Reviewers: Rico,
Message:
PTAL
Description:
Merge r9213 into the 3.4 branch.
This change fixes crashes caused by trying to change element property
definitions, freeze, seal or preventExtensions on objects with external
elements
arrays.
[email protected]
BUG=95920
TEST=test/mjsunit/regress/regress-95920.js
Please review this at http://codereview.chromium.org/7860043/
SVN Base: http://v8.googlecode.com/svn/branches/3.4/
Affected files:
M src/messages.js
M src/objects.cc
M src/runtime.cc
M src/version.cc
A + test/mjsunit/regress/regress-95920.js
### BEGIN SVN COPY METADATA
#$ cp branches/bleeding_edge/test/mjsunit/regress/regress-95920.js
test/mjsunit/regress/regress-95920.js
### END SVN COPY METADATA
Index: src/messages.js
===================================================================
--- src/messages.js (revision 9211)
+++ src/messages.js (working copy)
@@ -248,6 +248,8 @@
strict_cannot_assign: ["Cannot assign to read
only '", "%0", "' in strict mode"],
strict_poison_pill: ["'caller', 'callee', and 'arguments'
properties may not be accessed on strict mode functions or the arguments
objects for calls to them"],
strict_caller: ["Illegal access to a strict mode
caller function."],
+ cant_prevent_ext_external_array_elements: ["Cannot prevent extension
of an object with external array elements"],
+ redef_external_array_element: ["Cannot redefine a property of an
object"]
};
}
var message_type = %MessageGetType(message);
Index: src/objects.cc
===================================================================
--- src/objects.cc (revision 9211)
+++ src/objects.cc (working copy)
@@ -3456,6 +3456,17 @@
return JSObject::cast(proto)->PreventExtensions();
}
+ // It's not possible to seal objects with external array elements
+ if (HasExternalArrayElements()) {
+ HandleScope scope(isolate);
+ Handle<Object> object(this);
+ Handle<Object> error =
+ isolate->factory()->NewTypeError(
+ "cant_prevent_ext_external_array_elements",
+ HandleVector(&object, 1));
+ return isolate->Throw(*error);
+ }
+
// If there are fast elements we normalize.
NumberDictionary* dictionary = NULL;
{ MaybeObject* maybe = NormalizeElements();
Index: src/runtime.cc
===================================================================
--- src/runtime.cc (revision 9211)
+++ src/runtime.cc (working copy)
@@ -3948,6 +3948,17 @@
if (proto->IsNull()) return *obj_value;
js_object = Handle<JSObject>::cast(proto);
}
+
+ // Don't allow element properties to be redefined on objects with
external
+ // array elements.
+ if (js_object->HasExternalArrayElements()) {
+ Handle<Object> args[2] = { js_object, name };
+ Handle<Object> error =
+ isolate->factory()->NewTypeError("redef_external_array_element",
+ HandleVector(args, 2));
+ return isolate->Throw(*error);
+ }
+
Handle<NumberDictionary> dictionary = NormalizeElements(js_object);
// Make sure that we never go back to fast case.
dictionary->set_requires_slow_elements();
Index: src/version.cc
===================================================================
--- src/version.cc (revision 9211)
+++ src/version.cc (working copy)
@@ -35,7 +35,7 @@
#define MAJOR_VERSION 3
#define MINOR_VERSION 4
#define BUILD_NUMBER 14
-#define PATCH_LEVEL 19
+#define PATCH_LEVEL 20
// Use 1 for candidates and 0 otherwise.
// (Boolean macro values are not supported by all preprocessors.)
#define IS_CANDIDATE_VERSION 0
Index: test/mjsunit/regress/regress-95920.js
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
