Reviewers: arv,
Description:
Version 4.4.63.15 (cherry-pick)
Merge back fix for 490506/493566 to 4.4
[email protected]
BUG=chromium:490506
LOG=n
Please review this at https://codereview.chromium.org/1214503009/
Base URL: https://chromium.googlesource.com/v8/[email protected]
Affected files (+44, -40 lines):
M include/v8-version.h
M src/flag-definitions.h
M src/objects.cc
Index: include/v8-version.h
diff --git a/include/v8-version.h b/include/v8-version.h
index
c44d53c04d3e6de6f3a8fda282159bf285f3edc7..b6569630e82d0aeb31e6f0c7f3fbb46eb41d56e9
100644
--- a/include/v8-version.h
+++ b/include/v8-version.h
@@ -11,7 +11,7 @@
#define V8_MAJOR_VERSION 4
#define V8_MINOR_VERSION 4
#define V8_BUILD_NUMBER 63
-#define V8_PATCH_LEVEL 14
+#define V8_PATCH_LEVEL 15
// Use 1 for candidates and 0 otherwise.
// (Boolean macro values are not supported by all preprocessors.)
Index: src/flag-definitions.h
diff --git a/src/flag-definitions.h b/src/flag-definitions.h
index
93e61df0825ea3fc477481a62bf0a936606e4a3a..2b905e31d43e1d63ef730f32104a6d73009348e1
100644
--- a/src/flag-definitions.h
+++ b/src/flag-definitions.h
@@ -199,7 +199,7 @@ DEFINE_IMPLICATION(es_staging, harmony)
#define HARMONY_STAGED(V) \
V(harmony_rest_parameters, "harmony rest parameters") \
V(harmony_spreadcalls, "harmony spread-calls") \
- V(harmony_tostring, "harmony toString") \
+ V(harmony_tostring, "harmony toString")
// Features that are shipping (turned on by default, but internal flag
remains).
#define HARMONY_SHIPPING(V)
\
Index: src/objects.cc
diff --git a/src/objects.cc b/src/objects.cc
index
67a7b2bc7a18bd23e861f46be4f08f8b4bc9ac69..496c26c2c23337055b41336d814bf0861d2c76f4
100644
--- a/src/objects.cc
+++ b/src/objects.cc
@@ -3275,54 +3275,58 @@ MaybeHandle<Object>
Object::SetSuperProperty(LookupIterator* it,
if (found) return result;
LookupIterator own_lookup(it->GetReceiver(), it->name(),
LookupIterator::OWN);
+ for (; own_lookup.IsFound(); own_lookup.Next()) {
+ switch (own_lookup.state()) {
+ case LookupIterator::ACCESS_CHECK:
+ if (!own_lookup.HasAccess()) {
+ return JSObject::SetPropertyWithFailedAccessCheck(&own_lookup,
value,
+ SLOPPY);
+ }
+ break;
- switch (own_lookup.state()) {
- case LookupIterator::NOT_FOUND:
- return JSObject::AddDataProperty(&own_lookup, value, NONE,
language_mode,
- store_mode);
-
- case LookupIterator::INTEGER_INDEXED_EXOTIC:
- return result;
+ case LookupIterator::INTEGER_INDEXED_EXOTIC:
+ return RedefineNonconfigurableProperty(it->isolate(), it->name(),
value,
+ language_mode);
- case LookupIterator::DATA: {
- PropertyDetails details = own_lookup.property_details();
- if (details.IsConfigurable() || !details.IsReadOnly()) {
- return JSObject::SetOwnPropertyIgnoreAttributes(
- Handle<JSObject>::cast(it->GetReceiver()), it->name(), value,
- details.attributes());
+ case LookupIterator::DATA: {
+ PropertyDetails details = own_lookup.property_details();
+ if (details.IsConfigurable() || !details.IsReadOnly()) {
+ return JSObject::SetOwnPropertyIgnoreAttributes(
+ Handle<JSObject>(it->GetReceiver()), it->name(), value,
+ details.attributes());
+ }
+ return WriteToReadOnlyProperty(&own_lookup, value, language_mode);
}
- return WriteToReadOnlyProperty(&own_lookup, value, language_mode);
- }
- case LookupIterator::ACCESSOR: {
- PropertyDetails details = own_lookup.property_details();
- if (details.IsConfigurable()) {
- return JSObject::SetOwnPropertyIgnoreAttributes(
- Handle<JSObject>::cast(it->GetReceiver()), it->name(), value,
- details.attributes());
- }
+ case LookupIterator::ACCESSOR: {
+ PropertyDetails details = own_lookup.property_details();
+ if (details.IsConfigurable()) {
+ return JSObject::SetOwnPropertyIgnoreAttributes(
+ Handle<JSObject>(it->GetReceiver()), it->name(), value,
+ details.attributes());
+ }
- return RedefineNonconfigurableProperty(it->isolate(), it->name(),
value,
- language_mode);
- }
+ return RedefineNonconfigurableProperty(it->isolate(), it->name(),
value,
+ language_mode);
+ }
- case LookupIterator::TRANSITION:
- UNREACHABLE();
- break;
+ case LookupIterator::INTERCEPTOR:
+ case LookupIterator::JSPROXY: {
+ bool found = false;
+ MaybeHandle<Object> result = SetPropertyInternal(
+ &own_lookup, value, language_mode, store_mode, &found);
+ if (found) return result;
+ break;
+ }
- case LookupIterator::INTERCEPTOR:
- case LookupIterator::JSPROXY:
- case LookupIterator::ACCESS_CHECK: {
- bool found = false;
- MaybeHandle<Object> result = SetPropertyInternal(
- &own_lookup, value, language_mode, store_mode, &found);
- if (found) return result;
- return SetDataProperty(&own_lookup, value);
+ case LookupIterator::NOT_FOUND:
+ case LookupIterator::TRANSITION:
+ UNREACHABLE();
}
}
- UNREACHABLE();
- return MaybeHandle<Object>();
+ return JSObject::AddDataProperty(&own_lookup, value, NONE, language_mode,
+ store_mode);
}
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
