertNoAllocation no_alloc;
 
   // Is the object the constructor for this object?
   if (map()->constructor() == obj) {
@@ skipping 2689 matching lines @@
   if (HasFastElements()) {
     uint32_t length = IsJSArray() ?
         static_cast<uint32_t>(
             Smi::cast(JSArray::cast(this)->length())->value()) :
         static_cast<uint32_t>(FixedArray::cast(elements())->length());
     if ((index < length) &&
         !FixedArray::cast(elements())->get(index)->IsTheHole()) {
       return true;
     }
   } else {
-    if (element_dictionary()->FindNumberEntry(index) != -1) return true;
+    if (element_dictionary()->FindNumberEntry(index) != Dictionary::kNotFound) {
+      return true;
+    }
   }
 
   // Handle [] on String objects.
   if (this->IsStringObjectWithCharacterAt(index)) return true;
 
   Object* pt = GetPrototype();
   if (pt == Heap::null_value()) return false;
   return JSObject::cast(pt)->HasElementWithReceiver(receiver, index);
 }
 
@@ skipping 54 matching lines @@
   if (this->IsStringObjectWithCharacterAt(index)) return true;
 
   if (HasFastElements()) {
     uint32_t length = IsJSArray() ?
         static_cast<uint32_t>(
             Smi::cast(JSArray::cast(this)->length())->value()) :
         static_cast<uint32_t>(FixedArray::cast(elements())->length());
     return (index < length) &&
            !FixedArray::cast(elements())->get(index)->IsTheHole();
   } else {
-    return element_dictionary()->FindNumberEntry(index) != -1;
+    return element_dictionary()->FindNumberEntry(index)
+        != Dictionary::kNotFound;
   }
 }
 
 
 bool JSObject::HasElementWithReceiver(JSObject* receiver, uint32_t index) {
   // Check access rights if needed.
   if (IsAccessCheckNeeded() &&
       !Top::MayIndexedAccess(this, index, v8::ACCESS_HAS)) {
     Top::ReportFailedAccessCheck(this, v8::ACCESS_HAS);
     return false;
   }
 
   // Check for lookup interceptor
   if (HasIndexedInterceptor()) {
     return HasElementWithInterceptor(receiver, index);
   }
 
   if (HasFastElements()) {
     uint32_t length = IsJSArray() ?
         static_cast<uint32_t>(
             Smi::cast(JSArray::cast(this)->length())->value()) :
         static_cast<uint32_t>(FixedArray::cast(elements())->length());
     if ((index < length) &&
         !FixedArray::cast(elements())->get(index)->IsTheHole()) return true;
   } else {
-    if (element_dictionary()->FindNumberEntry(index) != -1) return true;
+    if (element_dictionary()->FindNumberEntry(index) != Dictionary::kNotFound) {
+      return true;
+    }
   }
 
   // Handle [] on String objects.
   if (this->IsStringObjectWithCharacterAt(index)) return true;
 
   Object* pt = GetPrototype();
   if (pt == Heap::null_value()) return false;
   return JSObject::cast(pt)->HasElementWithReceiver(receiver, index);
 }
 
@@ skipping 187 matching lines @@
   // JSArray::length cannot change.
   if (HasFastElements()) {
     FixedArray* elms = FixedArray::cast(elements());
     if (index < static_cast<uint32_t>(elms->length())) {
       Object* value = elms->get(index);
       if (!value->IsTheHole()) return value;
     }
   } else {
     Dictionary* dictionary = element_dictionary();
     int entry = dictionary->FindNumberEntry(index);
-    if (entry != -1) {
+    if (entry != Dictionary::kNotFound) {
       return dictionary->ValueAt(entry);
     }
   }
 
   // Continue searching via the prototype chain.
   Object* pt = GetPrototype();
   if (pt == Heap::null_value()) return Heap::undefined_value();
   return pt->GetElementWithReceiver(receiver, index);
 }
 
@@ skipping 49 matching lines @@
   // JSArray::length cannot change.
   if (HasFastElements()) {
     FixedArray* elms = FixedArray::cast(elements());
     if (index < static_cast<uint32_t>(elms->length())) {
       Object* value = elms->get(index);
       if (!value->IsTheHole()) return value;
     }
   } else {
     Dictionary* dictionary = element_dictionary();
     int entry = dictionary->FindNumberEntry(index);
-    if (entry != -1) {
+    if (entry != Dictionary::kNotFound) {
       return dictionary->ValueAt(entry);
     }
   }
 
   Object* pt = GetPrototype();
   if (pt == Heap::null_value()) return Heap::undefined_value();
   return pt->GetElementWithReceiver(receiver, index);
 }
 
