Status: Assigned
Owner: [email protected]
CC: [email protected]
Labels: Type-Bug Priority-Medium Area-Runtime
New issue 4365 by [email protected]: M45: SetAccessor() on
JSGlobalProxy crashes
https://code.google.com/p/v8/issues/detail?id=4365
I originally raised the issue in
https://code.google.com/p/v8/issues/detail?id=4137#c57, but in my
experience sometimes people do not watch for comments in these bugs with a
lot of commits. Feel free to close this one if you'd prefer to continue the
discussion there.
As I said there, M45 currently has a regression caused by
848b620bebd327c6895d0f5af51c8c44308fd337 ("Reland of Use the LookupIterator
in SetAccessor") where calling SetAccessor() on a JSGlobalProxy would
assert on v8::internal::JSObject::MigrateFastToSlow because
SetPropertyCallback() is being called on the global proxy instead of
LookupIterator's store target. In master it is fixed by
103675d68b77c125580f74b2dd12951127f4bc99 ("Replace Set*Callback with
TransitionToAccessorPair"), so it would be good if it could be
cherry-picked into the branch used by M45.
The attached patch has a test case that triggers the bug.
Attachments:
accessor-on-global-proxy-test.patch 628 bytes
--
You received this message because this project is configured to send all
issue notifications to this address.
You may adjust your notification preferences at:
https://code.google.com/hosting/settings
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
