Commit message: None
CVE: CVE-2018-9490
CWE: CWE-704
Vulnerability description: In CollectValuesOrEntriesImpl of elements.cc, there is possible remote code execution due to type confusion. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9.0 Android ID: A-111274046

Project: Android

 static uint32_t AddArguments(Handle<JSArray> receiver,
 Handle<FixedArrayBase> backing_store,
 Arguments* args, uint32_t add_size,
 Where add_position) {
 uint32_t length = Smi::cast(receiver->length())->value();
    DCHECK(0 < add_size);
 uint32_t elms_len = backing_store->length();
    DCHECK(add_size <= static_cast<uint32_t>(Smi::kMaxValue - length));
 uint32_t new_length = length + add_size;

 if (new_length > elms_len) {
 uint32_t capacity = JSObject::NewElementsCapacity(new_length);
 int copy_dst_index = add_position == AT_START ? add_size : 0;
      backing_store = Subclass::ConvertElementsWithCapacity(
          receiver, backing_store, KindTraits::Kind, capacity, 0,
          copy_dst_index, ElementsAccessor::kCopyToEndAndInitializeToHole);
      receiver->set_elements(*backing_store);
 } else if (add_position == AT_START) {
 Isolate* isolate = receiver->GetIsolate();
 Subclass::MoveElements(isolate, receiver, backing_store, add_size, 0,
                             length, 0, 0);
 }

 int insertion_index = add_position == AT_START ? 0 : length;
 Subclass::CopyArguments(args, backing_store, add_size, 1, insertion_index);
    receiver->set_length(Smi::FromInt(new_length));
 return new_length;
 }

Project: Android

 static void AddElementsToKeyAccumulatorImpl(Handle<JSObject> receiver,
 KeyAccumulator* accumulator,
 AddKeyConversion convert) {
 Isolate* isolate = accumulator->isolate();
 Handle<Object> undefined = isolate->factory()->undefined_value();
 Handle<Object> the_hole = isolate->factory()->the_hole_value();
 Handle<SeededNumberDictionary> dictionary(
 SeededNumberDictionary::cast(receiver->elements()), isolate);
 int capacity = dictionary->Capacity();
 for (int i = 0; i < capacity; i++) {
 Object* k = dictionary->KeyAt(i);
 if (k == *undefined) continue;
 if (k == *the_hole) continue;
 if (dictionary->IsDeleted(i)) continue;
 Object* value = dictionary->ValueAt(i);
      DCHECK(!value->IsTheHole(isolate));
      DCHECK(!value->IsAccessorPair());
      DCHECK(!value->IsAccessorInfo());
      accumulator->AddKey(value, convert);
 }
 }

Project: Android

 static void AddElementsToKeyAccumulatorImpl(Handle<JSObject> receiver,
 KeyAccumulator* accumulator,
 AddKeyConversion convert) {
 Isolate* isolate = accumulator->isolate();
 Handle<FixedArrayBase> elements(receiver->elements(), isolate);
 uint32_t length = Subclass::GetMaxNumberOfEntries(*receiver, *elements);
 for (uint32_t i = 0; i < length; i++) {
 if (IsFastPackedElementsKind(KindTraits::Kind) ||
 HasEntryImpl(isolate, *elements, i)) {
        accumulator->AddKey(Subclass::GetImpl(isolate, *elements, i), convert);
 }
 }
 }

Project: Android

 static void AddElementsToKeyAccumulatorImpl(Handle<JSObject> receiver,
 KeyAccumulator* accumulator,
 AddKeyConversion convert) {
 Isolate* isolate = receiver->GetIsolate();
 Handle<FixedArrayBase> elements(receiver->elements());
 uint32_t length = AccessorClass::GetCapacityImpl(*receiver, *elements);
 for (uint32_t i = 0; i < length; i++) {
 Handle<Object> value = AccessorClass::GetImpl(isolate, *elements, i);
      accumulator->AddKey(value, convert);
 }
 }

Project: Android

 static void AddElementsToKeyAccumulatorImpl(Handle<JSObject> receiver,
 KeyAccumulator* accumulator,
 AddKeyConversion convert) {
 Isolate* isolate = accumulator->isolate();
 Handle<FixedArrayBase> elements(receiver->elements(), isolate);
 uint32_t length = GetCapacityImpl(*receiver, *elements);
 for (uint32_t entry = 0; entry < length; entry++) {
 if (!HasEntryImpl(isolate, *elements, entry)) continue;
 Handle<Object> value = GetImpl(isolate, *elements, entry);
      accumulator->AddKey(value, convert);
 }
 }

Project: Android

 static void AddElementsToKeyAccumulatorImpl(Handle<JSObject> receiver,
 KeyAccumulator* accumulator,
 AddKeyConversion convert) {
 Isolate* isolate = receiver->GetIsolate();
 Handle<String> string(GetString(*receiver), isolate);
    string = String::Flatten(string);
 uint32_t length = static_cast<uint32_t>(string->length());
 for (uint32_t i = 0; i < length; i++) {
      accumulator->AddKey(
          isolate->factory()->LookupSingleCharacterStringFromCode(
              string->Get(i)),
          convert);
 }
 BackingStoreAccessor::AddElementsToKeyAccumulatorImpl(receiver, accumulator,
                                                          convert);
 }

Project: Android

 static void AddImpl(Handle<JSObject> object, uint32_t index,
 Handle<Object> value, PropertyAttributes attributes,
 uint32_t new_capacity) {
 PropertyDetails details(kData, attributes, 0, PropertyCellType::kNoCell);
 Handle<SeededNumberDictionary> dictionary =
        object->HasFastElements() || object->HasFastStringWrapperElements()
 ? JSObject::NormalizeElements(object)
 : handle(SeededNumberDictionary::cast(object->elements()));
 Handle<SeededNumberDictionary> new_dictionary =
 SeededNumberDictionary::AddNumberEntry(dictionary, index, value,
                                               details, object);
 if (attributes != NONE) object->RequireSlowElements(*new_dictionary);
 if (dictionary.is_identical_to(new_dictionary)) return;
    object->set_elements(*new_dictionary);
 }

Project: Android

 static void AddImpl(Handle<JSObject> object, uint32_t index,
 Handle<Object> value, PropertyAttributes attributes,
 uint32_t new_capacity) {
    DCHECK_EQ(NONE, attributes);
 ElementsKind from_kind = object->GetElementsKind();
 ElementsKind to_kind = Subclass::kind();
 if (IsDictionaryElementsKind(from_kind) ||
 IsFastDoubleElementsKind(from_kind) !=
 IsFastDoubleElementsKind(to_kind) ||
 Subclass::GetCapacityImpl(*object, object->elements()) !=
            new_capacity) {
 Subclass::GrowCapacityAndConvertImpl(object, new_capacity);
 } else {
 if (IsFastElementsKind(from_kind) && from_kind != to_kind) {
 JSObject::TransitionElementsKind(object, to_kind);
 }
 if (IsFastSmiOrObjectElementsKind(from_kind)) {
        DCHECK(IsFastSmiOrObjectElementsKind(to_kind));
 JSObject::EnsureWritableFastElements(object);
 }
 }
 Subclass::SetImpl(object, index, *value);
 }

Project: Android

 static void AddImpl(Handle<JSObject> object, uint32_t index,
 Handle<Object> value, PropertyAttributes attributes,
 uint32_t new_capacity) {
 Handle<FixedArray> parameter_map(FixedArray::cast(object->elements()));
 Handle<FixedArrayBase> old_elements(
 FixedArrayBase::cast(parameter_map->get(1)));
 Handle<SeededNumberDictionary> dictionary =
        old_elements->IsSeededNumberDictionary()
 ? Handle<SeededNumberDictionary>::cast(old_elements)
 : JSObject::NormalizeElements(object);
 PropertyDetails details(kData, attributes, 0, PropertyCellType::kNoCell);
 Handle<SeededNumberDictionary> new_dictionary =
 SeededNumberDictionary::AddNumberEntry(dictionary, index, value,
                                               details, object);
 if (attributes != NONE) object->RequireSlowElements(*new_dictionary);
 if (*dictionary != *new_dictionary) {
 FixedArray::cast(object->elements())->set(1, *new_dictionary);
 }
 }

Project: Android

 static void AddImpl(Handle<JSObject> object, uint32_t index,
 Handle<Object> value, PropertyAttributes attributes,
 uint32_t new_capacity) {
    DCHECK(index >= static_cast<uint32_t>(GetString(*object)->length()));
 if (KindTraits::Kind == FAST_STRING_WRAPPER_ELEMENTS &&
 (object->GetElementsKind() == SLOW_STRING_WRAPPER_ELEMENTS ||
 BackingStoreAccessor::GetCapacityImpl(*object, object->elements()) !=
             new_capacity)) {
 GrowCapacityAndConvertImpl(object, new_capacity);
 }
 BackingStoreAccessor::AddImpl(object, index, value, attributes,
                                  new_capacity);
 }

Project: Android

 static void BasicGrowCapacityAndConvertImpl(
 Handle<JSObject> object, Handle<FixedArrayBase> old_elements,
 ElementsKind from_kind, ElementsKind to_kind, uint32_t capacity) {
 Handle<FixedArrayBase> elements =
 ConvertElementsWithCapacity(object, old_elements, from_kind, capacity);

 if (IsHoleyElementsKind(from_kind)) to_kind = GetHoleyElementsKind(to_kind);
 Handle<Map> new_map = JSObject::GetElementsTransitionMap(object, to_kind);
 JSObject::SetMapAndElements(object, new_map, elements);

 JSObject::UpdateAllocationSite(object, to_kind);

 if (FLAG_trace_elements_transitions) {
 JSObject::PrintElementsTransition(stdout, object, from_kind, old_elements,
                                        to_kind, elements);
 }
 }

Project: Android

void CheckArrayAbuse(Handle<JSObject> obj, const char* op, uint32_t index,
 bool allow_appending) {
 DisallowHeapAllocation no_allocation;
 Object* raw_length = NULL;
 const char* elements_type = "array";
 if (obj->IsJSArray()) {
 JSArray* array = JSArray::cast(*obj);
    raw_length = array->length();
 } else {
    raw_length = Smi::FromInt(obj->elements()->length());
    elements_type = "object";
 }

 if (raw_length->IsNumber()) {
 double n = raw_length->Number();
 if (FastI2D(FastD2UI(n)) == n) {
 int32_t int32_length = DoubleToInt32(n);
 uint32_t compare_length = static_cast<uint32_t>(int32_length);
 if (allow_appending) compare_length++;
 if (index >= compare_length) {
 PrintF("[OOB %s %s (%s length = %d, element accessed = %d) in ",
               elements_type, op, elements_type, static_cast<int>(int32_length),
 static_cast<int>(index));
 TraceTopFrame(obj->GetIsolate());
 PrintF("]\n");
 }
 } else {
 PrintF("[%s elements length not integer value in ", elements_type);
 TraceTopFrame(obj->GetIsolate());
 PrintF("]\n");
 }
 } else {
 PrintF("[%s elements length not a number in ", elements_type);
 TraceTopFrame(obj->GetIsolate());
 PrintF("]\n");
 }
}

Project: Android

 static void CollectElementIndicesImpl(Handle<JSObject> object,
 Handle<FixedArrayBase> backing_store,
 KeyAccumulator* keys) {
    DCHECK_NE(DICTIONARY_ELEMENTS, kind());
 uint32_t length = Subclass::GetMaxIndex(*object, *backing_store);
 PropertyFilter filter = keys->filter();
 Isolate* isolate = keys->isolate();
 Factory* factory = isolate->factory();
 for (uint32_t i = 0; i < length; i++) {
 if (Subclass::HasElementImpl(isolate, object, i, backing_store, filter)) {
        keys->AddKey(factory->NewNumberFromUint(i));
 }
 }
 }

Project: Android

 static void CollectElementIndicesImpl(Handle<JSObject> object,
 Handle<FixedArrayBase> backing_store,
 KeyAccumulator* keys) {
 if (keys->filter() & SKIP_STRINGS) return;
 Isolate* isolate = keys->isolate();
 Handle<SeededNumberDictionary> dictionary =
 Handle<SeededNumberDictionary>::cast(backing_store);
 int capacity = dictionary->Capacity();
 Handle<FixedArray> elements = isolate->factory()->NewFixedArray(
 GetMaxNumberOfEntries(*object, *backing_store));
 int insertion_index = 0;
 PropertyFilter filter = keys->filter();
 for (int i = 0; i < capacity; i++) {
 Object* raw_key = dictionary->KeyAt(i);
 if (!dictionary->IsKey(isolate, raw_key)) continue;
 uint32_t key = FilterKey(dictionary, i, raw_key, filter);
 if (key == kMaxUInt32) {
        keys->AddShadowingKey(raw_key);
 continue;
 }
      elements->set(insertion_index, raw_key);
      insertion_index++;
 }
 SortIndices(elements, insertion_index);
 for (int i = 0; i < insertion_index; i++) {
      keys->AddKey(elements->get(i));
 }
 }

Project: Android

 static void CollectElementIndicesImpl(Handle<JSObject> object,
 Handle<FixedArrayBase> backing_store,
 KeyAccumulator* keys) {
 Isolate* isolate = keys->isolate();
 uint32_t nof_indices = 0;
 Handle<FixedArray> indices = isolate->factory()->NewFixedArray(
 GetCapacityImpl(*object, *backing_store));
 DirectCollectElementIndicesImpl(isolate, object, backing_store,
 GetKeysConversion::kKeepNumbers,
                                    ENUMERABLE_STRINGS, indices, &nof_indices);
 SortIndices(indices, nof_indices);
 for (uint32_t i = 0; i < nof_indices; i++) {
      keys->AddKey(indices->get(i));
 }
 }

Project: Android

 static void CollectElementIndicesImpl(Handle<JSObject> object,
 Handle<FixedArrayBase> backing_store,
 KeyAccumulator* keys) {
 uint32_t length = GetString(*object)->length();
 Factory* factory = keys->isolate()->factory();
 for (uint32_t i = 0; i < length; i++) {
      keys->AddKey(factory->NewNumberFromUint(i));
 }
 BackingStoreAccessor::CollectElementIndicesImpl(object, backing_store,
                                                    keys);
 }

