AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

[runtime] Don't normalize JSGlobalProxy

Browse Source 
Object.assign should not normalize JSGlobalProxy objects.

Bug: chromium:1139769
Change-Id: Ie7e24f6498267966b7553b0c5994307f5b632b0d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2485505
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70713}
This commit is contained in:
Camillo Bruni 2020-10-21 12:51:25 +02:00 committed by Commit Bot
parent ba5646046b
commit 46be10d188
2 changed files with 46 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
src/objects/js-objects.cc
View File

@ -319,7 +319,10 @@ Maybe<bool> JSReceiver::SetOrCopyDataProperties(
GetKeysConversion::kKeepNumbers),
Nothing<bool>());
if (!from->HasFastProperties() && target->HasFastProperties()) {
if (!from->HasFastProperties() && target->HasFastProperties() &&
!target->IsJSGlobalProxy()) {
// JSProxy is always in slow-mode.
DCHECK(!target->IsJSProxy());
// Convert to slow properties if we're guaranteed to overflow the number of
// descriptors.
int source_length =

42
test/mjsunit/es6/object-assign.js
View File

@ -4,6 +4,8 @@
// Based on Mozilla Object.assign() tests
// Flags: --allow-natives-syntax
function checkDataProperty(object, propertyKey, value, writable, enumerable, configurable) {
var desc = Object.getOwnPropertyDescriptor(object, propertyKey);
assertFalse(desc === undefined);
@ -227,19 +229,59 @@ assertSame(Object.assign(o, {}), o);
assertEquals(log, ["get a", "get b", "get c", "get sym1", "get sym2"]);
})();
(function proxy() {
const fast_source = { key1: "value1", key2: "value2"};
const slow_source = {__proto__:null};
for (let i = 0; i < 2000; i++) {
slow_source["key" + i] = i;
}
const empty_handler = {};
let target = {};
let proxy = new Proxy(target, empty_handler);
assertArrayEquals(Object.keys(target), []);
let result = Object.assign(proxy, fast_source);
%HeapObjectVerify(result);
assertArrayEquals(Object.keys(result), Object.keys(target));
assertArrayEquals(Object.keys(result), Object.keys(fast_source));
assertArrayEquals(Object.values(result), Object.values(fast_source));
target = {};
proxy = new Proxy(target, empty_handler);
assertArrayEquals(Object.keys(target), []);
result = Object.assign(proxy, slow_source);
%HeapObjectVerify(result);
assertEquals(Object.keys(result).length, Object.keys(target).length);
assertEquals(Object.keys(result).length, Object.keys(slow_source).length);
})();
(function global_object() {
let source = {
global1: "global1",
get global2() { return "global2" },
};
let result = Object.assign(globalThis, source);
%HeapObjectVerify(result);
assertTrue(result === globalThis);
assertTrue(result.global1 === source.global1);
assertTrue(result.global2 === source.global2);
let target = {};
result = Object.assign(target, globalThis);
%HeapObjectVerify(result);
assertTrue(result === target);
assertTrue(result.global1 === source.global1);
assertTrue(result.global2 === source.global2);
for (let i = 0; i < 2000; i++) {
source["property" + i] = i;
}
result = Object.assign(globalThis, source);
%HeapObjectVerify(result);
assertTrue(result === globalThis);
for (let i = 0; i < 2000; i++) {
const key = "property" + i;
assertEquals(result[key], i);
}
})();