src/v8/src/elements.cc

   1 // Copyright 2012 the V8 project authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #include "src/v8.h"
   6
   7 #include "src/arguments.h"
   8 #include "src/conversions.h"
   9 #include "src/elements.h"
  10 #include "src/objects.h"
  11 #include "src/utils.h"
  12
  13 // Each concrete ElementsAccessor can handle exactly one ElementsKind,
  14 // several abstract ElementsAccessor classes are used to allow sharing
  15 // common code.
  16 //
  17 // Inheritance hierarchy:
  18 // - ElementsAccessorBase                        (abstract)
  19 //   - FastElementsAccessor                      (abstract)
  20 //     - FastSmiOrObjectElementsAccessor
  21 //       - FastPackedSmiElementsAccessor
  22 //       - FastHoleySmiElementsAccessor
  23 //       - FastPackedObjectElementsAccessor
  24 //       - FastHoleyObjectElementsAccessor
  25 //     - FastDoubleElementsAccessor
  26 //       - FastPackedDoubleElementsAccessor
  27 //       - FastHoleyDoubleElementsAccessor
  28 //   - TypedElementsAccessor: template, with instantiations:
  29 //     - ExternalInt8ElementsAccessor
  30 //     - ExternalUint8ElementsAccessor
  31 //     - ExternalInt16ElementsAccessor
  32 //     - ExternalUint16ElementsAccessor
  33 //     - ExternalInt32ElementsAccessor
  34 //     - ExternalUint32ElementsAccessor
  35 //     - ExternalFloat32ElementsAccessor
  36 //     - ExternalFloat64ElementsAccessor
  37 //     - ExternalUint8ClampedElementsAccessor
  38 //     - FixedUint8ElementsAccessor
  39 //     - FixedInt8ElementsAccessor
  40 //     - FixedUint16ElementsAccessor
  41 //     - FixedInt16ElementsAccessor
  42 //     - FixedUint32ElementsAccessor
  43 //     - FixedInt32ElementsAccessor
  44 //     - FixedFloat32ElementsAccessor
  45 //     - FixedFloat64ElementsAccessor
  46 //     - FixedUint8ClampedElementsAccessor
  47 //   - DictionaryElementsAccessor
  48 //   - SloppyArgumentsElementsAccessor
  49
  50
  51 namespace v8 {
  52 namespace internal {
  53
  54
  55 static const int kPackedSizeNotKnown = -1;
  56
  57
  58 // First argument in list is the accessor class, the second argument is the
  59 // accessor ElementsKind, and the third is the backing store class.  Use the
  60 // fast element handler for smi-only arrays.  The implementation is currently
  61 // identical.  Note that the order must match that of the ElementsKind enum for
  62 // the |accessor_array[]| below to work.
  63 #define ELEMENTS_LIST(V)                                                \
  64   V(FastPackedSmiElementsAccessor, FAST_SMI_ELEMENTS, FixedArray)       \
  65   V(FastHoleySmiElementsAccessor, FAST_HOLEY_SMI_ELEMENTS,              \
  66     FixedArray)                                                         \
  67   V(FastPackedObjectElementsAccessor, FAST_ELEMENTS, FixedArray)        \
  68   V(FastHoleyObjectElementsAccessor, FAST_HOLEY_ELEMENTS, FixedArray)   \
  69   V(FastPackedDoubleElementsAccessor, FAST_DOUBLE_ELEMENTS,             \
  70     FixedDoubleArray)                                                   \
  71   V(FastHoleyDoubleElementsAccessor, FAST_HOLEY_DOUBLE_ELEMENTS,        \
  72     FixedDoubleArray)                                                   \
  73   V(DictionaryElementsAccessor, DICTIONARY_ELEMENTS,                    \
  74     SeededNumberDictionary)                                             \
  75   V(SloppyArgumentsElementsAccessor, SLOPPY_ARGUMENTS_ELEMENTS,         \
  76     FixedArray)                                                         \
  77   V(ExternalInt8ElementsAccessor, EXTERNAL_INT8_ELEMENTS,               \
  78     ExternalInt8Array)                                                  \
  79   V(ExternalUint8ElementsAccessor,                                      \
  80     EXTERNAL_UINT8_ELEMENTS, ExternalUint8Array)                        \
  81   V(ExternalInt16ElementsAccessor, EXTERNAL_INT16_ELEMENTS,             \
  82     ExternalInt16Array)                                                 \
  83   V(ExternalUint16ElementsAccessor,                                     \
  84     EXTERNAL_UINT16_ELEMENTS, ExternalUint16Array)                      \
  85   V(ExternalInt32ElementsAccessor, EXTERNAL_INT32_ELEMENTS,             \
  86     ExternalInt32Array)                                                 \
  87   V(ExternalUint32ElementsAccessor,                                     \
  88     EXTERNAL_UINT32_ELEMENTS, ExternalUint32Array)                      \
  89   V(ExternalFloat32ElementsAccessor,                                    \
  90     EXTERNAL_FLOAT32_ELEMENTS, ExternalFloat32Array)                    \
  91   V(ExternalFloat64ElementsAccessor,                                    \
  92     EXTERNAL_FLOAT64_ELEMENTS, ExternalFloat64Array)                    \
  93   V(ExternalUint8ClampedElementsAccessor,                               \
  94     EXTERNAL_UINT8_CLAMPED_ELEMENTS,                                    \
  95     ExternalUint8ClampedArray)                                          \
  96   V(FixedUint8ElementsAccessor, UINT8_ELEMENTS, FixedUint8Array)        \
  97   V(FixedInt8ElementsAccessor, INT8_ELEMENTS, FixedInt8Array)           \
  98   V(FixedUint16ElementsAccessor, UINT16_ELEMENTS, FixedUint16Array)     \
  99   V(FixedInt16ElementsAccessor, INT16_ELEMENTS, FixedInt16Array)        \
 100   V(FixedUint32ElementsAccessor, UINT32_ELEMENTS, FixedUint32Array)     \
 101   V(FixedInt32ElementsAccessor, INT32_ELEMENTS, FixedInt32Array)        \
 102   V(FixedFloat32ElementsAccessor, FLOAT32_ELEMENTS, FixedFloat32Array)  \
 103   V(FixedFloat64ElementsAccessor, FLOAT64_ELEMENTS, FixedFloat64Array)  \
 104   V(FixedUint8ClampedElementsAccessor, UINT8_CLAMPED_ELEMENTS,          \
 105     FixedUint8ClampedArray)
 106
 107
 108 template<ElementsKind Kind> class ElementsKindTraits {
 109  public:
 110   typedef FixedArrayBase BackingStore;
 111 };
 112
 113 #define ELEMENTS_TRAITS(Class, KindParam, Store)               \
 114 template<> class ElementsKindTraits<KindParam> {               \
 115  public:   /* NOLINT */                                        \
 116   static const ElementsKind Kind = KindParam;                  \
 117   typedef Store BackingStore;                                  \
 118 };
 119 ELEMENTS_LIST(ELEMENTS_TRAITS)
 120 #undef ELEMENTS_TRAITS
 121
 122
 123 ElementsAccessor** ElementsAccessor::elements_accessors_ = NULL;
 124
 125
 126 static bool HasKey(Handle<FixedArray> array, Handle<Object> key_handle) {
 127   DisallowHeapAllocation no_gc;
 128   Object* key = *key_handle;
 129   int len0 = array->length();
 130   for (int i = 0; i < len0; i++) {
 131     Object* element = array->get(i);
 132     if (element->IsSmi() && element == key) return true;
 133     if (element->IsString() &&
 134         key->IsString() && String::cast(element)->Equals(String::cast(key))) {
 135       return true;
 136     }
 137   }
 138   return false;
 139 }
 140
 141
 142 MUST_USE_RESULT
 143 static MaybeHandle<Object> ThrowArrayLengthRangeError(Isolate* isolate) {
 144   THROW_NEW_ERROR(isolate, NewRangeError("invalid_array_length",
 145                                          HandleVector<Object>(NULL, 0)),
 146                   Object);
 147 }
 148
 149
 150 static void CopyObjectToObjectElements(FixedArrayBase* from_base,
 151                                        ElementsKind from_kind,
 152                                        uint32_t from_start,
 153                                        FixedArrayBase* to_base,
 154                                        ElementsKind to_kind, uint32_t to_start,
 155                                        int raw_copy_size) {
 156   DCHECK(to_base->map() !=
 157       from_base->GetIsolate()->heap()->fixed_cow_array_map());
 158   DisallowHeapAllocation no_allocation;
 159   int copy_size = raw_copy_size;
 160   if (raw_copy_size < 0) {
 161     DCHECK(raw_copy_size == ElementsAccessor::kCopyToEnd ||
 162            raw_copy_size == ElementsAccessor::kCopyToEndAndInitializeToHole);
 163     copy_size = Min(from_base->length() - from_start,
 164                     to_base->length() - to_start);
 165     if (raw_copy_size == ElementsAccessor::kCopyToEndAndInitializeToHole) {
 166       int start = to_start + copy_size;
 167       int length = to_base->length() - start;
 168       if (length > 0) {
 169         Heap* heap = from_base->GetHeap();
 170         MemsetPointer(FixedArray::cast(to_base)->data_start() + start,
 171                       heap->the_hole_value(), length);
 172       }
 173     }
 174   }
 175   DCHECK((copy_size + static_cast<int>(to_start)) <= to_base->length() &&
 176          (copy_size + static_cast<int>(from_start)) <= from_base->length());
 177   if (copy_size == 0) return;
 178   FixedArray* from = FixedArray::cast(from_base);
 179   FixedArray* to = FixedArray::cast(to_base);
 180   DCHECK(IsFastSmiOrObjectElementsKind(from_kind));
 181   DCHECK(IsFastSmiOrObjectElementsKind(to_kind));
 182   Address to_address = to->address() + FixedArray::kHeaderSize;
 183   Address from_address = from->address() + FixedArray::kHeaderSize;
 184   CopyWords(reinterpret_cast<Object**>(to_address) + to_start,
 185             reinterpret_cast<Object**>(from_address) + from_start,
 186             static_cast<size_t>(copy_size));
 187   if (IsFastObjectElementsKind(from_kind) &&
 188       IsFastObjectElementsKind(to_kind)) {
 189     Heap* heap = from->GetHeap();
 190     if (!heap->InNewSpace(to)) {
 191       heap->RecordWrites(to->address(),
 192                          to->OffsetOfElementAt(to_start),
 193                          copy_size);
 194     }
 195     heap->incremental_marking()->RecordWrites(to);
 196   }
 197 }
 198
 199
 200 static void CopyDictionaryToObjectElements(
 201     FixedArrayBase* from_base, uint32_t from_start, FixedArrayBase* to_base,
 202     ElementsKind to_kind, uint32_t to_start, int raw_copy_size) {
 203   DisallowHeapAllocation no_allocation;
 204   SeededNumberDictionary* from = SeededNumberDictionary::cast(from_base);
 205   int copy_size = raw_copy_size;
 206   Heap* heap = from->GetHeap();
 207   if (raw_copy_size < 0) {
 208     DCHECK(raw_copy_size == ElementsAccessor::kCopyToEnd ||
 209            raw_copy_size == ElementsAccessor::kCopyToEndAndInitializeToHole);
 210     copy_size = from->max_number_key() + 1 - from_start;
 211     if (raw_copy_size == ElementsAccessor::kCopyToEndAndInitializeToHole) {
 212       int start = to_start + copy_size;
 213       int length = to_base->length() - start;
 214       if (length > 0) {
 215         Heap* heap = from->GetHeap();
 216         MemsetPointer(FixedArray::cast(to_base)->data_start() + start,
 217                       heap->the_hole_value(), length);
 218       }
 219     }
 220   }
 221   DCHECK(to_base != from_base);
 222   DCHECK(IsFastSmiOrObjectElementsKind(to_kind));
 223   if (copy_size == 0) return;
 224   FixedArray* to = FixedArray::cast(to_base);
 225   uint32_t to_length = to->length();
 226   if (to_start + copy_size > to_length) {
 227     copy_size = to_length - to_start;
 228   }
 229   for (int i = 0; i < copy_size; i++) {
 230     int entry = from->FindEntry(i + from_start);
 231     if (entry != SeededNumberDictionary::kNotFound) {
 232       Object* value = from->ValueAt(entry);
 233       DCHECK(!value->IsTheHole());
 234       to->set(i + to_start, value, SKIP_WRITE_BARRIER);
 235     } else {
 236       to->set_the_hole(i + to_start);
 237     }
 238   }
 239   if (IsFastObjectElementsKind(to_kind)) {
 240     if (!heap->InNewSpace(to)) {
 241       heap->RecordWrites(to->address(),
 242                          to->OffsetOfElementAt(to_start),
 243                          copy_size);
 244     }
 245     heap->incremental_marking()->RecordWrites(to);
 246   }
 247 }
 248
 249
 250 static void CopyDoubleToObjectElements(Handle<FixedArrayBase> from_base,
 251                                        uint32_t from_start,
 252                                        Handle<FixedArrayBase> to_base,
 253                                        ElementsKind to_kind,
 254                                        uint32_t to_start,
 255                                        int raw_copy_size) {
 256   DCHECK(IsFastSmiOrObjectElementsKind(to_kind));
 257   int copy_size = raw_copy_size;
 258   if (raw_copy_size < 0) {
 259     DCHECK(raw_copy_size == ElementsAccessor::kCopyToEnd ||
 260            raw_copy_size == ElementsAccessor::kCopyToEndAndInitializeToHole);
 261     copy_size = Min(from_base->length() - from_start,
 262                     to_base->length() - to_start);
 263     if (raw_copy_size == ElementsAccessor::kCopyToEndAndInitializeToHole) {
 264       // Also initialize the area that will be copied over since HeapNumber
 265       // allocation below can cause an incremental marking step, requiring all
 266       // existing heap objects to be propertly initialized.
