Commit Graph

942 Commits

Author SHA1 Message Date
neis
4df91581d1 [modules] Introduce new VariableLocation for module imports/exports.
Introduces a new VariableLocation MODULE for variables that live in a
module's export table.  Scope analysis sets this for the approriate variables.
Not yet supported by any backend.

Also, treats all imports as CONST bindings (including namespace imports), rather
than having new special variable modes.

BUG=

Review-Url: https://codereview.chromium.org/2199283002
Cr-Commit-Position: refs/heads/master@{#38426}
2016-08-08 09:49:27 +00:00
littledan
7826bfa789 [promise] Async/await edge case spec compliance fix
- Don't read .constructor when returning a Promise from an async function.
  Instead, call out to the internals of Promise.resolve directly.
  This is done by adding back in an "optimization" from an earlier form of
  the async/await code written by Caitlin Potter.
- Async functions always return a new Promise with a distinct identity,
  even if they simply return another Promise.

R=caitp@igalia.com
BUG=v8:4483

Review-Url: https://codereview.chromium.org/2219623002
Cr-Commit-Position: refs/heads/master@{#38404}
2016-08-06 01:00:47 +00:00
caitp
0272aa502f [promise] separate PerformPromiseThen from PromiseThen
The `PerformPromiseThen` spec-internal operation is used by the async functions
proposal, in order to ensure that AwaitExpressions are not observable via
usual mechanisms/hooks, such as Symbol.species.

BUG=v8:5253
R=littledan@chromium.org, adamk@chromium.org, gsathya@chromium.org, yangguo@chromium.org

Review-Url: https://codereview.chromium.org/2209433003
Cr-Commit-Position: refs/heads/master@{#38353}
2016-08-04 22:56:45 +00:00
adamk
56f9754387 Remove --harmony-exponentiation-operator flag
It's shipped in M52.

R=caitp@igalia.com, littledan@chromium.org

Review-Url: https://codereview.chromium.org/2203843002
Cr-Commit-Position: refs/heads/master@{#38256}
2016-08-02 17:17:35 +00:00
neis
88a795d1c8 Remove the --ignition-generators flag.
This flag has been enabled by default for over a month now.

R=mstarzinger@chromium.org, rmcilroy@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2176143002
Cr-Commit-Position: refs/heads/master@{#38020}
2016-07-25 12:56:27 +00:00
jwolfe
3cfd80d6a2 Adjust whitespace to make tests oblivious to --harmony-function-tostring
See discussion in https://codereview.chromium.org/2156303002/#msg8

With the new --harmony-function-tostring behavior, these tests would
fail without this change. This change makes the tests pass regardless
of whether or not --harmony-function-tostring is used.

All of these changes are simply inserting a space after the "function"
keyword to match the current function toString behavior. When
--harmony-function-tostring is enabled, the toString behavior matches
the spacing used in the function declaration. With the declaration
matching the current formatting, the toString behavior becomes
unaffected by --harmony-function-tostring.

BUG=v8:4958
LOG=n

Review-Url: https://codereview.chromium.org/2161413002
Cr-Commit-Position: refs/heads/master@{#37959}
2016-07-22 00:18:41 +00:00
adamk
458bd3b9a3 Slight cleanup of TryCatch parsing/variable declaration
Instead of unconditionally parsing the catch parameter as an expression
and then recovering if it turns out to be a simple variable proxy
(the overwhelmingly common case), this patch peeks one token ahead
before attempting to parse. This avoids doing the usual RemoveUnresolved
gymnastics in ParseTryStatement, and as a side-effect slightly improves
function name inference for an async arrow function test case.

Review-Url: https://codereview.chromium.org/2151433005
Cr-Commit-Position: refs/heads/master@{#37780}
2016-07-14 17:55:45 +00:00
binji
a16ca012e0 [Atomics] Rename Atomics.futex*, remove Atomics.futexWakeOrRequeue
* Rename Atomics.futexWait -> Atomics.wait
* Rename Atomics.futexWake -> Atomics.wake
* Remove Atomics.futexWakeOrRequeue
* Return value of Atomics.wait is now a string: "ok", "not-equal" or
  "timed-out"
* Update comments that reference URL for ecmascript_sharedmem to
  https://github.com/tc39/ecmascript_sharedmem

Review-Url: https://codereview.chromium.org/2143443002
Cr-Commit-Position: refs/heads/master@{#37727}
2016-07-13 18:34:03 +00:00
bmeurer
4e862dd964 [intrinsics] Remove obsolete intrinsics.
Remove obsolete definitions from macros.py, and drop the now obsolete
%_ToPrimitive, %_ToPrimitive_Number, %_ToPrimitive_String, %_ToName
and the %ToPrimitive_String intrinsics/runtime entries.

