Status: Assigned
Owner: [email protected]
Labels: Type-Bug Priority-Medium
New issue 4296 by [email protected]: Element access broken in ICs
(probably also optimizing compilers) when string wrappers are involved.
https://code.google.com/p/v8/issues/detail?id=4296
String wrappers claim FAST_HOLEY_SMI_ELEMENTS but actually they behave like
DICTIONARY_ELEMENTS for the mapped indices. Most V8 code forgets to check
for this special case.
(function () {
var o = new String("ab");
function store(o, i, v) { o[i] = v; }
function load(o, i) { return o[i]; }
// Initialize the IC.
store(o, 2, 10);
load(o, 2);
store(o, 0, 100);
assertEquals("a", load(o, 0));
})();
(function () {
var o = {__proto__: new String("ab")};
function store(o, i, v) { o[i] = v; }
function load(o, i) { return o[i]; }
// Initialize the IC.
store(o, 2, 10);
load(o, 2);
store(o, 0, 100);
assertEquals("a", load(o, 0));
})();
(function () {
"use strict";
var o = {__proto__: {}};
function store(o, i, v) { o[i] = v; }
// Initialize the IC.
store(o, 0, 100);
o.__proto__.__proto__ = new String("bla");
assertThrows(function () { store(o, 1, 100) });
})();
--
You received this message because this project is configured to send all
issue notifications to this address.
You may adjust your notification preferences at:
https://code.google.com/hosting/settings
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
