Version 3.1.3.
Fixed a bug triggered by functions with huge numbers of declared arguments.
Fixed zap value aliasing a real object - debug mode only. Issue 866.
Fixed issue where Array.prototype.__proto__ had been set to null. Issue 1121.
Fixed stability bugs in Crankshaft for x86.
Review URL: http://codereview.chromium.org/6460038
git-svn-id: http://v8.googlecode.com/svn/trunk@6711 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
diff --git a/src/objects.cc b/src/objects.cc
index 775487a..a6e0dcd 100644
--- a/src/objects.cc
+++ b/src/objects.cc
@@ -1707,8 +1707,9 @@
}
-bool JSObject::SetElementWithCallbackSetterInPrototypes(uint32_t index,
- Object* value) {
+MaybeObject* JSObject::SetElementWithCallbackSetterInPrototypes(uint32_t index,
+ Object* value,
+ bool* found) {
for (Object* pt = GetPrototype();
pt != Heap::null_value();
pt = pt->GetPrototype()) {
@@ -1718,15 +1719,16 @@
NumberDictionary* dictionary = JSObject::cast(pt)->element_dictionary();
int entry = dictionary->FindEntry(index);
if (entry != NumberDictionary::kNotFound) {
- Object* element = dictionary->ValueAt(entry);
PropertyDetails details = dictionary->DetailsAt(entry);
if (details.type() == CALLBACKS) {
- SetElementWithCallback(element, index, value, JSObject::cast(pt));
- return true;
+ *found = true;
+ return SetElementWithCallback(
+ dictionary->ValueAt(entry), index, value, JSObject::cast(pt));
}
}
}
- return false;
+ *found = false;
+ return Heap::the_hole_value();
}
@@ -2779,6 +2781,13 @@
MaybeObject* JSObject::PreventExtensions() {
+ if (IsJSGlobalProxy()) {
+ Object* proto = GetPrototype();
+ if (proto->IsNull()) return this;
+ ASSERT(proto->IsJSGlobalObject());
+ return JSObject::cast(proto)->PreventExtensions();
+ }
+
// If there are fast elements we normalize.
if (HasFastElements()) {
Object* ok;
@@ -6962,9 +6971,11 @@
uint32_t elms_length = static_cast<uint32_t>(elms->length());
if (check_prototype &&
- (index >= elms_length || elms->get(index)->IsTheHole()) &&
- SetElementWithCallbackSetterInPrototypes(index, value)) {
- return value;
+ (index >= elms_length || elms->get(index)->IsTheHole())) {
+ bool found;
+ MaybeObject* result =
+ SetElementWithCallbackSetterInPrototypes(index, value, &found);
+ if (found) return result;
}
@@ -7096,9 +7107,11 @@
}
} else {
// Index not already used. Look for an accessor in the prototype chain.
- if (check_prototype &&
- SetElementWithCallbackSetterInPrototypes(index, value)) {
- return value;
+ if (check_prototype) {
+ bool found;
+ MaybeObject* result =
+ SetElementWithCallbackSetterInPrototypes(index, value, &found);
+ if (found) return result;
}
// When we set the is_extensible flag to false we always force
// the element into dictionary mode (and force them to stay there).