 267       int start = to_start;
 268       int length = to_base->length() - start;
 269       if (length > 0) {
 270         Heap* heap = from_base->GetHeap();
 271         MemsetPointer(FixedArray::cast(*to_base)->data_start() + start,
 272                       heap->the_hole_value(), length);
 273       }
 274     }
 275   }
 276   DCHECK((copy_size + static_cast<int>(to_start)) <= to_base->length() &&
 277          (copy_size + static_cast<int>(from_start)) <= from_base->length());
 278   if (copy_size == 0) return;
 279   Isolate* isolate = from_base->GetIsolate();
 280   Handle<FixedDoubleArray> from = Handle<FixedDoubleArray>::cast(from_base);
 281   Handle<FixedArray> to = Handle<FixedArray>::cast(to_base);
 282   for (int i = 0; i < copy_size; ++i) {
 283     HandleScope scope(isolate);
 284     if (IsFastSmiElementsKind(to_kind)) {
 285       UNIMPLEMENTED();
 286     } else {
 287       DCHECK(IsFastObjectElementsKind(to_kind));
 288       Handle<Object> value = FixedDoubleArray::get(from, i + from_start);
 289       to->set(i + to_start, *value, UPDATE_WRITE_BARRIER);
 290     }
 291   }
 292 }
 293
 294
 295 static void CopyDoubleToDoubleElements(FixedArrayBase* from_base,
 296                                        uint32_t from_start,
 297                                        FixedArrayBase* to_base,
 298                                        uint32_t to_start, int raw_copy_size) {
 299   DisallowHeapAllocation no_allocation;
 300   int copy_size = raw_copy_size;
 301   if (raw_copy_size < 0) {
 302     DCHECK(raw_copy_size == ElementsAccessor::kCopyToEnd ||
 303            raw_copy_size == ElementsAccessor::kCopyToEndAndInitializeToHole);
 304     copy_size = Min(from_base->length() - from_start,
 305                     to_base->length() - to_start);
 306     if (raw_copy_size == ElementsAccessor::kCopyToEndAndInitializeToHole) {
 307       for (int i = to_start + copy_size; i < to_base->length(); ++i) {
 308         FixedDoubleArray::cast(to_base)->set_the_hole(i);
 309       }
 310     }
 311   }
 312   DCHECK((copy_size + static_cast<int>(to_start)) <= to_base->length() &&
 313          (copy_size + static_cast<int>(from_start)) <= from_base->length());
 314   if (copy_size == 0) return;
 315   FixedDoubleArray* from = FixedDoubleArray::cast(from_base);
 316   FixedDoubleArray* to = FixedDoubleArray::cast(to_base);
 317   Address to_address = to->address() + FixedDoubleArray::kHeaderSize;
 318   Address from_address = from->address() + FixedDoubleArray::kHeaderSize;
 319   to_address += kDoubleSize * to_start;
 320   from_address += kDoubleSize * from_start;
 321   int words_per_double = (kDoubleSize / kPointerSize);
 322   CopyWords(reinterpret_cast<Object**>(to_address),
 323             reinterpret_cast<Object**>(from_address),
 324             static_cast<size_t>(words_per_double * copy_size));
 325 }
 326
 327
 328 static void CopySmiToDoubleElements(FixedArrayBase* from_base,
 329                                     uint32_t from_start,
 330                                     FixedArrayBase* to_base, uint32_t to_start,
 331                                     int raw_copy_size) {
 332   DisallowHeapAllocation no_allocation;
 333   int copy_size = raw_copy_size;
 334   if (raw_copy_size < 0) {
 335     DCHECK(raw_copy_size == ElementsAccessor::kCopyToEnd ||
 336            raw_copy_size == ElementsAccessor::kCopyToEndAndInitializeToHole);
 337     copy_size = from_base->length() - from_start;
 338     if (raw_copy_size == ElementsAccessor::kCopyToEndAndInitializeToHole) {
 339       for (int i = to_start + copy_size; i < to_base->length(); ++i) {
 340         FixedDoubleArray::cast(to_base)->set_the_hole(i);
 341       }
 342     }
 343   }
 344   DCHECK((copy_size + static_cast<int>(to_start)) <= to_base->length() &&
 345          (copy_size + static_cast<int>(from_start)) <= from_base->length());
 346   if (copy_size == 0) return;
 347   FixedArray* from = FixedArray::cast(from_base);
 348   FixedDoubleArray* to = FixedDoubleArray::cast(to_base);
 349   Object* the_hole = from->GetHeap()->the_hole_value();
 350   for (uint32_t from_end = from_start + static_cast<uint32_t>(copy_size);
 351        from_start < from_end; from_start++, to_start++) {
 352     Object* hole_or_smi = from->get(from_start);
 353     if (hole_or_smi == the_hole) {
 354       to->set_the_hole(to_start);
 355     } else {
 356       to->set(to_start, Smi::cast(hole_or_smi)->value());
 357     }
 358   }
 359 }
 360
 361
 362 static void CopyPackedSmiToDoubleElements(FixedArrayBase* from_base,
 363                                           uint32_t from_start,
 364                                           FixedArrayBase* to_base,
 365                                           uint32_t to_start, int packed_size,
 366                                           int raw_copy_size) {
 367   DisallowHeapAllocation no_allocation;
 368   int copy_size = raw_copy_size;
 369   uint32_t to_end;
 370   if (raw_copy_size < 0) {
 371     DCHECK(raw_copy_size == ElementsAccessor::kCopyToEnd ||
 372            raw_copy_size == ElementsAccessor::kCopyToEndAndInitializeToHole);
 373     copy_size = packed_size - from_start;
 374     if (raw_copy_size == ElementsAccessor::kCopyToEndAndInitializeToHole) {
 375       to_end = to_base->length();
 376       for (uint32_t i = to_start + copy_size; i < to_end; ++i) {
 377         FixedDoubleArray::cast(to_base)->set_the_hole(i);
 378       }
 379     } else {
 380       to_end = to_start + static_cast<uint32_t>(copy_size);
 381     }
 382   } else {
 383     to_end = to_start + static_cast<uint32_t>(copy_size);
 384   }
 385   DCHECK(static_cast<int>(to_end) <= to_base->length());
 386   DCHECK(packed_size >= 0 && packed_size <= copy_size);
 387   DCHECK((copy_size + static_cast<int>(to_start)) <= to_base->length() &&
 388          (copy_size + static_cast<int>(from_start)) <= from_base->length());
 389   if (copy_size == 0) return;
 390   FixedArray* from = FixedArray::cast(from_base);
 391   FixedDoubleArray* to = FixedDoubleArray::cast(to_base);
 392   for (uint32_t from_end = from_start + static_cast<uint32_t>(packed_size);
 393        from_start < from_end; from_start++, to_start++) {
 394     Object* smi = from->get(from_start);
 395     DCHECK(!smi->IsTheHole());
 396     to->set(to_start, Smi::cast(smi)->value());
 397   }
 398 }
 399
 400
 401 static void CopyObjectToDoubleElements(FixedArrayBase* from_base,
 402                                        uint32_t from_start,
 403                                        FixedArrayBase* to_base,
 404                                        uint32_t to_start, int raw_copy_size) {
 405   DisallowHeapAllocation no_allocation;
 406   int copy_size = raw_copy_size;
 407   if (raw_copy_size < 0) {
 408     DCHECK(raw_copy_size == ElementsAccessor::kCopyToEnd ||
 409            raw_copy_size == ElementsAccessor::kCopyToEndAndInitializeToHole);
 410     copy_size = from_base->length() - from_start;
 411     if (raw_copy_size == ElementsAccessor::kCopyToEndAndInitializeToHole) {
 412       for (int i = to_start + copy_size; i < to_base->length(); ++i) {
 413         FixedDoubleArray::cast(to_base)->set_the_hole(i);
 414       }
 415     }
 416   }
 417   DCHECK((copy_size + static_cast<int>(to_start)) <= to_base->length() &&
 418          (copy_size + static_cast<int>(from_start)) <= from_base->length());
 419   if (copy_size == 0) return;
 420   FixedArray* from = FixedArray::cast(from_base);
 421   FixedDoubleArray* to = FixedDoubleArray::cast(to_base);
 422   Object* the_hole = from->GetHeap()->the_hole_value();
 423   for (uint32_t from_end = from_start + copy_size;
 424        from_start < from_end; from_start++, to_start++) {
 425     Object* hole_or_object = from->get(from_start);
 426     if (hole_or_object == the_hole) {
 427       to->set_the_hole(to_start);
 428     } else {
 429       to->set(to_start, hole_or_object->Number());
 430     }
 431   }
 432 }
 433
 434
 435 static void CopyDictionaryToDoubleElements(FixedArrayBase* from_base,
 436                                            uint32_t from_start,
 437                                            FixedArrayBase* to_base,
 438                                            uint32_t to_start,
 439                                            int raw_copy_size) {
 440   DisallowHeapAllocation no_allocation;
 441   SeededNumberDictionary* from = SeededNumberDictionary::cast(from_base);
 442   int copy_size = raw_copy_size;
 443   if (copy_size < 0) {
 444     DCHECK(copy_size == ElementsAccessor::kCopyToEnd ||
 445            copy_size == ElementsAccessor::kCopyToEndAndInitializeToHole);
 446     copy_size = from->max_number_key() + 1 - from_start;
 447     if (raw_copy_size == ElementsAccessor::kCopyToEndAndInitializeToHole) {
 448       for (int i = to_start + copy_size; i < to_base->length(); ++i) {
 449         FixedDoubleArray::cast(to_base)->set_the_hole(i);
 450       }
 451     }
 452   }
 453   if (copy_size == 0) return;
 454   FixedDoubleArray* to = FixedDoubleArray::cast(to_base);
 455   uint32_t to_length = to->length();
 456   if (to_start + copy_size > to_length) {
 457     copy_size = to_length - to_start;
 458   }
 459   for (int i = 0; i < copy_size; i++) {
 460     int entry = from->FindEntry(i + from_start);
 461     if (entry != SeededNumberDictionary::kNotFound) {
 462       to->set(i + to_start, from->ValueAt(entry)->Number());
 463     } else {
 464       to->set_the_hole(i + to_start);
 465     }
 466   }
 467 }
 468
 469