R=yangguo@chromium.org
BUG=v8:5049

Review-Url: https://codereview.chromium.org/2137203002
Cr-Commit-Position: refs/heads/master@{#37665}
2016-07-12 06:41:23 +00:00
littledan
77cbe27689 Narrowly address async function stack overflow parsing case
This patch just checks for a stack overflow and returns failure
from the cases which Clusterfuzz found. However, there may be
more locations in the parser which need similar treatment.

R=caitpotter88@gmail.com,neis
BUG=v8:4483,chromium:624300

Review-Url: https://codereview.chromium.org/2135503002
Cr-Commit-Position: refs/heads/master@{#37655}
2016-07-11 19:33:43 +00:00
yangguo
dfcc5d4ee8 [debugger] omit exception events for rethrown exceptions in async.
R=bmeurer@chromium.org, littledan@chromium.org
BUG=v8:5167

Review-Url: https://codereview.chromium.org/2124813002
Cr-Commit-Position: refs/heads/master@{#37623}
2016-07-11 05:50:03 +00:00
franzih
2f36ee7176 [builtins] Migrate SharedArrayBuffer.byteLength to C++.
Drive-by-fix: hydrogen code does not blindly return the
byteLength offset, instead it executes what is defined
in the byteLength getter.

BUG=

Review-Url: https://codereview.chromium.org/2123263002
Cr-Commit-Position: refs/heads/master@{#37595}
2016-07-07 19:44:23 +00:00
caitpotter88
8134986917 [builtins] don't create keys for undefined property descriptors in O.gOPDs
Implements the change proposed at https://github.com/tc39/ecma262/pull/593.

In summary, Object.getOwnPropertyDescriptors can produce results which cause
Object.defineProperties() to throw, by inserting a property with an undefined
descriptor into the result object. This change to the algorithm requires that
the descriptor only be added to the result object if it is not undefined.

BUG=v8:4725
R=littledan@chromium.org, adamk@chromium.org, jwolfe@igalia.com

Review-Url: https://codereview.chromium.org/2118613003
Cr-Commit-Position: refs/heads/master@{#37504}
2016-07-04 18:04:05 +00:00
caitpotter88
cd9e5f30ea [builtins] make AsyncFunction constructor a subclass of Function
Corrects a small problem with the current implementation of the AsyncFunction
constructor.

See https://tc39.github.io/ecmascript-asyncawait/#async-function-constructor for
details.

BUG=v8:4483
R=littledan@chromium.org, adamk@chromium.org, jwolfe@igalia.com

Review-Url: https://codereview.chromium.org/2118653004
Cr-Commit-Position: refs/heads/master@{#37484}
2016-07-01 22:52:40 +00:00
hablich
b1f7f1f4e4 Revert of Amend DataView, ArrayBuffer, and TypedArray methods to use ToIndex. (patchset id:140001 of https://codereview.chromium.org/2090353003/ )
Reason for revert:
Speculative revert to unblock roll: https://codereview.chromium.org/2107223003/

Original issue's description:
> Amend DataView, ArrayBuffer, and TypedArray methods to use ToIndex.
>
> The spec was modified to relax some requirements which implementors had not been
> enforcing. Part of this process involved introducing a new abstract operation
> ToIndex, which had partial overlap with our existing semantics as well as some
> differences (most notably treating undefined as 0). Test262 tests were introduced to
> check for the new semantics, some of which we were failing. This patch amends the
> parts of our implementation corresponding to specification algorithms which use
> ToIndex to follow its semantics precisely.
>
> BUG=v8:4784,v8:5120
>
> Committed: https://crrev.com/09720349ea058d178521ec58d0a5676443a5a132
> Cr-Commit-Position: refs/heads/master@{#37406}

TBR=littledan@chromium.org,adamk@chromium.org,bakkot@google.com
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4784,v8:5120

Review-Url: https://codereview.chromium.org/2113593002
Cr-Commit-Position: refs/heads/master@{#37417}
2016-06-30 07:39:09 +00:00
bakkot
09720349ea Amend DataView, ArrayBuffer, and TypedArray methods to use ToIndex.
The spec was modified to relax some requirements which implementors had not been
enforcing. Part of this process involved introducing a new abstract operation
ToIndex, which had partial overlap with our existing semantics as well as some
differences (most notably treating undefined as 0). Test262 tests were introduced to
check for the new semantics, some of which we were failing. This patch amends the
parts of our implementation corresponding to specification algorithms which use
ToIndex to follow its semantics precisely.

