Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly
Appearance settings

Commit acb6779

Browse filesBrowse files
indutnybnoordhuis
indutny
authored and
bnoordhuis
committed
deps: cherry-pick 6da51b4 from v8's upstream
Original commit message: TypedArray accessor detection: consider entire prototype chain When looking up a special accessor for known TypedArray fields ("length", "byteLength", "byteOffset"), consider the entire prototype chain, not only the direct prototype. This allows subclasses of TypedArrays to benefit from fast specialized accesses. Review URL: https://codereview.chromium.org/1313493005 Cr-Commit-Position: refs/heads/master@{#30678} Benchmark results: buffers/buffer-iterate.js size=16386 type=slow method=for n=1000: ./node: 71607 node: 8702.3 ............ 722.85% Improvement depends on the code, but generally brings us back to the performance that we had before the v8 update (if not making it faster). Fixes: #2463 PR-URL: #2801 Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl> Reviewed-By: Trevor Norris <trev.norris@gmail.com>
1 parent a6d674d commit acb6779
Copy full SHA for acb6779

File tree

Expand file treeCollapse file tree

2 files changed

+65
-13
lines changed
Open diff view settings
Filter options
Expand file treeCollapse file tree

2 files changed

+65
-13
lines changed
Open diff view settings
Collapse file

‎deps/v8/src/accessors.cc‎

Copy file name to clipboardExpand all lines: deps/v8/src/accessors.cc
+28-13Lines changed: 28 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -100,22 +100,37 @@ bool Accessors::IsJSArrayBufferViewFieldAccessor(Handle<Map> map,
100100
Isolate* isolate = name->GetIsolate();
101101

102102
switch (map->instance_type()) {
103-
case JS_TYPED_ARRAY_TYPE:
104-
// %TypedArray%.prototype is non-configurable, and so are the following
105-
// named properties on %TypedArray%.prototype, so we can directly inline
106-
// the field-load for typed array maps that still use their
107-
// %TypedArray%.prototype.
108-
if (JSFunction::cast(map->GetConstructor())->prototype() !=
109-
map->prototype()) {
103+
case JS_TYPED_ARRAY_TYPE: {
104+
if (!CheckForName(name, isolate->factory()->length_string(),
105+
JSTypedArray::kLengthOffset, object_offset) &&
106+
!CheckForName(name, isolate->factory()->byte_length_string(),
107+
JSTypedArray::kByteLengthOffset, object_offset) &&
108+
!CheckForName(name, isolate->factory()->byte_offset_string(),
109+
JSTypedArray::kByteOffsetOffset, object_offset)) {
110110
return false;
111111
}
112-
return CheckForName(name, isolate->factory()->length_string(),
113-
JSTypedArray::kLengthOffset, object_offset) ||
114-
CheckForName(name, isolate->factory()->byte_length_string(),
115-
JSTypedArray::kByteLengthOffset, object_offset) ||
116-
CheckForName(name, isolate->factory()->byte_offset_string(),
117-
JSTypedArray::kByteOffsetOffset, object_offset);
118112

113+
if (map->is_dictionary_map()) return false;
114+
115+
// Check if the property is overridden on the instance.
116+
DescriptorArray* descriptors = map->instance_descriptors();
117+
int descriptor = descriptors->SearchWithCache(*name, *map);
118+
if (descriptor != DescriptorArray::kNotFound) return false;
119+
120+
Handle<Object> proto = Handle<Object>(map->prototype(), isolate);
121+
if (!proto->IsJSReceiver()) return false;
122+
123+
// Check if the property is defined in the prototype chain.
124+
LookupIterator it(proto, name);
125+
if (!it.IsFound()) return false;
126+
127+
Object* original_proto =
128+
JSFunction::cast(map->GetConstructor())->prototype();
129+
130+
// Property is not configurable. It is enough to verify that
131+
// the holder is the same.
132+
return *it.GetHolder<Object>() == original_proto;
133+
}
119134
case JS_DATA_VIEW_TYPE:
120135
return CheckForName(name, isolate->factory()->byte_length_string(),
121136
JSDataView::kByteLengthOffset, object_offset) ||
Collapse file

‎deps/v8/test/mjsunit/regress/regress-typedarray-length.js‎

Copy file name to clipboardExpand all lines: deps/v8/test/mjsunit/regress/regress-typedarray-length.js
+37Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -71,6 +71,43 @@ assertEquals(undefined, get(a));
7171
assertEquals(undefined, get(a));
7272
})();
7373

74+
(function() {
75+
"use strict";
76+
77+
class MyTypedArray extends Int32Array {
78+
constructor(length) {
79+
super(length);
80+
}
81+
}
82+
83+
a = new MyTypedArray(1024);
84+
85+
get = function(a) {
86+
return a.length;
87+
}
88+
89+
assertEquals(1024, get(a));
90+
assertEquals(1024, get(a));
91+
assertEquals(1024, get(a));
92+
%OptimizeFunctionOnNextCall(get);
93+
assertEquals(1024, get(a));
94+
})();
95+
96+
(function() {
97+
"use strict";
98+
var a = new Uint8Array(4);
99+
Object.defineProperty(a, "length", {get: function() { return "blah"; }});
100+
get = function(a) {
101+
return a.length;
102+
}
103+
104+
assertEquals("blah", get(a));
105+
assertEquals("blah", get(a));
106+
assertEquals("blah", get(a));
107+
%OptimizeFunctionOnNextCall(get);
108+
assertEquals("blah", get(a));
109+
})();
110+
74111
// Ensure we cannot delete length, byteOffset, byteLength.
75112
assertTrue(Int32Array.prototype.hasOwnProperty("length"));
76113
assertTrue(Int32Array.prototype.hasOwnProperty("byteOffset"));

0 commit comments

Comments
0 (0)
Morty Proxy This is a proxified and sanitized view of the page, visit original site.