Support strict and aliased arguments in Array.prototype.slice

src/builtins.cc

Index: src/builtins.cc
diff --git a/src/builtins.cc b/src/builtins.cc
index b8d0b42d50e8f757497c12696d5112b1d03043b8..cca9547ef24b00b330aa0f7907506030f4d3e52a 100644
--- a/src/builtins.cc
+++ b/src/builtins.cc
@@ -574,19 +574,25 @@ BUILTIN(ArraySlice) {
     } else {
       // Array.slice(arguments, ...) is quite a common idiom (notably more
       // than 50% of invocations in Web apps).  Treat it in C++ as well.
-      Map* arguments_map =
+      Map* sloppy_arguments_map =
           isolate->context()->native_context()->sloppy_arguments_map();
+      Map* strict_arguments_map =
+          isolate->context()->native_context()->strict_arguments_map();
+      Map* aliased_arguments_map =
+          isolate->context()->native_context()->aliased_arguments_map();
 
       bool is_arguments_object_with_fast_elements =
           receiver->IsJSObject() &&
-          JSObject::cast(*receiver)->map() == arguments_map;
+          (JSObject::cast(*receiver)->map() == sloppy_arguments_map ||
+           JSObject::cast(*receiver)->map() == strict_arguments_map ||
+           JSObject::cast(*receiver)->map() == aliased_arguments_map);
       if (!is_arguments_object_with_fast_elements) {
         AllowHeapAllocation allow_allocation;
         return CallJsBuiltin(isolate, "ArraySlice", args);
       }
       JSObject* object = JSObject::cast(*receiver);
 
-      if (!object->HasFastElements()) {
+      if (!object->HasFastElements() && !object->HasSloppyArgumentsElements()) {
         AllowHeapAllocation allow_allocation;
         return CallJsBuiltin(isolate, "ArraySlice", args);
       }
@@ -597,7 +603,8 @@ BUILTIN(ArraySlice) {
         return CallJsBuiltin(isolate, "ArraySlice", args);
       }
       len = Smi::cast(len_obj)->value();
-      if (len > object->elements()->length()) {
+      if (object->map() == sloppy_arguments_map &&

[Igor Sheludko, 2015/01/30 14:13:29]

Ok, elements of the |aliased_arguments_map| is a special thing, but shouldn't we
also fall back to JS here in case of |strict_arguments_map|?

+          len > object->elements()->length()) {
         AllowHeapAllocation allow_allocation;
         return CallJsBuiltin(isolate, "ArraySlice", args);
       }
@@ -660,6 +667,16 @@ BUILTIN(ArraySlice) {
   Handle<FixedArrayBase> elms(object->elements(), isolate);
 
   ElementsKind kind = object->GetElementsKind();
+  if (kind == SLOPPY_ARGUMENTS_ELEMENTS) {
+    Handle<FixedArray> arguments(
+        FixedArray::cast(FixedArray::cast(*elms)->get(1)));
+    if (arguments->IsDictionary()) {
+      AllowHeapAllocation allow_allocation;
+      return CallJsBuiltin(isolate, "ArraySlice", args);
+    }
+    kind = FAST_HOLEY_ELEMENTS;
+  }
+
   if (IsHoleyElementsKind(kind)) {
     DisallowHeapAllocation no_gc;
     bool packed = true;