Revert "Make Object.freeze fast"

and "Fix Object.freeze on dictionary-backed arrays to properly freeze elements"

This reverts r14758 and r14759 due to introducing failures in Test262

TBR=verwaest@chromium.org

Review URL: https://codereview.chromium.org/15681004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14760 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

include/v8.h

@@ -5231,7 +5231,7 @@ class Internals {
   static const int kNullValueRootIndex = 7;
   static const int kTrueValueRootIndex = 8;
   static const int kFalseValueRootIndex = 9;
-  static const int kEmptyStringRootIndex = 129;
+  static const int kEmptyStringRootIndex = 127;
 
   static const int kNodeClassIdOffset = 1 * kApiPointerSize;
   static const int kNodeFlagsOffset = 1 * kApiPointerSize + 3;

src/heap.cc

@@ -2964,17 +2964,6 @@ bool Heap::CreateInitialObjects() {
   }
   set_observation_state(JSObject::cast(obj));
 
-  { MaybeObject* maybe_obj = AllocateSymbol();
-    if (!maybe_obj->ToObject(&obj)) return false;
-  }
-  set_frozen_symbol(Symbol::cast(obj));
-
-  { MaybeObject* maybe_obj = SeededNumberDictionary::Allocate(this, 0, TENURED);
-    if (!maybe_obj->ToObject(&obj)) return false;
-  }
-  SeededNumberDictionary::cast(obj)->set_requires_slow_elements();
-  set_empty_slow_element_dictionary(SeededNumberDictionary::cast(obj));
-
   // Handling of script id generation is in FACTORY->NewScript.
   set_last_script_id(undefined_value());
 

src/heap.h

@@ -181,10 +181,7 @@ namespace internal {
   V(Smi, getter_stub_deopt_pc_offset, GetterStubDeoptPCOffset)                 \
   V(Smi, setter_stub_deopt_pc_offset, SetterStubDeoptPCOffset)                 \
   V(JSObject, observation_state, ObservationState)                             \
-  V(Map, external_map, ExternalMap)                                            \
-  V(Symbol, frozen_symbol, FrozenSymbol)                                       \
-  V(SeededNumberDictionary, empty_slow_element_dictionary,                     \
-      EmptySlowElementDictionary)
+  V(Map, external_map, ExternalMap)
 
 #define ROOT_LIST(V)                                  \
   STRONG_ROOT_LIST(V)                                 \

src/objects-inl.h

@@ -3592,16 +3592,6 @@ bool Map::is_deprecated() {
 }
 
 
-void Map::freeze() {
-  set_bit_field3(IsFrozen::update(bit_field3(), true));
-}
-
-
-bool Map::is_frozen() {
-  return IsFrozen::decode(bit_field3());
-}
-
-
 bool Map::CanBeDeprecated() {
   int descriptor = LastAdded();
   for (int i = 0; i <= descriptor; i++) {

src/objects.h

@@ -2297,9 +2297,6 @@ class JSObject: public JSReceiver {
   static Handle<Object> PreventExtensions(Handle<JSObject> object);
   MUST_USE_RESULT MaybeObject* PreventExtensions();
 
-  // ES5 Object.freeze
-  MUST_USE_RESULT MaybeObject* Freeze(Isolate* isolate);
-
   // Copy object
   MUST_USE_RESULT MaybeObject* DeepCopy(Isolate* isolate);
 
@@ -2837,13 +2834,7 @@ class DescriptorArray: public FixedArray {
                          int new_size,
                          DescriptorArray* other);
 
-  MUST_USE_RESULT MaybeObject* CopyUpTo(int enumeration_index) {
-    return CopyUpToAddAttributes(enumeration_index, NONE);
-  }
-
-  MUST_USE_RESULT MaybeObject* CopyUpToAddAttributes(
-      int enumeration_index,
-      PropertyAttributes attributes);
+  MUST_USE_RESULT MaybeObject* CopyUpTo(int enumeration_index);
 
   // Sort the instance descriptors by the hash codes of their keys.
   void Sort();
@@ -3378,10 +3369,8 @@ class Dictionary: public HashTable<Shape, Key> {
   }
 
   // Returns a new array for dictionary usage. Might return Failure.
-  MUST_USE_RESULT static MaybeObject* Allocate(
-      Heap* heap,
-      int at_least_space_for,
-      PretenureFlag pretenure = NOT_TENURED);
+  MUST_USE_RESULT static MaybeObject* Allocate(Heap* heap,
+                                               int at_least_space_for);
 
   // Ensure enough space for n additional elements.
   MUST_USE_RESULT MaybeObject* EnsureCapacity(int n, Key key);
@@ -5082,7 +5071,6 @@ class Map: public HeapObject {
   class OwnsDescriptors:            public BitField<bool, 25,  1> {};
   class IsObserved:                 public BitField<bool, 26,  1> {};
   class Deprecated:                 public BitField<bool, 27,  1> {};
-  class IsFrozen:                   public BitField<bool, 28,  1> {};
 
