From c0e2268c8c3adfee3c1faa8ed89d7fa1ec578ee3 Mon Sep 17 00:00:00 2001 From: "karlklose@chromium.org" Date: Thu, 30 Jun 2011 14:56:06 +0000 Subject: [PATCH] Fix problem with arguments object ICs not checking for dictionary mode elements. R=kmillikin@chromium.org BUG=1514 TEST=mjsunit/regress/regress-1513.js Review URL: http://codereview.chromium.org/7282029 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8497 ce2b1a6d-e550-0410-aec6-3dcde31c8c00 --- src/arm/ic-arm.cc | 3 ++ src/ia32/ic-ia32.cc | 2 ++ src/runtime.cc | 7 ++++- src/x64/ic-x64.cc | 2 ++ test/mjsunit/regress/regress-1513.js | 44 ++++++++++++++++++++++++++++ 5 files changed, 57 insertions(+), 1 deletion(-) create mode 100644 test/mjsunit/regress/regress-1513.js diff --git a/src/arm/ic-arm.cc b/src/arm/ic-arm.cc index 676baeb35f..dea875bad4 100644 --- a/src/arm/ic-arm.cc +++ b/src/arm/ic-arm.cc @@ -952,6 +952,9 @@ static MemOperand GenerateUnmappedArgumentsLookup(MacroAssembler* masm, const int kBackingStoreOffset = FixedArray::kHeaderSize + kPointerSize; Register backing_store = parameter_map; __ ldr(backing_store, FieldMemOperand(parameter_map, kBackingStoreOffset)); + Handle fixed_array_map(masm->isolate()->heap()->fixed_array_map()); + __ CheckMap(backing_store, scratch, fixed_array_map, slow_case, + DONT_DO_SMI_CHECK); __ ldr(scratch, FieldMemOperand(backing_store, FixedArray::kLengthOffset)); __ cmp(key, Operand(scratch)); __ b(cs, slow_case); diff --git a/src/ia32/ic-ia32.cc b/src/ia32/ic-ia32.cc index 0f5820254d..be5910a124 100644 --- a/src/ia32/ic-ia32.cc +++ b/src/ia32/ic-ia32.cc @@ -528,6 +528,8 @@ static Operand GenerateUnmappedArgumentsLookup(MacroAssembler* masm, const int kBackingStoreOffset = FixedArray::kHeaderSize + kPointerSize; Register backing_store = parameter_map; __ mov(backing_store, FieldOperand(parameter_map, kBackingStoreOffset)); + Handle fixed_array_map(masm->isolate()->heap()->fixed_array_map()); + __ CheckMap(backing_store, fixed_array_map, slow_case, DONT_DO_SMI_CHECK); __ mov(scratch, FieldOperand(backing_store, FixedArray::kLengthOffset)); __ cmp(key, Operand(scratch)); __ j(greater_equal, slow_case); diff --git a/src/runtime.cc b/src/runtime.cc index 890f308894..f466a36eec 100644 --- a/src/runtime.cc +++ b/src/runtime.cc @@ -3925,7 +3925,12 @@ RUNTIME_FUNCTION(MaybeObject*, Runtime_DefineOrRedefineDataProperty) { Handle extended_dictionary = NumberDictionarySet(dictionary, index, obj_value, details); if (*extended_dictionary != *dictionary) { - js_object->set_elements(*extended_dictionary); + if (js_object->GetElementsKind() == + JSObject::NON_STRICT_ARGUMENTS_ELEMENTS) { + FixedArray::cast(js_object->elements())->set(1, *extended_dictionary); + } else { + js_object->set_elements(*extended_dictionary); + } } return *obj_value; } diff --git a/src/x64/ic-x64.cc b/src/x64/ic-x64.cc index 8919765cbc..342f672e64 100644 --- a/src/x64/ic-x64.cc +++ b/src/x64/ic-x64.cc @@ -1266,6 +1266,8 @@ static Operand GenerateUnmappedArgumentsLookup(MacroAssembler* masm, const int kBackingStoreOffset = FixedArray::kHeaderSize + kPointerSize; Register backing_store = parameter_map; __ movq(backing_store, FieldOperand(parameter_map, kBackingStoreOffset)); + Handle fixed_array_map(masm->isolate()->heap()->fixed_array_map()); + __ CheckMap(backing_store, fixed_array_map, slow_case, DONT_DO_SMI_CHECK); __ movq(scratch, FieldOperand(backing_store, FixedArray::kLengthOffset)); __ cmpq(key, scratch); __ j(greater_equal, slow_case); diff --git a/test/mjsunit/regress/regress-1513.js b/test/mjsunit/regress/regress-1513.js new file mode 100644 index 0000000000..06c5edf102 --- /dev/null +++ b/test/mjsunit/regress/regress-1513.js @@ -0,0 +1,44 @@ +// Copyright 2011 the V8 project authors. All rights reserved. +// Redistribution and use in source and binary forms, with or without +// modification, are permitted provided that the following conditions are +// met: +// +// * Redistributions of source code must retain the above copyright +// notice, this list of conditions and the following disclaimer. +// * Redistributions in binary form must reproduce the above +// copyright notice, this list of conditions and the following +// disclaimer in the documentation and/or other materials provided +// with the distribution. +// * Neither the name of Google Inc. nor the names of its +// contributors may be used to endorse or promote products derived +// from this software without specific prior written permission. +// +// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS +// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT +// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR +// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT +// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, +// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT +// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, +// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY +// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT +// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE +// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + +// Deleting a mapped arguments property and adding it via +// Object.defineProperty should not crash. + +function testcase() { + return (function (a, b, c) { + delete arguments[0]; + Object.defineProperty(arguments, "0", { + value: 10, + writable: false, + enumerable: false, + configurable: false + }); + assertEquals(10, arguments[0]); + }(0, 1, 2)); +} + +testcase();