Reviewers: Lasse Reichstein,
Description:
Fix issue 1447 by not redefining properties unneccesarily in seal and
freeze.
This avoids attempting to redefine function.arguments with a different
value than the current one. function.arguments returns a new copy on
each invocation.
[email protected]
BUG=v8:1447
TEST=mjsunit/regress/regress-1447.js
Please review this at http://codereview.chromium.org/7044104/
SVN Base: https://v8.googlecode.com/svn/branches/bleeding_edge
Affected files:
M src/v8natives.js
A test/mjsunit/regress/regress-1447.js
Index: src/v8natives.js
diff --git a/src/v8natives.js b/src/v8natives.js
index
3cb9dfd63e756f2e080596a586dbff80ccf673e3..0c88eb17a671e310aa2aa91ce02c2bba79d31f1f
100644
--- a/src/v8natives.js
+++ b/src/v8natives.js
@@ -938,7 +938,8 @@ function ObjectSeal(obj) {
for (var i = 0; i < names.length; i++) {
var name = names[i];
var desc = GetOwnProperty(obj, name);
- if (desc.isConfigurable()) desc.setConfigurable(false);
+ if (!desc.isConfigurable()) continue;
+ desc.setConfigurable(false);
DefineOwnProperty(obj, name, desc, true);
}
return ObjectPreventExtension(obj);
@@ -954,6 +955,7 @@ function ObjectFreeze(obj) {
for (var i = 0; i < names.length; i++) {
var name = names[i];
var desc = GetOwnProperty(obj, name);
+ if (!desc.isWritable() && !desc.isConfigurable()) continue;
if (IsDataDescriptor(desc)) desc.setWritable(false);
if (desc.isConfigurable()) desc.setConfigurable(false);
DefineOwnProperty(obj, name, desc, true);
Index: test/mjsunit/regress/regress-1447.js
diff --git a/test/mjsunit/regress/regress-1447.js
b/test/mjsunit/regress/regress-1447.js
new file mode 100644
index
0000000000000000000000000000000000000000..3c64929d1d113efec61792f040d15ceaab6aa4e8
--- /dev/null
+++ b/test/mjsunit/regress/regress-1447.js
@@ -0,0 +1,29 @@
+// Copyright 2011 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+[0].forEach(function(){ Object.freeze(Array.prototype.forEach); });
+[0].every(function(){ Object.seal(Array.prototype.every); });
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
