v8/test/mjsunit/harmony
littledan 7033ae511f Optimize @@species based on a global 'protector' cell
This patch makes ArraySpeciesCreate fast in V8 by avoiding two property reads
when the following conditions are met:
- No Array instance has had its __proto__ reset
- No Array instance has had a constructor property defined
- Array.prototype has not had its constructor changed
- Array[Symbol.species] has not been reset

For subclasses of Array, or for conditions where one of these assumptions is
violated, the full lookup of species is done according to the ArraySpeciesCreate
algorithm. Although this is a "performance cliff", it does not come up in the
expected typical use case of @@species (Array subclassing), so it is hoped that
this can form a good start. Array subclasses will incur the slowness of looking
up @@species, but their use won't slow down invocations of, for example,
Array.prototype.slice on Array base class instances.

Possible future optimizations:
- For the fallback case where the assumptions don't hold, optimize the two
  property lookups.
- For Array.prototype.slice and Array.prototype.splice, even if the full lookup
  of @@species needs to take place, we still could take the rest of the C++
  fastpath. However, to do this correctly requires changing the calling convention
  from C++ to JS to pass the @@species out, so it is not attempted in this patch.

With this patch, microbenchmarks of Array.prototype.slice do not suffer a
noticeable performance regression, unlike their previous 2.5x penalty.

TBR=hpayer@chromium.org

Review URL: https://codereview.chromium.org/1689733002

Cr-Commit-Position: refs/heads/master@{#34199}
2016-02-22 21:02:48 +00:00
..
regress Fix bug with spread rewriting 2016-01-21 12:16:20 +00:00
array-species-constructor-delete.js Optimize @@species based on a global 'protector' cell 2016-02-22 21:02:48 +00:00
array-species-constructor.js Optimize @@species based on a global 'protector' cell 2016-02-22 21:02:48 +00:00
array-species-delete.js Optimize @@species based on a global 'protector' cell 2016-02-22 21:02:48 +00:00
array-species-modified.js Optimize @@species based on a global 'protector' cell 2016-02-22 21:02:48 +00:00
array-species-parent-constructor.js Optimize @@species based on a global 'protector' cell 2016-02-22 21:02:48 +00:00
array-species-proto.js Optimize @@species based on a global 'protector' cell 2016-02-22 21:02:48 +00:00
array-species.js Optimize @@species based on a global 'protector' cell 2016-02-22 21:02:48 +00:00
arraybuffer-species.js TypedArray and ArrayBuffer support for @@species 2016-01-12 06:07:59 +00:00
atomics.js Support SAB atomics for offset-TypedArray 2015-11-18 00:19:54 +00:00
block-conflicts-sloppy.js Add class to existing lexical scoping tests 2015-08-12 18:43:06 +00:00
block-const-assign-sloppy.js Delete --harmony-computed-property-names flag 2015-08-05 21:32:38 +00:00
block-eval-var-over-let.js Fix harmony sloppy block scoping dynamic redeclaration check 2015-11-13 21:04:15 +00:00
block-for-sloppy.js Remove flags for ES2015 features shipped in M48 2016-02-03 20:51:46 +00:00
block-lazy-compile.js Preliminary code for block scopes and block contexts. 2011-08-11 16:29:28 +00:00
block-leave-sloppy.js Split off a separate --harmony_sloppy_let flag 2015-07-25 00:05:18 +00:00
block-let-crankshaft-sloppy.js Split off a separate --harmony_sloppy_let flag 2015-07-25 00:05:18 +00:00
block-let-declaration-sloppy.js Add class to existing lexical scoping tests 2015-08-12 18:43:06 +00:00
block-let-semantics-sloppy.js Implement sloppy-mode block-defined functions (Annex B 3.3) 2015-09-21 04:31:09 +00:00
block-scoping-sloppy.js [turbofan] Initial support for monomorphic/polymorphic property loads. 2015-10-19 05:24:51 +00:00
