Skip to content

Commit acb6779

Browse files
indutnybnoordhuis
authored andcommitted
deps: cherry-pick 6da51b4 from v8's upstream
Original commit message: TypedArray accessor detection: consider entire prototype chain When looking up a special accessor for known TypedArray fields ("length", "byteLength", "byteOffset"), consider the entire prototype chain, not only the direct prototype. This allows subclasses of TypedArrays to benefit from fast specialized accesses. Review URL: https://codereview.chromium.org/1313493005 Cr-Commit-Position: refs/heads/master@{#30678} Benchmark results: buffers/buffer-iterate.js size=16386 type=slow method=for n=1000: ./node: 71607 node: 8702.3 ............ 722.85% Improvement depends on the code, but generally brings us back to the performance that we had before the v8 update (if not making it faster). Fixes: #2463 PR-URL: #2801 Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl> Reviewed-By: Trevor Norris <trev.norris@gmail.com>
1 parent a6d674d commit acb6779

File tree

2 files changed

+65
-13
lines changed

2 files changed

+65
-13
lines changed

deps/v8/src/accessors.cc

+28-13
Original file line numberDiff line numberDiff line change
@@ -100,22 +100,37 @@ bool Accessors::IsJSArrayBufferViewFieldAccessor(Handle<Map> map,
100100
Isolate* isolate = name->GetIsolate();
101101

102102
switch (map->instance_type()) {
103-
case JS_TYPED_ARRAY_TYPE:
104-
// %TypedArray%.prototype is non-configurable, and so are the following
105-
// named properties on %TypedArray%.prototype, so we can directly inline
106-
// the field-load for typed array maps that still use their
107-
// %TypedArray%.prototype.
108-
if (JSFunction::cast(map->GetConstructor())->prototype() !=
109-
map->prototype()) {
103+
case JS_TYPED_ARRAY_TYPE: {
104+
if (!CheckForName(name, isolate->factory()->length_string(),
105+
JSTypedArray::kLengthOffset, object_offset) &&
106+
!CheckForName(name, isolate->factory()->byte_length_string(),
107+
JSTypedArray::kByteLengthOffset, object_offset) &&
108+
!CheckForName(name, isolate->factory()->byte_offset_string(),
109+
JSTypedArray::kByteOffsetOffset, object_offset)) {
110110
return false;
111111
}
112-
return CheckForName(name, isolate->factory()->length_string(),
113-
JSTypedArray::kLengthOffset, object_offset) ||
114-
CheckForName(name, isolate->factory()->byte_length_string(),
115-
JSTypedArray::kByteLengthOffset, object_offset) ||
116-
CheckForName(name, isolate->factory()->byte_offset_string(),
117-
JSTypedArray::kByteOffsetOffset, object_offset);
118112

113+
if (map->is_dictionary_map()) return false;
114+
115+
// Check if the property is overridden on the instance.
116+
DescriptorArray* descriptors = map->instance_descriptors();
117+
int descriptor = descriptors->SearchWithCache(*name, *map);
118+
if (descriptor != DescriptorArray::kNotFound) return false;
119+
120+
Handle<Object> proto = Handle<Object>(map->prototype(), isolate);
121+
if (!proto->IsJSReceiver()) return false;
122+
123+
// Check if the property is defined in the prototype chain.
124+
LookupIterator it(proto, name);
125+
if (!it.IsFound()) return false;
126+
127+
Object* original_proto =
128+
JSFunction::cast(map->GetConstructor())->prototype();
129+
130+
// Property is not configurable. It is enough to verify that
131+
// the holder is the same.
132+
return *it.GetHolder<Object>() == original_proto;
133+
}
119134
case JS_DATA_VIEW_TYPE:
120135
return CheckForName(name, isolate->factory()->byte_length_string(),
121136
JSDataView::kByteLengthOffset, object_offset) ||

deps/v8/test/mjsunit/regress/regress-typedarray-length.js

+37
Original file line numberDiff line numberDiff line change
@@ -71,6 +71,43 @@ assertEquals(undefined, get(a));
7171
assertEquals(undefined, get(a));
7272
})();
7373

74+
(function() {
75+
"use strict";
76+
77+
class MyTypedArray extends Int32Array {
78+
constructor(length) {
79+
super(length);
80+
}
81+
}
82+
83+
a = new MyTypedArray(1024);
84+
85+
get = function(a) {
86+
return a.length;
87+
}
88+
89+
assertEquals(1024, get(a));
90+
assertEquals(1024, get(a));
91+
assertEquals(1024, get(a));
92+
%OptimizeFunctionOnNextCall(get);
93+
assertEquals(1024, get(a));
94+
})();
95+
96+
(function() {
97+
"use strict";
98+
var a = new Uint8Array(4);
99+
Object.defineProperty(a, "length", {get: function() { return "blah"; }});
100+
get = function(a) {
101+
return a.length;
102+
}
103+
104+
assertEquals("blah", get(a));
105+
assertEquals("blah", get(a));
106+
assertEquals("blah", get(a));
107+
%OptimizeFunctionOnNextCall(get);
108+
assertEquals("blah", get(a));
109+
})();
110+
74111
// Ensure we cannot delete length, byteOffset, byteLength.
75112
assertTrue(Int32Array.prototype.hasOwnProperty("length"));
76113
assertTrue(Int32Array.prototype.hasOwnProperty("byteOffset"));

0 commit comments

Comments
 (0)