[stubs] Also handle properties of the JSBuiltinsObject in the fast case.

We can apply the shortcut used for data properties of the JSGlobalObject
to builtin properties as well. This mostly affects the custom properties
we use for the Math functions (i.e. rngstate for Math.random() and kMath
for sin, cos and friends).

Drive-by-fix: Also mark the internal builtin typed arrays properties
(rngstate, kMath and rempio2result) as READ_ONLY, as they should not be
touched after genesis.

R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/1254143003

Cr-Commit-Position: refs/heads/master@{#29887}

diff --git a/src/bootstrapper.cc b/src/bootstrapper.cc
index 71b61e6b52c573e4f64ea64926dee37a9d4c3b0b..1c1f3c7357f2fb21ec1b6da90862bd6fe6af2f1c 100644 (file)
--- a/src/bootstrapper.cc
+++ b/src/bootstrapper.cc
@@ -1819,7 +1819,8 @@ Data* SetBuiltinTypedArray(Isolate* isolate, Handle<JSBuiltinsObject> builtins,
   // Reset property cell type before (re)initializing.
   JSBuiltinsObject::InvalidatePropertyCell(builtins, name_string);
   JSObject::SetOwnPropertyIgnoreAttributes(builtins, name_string, typed_array,
-                                           DONT_DELETE).Assert();
+                                           FROZEN)
+      .Assert();
   return data;
 }
 

diff --git a/src/runtime/runtime-object.cc b/src/runtime/runtime-object.cc
index b9c3fdf1bedbdc09643c164347be4cdf14a92281..07ba01f957ad108153a546656c61ce1d9a418a2f 100644 (file)
--- a/src/runtime/runtime-object.cc
+++ b/src/runtime/runtime-object.cc
@@ -437,8 +437,8 @@ RUNTIME_FUNCTION(Runtime_LoadGlobalViaContext) {
 
   // Switch to fast mode only if there is a data property and it's not on
   // a hidden prototype.
-  if (LookupIterator::DATA == it.state() &&
-      it.GetHolder<Object>()->IsJSGlobalObject()) {
+  if (it.state() == LookupIterator::DATA &&
+      it.GetHolder<Object>().is_identical_to(global_object)) {
     // Now update the cell in the script context.
     Handle<PropertyCell> cell = it.GetPropertyCell();
     script_context->set(slot, *cell);
@@ -469,10 +469,11 @@ Object* StoreGlobalViaContext(Isolate* isolate, int slot, Handle<Object> value,
   Handle<Name> name(scope_info->ContextSlotName(slot), isolate);
   Handle<GlobalObject> global_object(script_context->global_object(), isolate);
   LookupIterator it(global_object, name, LookupIterator::HIDDEN);
+
   // Switch to fast mode only if there is a data property and it's not on
   // a hidden prototype.
-  if (LookupIterator::DATA == it.state() &&
-      it.GetHolder<Object>()->IsJSGlobalObject()) {
+  if (it.state() == LookupIterator::DATA &&
+      it.GetHolder<Object>().is_identical_to(global_object)) {
     // Now update cell in the script context.
     Handle<PropertyCell> cell = it.GetPropertyCell();
     script_context->set(slot, *cell);