Commit 51d38345 authored by Sathya Gunasekaran's avatar Sathya Gunasekaran Committed by Commit Bot

[bootstrapper] Ensure Map/Set constructor has fast properties.

Currently x instanceof Map/Set checks cannot take the fast path, since
the Map/Set constructor has dictionary properties. To avoid that, just
forcibly migrate the Map/Set constructor to fast properties again once
it's fully setup in the bootstrapper.

Bug: v8:5717, v8:5902
Change-Id: I23dfd00456c9206a0ca5af71dfbc9236982936fc
Reviewed-on: https://chromium-review.googlesource.com/520578
Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org>
Reviewed-by: 's avatarJakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45663}
parent 3e3dbdf3
......@@ -4881,10 +4881,22 @@ bool Genesis::ConfigureGlobalObjects(
native_context()->set_array_buffer_map(
native_context()->array_buffer_fun()->initial_map());
native_context()->set_js_map_map(
native_context()->js_map_fun()->initial_map());
native_context()->set_js_set_map(
native_context()->js_set_fun()->initial_map());
Handle<JSFunction> js_map_fun(native_context()->js_map_fun());
Handle<JSFunction> js_set_fun(native_context()->js_set_fun());
// Force the Map/Set constructor to fast properties, so that we can use the
// fast paths for various things like
//
// x instanceof Map
// x instanceof Set
//
// etc. We should probably come up with a more principled approach once
// the JavaScript builtins are gone.
JSObject::MigrateSlowToFast(js_map_fun, 0, "Bootstrapping");
JSObject::MigrateSlowToFast(js_set_fun, 0, "Bootstrapping");
native_context()->set_js_map_map(js_map_fun->initial_map());
native_context()->set_js_set_map(js_set_fun->initial_map());
return true;
}
......
......@@ -57,7 +57,6 @@ assertEquals(
[
'Error.prototype',
'EvalError.prototype', 'RangeError.prototype', 'ReferenceError.prototype',
'SyntaxError.prototype', 'TypeError.prototype', 'URIError.prototype',
'Map', 'Map.prototype.constructor', 'Set', 'Set.prototype.constructor'
'SyntaxError.prototype', 'TypeError.prototype', 'URIError.prototype'
],
log);
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment