Update the context if Set on slow-mode argument targets an aliased arguments entry

BUG=v8:4177
LOG=n

Review URL: https://codereview.chromium.org/1233493007

Cr-Commit-Position: refs/heads/master@{#29575}

src/elements.cc

@@ -930,11 +930,14 @@ class DictionaryElementsAccessor
     obj->set_elements(*new_elements);
   }
 
+  static Object* GetRaw(FixedArrayBase* store, uint32_t entry) {
+    SeededNumberDictionary* backing_store = SeededNumberDictionary::cast(store);
+    return backing_store->ValueAt(entry);
+  }
+
   static Handle<Object> GetImpl(Handle<FixedArrayBase> store, uint32_t entry) {
-    Handle<SeededNumberDictionary> backing_store =
-        Handle<SeededNumberDictionary>::cast(store);
-    Isolate* isolate = backing_store->GetIsolate();
-    return handle(backing_store->ValueAt(entry), isolate);
+    Isolate* isolate = store->GetIsolate();
+    return handle(GetRaw(*store, entry), isolate);
   }
 
   static void SetImpl(FixedArrayBase* store, uint32_t entry, Object* value) {
@@ -1175,6 +1178,12 @@ class FastSmiOrObjectElementsAccessor
       : FastElementsAccessor<FastElementsAccessorSubclass,
                              KindTraits>(name) {}
 
+  static Object* GetRaw(FixedArray* backing_store, uint32_t entry) {
+    uint32_t index = FastElementsAccessorSubclass::GetIndexForEntryImpl(
+        backing_store, entry);
+    return backing_store->get(index);
+  }
+
   // NOTE: this method violates the handlified function signature convention:
   // raw pointer parameters in the function that allocates.
   // See ElementsAccessor::CopyElements() for details.
@@ -1445,9 +1454,9 @@ class SloppyArgumentsElementsAccessor
       // Elements of the arguments object in slow mode might be slow aliases.
       if (result->IsAliasedArgumentsEntry()) {
         DisallowHeapAllocation no_gc;
-        AliasedArgumentsEntry* entry = AliasedArgumentsEntry::cast(*result);
+        AliasedArgumentsEntry* alias = AliasedArgumentsEntry::cast(*result);
         Context* context = Context::cast(parameter_map->get(0));
-        int context_entry = entry->aliased_context_slot();
+        int context_entry = alias->aliased_context_slot();
         DCHECK(!context->get(context_entry)->IsTheHole());
         return handle(context->get(context_entry), isolate);
       }
@@ -1471,7 +1480,16 @@ class SloppyArgumentsElementsAccessor
       context->set(context_entry, value);
     } else {
       FixedArray* arguments = FixedArray::cast(parameter_map->get(1));
-      ArgumentsAccessor::SetImpl(arguments, entry - length, value);
+      Object* current = ArgumentsAccessor::GetRaw(arguments, entry - length);
+      if (current->IsAliasedArgumentsEntry()) {
+        AliasedArgumentsEntry* alias = AliasedArgumentsEntry::cast(current);
+        Context* context = Context::cast(parameter_map->get(0));
+        int context_entry = alias->aliased_context_slot();
+        DCHECK(!context->get(context_entry)->IsTheHole());
+        context->set(context_entry, value);
+      } else {
+        ArgumentsAccessor::SetImpl(arguments, entry - length, value);
+      }
     }
   }
 

test/test262-es6/test262-es6.status

@@ -505,20 +505,6 @@
   'built-ins/GeneratorPrototype/return/try-finally-within-finally': [FAIL],
   'built-ins/GeneratorPrototype/return/try-finally-within-try': [FAIL],
 
-   # https://code.google.com/p/v8/issues/detail?id=4177
-   'language/arguments-object/mapped/mapped-arguments-nonconfigurable-2': [FAIL],
-   'language/arguments-object/mapped/mapped-arguments-nonconfigurable-3': [FAIL],
-   'language/arguments-object/mapped/mapped-arguments-nonconfigurable-4': [FAIL],
-   'language/arguments-object/mapped/mapped-arguments-nonconfigurable-delete-2': [FAIL],
-   'language/arguments-object/mapped/mapped-arguments-nonconfigurable-delete-3': [FAIL],
-   'language/arguments-object/mapped/mapped-arguments-nonconfigurable-delete-4': [FAIL],
-   'language/arguments-object/mapped/mapped-arguments-nonconfigurable-nonwritable-3': [FAIL],
-   'language/arguments-object/mapped/mapped-arguments-nonconfigurable-nonwritable-4': [FAIL],
-   'language/arguments-object/mapped/mapped-arguments-nonconfigurable-nonwritable-5': [FAIL],
-   'language/arguments-object/mapped/mapped-arguments-nonconfigurable-strict-delete-2': [FAIL],
-   'language/arguments-object/mapped/mapped-arguments-nonconfigurable-strict-delete-3': [FAIL],
-   'language/arguments-object/mapped/mapped-arguments-nonconfigurable-strict-delete-4': [FAIL],
-
    # https://code.google.com/p/v8/issues/detail?id=811
   'language/expressions/assignment/destructuring/array-elem-elision': [FAIL],
   'language/expressions/assignment/destructuring/array-elem-init-assignment': [FAIL],