 470 static void TraceTopFrame(Isolate* isolate) {
 471   StackFrameIterator it(isolate);
 472   if (it.done()) {
 473     PrintF("unknown location (no JavaScript frames present)");
 474     return;
 475   }
 476   StackFrame* raw_frame = it.frame();
 477   if (raw_frame->is_internal()) {
 478     Code* apply_builtin = isolate->builtins()->builtin(
 479         Builtins::kFunctionApply);
 480     if (raw_frame->unchecked_code() == apply_builtin) {
 481       PrintF("apply from ");
 482       it.Advance();
 483       raw_frame = it.frame();
 484     }
 485   }
 486   JavaScriptFrame::PrintTop(isolate, stdout, false, true);
 487 }
 488
 489
 490 void CheckArrayAbuse(Handle<JSObject> obj, const char* op, uint32_t key,
 491                      bool allow_appending) {
 492   DisallowHeapAllocation no_allocation;
 493   Object* raw_length = NULL;
 494   const char* elements_type = "array";
 495   if (obj->IsJSArray()) {
 496     JSArray* array = JSArray::cast(*obj);
 497     raw_length = array->length();
 498   } else {
 499     raw_length = Smi::FromInt(obj->elements()->length());
 500     elements_type = "object";
 501   }
 502
 503   if (raw_length->IsNumber()) {
 504     double n = raw_length->Number();
 505     if (FastI2D(FastD2UI(n)) == n) {
 506       int32_t int32_length = DoubleToInt32(n);
 507       uint32_t compare_length = static_cast<uint32_t>(int32_length);
 508       if (allow_appending) compare_length++;
 509       if (key >= compare_length) {
 510         PrintF("[OOB %s %s (%s length = %d, element accessed = %d) in ",
 511                elements_type, op, elements_type,
 512                static_cast<int>(int32_length),
 513                static_cast<int>(key));
 514         TraceTopFrame(obj->GetIsolate());
 515         PrintF("]\n");
 516       }
 517     } else {
 518       PrintF("[%s elements length not integer value in ", elements_type);
 519       TraceTopFrame(obj->GetIsolate());
 520       PrintF("]\n");
 521     }
 522   } else {
 523     PrintF("[%s elements length not a number in ", elements_type);
 524     TraceTopFrame(obj->GetIsolate());
 525     PrintF("]\n");
 526   }
 527 }
 528
 529
 530 // Base class for element handler implementations. Contains the
 531 // the common logic for objects with different ElementsKinds.
 532 // Subclasses must specialize method for which the element
 533 // implementation differs from the base class implementation.
 534 //
 535 // This class is intended to be used in the following way:
 536 //
 537 //   class SomeElementsAccessor :
 538 //       public ElementsAccessorBase<SomeElementsAccessor,
 539 //                                   BackingStoreClass> {
 540 //     ...
 541 //   }
 542 //
 543 // This is an example of the Curiously Recurring Template Pattern (see
 544 // http://en.wikipedia.org/wiki/Curiously_recurring_template_pattern).  We use
 545 // CRTP to guarantee aggressive compile time optimizations (i.e.  inlining and
 546 // specialization of SomeElementsAccessor methods).
 547 template <typename ElementsAccessorSubclass,
 548           typename ElementsTraitsParam>
 549 class ElementsAccessorBase : public ElementsAccessor {
 550  protected:
 551   explicit ElementsAccessorBase(const char* name)
 552       : ElementsAccessor(name) { }
 553
 554   typedef ElementsTraitsParam ElementsTraits;
 555   typedef typename ElementsTraitsParam::BackingStore BackingStore;
 556
 557   virtual ElementsKind kind() const FINAL OVERRIDE {
 558     return ElementsTraits::Kind;
 559   }
 560
 561   static void ValidateContents(Handle<JSObject> holder, int length) {
 562   }
 563
 564   static void ValidateImpl(Handle<JSObject> holder) {
 565     Handle<FixedArrayBase> fixed_array_base(holder->elements());
 566     if (!fixed_array_base->IsHeapObject()) return;
 567     // Arrays that have been shifted in place can't be verified.
 568     if (fixed_array_base->IsFiller()) return;
 569     int length = 0;
 570     if (holder->IsJSArray()) {
 571       Object* length_obj = Handle<JSArray>::cast(holder)->length();
 572       if (length_obj->IsSmi()) {
 573         length = Smi::cast(length_obj)->value();
 574       }
 575     } else {
 576       length = fixed_array_base->length();
 577     }
 578     ElementsAccessorSubclass::ValidateContents(holder, length);
 579   }
 580
 581   virtual void Validate(Handle<JSObject> holder) FINAL OVERRIDE {
 582     DisallowHeapAllocation no_gc;
 583     ElementsAccessorSubclass::ValidateImpl(holder);
 584   }
 585
 586   static bool HasElementImpl(Handle<Object> receiver,
 587                              Handle<JSObject> holder,
 588                              uint32_t key,
 589                              Handle<FixedArrayBase> backing_store) {
 590     return ElementsAccessorSubclass::GetAttributesImpl(
 591         receiver, holder, key, backing_store) != ABSENT;
 592   }
 593
 594   virtual bool HasElement(
 595       Handle<Object> receiver,
 596       Handle<JSObject> holder,
 597       uint32_t key,
 598       Handle<FixedArrayBase> backing_store) FINAL OVERRIDE {
 599     return ElementsAccessorSubclass::HasElementImpl(
 600         receiver, holder, key, backing_store);
 601   }
 602
 603   MUST_USE_RESULT virtual MaybeHandle<Object> Get(
 604       Handle<Object> receiver,
 605       Handle<JSObject> holder,
 606       uint32_t key,
 607       Handle<FixedArrayBase> backing_store) FINAL OVERRIDE {
 608     if (!IsExternalArrayElementsKind(ElementsTraits::Kind) &&
 609         FLAG_trace_js_array_abuse) {
 610       CheckArrayAbuse(holder, "elements read", key);
 611     }
 612
 613     if (IsExternalArrayElementsKind(ElementsTraits::Kind) &&
 614         FLAG_trace_external_array_abuse) {
 615       CheckArrayAbuse(holder, "external elements read", key);
 616     }
 617
 618     return ElementsAccessorSubclass::GetImpl(
 619         receiver, holder, key, backing_store);
 620   }
 621
 622   MUST_USE_RESULT static MaybeHandle<Object> GetImpl(
 623       Handle<Object> receiver,
 624       Handle<JSObject> obj,
 625       uint32_t key,
 626       Handle<FixedArrayBase> backing_store) {
 627     if (key < ElementsAccessorSubclass::GetCapacityImpl(backing_store)) {
 628       return BackingStore::get(Handle<BackingStore>::cast(backing_store), key);
 629     } else {
 630       return backing_store->GetIsolate()->factory()->the_hole_value();
 631     }
 632   }
 633
 634   MUST_USE_RESULT virtual PropertyAttributes GetAttributes(
 635       Handle<Object> receiver,
 636       Handle<JSObject> holder,
 637       uint32_t key,
 638       Handle<FixedArrayBase> backing_store) FINAL OVERRIDE {
 639     return ElementsAccessorSubclass::GetAttributesImpl(
 640         receiver, holder, key, backing_store);
 641   }
 642
 643   MUST_USE_RESULT static PropertyAttributes GetAttributesImpl(
 644         Handle<Object> receiver,
 645         Handle<JSObject> obj,
 646         uint32_t key,
 647         Handle<FixedArrayBase> backing_store) {
 648     if (key >= ElementsAccessorSubclass::GetCapacityImpl(backing_store)) {
 649       return ABSENT;
 650     }
 651     return
 652         Handle<BackingStore>::cast(backing_store)->is_the_hole(key)
 653           ? ABSENT : NONE;
 654   }
 655
 656   MUST_USE_RESULT virtual MaybeHandle<AccessorPair> GetAccessorPair(
 657       Handle<Object> receiver,
 658       Handle<JSObject> holder,
 659       uint32_t key,
 660       Handle<FixedArrayBase> backing_store) FINAL OVERRIDE {
 661     return ElementsAccessorSubclass::GetAccessorPairImpl(
 662         receiver, holder, key, backing_store);
 663   }
 664
 665   MUST_USE_RESULT static MaybeHandle<AccessorPair> GetAccessorPairImpl(
 666       Handle<Object> receiver,
 667       Handle<JSObject> obj,
 668       uint32_t key,
 669       Handle<FixedArrayBase> backing_store) {
 670     return MaybeHandle<AccessorPair>();
 671   }
 672
 673   MUST_USE_RESULT virtual MaybeHandle<Object> SetLength(
 674       Handle<JSArray> array,
 675       Handle<Object> length) FINAL OVERRIDE {
 676     return ElementsAccessorSubclass::SetLengthImpl(
 677         array, length, handle(array->elements()));
 678   }
 679
 680   MUST_USE_RESULT static MaybeHandle<Object> SetLengthImpl(
 681       Handle<JSObject> obj,
 682       Handle<Object> length,
 683       Handle<FixedArrayBase> backing_store);
 684
 685   virtual void SetCapacityAndLength(
 686       Handle<JSArray> array,
 687       int capacity,
 688       int length) FINAL OVERRIDE {
 689     ElementsAccessorSubclass::
 690         SetFastElementsCapacityAndLength(array, capacity, length);
 691   }
 692
 693   static void SetFastElementsCapacityAndLength(
 694       Handle<JSObject> obj,
 695       int capacity,
 696       int length) {
 697     UNIMPLEMENTED();
 698   }
 699
 700   MUST_USE_RESULT virtual MaybeHandle<Object> Delete(
 701       Handle<JSObject> obj,
 702       uint32_t key,
 703       JSReceiver::DeleteMode mode) OVERRIDE = 0;
 704
 705   static void CopyElementsImpl(Handle<FixedArrayBase> from,
 706                                uint32_t from_start,
 707                                Handle<FixedArrayBase> to,
 708                                ElementsKind from_kind,
 709                                uint32_t to_start,
 710                                int packed_size,
 711                                int copy_size) {
 712     UNREACHABLE();
 713   }
 714
 715   virtual void CopyElements(
 716       Handle<FixedArrayBase> from,
 717       uint32_t from_start,
 718       ElementsKind from_kind,
 719       Handle<FixedArrayBase> to,
