Reviewers: Søren Gjesse, Martin Maly,
Description:
Handle indexed properties on value objects correctly.
As with named properties, search the value wrapper prototypes for
properties.
Please review this at http://codereview.chromium.org/6526046/
SVN Base: https://v8.googlecode.com/svn/branches/bleeding_edge
Affected files:
M src/arguments.h
M src/objects.h
M src/objects.cc
A test/mjsunit/indexed-value-properties.js
Index: src/arguments.h
diff --git a/src/arguments.h b/src/arguments.h
index
d51c9e4cb15719eaba76a4b73fa75b43b39cae06..5cf8deaa5942f5ba967203046cdf0d6e8a4e7e94
100644
--- a/src/arguments.h
+++ b/src/arguments.h
@@ -78,7 +78,7 @@ class Arguments BASE_EMBEDDED {
class CustomArguments : public Relocatable {
public:
inline CustomArguments(Object* data,
- JSObject* self,
+ Object* self,
JSObject* holder) {
values_[2] = self;
values_[1] = holder;
Index: src/objects.cc
diff --git a/src/objects.cc b/src/objects.cc
index
31566ffeb72521a867fcbfc62542d448e5926549..e0232d58732ed014333c6118af88e3ec2645c6d9
100644
--- a/src/objects.cc
+++ b/src/objects.cc
@@ -531,10 +531,25 @@ MaybeObject* Object::GetProperty(Object* receiver,
MaybeObject* Object::GetElementWithReceiver(Object* receiver, uint32_t
index) {
- // Non-JS objects do not have integer indexed properties.
- if (!IsJSObject()) return Heap::undefined_value();
- return
JSObject::cast(this)->GetElementWithReceiver(JSObject::cast(receiver),
- index);
+ if (IsJSObject()) {
+ return JSObject::cast(this)->GetElementWithReceiver(receiver, index);
+ }
+
+ Object* holder = NULL;
+ Context* global_context = Top::context()->global_context();
+ if (IsString()) {
+ holder = global_context->string_function()->instance_prototype();
+ } else if (IsNumber()) {
+ holder = global_context->number_function()->instance_prototype();
+ } else if (IsBoolean()) {
+ holder = global_context->boolean_function()->instance_prototype();
+ } else {
+ // Undefined and null have no indexed properties.
+ ASSERT(IsUndefined() || IsNull());
+ return Heap::undefined_value();
+ }
+
+ return JSObject::cast(holder)->GetElementWithReceiver(receiver, index);
}
@@ -7237,7 +7252,7 @@ MaybeObject*
JSArray::JSArrayUpdateLengthFromIndex(uint32_t index,
}
-MaybeObject* JSObject::GetElementPostInterceptor(JSObject* receiver,
+MaybeObject* JSObject::GetElementPostInterceptor(Object* receiver,
uint32_t index) {
// Get element works for both JSObject and JSArray since
// JSArray::length cannot change.
@@ -7294,14 +7309,14 @@ MaybeObject*
JSObject::GetElementPostInterceptor(JSObject* receiver,
}
-MaybeObject* JSObject::GetElementWithInterceptor(JSObject* receiver,
+MaybeObject* JSObject::GetElementWithInterceptor(Object* receiver,
uint32_t index) {
// Make sure that the top context does not change when doing
// callbacks or interceptor calls.
AssertNoContextChange ncc;
HandleScope scope;
Handle<InterceptorInfo> interceptor(GetIndexedInterceptor());
- Handle<JSObject> this_handle(receiver);
+ Handle<Object> this_handle(receiver);
Handle<JSObject> holder_handle(this);
if (!interceptor->getter()->IsUndefined()) {
@@ -7327,7 +7342,7 @@ MaybeObject*
JSObject::GetElementWithInterceptor(JSObject* receiver,
}
-MaybeObject* JSObject::GetElementWithReceiver(JSObject* receiver,
+MaybeObject* JSObject::GetElementWithReceiver(Object* receiver,
uint32_t index) {
// Check access rights if needed.
if (IsAccessCheckNeeded() &&
Index: src/objects.h
diff --git a/src/objects.h b/src/objects.h
index
5538088103813962b3a0fda765e675e54ffd9877..d6349e66eb1336f98ce5045dc688af12521138d0
100644
--- a/src/objects.h
+++ b/src/objects.h
@@ -1546,8 +1546,8 @@ class JSObject: public HeapObject {
// Returns the index'th element.
// The undefined object if index is out of bounds.
- MaybeObject* GetElementWithReceiver(JSObject* receiver, uint32_t index);
- MaybeObject* GetElementWithInterceptor(JSObject* receiver, uint32_t
index);
+ MaybeObject* GetElementWithReceiver(Object* receiver, uint32_t index);
+ MaybeObject* GetElementWithInterceptor(Object* receiver, uint32_t index);
MUST_USE_RESULT MaybeObject* SetFastElementsCapacityAndLength(int
capacity,
int
length);
@@ -1804,7 +1804,7 @@ class JSObject: public HeapObject {
Object* value,
bool check_prototype);
- MaybeObject* GetElementPostInterceptor(JSObject* receiver, uint32_t
index);
+ MaybeObject* GetElementPostInterceptor(Object* receiver, uint32_t index);
MUST_USE_RESULT MaybeObject* DeletePropertyPostInterceptor(String* name,
DeleteMode
mode);
Index: test/mjsunit/indexed-value-properties.js
diff --git a/test/mjsunit/indexed-value-properties.js
b/test/mjsunit/indexed-value-properties.js
new file mode 100644
index
0000000000000000000000000000000000000000..92bb896eaf53aae187a3dafb2fbd11b4376d170f
--- /dev/null
+++ b/test/mjsunit/indexed-value-properties.js
@@ -0,0 +1,56 @@
+// Copyright 2011 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Test that the Number, String and Boolean prototypes are searched
+// for indexed properties on value objects.
+
+function return_one() { return 1; };
+
+function test(value) {
+ for (var i = 0; i < 10; i++) {
+ assertEquals(0, (value)[0]);
+ assertEquals(0, (value)["0"]);
+ assertEquals(return_one, (value)[1]);
+ assertEquals(return_one, (value)["1"]);
+ assertEquals(1, (value)[1]());
+ assertEquals(1, (value)["1"]());
+ }
+}
+
+Number.prototype[0] = 0;
+Number.prototype[1] = return_one;
+test(0);
+test(0.1);
+
+String.prototype[0] = 0;
+String.prototype[1] = return_one;
+test("");
+
+Boolean.prototype[0] = 0;
+Boolean.prototype[1] = return_one;
+test(true);
+test(false);
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
