[v8-dev] Change deprecated semantics of function template signatures. (issue 11308197)

mstarzinger Mon, 26 Nov 2012 04:57:04 -0800

Reviewers: rossberg,

Description:
Change deprecated semantics of function template signatures.


This changes how FunctionTemplate interprets a Signature that specifies
compatible receivers and arguments. Only the hidden prototype chain will
be considered when searching for compatible receivers. This prevents
JavaScript from modifying the inheritance relationship set up by the
embedder.

[email protected]
BUG=v8:2268
TEST=cctest/test-api


Please review this at https://codereview.chromium.org/11308197/

SVN Base: https://v8.googlecode.com/svn/branches/bleeding_edge

Affected files:
  M src/builtins.cc
  M src/stub-cache.cc
  M test/cctest/test-api.cc


Index: src/builtins.cc
diff --git a/src/builtins.cc b/src/builtins.cc

index5c8e32b4269d554d9d4452e05e55d439c9951602..5474f2b580899b44617cd6be1a2bdaf06dff221c100644

--- a/src/builtins.cc
+++ b/src/builtins.cc
@@ -1263,12 +1263,30 @@ BUILTIN(StrictModePoisonPill) {
 //


+// Searches the hidden prototype chain of the given object for the first
+// object that is an instance of the given type.  If no such object can
+// be found then Heap::null_value() is returned.
+static inline Object* FindHidden(Heap* heap,
+                                 Object* object,
+                                 FunctionTemplateInfo* type) {
+  for (; object != heap->null_value(); object = object->GetPrototype()) {
+    if (object->IsInstanceOf(type)) return object;
+    Object* proto = object->GetPrototype();
+    if (!proto->IsJSObject() ||
+        !JSObject::cast(proto)->map()->is_hidden_prototype()) {
+      break;
+    }
+  }
+  return heap->null_value();
+}
+
+
 // Returns the holder JSObject if the function can legally be called
 // with this receiver.  Returns Heap::null_value() if the call is
 // illegal.  Any arguments that don't fit the expected type is
-// overwritten with undefined.  Arguments that do fit the expected
-// type is overwritten with the object in the prototype chain that
-// actually has that type.
+// overwritten with undefined.  Note that holder and the arguments are
+// implicitly rewritten with the first object in the hidden prototype
+// chain that actually has the expected type.
 static inline Object* TypeCheck(Heap* heap,
                                 int argc,
                                 Object** argv,
@@ -1281,15 +1299,10 @@ static inline Object* TypeCheck(Heap* heap,
   SignatureInfo* sig = SignatureInfo::cast(sig_obj);
   // If necessary, check the receiver
   Object* recv_type = sig->receiver();
-
   Object* holder = recv;
   if (!recv_type->IsUndefined()) {
-    for (; holder != heap->null_value(); holder = holder->GetPrototype()) {
-      if (holder->IsInstanceOf(FunctionTemplateInfo::cast(recv_type))) {
-        break;
-      }
-    }
-    if (holder == heap->null_value()) return holder;

+ holder = FindHidden(heap, holder,FunctionTemplateInfo::cast(recv_type));

+    if (holder == heap->null_value()) return heap->null_value();
   }
   Object* args_obj = sig->args();
   // If there is no argument signature we're done
@@ -1302,13 +1315,9 @@ static inline Object* TypeCheck(Heap* heap,
     if (argtype->IsUndefined()) continue;
     Object** arg = &argv[-1 - i];
     Object* current = *arg;

- for (; current != heap->null_value(); current =current->GetPrototype()) {

-      if (current->IsInstanceOf(FunctionTemplateInfo::cast(argtype))) {
-        *arg = current;
-        break;
-      }
-    }
-    if (current == heap->null_value()) *arg = heap->undefined_value();

+ current = FindHidden(heap, current,FunctionTemplateInfo::cast(argtype));

+    if (current == heap->null_value()) current = heap->undefined_value();
+    *arg = current;
   }
   return holder;
 }
Index: src/stub-cache.cc
diff --git a/src/stub-cache.cc b/src/stub-cache.cc

index1f708b3ca63c94f6d7bf49e9c10d66e23f1de8ca..bfed6bbac7f5db4fa5f372b1c3d7554886c1b2ae100644

--- a/src/stub-cache.cc
+++ b/src/stub-cache.cc
@@ -1562,6 +1562,7 @@ int CallOptimization::GetPrototypeDepthOfExpectedType(
   while (!object.is_identical_to(holder)) {
     if (object->IsInstanceOf(*expected_receiver_type_)) return depth;
     object = Handle<JSObject>(JSObject::cast(object->GetPrototype()));
+    if (!object->map()->is_hidden_prototype()) return kInvalidProtoDepth;
     ++depth;
   }
   if (holder->IsInstanceOf(*expected_receiver_type_)) return depth;
Index: test/cctest/test-api.cc
diff --git a/test/cctest/test-api.cc b/test/cctest/test-api.cc

indexa51d3012a5a8f3c1929d122f9288bb95d2236e2c..0f33dedfcfa51bcc11f64a029cb1305e8a080967100644

--- a/test/cctest/test-api.cc
+++ b/test/cctest/test-api.cc
@@ -8063,12 +8063,8 @@ THREADED_TEST(ShadowObject) {
   Local<ObjectTemplate> proto = t->PrototypeTemplate();
   Local<ObjectTemplate> instance = t->InstanceTemplate();

-  // Only allow calls of f on instances of t.
-  Local<v8::Signature> signature = v8::Signature::New(t);
   proto->Set(v8_str("f"),
-             v8::FunctionTemplate::New(ShadowFunctionCallback,
-                                       Local<Value>(),
-                                       signature));

+ v8::FunctionTemplate::New(ShadowFunctionCallback,Local<Value>()));

   proto->Set(v8_str("x"), v8_num(12));

   instance->SetAccessor(v8_str("y"), ShadowYGetter, ShadowYSetter);

@@ -9933,6 +9929,7 @@THREADED_TEST(InterceptorCallICFastApi_SimpleSignature) {

                                 v8::Signature::New(fun_templ));