[builtins] Move InternalPackedArray initialization into bootstrapper.

Incremental step towards the removal of JS Natives.  This CL Moves
the initialization of InternalPackedArray functions and prototype out
of prologue.js and into bootstrapper.

Bug: v8:7624
Change-Id: I7a2a1afbd1721ddc9bc9ac677c03f0817e4f1418
Reviewed-on: https://chromium-review.googlesource.com/c/1374995Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Peter Wong <peter.wm.wong@gmail.com>
Cr-Commit-Position: refs/heads/master@{#58240}

src/bootstrapper.cc

@@ -245,9 +245,9 @@ class Genesis {
   };
   Handle<JSFunction> CreateArrayBuffer(Handle<String> name,
                                        ArrayBufferKind array_buffer_kind);
-  Handle<JSFunction> InstallInternalArray(Handle<JSObject> target,
-                                          const char* name,
-                                          ElementsKind elements_kind);
+  void InstallInternalPackedArrayFunction(Handle<JSObject> prototype,
+                                          const char* name);
+  void InstallInternalPackedArray(Handle<JSObject> target, const char* name);
   bool InstallNatives();
 
   Handle<JSFunction> InstallTypedArray(const char* name,
@@ -1749,6 +1749,9 @@ void Genesis::InitializeGlobal(Handle<JSGlobalObject> global_object,
     array_prototype_to_string_fun =
         SimpleInstallFunction(isolate_, proto, "toString",
                               Builtins::kArrayPrototypeToString, 0, false);
+
+    Handle<Map> map(proto->map(), isolate_);
+    Map::SetShouldBeFastPrototypeMap(map, true, isolate_);
   }
 
   {  // --- A r r a y I t e r a t o r ---
@@ -4913,10 +4916,20 @@ Handle<JSFunction> Genesis::CreateArrayBuffer(
   return array_buffer_fun;
 }
 
+void Genesis::InstallInternalPackedArrayFunction(Handle<JSObject> prototype,
+                                                 const char* function_name) {
+  Handle<JSObject> array_prototype(native_context()->initial_array_prototype(),
+                                   isolate());
+  Handle<Object> func =
+      JSReceiver::GetProperty(isolate(), array_prototype, function_name)
+          .ToHandleChecked();
+  JSObject::AddProperty(isolate(), prototype,
+                        factory()->InternalizeUtf8String(function_name), func,
+                        ALL_ATTRIBUTES_MASK);
+}
 
-Handle<JSFunction> Genesis::InstallInternalArray(Handle<JSObject> target,
-                                                 const char* name,
-                                                 ElementsKind elements_kind) {
+void Genesis::InstallInternalPackedArray(Handle<JSObject> target,
+                                         const char* name) {
   // --- I n t e r n a l   A r r a y ---
   // An array constructor on the builtins object that works like
   // the public Array constructor, except that its prototype
@@ -4933,7 +4946,7 @@ Handle<JSFunction> Genesis::InstallInternalArray(Handle<JSObject> target,
 
   Handle<Map> original_map(array_function->initial_map(), isolate());
   Handle<Map> initial_map = Map::Copy(isolate(), original_map, "InternalArray");
-  initial_map->set_elements_kind(elements_kind);
+  initial_map->set_elements_kind(PACKED_ELEMENTS);
   JSFunction::SetInitialMap(array_function, initial_map, prototype);
 
   // Make "length" magic on instances.
@@ -4949,7 +4962,18 @@ Handle<JSFunction> Genesis::InstallInternalArray(Handle<JSObject> target,
     initial_map->AppendDescriptor(isolate(), &d);
   }
 
-  return array_function;
+  JSObject::NormalizeProperties(
+      prototype, KEEP_INOBJECT_PROPERTIES, 6,
+      "OptimizeInternalPackedArrayPrototypeForAdding");
+  InstallInternalPackedArrayFunction(prototype, "push");
+  InstallInternalPackedArrayFunction(prototype, "pop");
+  InstallInternalPackedArrayFunction(prototype, "shift");
+  InstallInternalPackedArrayFunction(prototype, "unshift");
+  InstallInternalPackedArrayFunction(prototype, "splice");
+  InstallInternalPackedArrayFunction(prototype, "slice");
+
+  JSObject::ForceSetPrototype(prototype, factory()->null_value());
+  JSObject::MigrateSlowToFast(prototype, 0, "Bootstrapping");
 }
 
 bool Genesis::InstallNatives() {
@@ -4967,7 +4991,7 @@ bool Genesis::InstallNatives() {
       factory()->NewJSObject(isolate()->object_function());
   native_context()->set_extras_utils_object(*extras_utils);
 
