Ensure we can reliably check the cell for validity of global property

src/objects.cc

 // Copyright 2013 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include <iomanip>
 #include <sstream>
 
 #include "src/v8.h"
 
 #include "src/accessors.h"
@@ skipping 505 matching lines @@
                                    it->GetHolder<JSObject>(),
                                    it->GetAccessors(), language_mode);
   }
 
   it->isolate()->ReportFailedAccessCheck(checked);
   RETURN_EXCEPTION_IF_SCHEDULED_EXCEPTION(it->isolate(), Object);
   return value;
 }
 
 
+static void ReplaceExistingPropertyCell(Handle<GlobalObject> global, int entry,
+                                        Handle<Object> value) {
+  Isolate* isolate = global->GetIsolate();
+  Handle<PropertyCell> cell(
+      PropertyCell::cast(global->property_dictionary()->ValueAt(entry)));
+
+  Handle<PropertyCell> new_cell = isolate->factory()->NewPropertyCell(value);
+  global->property_dictionary()->ValueAtPut(entry, *new_cell);
+
+  Handle<Object> hole = isolate->factory()->the_hole_value();
+  if (*hole == cell->value()) {
+    PropertyCell::SetValueInferType(cell,
+                                    isolate->factory()->undefined_value());
+  } else {
+    PropertyCell::SetValueInferType(cell, hole);
+  }
+}
+
+
+void GlobalObject::InvalidatePropertyCell(Handle<GlobalObject> global,
+                                          Handle<Name> name) {
+  DCHECK(!global->HasFastProperties());
+  int entry = global->property_dictionary()->FindEntry(name);
+  if (entry != NameDictionary::kNotFound) {
+    PropertyCell* cell =
+        PropertyCell::cast(global->property_dictionary()->ValueAt(entry));
+    Handle<Object> value(cell->value(), global->GetIsolate());
+    ReplaceExistingPropertyCell(global, entry, value);
+  }
+}
+
+
 void JSObject::SetNormalizedProperty(Handle<JSObject> object,
                                      Handle<Name> name,
                                      Handle<Object> value,
                                      PropertyDetails details) {
   DCHECK(!object->HasFastProperties());
   Handle<NameDictionary> property_dictionary(object->property_dictionary());
 
   if (!name->IsUniqueName()) {
     name = object->GetIsolate()->factory()->InternalizeString(
         Handle<String>::cast(name));
@@ skipping 22 matching lines @@
     enumeration_index = original_details.dictionary_index();
     DCHECK(enumeration_index > 0);
   }
 
   details = PropertyDetails(
       details.attributes(), details.type(), enumeration_index);
 
   if (object->IsGlobalObject()) {
     Handle<PropertyCell> cell(
         PropertyCell::cast(property_dictionary->ValueAt(entry)));
-    PropertyCell::SetValueInferType(cell, value);
+    if (details.type() != property_dictionary->DetailsAt(entry).type()) {
+      ReplaceExistingPropertyCell(Handle<GlobalObject>::cast(object), entry,
+                                  value);
+    } else {
+      PropertyCell::SetValueInferType(cell, value);
+    }
     // Please note we have to update the property details.
     property_dictionary->DetailsAtPut(entry, details);
   } else {
     property_dictionary->SetEntry(entry, name, value, details);
   }
 }
 
 
 static MaybeHandle<JSObject> FindIndexedAllCanReadHolder(
     Isolate* isolate, Handle<JSObject> js_object,
@@ skipping 1190 matching lines @@
                                Handle<Name> name,
                                Handle<Object> value,
                                PropertyAttributes attributes) {
   DCHECK(!object->HasFastProperties());
   Isolate* isolate = object->GetIsolate();
   Handle<NameDictionary> dict(object->property_dictionary());
   if (object->IsGlobalObject()) {
     // In case name is an orphaned property reuse the cell.
     int entry = dict->FindEntry(name);
     if (entry != NameDictionary::kNotFound) {
-      Handle<PropertyCell> cell(PropertyCell::cast(dict->ValueAt(entry)));
-      PropertyCell::SetValueInferType(cell, value);
+      ReplaceExistingPropertyCell(Handle<GlobalObject>::cast(object), entry,
+                                  value);
       // Assign an enumeration index to the property and update
       // SetNextEnumerationIndex.
       int index = dict->NextEnumerationIndex();
       PropertyDetails details(attributes, DATA, index);
-      dict->SetNextEnumerationIndex(index + 1);
-      dict->SetEntry(entry, name, cell, details);
+      dict->DetailsAtPut(entry, details);
       return;
     }
     value = isolate->factory()->NewPropertyCell(value);
   }
   PropertyDetails details(attributes, DATA, 0);
   Handle<NameDictionary> result =
       NameDictionary::Add(dict, name, value, details);
   if (*dict != *result) object->set_properties(*result);
 }
 
