Reviewers: Michael Starzinger,
Description:
Implement correct checking for inherited readonliness on assignment.
Removes 6 out of 8 of our remaining unintentional failures on test262.
Specifically:
- In the runtime, when looking for setter callbacks in the prototype chain,
also look for read-only properties. If one is found, reject (exception in
strict mode). If a proxy is found, invoke proper trap.
Note: this folds in the CanPut function from the spec and avoids an extra
lookup over the prototype chain.
- In generated code for stores, insert a test for the maps from the
prototype
chain, but only up to the object where the property already exists (which
may be the object itself).
In Hydrogen, if the found property is read-only or not cacheable (e.g. a
proxy), bail out; in a stub, generate an unconditional miss (to get an
exception in strict mode).
- Add test cases and adapt existing test expectations.
- Not ported to x64 and ARM yet.
[email protected]
BUG=
TEST=
Please review this at https://chromiumcodereview.appspot.com/10388047/
SVN Base: https://v8.googlecode.com/svn/branches/bleeding_edge
Affected files:
M src/hydrogen.cc
M src/ia32/stub-cache-ia32.cc
M src/objects.h
M src/objects.cc
M src/stub-cache.h
M test/cctest/test-api.cc
M test/mjsunit/fuzz-accessors.js
M test/mjsunit/harmony/proxies.js
M test/mjsunit/override-read-only-property.js
A test/mjsunit/readonly.js
M test/mjsunit/regress/regress-1199637.js
M test/mjsunit/regress/regress-334.js
M test/mjsunit/with-readonly.js
M test/test262/test262.status
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
