Reviewers: Michael Starzinger,
Description:
Handlify GetNormalizedProperty.
[email protected]
BUG=
Please review this at https://codereview.chromium.org/27000006/
SVN Base: https://v8.googlecode.com/svn/branches/bleeding_edge
Affected files (+42, -37 lines):
M src/objects.h
M src/objects.cc
M src/property.h
M src/runtime.cc
A + test/mjsunit/regress/regress-getdataproperty-const.js
Index: src/objects.cc
diff --git a/src/objects.cc b/src/objects.cc
index
f39b760402e1f05a937dbaac7d278aa277ca2855..86004ce25b1119b8c82fd65b4e3e2a0c40b69d98
100644
--- a/src/objects.cc
+++ b/src/objects.cc
@@ -649,11 +649,15 @@ PropertyAttributes
JSObject::GetPropertyAttributeWithFailedAccessCheck(
}
-Object* JSObject::GetNormalizedProperty(LookupResult* result) {
- ASSERT(!HasFastProperties());
- Object* value =
property_dictionary()->ValueAt(result->GetDictionaryEntry());
- if (IsGlobalObject()) {
- value = PropertyCell::cast(value)->value();
+Handle<Object> JSObject::GetNormalizedProperty(Handle<JSObject> object,
+ LookupResult* result) {
+ ASSERT(!object->HasFastProperties());
+ Isolate* isolate = object->GetIsolate();
+ Handle<Object> value(
+ object->property_dictionary()->ValueAt(result->GetDictionaryEntry()),
+ isolate);
+ if (object->IsGlobalObject()) {
+ value = Handle<Object>(Handle<PropertyCell>::cast(value)->value(),
isolate);
}
ASSERT(!value->IsPropertyCell() && !value->IsCell());
return value;
@@ -888,10 +892,13 @@ MaybeObject* Object::GetProperty(Object* receiver,
*attributes = result->GetAttributes();
Object* value;
switch (result->type()) {
- case NORMAL:
- value = result->holder()->GetNormalizedProperty(result);
+ case NORMAL: {
+ HandleScope scope(isolate);
+ Handle<Object> value =
+ JSObject::GetNormalizedProperty(handle(result->holder()),
result);
ASSERT(!value->IsTheHole() || result->IsReadOnly());
- return value->IsTheHole() ? heap->undefined_value() : value;
+ return value->IsTheHole() ? heap->undefined_value() : *value;
+ }
case FIELD: {
MaybeObject* maybe_result = result->holder()->FastPropertyAt(
result->representation(),
Index: src/objects.h
diff --git a/src/objects.h b/src/objects.h
index
0d1b2510cdde6539967242941ad0f320165e9920..8fd3253f2d4520875ea683833e1d7b9c12598ef4
100644
--- a/src/objects.h
+++ b/src/objects.h
@@ -2191,7 +2191,8 @@ class JSObject: public JSReceiver {
// Retrieve a value in a normalized object given a lookup result.
// Handles the special representation of JS global objects.
- Object* GetNormalizedProperty(LookupResult* result);
+ static Handle<Object> GetNormalizedProperty(Handle<JSObject> object,
+ LookupResult* result);
// Sets the property value in a normalized object given a lookup result.
// Handles the special representation of JS global objects.
Index: src/property.h
diff --git a/src/property.h b/src/property.h
index
0f78ba478ec8512e8d94fd57a502a42a470c582a..3244b21050b633332a9493535a5802952f9212df
100644
--- a/src/property.h
+++ b/src/property.h
@@ -469,7 +469,8 @@ class LookupResult BASE_EMBEDDED {
}
// In the dictionary case, the data is held in the value field.
ASSERT(lookup_type_ == DICTIONARY_TYPE);
- return holder()->GetNormalizedProperty(this);
+ HandleScope scope(holder()->GetIsolate());
+ return *JSObject::GetNormalizedProperty(handle(holder()), this);
}
Object* GetValueFromMap(Map* map) const {
Index: src/runtime.cc
diff --git a/src/runtime.cc b/src/runtime.cc
index
77014b1771c054e1ec8da1c400b2c2533dc421b0..276d3882d697c3264c277efc6ece15250a0d0080
100644
--- a/src/runtime.cc
+++ b/src/runtime.cc
@@ -2267,7 +2267,7 @@ RUNTIME_FUNCTION(MaybeObject*,
Runtime_InitializeVarGlobal) {
RUNTIME_FUNCTION(MaybeObject*, Runtime_InitializeConstGlobal) {
- SealHandleScope shs(isolate);
+ HandleScope scope(isolate);
// All constants are declared with an initial value. The name
// of the constant is the first argument and the initial value
// is the second.
@@ -2276,7 +2276,7 @@ RUNTIME_FUNCTION(MaybeObject*,
Runtime_InitializeConstGlobal) {
Handle<Object> value = args.at<Object>(1);
// Get the current global object from top.
- GlobalObject* global = isolate->context()->global_object();
+ Handle<JSObject> global(isolate->context()->global_object(), isolate);
// According to ECMA-262, section 12.2, page 62, the property must
// not be deletable. Since it's a const, it must be READ_ONLY too.
