From 6cf94ebde1ad31dfce0af4dfa642468ec21b0174 Mon Sep 17 00:00:00 2001 From: bmeurer Date: Mon, 27 Jul 2015 23:48:08 -0700 Subject: [PATCH] [stubs] Also handle properties of the JSBuiltinsObject in the fast case. We can apply the shortcut used for data properties of the JSGlobalObject to builtin properties as well. This mostly affects the custom properties we use for the Math functions (i.e. rngstate for Math.random() and kMath for sin, cos and friends). Drive-by-fix: Also mark the internal builtin typed arrays properties (rngstate, kMath and rempio2result) as READ_ONLY, as they should not be touched after genesis. R=yangguo@chromium.org Review URL: https://codereview.chromium.org/1254143003 Cr-Commit-Position: refs/heads/master@{#29887} --- src/bootstrapper.cc | 3 ++- src/runtime/runtime-object.cc | 9 +++++---- 2 files changed, 7 insertions(+), 5 deletions(-) diff --git a/src/bootstrapper.cc b/src/bootstrapper.cc index 71b61e6b5..1c1f3c735 100644 --- a/src/bootstrapper.cc +++ b/src/bootstrapper.cc @@ -1819,7 +1819,8 @@ Data* SetBuiltinTypedArray(Isolate* isolate, Handle builtins, // Reset property cell type before (re)initializing. JSBuiltinsObject::InvalidatePropertyCell(builtins, name_string); JSObject::SetOwnPropertyIgnoreAttributes(builtins, name_string, typed_array, - DONT_DELETE).Assert(); + FROZEN) + .Assert(); return data; } diff --git a/src/runtime/runtime-object.cc b/src/runtime/runtime-object.cc index b9c3fdf1b..07ba01f95 100644 --- a/src/runtime/runtime-object.cc +++ b/src/runtime/runtime-object.cc @@ -437,8 +437,8 @@ RUNTIME_FUNCTION(Runtime_LoadGlobalViaContext) { // Switch to fast mode only if there is a data property and it's not on // a hidden prototype. - if (LookupIterator::DATA == it.state() && - it.GetHolder()->IsJSGlobalObject()) { + if (it.state() == LookupIterator::DATA && + it.GetHolder().is_identical_to(global_object)) { // Now update the cell in the script context. Handle cell = it.GetPropertyCell(); script_context->set(slot, *cell); @@ -469,10 +469,11 @@ Object* StoreGlobalViaContext(Isolate* isolate, int slot, Handle value, Handle name(scope_info->ContextSlotName(slot), isolate); Handle global_object(script_context->global_object(), isolate); LookupIterator it(global_object, name, LookupIterator::HIDDEN); + // Switch to fast mode only if there is a data property and it's not on // a hidden prototype. - if (LookupIterator::DATA == it.state() && - it.GetHolder()->IsJSGlobalObject()) { + if (it.state() == LookupIterator::DATA && + it.GetHolder().is_identical_to(global_object)) { // Now update cell in the script context. Handle cell = it.GetPropertyCell(); script_context->set(slot, *cell); -- 2.34.1