block-scoping-top-level-sloppy.js Split off a separate --harmony_sloppy_let flag 2015-07-25 00:05:18 +00:00
block-sloppy-function.js Remove always-on --harmony-rest-parameters flag 2015-12-12 00:00:38 +00:00
dataview-accessors.js Fix data view accessors to throw execptions on offsets bigger than size_t. 2013-11-18 15:16:22 +00:00
debug-step-destructuring-assignment.js [debugger] step on every assignment in a destructuring assignment. 2015-12-22 08:21:33 +00:00
debug-step-destructuring-bind.js [debugger] step on every assignment in destructuring bind. 2015-12-22 13:29:33 +00:00
debug-stepin-default-parameters.js [debugger] remove step count parameter from prepare step. 2015-12-16 08:39:54 +00:00
debug-stepin-proxies.js [debugger] remove step count parameter from prepare step. 2015-12-16 08:39:54 +00:00
default-parameters-debug.js [es6] Implement default parameters 2015-08-17 12:02:08 +00:00
default-parameters-destructuring.js Rename destructuring flag to "--harmony-destructuring-bind" 2015-11-18 23:30:09 +00:00
default-parameters.js Remove always-on --harmony-rest-parameters flag 2015-12-12 00:00:38 +00:00
destructuring-assignment-lazy.js [es6] use correct --harmony-destructuring-assignment flag when preparsing 2015-12-21 20:13:46 +00:00
destructuring-assignment.js [es6] support AssignmentPattern as LHS in for-in/of loops 2015-12-11 19:39:40 +00:00
destructuring-parameters-literalcount-nolazy.js Rename destructuring flag to "--harmony-destructuring-bind" 2015-11-18 23:30:09 +00:00
destructuring-parameters-literalcount.js Rename destructuring flag to "--harmony-destructuring-bind" 2015-11-18 23:30:09 +00:00
destructuring.js [es6] Implement for-of iterator finalization 2016-02-18 10:49:55 +00:00
do-expressions.js Remove flags for ES2015 features shipped in M48 2016-02-03 20:51:46 +00:00
function-name.js Don't reflect ES2015 Function name inference in Function.prototype.toString 2016-02-19 02:51:10 +00:00
function-sent.js [generators] Implement Generator.prototype.return. 2016-02-04 17:14:15 +00:00
futex.js Support offset-TypedArray in futex API 2015-11-20 11:40:00 +00:00
generators.js [es6] Implement for-of iterator finalization 2016-02-18 10:49:55 +00:00
instanceof-es6.js ES6: Desugaring of instanceof to support @@hasInstance 2016-02-19 19:20:38 +00:00
iterator-close.js [es6] Implement for-of iterator finalization 2016-02-18 10:49:55 +00:00
module-linking.js Remove --harmony-scoping flag. 2015-03-13 15:15:57 +00:00
module-parsing-eval.js Enable compiling mjsunit tests as ES6 modules 2015-02-10 19:11:55 +00:00
module-recompile.js Implement proper module linking. 2012-07-09 08:59:03 +00:00
module-resolution.js Remove --harmony-scoping flag. 2015-03-13 15:15:57 +00:00
modules.js Enable compiling mjsunit tests as ES6 modules 2015-02-10 19:11:55 +00:00
object-entries.js reland [es7] refactor and fix Object.values() / Object.entries() 2016-02-08 14:11:05 +00:00
object-get-own-property-descriptors.js [esnext] implement Object.getOwnPropertyDescriptors() proposal 2016-02-04 21:56:24 +00:00
object-values.js reland [es7] refactor and fix Object.values() / Object.entries() 2016-02-08 14:11:05 +00:00
private-symbols.js Remove Reflect.enumerate 2016-02-22 19:10:43 +00:00
private.js Update to ES2015 == semantics for Symbol/SIMD wrappers 2015-10-27 20:20:24 +00:00
promise-species.js Add @@species/better subclassing support to Promises 2016-01-12 06:33:15 +00:00
proxies-accesschecks.js [proxies] Fix JSObject::AllCanRead for Proxies on the prototype chain 2015-12-11 15:51:46 +00:00
proxies-apply.js [runtime] [proxy] Implementing [[Call]] 2015-12-08 16:05:09 +00:00
proxies-bind.js [proxies] Correctly handle proxies in Function.prototype.bind 2015-12-17 09:07:57 +00:00