Project: Android

 static Maybe<bool> CollectValuesOrEntriesImpl(
 Isolate* isolate, Handle<JSObject> object,
 Handle<FixedArray> values_or_entries, bool get_entries, int* nof_items,
 PropertyFilter filter) {
 Handle<BackingStore> elements(BackingStore::cast(object->elements()),
                                  isolate);
 int count = 0;
 uint32_t length = elements->length();
 for (uint32_t index = 0; index < length; ++index) {
 if (!HasEntryImpl(isolate, *elements, index)) continue;
 Handle<Object> value = Subclass::GetImpl(isolate, *elements, index);
 if (get_entries) {
        value = MakeEntryPair(isolate, index, value);
 }
      values_or_entries->set(count++, *value);
 }
 *nof_items = count;
 return Just(true);
 }

Project: Android

 static Maybe<bool> CollectValuesOrEntriesImpl(
 Isolate* isolate, Handle<JSObject> object,
 Handle<FixedArray> values_or_entries, bool get_entries, int* nof_items,
 PropertyFilter filter) {
 int count = 0;
 if ((filter & ONLY_CONFIGURABLE) == 0) {
 Handle<FixedArrayBase> elements(object->elements());
 uint32_t length = AccessorClass::GetCapacityImpl(*object, *elements);
 for (uint32_t index = 0; index < length; ++index) {
 Handle<Object> value =
 AccessorClass::GetImpl(isolate, *elements, index);
 if (get_entries) {
          value = MakeEntryPair(isolate, index, value);
 }
        values_or_entries->set(count++, *value);
 }
 }
 *nof_items = count;
 return Just(true);
 }

Project: Android

Handle<JSArray> ElementsAccessor::Concat(Isolate* isolate, Arguments* args,
 uint32_t concat_size,
 uint32_t result_len) {
 ElementsKind result_elements_kind = GetInitialFastElementsKind();
 bool has_raw_doubles = false;
 {
 DisallowHeapAllocation no_gc;
 bool is_holey = false;
 for (uint32_t i = 0; i < concat_size; i++) {
 Object* arg = (*args)[i];
 ElementsKind arg_kind = JSArray::cast(arg)->GetElementsKind();
      has_raw_doubles = has_raw_doubles || IsFastDoubleElementsKind(arg_kind);
      is_holey = is_holey || IsFastHoleyElementsKind(arg_kind);
      result_elements_kind =
 GetMoreGeneralElementsKind(result_elements_kind, arg_kind);
 }
 if (is_holey) {
      result_elements_kind = GetHoleyElementsKind(result_elements_kind);
 }
 }

 bool requires_double_boxing =
      has_raw_doubles && !IsFastDoubleElementsKind(result_elements_kind);
 ArrayStorageAllocationMode mode = requires_double_boxing
 ? INITIALIZE_ARRAY_ELEMENTS_WITH_HOLE
 : DONT_INITIALIZE_ARRAY_ELEMENTS;
 Handle<JSArray> result_array = isolate->factory()->NewJSArray(
      result_elements_kind, result_len, result_len, mode);
 if (result_len == 0) return result_array;

 uint32_t insertion_index = 0;
 Handle<FixedArrayBase> storage(result_array->elements(), isolate);
 ElementsAccessor* accessor = ElementsAccessor::ForKind(result_elements_kind);
 for (uint32_t i = 0; i < concat_size; i++) {
 JSArray* array = JSArray::cast((*args)[i]);
 uint32_t len = 0;
    array->length()->ToArrayLength(&len);
 if (len == 0) continue;
 ElementsKind from_kind = array->GetElementsKind();
    accessor->CopyElements(array, 0, from_kind, storage, insertion_index, len);
    insertion_index += len;
 }

  DCHECK_EQ(insertion_index, result_len);
 return result_array;
}

Project: Android

 static Handle<FixedArrayBase> ConvertElementsWithCapacity(
 Handle<JSObject> object, Handle<FixedArrayBase> old_elements,
 ElementsKind from_kind, uint32_t capacity) {
 return ConvertElementsWithCapacity(
        object, old_elements, from_kind, capacity, 0, 0,
 ElementsAccessor::kCopyToEndAndInitializeToHole);
 }

Project: Android

 static Handle<FixedArrayBase> ConvertElementsWithCapacity(
 Handle<JSObject> object, Handle<FixedArrayBase> old_elements,
 ElementsKind from_kind, uint32_t capacity, int copy_size) {
 return ConvertElementsWithCapacity(object, old_elements, from_kind,
                                       capacity, 0, 0, copy_size);
 }

Project: Android

 static Handle<FixedArrayBase> ConvertElementsWithCapacity(
 Handle<JSObject> object, Handle<FixedArrayBase> old_elements,
 ElementsKind from_kind, uint32_t capacity, uint32_t src_index,
 uint32_t dst_index, int copy_size) {
 Isolate* isolate = object->GetIsolate();
 Handle<FixedArrayBase> new_elements;
 if (IsFastDoubleElementsKind(kind())) {
      new_elements = isolate->factory()->NewFixedDoubleArray(capacity);
 } else {
      new_elements = isolate->factory()->NewUninitializedFixedArray(capacity);
 }

 int packed_size = kPackedSizeNotKnown;
 if (IsFastPackedElementsKind(from_kind) && object->IsJSArray()) {
      packed_size = Smi::cast(JSArray::cast(*object)->length())->value();
 }

 Subclass::CopyElementsImpl(*old_elements, src_index, *new_elements,
                               from_kind, dst_index, packed_size, copy_size);

 return new_elements;
 }

Project: Android

 static void CopyArguments(Arguments* args, Handle<FixedArrayBase> dst_store,
 uint32_t copy_size, uint32_t src_index,
 uint32_t dst_index) {
 DisallowHeapAllocation no_gc;
 FixedArrayBase* raw_backing_store = *dst_store;
 WriteBarrierMode mode = raw_backing_store->GetWriteBarrierMode(no_gc);
 for (uint32_t i = 0; i < copy_size; i++) {
 Object* argument = (*args)[src_index + i];
      DCHECK(!argument->IsTheHole(raw_backing_store->GetIsolate()));
 Subclass::SetImpl(raw_backing_store, dst_index + i, argument, mode);
 }
 }

Project: Android

static void CopyDictionaryToDoubleElements(FixedArrayBase* from_base,
 uint32_t from_start,
 FixedArrayBase* to_base,
 uint32_t to_start,
 int raw_copy_size) {
 DisallowHeapAllocation no_allocation;
 SeededNumberDictionary* from = SeededNumberDictionary::cast(from_base);
 int copy_size = raw_copy_size;
 if (copy_size < 0) {
    DCHECK(copy_size == ElementsAccessor::kCopyToEnd ||
           copy_size == ElementsAccessor::kCopyToEndAndInitializeToHole);
    copy_size = from->max_number_key() + 1 - from_start;
 if (raw_copy_size == ElementsAccessor::kCopyToEndAndInitializeToHole) {
 for (int i = to_start + copy_size; i < to_base->length(); ++i) {
 FixedDoubleArray::cast(to_base)->set_the_hole(i);
 }
 }
 }
 if (copy_size == 0) return;
 FixedDoubleArray* to = FixedDoubleArray::cast(to_base);
 uint32_t to_length = to->length();
 if (to_start + copy_size > to_length) {
    copy_size = to_length - to_start;
 }
 Isolate* isolate = from->GetIsolate();
 for (int i = 0; i < copy_size; i++) {
 int entry = from->FindEntry(isolate, i + from_start);
 if (entry != SeededNumberDictionary::kNotFound) {
      to->set(i + to_start, from->ValueAt(entry)->Number());
 } else {
      to->set_the_hole(i + to_start);
 }
 }
}

Project: Android

static void CopyDictionaryToObjectElements(
 FixedArrayBase* from_base, uint32_t from_start, FixedArrayBase* to_base,
 ElementsKind to_kind, uint32_t to_start, int raw_copy_size) {
 DisallowHeapAllocation no_allocation;
 SeededNumberDictionary* from = SeededNumberDictionary::cast(from_base);
 int copy_size = raw_copy_size;
 if (raw_copy_size < 0) {
    DCHECK(raw_copy_size == ElementsAccessor::kCopyToEnd ||
           raw_copy_size == ElementsAccessor::kCopyToEndAndInitializeToHole);
    copy_size = from->max_number_key() + 1 - from_start;
 if (raw_copy_size == ElementsAccessor::kCopyToEndAndInitializeToHole) {
 int start = to_start + copy_size;
 int length = to_base->length() - start;
 if (length > 0) {
 Heap* heap = from->GetHeap();
 MemsetPointer(FixedArray::cast(to_base)->data_start() + start,
                      heap->the_hole_value(), length);
 }
 }
 }
  DCHECK(to_base != from_base);
  DCHECK(IsFastSmiOrObjectElementsKind(to_kind));
 if (copy_size == 0) return;
 FixedArray* to = FixedArray::cast(to_base);
 uint32_t to_length = to->length();
 if (to_start + copy_size > to_length) {
    copy_size = to_length - to_start;
 }
 WriteBarrierMode write_barrier_mode = IsFastObjectElementsKind(to_kind)
 ? UPDATE_WRITE_BARRIER
 : SKIP_WRITE_BARRIER;
 Isolate* isolate = from->GetIsolate();
 for (int i = 0; i < copy_size; i++) {
 int entry = from->FindEntry(isolate, i + from_start);
 if (entry != SeededNumberDictionary::kNotFound) {
 Object* value = from->ValueAt(entry);
      DCHECK(!value->IsTheHole(isolate));
      to->set(i + to_start, value, write_barrier_mode);
 } else {
      to->set_the_hole(isolate, i + to_start);
 }
 }
}

Project: Android

static void CopyDoubleToDoubleElements(FixedArrayBase* from_base,
 uint32_t from_start,
 FixedArrayBase* to_base,
 uint32_t to_start, int raw_copy_size) {
 DisallowHeapAllocation no_allocation;
 int copy_size = raw_copy_size;
 if (raw_copy_size < 0) {
    DCHECK(raw_copy_size == ElementsAccessor::kCopyToEnd ||
           raw_copy_size == ElementsAccessor::kCopyToEndAndInitializeToHole);
    copy_size = Min(from_base->length() - from_start,
                    to_base->length() - to_start);
 if (raw_copy_size == ElementsAccessor::kCopyToEndAndInitializeToHole) {
 for (int i = to_start + copy_size; i < to_base->length(); ++i) {
 FixedDoubleArray::cast(to_base)->set_the_hole(i);
 }
 }
 }
  DCHECK((copy_size + static_cast<int>(to_start)) <= to_base->length() &&
 (copy_size + static_cast<int>(from_start)) <= from_base->length());
 if (copy_size == 0) return;
 FixedDoubleArray* from = FixedDoubleArray::cast(from_base);
 FixedDoubleArray* to = FixedDoubleArray::cast(to_base);
 Address to_address = to->address() + FixedDoubleArray::kHeaderSize;
 Address from_address = from->address() + FixedDoubleArray::kHeaderSize;
  to_address += kDoubleSize * to_start;
  from_address += kDoubleSize * from_start;
 int words_per_double = (kDoubleSize / kPointerSize);
 CopyWords(reinterpret_cast<Object**>(to_address),
 reinterpret_cast<Object**>(from_address),
 static_cast<size_t>(words_per_double * copy_size));
}

Project: Android

static void CopyDoubleToObjectElements(FixedArrayBase* from_base,
 uint32_t from_start,
 FixedArrayBase* to_base,
 uint32_t to_start, int raw_copy_size) {
 int copy_size = raw_copy_size;
 if (raw_copy_size < 0) {
 DisallowHeapAllocation no_allocation;
    DCHECK(raw_copy_size == ElementsAccessor::kCopyToEnd ||
           raw_copy_size == ElementsAccessor::kCopyToEndAndInitializeToHole);
    copy_size = Min(from_base->length() - from_start,
                    to_base->length() - to_start);
 if (raw_copy_size == ElementsAccessor::kCopyToEndAndInitializeToHole) {
 int start = to_start;
 int length = to_base->length() - start;
 if (length > 0) {
 Heap* heap = from_base->GetHeap();
 MemsetPointer(FixedArray::cast(to_base)->data_start() + start,
                      heap->the_hole_value(), length);
 }
 }
 }

  DCHECK((copy_size + static_cast<int>(to_start)) <= to_base->length() &&
 (copy_size + static_cast<int>(from_start)) <= from_base->length());
 if (copy_size == 0) return;

 Isolate* isolate = from_base->GetIsolate();
 Handle<FixedDoubleArray> from(FixedDoubleArray::cast(from_base), isolate);
 Handle<FixedArray> to(FixedArray::cast(to_base), isolate);

 int offset = 0;
 while (offset < copy_size) {
 HandleScope scope(isolate);
    offset += 100;
 for (int i = offset - 100; i < offset && i < copy_size; ++i) {
 Handle<Object> value =
 FixedDoubleArray::get(*from, i + from_start, isolate);
      to->set(i + to_start, *value, UPDATE_WRITE_BARRIER);
 }
 }
}

Project: Android

 void CopyElements(Handle<FixedArrayBase> source, ElementsKind source_kind,
 Handle<FixedArrayBase> destination, int size) {
 Subclass::CopyElementsImpl(*source, 0, *destination, source_kind, 0,
                               kPackedSizeNotKnown, size);
 }

Project: Android

 static void CopyElementsImpl(FixedArrayBase* from, uint32_t from_start,
 FixedArrayBase* to, ElementsKind from_kind,
 uint32_t to_start, int packed_size,
 int copy_size) {
    UNREACHABLE();
 }

Project: Android

 static void CopyElementsImpl(FixedArrayBase* from, uint32_t from_start,
 FixedArrayBase* to, ElementsKind from_kind,
 uint32_t to_start, int packed_size,
 int copy_size) {
 DisallowHeapAllocation no_gc;
 ElementsKind to_kind = KindTraits::Kind;
 switch (from_kind) {
 case FAST_SMI_ELEMENTS:
 case FAST_HOLEY_SMI_ELEMENTS:
 case FAST_ELEMENTS:
 case FAST_HOLEY_ELEMENTS:
 CopyObjectToObjectElements(from, from_kind, from_start, to, to_kind,
                                   to_start, copy_size);
 break;
 case FAST_DOUBLE_ELEMENTS:
 case FAST_HOLEY_DOUBLE_ELEMENTS: {
 AllowHeapAllocation allow_allocation;
        DCHECK(IsFastObjectElementsKind(to_kind));
 CopyDoubleToObjectElements(from, from_start, to, to_start, copy_size);
 break;
 }
 case DICTIONARY_ELEMENTS:
 CopyDictionaryToObjectElements(from, from_start, to, to_kind, to_start,
                                       copy_size);
 break;
 case FAST_SLOPPY_ARGUMENTS_ELEMENTS:
 case SLOW_SLOPPY_ARGUMENTS_ELEMENTS:
 case FAST_STRING_WRAPPER_ELEMENTS:
 case SLOW_STRING_WRAPPER_ELEMENTS:
#define TYPED_ARRAY_CASE(Type, type, TYPE, ctype, size) case TYPE##_ELEMENTS:
      TYPED_ARRAYS(TYPED_ARRAY_CASE)
#undef TYPED_ARRAY_CASE
      UNREACHABLE();
 break;
 case NO_ELEMENTS:
 break; // Nothing to do.
 }
 }

Project: Android

 static void CopyElementsImpl(FixedArrayBase* from, uint32_t from_start,
 FixedArrayBase* to, ElementsKind from_kind,
 uint32_t to_start, int packed_size,
 int copy_size) {
 DisallowHeapAllocation no_allocation;
 switch (from_kind) {
 case FAST_SMI_ELEMENTS:
 CopyPackedSmiToDoubleElements(from, from_start, to, to_start,
                                      packed_size, copy_size);
 break;
 case FAST_HOLEY_SMI_ELEMENTS:
 CopySmiToDoubleElements(from, from_start, to, to_start, copy_size);
 break;
 case FAST_DOUBLE_ELEMENTS:
 case FAST_HOLEY_DOUBLE_ELEMENTS:
 CopyDoubleToDoubleElements(from, from_start, to, to_start, copy_size);
 break;
 case FAST_ELEMENTS:
 case FAST_HOLEY_ELEMENTS:
 CopyObjectToDoubleElements(from, from_start, to, to_start, copy_size);
 break;
 case DICTIONARY_ELEMENTS:
 CopyDictionaryToDoubleElements(from, from_start, to, to_start,
                                       copy_size);
 break;
 case FAST_SLOPPY_ARGUMENTS_ELEMENTS:
 case SLOW_SLOPPY_ARGUMENTS_ELEMENTS:
 case FAST_STRING_WRAPPER_ELEMENTS:
 case SLOW_STRING_WRAPPER_ELEMENTS:
 case NO_ELEMENTS:
#define TYPED_ARRAY_CASE(Type, type, TYPE, ctype, size) case TYPE##_ELEMENTS:
      TYPED_ARRAYS(TYPED_ARRAY_CASE)
#undef TYPED_ARRAY_CASE
      UNREACHABLE();
 break;
 }
 }

Project: Android

 static void CopyElementsImpl(FixedArrayBase* from, uint32_t from_start,
 FixedArrayBase* to, ElementsKind from_kind,
 uint32_t to_start, int packed_size,
 int copy_size) {
    DCHECK(!to->IsDictionary());
 if (from_kind == SLOW_SLOPPY_ARGUMENTS_ELEMENTS) {
 CopyDictionaryToObjectElements(from, from_start, to, FAST_HOLEY_ELEMENTS,
                                     to_start, copy_size);
 } else {
      DCHECK_EQ(FAST_SLOPPY_ARGUMENTS_ELEMENTS, from_kind);
 CopyObjectToObjectElements(from, FAST_HOLEY_ELEMENTS, from_start, to,
                                 FAST_HOLEY_ELEMENTS, to_start, copy_size);
 }
 }

Project: Android

 static void CopyElementsImpl(FixedArrayBase* from, uint32_t from_start,
 FixedArrayBase* to, ElementsKind from_kind,
 uint32_t to_start, int packed_size,
 int copy_size) {
    DCHECK(!to->IsDictionary());
 if (from_kind == SLOW_STRING_WRAPPER_ELEMENTS) {
 CopyDictionaryToObjectElements(from, from_start, to, FAST_HOLEY_ELEMENTS,
                                     to_start, copy_size);
 } else {
      DCHECK_EQ(FAST_STRING_WRAPPER_ELEMENTS, from_kind);
 CopyObjectToObjectElements(from, FAST_HOLEY_ELEMENTS, from_start, to,
                                 FAST_HOLEY_ELEMENTS, to_start, copy_size);
 }
 }

Project: Android

static void CopyObjectToDoubleElements(FixedArrayBase* from_base,
 uint32_t from_start,
 FixedArrayBase* to_base,
 uint32_t to_start, int raw_copy_size) {
 DisallowHeapAllocation no_allocation;
 int copy_size = raw_copy_size;
 if (raw_copy_size < 0) {
    DCHECK(raw_copy_size == ElementsAccessor::kCopyToEnd ||
           raw_copy_size == ElementsAccessor::kCopyToEndAndInitializeToHole);
    copy_size = from_base->length() - from_start;
 if (raw_copy_size == ElementsAccessor::kCopyToEndAndInitializeToHole) {
 for (int i = to_start + copy_size; i < to_base->length(); ++i) {
 FixedDoubleArray::cast(to_base)->set_the_hole(i);
 }
 }
 }
  DCHECK((copy_size + static_cast<int>(to_start)) <= to_base->length() &&
 (copy_size + static_cast<int>(from_start)) <= from_base->length());
 if (copy_size == 0) return;
 FixedArray* from = FixedArray::cast(from_base);
 FixedDoubleArray* to = FixedDoubleArray::cast(to_base);
 Object* the_hole = from->GetHeap()->the_hole_value();
 for (uint32_t from_end = from_start + copy_size;
       from_start < from_end; from_start++, to_start++) {
 Object* hole_or_object = from->get(from_start);
 if (hole_or_object == the_hole) {
      to->set_the_hole(to_start);
 } else {
      to->set(to_start, hole_or_object->Number());
 }
 }
}

Project: Android

void CopyObjectToObjectElements(FixedArrayBase* from_base,
 ElementsKind from_kind, uint32_t from_start,
 FixedArrayBase* to_base, ElementsKind to_kind,
 uint32_t to_start, int raw_copy_size) {
  DCHECK(to_base->map() !=
      from_base->GetIsolate()->heap()->fixed_cow_array_map());
 DisallowHeapAllocation no_allocation;
 int copy_size = raw_copy_size;
 if (raw_copy_size < 0) {
    DCHECK(raw_copy_size == ElementsAccessor::kCopyToEnd ||
           raw_copy_size == ElementsAccessor::kCopyToEndAndInitializeToHole);
    copy_size = Min(from_base->length() - from_start,
                    to_base->length() - to_start);
 if (raw_copy_size == ElementsAccessor::kCopyToEndAndInitializeToHole) {
 int start = to_start + copy_size;
 int length = to_base->length() - start;
 if (length > 0) {
 Heap* heap = from_base->GetHeap();
 MemsetPointer(FixedArray::cast(to_base)->data_start() + start,
                      heap->the_hole_value(), length);
 }
 }
 }
  DCHECK((copy_size + static_cast<int>(to_start)) <= to_base->length() &&
 (copy_size + static_cast<int>(from_start)) <= from_base->length());
 if (copy_size == 0) return;
 FixedArray* from = FixedArray::cast(from_base);
 FixedArray* to = FixedArray::cast(to_base);
  DCHECK(IsFastSmiOrObjectElementsKind(from_kind));
  DCHECK(IsFastSmiOrObjectElementsKind(to_kind));

 WriteBarrierMode write_barrier_mode =
 (IsFastObjectElementsKind(from_kind) && IsFastObjectElementsKind(to_kind))
 ? UPDATE_WRITE_BARRIER
 : SKIP_WRITE_BARRIER;
 for (int i = 0; i < copy_size; i++) {
 Object* value = from->get(from_start + i);
    to->set(to_start + i, value, write_barrier_mode);
 }
}

Project: Android

static void CopyPackedSmiToDoubleElements(FixedArrayBase* from_base,
 uint32_t from_start,
 FixedArrayBase* to_base,
 uint32_t to_start, int packed_size,
 int raw_copy_size) {
 DisallowHeapAllocation no_allocation;
 int copy_size = raw_copy_size;
 uint32_t to_end;
 if (raw_copy_size < 0) {
    DCHECK(raw_copy_size == ElementsAccessor::kCopyToEnd ||
           raw_copy_size == ElementsAccessor::kCopyToEndAndInitializeToHole);
    copy_size = packed_size - from_start;
 if (raw_copy_size == ElementsAccessor::kCopyToEndAndInitializeToHole) {
      to_end = to_base->length();
 for (uint32_t i = to_start + copy_size; i < to_end; ++i) {
 FixedDoubleArray::cast(to_base)->set_the_hole(i);
 }
 } else {
      to_end = to_start + static_cast<uint32_t>(copy_size);
 }
 } else {
    to_end = to_start + static_cast<uint32_t>(copy_size);
 }
  DCHECK(static_cast<int>(to_end) <= to_base->length());
  DCHECK(packed_size >= 0 && packed_size <= copy_size);
  DCHECK((copy_size + static_cast<int>(to_start)) <= to_base->length() &&
 (copy_size + static_cast<int>(from_start)) <= from_base->length());
 if (copy_size == 0) return;
 FixedArray* from = FixedArray::cast(from_base);
 FixedDoubleArray* to = FixedDoubleArray::cast(to_base);
 for (uint32_t from_end = from_start + static_cast<uint32_t>(packed_size);
       from_start < from_end; from_start++, to_start++) {
 Object* smi = from->get(from_start);
    DCHECK(!smi->IsTheHole(from->GetIsolate()));
    to->set(to_start, Smi::cast(smi)->value());
 }
}

Project: Android

static void CopySmiToDoubleElements(FixedArrayBase* from_base,
 uint32_t from_start,
 FixedArrayBase* to_base, uint32_t to_start,
 int raw_copy_size) {
 DisallowHeapAllocation no_allocation;
 int copy_size = raw_copy_size;
 if (raw_copy_size < 0) {
    DCHECK(raw_copy_size == ElementsAccessor::kCopyToEnd ||
           raw_copy_size == ElementsAccessor::kCopyToEndAndInitializeToHole);
    copy_size = from_base->length() - from_start;
 if (raw_copy_size == ElementsAccessor::kCopyToEndAndInitializeToHole) {
 for (int i = to_start + copy_size; i < to_base->length(); ++i) {
 FixedDoubleArray::cast(to_base)->set_the_hole(i);
 }
 }
 }
  DCHECK((copy_size + static_cast<int>(to_start)) <= to_base->length() &&
 (copy_size + static_cast<int>(from_start)) <= from_base->length());
 if (copy_size == 0) return;
 FixedArray* from = FixedArray::cast(from_base);
 FixedDoubleArray* to = FixedDoubleArray::cast(to_base);
 Object* the_hole = from->GetHeap()->the_hole_value();
 for (uint32_t from_end = from_start + static_cast<uint32_t>(copy_size);
       from_start < from_end; from_start++, to_start++) {
 Object* hole_or_smi = from->get(from_start);
 if (hole_or_smi == the_hole) {
      to->set_the_hole(to_start);
 } else {
      to->set(to_start, Smi::cast(hole_or_smi)->value());
 }
 }
}

Project: Android

 static Handle<FixedArray> CreateListFromArrayImpl(Isolate* isolate,
 Handle<JSArray> array) {
    UNREACHABLE();
 return Handle<FixedArray>();
 }

Project: Android

 static Handle<FixedArray> CreateListFromArrayImpl(Isolate* isolate,
 Handle<JSArray> array) {
 uint32_t length = 0;
    array->length()->ToArrayLength(&length);
 Handle<FixedArray> result = isolate->factory()->NewFixedArray(length);
 Handle<FixedArrayBase> elements(array->elements(), isolate);
 for (uint32_t i = 0; i < length; i++) {
 if (!Subclass::HasElementImpl(isolate, array, i, elements)) continue;
 Handle<Object> value;
      value = Subclass::GetImpl(isolate, *elements, i);
 if (value->IsName()) {
        value = isolate->factory()->InternalizeName(Handle<Name>::cast(value));
 }
      result->set(i, *value);
 }
 return result;
 }

Project: Android

 static void DeleteCommon(Handle<JSObject> obj, uint32_t entry,
 Handle<FixedArrayBase> store) {
    DCHECK(obj->HasFastSmiOrObjectElements() || obj->HasFastDoubleElements() ||
           obj->HasFastArgumentsElements() ||
           obj->HasFastStringWrapperElements());
 Handle<BackingStore> backing_store = Handle<BackingStore>::cast(store);
 if (!obj->IsJSArray() &&
        entry == static_cast<uint32_t>(store->length()) - 1) {
 DeleteAtEnd(obj, backing_store, entry);
 return;
 }

 Isolate* isolate = obj->GetIsolate();
    backing_store->set_the_hole(isolate, entry);

 const int kMinLengthForSparsenessCheck = 64;
 if (backing_store->length() < kMinLengthForSparsenessCheck) return;
 if (backing_store->GetHeap()->InNewSpace(*backing_store)) return;
 uint32_t length = 0;
 if (obj->IsJSArray()) {
 JSArray::cast(*obj)->length()->ToArrayLength(&length);
 } else {
      length = static_cast<uint32_t>(store->length());
 }
 if ((entry > 0 && backing_store->is_the_hole(isolate, entry - 1)) ||
 (entry + 1 < length &&
         backing_store->is_the_hole(isolate, entry + 1))) {
 if (!obj->IsJSArray()) {
 uint32_t i;
 for (i = entry + 1; i < length; i++) {
 if (!backing_store->is_the_hole(isolate, i)) break;
 }
 if (i == length) {
 DeleteAtEnd(obj, backing_store, entry);
 return;
 }
 }
 int num_used = 0;
 for (int i = 0; i < backing_store->length(); ++i) {
 if (!backing_store->is_the_hole(isolate, i)) {
 ++num_used;
 if (4 * SeededNumberDictionary::ComputeCapacity(num_used) *
 SeededNumberDictionary::kEntrySize >
              backing_store->length()) {
 return;
 }
 }
 }
 JSObject::NormalizeElements(obj);
 }
 }

