Reviewers: Søren Gjesse, Description: Fix crash with indexed setter on objects without corresponding getter.
Please review this at http://codereview.chromium.org/63010 SVN Base: http://v8.googlecode.com/svn/branches/bleeding_edge/ Affected files: M src/objects.cc M test/mjsunit/indexed-accessors.js Index: test/mjsunit/indexed-accessors.js =================================================================== --- test/mjsunit/indexed-accessors.js (revision 1677) +++ test/mjsunit/indexed-accessors.js (working copy) @@ -98,3 +98,23 @@ var q = {}; q.__defineGetter__('0', function() { return 42; }); assertThrows('q[0] = 7'); + +// Using a getter where only a setter is defined returns undefined. +var q1 = {}; +q1.__defineSetter__('0', function() {q1.b = 17;}); +assertEquals(q1[0], undefined); +// Setter works +q1[0] = 3; +assertEquals(q1[0], undefined); +assertEquals(q1.b, 17); + +// Complex case of using an undefined getter. +// From http://code.google.com/p/v8/issues/detail?id=298 +// Reported by nth10sd. + +a = function(){} +__defineSetter__("0", function(){}); +if(a|= ''){} +assertThrows('this[a].__parent__'); +assertEquals(a, 0); +assertEquals(this[a], undefined); Index: src/objects.cc =================================================================== --- src/objects.cc (revision 1677) +++ src/objects.cc (working copy) @@ -1,4 +1,4 @@ -// Copyright 2006-2008 the V8 project authors. All rights reserved. +// Copyright 2006-2009 the V8 project authors. All rights reserved. // Redistribution and use in source and binary forms, with or without // modification, are permitted provided that the following conditions are // met: @@ -5521,6 +5521,8 @@ if (getter->IsJSFunction()) { return GetPropertyWithDefinedGetter(receiver, JSFunction::cast(getter)); + } else { + return Heap::undefined_value(); } } return element; --~--~---------~--~----~------------~-------~--~----~ v8-dev mailing list [email protected] http://groups.google.com/group/v8-dev -~----------~----~----~----~------~----~------~--~---
