[extinction] Add builtin-subclassing flag and support in Array.{from,of}

Bug: v8:7367
Change-Id: I4240f6683945c0f60b30afe563f8f735563e4367
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2568230Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Hannes Payer <hpayer@chromium.org>
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71622}

src/builtins/array-from.tq

@@ -8,10 +8,12 @@ namespace array {
 transitioning javascript builtin
 ArrayFrom(js-implicit context: NativeContext, receiver: JSAny)(...arguments):
     JSReceiver {
+  const c = HasBuiltinSubclassingFlag() ? receiver : GetArrayFunction();
+
   // Use fast path if:
   // * |items| is the only argument, and
   // * the receiver is the Array function.
-  if (arguments.length == 1 && receiver == GetArrayFunction()) {
+  if (arguments.length == 1 && c == GetArrayFunction()) {
     try {
       return iterator::FastIterableToList(arguments[0]) otherwise Slow;
     } label Slow {
@@ -24,7 +26,7 @@ ArrayFrom(js-implicit context: NativeContext, receiver: JSAny)(...arguments):
   const thisArg = arguments[2];
 
   // 1. Let C be the this value.
-  const c = receiver;
+  // (Done above.)
 
   let mapping: bool;
   // 2. If mapfn is undefined, let mapping be false.

src/builtins/array-of.tq

@@ -14,7 +14,7 @@ ArrayOf(
   const items: Arguments = arguments;
 
   // 3. Let C be the this value.
-  const c: JSAny = receiver;
+  const c: JSAny = HasBuiltinSubclassingFlag() ? receiver : GetArrayFunction();
 
   let a: JSReceiver;
 

src/builtins/base.tq

@@ -1070,6 +1070,7 @@ extern macro IsArraySpeciesProtectorCellInvalid(): bool;
 extern macro IsTypedArraySpeciesProtectorCellInvalid(): bool;
 extern macro IsPromiseSpeciesProtectorCellInvalid(): bool;
 extern macro IsMockArrayBufferAllocatorFlag(): bool;
+extern macro HasBuiltinSubclassingFlag(): bool;
 extern macro IsPrototypeTypedArrayPrototype(implicit context: Context)(Map):
     bool;
 

src/codegen/code-stub-assembler.h

@@ -2455,15 +2455,23 @@ class V8_EXPORT_PRIVATE CodeStubAssembler
   TNode<BoolT> IsRegExpSpeciesProtectorCellInvalid();
   TNode<BoolT> IsPromiseSpeciesProtectorCellInvalid();
 
-  TNode<BoolT> IsMockArrayBufferAllocatorFlag() {
-    TNode<Word32T> flag_value = UncheckedCast<Word32T>(Load(
-        MachineType::Uint8(),
-        ExternalConstant(
-            ExternalReference::address_of_mock_arraybuffer_allocator_flag())));
+  TNode<BoolT> LoadRuntimeFlag(ExternalReference address_of_flag) {
+    TNode<Word32T> flag_value = UncheckedCast<Word32T>(
+        Load(MachineType::Uint8(), ExternalConstant(address_of_flag)));
     return Word32NotEqual(Word32And(flag_value, Int32Constant(0xFF)),
                           Int32Constant(0));
   }
 
+  TNode<BoolT> IsMockArrayBufferAllocatorFlag() {
+    return LoadRuntimeFlag(
+        ExternalReference::address_of_mock_arraybuffer_allocator_flag());
+  }
+
+  TNode<BoolT> HasBuiltinSubclassingFlag() {
+    return LoadRuntimeFlag(
+        ExternalReference::address_of_builtin_subclassing_flag());
+  }
+
   // True iff |object| is a Smi or a HeapNumber or a BigInt.
   TNode<BoolT> IsNumeric(SloppyTNode<Object> object);
 

src/codegen/external-reference.cc

@@ -428,6 +428,10 @@ ExternalReference::address_of_mock_arraybuffer_allocator_flag() {
   return ExternalReference(&FLAG_mock_arraybuffer_allocator);
 }
 
+ExternalReference ExternalReference::address_of_builtin_subclassing_flag() {
+  return ExternalReference(&FLAG_builtin_subclassing);
+}
+
 ExternalReference ExternalReference::address_of_runtime_stats_flag() {
   return ExternalReference(&TracingFlags::runtime_stats);
 }

src/codegen/external-reference.h

@@ -108,6 +108,7 @@ class StatsCounter;
   V(address_of_min_int, "LDoubleConstant::min_int")                            \
   V(address_of_mock_arraybuffer_allocator_flag,                                \
     "FLAG_mock_arraybuffer_allocator")                                         \
+  V(address_of_builtin_subclassing_flag, "FLAG_builtin_subclassing")           \
   V(address_of_one_half, "LDoubleConstant::one_half")                          \
   V(address_of_runtime_stats_flag, "TracingFlags::runtime_stats")              \
   V(address_of_the_hole_nan, "the_hole_nan")                                   \

src/flags/flag-definitions.h

@@ -316,6 +316,9 @@ HARMONY_STAGED(FLAG_STAGED_FEATURES)
 HARMONY_SHIPPING(FLAG_SHIPPING_FEATURES)
 #undef FLAG_SHIPPING_FEATURES
 
+DEFINE_BOOL(builtin_subclassing, true,
+            "subclassing support in built-in methods")
+
 #ifdef V8_INTL_SUPPORT
 DEFINE_BOOL(icu_timezone_data, true, "get information about timezones from ICU")
 #endif

src/objects/objects.cc

@@ -1705,6 +1705,7 @@ bool Object::SameValueZero(Object other) {
 MaybeHandle<Object> Object::ArraySpeciesConstructor(
     Isolate* isolate, Handle<Object> original_array) {
   Handle<Object> default_species = isolate->array_function();
+  if (!FLAG_builtin_subclassing) return default_species;
   if (original_array->IsJSArray() &&
       Handle<JSArray>::cast(original_array)->HasArrayPrototype(isolate) &&
       Protectors::IsArraySpeciesLookupChainIntact(isolate)) {

test/mjsunit/extinction/array.js

+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --no-builtin-subclassing
+
+class SubArray extends Array { }
+
+// Constructor methods
+assertInstanceof(SubArray.from([1,2,3]), Array);
+assertEquals(SubArray.from([1,2,3]).constructor, Array);
+
+assertInstanceof(SubArray.of([1,2,3]), Array);
+assertEquals(SubArray.of([1,2,3]).constructor, Array);