Add fast path for proxy with preventExtensions trap

ObjectPreventExtensions and ReflectPreventExtensions are now Torque builtins (previously CPP) and the Proxy path is implemented completely in Torque while everything else calls into runtime (and is thus a bit slower than previously).

Perf improvement in micro-benchmark JSTests/Proxies
Before:
PreventExtensionsWithoutTrap-Proxies(Score): 1978
PreventExtensionsWithTrap-Proxies(Score): 739

After:
PreventExtensionsWithoutTrap-Proxies(Score): 3017
PreventExtensionsWithTrap-Proxies(Score): 2044

Bug: v8:6664
Change-Id: I6505d730cea6b0d197f6f5d0540b39056c8b763d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1652688
Commit-Queue: Z Nguyen-Huu <duongn@microsoft.com>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62130}

BUILD.gn

@@ -959,6 +959,7 @@ torque_files = [
   "src/builtins/proxy-get-property.tq",
   "src/builtins/proxy-has-property.tq",
   "src/builtins/proxy-is-extensible.tq",
+  "src/builtins/proxy-prevent-extensions.tq",
   "src/builtins/proxy-revocable.tq",
   "src/builtins/proxy-revoke.tq",
   "src/builtins/proxy-set-property.tq",

src/builtins/builtins-definitions.h

@@ -734,7 +734,6 @@ namespace internal {
   TFJ(ObjectKeys, 1, kReceiver, kObject)                                       \
   CPP(ObjectLookupGetter)                                                      \
   CPP(ObjectLookupSetter)                                                      \
-  CPP(ObjectPreventExtensions)                                                 \
   /* ES6 #sec-object.prototype.tostring */                                     \
   TFJ(ObjectPrototypeToString, 0, kReceiver)                                   \
   /* ES6 #sec-object.prototype.valueof */                                      \
@@ -828,7 +827,6 @@ namespace internal {
   CPP(ReflectGetPrototypeOf)                                                   \
   TFJ(ReflectHas, 2, kReceiver, kTarget, kKey)                                 \
   CPP(ReflectOwnKeys)                                                          \
-  CPP(ReflectPreventExtensions)                                                \
   CPP(ReflectSet)                                                              \
   CPP(ReflectSetPrototypeOf)                                                   \
                                                                                \

src/builtins/builtins-object.cc

@@ -391,18 +391,6 @@ BUILTIN(ObjectGetOwnPropertyDescriptors) {
   return *descriptors;
 }
 
-// ES6 section 19.1.2.15 Object.preventExtensions ( O )
-BUILTIN(ObjectPreventExtensions) {
-  HandleScope scope(isolate);
-  Handle<Object> object = args.atOrUndefined(isolate, 1);
-  if (object->IsJSReceiver()) {
-    MAYBE_RETURN(JSReceiver::PreventExtensions(Handle<JSReceiver>::cast(object),
-                                               kThrowOnError),
-                 ReadOnlyRoots(isolate).exception());
-  }
-  return *object;
-}
-
 // ES6 section 19.1.2.17 Object.seal ( O )
 BUILTIN(ObjectSeal) {
   HandleScope scope(isolate);

src/builtins/builtins-reflect.cc

@@ -158,25 +158,6 @@ BUILTIN(ReflectOwnKeys) {
   return *isolate->factory()->NewJSArrayWithElements(keys);
 }
 
-// ES6 section 26.1.12 Reflect.preventExtensions
-BUILTIN(ReflectPreventExtensions) {
-  HandleScope scope(isolate);
-  DCHECK_EQ(2, args.length());
-  Handle<Object> target = args.at(1);
-
-  if (!target->IsJSReceiver()) {
-    THROW_NEW_ERROR_RETURN_FAILURE(
-        isolate, NewTypeError(MessageTemplate::kCalledOnNonObject,
-                              isolate->factory()->NewStringFromAsciiChecked(
-                                  "Reflect.preventExtensions")));
-  }
-
-  Maybe<bool> result = JSReceiver::PreventExtensions(
-      Handle<JSReceiver>::cast(target), kDontThrow);
-  MAYBE_RETURN(result, ReadOnlyRoots(isolate).exception());
-  return *isolate->factory()->ToBoolean(result.FromJust());
-}
-
 // ES6 section 26.1.13 Reflect.set
 BUILTIN(ReflectSet) {
   HandleScope scope(isolate);

src/builtins/object.tq

@@ -5,6 +5,14 @@
 namespace runtime {
   extern transitioning runtime
   ObjectIsExtensible(implicit context: Context)(Object): Object;
+
+  extern transitioning runtime
+  JSReceiverPreventExtensionsThrow(implicit context: Context)(JSReceiver):
+      Object;
+
+  extern transitioning runtime
+  JSReceiverPreventExtensionsDontThrow(implicit context: Context)(JSReceiver):
+      Object;
 }  // namespace runtime
 
