Reviewers: Mads Ager,
Description:
Fix second half of issue 1151, the first change (r6765) only fixed
FunctionGetPrototype, not FunctionSetPrototype.
Please review this at http://codereview.chromium.org/6548008/
SVN Base: http://v8.googlecode.com/svn/branches/bleeding_edge/
Affected files:
M src/accessors.cc
M test/mjsunit/regress/regress-1151.js
Index: src/accessors.cc
===================================================================
--- src/accessors.cc (revision 6865)
+++ src/accessors.cc (working copy)
@@ -467,6 +467,7 @@
bool found_it = false;
JSFunction* function = FindInPrototypeChain<JSFunction>(object,
&found_it);
if (!found_it) return Heap::undefined_value();
+ if (!function->should_have_prototype()) return Heap::undefined_value();
if (function->has_initial_map()) {
// If the function has allocated the initial map
// replace it with a copy containing the new prototype.
Index: test/mjsunit/regress/regress-1151.js
===================================================================
--- test/mjsunit/regress/regress-1151.js (revision 6865)
+++ test/mjsunit/regress/regress-1151.js (working copy)
@@ -30,3 +30,6 @@
__defineSetter__.__proto__ = function() {};
__defineSetter__['prototype']
+
+eval.__proto__ = function () { };
+eval['prototype'] = {}
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
