Use function wrapper argument to expose internal arrays to native scripts.

R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/1127983003

Cr-Commit-Position: refs/heads/master@{#28354}

src/array.js

@@ -19,7 +19,12 @@ var $innerArrayEvery;
 
 %CheckIsBootstrapping();
 
+// -------------------------------------------------------------------
+// Imports
+
 var GlobalArray = global.Array;
+var InternalArray = exports.InternalArray;
+var InternalPackedArray = exports.InternalPackedArray;
 
 // -------------------------------------------------------------------
 

src/contexts.h

@@ -185,7 +185,8 @@ enum BindingFlags {
   V(MAP_ITERATOR_MAP_INDEX, Map, map_iterator_map)                             \
   V(SET_ITERATOR_MAP_INDEX, Map, set_iterator_map)                             \
   V(ARRAY_VALUES_ITERATOR_INDEX, JSFunction, array_values_iterator)            \
-  V(SCRIPT_CONTEXT_TABLE_INDEX, ScriptContextTable, script_context_table)
+  V(SCRIPT_CONTEXT_TABLE_INDEX, ScriptContextTable, script_context_table)      \
+  V(BUILTIN_EXPORTS_OBJECT_INDEX, Object, builtin_exports_object)
 
 
 // A table of all script contexts. Every loaded top-level script with top-level
@@ -422,6 +423,7 @@ class Context: public FixedArray {
     SCRIPT_CONTEXT_TABLE_INDEX,
     MAP_CACHE_INDEX,
     TO_LENGTH_FUN_INDEX,
+    BUILTIN_EXPORTS_OBJECT_INDEX,
 
     // Properties from here are treated as weak references by the full GC.
     // Scavenge treats them as strong references.

src/date.js

@@ -16,7 +16,13 @@ var $createDate;
 
 %CheckIsBootstrapping();
 
+// -------------------------------------------------------------------
+// Imports
+
 var GlobalDate = global.Date;
+var InternalArray = shared.InternalArray;
+
+// -------------------------------------------------------------------
 
 // This file contains date support implemented in JavaScript.
 

src/harmony-array-includes.js

@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-(function(global, shared, exports) {
+(function(global, exports) {
 
 'use strict';
 

src/harmony-array.js

@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-(function(global, shared, exports) {
+(function(global, exports) {
 
 'use strict';
 

src/harmony-object.js

@@ -3,7 +3,7 @@
 // found in the LICENSE file.
 //
 
-(function(global, shared, exports) {
+(function(global, exports) {
 
 "use strict";
 

src/harmony-reflect.js

@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-(function(global, shared, exports) {
+(function(global, exports) {
 
 'use strict';
 

src/harmony-regexp.js

@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-(function(global, shared, exports) {
+(function(global, exports) {
 
 'use strict';
 

src/harmony-spread.js

@@ -5,10 +5,16 @@
 var $spreadArguments;
 var $spreadIterable;
 
-(function(global, shared, exports) {
+(function(global, exports) {
 
 'use strict';
 
+// -------------------------------------------------------------------
+// Imports
+var InternalArray = exports.InternalArray;
+
+// -------------------------------------------------------------------
+
 function SpreadArguments() {
   var count = %_ArgumentsLength();
   var args = new InternalArray();

src/harmony-tostring.js

@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-(function(global, shared, exports) {
+(function(global, exports) {
 
 "use strict";
 

src/harmony-typedarray.js

@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-(function(global, shared, exports) {
+(function(global, exports) {
 
 "use strict";
 

src/json.js

@@ -10,7 +10,11 @@ var $jsonSerializeAdapter;
 
 %CheckIsBootstrapping();
 
+// -------------------------------------------------------------------
+// Imports
+
 var GlobalJSON = global.JSON;
+var InternalArray = shared.InternalArray;
 
 // -------------------------------------------------------------------
 

src/math.js

@@ -16,7 +16,11 @@ var $min;
 
 %CheckIsBootstrapping();
 
