Reviewers: Mads Ager,
Description:
Merge svn r8602 to the 3.3 branch.
r8602: Fix a potential crash in const declaration.
Declaration of const lookup slots would trigger an assertion if there was a
setter somewhere in the prototype chain, and that setter was shadowed by a
non-readonly data property also in the prototype chain.
[email protected]
BUG=
TEST=
Please review this at http://codereview.chromium.org/7327036/
SVN Base: https://v8.googlecode.com/svn/branches/3.3
Affected files:
M src/objects.cc
Index: src/objects.cc
diff --git a/src/objects.cc b/src/objects.cc
index
3b45c7891675eba070607ee4485a5a38b9749357..9042c27676e7d5e9a9091b5387138ce4ab1895ec
100644
--- a/src/objects.cc
+++ b/src/objects.cc
@@ -1863,13 +1863,9 @@ void
JSObject::LookupCallbackSetterInPrototypes(String* name,
pt = pt->GetPrototype()) {
JSObject::cast(pt)->LocalLookupRealNamedProperty(name, result);
if (result->IsProperty()) {
- if (result->IsReadOnly()) {
- result->NotFound();
- return;
- }
- if (result->type() == CALLBACKS) {
- return;
- }
+ if (result->type() == CALLBACKS && !result->IsReadOnly()) return;
+ // Found non-callback or read-only callback, stop looking.
+ break;
}
}
result->NotFound();
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