Project: Android

 static void DeleteFromArguments(Handle<JSObject> obj, uint32_t entry) {
 Handle<FixedArray> parameter_map(FixedArray::cast(obj->elements()));
 Handle<SeededNumberDictionary> dict(
 SeededNumberDictionary::cast(parameter_map->get(1)));
 uint32_t index = GetIndexForEntryImpl(*dict, entry);
 Handle<Object> result = SeededNumberDictionary::DeleteProperty(dict, entry);
    USE(result);
    DCHECK(result->IsTrue(dict->GetIsolate()));
 Handle<FixedArray> new_elements =
 SeededNumberDictionary::Shrink(dict, index);
    parameter_map->set(1, *new_elements);
 }

Project: Android

 static void DeleteFromArguments(Handle<JSObject> obj, uint32_t entry) {
 Handle<FixedArray> arguments =
 GetArguments(obj->GetIsolate(), obj->elements());
 FastHoleyObjectElementsAccessor::DeleteCommon(obj, entry, arguments);
 }

Project: Android

 static void DeleteImpl(Handle<JSObject> obj, uint32_t entry) {
 Handle<SeededNumberDictionary> dict(
 SeededNumberDictionary::cast(obj->elements()));
 uint32_t index = GetIndexForEntryImpl(*dict, entry);
 Handle<Object> result = SeededNumberDictionary::DeleteProperty(dict, entry);
    USE(result);
    DCHECK(result->IsTrue(dict->GetIsolate()));
 Handle<FixedArray> new_elements =
 SeededNumberDictionary::Shrink(dict, index);
    obj->set_elements(*new_elements);
 }

Project: Android

 static void DeleteImpl(Handle<JSObject> obj, uint32_t entry) {
    UNREACHABLE();
 }

Project: Android

 static void DeleteImpl(Handle<JSObject> obj, uint32_t entry) {
 FixedArray* parameter_map = FixedArray::cast(obj->elements());
 uint32_t length = static_cast<uint32_t>(parameter_map->length()) - 2;
 if (entry < length) {
      parameter_map->set_the_hole(entry + 2);
 } else {
 Subclass::DeleteFromArguments(obj, entry - length);
 }
 }

Project: Android

 static void DeleteImpl(Handle<JSObject> holder, uint32_t entry) {
 uint32_t length = static_cast<uint32_t>(GetString(*holder)->length());
 if (entry < length) {
 return; // String contents can't be deleted.
 }
 BackingStoreAccessor::DeleteImpl(holder, entry - length);
 }

Project: Android

 explicit DictionaryElementsAccessor(const char* name)
 : ElementsAccessorBase<DictionaryElementsAccessor,
 ElementsKindTraits<DICTIONARY_ELEMENTS> >(name) {}

Project: Android

 static Handle<FixedArray> DirectCollectElementIndicesImpl(
 Isolate* isolate, Handle<JSObject> object,
 Handle<FixedArrayBase> backing_store, GetKeysConversion convert,
 PropertyFilter filter, Handle<FixedArray> list, uint32_t* nof_indices,
 uint32_t insertion_index = 0) {
 if (filter & SKIP_STRINGS) return list;
 if (filter & ONLY_ALL_CAN_READ) return list;

 Handle<SeededNumberDictionary> dictionary =
 Handle<SeededNumberDictionary>::cast(backing_store);
 uint32_t capacity = dictionary->Capacity();
 for (uint32_t i = 0; i < capacity; i++) {
 uint32_t key = GetKeyForEntryImpl(isolate, dictionary, i, filter);
 if (key == kMaxUInt32) continue;
 Handle<Object> index = isolate->factory()->NewNumberFromUint(key);
 list->set(insertion_index, *index);
      insertion_index++;
 }
 *nof_indices = insertion_index;
 return list;
 }

Project: Android

 static Handle<FixedArray> DirectCollectElementIndicesImpl(
 Isolate* isolate, Handle<JSObject> object,
 Handle<FixedArrayBase> backing_store, GetKeysConversion convert,
 PropertyFilter filter, Handle<FixedArray> list, uint32_t* nof_indices,
 uint32_t insertion_index = 0) {
 Handle<FixedArray> parameter_map(FixedArray::cast(*backing_store), isolate);
 uint32_t length = parameter_map->length() - 2;

 for (uint32_t i = 0; i < length; ++i) {
 if (parameter_map->get(i + 2)->IsTheHole(isolate)) continue;
 if (convert == GetKeysConversion::kConvertToString) {
 Handle<String> index_string = isolate->factory()->Uint32ToString(i);
 list->set(insertion_index, *index_string);
 } else {
 list->set(insertion_index, Smi::FromInt(i), SKIP_WRITE_BARRIER);
 }
      insertion_index++;
 }

 Handle<FixedArrayBase> store(FixedArrayBase::cast(parameter_map->get(1)));
 return ArgumentsAccessor::DirectCollectElementIndicesImpl(
        isolate, object, store, convert, filter, list, nof_indices,
        insertion_index);
 }

Project: Android

 explicit FastDoubleElementsAccessor(const char* name)
 : FastElementsAccessor<Subclass, KindTraits>(name) {}

Project: Android

 explicit FastElementsAccessor(const char* name)
 : ElementsAccessorBase<Subclass, KindTraits>(name) {}

Project: Android

 explicit FastHoleyDoubleElementsAccessor(const char* name)
 : FastDoubleElementsAccessor<
 FastHoleyDoubleElementsAccessor,
 ElementsKindTraits<FAST_HOLEY_DOUBLE_ELEMENTS> >(name) {}

Project: Android

 explicit FastHoleyObjectElementsAccessor(const char* name)
 : FastSmiOrObjectElementsAccessor<
 FastHoleyObjectElementsAccessor,
 ElementsKindTraits<FAST_HOLEY_ELEMENTS> >(name) {}

Project: Android

 explicit FastHoleySmiElementsAccessor(const char* name)
 : FastSmiOrObjectElementsAccessor<
 FastHoleySmiElementsAccessor,
 ElementsKindTraits<FAST_HOLEY_SMI_ELEMENTS> >(name) {}

Project: Android

 explicit FastPackedDoubleElementsAccessor(const char* name)
 : FastDoubleElementsAccessor<
 FastPackedDoubleElementsAccessor,
 ElementsKindTraits<FAST_DOUBLE_ELEMENTS> >(name) {}

Project: Android

 explicit FastPackedObjectElementsAccessor(const char* name)
 : FastSmiOrObjectElementsAccessor<
 FastPackedObjectElementsAccessor,
 ElementsKindTraits<FAST_ELEMENTS> >(name) {}

Project: Android

 explicit FastSloppyArgumentsElementsAccessor(const char* name)
 : SloppyArgumentsElementsAccessor<
 FastSloppyArgumentsElementsAccessor,
 FastHoleyObjectElementsAccessor,
 ElementsKindTraits<FAST_SLOPPY_ARGUMENTS_ELEMENTS> >(name) {}

Project: Android

 explicit FastSmiOrObjectElementsAccessor(const char* name)
 : FastElementsAccessor<Subclass, KindTraits>(name) {}

Project: Android

 explicit FastStringWrapperElementsAccessor(const char* name)
 : StringWrapperElementsAccessor<
 FastStringWrapperElementsAccessor, FastHoleyObjectElementsAccessor,
 ElementsKindTraits<FAST_STRING_WRAPPER_ELEMENTS>>(name) {}

Project: Android

 static uint32_t FilterKey(Handle<SeededNumberDictionary> dictionary,
 int entry, Object* raw_key, PropertyFilter filter) {
    DCHECK(!dictionary->IsDeleted(entry));
    DCHECK(raw_key->IsNumber());
    DCHECK_LE(raw_key->Number(), kMaxUInt32);
 PropertyDetails details = dictionary->DetailsAt(entry);
 PropertyAttributes attr = details.attributes();
 if ((attr & filter) != 0) return kMaxUInt32;
 return static_cast<uint32_t>(raw_key->Number());
 }

Project: Android

 static Handle<FixedArray> GetArguments(Isolate* isolate,
 FixedArrayBase* backing_store) {
 FixedArray* parameter_map = FixedArray::cast(backing_store);
 return Handle<FixedArray>(FixedArray::cast(parameter_map->get(1)), isolate);
 }

Project: Android

 static uint32_t GetCapacityImpl(JSObject* holder,
 FixedArrayBase* backing_store) {
 return backing_store->length();
 }

Project: Android

 static uint32_t GetCapacityImpl(JSObject* holder,
 FixedArrayBase* backing_store) {
 if (WasNeutered(holder)) return 0;
 return backing_store->length();
 }

Project: Android

 static uint32_t GetCapacityImpl(JSObject* holder,
 FixedArrayBase* backing_store) {
 FixedArray* parameter_map = FixedArray::cast(backing_store);
 FixedArrayBase* arguments = FixedArrayBase::cast(parameter_map->get(1));
 return parameter_map->length() - 2 +
 ArgumentsAccessor::GetCapacityImpl(holder, arguments);
 }

Project: Android

 static PropertyDetails GetDetailsImpl(FixedArrayBase* backing_store,
 uint32_t entry) {
 return PropertyDetails(kData, NONE, 0, PropertyCellType::kNoCell);
 }

Project: Android

 static PropertyDetails GetDetailsImpl(JSObject* holder, uint32_t entry) {
 return PropertyDetails(kData, NONE, 0, PropertyCellType::kNoCell);
 }

Project: Android

 static PropertyDetails GetDetailsImpl(JSObject* holder, uint32_t entry) {
 return GetDetailsImpl(holder->elements(), entry);
 }

Project: Android

 static PropertyDetails GetDetailsImpl(JSObject* holder, uint32_t entry) {
 return PropertyDetails(kData, DONT_DELETE, 0, PropertyCellType::kNoCell);
 }

Project: Android

 static PropertyDetails GetDetailsImpl(FixedArrayBase* backing_store,
 uint32_t entry) {
 return PropertyDetails(kData, DONT_DELETE, 0, PropertyCellType::kNoCell);
 }

Project: Android

 static PropertyDetails GetDetailsImpl(JSObject* holder, uint32_t entry) {
 FixedArray* parameter_map = FixedArray::cast(holder->elements());
 uint32_t length = parameter_map->length() - 2;
 if (entry < length) {
 return PropertyDetails(kData, NONE, 0, PropertyCellType::kNoCell);
 }
 FixedArray* arguments = FixedArray::cast(parameter_map->get(1));
 return ArgumentsAccessor::GetDetailsImpl(arguments, entry - length);
 }

Project: Android

 static uint32_t GetEntryForIndexImpl(Isolate* isolate, JSObject* holder,
 FixedArrayBase* backing_store,
 uint32_t index, PropertyFilter filter) {
 uint32_t length = Subclass::GetMaxIndex(holder, backing_store);
 if (IsHoleyElementsKind(kind())) {
 return index < length &&
 !BackingStore::cast(backing_store)
 ->is_the_hole(isolate, index)
 ? index
 : kMaxUInt32;
 } else {
 return index < length ? index : kMaxUInt32;
 }
 }

Project: Android

 static uint32_t GetEntryForIndexImpl(Isolate* isolate, JSObject* holder,
 FixedArrayBase* store, uint32_t index,
 PropertyFilter filter) {
 DisallowHeapAllocation no_gc;
 SeededNumberDictionary* dictionary = SeededNumberDictionary::cast(store);
 int entry = dictionary->FindEntry(isolate, index);
 if (entry == SeededNumberDictionary::kNotFound) return kMaxUInt32;
 if (filter != ALL_PROPERTIES) {
 PropertyDetails details = dictionary->DetailsAt(entry);
 PropertyAttributes attr = details.attributes();
 if ((attr & filter) != 0) return kMaxUInt32;
 }
 return static_cast<uint32_t>(entry);
 }

Project: Android

 static uint32_t GetEntryForIndexImpl(Isolate* isolate, JSObject* holder,
 FixedArrayBase* backing_store,
 uint32_t index, PropertyFilter filter) {
 return index < AccessorClass::GetCapacityImpl(holder, backing_store)
 ? index
 : kMaxUInt32;
 }

Project: Android

 static uint32_t GetEntryForIndexImpl(Isolate* isolate, JSObject* holder,
 FixedArrayBase* parameters,
 uint32_t index, PropertyFilter filter) {
 FixedArray* parameter_map = FixedArray::cast(parameters);
 if (HasParameterMapArg(parameter_map, index)) return index;

 FixedArray* arguments = FixedArray::cast(parameter_map->get(1));
 uint32_t entry = ArgumentsAccessor::GetEntryForIndexImpl(
        isolate, holder, arguments, index, filter);
 if (entry == kMaxUInt32) return kMaxUInt32;
 return (parameter_map->length() - 2) + entry;
 }

Project: Android

 static Handle<Object> GetImpl(Isolate* isolate, FixedArrayBase* backing_store,
 uint32_t entry) {
 uint32_t index = GetIndexForEntryImpl(backing_store, entry);
 return handle(BackingStore::cast(backing_store)->get(index), isolate);
 }

Project: Android

 static Handle<Object> GetImpl(Isolate* isolate, FixedArrayBase* backing_store,
 uint32_t entry) {
 return handle(GetRaw(backing_store, entry), isolate);
 }

Project: Android

 static Handle<Object> GetImpl(Isolate* isolate, FixedArrayBase* backing_store,
 uint32_t entry) {
 return FixedDoubleArray::get(FixedDoubleArray::cast(backing_store), entry,
                                 isolate);
 }

Project: Android

 static Handle<Object> GetImpl(Isolate* isolate, FixedArrayBase* backing_store,
 uint32_t entry) {
 return BackingStore::get(BackingStore::cast(backing_store), entry);
 }