BUG=v8:4784,v8:5120

Review-Url: https://codereview.chromium.org/2090353003
Cr-Commit-Position: refs/heads/master@{#37406}
2016-06-29 21:18:59 +00:00
jwolfe
1ac0965542 Allow trailing commas in function parameter lists
Add a flag harmony_trailing_commas_in_parameters that allows trailing
commas in function parameter declaration lists and function call
parameter lists. Trailing commas are allowed in parenthetical lists like
`(a, b, c,)` only if the next token is `=>`, thereby making it an arrow
function declaration. Only 1 trailing comma is allowed, not `(a,,)`. A
trailing comma must follow a non-rest parameter, so `(,)` and `(...a,)`
are still SyntaxErrors. However, a trailing comma is allowed after a
spread parameter, e.g. `a(...b,);`.

Add parser tests for all of the above.

BUG=v8:5051
LOG=y

Review-Url: https://codereview.chromium.org/2094463002
Cr-Commit-Position: refs/heads/master@{#37355}
2016-06-29 01:39:10 +00:00
neis
2f0cb3afa3 Fix behavior of throw on yield*.
When calling the throw method on a generator suspended inside a yield*, yield*
in turn tries to call throw on its iterable.  If the iterable does not provide a
throw method, yield* must try to call the return method instead and then throw a
TypeError.  Due to a bug in our desugaring, we never threw the TypeError.

R=adamk@chromium.org
BUG=v8:5132

Review-Url: https://codereview.chromium.org/2094253002
Cr-Commit-Position: refs/heads/master@{#37314}
2016-06-28 07:46:16 +00:00
neis
6dffb07804 Fix behavior of return on yield*.
When calling the return method on a generator suspended inside a yield*, yield*
in turn calls return on its iterable.  If this results in a "done" iterator,
yield* must return immediately, thus terminating the generator.  For some
reason, we didn't terminate the generator but continued right after the yield*.

R=adamk@chromium.org
BUG=v8:5131

Review-Url: https://codereview.chromium.org/2100093002
Cr-Commit-Position: refs/heads/master@{#37310}
2016-06-28 07:10:54 +00:00
caitpotter88
4bb1f70e66 [parser] don't report error for CoverInitializedNames in async arrow formals
BUG=v8:4483, v8:5148
R=littledan@chromium.org, adamk@chromium.org, jwolfe@igalia.com, nikolaos@chromium.org

Review-Url: https://codereview.chromium.org/2091313002
Cr-Commit-Position: refs/heads/master@{#37260}
2016-06-25 00:39:11 +00:00
adamk
c7eb436d09 Remove all harmony runtime flags which shipped in M51
Flags removed (all begin with "harmony-"):
  function-name
  instanceof
  iterator-close
  unicode-regexps
  regexp-exec
  regexp-subclass
  species

BUG=v8:3566, v8:3648, v8:3699, v8:4093, v8:4447, v8:4602

Review-Url: https://codereview.chromium.org/2096933002
Cr-Commit-Position: refs/heads/master@{#37235}
2016-06-24 01:13:10 +00:00
nikolaos
b9f682baaf Fix bug with illegal spread as single arrow parameter
R=adamk@chromium.org
BUG=chromium:621496
LOG=N

Review-Url: https://codereview.chromium.org/2084703005
Cr-Commit-Position: refs/heads/master@{#37196}
2016-06-22 18:07:46 +00:00
nikolaos
2cabc866ec Fix classifier related bug
R=adamk@chromium.org
BUG=chromium:621111
LOG=N

Review-Url: https://codereview.chromium.org/2086513002
Cr-Commit-Position: refs/heads/master@{#37150}
2016-06-21 16:41:00 +00:00
caitpotter88
36dd4780f0 [test] add FunctionMirror and PromiseMirror tests for async functions
BUG=v8:4483
R=yangguo@chromium.org, littledan@chromium.org

Review-Url: https://codereview.chromium.org/2082023002
Cr-Commit-Position: refs/heads/master@{#37149}
2016-06-21 16:31:52 +00:00
caitpotter88
fd4d385b6d [liveedit]: fail to patch if target is outside of async function on stack
If an active generator is found on the stack (FUNCTION_BLOCKED_UNDER_GENERATOR),
and the target function is not found on top of that generator, add the error.