 namespace object {
@@ -15,6 +23,26 @@ namespace object {
         otherwise return runtime::ObjectIsExtensible(objectJSReceiver);
     return proxy::ProxyIsExtensible(objectJSProxy);
   }
+
+  transitioning macro
+  ObjectPreventExtensionsThrow(implicit context: Context)(object: Object):
+      Object {
+    const objectJSReceiver = Cast<JSReceiver>(object) otherwise return object;
+    const objectJSProxy = Cast<JSProxy>(objectJSReceiver)
+        otherwise return runtime::JSReceiverPreventExtensionsThrow(
+        objectJSReceiver);
+    return proxy::ProxyPreventExtensions(objectJSProxy, True);
+  }
+
+  transitioning macro
+  ObjectPreventExtensionsDontThrow(implicit context: Context)(object: Object):
+      Object {
+    const objectJSReceiver = Cast<JSReceiver>(object) otherwise return False;
+    const objectJSProxy = Cast<JSProxy>(objectJSReceiver)
+        otherwise return runtime::JSReceiverPreventExtensionsDontThrow(
+        objectJSReceiver);
+    return proxy::ProxyPreventExtensions(objectJSProxy, False);
+  }
 }  // namespace object
 
 namespace object_isextensible {
@@ -23,4 +51,12 @@ namespace object_isextensible {
       implicit context: Context)(_receiver: Object, object: Object): Object {
     return object::ObjectIsExtensible(object);
   }
-}  // namespace object-isextensible
+}  // namespace object_isextensible
+
+namespace object_preventextensions {
+  // ES6 section 19.1.2.11 Object.isExtensible ( O )
+  transitioning javascript builtin ObjectPreventExtensions(
+      implicit context: Context)(_receiver: Object, object: Object): Object {
+    return object::ObjectPreventExtensionsThrow(object);
+  }
+}  // namespace object_preventextensions

src/builtins/proxy-prevent-extensions.tq

@@ -0,0 +1,65 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include 'src/builtins/builtins-proxy-gen.h'
+
+namespace proxy {
+
+  // ES #sec-proxy-object-internal-methods-and-internal-slots-preventextensions
+  // https://tc39.es/ecma262/#sec-proxy-object-internal-methods-and-internal-slots-preventextensions
+  transitioning builtin
+  ProxyPreventExtensions(implicit context: Context)(
+      proxy: JSProxy, doThrow: Boolean): Object {
+    PerformStackCheck();
+    const kTrapName: constexpr string = 'preventExtensions';
+    try {
+      // 1. Let handler be O.[[ProxyHandler]].
+      // 2. If handler is null, throw a TypeError exception.
+      // 3. Assert: Type(handler) is Object.
+      const handler =
+          Cast<JSReceiver>(proxy.handler) otherwise ThrowProxyHandlerRevoked;
+
+      // 4. Let target be O.[[ProxyTarget]].
+      const target = proxy.target;
+
+      // 5. Let trap be ? GetMethod(handler, "preventExtensions").
+      // 6. If trap is undefined, then (see 6.a below).
+      const trap: Callable = GetMethod(handler, kTrapName)
+          otherwise goto TrapUndefined(target);
+
+      // 7. Let booleanTrapResult be ToBoolean(? Call(trap, handler, «
+      // target»)).
+      const trapResult = Call(context, trap, handler, target);
+
+      // 8. If booleanTrapResult is true, then
+      //    8.a. Let extensibleTarget be ? IsExtensible(target).
+      //    8.b If extensibleTarget is true, throw a TypeError exception.
+      if (BranchIfToBooleanIsTrue(trapResult)) {
+        const extensibleTarget: Object = object::ObjectIsExtensible(target);
+        assert(extensibleTarget == True || extensibleTarget == False);
+        if (BranchIfToBooleanIsTrue(extensibleTarget)) {
+          ThrowTypeError(kProxyPreventExtensionsExtensible);
+        }
+      } else {
+        if (doThrow == True) {
+          ThrowTypeError(kProxyTrapReturnedFalsish, kTrapName);
+        }
+        return False;
+      }
+
+      // 9. Return booleanTrapResult.
+      return True;
+    }
+    label TrapUndefined(target: Object) {
+      // 6.a. Return ? target.[[PreventExtensions]]().
+      if (doThrow == True) {
+        return object::ObjectPreventExtensionsThrow(target);
+      }
+      return object::ObjectPreventExtensionsDontThrow(target);
+    }
+    label ThrowProxyHandlerRevoked deferred {
+      ThrowTypeError(kProxyRevoked, kTrapName);
+    }
+  }
+}  // namespace proxy

src/builtins/proxy.tq

@@ -38,6 +38,10 @@ namespace proxy {
   generates 'MessageTemplate::kProxyPrivate';
   const kProxyIsExtensibleInconsistent: constexpr MessageTemplate
   generates 'MessageTemplate::kProxyIsExtensibleInconsistent';
+  const kProxyPreventExtensionsExtensible: constexpr MessageTemplate
+  generates 'MessageTemplate::kProxyPreventExtensionsExtensible';
+  const kProxyTrapReturnedFalsish: constexpr MessageTemplate
+  generates 'MessageTemplate::kProxyTrapReturnedFalsish';
 
