Revision: 9691
Author: [email protected]
Date: Wed Oct 19 02:06:15 2011
Log: Fix updating of property attributes for elements.
This fixes updating of property attributes for data elements when
attributes are already present on a dictionary element but get removed
by a subsequent redefinition of that element.
[email protected]
BUG=v8:1772
TEST=test262/15.2.3.6-4-82-18
Review URL: http://codereview.chromium.org/8337017
http://code.google.com/p/v8/source/detail?r=9691
Modified:
/branches/bleeding_edge/src/runtime.cc
/branches/bleeding_edge/test/test262/test262.status
=======================================
--- /branches/bleeding_edge/src/runtime.cc Tue Oct 18 05:19:18 2011
+++ /branches/bleeding_edge/src/runtime.cc Wed Oct 19 02:06:15 2011
@@ -4232,11 +4232,11 @@
uint32_t index;
bool is_element = name->AsArrayIndex(&index);
- // Special case for elements if any of the flags are true.
+ // Special case for elements if any of the flags might be involved.
// If elements are in fast case we always implicitly assume that:
// DONT_DELETE: false, DONT_ENUM: false, READ_ONLY: false.
- if (((unchecked & (DONT_DELETE | DONT_ENUM | READ_ONLY)) != 0) &&
- is_element) {
+ if (is_element && (attr != NONE ||
+ js_object->HasLocalElement(index) == JSObject::DICTIONARY_ELEMENT)) {
// Normalize the elements to enable attributes on the property.
if (js_object->IsJSGlobalProxy()) {
// We do not need to do access checks here since these has already
=======================================
--- /branches/bleeding_edge/test/test262/test262.status Tue Oct 18 06:49:19
2011
+++ /branches/bleeding_edge/test/test262/test262.status Wed Oct 19 02:06:15
2011
@@ -322,12 +322,6 @@
######################### UNANALYZED FAILURES ##########################
-# Bug? Object.defineProperty - Update [[Enumerable]] attribute of 'name'
-# property to true successfully when [[Enumerable]] attribute
of 'name'
-# is false and [[Configurable]] attribute of 'name' is true,
the 'desc'
-# is a generic descriptor which only contains [[Enumerable]] attribute
-# as true, 'name' property is an index data property (8.12.9 step 8)
-15.2.3.6-4-82-18: FAIL
# Bug? Object.defineProperty - 'O' is an Arguments object of a function
that has
# formal parameters, 'name' is own property of 'O' which is also
defined in
# [[ParameterMap]] of 'O', and 'desc' is data descriptor, test
updating
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
