Use Cells to check prototype chain validity (disabled by default).

src/ic/handler-compiler.cc

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/v8.h"
 
 #include "src/cpu-profiler.h"
 #include "src/ic/call-optimization.h"
 #include "src/ic/handler-compiler.h"
 #include "src/ic/ic.h"
@@ skipping 69 matching lines @@
 #endif
   return code;
 }
 
 
 #define __ ACCESS_MASM(masm())
 
 
 Register NamedLoadHandlerCompiler::FrontendHeader(Register object_reg,
                                                   Handle<Name> name,
-                                                  Label* miss) {
+                                                  Label* miss,
+                                                  ReturnHolder return_what) {
   PrototypeCheckType check_type = CHECK_ALL_MAPS;
   int function_index = -1;
   if (map()->instance_type() < FIRST_NONSTRING_TYPE) {
     function_index = Context::STRING_FUNCTION_INDEX;
   } else if (map()->instance_type() == SYMBOL_TYPE) {
     function_index = Context::SYMBOL_FUNCTION_INDEX;
   } else if (map()->instance_type() == HEAP_NUMBER_TYPE) {
     function_index = Context::NUMBER_FUNCTION_INDEX;
   } else if (*map() == isolate()->heap()->boolean_map()) {
     function_index = Context::BOOLEAN_FUNCTION_INDEX;
   } else {
     check_type = SKIP_RECEIVER;
   }
 
   if (check_type == CHECK_ALL_MAPS) {
     GenerateDirectLoadGlobalFunctionPrototype(masm(), function_index,
                                               scratch1(), miss);
     Object* function = isolate()->native_context()->get(function_index);
     Object* prototype = JSFunction::cast(function)->instance_prototype();
     Handle<Map> map(JSObject::cast(prototype)->map());
     set_map(map);
     object_reg = scratch1();
   }
 
   // Check that the maps starting from the prototype haven't changed.
   return CheckPrototypes(object_reg, scratch1(), scratch2(), scratch3(), name,
-                         miss, check_type);
+                         miss, check_type, return_what);
 }
 
 
 // Frontend for store uses the name register. It has to be restored before a
 // miss.
 Register NamedStoreHandlerCompiler::FrontendHeader(Register object_reg,
                                                    Handle<Name> name,
-                                                   Label* miss) {
+                                                   Label* miss,
+                                                   ReturnHolder return_what) {
   return CheckPrototypes(object_reg, this->name(), scratch1(), scratch2(), name,
-                         miss, SKIP_RECEIVER);
+                         miss, SKIP_RECEIVER, return_what);
 }
 
 
 Register PropertyHandlerCompiler::Frontend(Handle<Name> name) {
   Label miss;
   if (IC::ICUseVector(kind())) {
     PushVectorAndSlot();
   }
-  Register reg = FrontendHeader(receiver(), name, &miss);
+  Register reg = FrontendHeader(receiver(), name, &miss, RETURN_HOLDER);
   FrontendFooter(name, &miss);
   // The footer consumes the vector and slot from the stack if miss occurs.
   if (IC::ICUseVector(kind())) {
     DiscardVectorAndSlot();
   }
   return reg;
 }
 
 
 void PropertyHandlerCompiler::NonexistentFrontendHeader(Handle<Name> name,
                                                         Label* miss,
                                                         Register scratch1,
                                                         Register scratch2) {
   Register holder_reg;
   Handle<Map> last_map;
   if (holder().is_null()) {
     holder_reg = receiver();
     last_map = map();
     // If |type| has null as its prototype, |holder()| is
     // Handle<JSObject>::null().
     DCHECK(last_map->prototype() == isolate()->heap()->null_value());
   } else {
-    holder_reg = FrontendHeader(receiver(), name, miss);
     last_map = handle(holder()->map());
+    // This condition matches the branches below.
+    bool need_holder =
+        last_map->is_dictionary_map() && !last_map->IsJSGlobalObjectMap();
+    holder_reg =
+        FrontendHeader(receiver(), name, miss,
+                       need_holder ? RETURN_HOLDER : DONT_RETURN_ANYTHING);
   }
 