proxies-construct.js [runtime] [proxy] implement [[Construct]] 2015-12-09 14:55:33 +00:00
proxies-cross-realm-exception.js [proxies] fix access issue when having proxies on the prototype-chain of global objects. 2015-12-16 14:31:39 +00:00
proxies-define-property.js [runtime] [proxies] adding tests for uncovered branches 2015-12-10 15:35:15 +00:00
proxies-delete-property.js [proxies] Implement [[Delete]]. 2015-11-26 09:34:28 +00:00
proxies-enumerate.js [proxy] fixing for-in for proxies, fixing harmony/proxy.js tests, improving error messages and some drive-by fixes 2015-12-11 14:56:00 +00:00
proxies-example-membrane.js [runtime] support new Proxy() instead of Proxy.create and install getPrototypeOf trap 2015-11-13 14:14:07 +00:00
proxies-for.js [tests] Fix bogus uses of assertThrows. 2016-01-07 14:49:21 +00:00
proxies-function.js [proxies] Remove "fix" functionality, add (still unused) target property. 2015-11-12 22:12:06 +00:00
proxies-get-own-property-descriptor.js [proxies] Wire up Object.getOwnPropertyDescriptor 2015-11-17 13:08:51 +00:00
proxies-get-prototype-of.js Reland of [proxies] Make Object.prototype.isPrototypeOf work with proxies. (patchset #1 id:1 of https://codereview.chromium.org/1494283002/ ) 2015-12-04 06:39:16 +00:00
proxies-get.js [proxies] Add missing condition to GetProperty consistency check. 2015-12-14 12:49:59 +00:00
proxies-global-reference.js Throw TypeError when reading global references through a JSProxy 2015-12-17 14:37:41 +00:00
proxies-has-own-property.js [proxies] Fix Object.prototype.hasOwnProperty 2015-12-17 12:12:10 +00:00
proxies-has.js [proxies] Fix bogus cast in HasOwnPropertyImplementation 2015-12-16 11:42:47 +00:00
proxies-hash.js [proxies] Make Object.{freeze,seal} behave correctly for proxies. 2015-12-07 11:01:35 +00:00
proxies-integrity.js [proxies] Make Object.{isFrozen,isSealed} behave correctly for proxies. 2015-12-07 15:36:14 +00:00
proxies-is-extensible.js [proxies] Implement [[PreventExtensions]] and [[IsExtensible]]. 2015-11-24 14:16:24 +00:00
proxies-json.js [proxies] Make Array.prototype.concat work correctly with proxies. 2015-12-16 14:17:25 +00:00
proxies-keys.js [proxies] Implement Symbol/DONT_ENUM filtering for GetKeys() 2015-12-02 10:19:59 +00:00
proxies-object-assign.js Move Object.assign implementation to C++ 2015-12-11 14:10:55 +00:00
proxies-ownkeys.js [proxies] allow duplicate keys for [[OwnPropertyKeys]] trap. 2016-02-04 17:55:35 +00:00
proxies-prevent-extensions.js [proxies] Implement [[PreventExtensions]] and [[IsExtensible]]. 2015-11-24 14:16:24 +00:00
proxies-property-is-enumerable.js [runtime] [proxy] Fix Object.prototype.PropertyIsEnumerable to support 2015-12-01 17:12:08 +00:00
proxies-prototype-handler-stackoverflow.js [proxies] Check for stack overflow in Proxy internal methods 2015-12-15 17:23:44 +00:00
proxies-prototype-target-stackoverflow.js [proxies] Check for stack overflow in Proxy internal methods 2015-12-15 17:23:44 +00:00
proxies-revocable.js [proxies] Implement Proxy.revocable. 2015-12-04 10:56:01 +00:00
proxies-set-prototype-of.js [proxies] Implement spec change to consistency check in [[SetPrototypeOf]]. 2016-02-10 08:07:40 +00:00
proxies-set.js [proxies] Implement [[Set]]. 2015-12-01 12:27:09 +00:00
proxies-with-unscopables.js [proxies] [tests] Un-skip proxies-with-unscopables, delete proxies-symbols 2015-12-14 16:37:53 +00:00
proxies-with.js [tests] Fix bogus uses of assertThrows. 2016-01-07 14:49:21 +00:00
proxies.js [proxies] Adapt and reenable remaining tests in proxies.js 2016-01-08 14:57:02 +00:00
reflect-apply.js [es6] implement Reflect.apply() & Reflect.construct() 2015-03-19 14:47:27 +00:00
reflect-construct.js Make generators non-constructable. 2016-01-18 13:11:06 +00:00
