AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

Only walk the hidden prototype chain for private nonexistent symbols

Browse Source 
BUG=chromium:479528
LOG=n

Review URL: https://codereview.chromium.org/1185373004

Cr-Commit-Position: refs/heads/master@{#29075}
This commit is contained in:
verwaest 2015-06-17 03:20:41 -07:00 committed by Commit bot
parent 72cdb99346
commit bb1b54a776
2 changed files with 27 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
src/ic/handler-compiler.cc
View File

@ -53,6 +53,16 @@ Handle<Code> NamedLoadHandlerCompiler::ComputeLoadNonexistent(
while (true) {
if (current_map->is_dictionary_map()) cache_name = name;
if (current_map->prototype()->IsNull()) break;
if (name->IsPrivate()) {
// TODO(verwaest): Use nonexistent_private_symbol.
cache_name = name;
JSReceiver* prototype = JSReceiver::cast(current_map->prototype());
if (!prototype->map()->is_hidden_prototype() &&
!prototype->map()->IsGlobalObjectMap()) {
break;
}
}
last = handle(JSObject::cast(current_map->prototype()));
current_map = handle(last->map());
}
@ -428,8 +438,11 @@ Handle<Code> NamedStoreHandlerCompiler::CompileStoreTransition(
if (is_nonexistent) {
// Find the top object.
Handle<JSObject> last;
PrototypeIterator::WhereToEnd end =
name->IsPrivate() ? PrototypeIterator::END_AT_NON_HIDDEN
: PrototypeIterator::END_AT_NULL;
PrototypeIterator iter(isolate(), holder());
while (!iter.IsAtEnd()) {
while (!iter.IsAtEnd(end)) {
last = Handle<JSObject>::cast(PrototypeIterator::GetCurrent(iter));
iter.Advance();
}

13
test/mjsunit/regress/regress-479528.js Normal file
View File

@ -0,0 +1,13 @@
// Copyright 2015 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --allow-natives-syntax
var __v_7 = {"__proto__": this};
__v_9 = %CreatePrivateSymbol("__v_9");
this[__v_9] = "moo";
function __f_5() {
__v_7[__v_9] = "bow-wow";
}
__f_5();