   if (last_map->is_dictionary_map()) {
     if (last_map->IsJSGlobalObjectMap()) {
       Handle<JSGlobalObject> global =
           holder().is_null()
               ? Handle<JSGlobalObject>::cast(isolate()->global_object())
               : Handle<JSGlobalObject>::cast(holder());
       GenerateCheckPropertyCell(masm(), global, name, scratch1, miss);
     } else {
@@ skipping 150 matching lines @@
     JSObject* last = *holder();
     PrototypeIterator iter(isolate(), last);
     while (!iter.IsAtEnd()) {
       lost_holder_register = true;
       last = JSObject::cast(iter.GetCurrent());
       iter.Advance();
     }
     auto last_handle = handle(last);
     set_holder(last_handle);
   }
-  Register reg = FrontendHeader(receiver(), it->name(), &miss);
+  Register reg = FrontendHeader(receiver(), it->name(), &miss, RETURN_HOLDER);
   // Reset the holder so further calculations are correct.
   set_holder(holder_orig);
   if (lost_holder_register) {
     if (*it->GetReceiver() == *holder()) {
       reg = receiver();
     } else {
       // Reload lost holder register.
       auto cell = isolate()->factory()->NewWeakCell(holder());
       __ LoadWeakValue(reg, cell, &miss);
     }
@@ skipping 14 matching lines @@
 void NamedLoadHandlerCompiler::GenerateLoadPostInterceptor(
     LookupIterator* it, Register interceptor_reg) {
   Handle<JSObject> real_named_property_holder(it->GetHolder<JSObject>());
 
   Handle<Map> holder_map(holder()->map());
   set_map(holder_map);
   set_holder(real_named_property_holder);
 
   Label miss;
   InterceptorVectorSlotPush(interceptor_reg);
-  Register reg = FrontendHeader(interceptor_reg, it->name(), &miss);
+  Register reg =
+      FrontendHeader(interceptor_reg, it->name(), &miss, RETURN_HOLDER);
   FrontendFooter(it->name(), &miss);
   // We discard the vector and slot now because we don't miss below this point.
   InterceptorVectorSlotPop(reg, DISCARD);
 
   switch (it->state()) {
     case LookupIterator::ACCESS_CHECK:
     case LookupIterator::INTERCEPTOR:
     case LookupIterator::JSPROXY:
     case LookupIterator::NOT_FOUND:
     case LookupIterator::INTEGER_INDEXED_EXOTIC:
@@ skipping 44 matching lines @@
     // Find the top object.
     Handle<JSObject> last;
     PrototypeIterator iter(isolate(), holder());
     while (!iter.IsAtEnd()) {
       last = Handle<JSObject>::cast(PrototypeIterator::GetCurrent(iter));
       iter.Advance();
     }
     if (!last.is_null()) set_holder(last);
     NonexistentFrontendHeader(name, &miss, scratch1(), scratch2());
   } else {
-    FrontendHeader(receiver(), name, &miss);
+    FrontendHeader(receiver(), name, &miss, DONT_RETURN_ANYTHING);
     DCHECK(holder()->HasFastProperties());
   }
 
   int descriptor = transition->LastAdded();
   Handle<DescriptorArray> descriptors(transition->instance_descriptors());
   PropertyDetails details = descriptors->GetDetails(descriptor);
   Representation representation = details.representation();
   DCHECK(!representation.IsNone());
 
   // Stub is never generated for objects that require access checks.
@@ skipping 99 matching lines @@
         DCHECK(elements_kind == DICTIONARY_ELEMENTS);
         cached_stub = LoadDictionaryElementStub(isolate()).GetCode();
       }
     }
 
     handlers->Add(cached_stub);
   }
 }
 }
 }  // namespace v8::internal