AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

Do not call setters of read-only accessors.

Browse Source 
BUG=
TEST=mjsunit/readonly-accessor
R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/271433002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@21158 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
This commit is contained in:
ulan@chromium.org 2014-05-06 08:34:48 +00:00
parent d56f01ba1c
commit a872ffdabc
2 changed files with 13 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
src/objects.cc
View File

@ -3147,9 +3147,12 @@ MaybeHandle<Object> JSObject::SetPropertyViaPrototypes(
}
case CALLBACKS: {
*done = true;
Handle<Object> callback_object(result.GetCallbackObject(), isolate);
return SetPropertyWithCallback(object, callback_object, name, value,
handle(result.holder()), strict_mode);
if (!result.IsReadOnly()) {
Handle<Object> callback_object(result.GetCallbackObject(), isolate);
return SetPropertyWithCallback(object, callback_object, name, value,
handle(result.holder()), strict_mode);
}
break;
}
case HANDLER: {
Handle<JSProxy> proxy(result.proxy());

7
test/mjsunit/readonly-accessor.js Normal file
View File

@ -0,0 +1,7 @@
// Copyright 2014 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
var foo = {};
foo.__proto__ = new String("bar");
foo.length = 20;