On 2014/08/21 11:07:20, Toon Verwaest wrote:
https://codereview.chromium.org/342453002/diff/40001/src/accessors.cc File src/accessors.cc (right):
https://codereview.chromium.org/342453002/diff/40001/src/accessors.cc#newcode184
src/accessors.cc:184: MaybeHandle<Object> maybe = Object::SetDataProperty(&it,value); To be clear what I meant, what about:
o = {__proto__:arguments};
// Make o dict-mode.
%OptimizeObjectForAddingMultipleProperties(o, 0);
o[@@iterator] = 10;
The setter will be called with a slow-mode o, for which (without calling Next()), IsFound() is true while HasProperty is false.
Yes, I see what you mean. Thanks for catching this.
Or even worse, what about: String.prototype.__proto__ = arguments; "bla"[@@iterator] = 10;
In this case String.prototype already has an @@iterator; but yeah, I know what
you mean. https://codereview.chromium.org/342453002/diff/40001/src/accessors.cc#newcode191
src/accessors.cc:191: return MakeAccessor(isolate, isolate->factory()->length_string(), Ok, in that case this is part of what confused me. This shouldn't be length-string, but rather @@iterator, right?
Good catch, will fix. (Makes you wonder what this is for.) https://codereview.chromium.org/342453002/ -- -- v8-dev mailing list [email protected] http://groups.google.com/group/v8-dev--- You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