Based on test by wingo@igalia.com and littledan@chromium.org
(https://codereview.chromium.org/2035643003/)

LOG=N
BUG=v8:4483
R=yangguo@chromium.org, littledan@chromium.org

Review-Url: https://codereview.chromium.org/2058733002
Cr-Commit-Position: refs/heads/master@{#37000}
2016-06-15 12:25:26 +00:00
jgruber
ae23436cbf [regexp] Experimental support for regexp named captures
Named capture groups may be specified using the /(?<name>pattern)/u
syntax, with named backreferences specified as /\k<name>/u. They're
hidden behind the --harmony-regexp-named-captures flag, and are only
enabled for unicode regexps.

R=yangguo@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2050343002
Cr-Commit-Position: refs/heads/master@{#36986}
2016-06-15 06:49:55 +00:00
yangguo
a8e88eaab8 [regexp] implement \p{Any}, \p{Ascii}, and \p{Assigned}.
R=littledan@chromium.org, mathias@qiwi.be
BUG=v8:4743

Committed: https://crrev.com/92bfd13457c80f02be01551f4ea9a5badfe0e4c4
Review-Url: https://codereview.chromium.org/2059113002
Cr-Original-Commit-Position: refs/heads/master@{#36969}
Cr-Commit-Position: refs/heads/master@{#36974}
2016-06-14 15:16:56 +00:00
yangguo
3fe12ef8fa Revert of [regexp] implement \p{Any}, \p{Ascii}, and \p{Assigned}. (patchset id:40001 of https://codereview.chromium.org/2059113002/ )
Reason for revert:
compile failure

Original issue's description:
> [regexp] implement \p{Any}, \p{Ascii}, and \p{Assigned}.
>
> R=littledan@chromium.org, mathias@qiwi.be
> BUG=v8:4743
>
> Committed: https://crrev.com/92bfd13457c80f02be01551f4ea9a5badfe0e4c4
> Cr-Commit-Position: refs/heads/master@{#36969}

TBR=littledan@chromium.org,mathias@qiwi.be
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4743

Review-Url: https://codereview.chromium.org/2065083002
Cr-Commit-Position: refs/heads/master@{#36970}
2016-06-14 14:01:58 +00:00
yangguo
92bfd13457 [regexp] implement \p{Any}, \p{Ascii}, and \p{Assigned}.
R=littledan@chromium.org, mathias@qiwi.be
BUG=v8:4743

Review-Url: https://codereview.chromium.org/2059113002
Cr-Commit-Position: refs/heads/master@{#36969}
2016-06-14 13:55:54 +00:00
caitpotter88
1a30866239 [interpreter] support async functions in Ignition
BUG=v8:4483, v8:4907, 618603
LOG=N
R=neis@chromium.org, yangguo@chromium.org, littledan@chromium.org

Review-Url: https://codereview.chromium.org/2051423003
Cr-Commit-Position: refs/heads/master@{#36938}
2016-06-13 17:21:19 +00:00
littledan
5d7b9ece16 Async/await event listener test
This patch adds a test for async/await analogous to a previous Promise test.
It also fixes a typo in promise.js and makes a previous Promise test more
correct by ensuring that all assertions run before completion, fixing the
test expectations for the real result (which seems correct).

BUG=v8:4483
CQ_INCLUDE_TRYBOTS=tryserver.chromium.linux:linux_chromium_rel_ng;tryserver.blink:linux_blink_rel

Review-Url: https://codereview.chromium.org/2037653002
Cr-Commit-Position: refs/heads/master@{#36903}
2016-06-10 19:15:35 +00:00
yangguo
4620e29428 [regexp] disallow regexp property class shorthand syntax for single char.
R=littledan@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2044803003
Cr-Commit-Position: refs/heads/master@{#36778}
2016-06-07 09:14:22 +00:00
yangguo
8d90210a1e [debug] implement intuitive semantics for stepping over await call.
R=*bmeurer@chromium.org, caitpotter88@gmail.com, *littledan@chromium.org, *ulan@chromium.org
BUG=v8:4483

Review-Url: https://codereview.chromium.org/2033223003
Cr-Commit-Position: refs/heads/master@{#36718}
2016-06-03 15:31:52 +00:00
neis
8154d977e4 Fix bug in yield* desugaring.
In one corner case, we incorrectly returned a value without first wrapping it in
an iterator result object.

