Reviewers: Sven Panne,

Description:
ic: perform interceptor query in LookupForWrite

Right now, v8 in a strict mode will give up setting a property on global
object if it has setter interceptor. Correct behaviour would be calling query interceptor or getter, if present, to figure out if the property (variable) was
declared.

See node.js issue for details: https://github.com/joyent/node/issues/6235

[email protected]
BUG=

Please review this at https://codereview.chromium.org/24272005/

SVN Base: git://github.com/v8/v8.git@master

Affected files (+16, -7 lines):
  M src/ic.cc


Index: src/ic.cc
diff --git a/src/ic.cc b/src/ic.cc
index 163172d8eb4df42e68c395c528f1864fb68ca49c..641fe0d29ce957c4835b1b9033303e465204b806 100644
--- a/src/ic.cc
+++ b/src/ic.cc
@@ -1607,13 +1607,22 @@ static bool LookupForWrite(Handle<JSObject> receiver,
     if (lookup->IsReadOnly() || !lookup->IsCacheable()) return false;

     if (lookup->holder() == *receiver) {
-      if (lookup->IsInterceptor() &&
-          receiver->GetNamedInterceptor()->setter()->IsUndefined()) {
-        receiver->LocalLookupRealNamedProperty(*name, lookup);
-        return lookup->IsFound() &&
-            !lookup->IsReadOnly() &&
-            lookup->CanHoldValue(value) &&
-            lookup->IsCacheable();
+      if (lookup->IsInterceptor()) {
+        bool found_and_writable;
+        if (receiver->GetNamedInterceptor()->setter()->IsUndefined()) {
+          receiver->LocalLookupRealNamedProperty(*name, lookup);
+          found_and_writable = lookup->IsFound() &&
+                               !lookup->IsReadOnly() &&
+                               lookup->CanHoldValue(value);
+        } else {
+          ASSERT(lookup->representation()->IsNone());
+          PropertyAttributes attrs =
+ lookup->holder()->GetPropertyAttributeWithInterceptor(*receiver,
+                                                                    *name,
+                                                                    true);
+          found_and_writable = attrs != ABSENT && (attrs & READ_ONLY) == 0;
+        }
+        return found_and_writable && lookup->IsCacheable();
       }
       return lookup->CanHoldValue(value);
     }


--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
--- You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to [email protected].
For more options, visit https://groups.google.com/groups/opt_out.

Reply via email to