AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

Fix bug in Object.defineProperty where a growing lements dictionary was ignored.

Browse Source 
TEST=mjsunit/object-define-property

Review URL: http://codereview.chromium.org/7129017

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8215 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
This commit is contained in:
lrn@chromium.org 2011-06-08 08:13:31 +00:00
parent b5144668cd
commit bd826d54f5
4 changed files with 28 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
src/handles.cc
View File

@ -228,12 +228,14 @@ void TransformToFastProperties(Handle<JSObject> object,
}
void NumberDictionarySet(Handle<NumberDictionary> dictionary,
uint32_t index,
Handle<Object> value,
PropertyDetails details) {
CALL_HEAP_FUNCTION_VOID(dictionary->GetIsolate(),
dictionary->Set(index, *value, details));
Handle<NumberDictionary> NumberDictionarySet(
Handle<NumberDictionary> dictionary,
uint32_t index,
Handle<Object> value,
PropertyDetails details) {
CALL_HEAP_FUNCTION(dictionary->GetIsolate(),
dictionary->Set(index, *value, details),
NumberDictionary);
}

11
src/handles.h
View File

@ -1,4 +1,4 @@
// Copyright 2006-2008 the V8 project authors. All rights reserved.
// Copyright 2011 the V8 project authors. All rights reserved.
// Redistribution and use in source and binary forms, with or without
// modification, are permitted provided that the following conditions are
// met:
@ -173,10 +173,11 @@ void NormalizeProperties(Handle<JSObject> object,
void NormalizeElements(Handle<JSObject> object);
void TransformToFastProperties(Handle<JSObject> object,
int unused_property_fields);
void NumberDictionarySet(Handle<NumberDictionary> dictionary,
uint32_t index,
Handle<Object> value,
PropertyDetails details);
MUST_USE_RESULT Handle<NumberDictionary> NumberDictionarySet(
Handle<NumberDictionary> dictionary,
uint32_t index,
Handle<Object> value,
PropertyDetails details);
// Flattens a string.
void FlattenString(Handle<String> str);

6
src/runtime.cc
View File

@ -3914,7 +3914,11 @@ RUNTIME_FUNCTION(MaybeObject*, Runtime_DefineOrRedefineDataProperty) {
// Make sure that we never go back to fast case.
dictionary->set_requires_slow_elements();
PropertyDetails details = PropertyDetails(attr, NORMAL);
NumberDictionarySet(dictionary, index, obj_value, details);
Handle<NumberDictionary> extended_dictionary =
NumberDictionarySet(dictionary, index, obj_value, details);
if (*extended_dictionary != *dictionary) {
js_object->set_elements(*extended_dictionary);
}
return *obj_value;
}

9
test/mjsunit/object-define-property.js
View File

@ -1045,3 +1045,12 @@ Object.defineProperty(o, 'p',
testDefineProperty(o, 'p',
{ enumerable : false, configurable : false },
{ get: undefined, set: setter1, enumerable : false, configurable : false });
// Regression test: Ensure that growing dictionaries are not ignored.
o = {};
for (var i = 0; i < 1000; i++) {
// Non-enumerable property forces dictionary mode.
Object.defineProperty(o, i, {value: i, enumerable: false});
}
assertEquals(999, o[999]);