AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

[objects] Fix module namespace object element accesses

Browse Source 
As of the normative change [1] of spec, the export name can be
arbitrary strings. Element accesses on module namespace objects
will be interpreted as indexed properties, so those element key
exports should be setup as elements.

[1]: https://github.com/tc39/ecma262/pull/2154

Bug: v8:11690
Change-Id: I3b724d11b9306739268fc5348bae87911a8da18c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3219945
Reviewed-by: Shu-yu Guo <syg@chromium.org>
Commit-Queue: legendecas <legendecas@gmail.com>
Cr-Commit-Position: refs/heads/main@{#77581}
This commit is contained in:
legendecas 2021-10-26 00:23:12 +08:00 committed by V8 LUCI CQ
parent 3f82a2d5ba
commit 419ca34349
6 changed files with 27 additions and 18 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
src/objects/js-objects-inl.h
View File

@ -717,8 +717,6 @@ Maybe<bool> JSReceiver::HasProperty(Handle<JSReceiver> object,
Maybe<bool> JSReceiver::HasOwnProperty(Handle<JSReceiver> object,
uint32_t index) {
if (object->IsJSModuleNamespace()) return Just(false);
if (object->IsJSObject()) { // Shortcut.
LookupIterator it(object->GetIsolate(), object, index, object,
LookupIterator::OWN);

14
src/objects/js-objects.cc
View File

@ -2581,6 +2581,20 @@ void JSObject::SetNormalizedProperty(Handle<JSObject> object, Handle<Name> name,
}
}
void JSObject::SetNormalizedElement(Handle<JSObject> object, uint32_t index,
Handle<Object> value,
PropertyDetails details) {
DCHECK_EQ(object->GetElementsKind(), DICTIONARY_ELEMENTS);
Isolate* isolate = object->GetIsolate();
Handle<NumberDictionary> dictionary =
handle(NumberDictionary::cast(object->elements()), isolate);
dictionary =
NumberDictionary::Set(isolate, dictionary, index, value, object, details);
object->set_elements(*dictionary);
}
void JSObject::JSObjectShortPrint(StringStream* accumulator) {
switch (map().instance_type()) {
case JS_ARRAY_TYPE: {

8
src/objects/js-objects.h
View File

@ -465,13 +465,9 @@ class JSObject : public TorqueGeneratedJSObject<JSObject, JSReceiver> {
static void SetNormalizedProperty(Handle<JSObject> object, Handle<Name> name,
Handle<Object> value,
PropertyDetails details);
static void SetDictionaryElement(Handle<JSObject> object, uint32_t index,
static void SetNormalizedElement(Handle<JSObject> object, uint32_t index,
Handle<Object> value,
PropertyAttributes attributes);
static void SetDictionaryArgumentsElement(Handle<JSObject> object,
uint32_t index,
Handle<Object> value,
PropertyAttributes attributes);
PropertyDetails details);
static void OptimizeAsPrototype(Handle<JSObject> object,
bool enable_setup_mode = true);

8
src/objects/module.cc
View File

@ -372,11 +372,19 @@ Handle<JSModuleNamespace> Module::GetModuleNamespace(Isolate* isolate,
JSObject::NormalizeProperties(isolate, ns, CLEAR_INOBJECT_PROPERTIES,
static_cast<int>(names.size()),
"JSModuleNamespace");
JSObject::NormalizeElements(ns);
for (const auto& name : names) {
uint32_t index = 0;
if (name->AsArrayIndex(&index)) {
JSObject::SetNormalizedElement(
ns, index, Accessors::MakeModuleNamespaceEntryInfo(isolate, name),
PropertyDetails(kAccessor, attr, PropertyCellType::kMutable));
} else {
JSObject::SetNormalizedProperty(
ns, name, Accessors::MakeModuleNamespaceEntryInfo(isolate, name),
PropertyDetails(kAccessor, attr, PropertyCellType::kMutable));
}
}
JSObject::PreventExtensions(ns, kThrowOnError).ToChecked();
// Optimize the namespace object as a prototype, for two reasons:

4
src/runtime/runtime-object.cc
View File

@ -360,10 +360,6 @@ RUNTIME_FUNCTION(Runtime_ObjectHasOwnProperty) {
Handle<Object> object = args.at(0);
if (object->IsJSModuleNamespace()) {
if (key.is_element()) {
// Namespace objects can't have indexed properties.
return ReadOnlyRoots(isolate).false_value();
}
LookupIterator it(isolate, object, key, LookupIterator::OWN);
PropertyDescriptor desc;
Maybe<bool> result = JSReceiver::GetOwnPropertyDescriptor(&it, &desc);

3
test/test262/test262.status
View File

@ -398,9 +398,6 @@
# http://crbug/v8/11533
'language/statements/class/subclass/default-constructor-spread-override': [FAIL],
# https://bugs.chromium.org/p/v8/issues/detail?id=11690
'language/module-code/export-expname-binding-index': [FAIL],
# https://bugs.chromium.org/p/v8/issues/detail?id=11111
'built-ins/ArrayBuffer/prototype/transfer/*': [FAIL],
'built-ins/ArrayBuffer/prototype/transfer/this-is-sharedarraybuffer': [PASS],