R=littledan@chromium.org
BUG=v8:5057

Review-Url: https://codereview.chromium.org/2034653002
Cr-Commit-Position: refs/heads/master@{#36676}
2016-06-02 09:43:59 +00:00
littledan
46253e743d [esnext] Fix various callsites to use is_resumable, not is_generator
Async functions are built out of generators, but the
SharedFunctionInfo returns false for is_generator. is_resumable is
the broader query. This patch fixes many parts of V8 to refer
to is_resumable as appropriate.

One incidental change is to remove a check for generators extending
classes. This is part of a general check for constructors being the
only thing which can extend classes, so it is removed here and the
error message for the general case is made more accurate.

BUG=v8:4483

Review-Url: https://codereview.chromium.org/1996943002
Cr-Commit-Position: refs/heads/master@{#36621}
2016-05-31 17:15:15 +00:00
caitpotter88
f30f8286fb [test] add debugger tests for debug evaluation in async functions
BUG=v8:4483
R=littledan@chromium.org, yangguo@chromium.org

Review-Url: https://codereview.chromium.org/2010693003
Cr-Commit-Position: refs/heads/master@{#36614}
2016-05-31 14:14:47 +00:00
littledan
6390282f96 Improve strictness of Annex B 3.3 for generators and async functions
Annex B 3.3 applies only for ordinary FunctionDeclarations, not
GeneratorDeclarations or AsyncFunctionDeclarations. This patch
- Skips applying Annex B 3.3 to async functions
- Adds a flag to refrain from applying it to generators
- UseCounter for how often duplicate function in block occurs
  with generators (unclear how to measure need for hoisting from block)

BUG=v8:4806

Review-Url: https://codereview.chromium.org/1995863002
Cr-Commit-Position: refs/heads/master@{#36557}
2016-05-27 18:23:20 +00:00
caitpotter88
38c6fb82f3 [test] add debugger scopes testing for async functions
BUG=v8:4483
R=littledan@chromium.org, yangguo@chromium.org

Review-Url: https://codereview.chromium.org/2005613002
Cr-Commit-Position: refs/heads/master@{#36489}
2016-05-24 18:43:51 +00:00
neis
0fd18acb9b [generators] Get better clusterfuzz coverage.
Duplicate mjsunit/harmony/generators.js but explicitly require
--turbo-from-bytecode such that Clusterfuzz can thoroughly test the
new generators implementation.

BUG=v8:4907

Review-Url: https://codereview.chromium.org/2002983002
Cr-Commit-Position: refs/heads/master@{#36441}
2016-05-23 13:57:46 +00:00
caitpotter88
239309fc8f [heap] don't flush async functions, they may be resumed later
BUG=v8:4483
R=littledan@chromium.org, hpayer@chromium.org, mstarzinger@chromium.org, ulan@chromium.org

Review-Url: https://codereview.chromium.org/1992093003
Cr-Commit-Position: refs/heads/master@{#36405}
2016-05-20 12:07:51 +00:00
yangguo
e17c68c493 [JSON] implement indentation in the BasicJsonStringifier and expose via API.
R=jochen@chromium.org, verwaest@chromium.org

Review-Url: https://codereview.chromium.org/1922603006
Cr-Commit-Position: refs/heads/master@{#36392}
2016-05-20 07:58:02 +00:00
machenbach
ad7939e71d Revert of [test] add tests for async function stacktraces (patchset id:1 of https://codereview.chromium.org/1995723004/ )
Reason for revert:
Breaks gc stress:
https://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20gc%20stress/builds/3575

Original issue's description:
> [test] add tests for async function stacktraces
>
> BUG=v8:4483
> R=littledan@chromium.org
>
> Committed: https://crrev.com/02f228eccdfcfab4081c2494ade52e54702b692c
> Cr-Commit-Position: refs/heads/master@{#36365}

TBR=littledan@chromium.org,caitpotter88@gmail.com
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4483

Review-Url: https://codereview.chromium.org/1997453004
Cr-Commit-Position: refs/heads/master@{#36369}
2016-05-19 14:51:41 +00:00
caitpotter88
02f228eccd [test] add tests for async function stacktraces
BUG=v8:4483
R=littledan@chromium.org

Review-Url: https://codereview.chromium.org/1995723004
Cr-Commit-Position: refs/heads/master@{#36365}
2016-05-19 13:29:57 +00:00
caitpotter88
f6865cb142 [runtime] set AsyncFunctionNext/Throw to adapt arguments
Prevent crash/UB during stack frame iteration through functions, which occurs
when debugging, when building stacktraces, etc.