 720       uint32_t to_start,
 721       int copy_size) FINAL OVERRIDE {
 722     DCHECK(!from.is_null());
 723     ElementsAccessorSubclass::CopyElementsImpl(
 724         from, from_start, to, from_kind, to_start, kPackedSizeNotKnown,
 725         copy_size);
 726   }
 727
 728   virtual void CopyElements(
 729       JSObject* from_holder,
 730       uint32_t from_start,
 731       ElementsKind from_kind,
 732       Handle<FixedArrayBase> to,
 733       uint32_t to_start,
 734       int copy_size) FINAL OVERRIDE {
 735     int packed_size = kPackedSizeNotKnown;
 736     bool is_packed = IsFastPackedElementsKind(from_kind) &&
 737         from_holder->IsJSArray();
 738     if (is_packed) {
 739       packed_size =
 740           Smi::cast(JSArray::cast(from_holder)->length())->value();
 741       if (copy_size >= 0 && packed_size > copy_size) {
 742         packed_size = copy_size;
 743       }
 744     }
 745     Handle<FixedArrayBase> from(from_holder->elements());
 746     ElementsAccessorSubclass::CopyElementsImpl(
 747         from, from_start, to, from_kind, to_start, packed_size, copy_size);
 748   }
 749
 750   virtual MaybeHandle<FixedArray> AddElementsToFixedArray(
 751       Handle<Object> receiver,
 752       Handle<JSObject> holder,
 753       Handle<FixedArray> to,
 754       Handle<FixedArrayBase> from) FINAL OVERRIDE {
 755     int len0 = to->length();
 756 #ifdef ENABLE_SLOW_DCHECKS
 757     if (FLAG_enable_slow_asserts) {
 758       for (int i = 0; i < len0; i++) {
 759         DCHECK(!to->get(i)->IsTheHole());
 760       }
 761     }
 762 #endif
 763
 764     // Optimize if 'other' is empty.
 765     // We cannot optimize if 'this' is empty, as other may have holes.
 766     uint32_t len1 = ElementsAccessorSubclass::GetCapacityImpl(from);
 767     if (len1 == 0) return to;
 768
 769     Isolate* isolate = from->GetIsolate();
 770
 771     // Compute how many elements are not in other.
 772     uint32_t extra = 0;
 773     for (uint32_t y = 0; y < len1; y++) {
 774       uint32_t key = ElementsAccessorSubclass::GetKeyForIndexImpl(from, y);
 775       if (ElementsAccessorSubclass::HasElementImpl(
 776               receiver, holder, key, from)) {
 777         Handle<Object> value;
 778         ASSIGN_RETURN_ON_EXCEPTION(
 779             isolate, value,
 780             ElementsAccessorSubclass::GetImpl(receiver, holder, key, from),
 781             FixedArray);
 782
 783         DCHECK(!value->IsTheHole());
 784         if (!HasKey(to, value)) {
 785           extra++;
 786         }
 787       }
 788     }
 789
 790     if (extra == 0) return to;
 791
 792     // Allocate the result
 793     Handle<FixedArray> result = isolate->factory()->NewFixedArray(len0 + extra);
 794
 795     // Fill in the content
 796     {
 797       DisallowHeapAllocation no_gc;
 798       WriteBarrierMode mode = result->GetWriteBarrierMode(no_gc);
 799       for (int i = 0; i < len0; i++) {
 800         Object* e = to->get(i);
 801         DCHECK(e->IsString() || e->IsNumber());
 802         result->set(i, e, mode);
 803       }
 804     }
 805     // Fill in the extra values.
 806     uint32_t index = 0;
 807     for (uint32_t y = 0; y < len1; y++) {
 808       uint32_t key =
 809           ElementsAccessorSubclass::GetKeyForIndexImpl(from, y);
 810       if (ElementsAccessorSubclass::HasElementImpl(
 811               receiver, holder, key, from)) {
 812         Handle<Object> value;
 813         ASSIGN_RETURN_ON_EXCEPTION(
 814             isolate, value,
 815             ElementsAccessorSubclass::GetImpl(receiver, holder, key, from),
 816             FixedArray);
 817         if (!value->IsTheHole() && !HasKey(to, value)) {
 818           result->set(len0 + index, *value);
 819           index++;
 820         }
 821       }
 822     }
 823     DCHECK(extra == index);
 824     return result;
 825   }
 826
 827  protected:
 828   static uint32_t GetCapacityImpl(Handle<FixedArrayBase> backing_store) {
 829     return backing_store->length();
 830   }
 831
 832   virtual uint32_t GetCapacity(Handle<FixedArrayBase> backing_store)
 833       FINAL OVERRIDE {
 834     return ElementsAccessorSubclass::GetCapacityImpl(backing_store);
 835   }
 836
 837   static uint32_t GetKeyForIndexImpl(Handle<FixedArrayBase> backing_store,
 838                                      uint32_t index) {
 839     return index;
 840   }
 841
 842   virtual uint32_t GetKeyForIndex(Handle<FixedArrayBase> backing_store,
 843                                   uint32_t index) FINAL OVERRIDE {
 844     return ElementsAccessorSubclass::GetKeyForIndexImpl(backing_store, index);
 845   }
 846
 847  private:
 848   DISALLOW_COPY_AND_ASSIGN(ElementsAccessorBase);
 849 };
 850
 851
 852 // Super class for all fast element arrays.
 853 template<typename FastElementsAccessorSubclass,
 854          typename KindTraits>
 855 class FastElementsAccessor
 856     : public ElementsAccessorBase<FastElementsAccessorSubclass, KindTraits> {
 857  public:
 858   explicit FastElementsAccessor(const char* name)
 859       : ElementsAccessorBase<FastElementsAccessorSubclass,
 860                              KindTraits>(name) {}
 861  protected:
 862   friend class ElementsAccessorBase<FastElementsAccessorSubclass, KindTraits>;
 863   friend class SloppyArgumentsElementsAccessor;
 864
 865   typedef typename KindTraits::BackingStore BackingStore;
 866
 867   // Adjusts the length of the fast backing store.
 868   static Handle<Object> SetLengthWithoutNormalize(
 869       Handle<FixedArrayBase> backing_store,
 870       Handle<JSArray> array,
 871       Handle<Object> length_object,
 872       uint32_t length) {
 873     Isolate* isolate = array->GetIsolate();
 874     uint32_t old_capacity = backing_store->length();
 875     Handle<Object> old_length(array->length(), isolate);
 876     bool same_or_smaller_size = old_length->IsSmi() &&
 877         static_cast<uint32_t>(Handle<Smi>::cast(old_length)->value()) >= length;
 878     ElementsKind kind = array->GetElementsKind();
 879
 880     if (!same_or_smaller_size && IsFastElementsKind(kind) &&
 881         !IsFastHoleyElementsKind(kind)) {
 882       kind = GetHoleyElementsKind(kind);
 883       JSObject::TransitionElementsKind(array, kind);
 884     }
 885
 886     // Check whether the backing store should be shrunk.
 887     if (length <= old_capacity) {
 888       if (array->HasFastSmiOrObjectElements()) {
 889         backing_store = JSObject::EnsureWritableFastElements(array);
 890       }
 891       if (2 * length <= old_capacity) {
 892         // If more than half the elements won't be used, trim the array.
 893         if (length == 0) {
 894           array->initialize_elements();
 895         } else {
 896           isolate->heap()->RightTrimFixedArray<Heap::FROM_MUTATOR>(
 897               *backing_store, old_capacity - length);
 898         }
 899       } else {
 900         // Otherwise, fill the unused tail with holes.
 901         int old_length = FastD2IChecked(array->length()->Number());
 902         for (int i = length; i < old_length; i++) {
 903           Handle<BackingStore>::cast(backing_store)->set_the_hole(i);
 904         }
 905       }
 906       return length_object;
 907     }
 908
 909     // Check whether the backing store should be expanded.
 910     uint32_t min = JSObject::NewElementsCapacity(old_capacity);
 911     uint32_t new_capacity = length > min ? length : min;
 912     FastElementsAccessorSubclass::SetFastElementsCapacityAndLength(
 913         array, new_capacity, length);
 914     JSObject::ValidateElements(array);
 915     return length_object;
 916   }
 917
 918   static Handle<Object> DeleteCommon(Handle<JSObject> obj,
 919                                      uint32_t key,
 920                                      JSReceiver::DeleteMode mode) {
 921     DCHECK(obj->HasFastSmiOrObjectElements() ||
 922            obj->HasFastDoubleElements() ||
 923            obj->HasFastArgumentsElements());
 924     Isolate* isolate = obj->GetIsolate();
 925     Heap* heap = obj->GetHeap();
 926     Handle<FixedArrayBase> elements(obj->elements());
 927     if (*elements == heap->empty_fixed_array()) {
 928       return isolate->factory()->true_value();
 929     }
 930     Handle<BackingStore> backing_store = Handle<BackingStore>::cast(elements);
 931     bool is_sloppy_arguments_elements_map =
 932         backing_store->map() == heap->sloppy_arguments_elements_map();
 933     if (is_sloppy_arguments_elements_map) {
 934       backing_store = handle(
 935           BackingStore::cast(Handle<FixedArray>::cast(backing_store)->get(1)),
 936           isolate);
 937     }
 938     uint32_t length = static_cast<uint32_t>(
 939         obj->IsJSArray()
 940         ? Smi::cast(Handle<JSArray>::cast(obj)->length())->value()
 941         : backing_store->length());
 942     if (key < length) {
 943       if (!is_sloppy_arguments_elements_map) {
 944         ElementsKind kind = KindTraits::Kind;
 945         if (IsFastPackedElementsKind(kind)) {
 946           JSObject::TransitionElementsKind(obj, GetHoleyElementsKind(kind));
 947         }
 948         if (IsFastSmiOrObjectElementsKind(KindTraits::Kind)) {
 949           Handle<Object> writable = JSObject::EnsureWritableFastElements(obj);
 950           backing_store = Handle<BackingStore>::cast(writable);
 951         }
 952       }
 953       backing_store->set_the_hole(key);
 954       // If an old space backing store is larger than a certain size and
 955       // has too few used values, normalize it.
