Support strict and aliased arguments in Array.prototype.slice

src/elements.cc

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/v8.h"
 
 #include "src/arguments.h"
 #include "src/conversions.h"
 #include "src/elements.h"
 #include "src/objects.h"
@@ skipping 1662 matching lines @@
         return FastHoleyObjectElementsAccessor::DeleteCommon(obj, key, mode);
       }
     }
     return isolate->factory()->true_value();
   }
 
   static void CopyElementsImpl(FixedArrayBase* from, uint32_t from_start,
                                FixedArrayBase* to, ElementsKind from_kind,
                                uint32_t to_start, int packed_size,
                                int copy_size) {
-    UNREACHABLE();
+    DCHECK_LE(0, copy_size);
+    if (copy_size == 0) return;
+    Isolate* isolate = from->GetIsolate();
+    FixedArray* parameter_map = FixedArray::cast(from);
+    FixedArray* arguments = FixedArray::cast(parameter_map->get(1));
+    // Since we may need to call back into JS if arguments is a dictionary,
+    // disallow copying it here.
+    DCHECK(!arguments->IsDictionary());
+    Context* context = Context::cast(parameter_map->get(0));
+    Object* the_hole = isolate->heap()->the_hole_value();
+
+    int max_copy_size = to->length() - to_start;
+    // Limit up to which we copy.
+    int copy_length = Min(max_copy_size, copy_size) + from_start;
+    // Portion of this limit that are mapped.
+    int mapped = Min(copy_length, parameter_map->length() - 2);
+    // Portion of the limit that is unmapped.
+    int actual = Min(copy_length, arguments->length());
+
+    // Copy arguments that may be mapped.
+    int limit = mapped - from_start;
+    int i;
+    for (i = 0; i < limit; i++) {
+      Object* probe = parameter_map->get(from_start + 2 + i);
+      Object* value;
+      if (probe->IsTheHole()) {
+        value = arguments->get(from_start + i);
+      } else {
+        int context_index = Smi::cast(probe)->value();
+        DCHECK(!context->get(context_index)->IsTheHole());
+        value = context->get(context_index);
+      }
+      FixedArray::cast(to)->set(to_start + i, value);

[Igor Sheludko, 2015/01/30 14:13:29]

I would suggest to move casts to FixedArray out of all loops although it's a nop
in release mode.

+    }
+
+    // Copy unmapped actual arguments.
+    limit = actual - from_start;
+    for (; i < limit; i++) {
+      Object* value = arguments->get(from_start + i);
+      FixedArray::cast(to)->set(to_start + i, value);
+    }
+
+    // Fill holes for "arguments" beyond the length of the actual arguments.
+    for (i += to_start; i < to->length(); i++) {
+      FixedArray::cast(to)->set(i, the_hole);
+    }
   }
 
   static uint32_t GetCapacityImpl(Handle<FixedArrayBase> backing_store) {
     Handle<FixedArray> parameter_map = Handle<FixedArray>::cast(backing_store);
     Handle<FixedArrayBase> arguments(
         FixedArrayBase::cast(parameter_map->get(1)));
     return Max(static_cast<uint32_t>(parameter_map->length() - 2),
                ForArray(arguments)->GetCapacity(arguments));
   }
 
@@ skipping 222 matching lines @@
       UNREACHABLE();
       break;
   }
 
   array->set_elements(*elms);
   array->set_length(Smi::FromInt(number_of_elements));
   return array;
 }
 
 } }  // namespace v8::internal