Project: Android

 static Handle<Object> GetImpl(Isolate* isolate, FixedArrayBase* parameters,
 uint32_t entry) {
 Handle<FixedArray> parameter_map(FixedArray::cast(parameters), isolate);
 uint32_t length = parameter_map->length() - 2;
 if (entry < length) {
 DisallowHeapAllocation no_gc;
 Object* probe = parameter_map->get(entry + 2);
 Context* context = Context::cast(parameter_map->get(0));
 int context_entry = Smi::cast(probe)->value();
      DCHECK(!context->get(context_entry)->IsTheHole(isolate));
 return handle(context->get(context_entry), isolate);
 } else {
 Handle<Object> result = ArgumentsAccessor::GetImpl(
          isolate, FixedArray::cast(parameter_map->get(1)), entry - length);
 if (result->IsAliasedArgumentsEntry()) {
 DisallowHeapAllocation no_gc;
 AliasedArgumentsEntry* alias = AliasedArgumentsEntry::cast(*result);
 Context* context = Context::cast(parameter_map->get(0));
 int context_entry = alias->aliased_context_slot();
        DCHECK(!context->get(context_entry)->IsTheHole(isolate));
 return handle(context->get(context_entry), isolate);
 }
 return result;
 }
 }

Project: Android

 static Handle<Object> GetImpl(Isolate* isolate, FixedArrayBase* elements,
 uint32_t entry) {
    UNREACHABLE();
 return Handle<Object>();
 }

Project: Android

 static uint32_t GetIndexForEntryImpl(FixedArrayBase* store, uint32_t entry) {
 DisallowHeapAllocation no_gc;
 SeededNumberDictionary* dict = SeededNumberDictionary::cast(store);
 uint32_t result = 0;
    CHECK(dict->KeyAt(entry)->ToArrayIndex(&result));
 return result;
 }

Project: Android

 static Handle<Object> GetInternalImpl(Handle<JSObject> holder,
 uint32_t entry) {
 return Subclass::GetImpl(holder->GetIsolate(), holder->elements(), entry);
 }

Project: Android

 static Handle<Object> GetInternalImpl(Handle<JSObject> holder,
 uint32_t entry) {
 return GetImpl(holder, entry);
 }

Project: Android

 static uint32_t GetKeyForEntryImpl(Isolate* isolate,
 Handle<SeededNumberDictionary> dictionary,
 int entry, PropertyFilter filter) {
 DisallowHeapAllocation no_gc;
 Object* raw_key = dictionary->KeyAt(entry);
 if (!dictionary->IsKey(isolate, raw_key)) return kMaxUInt32;
 return FilterKey(dictionary, entry, raw_key, filter);
 }

Project: Android

 static uint32_t GetMaxIndex(JSObject* receiver, FixedArrayBase* elements) {
 if (receiver->IsJSArray()) {
      DCHECK(JSArray::cast(receiver)->length()->IsSmi());
 return static_cast<uint32_t>(
 Smi::cast(JSArray::cast(receiver)->length())->value());
 }
 return Subclass::GetCapacityImpl(receiver, elements);
 }

Project: Android

 static uint32_t GetMaxIndex(JSObject* receiver, FixedArrayBase* elements) {
    UNREACHABLE();
 }

Project: Android

 static uint32_t GetMaxNumberOfEntries(JSObject* receiver,
 FixedArrayBase* elements) {
 return Subclass::GetMaxIndex(receiver, elements);
 }

Project: Android

 static uint32_t GetMaxNumberOfEntries(JSObject* receiver,
 FixedArrayBase* backing_store) {
 return NumberOfElementsImpl(receiver, backing_store);
 }

Project: Android

 static uint32_t GetMaxNumberOfEntries(JSObject* holder,
 FixedArrayBase* backing_store) {
 FixedArray* parameter_map = FixedArray::cast(backing_store);
 FixedArrayBase* arguments = FixedArrayBase::cast(parameter_map->get(1));
 return parameter_map->length() - 2 +
 ArgumentsAccessor::GetMaxNumberOfEntries(holder, arguments);
 }

Project: Android

 static Object* GetRaw(FixedArrayBase* store, uint32_t entry) {
 SeededNumberDictionary* backing_store = SeededNumberDictionary::cast(store);
 return backing_store->ValueAt(entry);
 }

Project: Android

 static Object* GetRaw(FixedArray* backing_store, uint32_t entry) {
 uint32_t index = Subclass::GetIndexForEntryImpl(backing_store, entry);
 return backing_store->get(index);
 }

Project: Android

 static String* GetString(JSObject* holder) {
    DCHECK(holder->IsJSValue());
 JSValue* js_value = JSValue::cast(holder);
    DCHECK(js_value->value()->IsString());
 return String::cast(js_value->value());
 }

Project: Android

 static void GrowCapacityAndConvertImpl(Handle<JSObject> object,
 uint32_t capacity) {
 ElementsKind from_kind = object->GetElementsKind();
 if (IsFastSmiOrObjectElementsKind(from_kind)) {
      object->GetIsolate()->UpdateArrayProtectorOnSetLength(object);
 }
 Handle<FixedArrayBase> old_elements(object->elements());
    DCHECK(IsFastDoubleElementsKind(from_kind) !=
 IsFastDoubleElementsKind(kind()) ||
 IsDictionaryElementsKind(from_kind) ||
 static_cast<uint32_t>(old_elements->length()) < capacity);
 Subclass::BasicGrowCapacityAndConvertImpl(object, old_elements, from_kind,
                                              kind(), capacity);
 }

Project: Android

 static void GrowCapacityAndConvertImpl(Handle<JSObject> object,
 uint32_t capacity) {
    UNREACHABLE();
 }

Project: Android

 static void GrowCapacityAndConvertImpl(Handle<JSObject> object,
 uint32_t capacity) {
 Handle<FixedArray> parameter_map(FixedArray::cast(object->elements()));
 Handle<FixedArray> old_elements(FixedArray::cast(parameter_map->get(1)));
 ElementsKind from_kind = object->GetElementsKind();
    DCHECK(from_kind == SLOW_SLOPPY_ARGUMENTS_ELEMENTS ||
 static_cast<uint32_t>(old_elements->length()) < capacity);
 Handle<FixedArrayBase> elements =
 ConvertElementsWithCapacity(object, old_elements, from_kind, capacity);
 Handle<Map> new_map = JSObject::GetElementsTransitionMap(
        object, FAST_SLOPPY_ARGUMENTS_ELEMENTS);
 JSObject::MigrateToMap(object, new_map);
    parameter_map->set(1, *elements);
 JSObject::ValidateElements(object);
 }

Project: Android

 static void GrowCapacityAndConvertImpl(Handle<JSObject> object,
 uint32_t capacity) {
 Handle<FixedArrayBase> old_elements(object->elements());
 ElementsKind from_kind = object->GetElementsKind();
    DCHECK(from_kind == SLOW_STRING_WRAPPER_ELEMENTS ||
 static_cast<uint32_t>(old_elements->length()) < capacity);
 Subclass::BasicGrowCapacityAndConvertImpl(object, old_elements, from_kind,
                                              FAST_STRING_WRAPPER_ELEMENTS,
                                              capacity);
 }

Project: Android

 static bool HasAccessorsImpl(JSObject* holder,
 FixedArrayBase* backing_store) {
 return false;
 }

Project: Android

 static bool HasAccessorsImpl(JSObject* holder,
 FixedArrayBase* backing_store) {
 DisallowHeapAllocation no_gc;
 SeededNumberDictionary* dict = SeededNumberDictionary::cast(backing_store);
 if (!dict->requires_slow_elements()) return false;
 int capacity = dict->Capacity();
 Isolate* isolate = dict->GetIsolate();
 for (int i = 0; i < capacity; i++) {
 Object* key = dict->KeyAt(i);
 if (!dict->IsKey(isolate, key)) continue;
      DCHECK(!dict->IsDeleted(i));
 PropertyDetails details = dict->DetailsAt(i);
 if (details.kind() == kAccessor) return true;
 }
 return false;
 }

Project: Android

 static bool HasAccessorsImpl(JSObject* holder,
 FixedArrayBase* backing_store) {
 FixedArray* parameter_map = FixedArray::cast(backing_store);
 FixedArrayBase* arguments = FixedArrayBase::cast(parameter_map->get(1));
 return ArgumentsAccessor::HasAccessorsImpl(holder, arguments);
 }

Project: Android

 static bool HasElementImpl(Isolate* isolate, Handle<JSObject> holder,
 uint32_t index,
 Handle<FixedArrayBase> backing_store,
 PropertyFilter filter) {
 return index < AccessorClass::GetCapacityImpl(*holder, *backing_store);
 }

Project: Android

 static bool HasEntryImpl(Isolate* isolate, FixedArrayBase* store,
 uint32_t entry) {
 DisallowHeapAllocation no_gc;
 SeededNumberDictionary* dict = SeededNumberDictionary::cast(store);
 Object* index = dict->KeyAt(entry);
 return !index->IsTheHole(isolate);
 }

Project: Android

 static bool HasEntryImpl(Isolate* isolate, FixedArrayBase* backing_store,
 uint32_t entry) {
 return !BackingStore::cast(backing_store)->is_the_hole(isolate, entry);
 }

Project: Android

 static bool HasEntryImpl(Isolate* isolate, FixedArrayBase* parameters,
 uint32_t entry) {
 FixedArray* parameter_map = FixedArray::cast(parameters);
 uint32_t length = parameter_map->length() - 2;
 if (entry < length) {
 return HasParameterMapArg(parameter_map, entry);
 }

 FixedArrayBase* arguments = FixedArrayBase::cast(parameter_map->get(1));
 return ArgumentsAccessor::HasEntryImpl(isolate, arguments, entry - length);
 }

Project: Android

 static bool IncludesValueFastPath(Isolate* isolate, Handle<JSObject> receiver,
 Handle<Object> value, uint32_t start_from,
 uint32_t length, Maybe<bool>* result) {
 DisallowHeapAllocation no_gc;
 SeededNumberDictionary* dictionary =
 SeededNumberDictionary::cast(receiver->elements());
 int capacity = dictionary->Capacity();
 Object* the_hole = isolate->heap()->the_hole_value();
 Object* undefined = isolate->heap()->undefined_value();

 bool found = false;
 for (int i = 0; i < capacity; ++i) {
 Object* k = dictionary->KeyAt(i);
 if (k == the_hole) continue;
 if (k == undefined) continue;

 uint32_t index;
 if (!k->ToArrayIndex(&index) || index < start_from || index >= length) {
 continue;
 }

 if (dictionary->DetailsAt(i).kind() == kAccessor) {
 return false;
 } else if (!found) {
 Object* element_k = dictionary->ValueAt(i);
 if (value->SameValueZero(element_k)) found = true;
 }
 }

 *result = Just(found);
 return true;
 }

Project: Android

 static Maybe<bool> IncludesValueImpl(Isolate* isolate,
 Handle<JSObject> receiver,
 Handle<Object> value,
 uint32_t start_from, uint32_t length) {
 return IncludesValueSlowPath(isolate, receiver, value, start_from, length);
 }

Project: Android

 static Maybe<bool> IncludesValueImpl(Isolate* isolate,
 Handle<JSObject> receiver,
 Handle<Object> search_value,
 uint32_t start_from, uint32_t length) {
    DCHECK(JSObject::PrototypeHasNoElements(isolate, *receiver));
 DisallowHeapAllocation no_gc;
 FixedArrayBase* elements_base = receiver->elements();
 Object* the_hole = isolate->heap()->the_hole_value();
 Object* undefined = isolate->heap()->undefined_value();
 Object* value = *search_value;

 if (value == undefined &&
 static_cast<uint32_t>(elements_base->length()) < length) {
 return Just(true);
 }

 if (start_from >= length) return Just(false);

    length = std::min(static_cast<uint32_t>(elements_base->length()), length);

 if (!value->IsNumber()) {
 if (value == undefined) {
 if (!IsFastObjectElementsKind(Subclass::kind()) &&
 !IsFastHoleyElementsKind(Subclass::kind())) {
 return Just(false);
 }

 if (IsFastSmiOrObjectElementsKind(Subclass::kind())) {
 auto elements = FixedArray::cast(receiver->elements());

 for (uint32_t k = start_from; k < length; ++k) {
 Object* element_k = elements->get(k);

 if (IsFastHoleyElementsKind(Subclass::kind()) &&
                element_k == the_hole) {
 return Just(true);
 }
 if (IsFastObjectElementsKind(Subclass::kind()) &&
                element_k == undefined) {
 return Just(true);
 }
 }
 return Just(false);
 } else {
          DCHECK_EQ(Subclass::kind(), FAST_HOLEY_DOUBLE_ELEMENTS);
 auto elements = FixedDoubleArray::cast(receiver->elements());

 for (uint32_t k = start_from; k < length; ++k) {
 if (IsFastHoleyElementsKind(Subclass::kind()) &&
                elements->is_the_hole(k)) {
 return Just(true);
 }
 }
 return Just(false);
 }
 } else if (!IsFastObjectElementsKind(Subclass::kind())) {
 return Just(false);
 } else {
        DCHECK(IsFastObjectElementsKind(Subclass::kind()));
 auto elements = FixedArray::cast(receiver->elements());

 for (uint32_t k = start_from; k < length; ++k) {
 Object* element_k = elements->get(k);
 if (IsFastHoleyElementsKind(Subclass::kind()) &&
              element_k == the_hole) {
 continue;
 }

 if (value->SameValueZero(element_k)) return Just(true);
 }
 return Just(false);
 }
 } else {
 if (!value->IsNaN()) {
 double search_value = value->Number();
 if (IsFastDoubleElementsKind(Subclass::kind())) {
 auto elements = FixedDoubleArray::cast(receiver->elements());

 for (uint32_t k = start_from; k < length; ++k) {
 if (IsFastHoleyElementsKind(Subclass::kind()) &&
                elements->is_the_hole(k)) {
 continue;
 }
 if (elements->get_scalar(k) == search_value) return Just(true);
 }
 return Just(false);
 } else {
 auto elements = FixedArray::cast(receiver->elements());

 for (uint32_t k = start_from; k < length; ++k) {
 Object* element_k = elements->get(k);
 if (element_k->IsNumber() && element_k->Number() == search_value) {
 return Just(true);
 }
 }
 return Just(false);
 }
 } else {
 if (IsFastSmiElementsKind(Subclass::kind())) return Just(false);

 if (IsFastDoubleElementsKind(Subclass::kind())) {
 auto elements = FixedDoubleArray::cast(receiver->elements());

 for (uint32_t k = start_from; k < length; ++k) {
 if (IsFastHoleyElementsKind(Subclass::kind()) &&
                elements->is_the_hole(k)) {
 continue;
 }
 if (std::isnan(elements->get_scalar(k))) return Just(true);
 }
 return Just(false);
 } else {
          DCHECK(IsFastSmiOrObjectElementsKind(Subclass::kind()));
 auto elements = FixedArray::cast(receiver->elements());

 for (uint32_t k = start_from; k < length; ++k) {
 if (elements->get(k)->IsNaN()) return Just(true);
 }
 return Just(false);
 }
 }
 }
 }