 956       // To avoid doing the check on every delete we require at least
 957       // one adjacent hole to the value being deleted.
 958       const int kMinLengthForSparsenessCheck = 64;
 959       if (backing_store->length() >= kMinLengthForSparsenessCheck &&
 960           !heap->InNewSpace(*backing_store) &&
 961           ((key > 0 && backing_store->is_the_hole(key - 1)) ||
 962            (key + 1 < length && backing_store->is_the_hole(key + 1)))) {
 963         int num_used = 0;
 964         for (int i = 0; i < backing_store->length(); ++i) {
 965           if (!backing_store->is_the_hole(i)) ++num_used;
 966           // Bail out early if more than 1/4 is used.
 967           if (4 * num_used > backing_store->length()) break;
 968         }
 969         if (4 * num_used <= backing_store->length()) {
 970           JSObject::NormalizeElements(obj);
 971         }
 972       }
 973     }
 974     return isolate->factory()->true_value();
 975   }
 976
 977   virtual MaybeHandle<Object> Delete(
 978       Handle<JSObject> obj,
 979       uint32_t key,
 980       JSReceiver::DeleteMode mode) FINAL OVERRIDE {
 981     return DeleteCommon(obj, key, mode);
 982   }
 983
 984   static bool HasElementImpl(
 985       Handle<Object> receiver,
 986       Handle<JSObject> holder,
 987       uint32_t key,
 988       Handle<FixedArrayBase> backing_store) {
 989     if (key >= static_cast<uint32_t>(backing_store->length())) {
 990       return false;
 991     }
 992     return !Handle<BackingStore>::cast(backing_store)->is_the_hole(key);
 993   }
 994
 995   static void ValidateContents(Handle<JSObject> holder, int length) {
 996 #if DEBUG
 997     Isolate* isolate = holder->GetIsolate();
 998     HandleScope scope(isolate);
 999     Handle<FixedArrayBase> elements(holder->elements(), isolate);
1000     Map* map = elements->map();
1001     DCHECK((IsFastSmiOrObjectElementsKind(KindTraits::Kind) &&
1002             (map == isolate->heap()->fixed_array_map() ||
1003              map == isolate->heap()->fixed_cow_array_map())) ||
1004            (IsFastDoubleElementsKind(KindTraits::Kind) ==
1005             ((map == isolate->heap()->fixed_array_map() && length == 0) ||
1006              map == isolate->heap()->fixed_double_array_map())));
1007     DisallowHeapAllocation no_gc;
1008     for (int i = 0; i < length; i++) {
1009       HandleScope scope(isolate);
1010       Handle<BackingStore> backing_store = Handle<BackingStore>::cast(elements);
1011       DCHECK((!IsFastSmiElementsKind(KindTraits::Kind) ||
1012               BackingStore::get(backing_store, i)->IsSmi()) ||
1013              (IsFastHoleyElementsKind(KindTraits::Kind) ==
1014               backing_store->is_the_hole(i)));
1015     }
1016 #endif
1017   }
1018 };
1019
1020
1021 static inline ElementsKind ElementsKindForArray(Handle<FixedArrayBase> array) {
1022   switch (array->map()->instance_type()) {
1023     case FIXED_ARRAY_TYPE:
1024       if (array->IsDictionary()) {
1025         return DICTIONARY_ELEMENTS;
1026       } else {
1027         return FAST_HOLEY_ELEMENTS;
1028       }
1029     case FIXED_DOUBLE_ARRAY_TYPE:
1030       return FAST_HOLEY_DOUBLE_ELEMENTS;
1031
1032 #define TYPED_ARRAY_CASE(Type, type, TYPE, ctype, size)                       \
1033     case EXTERNAL_##TYPE##_ARRAY_TYPE:                                        \
1034       return EXTERNAL_##TYPE##_ELEMENTS;                                      \
1035     case FIXED_##TYPE##_ARRAY_TYPE:                                           \
1036       return TYPE##_ELEMENTS;
1037
1038     TYPED_ARRAYS(TYPED_ARRAY_CASE)
1039 #undef TYPED_ARRAY_CASE
1040
1041     default:
1042       UNREACHABLE();
1043   }
1044   return FAST_HOLEY_ELEMENTS;
1045 }
1046
1047
1048 template<typename FastElementsAccessorSubclass,
1049          typename KindTraits>
1050 class FastSmiOrObjectElementsAccessor
1051     : public FastElementsAccessor<FastElementsAccessorSubclass, KindTraits> {
1052  public:
1053   explicit FastSmiOrObjectElementsAccessor(const char* name)
1054       : FastElementsAccessor<FastElementsAccessorSubclass,
1055                              KindTraits>(name) {}
1056
1057   static void CopyElementsImpl(Handle<FixedArrayBase> from,
1058                                uint32_t from_start,
1059                                Handle<FixedArrayBase> to,
1060                                ElementsKind from_kind,
1061                                uint32_t to_start,
1062                                int packed_size,
1063                                int copy_size) {
1064     ElementsKind to_kind = KindTraits::Kind;
1065     switch (from_kind) {
1066       case FAST_SMI_ELEMENTS:
1067       case FAST_HOLEY_SMI_ELEMENTS:
1068       case FAST_ELEMENTS:
1069       case FAST_HOLEY_ELEMENTS:
1070         CopyObjectToObjectElements(*from, from_kind, from_start, *to, to_kind,
1071                                    to_start, copy_size);
1072         break;
1073       case FAST_DOUBLE_ELEMENTS:
1074       case FAST_HOLEY_DOUBLE_ELEMENTS:
1075         CopyDoubleToObjectElements(
1076             from, from_start, to, to_kind, to_start, copy_size);
1077         break;
1078       case DICTIONARY_ELEMENTS:
1079         CopyDictionaryToObjectElements(*from, from_start, *to, to_kind,
1080                                        to_start, copy_size);
1081         break;
1082       case SLOPPY_ARGUMENTS_ELEMENTS: {
1083         // TODO(verwaest): This is a temporary hack to support extending
1084         // SLOPPY_ARGUMENTS_ELEMENTS in SetFastElementsCapacityAndLength.
1085         // This case should be UNREACHABLE().
1086         Handle<FixedArray> parameter_map = Handle<FixedArray>::cast(from);
1087         Handle<FixedArrayBase> arguments(
1088             FixedArrayBase::cast(parameter_map->get(1)));
1089         ElementsKind from_kind = ElementsKindForArray(arguments);
1090         CopyElementsImpl(arguments, from_start, to, from_kind,
1091                          to_start, packed_size, copy_size);
1092         break;
1093       }
1094 #define TYPED_ARRAY_CASE(Type, type, TYPE, ctype, size)                       \
1095       case EXTERNAL_##TYPE##_ELEMENTS:                                        \
1096       case TYPE##_ELEMENTS:                                                   \
1097         UNREACHABLE();
1098       TYPED_ARRAYS(TYPED_ARRAY_CASE)
1099 #undef TYPED_ARRAY_CASE
1100     }
1101   }
1102
1103
1104   static void SetFastElementsCapacityAndLength(
1105       Handle<JSObject> obj,
1106       uint32_t capacity,
1107       uint32_t length) {
1108     JSObject::SetFastElementsCapacitySmiMode set_capacity_mode =
1109         obj->HasFastSmiElements()
1110             ? JSObject::kAllowSmiElements
1111             : JSObject::kDontAllowSmiElements;
1112     JSObject::SetFastElementsCapacityAndLength(
1113         obj, capacity, length, set_capacity_mode);
1114   }
1115 };
1116
1117
1118 class FastPackedSmiElementsAccessor
1119     : public FastSmiOrObjectElementsAccessor<
1120         FastPackedSmiElementsAccessor,
1121         ElementsKindTraits<FAST_SMI_ELEMENTS> > {
1122  public:
1123   explicit FastPackedSmiElementsAccessor(const char* name)
1124       : FastSmiOrObjectElementsAccessor<
1125           FastPackedSmiElementsAccessor,
1126           ElementsKindTraits<FAST_SMI_ELEMENTS> >(name) {}
1127 };
1128
1129
1130 class FastHoleySmiElementsAccessor
1131     : public FastSmiOrObjectElementsAccessor<
1132         FastHoleySmiElementsAccessor,
1133         ElementsKindTraits<FAST_HOLEY_SMI_ELEMENTS> > {
1134  public:
1135   explicit FastHoleySmiElementsAccessor(const char* name)
1136       : FastSmiOrObjectElementsAccessor<
1137           FastHoleySmiElementsAccessor,
1138           ElementsKindTraits<FAST_HOLEY_SMI_ELEMENTS> >(name) {}
1139 };
1140
1141
1142 class FastPackedObjectElementsAccessor
1143     : public FastSmiOrObjectElementsAccessor<
1144         FastPackedObjectElementsAccessor,
1145         ElementsKindTraits<FAST_ELEMENTS> > {
1146  public:
1147   explicit FastPackedObjectElementsAccessor(const char* name)
1148       : FastSmiOrObjectElementsAccessor<
1149           FastPackedObjectElementsAccessor,
1150           ElementsKindTraits<FAST_ELEMENTS> >(name) {}
1151 };
1152
1153
1154 class FastHoleyObjectElementsAccessor
1155     : public FastSmiOrObjectElementsAccessor<
1156         FastHoleyObjectElementsAccessor,
1157         ElementsKindTraits<FAST_HOLEY_ELEMENTS> > {
1158  public:
1159   explicit FastHoleyObjectElementsAccessor(const char* name)
1160       : FastSmiOrObjectElementsAccessor<
1161           FastHoleyObjectElementsAccessor,
1162           ElementsKindTraits<FAST_HOLEY_ELEMENTS> >(name) {}
1163 };
1164
1165
1166 template<typename FastElementsAccessorSubclass,
1167          typename KindTraits>
1168 class FastDoubleElementsAccessor
1169     : public FastElementsAccessor<FastElementsAccessorSubclass, KindTraits> {
1170  public:
1171   explicit FastDoubleElementsAccessor(const char* name)
1172       : FastElementsAccessor<FastElementsAccessorSubclass,
1173                              KindTraits>(name) {}
1174
1175   static void SetFastElementsCapacityAndLength(Handle<JSObject> obj,
1176                                                uint32_t capacity,
1177                                                uint32_t length) {
1178     JSObject::SetFastDoubleElementsCapacityAndLength(obj, capacity, length);
1179   }
1180
1181  protected:
1182   static void CopyElementsImpl(Handle<FixedArrayBase> from,
1183                                uint32_t from_start,
1184                                Handle<FixedArrayBase> to,
1185                                ElementsKind from_kind,
1186                                uint32_t to_start,