   // Tells whether the object in the prototype property will be used
   // for instances created from this function.  If the prototype
@@ -5385,8 +5373,6 @@ class Map: public HeapObject {
   inline void set_owns_descriptors(bool is_shared);
   inline bool is_observed();
   inline void set_is_observed(bool is_observed);
-  inline void freeze();
-  inline bool is_frozen();
   inline void deprecate();
   inline bool is_deprecated();
   inline bool CanBeDeprecated();
@@ -5401,9 +5387,9 @@ class Map: public HeapObject {
   MUST_USE_RESULT MaybeObject* CopyDropDescriptors();
   MUST_USE_RESULT MaybeObject* CopyReplaceDescriptors(
       DescriptorArray* descriptors,
+      Name* name,
       TransitionFlag flag,
-      Name* name = NULL,
-      SimpleTransitionFlag simple_flag = FULL_TRANSITION);
+      int descriptor_index);
   MUST_USE_RESULT MaybeObject* CopyInstallDescriptors(
       int new_descriptor,
       DescriptorArray* descriptors);

src/property-details.h

@@ -39,7 +39,7 @@ enum PropertyAttributes {
   DONT_ENUM         = v8::DontEnum,
   DONT_DELETE       = v8::DontDelete,
 
-  SEALED            = DONT_DELETE,
+  SEALED            = DONT_ENUM | DONT_DELETE,
   FROZEN            = SEALED | READ_ONLY,
 
   SYMBOLIC          = 8,  // Used to filter symbol names
@@ -180,11 +180,6 @@ class PropertyDetails BASE_EMBEDDED {
   PropertyDetails CopyWithRepresentation(Representation representation) {
     return PropertyDetails(value_, representation);
   }
-  PropertyDetails CopyAddAttributes(PropertyAttributes new_attributes) {
-    new_attributes =
-        static_cast<PropertyAttributes>(attributes() | new_attributes);
-    return PropertyDetails(value_, new_attributes);
-  }
 
   // Conversion for storing details as Object*.
   explicit inline PropertyDetails(Smi* smi);
@@ -242,9 +237,6 @@ class PropertyDetails BASE_EMBEDDED {
     value_ = RepresentationField::update(
         value, EncodeRepresentation(representation));
   }
-  PropertyDetails(int value, PropertyAttributes attributes) {
-    value_ = AttributesField::update(value, attributes);
-  }
 
   uint32_t value_;
 };

src/runtime.cc

@@ -2692,14 +2692,6 @@ RUNTIME_FUNCTION(MaybeObject*, Runtime_ThrowGeneratorStateError) {
 }
 
 
-RUNTIME_FUNCTION(MaybeObject*, Runtime_ObjectFreeze) {
-  NoHandleAllocation ha(isolate);
-  ASSERT(args.length() == 1);
-  CONVERT_ARG_CHECKED(JSObject, object, 0);
-  return object->Freeze(isolate);
-}
-
-
 MUST_USE_RESULT static MaybeObject* CharFromCode(Isolate* isolate,
                                                  Object* char_code) {
   if (char_code->IsNumber()) {
@@ -13313,7 +13305,6 @@ ELEMENTS_KIND_CHECK_RUNTIME_FUNCTION(FastSmiOrObjectElements)
 ELEMENTS_KIND_CHECK_RUNTIME_FUNCTION(FastDoubleElements)
 ELEMENTS_KIND_CHECK_RUNTIME_FUNCTION(FastHoleyElements)
 ELEMENTS_KIND_CHECK_RUNTIME_FUNCTION(DictionaryElements)
-ELEMENTS_KIND_CHECK_RUNTIME_FUNCTION(NonStrictArgumentsElements)
 ELEMENTS_KIND_CHECK_RUNTIME_FUNCTION(ExternalPixelElements)
 ELEMENTS_KIND_CHECK_RUNTIME_FUNCTION(ExternalArrayElements)
 ELEMENTS_KIND_CHECK_RUNTIME_FUNCTION(ExternalByteElements)

src/runtime.h

@@ -303,9 +303,6 @@ namespace internal {
   F(ResumeJSGeneratorObject, 3, 1) \
   F(ThrowGeneratorStateError, 1, 1) \
   \
-  /* ES5 */ \
-  F(ObjectFreeze, 1, 1) \
-  \
   /* Harmony modules */ \
   F(IsJSModule, 1, 1) \
   \
@@ -426,7 +423,6 @@ namespace internal {
   F(HasFastDoubleElements, 1, 1) \
   F(HasFastHoleyElements, 1, 1) \
   F(HasDictionaryElements, 1, 1) \
-  F(HasNonStrictArgumentsElements, 1, 1) \
   F(HasExternalPixelElements, 1, 1) \
   F(HasExternalArrayElements, 1, 1) \
   F(HasExternalByteElements, 1, 1) \

