Reviewers: arv, Toon Verwaest,
Message:
PTAL
Description:
Fix the behavior of 'super.foo' assignment when receiver is not an object.
R=a...@chromium.org,verwa...@chromium.org
BUG=v8:4097
LOG=N
Please review this at https://codereview.chromium.org/1132203005/
Base URL: https://chromium.googlesource.com/v8/v8.git@master
Affected files (+25, -0 lines):
M src/objects.cc
A test/mjsunit/es6/regress/regress-4097.js
Index: src/objects.cc
diff --git a/src/objects.cc b/src/objects.cc
index
92f7b0fbcfa8b49939f2a902d4bdc8f09929b677..1224ab1c6d73c244e089564746ac8abf22d08801
100644
--- a/src/objects.cc
+++ b/src/objects.cc
@@ -3279,6 +3279,11 @@ MaybeHandle<Object>
Object::SetSuperProperty(LookupIterator* it,
SetPropertyInternal(it, value, language_mode, store_mode, &found);
if (found) return result;
+ if (!it->GetReceiver()->IsJSReceiver()) {
+ return WriteToReadOnlyProperty(it->isolate(), it->GetReceiver(),
it->name(),
+ value, language_mode);
+ }
+
LookupIterator own_lookup(it->GetReceiver(), it->name(),
LookupIterator::OWN);
switch (own_lookup.state()) {
Index: test/mjsunit/es6/regress/regress-4097.js
diff --git a/test/mjsunit/es6/regress/regress-4097.js
b/test/mjsunit/es6/regress/regress-4097.js
new file mode 100644
index
0000000000000000000000000000000000000000..d74c62f4bf69a30862edbca2823cfe6d7253acb1
--- /dev/null
+++ b/test/mjsunit/es6/regress/regress-4097.js
@@ -0,0 +1,20 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+(function () {
+ "use strict";
+ class A {
+ s() {
+ super.bla = 10;
+ }
+ };
+
+ let a = new A();
+ (new A).s.call(a);
+ assertEquals(10, a.bla);
+ assertThrows(function() { (new A).s.call(undefined); }, TypeError);
+ assertThrows(function() { (new A).s.call(42); }, TypeError);
+ assertThrows(function() { (new A).s.call(null); }, TypeError);
+ assertThrows(function() { (new A).s.call("abc"); }, TypeError);
+})()
--
--
v8-dev mailing list
v8-dev@googlegroups.com
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to v8-dev+unsubscr...@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.