Project: Android

 static Maybe<bool> IncludesValueImpl(Isolate* isolate,
 Handle<JSObject> receiver,
 Handle<Object> value,
 uint32_t start_from, uint32_t length) {
    DCHECK(JSObject::PrototypeHasNoElements(isolate, *receiver));
 DisallowHeapAllocation no_gc;

 if (WasNeutered(*receiver)) {
 return Just(value->IsUndefined(isolate) && length > start_from);
 }

 BackingStore* elements = BackingStore::cast(receiver->elements());
 if (value->IsUndefined(isolate) &&
        length > static_cast<uint32_t>(elements->length())) {
 return Just(true);
 }
 if (!value->IsNumber()) return Just(false);

 double search_value = value->Number();

 if (!std::isfinite(search_value)) {
 if (AccessorClass::kind() < FLOAT32_ELEMENTS ||
 AccessorClass::kind() > FLOAT64_ELEMENTS) {
 return Just(false);
 }
 } else if (search_value < std::numeric_limits<ctype>::lowest() ||
               search_value > std::numeric_limits<ctype>::max()) {
 return Just(false);
 }

 if (static_cast<uint32_t>(elements->length()) < length) {
      length = elements->length();
 }

 if (!std::isnan(search_value)) {
 for (uint32_t k = start_from; k < length; ++k) {
 double element_k = elements->get_scalar(k);
 if (element_k == search_value) return Just(true);
 }
 return Just(false);
 } else {
 for (uint32_t k = start_from; k < length; ++k) {
 double element_k = elements->get_scalar(k);
 if (std::isnan(element_k)) return Just(true);
 }
 return Just(false);
 }
 }

Project: Android

static Maybe<bool> IncludesValueSlowPath(Isolate* isolate,
 Handle<JSObject> receiver,
 Handle<Object> value,
 uint32_t start_from, uint32_t length) {
 bool search_for_hole = value->IsUndefined(isolate);
 for (uint32_t k = start_from; k < length; ++k) {
 LookupIterator it(isolate, receiver, k);
 if (!it.IsFound()) {
 if (search_for_hole) return Just(true);
 continue;
 }
 Handle<Object> element_k;
    ASSIGN_RETURN_ON_EXCEPTION_VALUE(isolate, element_k,
 Object::GetProperty(&it), Nothing<bool>());

 if (value->SameValueZero(*element_k)) return Just(true);
 }

 return Just(false);
}

Project: Android

 static Maybe<int64_t> IndexOfValueImpl(Isolate* isolate,
 Handle<JSObject> receiver,
 Handle<Object> value,
 uint32_t start_from, uint32_t length) {
 return IndexOfValueSlowPath(isolate, receiver, value, start_from, length);
 }

Project: Android

 static Maybe<int64_t> IndexOfValueImpl(Isolate* isolate,
 Handle<JSObject> receiver,
 Handle<Object> search_value,
 uint32_t start_from, uint32_t length) {
    DCHECK(JSObject::PrototypeHasNoElements(isolate, *receiver));
 DisallowHeapAllocation no_gc;
 FixedArrayBase* elements_base = receiver->elements();
 Object* value = *search_value;

 if (start_from >= length) return Just<int64_t>(-1);

    length = std::min(static_cast<uint32_t>(elements_base->length()), length);

 if (!value->IsNumber() && !IsFastObjectElementsKind(Subclass::kind())) {
 return Just<int64_t>(-1);
 }
 if (value->IsNaN()) return Just<int64_t>(-1);

 FixedArray* elements = FixedArray::cast(receiver->elements());
 for (uint32_t k = start_from; k < length; ++k) {
 if (value->StrictEquals(elements->get(k))) return Just<int64_t>(k);
 }
 return Just<int64_t>(-1);
 }

Project: Android

 static Maybe<int64_t> IndexOfValueImpl(Isolate* isolate,
 Handle<JSObject> receiver,
 Handle<Object> search_value,
 uint32_t start_from, uint32_t length) {
    DCHECK(JSObject::PrototypeHasNoElements(isolate, *receiver));
 DisallowHeapAllocation no_gc;
 FixedArrayBase* elements_base = receiver->elements();
 Object* value = *search_value;

    length = std::min(static_cast<uint32_t>(elements_base->length()), length);

 if (start_from >= length) return Just<int64_t>(-1);

 if (!value->IsNumber()) {
 return Just<int64_t>(-1);
 }
 if (value->IsNaN()) {
 return Just<int64_t>(-1);
 }
 double numeric_search_value = value->Number();
 FixedDoubleArray* elements = FixedDoubleArray::cast(receiver->elements());

 for (uint32_t k = start_from; k < length; ++k) {
 if (elements->is_the_hole(k)) {
 continue;
 }
 if (elements->get_scalar(k) == numeric_search_value) {
 return Just<int64_t>(k);
 }
 }
 return Just<int64_t>(-1);
 }

Project: Android

 static Maybe<int64_t> IndexOfValueImpl(Isolate* isolate,
 Handle<JSObject> receiver,
 Handle<Object> value,
 uint32_t start_from, uint32_t length) {
    DCHECK(JSObject::PrototypeHasNoElements(isolate, *receiver));
 DisallowHeapAllocation no_gc;

 if (WasNeutered(*receiver)) return Just<int64_t>(-1);

 BackingStore* elements = BackingStore::cast(receiver->elements());
 if (!value->IsNumber()) return Just<int64_t>(-1);

 double search_value = value->Number();

 if (!std::isfinite(search_value)) {
 if (AccessorClass::kind() < FLOAT32_ELEMENTS ||
 AccessorClass::kind() > FLOAT64_ELEMENTS) {
 return Just<int64_t>(-1);
 }
 } else if (search_value < std::numeric_limits<ctype>::lowest() ||
               search_value > std::numeric_limits<ctype>::max()) {
 return Just<int64_t>(-1);
 }

 if (static_cast<uint32_t>(elements->length()) < length) {
      length = elements->length();
 }

 if (std::isnan(search_value)) {
 return Just<int64_t>(-1);
 }

    ctype typed_search_value = static_cast<ctype>(search_value);
 if (static_cast<double>(typed_search_value) != search_value) {
 return Just<int64_t>(-1); // Loss of precision.
 }

 for (uint32_t k = start_from; k < length; ++k) {
      ctype element_k = elements->get_scalar(k);
 if (element_k == typed_search_value) return Just<int64_t>(k);
 }
 return Just<int64_t>(-1);
 }

Project: Android

static Maybe<int64_t> IndexOfValueSlowPath(Isolate* isolate,
 Handle<JSObject> receiver,
 Handle<Object> value,
 uint32_t start_from,
 uint32_t length) {
 for (uint32_t k = start_from; k < length; ++k) {
 LookupIterator it(isolate, receiver, k);
 if (!it.IsFound()) {
 continue;
 }
 Handle<Object> element_k;
    ASSIGN_RETURN_ON_EXCEPTION_VALUE(
        isolate, element_k, Object::GetProperty(&it), Nothing<int64_t>());

 if (value->StrictEquals(*element_k)) return Just<int64_t>(k);
 }


   return Just<int64_t>(-1);
 }

Project: Android

void ElementsAccessor::InitializeOncePerProcess() {
 static ElementsAccessor* accessor_array[] = {
#define ACCESSOR_ARRAY(Class, Kind, Store) new Class(#Kind),
      ELEMENTS_LIST(ACCESSOR_ARRAY)
#undef ACCESSOR_ARRAY
 };

  STATIC_ASSERT((sizeof(accessor_array) / sizeof(*accessor_array)) ==
                kElementsKindCount);

  elements_accessors_ = accessor_array;
}

Project: Android

 static void MoveElements(Isolate* isolate, Handle<JSArray> receiver,
 Handle<FixedArrayBase> backing_store, int dst_index,
 int src_index, int len, int hole_start,
 int hole_end) {
 Heap* heap = isolate->heap();
 Handle<BackingStore> dst_elms = Handle<BackingStore>::cast(backing_store);
 if (heap->CanMoveObjectStart(*dst_elms) && dst_index == 0) {
 *dst_elms.location() =
 BackingStore::cast(heap->LeftTrimFixedArray(*dst_elms, src_index));
      receiver->set_elements(*dst_elms);
      hole_end -= src_index;
      DCHECK_LE(hole_start, backing_store->length());
      DCHECK_LE(hole_end, backing_store->length());
 } else if (len != 0) {
 if (IsFastDoubleElementsKind(KindTraits::Kind)) {
 MemMove(dst_elms->data_start() + dst_index,
                dst_elms->data_start() + src_index, len * kDoubleSize);
 } else {
 DisallowHeapAllocation no_gc;
        heap->MoveElements(FixedArray::cast(*dst_elms), dst_index, src_index,
                           len);
 }
 }
 if (hole_start != hole_end) {
      dst_elms->FillWithHoles(hole_start, hole_end);
 }
 }

Project: Android

 static Handle<SeededNumberDictionary> NormalizeImpl(
 Handle<JSObject> object, Handle<FixedArrayBase> elements) {
    UNREACHABLE();
 return Handle<SeededNumberDictionary>();
 }

Project: Android

 static Handle<SeededNumberDictionary> NormalizeImpl(
 Handle<JSObject> object, Handle<FixedArrayBase> store) {
 Isolate* isolate = store->GetIsolate();
 ElementsKind kind = Subclass::kind();

 if (IsFastSmiOrObjectElementsKind(kind)) {
      isolate->UpdateArrayProtectorOnNormalizeElements(object);
 }

 int capacity = object->GetFastElementsUsage();
 Handle<SeededNumberDictionary> dictionary =
 SeededNumberDictionary::New(isolate, capacity);

 PropertyDetails details = PropertyDetails::Empty();
 int j = 0;
 for (int i = 0; j < capacity; i++) {
 if (IsHoleyElementsKind(kind)) {
 if (BackingStore::cast(*store)->is_the_hole(isolate, i)) continue;
 }
 Handle<Object> value = Subclass::GetImpl(isolate, *store, i);
      dictionary = SeededNumberDictionary::AddNumberEntry(dictionary, i, value,
                                                          details, object);
      j++;
 }
 return dictionary;
 }

Project: Android

 static Handle<SeededNumberDictionary> NormalizeImpl(
 Handle<JSObject> object, Handle<FixedArrayBase> elements) {
 Handle<FixedArray> arguments =
 GetArguments(elements->GetIsolate(), *elements);
 return FastHoleyObjectElementsAccessor::NormalizeImpl(object, arguments);
 }

Project: Android

 static Handle<SeededNumberDictionary> NormalizeImpl(
 Handle<JSObject> object, Handle<FixedArrayBase> elements) {
 return FastHoleyObjectElementsAccessor::NormalizeImpl(object, elements);
 }

Project: Android

 static uint32_t NumberOfElementsImpl(JSObject* receiver,
 FixedArrayBase* backing_store) {
    UNREACHABLE();
 }

Project: Android

 static uint32_t NumberOfElementsImpl(JSObject* receiver,
 FixedArrayBase* backing_store) {
 SeededNumberDictionary* dict = SeededNumberDictionary::cast(backing_store);
 return dict->NumberOfElements();
 }

Project: Android

 static uint32_t NumberOfElementsImpl(JSObject* receiver,
 FixedArrayBase* backing_store) {
 uint32_t max_index = Subclass::GetMaxIndex(receiver, backing_store);
 if (IsFastPackedElementsKind(Subclass::kind())) return max_index;
 Isolate* isolate = receiver->GetIsolate();
 uint32_t count = 0;
 for (uint32_t i = 0; i < max_index; i++) {
 if (Subclass::HasEntryImpl(isolate, backing_store, i)) count++;
 }
 return count;
 }

Project: Android

 static uint32_t NumberOfElementsImpl(JSObject* receiver,
 FixedArrayBase* backing_store) {
 FixedArray* parameter_map = FixedArray::cast(backing_store);
 FixedArrayBase* arguments = FixedArrayBase::cast(parameter_map->get(1));
 uint32_t nof_elements = 0;
 uint32_t length = parameter_map->length() - 2;
 for (uint32_t entry = 0; entry < length; entry++) {
 if (HasParameterMapArg(parameter_map, entry)) nof_elements++;
 }
 return nof_elements +
 ArgumentsAccessor::NumberOfElementsImpl(receiver, arguments);
 }

Project: Android

 static uint32_t NumberOfElementsImpl(JSObject* object,
 FixedArrayBase* backing_store) {
 uint32_t length = GetString(object)->length();
 return length +
 BackingStoreAccessor::NumberOfElementsImpl(object, backing_store);
 }

Project: Android

 static Handle<Object> PopImpl(Handle<JSArray> receiver) {
    UNREACHABLE();
 return Handle<Object>();
 }

Project: Android

 static Handle<Object> PopImpl(Handle<JSArray> receiver) {
 return Subclass::RemoveElement(receiver, AT_END);
 }

Project: Android

 static MaybeHandle<FixedArray> PrependElementIndicesImpl(
 Handle<JSObject> object, Handle<FixedArrayBase> backing_store,
 Handle<FixedArray> keys, GetKeysConversion convert,
 PropertyFilter filter) {
 Isolate* isolate = object->GetIsolate();
 uint32_t nof_property_keys = keys->length();
 uint32_t initial_list_length =
 Subclass::GetMaxNumberOfEntries(*object, *backing_store);

    initial_list_length += nof_property_keys;
 if (initial_list_length > FixedArray::kMaxLength ||
        initial_list_length < nof_property_keys) {
 return isolate->Throw<FixedArray>(isolate->factory()->NewRangeError(
 MessageTemplate::kInvalidArrayLength));
 }