Also prevents these functions from appearing in stacktraces, by unsetting the "native" flag.

BUG=v8:4483, v8:5025
R=yangguo@chromium.org, littledan@chromium.org, adamk@chromium.org

Review-Url: https://codereview.chromium.org/1990803005
Cr-Commit-Position: refs/heads/master@{#36339}
2016-05-18 20:53:40 +00:00
bmeurer
551e0aa11b [es6] Reintroduce the instanceof operator in the backends.
This adds back the instanceof operator support in the backends and
introduces a @@hasInstance protector cell on the isolate that guards the
fast path for the InstanceOfStub. This way we recover the ~10%
regression on Octane EarleyBoyer in Crankshaft and greatly improve
TurboFan and Ignition performance of instanceof.

R=ishell@chromium.org
TBR=hpayer@chromium.org,rossberg@chromium.org
BUG=chromium:597249, v8:4447
LOG=n

Review-Url: https://codereview.chromium.org/1980483003
Cr-Commit-Position: refs/heads/master@{#36275}
2016-05-17 11:25:59 +00:00
littledan
4afe89a7da [esnext] Async function toString support
BUG=v8:4483

Review-Url: https://codereview.chromium.org/1973193002
Cr-Commit-Position: refs/heads/master@{#36265}
2016-05-17 01:28:53 +00:00
caitpotter88
d08c0304c5 [esnext] prototype runtime implementation for async functions
BUG=v8:4483
LOG=N
R=littledan@chromium.org, adamk@chromium.org

Review-Url: https://codereview.chromium.org/1895603002
Cr-Commit-Position: refs/heads/master@{#36263}
2016-05-17 00:27:51 +00:00
cbruni
f87014ebde [runtime] Avoid @@isConcatSpreadable lookup for fast path Array.prototype.concat
Currently we do not check for @@isConcatSpreadable properly. If the Symbol is
set on the Array.prototype or Object.prototype the current fast paths fail.
This CL adds a fix to globally invalidate a isConcatSpreadable_protector.

Drive-by-fix: use named accessors for context variables

LOG=N
BUG=chromium:542504, v8:903

Review-Url: https://codereview.chromium.org/1409123003
Cr-Commit-Position: refs/heads/master@{#36201}
2016-05-12 08:52:36 +00:00
neis
3cc7315eda Allow Turbofan optimization of Ignition generators, first version.
In the bytecode graphbuilder, translate the two generator-specific
bytecodes as a couple of runtime calls for now.

BUG=v8:4907
LOG=n

Review-Url: https://codereview.chromium.org/1957393004
Cr-Commit-Position: refs/heads/master@{#36134}
2016-05-10 12:07:33 +00:00
littledan
04c8c11ee5 Make array __proto__ manipulations not disturb the species protector
Previously, the species protector was invalidated whenever the __proto__ of
an Array instance was manipulated. Then, if the map's new_target_is_base field
remained set, it was correct to conclude that GetPrototypeOf(array) was
%ArrayPrototype%. However, this choice caused the popular D3 framework to
invalidate the species protector, causing many functions to become slower.

This patch eliminates that aspect of the species protector. Instead, the check
is to look at the instance->map()->prototype(). It is valid to look directly
at the map's prototype slot, ignoring hidden prototypes and proxies, because
- This is only called on Array instances, so the receiver cannot be a Proxy.
- For hidden prototypes, any inaccuracy would only result in conservatively
  taking the slow path.

Theoretically, this patch could make methods applied to arrays from other
contexts slower. However, the slowdown would only affect a particular array
instance and not have a global spill-over effect. Further, the slowdown could
be addressed by tracking, either in the instance's map or in the actual
prototype object, whether it is a %ArrayPrototype% from any context, in a way
which is cheap to query, and use that rather than comparing to the currently
executing native context.

In interactive testing, this patch led the OnShape CAD system to experience
faster load times (110+s -> 40s).

BUG=chromium:606207
LOG=Y

Review-Url: https://codereview.chromium.org/1936393002
Cr-Commit-Position: refs/heads/master@{#36033}
2016-05-04 16:48:50 +00:00