Support strict and aliased arguments in Array.prototype.slice

src/builtins.cc

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/v8.h"
 
 #include "src/api.h"
 #include "src/arguments.h"
 #include "src/base/once.h"
 #include "src/bootstrapper.h"
@@ skipping 556 matching lines @@
 
       if (!array->HasFastElements()) {
         AllowHeapAllocation allow_allocation;
         return CallJsBuiltin(isolate, "ArraySlice", args);
       }
 
       len = Smi::cast(array->length())->value();
     } else {
       // Array.slice(arguments, ...) is quite a common idiom (notably more
       // than 50% of invocations in Web apps).  Treat it in C++ as well.
-      Map* arguments_map =
+      Map* sloppy_arguments_map =
           isolate->context()->native_context()->sloppy_arguments_map();
+      Map* strict_arguments_map =
+          isolate->context()->native_context()->strict_arguments_map();
+      Map* aliased_arguments_map =
+          isolate->context()->native_context()->aliased_arguments_map();
 
       bool is_arguments_object_with_fast_elements =
           receiver->IsJSObject() &&
-          JSObject::cast(*receiver)->map() == arguments_map;
+          (JSObject::cast(*receiver)->map() == sloppy_arguments_map ||
+           JSObject::cast(*receiver)->map() == strict_arguments_map ||
+           JSObject::cast(*receiver)->map() == aliased_arguments_map);
       if (!is_arguments_object_with_fast_elements) {
         AllowHeapAllocation allow_allocation;
         return CallJsBuiltin(isolate, "ArraySlice", args);
       }
       JSObject* object = JSObject::cast(*receiver);
 
-      if (!object->HasFastElements()) {
+      if (!object->HasFastElements() && !object->HasSloppyArgumentsElements()) {
         AllowHeapAllocation allow_allocation;
         return CallJsBuiltin(isolate, "ArraySlice", args);
       }
 
       Object* len_obj = object->InObjectPropertyAt(Heap::kArgumentsLengthIndex);
       if (!len_obj->IsSmi()) {
         AllowHeapAllocation allow_allocation;
         return CallJsBuiltin(isolate, "ArraySlice", args);
       }
       len = Smi::cast(len_obj)->value();
-      if (len > object->elements()->length()) {
+      if (object->map() == sloppy_arguments_map &&

[Igor Sheludko, 2015/01/30 14:13:29]

Ok, elements of the |aliased_arguments_map| is a special thing, but shouldn't we
also fall back to JS here in case of |strict_arguments_map|?

+          len > object->elements()->length()) {
         AllowHeapAllocation allow_allocation;
         return CallJsBuiltin(isolate, "ArraySlice", args);
       }
     }
 
     DCHECK(len >= 0);
     int n_arguments = args.length() - 1;
 
     // Note carefully choosen defaults---if argument is missing,
     // it's undefined which gets converted to 0 for relative_start
@@ skipping 42 matching lines @@
   int final = (relative_end < 0) ? Max(len + relative_end, 0)
                                  : Min(relative_end, len);
 
   // Calculate the length of result array.
   int result_len = Max(final - k, 0);
 
   Handle<JSObject> object = Handle<JSObject>::cast(receiver);
   Handle<FixedArrayBase> elms(object->elements(), isolate);
 
   ElementsKind kind = object->GetElementsKind();
+  if (kind == SLOPPY_ARGUMENTS_ELEMENTS) {
+    Handle<FixedArray> arguments(
+        FixedArray::cast(FixedArray::cast(*elms)->get(1)));
+    if (arguments->IsDictionary()) {
+      AllowHeapAllocation allow_allocation;
+      return CallJsBuiltin(isolate, "ArraySlice", args);
+    }
+    kind = FAST_HOLEY_ELEMENTS;
+  }
+
   if (IsHoleyElementsKind(kind)) {
     DisallowHeapAllocation no_gc;
     bool packed = true;
     ElementsAccessor* accessor = ElementsAccessor::ForKind(kind);
     for (int i = k; i < final; i++) {
       if (!accessor->HasElement(object, object, i, elms)) {
         packed = false;
         break;
       }
     }
@@ skipping 971 matching lines @@
 }
 BUILTIN_LIST_C(DEFINE_BUILTIN_ACCESSOR_C)
 BUILTIN_LIST_A(DEFINE_BUILTIN_ACCESSOR_A)
 BUILTIN_LIST_H(DEFINE_BUILTIN_ACCESSOR_H)
 BUILTIN_LIST_DEBUG_A(DEFINE_BUILTIN_ACCESSOR_A)
 #undef DEFINE_BUILTIN_ACCESSOR_C
 #undef DEFINE_BUILTIN_ACCESSOR_A
 
 
 } }  // namespace v8::internal