Reviewers: Michael Starzinger,
Description:
Fix use of proxies as f.prototype properties.
[email protected]
BUG=v8:2021
TEST=
Please review this at https://chromiumcodereview.appspot.com/9837008/
SVN Base: https://v8.googlecode.com/svn/branches/bleeding_edge
Affected files:
M src/objects.cc
M test/mjsunit/harmony/proxies.js
Index: src/objects.cc
diff --git a/src/objects.cc b/src/objects.cc
index
9d20f6c503a68917fc94a134d0191ccc311aa969..c75544c090485139e9a257d1afb1e9d5170b26d6
100644
--- a/src/objects.cc
+++ b/src/objects.cc
@@ -7451,7 +7451,7 @@ bool JSFunction::IsInlineable() {
MaybeObject* JSFunction::SetInstancePrototype(Object* value) {
- ASSERT(value->IsJSObject());
+ ASSERT(value->IsJSReceiver());
Heap* heap = GetHeap();
if (has_initial_map()) {
// If the function has allocated the initial map
@@ -7478,11 +7478,11 @@ MaybeObject* JSFunction::SetPrototype(Object*
value) {
ASSERT(should_have_prototype());
Object* construct_prototype = value;
- // If the value is not a JSObject, store the value in the map's
+ // If the value is not a JSReceiver, store the value in the map's
// constructor field so it can be accessed. Also, set the prototype
// used for constructing objects to the original object prototype.
// See ECMA-262 13.2.2.
- if (!value->IsJSObject()) {
+ if (!value->IsJSReceiver()) {
// Copy the map so this does not affect unrelated functions.
// Remove map transitions because they point to maps with a
// different prototype.
Index: test/mjsunit/harmony/proxies.js
diff --git a/test/mjsunit/harmony/proxies.js
b/test/mjsunit/harmony/proxies.js
index
50c8613b6390c15f15b1245b5e33a9f65fd46c4b..8d8f83996e255832168fa0c3c5a2d3f117888cb8
100644
--- a/test/mjsunit/harmony/proxies.js
+++ b/test/mjsunit/harmony/proxies.js
@@ -2257,3 +2257,22 @@ TestIsEnumerableThrow(Proxy.create({
return function(k) { throw "myexn" }
}
}))
+
+
+
+// Constructor functions with proxy prototypes.
+
+function TestConstructorWithProxyPrototype() {
+ TestWithProxies(TestConstructorWithProxyPrototype2, {})
+}
+
+function TestConstructorWithProxyPrototype2(create, handler) {
+ function C() {};
+ C.prototype = create(handler);
+
+ var o = new C;
+ assertSame(C.prototype, o.__proto__);
+ assertSame(C.prototype, Object.getPrototypeOf(o));
+}
+
+TestConstructorWithProxyPrototype();
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