 
@@ skipping 239 matching lines @@
   if (this->IsStringObjectWithCharacterAt(index)) return true;
 
   if (HasFastElements()) {
     uint32_t length = IsJSArray() ?
         static_cast<uint32_t>(
             Smi::cast(JSArray::cast(this)->length())->value()) :
         static_cast<uint32_t>(FixedArray::cast(elements())->length());
     return (index < length) &&
         !FixedArray::cast(elements())->get(index)->IsTheHole();
   }
-  return element_dictionary()->FindNumberEntry(index) != -1;
+  return element_dictionary()->FindNumberEntry(index)
+      != Dictionary::kNotFound;
 }
 
 
 bool JSObject::HasRealNamedCallbackProperty(String* key) {
   // Check access rights if needed.
   if (IsAccessCheckNeeded() &&
       !Top::MayNamedAccess(this, key, v8::ACCESS_HAS)) {
     Top::ReportFailedAccessCheck(this, v8::ACCESS_HAS);
     return false;
   }
@@ skipping 510 matching lines @@
     HashTable::cast(obj)->SetCapacity(capacity);
   }
   return obj;
 }
 
 
 // Find entry for key otherwise return -1.
 template <int prefix_size, int element_size>
 int HashTable<prefix_size, element_size>::FindEntry(HashTableKey* key) {
   uint32_t nof = NumberOfElements();
-  if (nof == 0) return -1;  // Bail out if empty.
+  if (nof == 0) return kNotFound;  // Bail out if empty.
 
   uint32_t capacity = Capacity();
   uint32_t hash = key->Hash();
   uint32_t entry = GetProbe(hash, 0, capacity);
 
   Object* element = KeyAt(entry);
   uint32_t passed_elements = 0;
   if (!element->IsNull()) {
     if (!element->IsUndefined() && key->IsMatch(element)) return entry;
-    if (++passed_elements == nof) return -1;
+    if (++passed_elements == nof) return kNotFound;
   }
   for (uint32_t i = 1; !element->IsUndefined(); i++) {
     entry = GetProbe(hash, i, capacity);
     element = KeyAt(entry);
     if (!element->IsNull()) {
       if (!element->IsUndefined() && key->IsMatch(element)) return entry;
-      if (++passed_elements == nof) return -1;
+      if (++passed_elements == nof) return kNotFound;
     }
   }
-  return -1;
+  return kNotFound;
 }
 
 
 template<int prefix_size, int element_size>
 Object* HashTable<prefix_size, element_size>::EnsureCapacity(
     int n, HashTableKey* key) {
   int capacity = Capacity();
   int nof = NumberOfElements() + n;
   // Make sure 25% is free
   if (nof + (nof >> 2) <= capacity) return this;
@@ skipping 56 matching lines @@
 
 Object* SymbolTable::LookupString(String* string, Object** s) {
   SymbolKey key(string);
   return LookupKey(&key, s);
 }
 
 
 bool SymbolTable::LookupSymbolIfExists(String* string, String** symbol) {
   SymbolKey key(string);
   int entry = FindEntry(&key);
-  if (entry == -1) {
+  if (entry == kNotFound) {
     return false;
   } else {
     String* result = String::cast(KeyAt(entry));
     ASSERT(StringShape(result).IsSymbol());
     *symbol = result;
     return true;
   }
 }
 
 
 Object* SymbolTable::LookupSymbol(Vector<const char> str, Object** s) {
   Utf8SymbolKey key(str);
   return LookupKey(&key, s);
 }
 
 
 Object* SymbolTable::LookupKey(HashTableKey* key, Object** s) {
   int entry = FindEntry(key);
 
   // Symbol already in table.
-  if (entry != -1) {
+  if (entry != kNotFound) {
     *s = KeyAt(entry);
     return this;
   }
 
   // Adding new symbol. Grow table if needed.
   Object* obj = EnsureCapacity(1, key);
   if (obj->IsFailure()) return obj;
 
   // Create symbol object.
   Object* symbol = key->GetObject();
   if (symbol->IsFailure()) return symbol;
 
   // If the symbol table grew as part of EnsureCapacity, obj is not
   // the current symbol table and therefore we cannot use
   // SymbolTable::cast here.
   SymbolTable* table = reinterpret_cast<SymbolTable*>(obj);
 
   // Add the new symbol and return it along with the symbol table.
   entry = table->FindInsertionEntry(symbol, key->Hash());
   table->set(EntryToIndex(entry), symbol);
   table->ElementAdded();
   *s = symbol;
   return table;
 }
 
 
 Object* CompilationCacheTable::Lookup(String* src) {
   StringKey key(src);
   int entry = FindEntry(&key);
-  if (entry == -1) return Heap::undefined_value();
+  if (entry == kNotFound) return Heap::undefined_value();
   return get(EntryToIndex(entry) + 1);
 }
 
