AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

Explicitly disallow stores to JSObjectAccessors (for now).

Browse Source 
TBR=dcarney@chromium.org

Review URL: https://codereview.chromium.org/154873002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19086 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
This commit is contained in:
verwaest@chromium.org 2014-02-04 22:46:53 +00:00
parent 2c3e6b41ff
commit fb306f9811
1 changed files with 1 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
src/hydrogen.cc
View File

@ -5442,12 +5442,7 @@ bool HOptimizedGraphBuilder::PropertyAccessInfo::LookupInPrototypes() {
bool HOptimizedGraphBuilder::PropertyAccessInfo::CanAccessMonomorphic() {
if (!CanInlinePropertyAccess(type_)) return false;
if (IsJSObjectFieldAccessor()) {
// We should never have gathered typefeedback for JSObjectFieldAccessor
// stores.
ASSERT(IsLoad());
return true;
}
if (IsJSObjectFieldAccessor()) return IsLoad();
if (!LookupDescriptor()) return false;
if (lookup_.IsFound()) {
if (IsLoad()) return true;