-  InstallInternalArray(extras_utils, "InternalPackedArray", PACKED_ELEMENTS);
+  InstallInternalPackedArray(extras_utils, "InternalPackedArray");
 
   // v8.createPromise(parent)
   Handle<JSFunction> promise_internal_constructor =

src/js/prologue.js

@@ -38,36 +38,6 @@ function ImportNow(name) {
 }
 
 
-// Prevents changes to the prototype of a built-in function.
-// The "prototype" property of the function object is made non-configurable,
-// and the prototype object is made non-extensible. The latter prevents
-// changing the __proto__ property.
-function SetUpLockedPrototype(
-    constructor, fields, methods) {
-  %CheckIsBootstrapping();
-  var prototype = constructor.prototype;
-  // Install functions first, because this function is used to initialize
-  // PropertyDescriptor itself.
-  var property_count = (methods.length >> 1) + (fields ? fields.length : 0);
-  if (property_count >= 4) {
-    %OptimizeObjectForAddingMultipleProperties(prototype, property_count);
-  }
-  if (fields) {
-    for (var i = 0; i < fields.length; i++) {
-      %AddNamedProperty(prototype, fields[i],
-                        UNDEFINED, DONT_ENUM | DONT_DELETE);
-    }
-  }
-  for (var i = 0; i < methods.length; i += 2) {
-    var key = methods[i];
-    var f = methods[i + 1];
-    %AddNamedProperty(prototype, key, f, DONT_ENUM | DONT_DELETE | READ_ONLY);
-    %SetNativeFlag(f);
-  }
-  %InternalSetPrototype(prototype, null);
-  %ToFastProperties(prototype);
-}
-
 var GlobalArray = global.Array;
 
 // -----------------------------------------------------------------------
@@ -99,13 +69,6 @@ function PostNatives(utils) {
   %AddNamedProperty(GlobalArray.prototype, unscopablesSymbol, unscopables,
                     DONT_ENUM | READ_ONLY);
 
-  var ArrayPop = GlobalArray.prototype.pop;
-  var ArrayPush = GlobalArray.prototype.push;
-  var ArraySlice = GlobalArray.prototype.slice;
-  var ArrayShift = GlobalArray.prototype.shift;
-  var ArraySplice = GlobalArray.prototype.splice;
-  var ArrayUnshift = GlobalArray.prototype.unshift;
-
   // Array prototype functions that return iterators. They are exposed to the
   // public API via Template::SetIntrinsicDataProperty().
   var ArrayEntries = GlobalArray.prototype.entries;
@@ -113,17 +76,6 @@ function PostNatives(utils) {
   var ArrayKeys = GlobalArray.prototype.keys;
   var ArrayValues = GlobalArray.prototype[iteratorSymbol];
 
-  // V8 extras get a separate copy of InternalPackedArray. We give them the basic
-  // manipulation methods.
-  SetUpLockedPrototype(extrasUtils.InternalPackedArray, GlobalArray(), [
-    "push", ArrayPush,
-    "pop", ArrayPop,
-    "shift", ArrayShift,
-    "unshift", ArrayUnshift,
-    "splice", ArraySplice,
-    "slice", ArraySlice
-  ]);
-
   %InstallToContext([
     "array_entries_iterator", ArrayEntries,
     "array_for_each_iterator", ArrayForEach,
@@ -141,7 +93,6 @@ function PostNatives(utils) {
   utils.Export = UNDEFINED;
   utils.Import = UNDEFINED;
   utils.ImportNow = UNDEFINED;
-  utils.SetUpLockedPrototype = UNDEFINED;
   utils.PostNatives = UNDEFINED;
 }