AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

Fix updating of property attributes for elements.

Browse Source 
This fixes updating of property attributes for data elements when
attributes are already present on a dictionary element but get removed
by a subsequent redefinition of that element.

R=rossberg@chromium.org
BUG=v8:1772
TEST=test262/15.2.3.6-4-82-18

Review URL: http://codereview.chromium.org/8337017

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9691 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
This commit is contained in:
mstarzinger@chromium.org 2011-10-19 09:06:15 +00:00
parent 8472de004b
commit 8b181d4de6
2 changed files with 3 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
src/runtime.cc
View File

@ -4232,11 +4232,11 @@ RUNTIME_FUNCTION(MaybeObject*, Runtime_DefineOrRedefineDataProperty) {
uint32_t index;
bool is_element = name->AsArrayIndex(&index);
// Special case for elements if any of the flags are true.
// Special case for elements if any of the flags might be involved.
// If elements are in fast case we always implicitly assume that:
// DONT_DELETE: false, DONT_ENUM: false, READ_ONLY: false.
if (((unchecked & (DONT_DELETE | DONT_ENUM | READ_ONLY)) != 0) &&
is_element) {
if (is_element && (attr != NONE ||
js_object->HasLocalElement(index) == JSObject::DICTIONARY_ELEMENT)) {
// Normalize the elements to enable attributes on the property.
if (js_object->IsJSGlobalProxy()) {
// We do not need to do access checks here since these has already

6
test/test262/test262.status
View File

@ -322,12 +322,6 @@ S15.4.4.3_A2_T1: FAIL_OK
######################### UNANALYZED FAILURES ##########################
# Bug? Object.defineProperty - Update [[Enumerable]] attribute of 'name'
# property to true successfully when [[Enumerable]] attribute of 'name'
# is false and [[Configurable]] attribute of 'name' is true, the 'desc'
# is a generic descriptor which only contains [[Enumerable]] attribute
# as true, 'name' property is an index data property (8.12.9 step 8)
15.2.3.6-4-82-18: FAIL
# Bug? Object.defineProperty - 'O' is an Arguments object of a function that has
# formal parameters, 'name' is own property of 'O' which is also defined in
# [[ParameterMap]] of 'O', and 'desc' is data descriptor, test updating