Revision: 15186
Author: [email protected]
Date: Mon Jun 17 10:42:27 2013
Log: Fix Runtime_SetProperty to properly handle OOM failures
BUG=chromium:249873
[email protected]
Review URL: https://codereview.chromium.org/17167002
http://code.google.com/p/v8/source/detail?r=15186
Modified:
/branches/bleeding_edge/src/objects.cc
/branches/bleeding_edge/src/runtime.cc
=======================================
--- /branches/bleeding_edge/src/objects.cc Mon Jun 17 09:27:18 2013
+++ /branches/bleeding_edge/src/objects.cc Mon Jun 17 10:42:27 2013
@@ -12060,7 +12060,7 @@
StrictModeFlag strict_mode,
SetPropertyMode set_mode) {
if (object->HasExternalArrayElements()) {
- if (!value->IsSmi() && !value->IsHeapNumber()
&& !value->IsUndefined()) {
+ if (!value->IsNumber() && !value->IsUndefined()) {
bool has_exception;
Handle<Object> number = Execution::ToNumber(value, &has_exception);
if (has_exception) return Handle<Object>();
=======================================
--- /branches/bleeding_edge/src/runtime.cc Mon Jun 17 09:27:18 2013
+++ /branches/bleeding_edge/src/runtime.cc Mon Jun 17 10:42:27 2013
@@ -4753,25 +4753,40 @@
}
js_object->ValidateElements();
- Handle<Object> result = JSObject::SetElement(
- js_object, index, value, attr, strict_mode, set_mode);
+ if (js_object->HasExternalArrayElements()) {
+ if (!value->IsNumber() && !value->IsUndefined()) {
+ bool has_exception;
+ Handle<Object> number = Execution::ToNumber(value, &has_exception);
+ if (has_exception) return Failure::Exception();
+ value = number;
+ }
+ }
+ MaybeObject* result = js_object->SetElement(
+ index, *value, attr, strict_mode, true, set_mode);
js_object->ValidateElements();
- if (result.is_null()) return Failure::Exception();
+ if (result->IsFailure()) return result;
return *value;
}
if (key->IsName()) {
- Handle<Object> result;
+ MaybeObject* result;
Handle<Name> name = Handle<Name>::cast(key);
if (name->AsArrayIndex(&index)) {
- result = JSObject::SetElement(
- js_object, index, value, attr, strict_mode, set_mode);
+ if (js_object->HasExternalArrayElements()) {
+ if (!value->IsNumber() && !value->IsUndefined()) {
+ bool has_exception;
+ Handle<Object> number = Execution::ToNumber(value,
&has_exception);
+ if (has_exception) return Failure::Exception();
+ value = number;
+ }
+ }
+ result = js_object->SetElement(
+ index, *value, attr, strict_mode, true, set_mode);
} else {
if (name->IsString()) Handle<String>::cast(name)->TryFlatten();
- result = JSReceiver::SetProperty(
- js_object, name, value, attr, strict_mode);
+ result = js_object->SetProperty(*name, *value, attr, strict_mode);
}
- if (result.is_null()) return Failure::Exception();
+ if (result->IsFailure()) return result;
return *value;
}
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/groups/opt_out.
