Reviewers: Lasse Reichstein,
Message:
Upon landing this will/should trigger one of webkit layout test expectations
(there is one expectation of failure for a test which now should pass).
As soon as I confirm on my machine that this is indeed the case I will
create
webkit patch to update the test expectations.
Thank you!
Martin
Description:
Throw if setting length of a string in strict mode.
BUG=
TEST=test/mjsunit/strict-mode.js
Please review this at http://codereview.chromium.org/6623002/
SVN Base: https://v8.googlecode.com/svn/branches/bleeding_edge
Affected files:
M src/ic.cc
M test/mjsunit/strict-mode.js
Index: src/ic.cc
diff --git a/src/ic.cc b/src/ic.cc
index
dfbbb9152996b86426158b6a33e94a404be2f8bf..087a959afd9fdf173f8465146ef2641ecf0a9bc0
100644
--- a/src/ic.cc
+++ b/src/ic.cc
@@ -1397,8 +1397,16 @@ MaybeObject* StoreIC::Store(State state,
return TypeError("non_object_property_store", object, name);
}
- // Ignore stores where the receiver is not a JSObject.
- if (!object->IsJSObject()) return *value;
+ if (!object->IsJSObject()) {
+ // The length property of string values is read-only. Throw in strict
mode.
+ if (strict_mode == kStrictMode && object->IsString() &&
+ name->Equals(Heap::length_symbol())) {
+ return TypeError("strict_read_only_property", object, name);
+ }
+ // Ignore stores where the receiver is not a JSObject.
+ return *value;
+ }
+
Handle<JSObject> receiver = Handle<JSObject>::cast(object);
// Check if the given name is an array index.
Index: test/mjsunit/strict-mode.js
diff --git a/test/mjsunit/strict-mode.js b/test/mjsunit/strict-mode.js
index
9137f8d03a9652f6c974436bff62dc478a08ec57..69be19c28a708a8ce5894402bffe249592355952
100644
--- a/test/mjsunit/strict-mode.js
+++ b/test/mjsunit/strict-mode.js
@@ -944,3 +944,16 @@ repeat(10, function() { testAssignToUndefined(false);
});
assertEquals(o[7], 17);
})();
+
+
+(function TestAssignmentToStringLength() {
+ "use strict";
+
+ var str_val = "string";
+ var str_obj = new String(str_val);
+ var str_cat = str_val + str_val + str_obj;
+
+ assertThrows(function() { str_val.length = 1; }, TypeError);
+ assertThrows(function() { str_obj.length = 1; }, TypeError);
+ assertThrows(function() { str_cat.length = 1; }, TypeError);
+})();
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