src/v8natives.js

@@ -1225,27 +1225,20 @@ function ObjectFreeze(obj) {
   if (!IS_SPEC_OBJECT(obj)) {
     throw MakeTypeError("called_on_non_object", ["Object.freeze"]);
   }
-  var isProxy = %IsJSProxy(obj);
-  if (isProxy || %HasNonStrictArgumentsElements(obj)) {
-    if (isProxy) {
-      ProxyFix(obj);
-    }
-    var names = ObjectGetOwnPropertyNames(obj);
-    for (var i = 0; i < names.length; i++) {
-      var name = names[i];
-      var desc = GetOwnProperty(obj, name);
-      if (desc.isWritable() || desc.isConfigurable()) {
-        if (IsDataDescriptor(desc)) desc.setWritable(false);
-        desc.setConfigurable(false);
-        DefineOwnProperty(obj, name, desc, true);
-      }
+  if (%IsJSProxy(obj)) {
+    ProxyFix(obj);
+  }
+  var names = ObjectGetOwnPropertyNames(obj);
+  for (var i = 0; i < names.length; i++) {
+    var name = names[i];
+    var desc = GetOwnProperty(obj, name);
+    if (desc.isWritable() || desc.isConfigurable()) {
+      if (IsDataDescriptor(desc)) desc.setWritable(false);
+      desc.setConfigurable(false);
+      DefineOwnProperty(obj, name, desc, true);
     }
-    %PreventExtensions(obj);
-  } else {
-    // TODO(adamk): Is it worth going to this fast path if the
-    // object's properties are already in dictionary mode?
-    %ObjectFreeze(obj);
   }
+  %PreventExtensions(obj);
   return obj;
 }
 

test/mjsunit/object-freeze.js

@@ -28,7 +28,6 @@
 // Tests the Object.freeze and Object.isFrozen methods - ES 15.2.3.9 and
 // ES 15.2.3.12
 
-// Flags: --allow-natives-syntax
 
 // Test that we throw an error if an object is not passed as argument.
 var non_objects = new Array(undefined, null, 1, -1, 0, 42.43);
@@ -192,70 +191,3 @@ assertFalse(Object.isFrozen(obj5));
 // Make sure that Object.freeze returns the frozen object.
 var obj6 = {}
 assertTrue(obj6 === Object.freeze(obj6))
-
-// Test that the enumerable attribute is unperturbed by freezing.
-obj = { x: 42, y: 'foo' };
-Object.defineProperty(obj, 'y', {enumerable: false});
-Object.freeze(obj);
-desc = Object.getOwnPropertyDescriptor(obj, 'x');
-assertTrue(desc.enumerable);
-desc = Object.getOwnPropertyDescriptor(obj, 'y');
-assertFalse(desc.enumerable);
-
-// Fast properties should remain fast
-obj = { x: 42, y: 'foo' };
-assertTrue(%HasFastProperties(obj));
-Object.freeze(obj);
-assertTrue(%HasFastProperties(obj));
-
-// Frozen objects should share maps where possible
-obj = { prop1: 1, prop2: 2 };
-obj2 = { prop1: 3, prop2: 4 };
-assertTrue(%HaveSameMap(obj, obj2));
-Object.freeze(obj);
-Object.freeze(obj2);
-assertTrue(%HaveSameMap(obj, obj2));
-
-// Frozen objects should share maps even when they have elements
-obj = { prop1: 1, prop2: 2, 75: 'foo' };
-obj2 = { prop1: 3, prop2: 4, 150: 'bar' };
-assertTrue(%HaveSameMap(obj, obj2));
-Object.freeze(obj);
-Object.freeze(obj2);
-assertTrue(%HaveSameMap(obj, obj2));
-
-// Setting elements after freezing should not be allowed
-obj = { prop: 'thing' };
-Object.freeze(obj);
-obj[0] = 'hello';
-assertFalse(obj.hasOwnProperty(0));
-
-// Freezing an object in dictionary mode should work
-obj = { };
-for (var i = 0; i < 100; ++i) {
-  obj['x' + i] = i;
-}
-assertFalse(%HasFastProperties(obj));
-Object.freeze(obj);
-assertFalse(%HasFastProperties(obj));
-assertTrue(Object.isFrozen(obj));
-assertFalse(Object.isExtensible(obj));
-for (var i = 0; i < 100; ++i) {
-  desc = Object.getOwnPropertyDescriptor(obj, 'x' + i);
-  assertFalse(desc.writable);
-  assertFalse(desc.configurable);
-}
-
-// Freezing arguments should work
-var func = function(arg) {
-  Object.freeze(arguments);
-  assertTrue(Object.isFrozen(arguments));
-};
-func('hello', 'world');
-func('goodbye', 'world');
-
-// Freezing sparse arrays
-var sparseArr = [0, 1];
-sparseArr[10000] = 10000;
-Object.freeze(sparseArr);
-assertTrue(Object.isFrozen(sparseArr));