1187                                int packed_size,
1188                                int copy_size) {
1189     switch (from_kind) {
1190       case FAST_SMI_ELEMENTS:
1191         CopyPackedSmiToDoubleElements(*from, from_start, *to, to_start,
1192                                       packed_size, copy_size);
1193         break;
1194       case FAST_HOLEY_SMI_ELEMENTS:
1195         CopySmiToDoubleElements(*from, from_start, *to, to_start, copy_size);
1196         break;
1197       case FAST_DOUBLE_ELEMENTS:
1198       case FAST_HOLEY_DOUBLE_ELEMENTS:
1199         CopyDoubleToDoubleElements(*from, from_start, *to, to_start, copy_size);
1200         break;
1201       case FAST_ELEMENTS:
1202       case FAST_HOLEY_ELEMENTS:
1203         CopyObjectToDoubleElements(*from, from_start, *to, to_start, copy_size);
1204         break;
1205       case DICTIONARY_ELEMENTS:
1206         CopyDictionaryToDoubleElements(*from, from_start, *to, to_start,
1207                                        copy_size);
1208         break;
1209       case SLOPPY_ARGUMENTS_ELEMENTS:
1210         UNREACHABLE();
1211
1212 #define TYPED_ARRAY_CASE(Type, type, TYPE, ctype, size)                       \
1213       case EXTERNAL_##TYPE##_ELEMENTS:                                        \
1214       case TYPE##_ELEMENTS:                                                   \
1215         UNREACHABLE();
1216       TYPED_ARRAYS(TYPED_ARRAY_CASE)
1217 #undef TYPED_ARRAY_CASE
1218     }
1219   }
1220 };
1221
1222
1223 class FastPackedDoubleElementsAccessor
1224     : public FastDoubleElementsAccessor<
1225         FastPackedDoubleElementsAccessor,
1226         ElementsKindTraits<FAST_DOUBLE_ELEMENTS> > {
1227  public:
1228   friend class ElementsAccessorBase<FastPackedDoubleElementsAccessor,
1229                                     ElementsKindTraits<FAST_DOUBLE_ELEMENTS> >;
1230   explicit FastPackedDoubleElementsAccessor(const char* name)
1231       : FastDoubleElementsAccessor<
1232           FastPackedDoubleElementsAccessor,
1233           ElementsKindTraits<FAST_DOUBLE_ELEMENTS> >(name) {}
1234 };
1235
1236
1237 class FastHoleyDoubleElementsAccessor
1238     : public FastDoubleElementsAccessor<
1239         FastHoleyDoubleElementsAccessor,
1240         ElementsKindTraits<FAST_HOLEY_DOUBLE_ELEMENTS> > {
1241  public:
1242   friend class ElementsAccessorBase<
1243     FastHoleyDoubleElementsAccessor,
1244     ElementsKindTraits<FAST_HOLEY_DOUBLE_ELEMENTS> >;
1245   explicit FastHoleyDoubleElementsAccessor(const char* name)
1246       : FastDoubleElementsAccessor<
1247           FastHoleyDoubleElementsAccessor,
1248           ElementsKindTraits<FAST_HOLEY_DOUBLE_ELEMENTS> >(name) {}
1249 };
1250
1251
1252 // Super class for all external element arrays.
1253 template<ElementsKind Kind>
1254 class TypedElementsAccessor
1255     : public ElementsAccessorBase<TypedElementsAccessor<Kind>,
1256                                   ElementsKindTraits<Kind> > {
1257  public:
1258   explicit TypedElementsAccessor(const char* name)
1259       : ElementsAccessorBase<AccessorClass,
1260                              ElementsKindTraits<Kind> >(name) {}
1261
1262  protected:
1263   typedef typename ElementsKindTraits<Kind>::BackingStore BackingStore;
1264   typedef TypedElementsAccessor<Kind> AccessorClass;
1265
1266   friend class ElementsAccessorBase<AccessorClass,
1267                                     ElementsKindTraits<Kind> >;
1268
1269   MUST_USE_RESULT static MaybeHandle<Object> GetImpl(
1270       Handle<Object> receiver,
1271       Handle<JSObject> obj,
1272       uint32_t key,
1273       Handle<FixedArrayBase> backing_store) {
1274     if (key < AccessorClass::GetCapacityImpl(backing_store)) {
1275       return BackingStore::get(Handle<BackingStore>::cast(backing_store), key);
1276     } else {
1277       return backing_store->GetIsolate()->factory()->undefined_value();
1278     }
1279   }
1280
1281   MUST_USE_RESULT static PropertyAttributes GetAttributesImpl(
1282       Handle<Object> receiver,
1283       Handle<JSObject> obj,
1284       uint32_t key,
1285       Handle<FixedArrayBase> backing_store) {
1286     return
1287         key < AccessorClass::GetCapacityImpl(backing_store)
1288           ? NONE : ABSENT;
1289   }
1290
1291   MUST_USE_RESULT static MaybeHandle<Object> SetLengthImpl(
1292       Handle<JSObject> obj,
1293       Handle<Object> length,
1294       Handle<FixedArrayBase> backing_store) {
1295     // External arrays do not support changing their length.
1296     UNREACHABLE();
1297     return obj;
1298   }
1299
1300   MUST_USE_RESULT virtual MaybeHandle<Object> Delete(
1301       Handle<JSObject> obj,
1302       uint32_t key,
1303       JSReceiver::DeleteMode mode) FINAL OVERRIDE {
1304     // External arrays always ignore deletes.
1305     return obj->GetIsolate()->factory()->true_value();
1306   }
1307
1308   static bool HasElementImpl(Handle<Object> receiver,
1309                              Handle<JSObject> holder,
1310                              uint32_t key,
1311                              Handle<FixedArrayBase> backing_store) {
1312     uint32_t capacity =
1313         AccessorClass::GetCapacityImpl(backing_store);
1314     return key < capacity;
1315   }
1316 };
1317
1318
1319
1320 #define EXTERNAL_ELEMENTS_ACCESSOR(Type, type, TYPE, ctype, size)    \
1321   typedef TypedElementsAccessor<EXTERNAL_##TYPE##_ELEMENTS>          \
1322       External##Type##ElementsAccessor;
1323
1324 TYPED_ARRAYS(EXTERNAL_ELEMENTS_ACCESSOR)
1325 #undef EXTERNAL_ELEMENTS_ACCESSOR
1326
1327 #define FIXED_ELEMENTS_ACCESSOR(Type, type, TYPE, ctype, size)       \
1328   typedef TypedElementsAccessor<TYPE##_ELEMENTS >                    \
1329       Fixed##Type##ElementsAccessor;
1330
1331 TYPED_ARRAYS(FIXED_ELEMENTS_ACCESSOR)
1332 #undef FIXED_ELEMENTS_ACCESSOR
1333
1334
1335
1336 class DictionaryElementsAccessor
1337     : public ElementsAccessorBase<DictionaryElementsAccessor,
1338                                   ElementsKindTraits<DICTIONARY_ELEMENTS> > {
1339  public:
1340   explicit DictionaryElementsAccessor(const char* name)
1341       : ElementsAccessorBase<DictionaryElementsAccessor,
1342                              ElementsKindTraits<DICTIONARY_ELEMENTS> >(name) {}
1343
1344   // Adjusts the length of the dictionary backing store and returns the new
1345   // length according to ES5 section 15.4.5.2 behavior.
1346   static Handle<Object> SetLengthWithoutNormalize(
1347       Handle<FixedArrayBase> store,
1348       Handle<JSArray> array,
1349       Handle<Object> length_object,
1350       uint32_t length) {
1351     Handle<SeededNumberDictionary> dict =
1352         Handle<SeededNumberDictionary>::cast(store);
1353     Isolate* isolate = array->GetIsolate();
1354     int capacity = dict->Capacity();
1355     uint32_t new_length = length;
1356     uint32_t old_length = static_cast<uint32_t>(array->length()->Number());
1357     if (new_length < old_length) {
1358       // Find last non-deletable element in range of elements to be
1359       // deleted and adjust range accordingly.
1360       for (int i = 0; i < capacity; i++) {
1361         DisallowHeapAllocation no_gc;
1362         Object* key = dict->KeyAt(i);
1363         if (key->IsNumber()) {
1364           uint32_t number = static_cast<uint32_t>(key->Number());
1365           if (new_length <= number && number < old_length) {
1366             PropertyDetails details = dict->DetailsAt(i);
1367             if (!details.IsConfigurable()) new_length = number + 1;
1368           }
1369         }
1370       }
1371       if (new_length != length) {
1372         length_object = isolate->factory()->NewNumberFromUint(new_length);
1373       }
1374     }
1375
1376     if (new_length == 0) {
1377       // Flush the backing store.
1378       JSObject::ResetElements(array);
1379     } else {
1380       DisallowHeapAllocation no_gc;
1381       // Remove elements that should be deleted.
1382       int removed_entries = 0;
1383       Handle<Object> the_hole_value = isolate->factory()->the_hole_value();
1384       for (int i = 0; i < capacity; i++) {
1385         Object* key = dict->KeyAt(i);
1386         if (key->IsNumber()) {
1387           uint32_t number = static_cast<uint32_t>(key->Number());
1388           if (new_length <= number && number < old_length) {
1389             dict->SetEntry(i, the_hole_value, the_hole_value);
1390             removed_entries++;
1391           }
1392         }
1393       }
1394
1395       // Update the number of elements.
1396       dict->ElementsRemoved(removed_entries);
1397     }
1398     return length_object;
1399   }
1400
1401   MUST_USE_RESULT static MaybeHandle<Object> DeleteCommon(
1402       Handle<JSObject> obj,
1403       uint32_t key,
1404       JSReceiver::DeleteMode mode) {
1405     Isolate* isolate = obj->GetIsolate();
1406     Handle<FixedArray> backing_store(FixedArray::cast(obj->elements()),
1407                                      isolate);
1408     bool is_arguments =
1409         (obj->GetElementsKind() == SLOPPY_ARGUMENTS_ELEMENTS);
1410     if (is_arguments) {
1411       backing_store = handle(FixedArray::cast(backing_store->get(1)), isolate);
1412     }
1413     Handle<SeededNumberDictionary> dictionary =
1414         Handle<SeededNumberDictionary>::cast(backing_store);
1415     int entry = dictionary->FindEntry(key);
1416     if (entry != SeededNumberDictionary::kNotFound) {
1417       Handle<Object> result =
1418           SeededNumberDictionary::DeleteProperty(dictionary, entry, mode);
1419       if (*result == *isolate->factory()->false_value()) {
1420         if (mode == JSObject::STRICT_DELETION) {
1421           // Deleting a non-configurable property in strict mode.