+// -------------------------------------------------------------------
+// Imports
+
 var GlobalObject = global.Object;
+var InternalArray = shared.InternalArray;
 
 //-------------------------------------------------------------------
 

src/messages.js

@@ -35,7 +35,14 @@ var MakeTypeErrorEmbedded;
 
 %CheckIsBootstrapping();
 
+// -------------------------------------------------------------------
+// Imports
+
 var GlobalObject = global.Object;
+var InternalArray = shared.InternalArray;
+
+// -------------------------------------------------------------------
+
 var GlobalError;
 var GlobalTypeError;
 var GlobalRangeError;
@@ -44,8 +51,6 @@ var GlobalSyntaxError;
 var GlobalReferenceError;
 var GlobalEvalError;
 
-// -------------------------------------------------------------------
-
 var kMessages = {
   // Error
   constructor_is_generator:      ["Class constructor may not be a generator"],

src/object-observe.js

@@ -16,8 +16,12 @@ var $observeNativeObjectNotifierPerformChange;
 
 %CheckIsBootstrapping();
 
+// -------------------------------------------------------------------
+// Imports
+
 var GlobalArray = global.Array;
 var GlobalObject = global.Object;
+var InternalArray = shared.InternalArray;
 
 // -------------------------------------------------------------------
 

src/objects.h

@@ -1694,9 +1694,6 @@ class JSReceiver: public HeapObject {
 // Forward declaration for JSObject::GetOrCreateHiddenPropertiesHashTable.
 class ObjectHashTable;
 
-// Forward declaration for JSObject::Copy.
-class AllocationSite;
-
 
 // The JSObject describes real heap allocated JavaScript objects with
 // properties.
@@ -2157,7 +2154,6 @@ class JSObject: public JSReceiver {
   // Copy object.
   enum DeepCopyHints { kNoHints = 0, kObjectIsShallow = 1 };
 
-  static Handle<JSObject> Copy(Handle<JSObject> object);
   MUST_USE_RESULT static MaybeHandle<JSObject> DeepCopy(
       Handle<JSObject> object,
       AllocationSiteUsageContext* site_context,

src/promise.js

@@ -18,6 +18,11 @@ var $promiseValue;
 
 %CheckIsBootstrapping();
 
+// -------------------------------------------------------------------
+// Imports
+
+var InternalArray = shared.InternalArray;
+
 // -------------------------------------------------------------------
 
 // Status values: 0 = pending, +1 = resolved, -1 = rejected

src/regexp.js

@@ -13,7 +13,13 @@ var harmony_unicode_regexps = false;
 
 %CheckIsBootstrapping();
 
+// -------------------------------------------------------------------
+// Imports
+
 var GlobalRegExp = global.RegExp;
+var InternalPackedArray = shared.InternalPackedArray;
+
+// -------------------------------------------------------------------
 
 // Property of the builtins object for recording the result of the last
 // regexp match.  The property $regexpLastMatchInfo includes the matchIndices

src/string.js

@@ -10,8 +10,13 @@ var $stringSubstring;
 
 %CheckIsBootstrapping();
 
+// -------------------------------------------------------------------
+// Imports
+
 var GlobalRegExp = global.RegExp;
 var GlobalString = global.String;
+var InternalArray = shared.InternalArray;
+var InternalPackedArray = shared.InternalPackedArray;
 
 //-------------------------------------------------------------------
 

src/templates.js

@@ -12,9 +12,17 @@ var $getTemplateCallSite;
 
 %CheckIsBootstrapping();
 
-var callSiteCache = new global.Map;
-var mapGetFn = global.Map.prototype.get;
-var mapSetFn = global.Map.prototype.set;
+// -------------------------------------------------------------------
+// Imports
+
+var GlobalMap = global.Map;
+var InternalArray = shared.InternalArray;
+
+// -------------------------------------------------------------------
+
+var callSiteCache = new GlobalMap;
+var mapGetFn = GlobalMap.prototype.get;
+var mapSetFn = GlobalMap.prototype.set;
 
 
 function SameCallSiteElements(rawStrings, other) {

src/uri.js

@@ -11,8 +11,12 @@
 
 %CheckIsBootstrapping();
 
