Reviewers: Rico,
Message:
PTAL
Description:
Merge r9213 into the 3.3 branch.
This change fixes crashes caused by trying to change element property
definitions, freeze, seal or preventExtensions on objects with external
elements
arrays.
[email protected]
BUG=95920
TEST=test/mjsunit/regress/regress-95920.js
Please review this at http://codereview.chromium.org/7787030/
SVN Base: http://v8.googlecode.com/svn/branches/3.3/
Affected files:
M src/messages.js
M src/objects.cc
M src/runtime.cc
M src/version.cc
A + test/mjsunit/regress/regress-95920.js
### BEGIN SVN COPY METADATA
#$ cp branches/bleeding_edge/test/mjsunit/regress/regress-95920.js
test/mjsunit/regress/regress-95920.js
### END SVN COPY METADATA
Index: src/messages.js
===================================================================
--- src/messages.js (revision 9211)
+++ src/messages.js (working copy)
@@ -241,6 +241,8 @@
strict_cannot_assign: ["Cannot assign to read
only '", "%0", "' in strict mode"],
strict_poison_pill: ["'caller', 'callee', and 'arguments'
properties may not be accessed on strict mode functions or the arguments
objects for calls to them"],
strict_caller: ["Illegal access to a strict mode
caller function."],
+ cant_prevent_ext_external_array_elements:, ["Cannot prevent
extension of an object with external array elements"],
+ redef_external_array_element:, ["Cannot redefine a property of an
object with external array elements"],
};
}
var message_type = %MessageGetType(message);
Index: src/objects.cc
===================================================================
--- src/objects.cc (revision 9211)
+++ src/objects.cc (working copy)
@@ -3105,6 +3105,17 @@
return JSObject::cast(proto)->PreventExtensions();
}
+ // It's not possible to seal objects with external array elements
+ if (HasExternalArrayElements()) {
+ HandleScope scope(isolate);
+ Handle<Object> object(this);
+ Handle<Object> error =
+ isolate->factory()->NewTypeError(
+ "cant_prevent_ext_external_array_elements",
+ HandleVector(&object, 1));
+ return isolate->Throw(*error);
+ }
+
// If there are fast elements we normalize.
if (HasFastElements()) {
Object* ok;
Index: src/runtime.cc
===================================================================
--- src/runtime.cc (revision 9211)
+++ src/runtime.cc (working copy)
@@ -3885,6 +3885,17 @@
if (proto->IsNull()) return *obj_value;
js_object = Handle<JSObject>::cast(proto);
}
+
+ // Don't allow element properties to be redefined on objects with
external
+ // array elements.
+ if (js_object->HasExternalArrayElements()) {
+ Handle<Object> args[2] = { js_object, name };
+ Handle<Object> error =
+ isolate->factory()->NewTypeError("redef_external_array_element",
+ HandleVector(args, 2));
+ return isolate->Throw(*error);
+ }
+
NormalizeElements(js_object);
Handle<NumberDictionary> dictionary(js_object->element_dictionary());
// Make sure that we never go back to fast case.
Index: src/version.cc
===================================================================
--- src/version.cc (revision 9211)
+++ src/version.cc (working copy)
@@ -35,7 +35,7 @@
#define MAJOR_VERSION 3
#define MINOR_VERSION 3
#define BUILD_NUMBER 10
-#define PATCH_LEVEL 36
+#define PATCH_LEVEL 37
// Use 1 for candidates and 0 otherwise.
// (Boolean macro values are not supported by all preprocessors.)
#define IS_CANDIDATE_VERSION 0
Index: test/mjsunit/regress/regress-95920.js
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