   const kProxyGet: constexpr int31
   generates 'JSProxy::AccessKind::kGet';

src/builtins/reflect.tq

@@ -14,4 +14,12 @@ namespace reflect {
         otherwise ThrowTypeError(kCalledOnNonObject, 'Reflect.isExtensible');
     return object::ObjectIsExtensible(objectJSReceiver);
   }
+
+  // ES6 section 26.1.12 Reflect.preventExtensions
+  transitioning javascript builtin ReflectPreventExtensions(
+      implicit context: Context)(_receiver: Object, object: Object): Object {
+    const objectJSReceiver = Cast<JSReceiver>(object)
+        otherwise ThrowTypeError(kCalledOnNonObject, 'Reflect.preventExtensions');
+    return object::ObjectPreventExtensionsDontThrow(objectJSReceiver);
+  }
 }  // namespace reflect

src/init/bootstrapper.cc

@@ -1423,7 +1423,7 @@ void Genesis::InitializeGlobal(Handle<JSGlobalObject> global_object,
     SimpleInstallFunction(isolate_, object_function, "is", Builtins::kObjectIs,
                           2, true);
     SimpleInstallFunction(isolate_, object_function, "preventExtensions",
-                          Builtins::kObjectPreventExtensions, 1, false);
+                          Builtins::kObjectPreventExtensions, 1, true);
     SimpleInstallFunction(isolate_, object_function, "seal",
                           Builtins::kObjectSeal, 1, false);
 

src/runtime/runtime-object.cc

@@ -515,6 +515,28 @@ RUNTIME_FUNCTION(Runtime_ObjectIsExtensible) {
   return isolate->heap()->ToBoolean(result.FromJust());
 }
 
+RUNTIME_FUNCTION(Runtime_JSReceiverPreventExtensionsThrow) {
+  HandleScope scope(isolate);
+  DCHECK_EQ(1, args.length());
+  CONVERT_ARG_HANDLE_CHECKED(JSReceiver, object, 0);
+
+  MAYBE_RETURN(JSReceiver::PreventExtensions(Handle<JSReceiver>::cast(object),
+                                             kThrowOnError),
+               ReadOnlyRoots(isolate).exception());
+  return *object;
+}
+
+RUNTIME_FUNCTION(Runtime_JSReceiverPreventExtensionsDontThrow) {
+  HandleScope scope(isolate);
+  DCHECK_EQ(1, args.length());
+  CONVERT_ARG_HANDLE_CHECKED(JSReceiver, object, 0);
+
+  Maybe<bool> result = JSReceiver::PreventExtensions(
+      Handle<JSReceiver>::cast(object), kDontThrow);
+  MAYBE_RETURN(result, ReadOnlyRoots(isolate).exception());
+  return *isolate->factory()->ToBoolean(result.FromJust());
+}
+
 RUNTIME_FUNCTION(Runtime_GetProperty) {
   HandleScope scope(isolate);
   DCHECK_EQ(2, args.length());

src/runtime/runtime.h

@@ -300,15 +300,17 @@ namespace internal {
   I(HasProperty, 2, 1)                                          \
   F(InternalSetPrototype, 2, 1)                                 \
   I(IsJSReceiver, 1, 1)                                         \
+  F(JSReceiverPreventExtensionsDontThrow, 1, 1)                 \
+  F(JSReceiverPreventExtensionsThrow, 1, 1)                     \
   F(NewObject, 2, 1)                                            \
   F(ObjectCreate, 2, 1)                                         \
   F(ObjectEntries, 1, 1)                                        \
   F(ObjectEntriesSkipFastPath, 1, 1)                            \
-  F(ObjectHasOwnProperty, 2, 1)                                 \
-  F(ObjectKeys, 1, 1)                                           \
   F(ObjectGetOwnPropertyNames, 1, 1)                            \
   F(ObjectGetOwnPropertyNamesTryFast, 1, 1)                     \
+  F(ObjectHasOwnProperty, 2, 1)                                 \
   F(ObjectIsExtensible, 1, 1)                                   \
+  F(ObjectKeys, 1, 1)                                           \
   F(ObjectValues, 1, 1)                                         \
   F(ObjectValuesSkipFastPath, 1, 1)                             \
   F(OptimizeObjectForAddingMultipleProperties, 2, 1)            \

test/mjsunit/es6/proxies-prevent-extensions.js

@@ -173,6 +173,7 @@
   assertFalse(Reflect.preventExtensions(proxy));
   Object.preventExtensions(target);
   assertFalse(Reflect.preventExtensions(proxy));
+  assertThrows(() => { Object.preventExtensions(proxy) }, TypeError);
 })();