AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

Harden DefineOrRedefineDataProperty.

Browse Source 
R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/240973002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20908 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
This commit is contained in:
ulan@chromium.org 2014-04-23 12:28:50 +00:00
parent b881d87128
commit f348865894
1 changed files with 7 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
src/runtime.cc
View File

@ -5193,6 +5193,7 @@ RUNTIME_FUNCTION(Runtime_DefineOrRedefineAccessorProperty) {
PropertyAttributes attr = static_cast<PropertyAttributes>(unchecked);
bool fast = obj->HasFastProperties();
// DefineAccessor checks access rights.
JSObject::DefineAccessor(obj, name, getter, setter, attr);
RETURN_FAILURE_IF_SCHEDULED_EXCEPTION(isolate);
if (fast) JSObject::TransformToFastProperties(obj, 0);
@ -5216,6 +5217,12 @@ RUNTIME_FUNCTION(Runtime_DefineOrRedefineDataProperty) {
RUNTIME_ASSERT((unchecked & ~(READ_ONLY | DONT_ENUM | DONT_DELETE)) == 0);
PropertyAttributes attr = static_cast<PropertyAttributes>(unchecked);
// Check access rights if needed.
if (js_object->IsAccessCheckNeeded() &&
!isolate->MayNamedAccess(js_object, name, v8::ACCESS_SET)) {
return isolate->heap()->undefined_value();
}
LookupResult lookup(isolate);
js_object->LocalLookupRealNamedProperty(*name, &lookup);