reflect-define-property.js [es6] Partially implement Reflect.defineProperty. 2015-10-29 15:39:49 +00:00
reflect-get-own-property-descriptor.js [es6] Partially implement Reflect.getOwnPropertyDescriptor. 2015-10-30 10:05:03 +00:00
reflect-get-prototype-of.js Reland of Use ES2015-style TypedArray prototype chain (patchset #1 id:1 of https://codereview.chromium.org/1554523002/ ) 2015-12-30 22:14:16 +00:00
reflect-own-keys.js [es6] Partially implement Reflect.ownKeys. 2015-11-18 00:52:50 +00:00
reflect-prevent-extensions.js [es6] Partially implement Reflect.preventExtensions. 2015-10-21 09:23:47 +00:00
reflect-set-prototype-of.js Fix corner-case behavior of JSObject::SetPrototype. 2015-10-23 14:52:26 +00:00
reflect.js Remove Reflect.enumerate 2016-02-22 19:10:43 +00:00
regexp-flags.js Split --harmony-unicode and --harmony-unicode-regexps. 2015-02-05 14:17:09 +00:00
regexp-lookbehind.js [regexp] break recursion in mutually recursive capture/back references. 2015-12-16 06:58:58 +00:00
regexp-sticky.js RegExp: Fix update of lastIndex on non-global sticky 2015-10-06 21:24:12 +00:00
set-prototype-of.js Fix corner-case behavior of JSObject::SetPrototype. 2015-10-23 14:52:26 +00:00
sharedarraybuffer.js Reland of Use ES2015-style TypedArray prototype chain (patchset #1 id:1 of https://codereview.chromium.org/1554523002/ ) 2015-12-30 22:14:16 +00:00
simd.js [builtins] Support SameValue and SameValueZero via runtime functions. 2016-02-17 10:54:25 +00:00
species.js Add a --harmony-species flag, defining @@species on constructors 2016-01-04 19:39:59 +00:00
string-match.js [es6] Implement @@match subclassing. 2015-11-24 13:57:31 +00:00
string-replace.js Separate String.prototype.replace into RegExp.prototype[Symbol.replace] 2016-01-19 17:33:44 +00:00
string-split.js [es6] Implement @@split subclassing. 2015-11-10 07:00:44 +00:00
to-length.js [runtime] Implement %_ToLength via ToLengthStub. 2015-10-19 08:35:18 +00:00
to-name.js [es6] Implement Date.prototype[@@toPrimitive] as C++ builtin. 2015-08-31 12:53:10 +00:00
to-number.js [es6] Implement Date.prototype[@@toPrimitive] as C++ builtin. 2015-08-31 12:53:10 +00:00
to-primitive.js [es6] Implement Date.prototype[@@toPrimitive] as C++ builtin. 2015-08-31 12:53:10 +00:00
to-string.js [es6] Implement Date.prototype[@@toPrimitive] as C++ builtin. 2015-08-31 12:53:10 +00:00
typedarray-species.js TypedArray and ArrayBuffer support for @@species 2016-01-12 06:07:59 +00:00
unicode-character-ranges.js [regexp] fix off-by-one in UnicodeRangeSplitter. 2016-02-09 09:10:31 +00:00
unicode-escapes-in-regexps.js [regexp] parse RegExpUnicodeEscapeSequence according to spec. 2016-02-11 12:29:29 +00:00
unicode-regexp-backrefs.js [regexp] back refs must not start/end in the middle of a surrogate pair 2016-01-27 10:51:30 +00:00
unicode-regexp-ignore-case-noi18n.js Revert of [regexp] implement /ui to mirror the implementation for /i. (patchset #2 id:20001 of https://codereview.chromium.org/1641613002/ ) 2016-02-02 11:44:45 +00:00
unicode-regexp-ignore-case.js Revert of [regexp] implement /ui to mirror the implementation for /i. (patchset #2 id:20001 of https://codereview.chromium.org/1641613002/ ) 2016-02-02 11:44:45 +00:00
unicode-regexp-last-index.js [regexp] step back if starting unicode regexp within surrogate pair. 2016-01-25 10:46:11 +00:00
unicode-regexp-property-class.js [regexp] experimental implementation for \p property class. 2016-02-10 16:24:05 +00:00
unicode-regexp-restricted-syntax.js [regexp] parse RegExpUnicodeEscapeSequence according to spec. 2016-02-11 12:29:29 +00:00
unicode-regexp-unanchored-advance.js [regexp] simplify unanchored advance for unicode regexps. 2016-02-09 09:11:24 +00:00
unicode-regexp-zero-length.js [regexp] fix zero-length matches for RegExp.prototype.@@split. 2016-02-03 14:49:07 +00:00