 
 Object* CompilationCacheTable::LookupEval(String* src, Context* context) {
   StringSharedKey key(src, context->closure()->shared());
   int entry = FindEntry(&key);
-  if (entry == -1) return Heap::undefined_value();
+  if (entry == kNotFound) return Heap::undefined_value();
   return get(EntryToIndex(entry) + 1);
 }
 
 
 Object* CompilationCacheTable::LookupRegExp(String* src,
                                             JSRegExp::Flags flags) {
   RegExpKey key(src, flags);
   int entry = FindEntry(&key);
-  if (entry == -1) return Heap::undefined_value();
+  if (entry == kNotFound) return Heap::undefined_value();
   return get(EntryToIndex(entry) + 1);
 }
 
 
 Object* CompilationCacheTable::Put(String* src, Object* value) {
   StringKey key(src);
   Object* obj = EnsureCapacity(1, &key);
   if (obj->IsFailure()) return obj;
 
   CompilationCacheTable* cache =
@@ skipping 129 matching lines @@
 
  private:
   Map* map_;
   String* name_;
 };
 
 
 Object* MapCache::Lookup(FixedArray* array) {
   SymbolsKey key(array);
   int entry = FindEntry(&key);
-  if (entry == -1) return Heap::undefined_value();
+  if (entry == kNotFound) return Heap::undefined_value();
   return get(EntryToIndex(entry) + 1);
 }
 
 
 Object* MapCache::Put(FixedArray* array, Map* value) {
   SymbolsKey key(array);
   Object* obj = EnsureCapacity(1, &key);
   if (obj->IsFailure()) return obj;
 
   MapCache* cache = reinterpret_cast<MapCache*>(obj);
   int entry = cache->FindInsertionEntry(array, key.Hash());
   cache->set(EntryToIndex(entry), array);
   cache->set(EntryToIndex(entry) + 1, value);
   cache->ElementAdded();
   return cache;
 }
 
 
 int LookupCache::Lookup(Map* map, String* name) {
   MapNameKey key(map, name);
   int entry = FindEntry(&key);
-  if (entry == -1) return kNotFound;
+  if (entry == kNotFound) return kNotFound;
   return Smi::cast(get(EntryToIndex(entry) + 1))->value();
 }
 
 
 Object* LookupCache::Put(Map* map, String* name, int value) {
   MapNameKey key(map, name);
   Object* obj = EnsureCapacity(1, &key);
   if (obj->IsFailure()) return obj;
   Object* k = key.GetObject();
   if (k->IsFailure()) return k;
@@ skipping 130 matching lines @@
 int Dictionary::FindNumberEntry(uint32_t index) {
   NumberKey k(index);
   return FindEntry(&k);
 }
 
 
 Object* Dictionary::AtPut(HashTableKey* key, Object* value) {
   int entry = FindEntry(key);
 
   // If the entry is present set the value;
-  if (entry != -1) {
+  if (entry != kNotFound) {
     ValueAtPut(entry, value);
     return this;
   }
 
   // Check whether the dictionary should be extended.
   Object* obj = EnsureCapacity(1, key);
   if (obj->IsFailure()) return obj;
   Object* k = key->GetObject();
   if (k->IsFailure()) return k;
   PropertyDetails details = PropertyDetails(NONE, NORMAL);
@@ skipping 54 matching lines @@
         Smi::FromInt(key << kRequiresSlowElementsTagSize),
         SKIP_WRITE_BARRIER);
   }
 }
 
 
 Object* Dictionary::AddStringEntry(String* key,
                                    Object* value,
                                    PropertyDetails details) {
   StringKey k(key);
-  SLOW_ASSERT(FindEntry(&k) == -1);
+  SLOW_ASSERT(FindEntry(&k) == kNotFound);
   return Add(&k, value, details);
 }
 
 
 Object* Dictionary::AddNumberEntry(uint32_t key,
                                    Object* value,
                                    PropertyDetails details) {
   NumberKey k(key);
   UpdateMaxNumberKey(key);
-  SLOW_ASSERT(FindEntry(&k) == -1);
+  SLOW_ASSERT(FindEntry(&k) == kNotFound);
   return Add(&k, value, details);
 }
 
 
 Object* Dictionary::AtNumberPut(uint32_t key, Object* value) {
   NumberKey k(key);
   UpdateMaxNumberKey(key);
   return AtPut(&k, value);
 }
 
@@ skipping 521 matching lines @@
   // No break point.
   if (break_point_objects()->IsUndefined()) return 0;
   // Single beak point.
   if (!break_point_objects()->IsFixedArray()) return 1;
   // Multiple break points.
   return FixedArray::cast(break_point_objects())->length();
 }
 
 
 } }  // namespace v8::internal