+//- ------------------------------------------------------------------
+// Imports
+
 var GlobalObject = global.Object;
 var GlobalArray = global.Array;
+var InternalArray = shared.InternalArray;
 
 // -------------------------------------------------------------------
 // Define internal helper functions.

src/v8natives.js

@@ -36,11 +36,15 @@ var $toNameArray;
 
 %CheckIsBootstrapping();
 
+// ----------------------------------------------------------------------------
+// Imports
+
 var GlobalArray = global.Array;
 var GlobalBoolean = global.Boolean;
 var GlobalFunction = global.Function;
 var GlobalNumber = global.Number;
 var GlobalObject = global.Object;
+var InternalArray = shared.InternalArray;
 
 // ----------------------------------------------------------------------------
 

test/cctest/test-heap.cc

@@ -5430,3 +5430,56 @@ TEST(PreprocessStackTrace) {
     CHECK(!element->IsCode());
   }
 }
+
+
+static bool shared_has_been_collected = false;
+static bool builtin_exports_has_been_collected = false;
+
+static void SharedHasBeenCollected(
+    const v8::WeakCallbackInfo<v8::Persistent<v8::Object>>& data) {
+  shared_has_been_collected = true;
+  data.GetParameter()->Reset();
+}
+
+
+static void BuiltinExportsHasBeenCollected(
+    const v8::WeakCallbackInfo<v8::Persistent<v8::Object>>& data) {
+  builtin_exports_has_been_collected = true;
+  data.GetParameter()->Reset();
+}
+
+
+TEST(BootstrappingExports) {
+  FLAG_expose_natives_as = "natives";
+  CcTest::InitializeVM();
+  v8::Isolate* isolate = CcTest::isolate();
+
+  if (Snapshot::HaveASnapshotToStartFrom(CcTest::i_isolate())) return;
+
+  shared_has_been_collected = false;
+  builtin_exports_has_been_collected = false;
+
+  v8::Persistent<v8::Object> shared;
+  v8::Persistent<v8::Object> builtin_exports;
+
+  {
+    v8::HandleScope scope(isolate);
+    v8::Handle<v8::Object> natives =
+        CcTest::global()->Get(v8_str("natives"))->ToObject(isolate);
+    shared.Reset(isolate, natives->Get(v8_str("shared"))->ToObject(isolate));
+    natives->Delete(v8_str("shared"));
+    builtin_exports.Reset(
+        isolate, natives->Get(v8_str("builtin_exports"))->ToObject(isolate));
+    natives->Delete(v8_str("builtin_exports"));
+  }
+
+  shared.SetWeak(&shared, SharedHasBeenCollected,
+                 v8::WeakCallbackType::kParameter);
+  builtin_exports.SetWeak(&builtin_exports, BuiltinExportsHasBeenCollected,
+                          v8::WeakCallbackType::kParameter);
+
+  CcTest::heap()->CollectAllAvailableGarbage("fire weak callbacks");
+
+  CHECK(shared_has_been_collected);
+  CHECK(builtin_exports_has_been_collected);
+}

test/mjsunit/regress/regress-1878.js

@@ -32,13 +32,13 @@
 var a = Array();
 
 for (var i = 0; i < 1000; i++) {
-  var ai = natives.InternalArray(10000);
+  var ai = natives.shared.InternalArray(10000);
   assertFalse(%HaveSameMap(ai, a));
   assertTrue(%HasFastObjectElements(ai));
 }
 
 for (var i = 0; i < 1000; i++) {
-  var ai = new natives.InternalArray(10000);
+  var ai = new natives.shared.InternalArray(10000);
   assertFalse(%HaveSameMap(ai, a));
   assertTrue(%HasFastObjectElements(ai));
 }