Reviewers: Toon Verwaest,
Message:
PTAL.
I'll get started on the platform ports.
Description:
Use Cells to check prototype chain validity (disabled by default).
The cells are stored as (hidden) properties on prototype objects. When a
prototype object changes its map, then both its own validity cell and those
of
all "downstream" prototypes are invalidated; handlers for a given receiver
embed
the currently valid cell for that receiver's prototype during their
compilation
and check it on execution.
Other changes in this CL:
- Made Map::SetPrototype static (for GC safety of |this|).
- For prototype maps, keep track of the prototype object using them. This is
required for being able to find and invalidate "downstream" prototypes'
cells.
- Ensure that prototype maps are never shared, even if they are slow. This
is
required for the above.
- Minor "const" cleanup for a few Map field accessors.
Please review this at https://codereview.chromium.org/908213002/
Base URL: https://chromium.googlesource.com/v8/v8.git@master
Affected files (+356, -131 lines):
M src/bootstrapper.cc
M src/factory.cc
M src/flag-definitions.h
M src/heap-snapshot-generator.cc
M src/heap/heap.h
M src/ic/handler-compiler.h
M src/ic/handler-compiler.cc
M src/ic/ic.cc
M src/ic/x64/handler-compiler-x64.cc
M src/isolate.cc
M src/objects.h
M src/objects.cc
M src/objects-inl.h
M src/objects-printer.cc
M src/runtime/runtime-classes.cc
M src/runtime/runtime-debug.cc
M src/types.cc
M test/mjsunit/fast-prototype.js
M test/mjsunit/regress/regress-put-prototype-transition.js
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