1422           Handle<Object> name = isolate->factory()->NewNumberFromUint(key);
1423           Handle<Object> args[2] = { name, obj };
1424           THROW_NEW_ERROR(isolate, NewTypeError("strict_delete_property",
1425                                                 HandleVector(args, 2)),
1426                           Object);
1427         }
1428         return isolate->factory()->false_value();
1429       }
1430       Handle<FixedArray> new_elements =
1431           SeededNumberDictionary::Shrink(dictionary, key);
1432
1433       if (is_arguments) {
1434         FixedArray::cast(obj->elements())->set(1, *new_elements);
1435       } else {
1436         obj->set_elements(*new_elements);
1437       }
1438     }
1439     return isolate->factory()->true_value();
1440   }
1441
1442   static void CopyElementsImpl(Handle<FixedArrayBase> from,
1443                                uint32_t from_start,
1444                                Handle<FixedArrayBase> to,
1445                                ElementsKind from_kind,
1446                                uint32_t to_start,
1447                                int packed_size,
1448                                int copy_size) {
1449     UNREACHABLE();
1450   }
1451
1452
1453  protected:
1454   friend class ElementsAccessorBase<DictionaryElementsAccessor,
1455                                     ElementsKindTraits<DICTIONARY_ELEMENTS> >;
1456
1457   MUST_USE_RESULT virtual MaybeHandle<Object> Delete(
1458       Handle<JSObject> obj,
1459       uint32_t key,
1460       JSReceiver::DeleteMode mode) FINAL OVERRIDE {
1461     return DeleteCommon(obj, key, mode);
1462   }
1463
1464   MUST_USE_RESULT static MaybeHandle<Object> GetImpl(
1465       Handle<Object> receiver,
1466       Handle<JSObject> obj,
1467       uint32_t key,
1468       Handle<FixedArrayBase> store) {
1469     Handle<SeededNumberDictionary> backing_store =
1470         Handle<SeededNumberDictionary>::cast(store);
1471     Isolate* isolate = backing_store->GetIsolate();
1472     int entry = backing_store->FindEntry(key);
1473     if (entry != SeededNumberDictionary::kNotFound) {
1474       Handle<Object> element(backing_store->ValueAt(entry), isolate);
1475       PropertyDetails details = backing_store->DetailsAt(entry);
1476       if (details.type() == CALLBACKS) {
1477         return JSObject::GetElementWithCallback(
1478             obj, receiver, element, key, obj);
1479       } else {
1480         return element;
1481       }
1482     }
1483     return isolate->factory()->the_hole_value();
1484   }
1485
1486   MUST_USE_RESULT static PropertyAttributes GetAttributesImpl(
1487       Handle<Object> receiver,
1488       Handle<JSObject> obj,
1489       uint32_t key,
1490       Handle<FixedArrayBase> backing_store) {
1491     Handle<SeededNumberDictionary> dictionary =
1492         Handle<SeededNumberDictionary>::cast(backing_store);
1493     int entry = dictionary->FindEntry(key);
1494     if (entry != SeededNumberDictionary::kNotFound) {
1495       return dictionary->DetailsAt(entry).attributes();
1496     }
1497     return ABSENT;
1498   }
1499
1500   MUST_USE_RESULT static MaybeHandle<AccessorPair> GetAccessorPairImpl(
1501       Handle<Object> receiver,
1502       Handle<JSObject> obj,
1503       uint32_t key,
1504       Handle<FixedArrayBase> store) {
1505     Handle<SeededNumberDictionary> backing_store =
1506         Handle<SeededNumberDictionary>::cast(store);
1507     int entry = backing_store->FindEntry(key);
1508     if (entry != SeededNumberDictionary::kNotFound &&
1509         backing_store->DetailsAt(entry).type() == CALLBACKS &&
1510         backing_store->ValueAt(entry)->IsAccessorPair()) {
1511       return handle(AccessorPair::cast(backing_store->ValueAt(entry)));
1512     }
1513     return MaybeHandle<AccessorPair>();
1514   }
1515
1516   static bool HasElementImpl(Handle<Object> receiver,
1517                              Handle<JSObject> holder,
1518                              uint32_t key,
1519                              Handle<FixedArrayBase> store) {
1520     Handle<SeededNumberDictionary> backing_store =
1521         Handle<SeededNumberDictionary>::cast(store);
1522     return backing_store->FindEntry(key) != SeededNumberDictionary::kNotFound;
1523   }
1524
1525   static uint32_t GetKeyForIndexImpl(Handle<FixedArrayBase> store,
1526                                      uint32_t index) {
1527     DisallowHeapAllocation no_gc;
1528     Handle<SeededNumberDictionary> dict =
1529         Handle<SeededNumberDictionary>::cast(store);
1530     Object* key = dict->KeyAt(index);
1531     return Smi::cast(key)->value();
1532   }
1533 };
1534
1535
1536 class SloppyArgumentsElementsAccessor : public ElementsAccessorBase<
1537     SloppyArgumentsElementsAccessor,
1538     ElementsKindTraits<SLOPPY_ARGUMENTS_ELEMENTS> > {
1539  public:
1540   explicit SloppyArgumentsElementsAccessor(const char* name)
1541       : ElementsAccessorBase<
1542           SloppyArgumentsElementsAccessor,
1543           ElementsKindTraits<SLOPPY_ARGUMENTS_ELEMENTS> >(name) {}
1544  protected:
1545   friend class ElementsAccessorBase<
1546       SloppyArgumentsElementsAccessor,
1547       ElementsKindTraits<SLOPPY_ARGUMENTS_ELEMENTS> >;
1548
1549   MUST_USE_RESULT static MaybeHandle<Object> GetImpl(
1550       Handle<Object> receiver,
1551       Handle<JSObject> obj,
1552       uint32_t key,
1553       Handle<FixedArrayBase> parameters) {
1554     Isolate* isolate = obj->GetIsolate();
1555     Handle<FixedArray> parameter_map = Handle<FixedArray>::cast(parameters);
1556     Handle<Object> probe = GetParameterMapArg(obj, parameter_map, key);
1557     if (!probe->IsTheHole()) {
1558       DisallowHeapAllocation no_gc;
1559       Context* context = Context::cast(parameter_map->get(0));
1560       int context_index = Handle<Smi>::cast(probe)->value();
1561       DCHECK(!context->get(context_index)->IsTheHole());
1562       return handle(context->get(context_index), isolate);
1563     } else {
1564       // Object is not mapped, defer to the arguments.
1565       Handle<FixedArray> arguments(FixedArray::cast(parameter_map->get(1)),
1566                                    isolate);
1567       Handle<Object> result;
1568       ASSIGN_RETURN_ON_EXCEPTION(
1569           isolate, result,
1570           ElementsAccessor::ForArray(arguments)->Get(
1571               receiver, obj, key, arguments),
1572           Object);
1573       // Elements of the arguments object in slow mode might be slow aliases.
1574       if (result->IsAliasedArgumentsEntry()) {
1575         DisallowHeapAllocation no_gc;
1576         AliasedArgumentsEntry* entry = AliasedArgumentsEntry::cast(*result);
1577         Context* context = Context::cast(parameter_map->get(0));
1578         int context_index = entry->aliased_context_slot();
1579         DCHECK(!context->get(context_index)->IsTheHole());
1580         return handle(context->get(context_index), isolate);
1581       } else {
1582         return result;
1583       }
1584     }
1585   }
1586
1587   MUST_USE_RESULT static PropertyAttributes GetAttributesImpl(
1588       Handle<Object> receiver,
1589       Handle<JSObject> obj,
1590       uint32_t key,
1591       Handle<FixedArrayBase> backing_store) {
1592     Handle<FixedArray> parameter_map = Handle<FixedArray>::cast(backing_store);
1593     Handle<Object> probe = GetParameterMapArg(obj, parameter_map, key);
1594     if (!probe->IsTheHole()) {
1595       return NONE;
1596     } else {
1597       // If not aliased, check the arguments.
1598       Handle<FixedArray> arguments(FixedArray::cast(parameter_map->get(1)));
1599       return ElementsAccessor::ForArray(arguments)->GetAttributes(
1600           receiver, obj, key, arguments);
1601     }
1602   }
1603
1604   MUST_USE_RESULT static MaybeHandle<AccessorPair> GetAccessorPairImpl(
1605       Handle<Object> receiver,
1606       Handle<JSObject> obj,
1607       uint32_t key,
1608       Handle<FixedArrayBase> parameters) {
1609     Handle<FixedArray> parameter_map = Handle<FixedArray>::cast(parameters);
1610     Handle<Object> probe = GetParameterMapArg(obj, parameter_map, key);
1611     if (!probe->IsTheHole()) {
1612       return MaybeHandle<AccessorPair>();
1613     } else {
1614       // If not aliased, check the arguments.
1615       Handle<FixedArray> arguments(FixedArray::cast(parameter_map->get(1)));
1616       return ElementsAccessor::ForArray(arguments)->GetAccessorPair(
1617           receiver, obj, key, arguments);
1618     }
1619   }
1620
1621   MUST_USE_RESULT static MaybeHandle<Object> SetLengthImpl(
1622       Handle<JSObject> obj,
1623       Handle<Object> length,
1624       Handle<FixedArrayBase> parameter_map) {
1625     // TODO(mstarzinger): This was never implemented but will be used once we
1626     // correctly implement [[DefineOwnProperty]] on arrays.
1627     UNIMPLEMENTED();
1628     return obj;
1629   }
1630
1631   MUST_USE_RESULT virtual MaybeHandle<Object> Delete(
1632       Handle<JSObject> obj,
1633       uint32_t key,
1634       JSReceiver::DeleteMode mode) FINAL OVERRIDE {
1635     Isolate* isolate = obj->GetIsolate();
1636     Handle<FixedArray> parameter_map(FixedArray::cast(obj->elements()));
1637     Handle<Object> probe = GetParameterMapArg(obj, parameter_map, key);
1638     if (!probe->IsTheHole()) {
1639       // TODO(kmillikin): We could check if this was the last aliased
1640       // parameter, and revert to normal elements in that case.  That
1641       // would enable GC of the context.
1642       parameter_map->set_the_hole(key + 2);
1643     } else {
1644       Handle<FixedArray> arguments(FixedArray::cast(parameter_map->get(1)));
1645       if (arguments->IsDictionary()) {
1646         return DictionaryElementsAccessor::DeleteCommon(obj, key, mode);
1647       } else {
1648         // It's difficult to access the version of DeleteCommon that is declared
1649         // in the templatized super class, call the concrete implementation in
1650         // the class for the most generalized ElementsKind subclass.