@@ -2291,8 +2291,6 @@ RUNTIME_FUNCTION(MaybeObject*,
Runtime_InitializeConstGlobal) {
LookupResult lookup(isolate);
global->LocalLookup(*name, &lookup);
if (!lookup.IsFound()) {
- HandleScope handle_scope(isolate);
- Handle<GlobalObject> global(isolate->context()->global_object());
RETURN_IF_EMPTY_HANDLE(
isolate,
JSObject::SetLocalPropertyIgnoreAttributes(global, name, value,
@@ -2303,8 +2301,6 @@ RUNTIME_FUNCTION(MaybeObject*,
Runtime_InitializeConstGlobal) {
if (!lookup.IsReadOnly()) {
// Restore global object from context (in case of GC) and continue
// with setting the value.
- HandleScope handle_scope(isolate);
- Handle<GlobalObject> global(isolate->context()->global_object());
// BUG 1213575: Handle the case where we have to set a read-only
// property through an interceptor and only do it if it's
@@ -2322,16 +2318,15 @@ RUNTIME_FUNCTION(MaybeObject*,
Runtime_InitializeConstGlobal) {
// current value is the hole.
// Strict mode handling not needed (const is disallowed in strict mode).
if (lookup.IsField()) {
- FixedArray* properties = global->properties();
+ Handle<FixedArray> properties(global->properties(), isolate);
int index = lookup.GetFieldIndex().field_index();
if (properties->get(index)->IsTheHole() || !lookup.IsReadOnly()) {
properties->set(index, *value);
}
} else if (lookup.IsNormal()) {
- if (global->GetNormalizedProperty(&lookup)->IsTheHole() ||
+ if (JSObject::GetNormalizedProperty(global, &lookup)->IsTheHole() ||
!lookup.IsReadOnly()) {
- HandleScope scope(isolate);
- JSObject::SetNormalizedProperty(Handle<JSObject>(global), &lookup,
value);
+ JSObject::SetNormalizedProperty(global, &lookup, value);
}
} else {
// Ignore re-initialization of constants that have already been
@@ -2419,7 +2414,7 @@ RUNTIME_FUNCTION(MaybeObject*,
Runtime_InitializeConstContextSlot) {
properties->set(index, *value);
}
} else if (lookup.IsNormal()) {
- if (object->GetNormalizedProperty(&lookup)->IsTheHole()) {
+ if (JSObject::GetNormalizedProperty(object, &lookup)->IsTheHole()) {
JSObject::SetNormalizedProperty(object, &lookup, value);
}
} else {
@@ -5090,7 +5085,7 @@ RUNTIME_FUNCTION(MaybeObject*,
Runtime_DefineOrRedefineDataProperty) {
// Return property without being observable by accessors or interceptors.
RUNTIME_FUNCTION(MaybeObject*, Runtime_GetDataProperty) {
- SealHandleScope shs(isolate);
+ HandleScope scope(isolate);
ASSERT(args.length() == 2);
CONVERT_ARG_HANDLE_CHECKED(JSObject, object, 0);
CONVERT_ARG_HANDLE_CHECKED(Name, key, 1);
@@ -5098,8 +5093,12 @@ RUNTIME_FUNCTION(MaybeObject*,
Runtime_GetDataProperty) {
object->LookupRealNamedProperty(*key, &lookup);
if (!lookup.IsFound()) return isolate->heap()->undefined_value();
switch (lookup.type()) {
- case NORMAL:
- return lookup.holder()->GetNormalizedProperty(&lookup);
+ case NORMAL: {
+ Handle<Object> value =
+ JSObject::GetNormalizedProperty(handle(lookup.holder()),
&lookup);
+ if (value->IsTheHole()) break;
+ return *value;
+ }
case FIELD:
return lookup.holder()->FastPropertyAt(
lookup.representation(),
@@ -10673,12 +10672,12 @@ static MaybeObject* DebugLookupResultValue(Heap*
heap,
bool* caught_exception) {
Object* value;
switch (result->type()) {
- case NORMAL:
- value = result->holder()->GetNormalizedProperty(result);
- if (value->IsTheHole()) {
- return heap->undefined_value();
- }
- return value;
+ case NORMAL: {
+ HandleScope scope(name->GetIsolate());
+ Handle<Object> value =
+ JSObject::GetNormalizedProperty(handle(result->holder()),
result);
+ return (value->IsTheHole()) ? heap->undefined_value() : *value;
+ }
case FIELD: {
Object* value;
MaybeObject* maybe_value =
Index: test/mjsunit/regress/regress-getdataproperty-const.js
diff --git a/test/mjsunit/regress/regress-crbug-173974.js
b/test/mjsunit/regress/regress-getdataproperty-const.js
similarity index 93%
copy from test/mjsunit/regress/regress-crbug-173974.js
copy to test/mjsunit/regress/regress-getdataproperty-const.js
index
905bd6058a0ad0fe2ebe10e4c7dafbe9945cbe3b..14f7a7494e98527576e869a11b4fbd6659eaecfa
100644
--- a/test/mjsunit/regress/regress-crbug-173974.js
+++ b/test/mjsunit/regress/regress-getdataproperty-const.js
@@ -26,11 +26,8 @@
// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
// Flags: --allow-natives-syntax
+// Make sure the hole does not escape.
+
+assertEquals(undefined, %GetDataProperty(this, 'a'));
+const a = 1;
-function f() {
- var count = "";
- count[0] --;
-}
-f();
-%OptimizeFunctionOnNextCall(f);
-f();
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/groups/opt_out.
