Remove calls to SetLocalPropertyIgnoreAttributesTrampoline from accessors.cc

src/accessors.cc

Index: src/accessors.cc
diff --git a/src/accessors.cc b/src/accessors.cc
index 50232661c1976d67e61fe7855fd19e16d186197f..ff0647fb20aa4536ec9551edf08b46baee9ec649 100644
--- a/src/accessors.cc
+++ b/src/accessors.cc
@@ -148,45 +148,47 @@ MaybeObject* Accessors::ArrayGetLength(Isolate* isolate,
 
 
 // The helper function will 'flatten' Number objects.
-Object* Accessors::FlattenNumber(Isolate* isolate, Object* value) {
+Handle<Object> Accessors::FlattenNumber(Isolate* isolate,
+                                        Handle<Object> value) {
   if (value->IsNumber() || !value->IsJSValue()) return value;
-  JSValue* wrapper = JSValue::cast(value);
+  Handle<JSValue> wrapper = Handle<JSValue>::cast(value);
   ASSERT(wrapper->GetIsolate()->context()->native_context()->number_function()->
       has_initial_map());
-  Map* number_map = isolate->context()->native_context()->
-      number_function()->initial_map();
-  if (wrapper->map() == number_map) return wrapper->value();
+  if (wrapper->map() ==
+      isolate->context()->native_context()->number_function()->initial_map()) {
+    return handle(wrapper->value(), isolate);
+  }
+
   return value;
 }
 
 
 MaybeObject* Accessors::ArraySetLength(Isolate* isolate,
-                                       JSObject* object,
-                                       Object* value,
+                                       JSObject* object_raw,
+                                       Object* value_raw,
                                        void*) {
+  HandleScope scope(isolate);
+  Handle<JSObject> object(object_raw, isolate);
+  Handle<Object> value(value_raw, isolate);
+
   // This means one of the object's prototypes is a JSArray and the
   // object does not have a 'length' property.  Calling SetProperty
   // causes an infinite loop.
   if (!object->IsJSArray()) {
-    return object->SetLocalPropertyIgnoreAttributesTrampoline(
-        isolate->heap()->length_string(), value, NONE);
+    return *JSObject::SetLocalPropertyIgnoreAttributes(object,

[Michael Starzinger, 2013/11/05 12:48:17]

I think it's possible that setting the property fails due to an exception (e.g.
extension of "object" has been prevented). In that case the returned handle
might be empty and the dereference will fail. We should use the following
pattern ...

Handle<Object> result = JSObject::SetLocalPropertyIgnoreAttributes();
RETURN_IF_EMPTY_HANDLE(isolate, result);
return *result;

[rafaelw, 2013/11/05 13:35:16]

Done.

+        isolate->factory()->length_string(), value, NONE);
   }
 
   value = FlattenNumber(isolate, value);
 
-  // Need to call methods that may trigger GC.
-  HandleScope scope(isolate);
-
-  // Protect raw pointers.
-  Handle<JSArray> array_handle(JSArray::cast(object), isolate);
-  Handle<Object> value_handle(value, isolate);
+  Handle<JSArray> array_handle(Handle<JSArray>::cast(object));

[Michael Starzinger, 2013/11/05 12:48:17]

nit: Better use assignment instead of constructor syntax here for consistency
with the rest of the code ...

Handle<JSArray> array_handle = Handle<JSArray>::cast(object);

[rafaelw, 2013/11/05 13:35:16]

Done.

 
   bool has_exception;
   Handle<Object> uint32_v =
-      Execution::ToUint32(isolate, value_handle, &has_exception);
+      Execution::ToUint32(isolate, value, &has_exception);
   if (has_exception) return Failure::Exception();
   Handle<Object> number_v =
-      Execution::ToNumber(isolate, value_handle, &has_exception);
+      Execution::ToNumber(isolate, value, &has_exception);
   if (has_exception) return Failure::Exception();
 
   if (uint32_v->Number() == number_v->Number()) {
@@ -578,26 +580,26 @@ MaybeObject* Accessors::FunctionGetPrototype(Isolate* isolate,
 
 
 MaybeObject* Accessors::FunctionSetPrototype(Isolate* isolate,
-                                             JSObject* object,
+                                             JSObject* object_raw,
                                              Object* value_raw,
                                              void*) {
-  Heap* heap = isolate->heap();
-  JSFunction* function_raw = FindInstanceOf<JSFunction>(isolate, object);
-  if (function_raw == NULL) return heap->undefined_value();
-  if (!function_raw->should_have_prototype()) {
-    // Since we hit this accessor, object will have no prototype property.
-    return object->SetLocalPropertyIgnoreAttributesTrampoline(
-        heap->prototype_string(), value_raw, NONE);
-  }
+  JSFunction* function_raw = FindInstanceOf<JSFunction>(isolate, object_raw);
+  if (function_raw == NULL) return isolate->heap()->undefined_value();
 
   HandleScope scope(isolate);
   Handle<JSFunction> function(function_raw, isolate);
+  Handle<Object> object(object_raw, isolate);
   Handle<Object> value(value_raw, isolate);
+  if (!function->should_have_prototype()) {
+    // Since we hit this accessor, object will have no prototype property.
+    return *JSObject::SetLocalPropertyIgnoreAttributes(object,

[Michael Starzinger, 2013/11/05 12:48:17]

Likewise. See the comment above about the possibility of an exception.

[rafaelw, 2013/11/05 13:35:16]

Done.

+        isolate->factory()->prototype_string(), value, NONE);
+  }
 
   Handle<Object> old_value;
   bool is_observed =
       FLAG_harmony_observation &&
-      *function == object &&
+      *function == *object &&
       function->map()->is_observed();
   if (is_observed) {
     if (function->has_prototype())