Fix TypedArray Property optimizations

This patch installs %TypedArray% and its prototype on the native
context, and wires them up to each TypedArray subclass. This is later
used to check the holder of length, byteLength and byteOffset is
%Typedarray% and apply the appropriate optimizations.

BUG=chromium:593634
LOG=Y

Review-Url: https://codereview.chromium.org/1949863002
Cr-Commit-Position: refs/heads/master@{#36116}

src/accessors.cc

@@ -117,12 +117,11 @@ bool Accessors::IsJSArrayBufferViewFieldAccessor(Handle<Map> map,
       LookupIterator it(proto, name);
       if (!it.IsFound()) return false;
 
-      Object* original_proto =
-          JSFunction::cast(map->GetConstructor())->prototype();
+      Handle<Object> typed_array_proto = isolate->typed_array_prototype();
 
       // Property is not configurable. It is enough to verify that
       // the holder is the same.
-      return *it.GetHolder<Object>() == original_proto;
+      return *it.GetHolder<Object>() == *typed_array_proto;
     }
     case JS_DATA_VIEW_TYPE:
       return CheckForName(name, isolate->factory()->byte_length_string(),

src/bootstrapper.cc

@@ -1605,6 +1605,17 @@ void Genesis::InitializeGlobal(Handle<JSGlobalObject> global_object,
   }
 
   {  // -- T y p e d A r r a y s
+    // Create the %TypedArrayPrototype%
+    Handle<JSObject> typed_array_prototype =
+        factory->NewJSObject(isolate->object_function(), TENURED);
+    native_context()->set_typed_array_prototype(*typed_array_prototype);
+
+    Handle<JSFunction> typed_array_fun = CreateFunction(
+        isolate, factory->InternalizeUtf8String("TypedArray"), JS_OBJECT_TYPE,
+        JSObject::kHeaderSize, typed_array_prototype, Builtins::kIllegal);
+    InstallWithIntrinsicDefaultProto(isolate, typed_array_fun,
+                                     Context::TYPED_ARRAY_FUN_INDEX);
+
 #define INSTALL_TYPED_ARRAY(Type, type, TYPE, ctype, size)             \
   {                                                                    \
     Handle<JSFunction> fun;                                            \
@@ -1927,9 +1938,17 @@ void Genesis::InitializeGlobal(Handle<JSGlobalObject> global_object,
 void Genesis::InstallTypedArray(const char* name, ElementsKind elements_kind,
                                 Handle<JSFunction>* fun) {
   Handle<JSObject> global = Handle<JSObject>(native_context()->global_object());
-  Handle<JSFunction> result = InstallFunction(
-      global, name, JS_TYPED_ARRAY_TYPE, JSTypedArray::kSize,
-      isolate()->initial_object_prototype(), Builtins::kIllegal);
+
+  Handle<JSObject> typed_array_prototype =
+      Handle<JSObject>(isolate()->typed_array_prototype());
+  Handle<JSFunction> typed_array_function =
+      Handle<JSFunction>(isolate()->typed_array_function());
+
+  Handle<JSObject> prototype =
+      factory()->NewJSObject(isolate()->object_function(), TENURED);
+  Handle<JSFunction> result =
+      InstallFunction(global, name, JS_TYPED_ARRAY_TYPE, JSTypedArray::kSize,
+                      prototype, Builtins::kIllegal);
 
   Handle<Map> initial_map = isolate()->factory()->NewMap(
       JS_TYPED_ARRAY_TYPE,
@@ -1937,6 +1956,15 @@ void Genesis::InstallTypedArray(const char* name, ElementsKind elements_kind,
       elements_kind);
   JSFunction::SetInitialMap(result, initial_map,
                             handle(initial_map->prototype(), isolate()));
+
+  CHECK(JSObject::SetPrototype(result, typed_array_function, false,
+                               Object::DONT_THROW)
+            .FromJust());
+
+  CHECK(JSObject::SetPrototype(prototype, typed_array_prototype, false,
+                               Object::DONT_THROW)
+            .FromJust());
+
   *fun = result;
 }
 

src/contexts.h

@@ -244,6 +244,8 @@ enum BindingFlags {
   V(STRING_FUNCTION_INDEX, JSFunction, string_function)                        \
   V(STRING_FUNCTION_PROTOTYPE_MAP_INDEX, Map, string_function_prototype_map)   \
   V(SYMBOL_FUNCTION_INDEX, JSFunction, symbol_function)                        \
+  V(TYPED_ARRAY_FUN_INDEX, JSFunction, typed_array_function)                   \
+  V(TYPED_ARRAY_PROTOTYPE_INDEX, JSObject, typed_array_prototype)              \
   V(UINT16_ARRAY_FUN_INDEX, JSFunction, uint16_array_fun)                      \
   V(UINT16X8_FUNCTION_INDEX, JSFunction, uint16x8_function)                    \
   V(UINT32_ARRAY_FUN_INDEX, JSFunction, uint32_array_fun)                      \

src/js/array-iterator.js

@@ -22,7 +22,7 @@ var IteratorPrototype = utils.ImportNow("IteratorPrototype");
 var iteratorSymbol = utils.ImportNow("iterator_symbol");
 var MakeTypeError;
 var toStringTagSymbol = utils.ImportNow("to_string_tag_symbol");
-var GlobalTypedArray = global.Uint8Array.__proto__;
+var GlobalTypedArray = %object_get_prototype_of(global.Uint8Array);
 
 utils.Import(function(from) {
   MakeTypeError = from.MakeTypeError;

src/js/typedarray.js

@@ -68,6 +68,8 @@ endmacro
 
 TYPED_ARRAYS(DECLARE_GLOBALS)
 
+var TypedArray = %object_get_prototype_of(GlobalUint8Array);
+
 utils.Import(function(from) {
   ArrayValues = from.ArrayValues;
   GetIterator = from.GetIterator;
@@ -808,7 +810,7 @@ function TypedArrayFrom(source, mapfn, thisArg) {
 }
 %FunctionSetLength(TypedArrayFrom, 1);
 
-function TypedArray() {
+function TypedArrayConstructor() {
   if (IS_UNDEFINED(new.target)) {
     throw MakeTypeError(kConstructorNonCallable, "TypedArray");
   }
@@ -819,9 +821,10 @@ function TypedArray() {
 
 // -------------------------------------------------------------------
 
-%FunctionSetPrototype(TypedArray, new GlobalObject());
+%SetCode(TypedArray, TypedArrayConstructor);
 %AddNamedProperty(TypedArray.prototype,
                   "constructor", TypedArray, DONT_ENUM);
+
 utils.InstallFunctions(TypedArray, DONT_ENUM, [
   "from", TypedArrayFrom,
   "of", TypedArrayOf

test/cctest/interpreter/bytecode_expectations/CallRuntime.golden

@@ -83,7 +83,7 @@ bytecodes: [
   B(Star), R(0),
   B(CreateArrayLiteral), U8(0), U8(0), U8(3),
   B(Star), R(1),
-  B(CallJSRuntime), U8(118), R(0), U8(2),
+  B(CallJSRuntime), U8(120), R(0), U8(2),
   B(Return),
 ]
 constant pool: [