Revision: 6810
Author: [email protected]
Date: Wed Feb 16 04:10:48 2011
Log: Handle indexed properties on value objects correctly.
As with named properties, search the value wrapper prototypes for
properties.
Review URL: http://codereview.chromium.org/6526046
http://code.google.com/p/v8/source/detail?r=6810
Added:
/branches/bleeding_edge/test/mjsunit/indexed-value-properties.js
Modified:
/branches/bleeding_edge/src/arguments.h
/branches/bleeding_edge/src/objects.cc
/branches/bleeding_edge/src/objects.h
=======================================
--- /dev/null
+++ /branches/bleeding_edge/test/mjsunit/indexed-value-properties.js Wed
Feb 16 04:10:48 2011
@@ -0,0 +1,56 @@
+// Copyright 2011 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Test that the Number, String and Boolean prototypes are searched
+// for indexed properties on value objects.
+
+function return_one() { return 1; };
+
+function test(value) {
+ for (var i = 0; i < 10; i++) {
+ assertEquals(0, (value)[0]);
+ assertEquals(0, (value)["0"]);
+ assertEquals(return_one, (value)[1]);
+ assertEquals(return_one, (value)["1"]);
+ assertEquals(1, (value)[1]());
+ assertEquals(1, (value)["1"]());
+ }
+}
+
+Number.prototype[0] = 0;
+Number.prototype[1] = return_one;
+test(0);
+test(0.1);
+
+String.prototype[0] = 0;
+String.prototype[1] = return_one;
+test("");
+
+Boolean.prototype[0] = 0;
+Boolean.prototype[1] = return_one;
+test(true);
+test(false);
=======================================
--- /branches/bleeding_edge/src/arguments.h Tue Dec 7 03:01:02 2010
+++ /branches/bleeding_edge/src/arguments.h Wed Feb 16 04:10:48 2011
@@ -78,7 +78,7 @@
class CustomArguments : public Relocatable {
public:
inline CustomArguments(Object* data,
- JSObject* self,
+ Object* self,
JSObject* holder) {
values_[2] = self;
values_[1] = holder;
=======================================
--- /branches/bleeding_edge/src/objects.cc Mon Feb 14 15:41:47 2011
+++ /branches/bleeding_edge/src/objects.cc Wed Feb 16 04:10:48 2011
@@ -531,10 +531,25 @@
MaybeObject* Object::GetElementWithReceiver(Object* receiver, uint32_t
index) {
- // Non-JS objects do not have integer indexed properties.
- if (!IsJSObject()) return Heap::undefined_value();
- return
JSObject::cast(this)->GetElementWithReceiver(JSObject::cast(receiver),
- index);
+ if (IsJSObject()) {
+ return JSObject::cast(this)->GetElementWithReceiver(receiver, index);
+ }
+
+ Object* holder = NULL;
+ Context* global_context = Top::context()->global_context();
+ if (IsString()) {
+ holder = global_context->string_function()->instance_prototype();
+ } else if (IsNumber()) {
+ holder = global_context->number_function()->instance_prototype();
+ } else if (IsBoolean()) {
+ holder = global_context->boolean_function()->instance_prototype();
+ } else {
+ // Undefined and null have no indexed properties.
+ ASSERT(IsUndefined() || IsNull());
+ return Heap::undefined_value();
+ }
+
+ return JSObject::cast(holder)->GetElementWithReceiver(receiver, index);
}
@@ -7237,7 +7252,7 @@
}
-MaybeObject* JSObject::GetElementPostInterceptor(JSObject* receiver,
+MaybeObject* JSObject::GetElementPostInterceptor(Object* receiver,
uint32_t index) {
// Get element works for both JSObject and JSArray since
// JSArray::length cannot change.
@@ -7294,14 +7309,14 @@
}
-MaybeObject* JSObject::GetElementWithInterceptor(JSObject* receiver,
+MaybeObject* JSObject::GetElementWithInterceptor(Object* receiver,
uint32_t index) {
// Make sure that the top context does not change when doing
// callbacks or interceptor calls.
AssertNoContextChange ncc;
HandleScope scope;
Handle<InterceptorInfo> interceptor(GetIndexedInterceptor());
- Handle<JSObject> this_handle(receiver);
+ Handle<Object> this_handle(receiver);
Handle<JSObject> holder_handle(this);
if (!interceptor->getter()->IsUndefined()) {
@@ -7327,7 +7342,7 @@
}
-MaybeObject* JSObject::GetElementWithReceiver(JSObject* receiver,
+MaybeObject* JSObject::GetElementWithReceiver(Object* receiver,
uint32_t index) {
// Check access rights if needed.
if (IsAccessCheckNeeded() &&
=======================================
--- /branches/bleeding_edge/src/objects.h Tue Feb 15 11:15:59 2011
+++ /branches/bleeding_edge/src/objects.h Wed Feb 16 04:10:48 2011
@@ -1546,8 +1546,8 @@
// Returns the index'th element.
// The undefined object if index is out of bounds.
- MaybeObject* GetElementWithReceiver(JSObject* receiver, uint32_t index);
- MaybeObject* GetElementWithInterceptor(JSObject* receiver, uint32_t
index);
+ MaybeObject* GetElementWithReceiver(Object* receiver, uint32_t index);
+ MaybeObject* GetElementWithInterceptor(Object* receiver, uint32_t index);
MUST_USE_RESULT MaybeObject* SetFastElementsCapacityAndLength(int
capacity,
int
length);
@@ -1804,7 +1804,7 @@
Object* value,
bool check_prototype);
- MaybeObject* GetElementPostInterceptor(JSObject* receiver, uint32_t
index);
+ MaybeObject* GetElementPostInterceptor(Object* receiver, uint32_t index);
MUST_USE_RESULT MaybeObject* DeletePropertyPostInterceptor(String* name,
DeleteMode
mode);
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