 MaybeHandle<FixedArray> raw_array =
        isolate->factory()->TryNewFixedArray(initial_list_length);
 Handle<FixedArray> combined_keys;

 if (!raw_array.ToHandle(&combined_keys)) {
 if (IsHoleyElementsKind(kind())) {
        initial_list_length =
 Subclass::NumberOfElementsImpl(*object, *backing_store);
        initial_list_length += nof_property_keys;
 }
      combined_keys = isolate->factory()->NewFixedArray(initial_list_length);
 }

 uint32_t nof_indices = 0;
 bool needs_sorting =
 IsDictionaryElementsKind(kind()) || IsSloppyArgumentsElements(kind());
    combined_keys = Subclass::DirectCollectElementIndicesImpl(
        isolate, object, backing_store,
        needs_sorting ? GetKeysConversion::kKeepNumbers : convert, filter,
        combined_keys, &nof_indices);

 if (needs_sorting) {
 SortIndices(combined_keys, nof_indices);
 if (convert == GetKeysConversion::kConvertToString) {
 for (uint32_t i = 0; i < nof_indices; i++) {
 Handle<Object> index_string = isolate->factory()->Uint32ToString(
              combined_keys->get(i)->Number());
          combined_keys->set(i, *index_string);
 }
 }
 }

 CopyObjectToObjectElements(*keys, FAST_ELEMENTS, 0, *combined_keys,
                               FAST_ELEMENTS, nof_indices, nof_property_keys);

 if (IsHoleyElementsKind(kind()) || IsSloppyArgumentsElements(kind())) {
 int final_size = nof_indices + nof_property_keys;
      DCHECK_LE(final_size, combined_keys->length());
      combined_keys->Shrink(final_size);
 }

 return combined_keys;
 }

Project: Android

 static uint32_t PushImpl(Handle<JSArray> receiver, Arguments* args,
 uint32_t push_sized) {
    UNREACHABLE();
 return 0;
 }

Project: Android

 static uint32_t PushImpl(Handle<JSArray> receiver,
 Arguments* args, uint32_t push_size) {
 Handle<FixedArrayBase> backing_store(receiver->elements());
 return Subclass::AddArguments(receiver, backing_store, args, push_size,
                                  AT_END);
 }

Project: Android

 static void ReconfigureImpl(Handle<JSObject> object,
 Handle<FixedArrayBase> store, uint32_t entry,
 Handle<Object> value,
 PropertyAttributes attributes) {
    UNREACHABLE();
 }

Project: Android

 static void ReconfigureImpl(Handle<JSObject> object,
 Handle<FixedArrayBase> store, uint32_t entry,
 Handle<Object> value,
 PropertyAttributes attributes) {
 SeededNumberDictionary* dictionary = SeededNumberDictionary::cast(*store);
 if (attributes != NONE) object->RequireSlowElements(dictionary);
    dictionary->ValueAtPut(entry, *value);
 PropertyDetails details = dictionary->DetailsAt(entry);
    details = PropertyDetails(kData, attributes, details.dictionary_index(),
 PropertyCellType::kNoCell);
    dictionary->DetailsAtPut(entry, details);
 }

Project: Android

 static void ReconfigureImpl(Handle<JSObject> object,
 Handle<FixedArrayBase> store, uint32_t entry,
 Handle<Object> value,
 PropertyAttributes attributes) {
 Handle<SeededNumberDictionary> dictionary =
 JSObject::NormalizeElements(object);
    entry = dictionary->FindEntry(entry);
 DictionaryElementsAccessor::ReconfigureImpl(object, dictionary, entry,
                                                value, attributes);
 }

Project: Android

 static void ReconfigureImpl(Handle<JSObject> object,
 Handle<FixedArrayBase> store, uint32_t entry,
 Handle<Object> value,
 PropertyAttributes attributes) {
 Handle<FixedArray> parameter_map = Handle<FixedArray>::cast(store);
 uint32_t length = parameter_map->length() - 2;
 Isolate* isolate = store->GetIsolate();
 if (entry < length) {
 Object* probe = parameter_map->get(entry + 2);
      DCHECK(!probe->IsTheHole(isolate));
 Context* context = Context::cast(parameter_map->get(0));
 int context_entry = Smi::cast(probe)->value();
      DCHECK(!context->get(context_entry)->IsTheHole(isolate));
      context->set(context_entry, *value);

      parameter_map->set_the_hole(isolate, entry + 2);
 if ((attributes & READ_ONLY) == 0) {
        value = isolate->factory()->NewAliasedArgumentsEntry(context_entry);
 }

 PropertyDetails details(kData, attributes, 0, PropertyCellType::kNoCell);
 Handle<SeededNumberDictionary> arguments(
 SeededNumberDictionary::cast(parameter_map->get(1)), isolate);
      arguments = SeededNumberDictionary::AddNumberEntry(
          arguments, entry, value, details, object);
      DCHECK_NE(NONE, attributes);
      object->RequireSlowElements(*arguments);
      parameter_map->set(1, *arguments);
 } else {
 Handle<FixedArrayBase> arguments(
 FixedArrayBase::cast(parameter_map->get(1)), isolate);
 DictionaryElementsAccessor::ReconfigureImpl(
          object, arguments, entry - length, value, attributes);
 }
 }

Project: Android

 static void ReconfigureImpl(Handle<JSObject> object,
 Handle<FixedArrayBase> store, uint32_t entry,
 Handle<Object> value,
 PropertyAttributes attributes) {
 Handle<SeededNumberDictionary> dictionary =
 JSObject::NormalizeElements(object);
 FixedArray::cast(*store)->set(1, *dictionary);
 uint32_t length = static_cast<uint32_t>(store->length()) - 2;
 if (entry >= length) {
      entry = dictionary->FindEntry(entry - length) + length;
 }
 SlowSloppyArgumentsElementsAccessor::ReconfigureImpl(object, store, entry,
                                                         value, attributes);
 }

Project: Android

 static void ReconfigureImpl(Handle<JSObject> object,
 Handle<FixedArrayBase> store, uint32_t entry,
 Handle<Object> value,
 PropertyAttributes attributes) {
 uint32_t length = static_cast<uint32_t>(GetString(*object)->length());
 if (entry < length) {
 return; // String contents can't be reconfigured.
 }
 BackingStoreAccessor::ReconfigureImpl(object, store, entry - length, value,
                                          attributes);
 }

Project: Android

 static Handle<Object> RemoveElement(Handle<JSArray> receiver,
 Where remove_position) {
 Isolate* isolate = receiver->GetIsolate();
 ElementsKind kind = KindTraits::Kind;
 if (IsFastSmiOrObjectElementsKind(kind)) {
 HandleScope scope(isolate);
 JSObject::EnsureWritableFastElements(receiver);
 }
 Handle<FixedArrayBase> backing_store(receiver->elements(), isolate);
 uint32_t length =
 static_cast<uint32_t>(Smi::cast(receiver->length())->value());
    DCHECK(length > 0);
 int new_length = length - 1;
 int remove_index = remove_position == AT_START ? 0 : new_length;
 Handle<Object> result =
 Subclass::GetImpl(isolate, *backing_store, remove_index);
 if (remove_position == AT_START) {
 Subclass::MoveElements(isolate, receiver, backing_store, 0, 1, new_length,
 0, 0);
 }
 Subclass::SetLengthImpl(isolate, receiver, new_length, backing_store);

 if (IsHoleyElementsKind(kind) && result->IsTheHole(isolate)) {
 return isolate->factory()->undefined_value();
 }
 return result;
 }

Project: Android

 static inline void SetImpl(Handle<JSObject> holder, uint32_t entry,
 Object* value) {
 SetImpl(holder->elements(), entry, value);
 }

Project: Android

 static inline void SetImpl(FixedArrayBase* backing_store, uint32_t entry,
 Object* value) {
 SeededNumberDictionary::cast(backing_store)->ValueAtPut(entry, value);
 }

Project: Android

 static inline void SetImpl(FixedArrayBase* backing_store, uint32_t entry,
 Object* value) {
 FixedArray::cast(backing_store)->set(entry, value);
 }

Project: Android

 static inline void SetImpl(FixedArrayBase* backing_store, uint32_t entry,
 Object* value, WriteBarrierMode mode) {
 FixedArray::cast(backing_store)->set(entry, value, mode);
 }

Project: Android

 static inline void SetImpl(FixedArrayBase* backing_store, uint32_t entry,
 Object* value) {
 FixedDoubleArray::cast(backing_store)->set(entry, value->Number());
 }

Project: Android

 static inline void SetImpl(FixedArrayBase* backing_store, uint32_t entry,
 Object* value, WriteBarrierMode mode) {
 FixedDoubleArray::cast(backing_store)->set(entry, value->Number());
 }

Project: Android

 static inline void SetImpl(FixedArrayBase* backing_store, uint32_t entry,
 Object* value) {
 BackingStore::cast(backing_store)->SetValue(entry, value);
 }

Project: Android

 static inline void SetImpl(FixedArrayBase* backing_store, uint32_t entry,
 Object* value, WriteBarrierMode mode) {
 BackingStore::cast(backing_store)->SetValue(entry, value);
 }

Project: Android

 static inline void SetImpl(FixedArrayBase* store, uint32_t entry,
 Object* value) {
 FixedArray* parameter_map = FixedArray::cast(store);
 uint32_t length = parameter_map->length() - 2;
 if (entry < length) {
 Object* probe = parameter_map->get(entry + 2);
 Context* context = Context::cast(parameter_map->get(0));
 int context_entry = Smi::cast(probe)->value();
      DCHECK(!context->get(context_entry)->IsTheHole(store->GetIsolate()));
      context->set(context_entry, value);
 } else {
 FixedArray* arguments = FixedArray::cast(parameter_map->get(1));
 Object* current = ArgumentsAccessor::GetRaw(arguments, entry - length);
 if (current->IsAliasedArgumentsEntry()) {
 AliasedArgumentsEntry* alias = AliasedArgumentsEntry::cast(current);
 Context* context = Context::cast(parameter_map->get(0));
 int context_entry = alias->aliased_context_slot();
        DCHECK(!context->get(context_entry)->IsTheHole(store->GetIsolate()));
        context->set(context_entry, value);
 } else {
 ArgumentsAccessor::SetImpl(arguments, entry - length, value);
 }
 }
 }

Project: Android

 static void SetImpl(Handle<JSObject> holder, uint32_t entry, Object* value) {
 uint32_t length = static_cast<uint32_t>(GetString(*holder)->length());
 if (entry < length) {
 return; // String contents are read-only.
 }
 BackingStoreAccessor::SetImpl(holder->elements(), entry - length, value);
 }

Project: Android

 static void SetLengthImpl(Isolate* isolate, Handle<JSArray> array,
 uint32_t length,
 Handle<FixedArrayBase> backing_store) {
    DCHECK(!array->SetLengthWouldNormalize(length));
    DCHECK(IsFastElementsKind(array->GetElementsKind()));
 uint32_t old_length = 0;
    CHECK(array->length()->ToArrayIndex(&old_length));

 if (old_length < length) {
 ElementsKind kind = array->GetElementsKind();
 if (!IsFastHoleyElementsKind(kind)) {
        kind = GetHoleyElementsKind(kind);
 JSObject::TransitionElementsKind(array, kind);
 }
 }

 uint32_t capacity = backing_store->length();
    old_length = Min(old_length, capacity);
 if (length == 0) {
      array->initialize_elements();
 } else if (length <= capacity) {
 if (IsFastSmiOrObjectElementsKind(kind())) {
 JSObject::EnsureWritableFastElements(array);
 if (array->elements() != *backing_store) {
          backing_store = handle(array->elements(), isolate);
 }
 }
 if (2 * length <= capacity) {
        isolate->heap()->RightTrimFixedArray(*backing_store, capacity - length);
 } else {
 BackingStore::cast(*backing_store)->FillWithHoles(length, old_length);
 }
 } else {
      capacity = Max(length, JSObject::NewElementsCapacity(capacity));
 Subclass::GrowCapacityAndConvertImpl(array, capacity);
 }

    array->set_length(Smi::FromInt(length));
 JSObject::ValidateElements(array);
 }

Project: Android

 static void SetLengthImpl(Isolate* isolate, Handle<JSArray> array,
 uint32_t length,
 Handle<FixedArrayBase> backing_store) {
 Handle<SeededNumberDictionary> dict =
 Handle<SeededNumberDictionary>::cast(backing_store);
 int capacity = dict->Capacity();
 uint32_t old_length = 0;
    CHECK(array->length()->ToArrayLength(&old_length));
 if (length < old_length) {
 if (dict->requires_slow_elements()) {
 for (int entry = 0; entry < capacity; entry++) {
 DisallowHeapAllocation no_gc;
 Object* index = dict->KeyAt(entry);
 if (index->IsNumber()) {
 uint32_t number = static_cast<uint32_t>(index->Number());
 if (length <= number && number < old_length) {
 PropertyDetails details = dict->DetailsAt(entry);
 if (!details.IsConfigurable()) length = number + 1;
 }
 }
 }
 }

 if (length == 0) {
 JSObject::ResetElements(array);
 } else {
 DisallowHeapAllocation no_gc;
 int removed_entries = 0;
 Handle<Object> the_hole_value = isolate->factory()->the_hole_value();
 for (int entry = 0; entry < capacity; entry++) {
 Object* index = dict->KeyAt(entry);
 if (index->IsNumber()) {
 uint32_t number = static_cast<uint32_t>(index->Number());
 if (length <= number && number < old_length) {
              dict->SetEntry(entry, the_hole_value, the_hole_value);
              removed_entries++;
 }
 }
 }

        dict->ElementsRemoved(removed_entries);
 }
 }

 Handle<Object> length_obj = isolate->factory()->NewNumberFromUint(length);
    array->set_length(*length_obj);
 }

Project: Android

 static void SetLengthImpl(Isolate* isolate, Handle<JSArray> array,
 uint32_t length,
 Handle<FixedArrayBase> backing_store) {
    UNREACHABLE();
 }

Project: Android

 static void SetLengthImpl(Isolate* isolate, Handle<JSArray> array,
 uint32_t length,
 Handle<FixedArrayBase> parameter_map) {
    UNREACHABLE();
 }

Project: Android

 static Handle<Object> ShiftImpl(Handle<JSArray> receiver) {
    UNREACHABLE();
 return Handle<Object>();
 }