@@ skipping 3508 matching lines @@
   DCHECK(!object->HasFastProperties());
   Isolate* isolate = object->GetIsolate();
   Handle<NameDictionary> dictionary(object->property_dictionary());
   int entry = dictionary->FindEntry(name);
   DCHECK_NE(NameDictionary::kNotFound, entry);
 
   // If we have a global object set the cell to the hole.
   if (object->IsGlobalObject()) {
     PropertyDetails details = dictionary->DetailsAt(entry);
     DCHECK(details.IsConfigurable());
-    Handle<PropertyCell> cell(PropertyCell::cast(dictionary->ValueAt(entry)));
-    Handle<Object> value = isolate->factory()->the_hole_value();
-    PropertyCell::SetValueInferType(cell, value);
+    ReplaceExistingPropertyCell(Handle<GlobalObject>::cast(object), entry,
+                                isolate->factory()->the_hole_value());
     dictionary->DetailsAtPut(entry, details.AsDeleted());
     return;
   }
 
   NameDictionary::DeleteProperty(dictionary, entry);
   Handle<NameDictionary> new_properties =
       NameDictionary::Shrink(dictionary, name);
   object->set_properties(*new_properties);
 }
 
@@ skipping 2097 matching lines @@
 
 
 Handle<Map> Map::TransitionToAccessorProperty(Handle<Map> map,
                                               Handle<Name> name,
                                               AccessorComponent component,
                                               Handle<Object> accessor,
                                               PropertyAttributes attributes) {
   Isolate* isolate = name->GetIsolate();
 
   // Dictionary maps can always have additional data properties.
-  if (map->is_dictionary_map()) {
-    // For global objects, property cells are inlined. We need to change the
-    // map.
-    if (map->IsGlobalObjectMap()) return Copy(map, "GlobalAccessor");
-    return map;
-  }
+  if (map->is_dictionary_map()) return map;
 
   // Migrate to the newest map before transitioning to the new property.
   map = Update(map);
 
   PropertyNormalizationMode mode = map->is_prototype_map()
                                        ? KEEP_INOBJECT_PROPERTIES
                                        : CLEAR_INOBJECT_PROPERTIES;
 
   int index = map->SearchTransition(kAccessor, *name, attributes);
   if (index != TransitionArray::kNotFound) {
@@ skipping 7853 matching lines @@
       // Clamp undefined to NaN (default). All other types have been
       // converted to a number type further up in the call chain.
       DCHECK(value->IsUndefined());
     }
     array->set(index, double_value);
   }
   return array->GetIsolate()->factory()->NewNumber(double_value);
 }
 
 
-void GlobalObject::InvalidatePropertyCell(Handle<GlobalObject> global,
-                                          Handle<Name> name) {
-  DCHECK(!global->HasFastProperties());
-  Isolate* isolate = global->GetIsolate();
-  int entry = global->property_dictionary()->FindEntry(name);
-  if (entry != NameDictionary::kNotFound) {
-    Handle<PropertyCell> cell(
-        PropertyCell::cast(global->property_dictionary()->ValueAt(entry)));
-
-    Handle<Object> value(cell->value(), isolate);
-    Handle<PropertyCell> new_cell = isolate->factory()->NewPropertyCell(value);
-    global->property_dictionary()->ValueAtPut(entry, *new_cell);
-
-    Handle<Object> hole = isolate->factory()->the_hole_value();
-    if (*hole != *value) {
-      PropertyCell::SetValueInferType(cell, hole);
-    } else {
-      // If property value was the hole, set it to any other value,
-      // to ensure that LoadNonexistent ICs execute a miss.
-      Handle<Object> undefined = isolate->factory()->undefined_value();
-      PropertyCell::SetValueInferType(cell, undefined);
-    }
-  }
-}
-
-
 Handle<PropertyCell> GlobalObject::EnsurePropertyCell(
     Handle<GlobalObject> global, Handle<Name> name) {
   DCHECK(!global->HasFastProperties());
   int entry = global->property_dictionary()->FindEntry(name);
   if (entry == NameDictionary::kNotFound) {
     Isolate* isolate = global->GetIsolate();
     Handle<PropertyCell> cell = isolate->factory()->NewPropertyCellWithHole();
     PropertyDetails details(NONE, DATA, 0);
     details = details.AsDeleted();
     Handle<NameDictionary> dictionary = NameDictionary::Add(
@@ skipping 1807 matching lines @@
                                                CompilationInfo* info) {
   Handle<DependentCode> codes = DependentCode::InsertCompilationInfo(
       handle(cell->dependent_code(), info->isolate()),
       DependentCode::kPropertyCellChangedGroup, info->object_wrapper());
   if (*codes != cell->dependent_code()) cell->set_dependent_code(*codes);
   info->dependencies(DependentCode::kPropertyCellChangedGroup)->Add(
       cell, info->zone());
 }
 
 } }  // namespace v8::internal