Reviewers: Kasper Lund, Description: Fixed a bug exposed by the Mozilla test suite where the result of a store to a global property is wrong. "Boolean(x=0)" is one test case.
Please review this at http://codereview.chromium.org/40291 SVN Base: http://v8.googlecode.com/svn/branches/experimental/global/ Affected files: M src/objects.cc Index: src/objects.cc =================================================================== --- src/objects.cc (revision 1445) +++ src/objects.cc (working copy) @@ -456,8 +456,10 @@ JSGlobalPropertyCell::cast(property_dictionary()->ValueAt(entry)); cell->set_value(value); store_value = cell; + // No need to update the property dictionary. + } else { + property_dictionary()->SetStringEntry(entry, name, store_value, details); } - property_dictionary()->SetStringEntry(entry, name, store_value, details); return value; } @@ -1322,11 +1324,14 @@ Object* value, PropertyAttributes attributes) { PropertyDetails details = PropertyDetails(attributes, NORMAL); + Object* store_value = value; if (IsJSGlobalObject()) { - value = Heap::AllocateJSGlobalPropertyCell(value); - if (value->IsFailure()) return value; + store_value = Heap::AllocateJSGlobalPropertyCell(value); + if (store_value->IsFailure()) return store_value; } - Object* result = property_dictionary()->AddStringEntry(name, value, details); + Object* result = property_dictionary()->AddStringEntry(name, + store_value, + details); if (result->IsFailure()) return result; if (property_dictionary() != result) { set_properties(Dictionary::cast(result)); --~--~---------~--~----~------------~-------~--~----~ v8-dev mailing list [email protected] http://groups.google.com/group/v8-dev -~----------~----~----~----~------~----~------~--~---
