Reviewers: mvstanton,
Description:
Use premordial Object.isSealed/isFrozen in builtins.
[email protected]
Please review this at https://codereview.chromium.org/223473002/
SVN Base: https://v8.googlecode.com/svn/branches/bleeding_edge
Affected files (+12, -12 lines):
M src/array.js
A + test/mjsunit/regress/regress-builtinbust-1.js
Index: src/array.js
diff --git a/src/array.js b/src/array.js
index
e48230e2bd738e042cf0046d00c47ff96d984d4d..d158a059c678019ef2460f142eabc2e252ef4754
100644
--- a/src/array.js
+++ b/src/array.js
@@ -419,7 +419,7 @@ function ArrayPop() {
return;
}
- if ($Object.isSealed(this)) {
+ if (ObjectIsSealed(this)) {
throw MakeTypeError("array_functions_change_sealed",
["Array.prototype.pop"]);
}
@@ -460,7 +460,7 @@ function ArrayPush() {
var n = TO_UINT32(this.length);
var m = %_ArgumentsLength();
- if (m > 0 && $Object.isSealed(this)) {
+ if (m > 0 && ObjectIsSealed(this)) {
throw MakeTypeError("array_functions_change_sealed",
["Array.prototype.push"]);
}
@@ -596,7 +596,7 @@ function ArrayShift() {
return;
}
- if ($Object.isSealed(this)) {
+ if (ObjectIsSealed(this)) {
throw MakeTypeError("array_functions_change_sealed",
["Array.prototype.shift"]);
}
@@ -641,7 +641,7 @@ function ArrayUnshift(arg1) { // length == 1
var len = TO_UINT32(this.length);
var num_arguments = %_ArgumentsLength();
- var is_sealed = $Object.isSealed(this);
+ var is_sealed = ObjectIsSealed(this);
if (num_arguments > 0 && is_sealed) {
throw MakeTypeError("array_functions_change_sealed",
@@ -654,7 +654,7 @@ function ArrayUnshift(arg1) { // length == 1
if (IS_ARRAY(this) && !is_sealed) {
SmartMove(this, 0, 0, len, num_arguments);
} else {
- if (num_arguments == 0 && $Object.isFrozen(this)) {
+ if (num_arguments == 0 && ObjectIsFrozen(this)) {
// In the zero argument case, values from the prototype come into the
// object. This can't be allowed on frozen arrays.
for (var i = 0; i < len; i++) {
@@ -807,10 +807,10 @@ function ArraySplice(start, delete_count) {
deleted_elements.length = del_count;
var num_elements_to_add = num_arguments > 2 ? num_arguments - 2 : 0;
- if (del_count != num_elements_to_add && $Object.isSealed(this)) {
+ if (del_count != num_elements_to_add && ObjectIsSealed(this)) {
throw MakeTypeError("array_functions_change_sealed",
["Array.prototype.splice"]);
- } else if (del_count > 0 && $Object.isFrozen(this)) {
+ } else if (del_count > 0 && ObjectIsFrozen(this)) {
throw MakeTypeError("array_functions_on_frozen",
["Array.prototype.splice"]);
}
Index: test/mjsunit/regress/regress-builtinbust-1.js
diff --git a/test/mjsunit/neuter-twice.js
b/test/mjsunit/regress/regress-builtinbust-1.js
similarity index 57%
copy from test/mjsunit/neuter-twice.js
copy to test/mjsunit/regress/regress-builtinbust-1.js
index
3501cee4330f966c1eeaf6f5b7ebdc6418f2bcec..947766cbccf94e24eb1589d8aeaba0b4eecfdb1a
100644
--- a/test/mjsunit/neuter-twice.js
+++ b/test/mjsunit/regress/regress-builtinbust-1.js
@@ -1,9 +1,9 @@
// Copyright 2014 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
-//
-// Flags: --allow-natives-syntax
-var ab = new ArrayBuffer(100);
-%ArrayBufferNeuter(ab);
-%ArrayBufferNeuter(ab);
+function nope() { return false; }
+var a = [ 1, 2, 3 ];
+Object.seal(a);
+Object.isSealed = nope;
+assertThrows("a.shift()");
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
