deps: V8: backport e560815 from upstream · nodejs/node@2d3e735
@@ -795,14 +795,18 @@ namespace {
795795 */
796796class ArrayConcatVisitor {
797797public:
798-ArrayConcatVisitor(Isolate* isolate, Handle<Object> storage,
798+ArrayConcatVisitor(Isolate* isolate, Handle<HeapObject> storage,
799799bool fast_elements)
800800 : isolate_(isolate),
801801storage_(isolate->global_handles()->Create(*storage)),
802802 index_offset_(0u),
803- bit_field_(FastElementsField::encode(fast_elements) |
804- ExceedsLimitField::encode(false) |
805- IsFixedArrayField::encode(storage->IsFixedArray())) {
803+ bit_field_(
804+FastElementsField::encode(fast_elements) |
805+ ExceedsLimitField::encode(false) |
806+ IsFixedArrayField::encode(storage->IsFixedArray()) |
807+ HasSimpleElementsField::encode(storage->IsFixedArray() ||
808+ storage->map()->instance_type() >
809+ LAST_CUSTOM_ELEMENTS_RECEIVER)) {
806810DCHECK(!(this->fast_elements() && !is_fixed_array()));
807811 }
808812@@ -891,12 +895,16 @@ class ArrayConcatVisitor {
891895// (otherwise)
892896 Handle<FixedArray> storage_fixed_array() {
893897DCHECK(is_fixed_array());
898+DCHECK(has_simple_elements());
894899return Handle<FixedArray>::cast(storage_);
895900 }
896901 Handle<JSReceiver> storage_jsreceiver() {
897902DCHECK(!is_fixed_array());
898903return Handle<JSReceiver>::cast(storage_);
899904 }
905+bool has_simple_elements() const {
906+return HasSimpleElementsField::decode(bit_field_);
907+ }
900908901909private:
902910// Convert storage to dictionary mode.
@@ -929,12 +937,14 @@ class ArrayConcatVisitor {
929937930938inline void set_storage(FixedArray* storage) {
931939DCHECK(is_fixed_array());
940+DCHECK(has_simple_elements());
932941 storage_ = isolate_->global_handles()->Create(storage);
933942 }
934943935944class FastElementsField : public BitField<bool, 0, 1> {};
936945class ExceedsLimitField : public BitField<bool, 1, 1> {};
937946class IsFixedArrayField : public BitField<bool, 2, 1> {};
947+class HasSimpleElementsField : public BitField<bool, 3, 1> {};
938948939949bool fast_elements() const { return FastElementsField::decode(bit_field_); }
940950void set_fast_elements(bool fast) {
@@ -1166,8 +1176,6 @@ bool IterateElementsSlow(Isolate* isolate, Handle<JSReceiver> receiver,
11661176 visitor->increase_index_offset(length);
11671177return true;
11681178}
1169-1170-11711179/**
11721180 * A helper function that visits "array" elements of a JSReceiver in numerical
11731181 * order.
@@ -1201,7 +1209,8 @@ bool IterateElements(Isolate* isolate, Handle<JSReceiver> receiver,
12011209return IterateElementsSlow(isolate, receiver, length, visitor);
12021210 }
120312111204-if (!HasOnlySimpleElements(isolate, *receiver)) {
1212+if (!HasOnlySimpleElements(isolate, *receiver) ||
1213+ !visitor->has_simple_elements()) {
12051214return IterateElementsSlow(isolate, receiver, length, visitor);
12061215 }
12071216 Handle<JSObject> array = Handle<JSObject>::cast(receiver);
@@ -1476,7 +1485,7 @@ Object* Slow_ArrayConcat(Arguments* args, Handle<Object> species,
14761485// In case of failure, fall through.
14771486 }
147814871479- Handle<Object> storage;
1488+ Handle<HeapObject> storage;
14801489if (fast_case) {
14811490// The backing storage array must have non-existing elements to preserve
14821491// holes across concat operations.
@@ -1494,7 +1503,7 @@ Object* Slow_ArrayConcat(Arguments* args, Handle<Object> species,
14941503ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
14951504 isolate, storage_object,
14961505Execution::New(isolate, species, species, 1, &length));
1497- storage = storage_object;
1506+ storage = Handle<HeapObject>::cast(storage_object);
14981507 }
1499150815001509 ArrayConcatVisitor visitor(isolate, storage, fast_case);