2325ef535f
If we pass in thin-string into a keyed load, the underlying internalized string is used to find the handler. However, the thin string itself was used to interpret the handler. Since the thin string itself isn't unique, this caused existing properties on the prototype chain to not be found in case of dictionary-mode prototypes. Bug: chromium:731193 Change-Id: Ic98d3789ecf9175e17d9c898ab13231aad59efcc Reviewed-on: https://chromium-review.googlesource.com/539596 Reviewed-by: Jakob Kummerow <jkummerow@chromium.org> Commit-Queue: Toon Verwaest <verwaest@chromium.org> Cr-Commit-Position: refs/heads/master@{#46005}
28 lines
577 B
JavaScript
28 lines
577 B
JavaScript
// Copyright 2017 the V8 project authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style license that can be
|
|
// found in the LICENSE file.
|
|
|
|
function f() {
|
|
}
|
|
|
|
// Make prototype of f go dictionary-mode.
|
|
for (var i = 0; i < 10000; i++) {
|
|
f.prototype["b" + i] = 1;
|
|
}
|
|
|
|
var o = new f();
|
|
|
|
function access(o, k) {
|
|
return o[k];
|
|
}
|
|
|
|
// Create a thin string.
|
|
var p = "b";
|
|
p += 10001;
|
|
|
|
assertEquals(undefined, access(o, p));
|
|
assertEquals(undefined, access(o, p));
|
|
assertEquals(undefined, access(o, p));
|
|
f.prototype[p] = 100;
|
|
assertEquals(100, access(o, p));
|