1651         return FastHoleyObjectElementsAccessor::DeleteCommon(obj, key, mode);
1652       }
1653     }
1654     return isolate->factory()->true_value();
1655   }
1656
1657   static void CopyElementsImpl(Handle<FixedArrayBase> from,
1658                                uint32_t from_start,
1659                                Handle<FixedArrayBase> to,
1660                                ElementsKind from_kind,
1661                                uint32_t to_start,
1662                                int packed_size,
1663                                int copy_size) {
1664     UNREACHABLE();
1665   }
1666
1667   static uint32_t GetCapacityImpl(Handle<FixedArrayBase> backing_store) {
1668     Handle<FixedArray> parameter_map = Handle<FixedArray>::cast(backing_store);
1669     Handle<FixedArrayBase> arguments(
1670         FixedArrayBase::cast(parameter_map->get(1)));
1671     return Max(static_cast<uint32_t>(parameter_map->length() - 2),
1672                ForArray(arguments)->GetCapacity(arguments));
1673   }
1674
1675   static uint32_t GetKeyForIndexImpl(Handle<FixedArrayBase> dict,
1676                                      uint32_t index) {
1677     return index;
1678   }
1679
1680   static bool HasElementImpl(Handle<Object> receiver,
1681                              Handle<JSObject> holder,
1682                              uint32_t key,
1683                              Handle<FixedArrayBase> parameters) {
1684     Handle<FixedArray> parameter_map = Handle<FixedArray>::cast(parameters);
1685     Handle<Object> probe = GetParameterMapArg(holder, parameter_map, key);
1686     if (!probe->IsTheHole()) {
1687       return true;
1688     } else {
1689       Isolate* isolate = holder->GetIsolate();
1690       Handle<FixedArrayBase> arguments(FixedArrayBase::cast(
1691           Handle<FixedArray>::cast(parameter_map)->get(1)), isolate);
1692       ElementsAccessor* accessor = ElementsAccessor::ForArray(arguments);
1693       Handle<Object> value;
1694       ASSIGN_RETURN_ON_EXCEPTION_VALUE(
1695           isolate, value,
1696           accessor->Get(receiver, holder, key, arguments),
1697           false);
1698       return !value->IsTheHole();
1699     }
1700   }
1701
1702  private:
1703   static Handle<Object> GetParameterMapArg(Handle<JSObject> holder,
1704                                            Handle<FixedArray> parameter_map,
1705                                            uint32_t key) {
1706     Isolate* isolate = holder->GetIsolate();
1707     uint32_t length = holder->IsJSArray()
1708         ? Smi::cast(Handle<JSArray>::cast(holder)->length())->value()
1709         : parameter_map->length();
1710     return key < (length - 2)
1711         ? handle(parameter_map->get(key + 2), isolate)
1712         : Handle<Object>::cast(isolate->factory()->the_hole_value());
1713   }
1714 };
1715
1716
1717 ElementsAccessor* ElementsAccessor::ForArray(Handle<FixedArrayBase> array) {
1718   return elements_accessors_[ElementsKindForArray(array)];
1719 }
1720
1721
1722 void ElementsAccessor::InitializeOncePerProcess() {
1723   static ElementsAccessor* accessor_array[] = {
1724 #define ACCESSOR_ARRAY(Class, Kind, Store) new Class(#Kind),
1725     ELEMENTS_LIST(ACCESSOR_ARRAY)
1726 #undef ACCESSOR_ARRAY
1727   };
1728
1729   STATIC_ASSERT((sizeof(accessor_array) / sizeof(*accessor_array)) ==
1730                 kElementsKindCount);
1731
1732   elements_accessors_ = accessor_array;
1733 }
1734
1735
1736 void ElementsAccessor::TearDown() {
1737   if (elements_accessors_ == NULL) return;
1738 #define ACCESSOR_DELETE(Class, Kind, Store) delete elements_accessors_[Kind];
1739   ELEMENTS_LIST(ACCESSOR_DELETE)
1740 #undef ACCESSOR_DELETE
1741   elements_accessors_ = NULL;
1742 }
1743
1744
1745 template <typename ElementsAccessorSubclass, typename ElementsKindTraits>
1746 MUST_USE_RESULT
1747 MaybeHandle<Object> ElementsAccessorBase<ElementsAccessorSubclass,
1748                                          ElementsKindTraits>::
1749     SetLengthImpl(Handle<JSObject> obj,
1750                   Handle<Object> length,
1751                   Handle<FixedArrayBase> backing_store) {
1752   Isolate* isolate = obj->GetIsolate();
1753   Handle<JSArray> array = Handle<JSArray>::cast(obj);
1754
1755   // Fast case: The new length fits into a Smi.
1756   Handle<Object> smi_length;
1757
1758   if (Object::ToSmi(isolate, length).ToHandle(&smi_length) &&
1759       smi_length->IsSmi()) {
1760     const int value = Handle<Smi>::cast(smi_length)->value();
1761     if (value >= 0) {
1762       Handle<Object> new_length = ElementsAccessorSubclass::
1763           SetLengthWithoutNormalize(backing_store, array, smi_length, value);
1764       DCHECK(!new_length.is_null());
1765
1766       // even though the proposed length was a smi, new_length could
1767       // still be a heap number because SetLengthWithoutNormalize doesn't
1768       // allow the array length property to drop below the index of
1769       // non-deletable elements.
1770       DCHECK(new_length->IsSmi() || new_length->IsHeapNumber() ||
1771              new_length->IsUndefined());
1772       if (new_length->IsSmi()) {
1773         array->set_length(*Handle<Smi>::cast(new_length));
1774         return array;
1775       } else if (new_length->IsHeapNumber()) {
1776         array->set_length(*new_length);
1777         return array;
1778       }
1779     } else {
1780       return ThrowArrayLengthRangeError(isolate);
1781     }
1782   }
1783
1784   // Slow case: The new length does not fit into a Smi or conversion
1785   // to slow elements is needed for other reasons.
1786   if (length->IsNumber()) {
1787     uint32_t value;
1788     if (length->ToArrayIndex(&value)) {
1789       Handle<SeededNumberDictionary> dictionary =
1790           JSObject::NormalizeElements(array);
1791       DCHECK(!dictionary.is_null());
1792
1793       Handle<Object> new_length = DictionaryElementsAccessor::
1794           SetLengthWithoutNormalize(dictionary, array, length, value);
1795       DCHECK(!new_length.is_null());
1796
1797       DCHECK(new_length->IsNumber());
1798       array->set_length(*new_length);
1799       return array;
1800     } else {
1801       return ThrowArrayLengthRangeError(isolate);
1802     }
1803   }
1804
1805   // Fall-back case: The new length is not a number so make the array
1806   // size one and set only element to length.
1807   Handle<FixedArray> new_backing_store = isolate->factory()->NewFixedArray(1);
1808   new_backing_store->set(0, *length);
1809   JSArray::SetContent(array, new_backing_store);
1810   return array;
1811 }
1812
1813
1814 MaybeHandle<Object> ArrayConstructInitializeElements(Handle<JSArray> array,
1815                                                      Arguments* args) {
1816   // Optimize the case where there is one argument and the argument is a
1817   // small smi.
1818   if (args->length() == 1) {
1819     Handle<Object> obj = args->at<Object>(0);
1820     if (obj->IsSmi()) {
1821       int len = Handle<Smi>::cast(obj)->value();
1822       if (len > 0 && len < JSObject::kInitialMaxFastElementArray) {
1823         ElementsKind elements_kind = array->GetElementsKind();
1824         JSArray::Initialize(array, len, len);
1825
1826         if (!IsFastHoleyElementsKind(elements_kind)) {
1827           elements_kind = GetHoleyElementsKind(elements_kind);
1828           JSObject::TransitionElementsKind(array, elements_kind);
1829         }
1830         return array;
1831       } else if (len == 0) {
1832         JSArray::Initialize(array, JSArray::kPreallocatedArrayElements);
1833         return array;
1834       }
1835     }
1836
1837     // Take the argument as the length.
1838     JSArray::Initialize(array, 0);
1839
1840     return JSArray::SetElementsLength(array, obj);
1841   }
1842
1843   // Optimize the case where there are no parameters passed.
1844   if (args->length() == 0) {
1845     JSArray::Initialize(array, JSArray::kPreallocatedArrayElements);
1846     return array;
1847   }
1848
1849   Factory* factory = array->GetIsolate()->factory();
1850
1851   // Set length and elements on the array.
1852   int number_of_elements = args->length();
1853   JSObject::EnsureCanContainElements(
1854       array, args, 0, number_of_elements, ALLOW_CONVERTED_DOUBLE_ELEMENTS);
1855
1856   // Allocate an appropriately typed elements array.
1857   ElementsKind elements_kind = array->GetElementsKind();
1858   Handle<FixedArrayBase> elms;
1859   if (IsFastDoubleElementsKind(elements_kind)) {
1860     elms = Handle<FixedArrayBase>::cast(
1861         factory->NewFixedDoubleArray(number_of_elements));
1862   } else {
1863     elms = Handle<FixedArrayBase>::cast(
1864         factory->NewFixedArrayWithHoles(number_of_elements));
1865   }
1866
1867   // Fill in the content
1868   switch (array->GetElementsKind()) {
1869     case FAST_HOLEY_SMI_ELEMENTS:
1870     case FAST_SMI_ELEMENTS: {
1871       Handle<FixedArray> smi_elms = Handle<FixedArray>::cast(elms);
1872       for (int index = 0; index < number_of_elements; index++) {
1873         smi_elms->set(index, (*args)[index], SKIP_WRITE_BARRIER);
1874       }
1875       break;
1876     }
1877     case FAST_HOLEY_ELEMENTS:
1878     case FAST_ELEMENTS: {
1879       DisallowHeapAllocation no_gc;
1880       WriteBarrierMode mode = elms->GetWriteBarrierMode(no_gc);
1881       Handle<FixedArray> object_elms = Handle<FixedArray>::cast(elms);
1882       for (int index = 0; index < number_of_elements; index++) {
1883         object_elms->set(index, (*args)[index], mode);
1884       }
1885       break;
1886     }
1887     case FAST_HOLEY_DOUBLE_ELEMENTS:
1888     case FAST_DOUBLE_ELEMENTS: {
1889       Handle<FixedDoubleArray> double_elms =
1890           Handle<FixedDoubleArray>::cast(elms);
1891       for (int index = 0; index < number_of_elements; index++) {
1892         double_elms->set(index, (*args)[index]->Number());
1893       }
1894       break;
1895     }
1896     default:
1897       UNREACHABLE();
1898       break;
1899   }
1900
1901   array->set_elements(*elms);
1902   array->set_length(Smi::FromInt(number_of_elements));
1903   return array;
1904 }
1905
1906 } }  // namespace v8::internal