Revision: 8608 Author: [email protected] Date: Mon Jul 11 08:07:03 2011 Log: Merge svn r8602 to the 3.3 branch.
r8602: Fix a potential crash in const declaration. Declaration of const lookup slots would trigger an assertion if there was a setter somewhere in the prototype chain, and that setter was shadowed by a non-readonly data property also in the prototype chain. [email protected] BUG= TEST= Review URL: http://codereview.chromium.org/7327036 http://code.google.com/p/v8/source/detail?r=8608 Modified: /branches/3.3/src/objects.cc /branches/3.3/src/version.cc ======================================= --- /branches/3.3/src/objects.cc Mon Jul 11 07:12:41 2011 +++ /branches/3.3/src/objects.cc Mon Jul 11 08:07:03 2011 @@ -1863,13 +1863,9 @@ pt = pt->GetPrototype()) { JSObject::cast(pt)->LocalLookupRealNamedProperty(name, result); if (result->IsProperty()) { - if (result->IsReadOnly()) { - result->NotFound(); - return; - } - if (result->type() == CALLBACKS) { - return; - } + if (result->type() == CALLBACKS && !result->IsReadOnly()) return; + // Found non-callback or read-only callback, stop looking. + break; } } result->NotFound(); ======================================= --- /branches/3.3/src/version.cc Mon Jul 11 07:12:41 2011 +++ /branches/3.3/src/version.cc Mon Jul 11 08:07:03 2011 @@ -35,7 +35,7 @@ #define MAJOR_VERSION 3 #define MINOR_VERSION 3 #define BUILD_NUMBER 10 -#define PATCH_LEVEL 19 +#define PATCH_LEVEL 20 // Use 1 for candidates and 0 otherwise. // (Boolean macro values are not supported by all preprocessors.) #define IS_CANDIDATE_VERSION 0 -- v8-dev mailing list [email protected] http://groups.google.com/group/v8-dev
