Reviewers: rossberg,
Description:
Add workaround for redefinition of __proto__ property.
This is a temporary workaround when the __proto__ property is being
redefined (e.g. by Object.freeze()) to not loose the foreign callback.
Once the __proto__ property is a real JavaScript accessor this hack is
no longer necessary.
[email protected]
BUG=v8:2565
TEST=mjsunit/regress/regress-2565
Please review this at https://codereview.chromium.org/12398010/
SVN Base: https://v8.googlecode.com/svn/branches/bleeding_edge
Affected files:
M src/runtime.cc
A + test/mjsunit/regress/regress-2565.js
Index: src/runtime.cc
diff --git a/src/runtime.cc b/src/runtime.cc
index
e914a3ae3291ee411b2c3a80122b2725c507fd90..52a0a7b3c7139051f384eb2beef1ebe620f13e05
100644
--- a/src/runtime.cc
+++ b/src/runtime.cc
@@ -4091,6 +4091,13 @@ RUNTIME_FUNCTION(MaybeObject*,
Runtime_DefineOrRedefineDataProperty) {
if (callback->IsAccessorInfo()) {
return isolate->heap()->undefined_value();
}
+ // TODO(mstarzinger): The __proto__ property should actually be a real
+ // JavaScript accessor instead of a foreign callback. But for now we
just
+ // avoid changing the writability attribute of this property.
+ Handle<String> proto_string = isolate->factory()->proto_string();
+ if (callback->IsForeign() && proto_string->Equals(*name)) {
+ attr = static_cast<PropertyAttributes>(attr & ~READ_ONLY);
+ }
// Avoid redefining foreign callback as data property, just use the
stored
// setter to update the value instead.
// TODO(mstarzinger): So far this only works if property attributes
don't
Index: test/mjsunit/regress/regress-2565.js
diff --git a/test/mjsunit/regress/regress-crbug-172345.js
b/test/mjsunit/regress/regress-2565.js
similarity index 91%
copy from test/mjsunit/regress/regress-crbug-172345.js
copy to test/mjsunit/regress/regress-2565.js
index
711501caa791f2974635ac4dd894568a2e3fc982..a77806a62e2209d355fce393b98797f1d20f40f8
100644
--- a/test/mjsunit/regress/regress-crbug-172345.js
+++ b/test/mjsunit/regress/regress-2565.js
@@ -25,10 +25,8 @@
// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-function f(a,i) {
- return a[i];
-}
-
-f([1,2,3], "length");
-f([1,2,3], "length");
-f([1,2,3], 2);
+Object.freeze(Object.prototype);
+var p = {};
+var o = Object.create(p);
+assertSame(p, o.__proto__);
+assertSame(p, Object.getPrototypeOf(o));
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/groups/opt_out.