Project: Android

 static Handle<Object> ShiftImpl(Handle<JSArray> receiver) {
 return Subclass::RemoveElement(receiver, AT_START);
 }

Project: Android

 static Handle<JSArray> SliceImpl(Handle<JSObject> receiver,
 uint32_t start, uint32_t end) {
    UNREACHABLE();
 return Handle<JSArray>();
 }

Project: Android

 static Handle<JSArray> SliceImpl(Handle<JSObject> receiver,
 uint32_t start, uint32_t end) {
 Isolate* isolate = receiver->GetIsolate();
 Handle<FixedArrayBase> backing_store(receiver->elements(), isolate);
 int result_len = end < start ? 0u : end - start;
 Handle<JSArray> result_array = isolate->factory()->NewJSArray(
 KindTraits::Kind, result_len, result_len);
 DisallowHeapAllocation no_gc;
 Subclass::CopyElementsImpl(*backing_store, start, result_array->elements(),
 KindTraits::Kind, 0, kPackedSizeNotKnown,
                               result_len);
 Subclass::TryTransitionResultArrayToPacked(result_array);
 return result_array;
 }

Project: Android

 static Handle<JSArray> SliceImpl(Handle<JSObject> receiver, uint32_t start,
 uint32_t end) {
 Isolate* isolate = receiver->GetIsolate();
 uint32_t result_len = end < start ? 0u : end - start;
 Handle<JSArray> result_array = isolate->factory()->NewJSArray(
        FAST_HOLEY_ELEMENTS, result_len, result_len);
 DisallowHeapAllocation no_gc;
 FixedArray* elements = FixedArray::cast(result_array->elements());
 FixedArray* parameters = FixedArray::cast(receiver->elements());
 uint32_t insertion_index = 0;
 for (uint32_t i = start; i < end; i++) {
 uint32_t entry = GetEntryForIndexImpl(isolate, *receiver, parameters, i,
                                            ALL_PROPERTIES);
 if (entry != kMaxUInt32 && HasEntryImpl(isolate, parameters, entry)) {
        elements->set(insertion_index, *GetImpl(isolate, parameters, entry));
 } else {
        elements->set_the_hole(isolate, insertion_index);
 }
      insertion_index++;
 }
 return result_array;
 }

Project: Android

 explicit SloppyArgumentsElementsAccessor(const char* name)
 : ElementsAccessorBase<Subclass, KindTraits>(name) {
    USE(KindTraits::Kind);
 }

Project: Android

 explicit SlowSloppyArgumentsElementsAccessor(const char* name)
 : SloppyArgumentsElementsAccessor<
 SlowSloppyArgumentsElementsAccessor, DictionaryElementsAccessor,
 ElementsKindTraits<SLOW_SLOPPY_ARGUMENTS_ELEMENTS> >(name) {}

Project: Android

 explicit SlowStringWrapperElementsAccessor(const char* name)
 : StringWrapperElementsAccessor<
 SlowStringWrapperElementsAccessor, DictionaryElementsAccessor,
 ElementsKindTraits<SLOW_STRING_WRAPPER_ELEMENTS>>(name) {}

Project: Android

static void SortIndices(
 Handle<FixedArray> indices, uint32_t sort_size,
 WriteBarrierMode write_barrier_mode = UPDATE_WRITE_BARRIER) {
 struct {
 bool operator()(Object* a, Object* b) {
 if (a->IsSmi() || !a->IsUndefined(HeapObject::cast(a)->GetIsolate())) {
 if (!b->IsSmi() && b->IsUndefined(HeapObject::cast(b)->GetIsolate())) {
 return true;
 }
 return a->Number() < b->Number();
 }
 return !b->IsSmi() && b->IsUndefined(HeapObject::cast(b)->GetIsolate());
 }
 } cmp;
 Object** start =
 reinterpret_cast<Object**>(indices->GetFirstElementAddress());
  std::sort(start, start + sort_size, cmp);
 if (write_barrier_mode != SKIP_WRITE_BARRIER) {
    FIXED_ARRAY_ELEMENTS_WRITE_BARRIER(indices->GetIsolate()->heap(), *indices,
 0, sort_size);
 }
}

Project: Android

 static Handle<FixedArrayBase> SpliceGrowStep(
 Isolate* isolate, Handle<JSArray> receiver,
 Handle<FixedArrayBase> backing_store, uint32_t start,
 uint32_t delete_count, uint32_t add_count, uint32_t length,
 uint32_t new_length) {
    DCHECK((add_count - delete_count) <= (Smi::kMaxValue - length));
 if (new_length <= static_cast<uint32_t>(backing_store->length())) {
 Subclass::MoveElements(isolate, receiver, backing_store,
                             start + add_count, start + delete_count,
 (length - delete_count - start), 0, 0);
 return backing_store;
 }
 int capacity = JSObject::NewElementsCapacity(new_length);
 Handle<FixedArrayBase> new_elms = Subclass::ConvertElementsWithCapacity(
        receiver, backing_store, KindTraits::Kind, capacity, start);
 Subclass::CopyElementsImpl(*backing_store, start + delete_count, *new_elms,
 KindTraits::Kind, start + add_count,
                               kPackedSizeNotKnown,
 ElementsAccessor::kCopyToEndAndInitializeToHole);
    receiver->set_elements(*new_elms);
 return new_elms;
 }

Project: Android

 static Handle<JSArray> SpliceImpl(Handle<JSArray> receiver,
 uint32_t start, uint32_t delete_count,
 Arguments* args, uint32_t add_count) {
 Isolate* isolate = receiver->GetIsolate();
 Heap* heap = isolate->heap();
 uint32_t length = Smi::cast(receiver->length())->value();
 uint32_t new_length = length - delete_count + add_count;

 ElementsKind kind = KindTraits::Kind;
 if (new_length <= static_cast<uint32_t>(receiver->elements()->length()) &&
 IsFastSmiOrObjectElementsKind(kind)) {
 HandleScope scope(isolate);
 JSObject::EnsureWritableFastElements(receiver);
 }

 Handle<FixedArrayBase> backing_store(receiver->elements(), isolate);

 if (new_length == 0) {
      receiver->set_elements(heap->empty_fixed_array());
      receiver->set_length(Smi::kZero);
 return isolate->factory()->NewJSArrayWithElements(
          backing_store, KindTraits::Kind, delete_count);
 }

 Handle<JSArray> deleted_elements = isolate->factory()->NewJSArray(
 KindTraits::Kind, delete_count, delete_count);
 if (delete_count > 0) {
 DisallowHeapAllocation no_gc;
 Subclass::CopyElementsImpl(*backing_store, start,
                                 deleted_elements->elements(), KindTraits::Kind,
 0, kPackedSizeNotKnown, delete_count);
 }

 if (add_count < delete_count) {
 Subclass::SpliceShrinkStep(isolate, receiver, backing_store, start,
                                 delete_count, add_count, length, new_length);
 } else if (add_count > delete_count) {
      backing_store =
 Subclass::SpliceGrowStep(isolate, receiver, backing_store, start,
                                   delete_count, add_count, length, new_length);
 }

 Subclass::CopyArguments(args, backing_store, add_count, 3, start);

    receiver->set_length(Smi::FromInt(new_length));
 Subclass::TryTransitionResultArrayToPacked(deleted_elements);
 return deleted_elements;
 }

Project: Android

 static void SpliceShrinkStep(Isolate* isolate, Handle<JSArray> receiver,
 Handle<FixedArrayBase> backing_store,
 uint32_t start, uint32_t delete_count,
 uint32_t add_count, uint32_t len,
 uint32_t new_length) {
 const int move_left_count = len - delete_count - start;
 const int move_left_dst_index = start + add_count;
 Subclass::MoveElements(isolate, receiver, backing_store,
                           move_left_dst_index, start + delete_count,
                           move_left_count, new_length, len);
 }

Project: Android

 explicit StringWrapperElementsAccessor(const char* name)
 : ElementsAccessorBase<Subclass, KindTraits>(name) {
    USE(KindTraits::Kind);
 }

Project: Android

void ElementsAccessor::TearDown() {
 if (elements_accessors_ == NULL) return;
#define ACCESSOR_DELETE(Class, Kind, Store) delete elements_accessors_[Kind];
  ELEMENTS_LIST(ACCESSOR_DELETE)
#undef ACCESSOR_DELETE
  elements_accessors_ = NULL;
}

Project: Android

MaybeHandle<Object> ThrowArrayLengthRangeError(Isolate* isolate) {
  THROW_NEW_ERROR(isolate, NewRangeError(MessageTemplate::kInvalidArrayLength),
 Object);
}

Project: Android

static void TraceTopFrame(Isolate* isolate) {
 StackFrameIterator it(isolate);
 if (it.done()) {
 PrintF("unknown location (no JavaScript frames present)");
 return;
 }
 StackFrame* raw_frame = it.frame();
 if (raw_frame->is_internal()) {
 Code* apply_builtin =
        isolate->builtins()->builtin(Builtins::kFunctionPrototypeApply);
 if (raw_frame->unchecked_code() == apply_builtin) {
 PrintF("apply from ");
      it.Advance();
      raw_frame = it.frame();
 }
 }
 JavaScriptFrame::PrintTop(isolate, stdout, false, true);
}

Project: Android

 static void TransitionElementsKindImpl(Handle<JSObject> object,
 Handle<Map> to_map) {
 Handle<Map> from_map = handle(object->map());
 ElementsKind from_kind = from_map->elements_kind();
 ElementsKind to_kind = to_map->elements_kind();
 if (IsFastHoleyElementsKind(from_kind)) {
      to_kind = GetHoleyElementsKind(to_kind);
 }
 if (from_kind != to_kind) {
      DCHECK(IsFastElementsKind(from_kind));
      DCHECK(IsFastElementsKind(to_kind));
      DCHECK_NE(TERMINAL_FAST_ELEMENTS_KIND, from_kind);

 Handle<FixedArrayBase> from_elements(object->elements());
 if (object->elements() == object->GetHeap()->empty_fixed_array() ||
 IsFastDoubleElementsKind(from_kind) ==
 IsFastDoubleElementsKind(to_kind)) {
 JSObject::MigrateToMap(object, to_map);
 } else {
        DCHECK((IsFastSmiElementsKind(from_kind) &&
 IsFastDoubleElementsKind(to_kind)) ||
 (IsFastDoubleElementsKind(from_kind) &&
 IsFastObjectElementsKind(to_kind)));
 uint32_t capacity = static_cast<uint32_t>(object->elements()->length());
 Handle<FixedArrayBase> elements = ConvertElementsWithCapacity(
            object, from_elements, from_kind, capacity);
 JSObject::SetMapAndElements(object, to_map, elements);
 }
 if (FLAG_trace_elements_transitions) {
 JSObject::PrintElementsTransition(stdout, object, from_kind,
                                          from_elements, to_kind,
                                          handle(object->elements()));
 }
 }
 }

Project: Android

 static void TransitionElementsKindImpl(Handle<JSObject> object,
 Handle<Map> map) {
    UNREACHABLE();
 }

Project: Android

 static void TryTransitionResultArrayToPacked(Handle<JSArray> array) {
 if (!IsHoleyElementsKind(kind())) return;
 int length = Smi::cast(array->length())->value();
 Handle<FixedArrayBase> backing_store(array->elements());
 if (!Subclass::IsPackedImpl(array, backing_store, 0, length)) {
 return;
 }
 ElementsKind packed_kind = GetPackedElementsKind(kind());
 Handle<Map> new_map =
 JSObject::GetElementsTransitionMap(array, packed_kind);
 JSObject::MigrateToMap(array, new_map);
 if (FLAG_trace_elements_transitions) {
 JSObject::PrintElementsTransition(stdout, array, kind(), backing_store,
                                        packed_kind, backing_store);
 }
 }

Project: Android

 static uint32_t UnshiftImpl(Handle<JSArray> receiver, Arguments* args,
 uint32_t unshift_size) {
    UNREACHABLE();
 return 0;
 }

Project: Android

 static uint32_t UnshiftImpl(Handle<JSArray> receiver,
 Arguments* args, uint32_t unshift_size) {
 Handle<FixedArrayBase> backing_store(receiver->elements());
 return Subclass::AddArguments(receiver, backing_store, args, unshift_size,
                                  AT_START);
 }

Project: Android

 static void ValidateContents(Handle<JSObject> holder, int length) {
 }

Project: Android

 static void ValidateContents(Handle<JSObject> holder, int length) {
#if DEBUG
 Isolate* isolate = holder->GetIsolate();
 Heap* heap = isolate->heap();
 HandleScope scope(isolate);
 Handle<FixedArrayBase> elements(holder->elements(), isolate);
 Map* map = elements->map();
 if (IsFastSmiOrObjectElementsKind(KindTraits::Kind)) {
      DCHECK_NE(map, heap->fixed_double_array_map());
 } else if (IsFastDoubleElementsKind(KindTraits::Kind)) {
      DCHECK_NE(map, heap->fixed_cow_array_map());
 if (map == heap->fixed_array_map()) DCHECK_EQ(0, length);
 } else {
      UNREACHABLE();
 }
 if (length == 0) return; // nothing to do!
#if ENABLE_SLOW_DCHECKS
 DisallowHeapAllocation no_gc;
 Handle<BackingStore> backing_store = Handle<BackingStore>::cast(elements);
 if (IsFastSmiElementsKind(KindTraits::Kind)) {
 for (int i = 0; i < length; i++) {
        DCHECK(BackingStore::get(*backing_store, i, isolate)->IsSmi() ||
 (IsFastHoleyElementsKind(KindTraits::Kind) &&
                backing_store->is_the_hole(isolate, i)));
 }
 } else if (KindTraits::Kind == FAST_ELEMENTS ||
 KindTraits::Kind == FAST_DOUBLE_ELEMENTS) {
 for (int i = 0; i < length; i++) {
        DCHECK(!backing_store->is_the_hole(isolate, i));
 }
 } else {
      DCHECK(IsFastHoleyElementsKind(KindTraits::Kind));
 }
#endif
#endif
 }

Project: Android

 static bool WasNeutered(JSObject* holder) {
 JSArrayBufferView* view = JSArrayBufferView::cast(holder);
 return view->WasNeutered();
 }

Project: Android

 static ElementsKind kind() { return ElementsTraits::Kind; }