Revision: 3828
Author: [email protected]
Date: Wed Feb 10 05:46:15 2010
Log: Harden global variable accesses in the fast code generator.
Explicitly check that global variables do not have accessors or
interceptors in the fast code generator syntax checker.
Review URL: http://codereview.chromium.org/595022
http://code.google.com/p/v8/source/detail?r=3828
Modified:
/branches/bleeding_edge/src/fast-codegen.cc
/branches/bleeding_edge/test/mjsunit/compiler/simple-global-access.js
=======================================
--- /branches/bleeding_edge/src/fast-codegen.cc Wed Feb 10 01:18:55 2010
+++ /branches/bleeding_edge/src/fast-codegen.cc Wed Feb 10 05:46:15 2010
@@ -220,8 +220,16 @@
if (info()->has_global_object()) {
LookupResult lookup;
info()->global_object()->Lookup(*expr->name(), &lookup);
- if (!lookup.IsValid() || !lookup.IsDontDelete()) {
- BAILOUT("Non-existing or deletable global variable");
+ if (!lookup.IsValid()) {
+ BAILOUT("Non-existing global variable");
+ }
+ // We do not handle global variables with accessors or interceptors.
+ if (lookup.type() != NORMAL) {
+ BAILOUT("Global variable with accessors or interceptors.");
+ }
+ // We do not handle deletable global variables.
+ if (!lookup.IsDontDelete()) {
+ BAILOUT("Deletable global variable");
}
}
}
@@ -573,8 +581,10 @@
ASSERT(info()->has_global_object());
LookupResult lookup;
info()->global_object()->Lookup(*expr->name(), &lookup);
- // We only support DontDelete properties for now.
+ // We only support normal (non-accessor/interceptor) DontDelete
properties
+ // for now.
ASSERT(lookup.IsValid());
+ ASSERT_EQ(NORMAL, lookup.type());
ASSERT(lookup.IsDontDelete());
Handle<Object> cell(info()->global_object()->GetPropertyCell(&lookup));
=======================================
--- /branches/bleeding_edge/test/mjsunit/compiler/simple-global-access.js
Fri Feb 5 05:57:18 2010
+++ /branches/bleeding_edge/test/mjsunit/compiler/simple-global-access.js
Wed Feb 10 05:46:15 2010
@@ -31,21 +31,23 @@
var g1 = 42;
var g2 = 43;
var g3 = 44;
+this.__defineGetter__("g4", function () { return 45; });
function f1() { this.x = this.y = this.z = g1; }
function f2() { this.x = g1; this.y = g2; this.z = g3; }
-
-var o = {x:0, y:0, z:0, m1:f1, m2:f2}
-
-o.m1();
-
+function f3() { this.x = g4; }
+
+var o = { x:0, y:0, z:0, test1:f1, test2:f2, test3:f3 }
+
+o.test1();
assertEquals(42, o.x);
assertEquals(42, o.y);
assertEquals(42, o.z);
-
-o.m2();
-
+o.test2();
assertEquals(42, o.x);
assertEquals(43, o.y);
assertEquals(44, o.z);
+
+o.test3();
+assertEquals(45, o.x);
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
