Throw if setting length of a string in strict mode.

BUG=
TEST=test/mjsunit/strict-mode.js

Review URL: http://codereview.chromium.org/6623002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7064 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

diff --git a/src/ic.cc b/src/ic.cc
index dfbbb9152996b86426158b6a33e94a404be2f8bf..087a959afd9fdf173f8465146ef2641ecf0a9bc0 100644 (file)
--- a/src/ic.cc
+++ b/src/ic.cc
@@ -1397,8 +1397,16 @@ MaybeObject* StoreIC::Store(State state,
     return TypeError("non_object_property_store", object, name);
   }
 
-  // Ignore stores where the receiver is not a JSObject.
-  if (!object->IsJSObject()) return *value;
+  if (!object->IsJSObject()) {
+    // The length property of string values is read-only. Throw in strict mode.
+    if (strict_mode == kStrictMode && object->IsString() &&
+        name->Equals(Heap::length_symbol())) {
+      return TypeError("strict_read_only_property", object, name);
+    }
+    // Ignore stores where the receiver is not a JSObject.
+    return *value;
+  }
+
   Handle<JSObject> receiver = Handle<JSObject>::cast(object);
 
   // Check if the given name is an array index.

diff --git a/test/mjsunit/strict-mode.js b/test/mjsunit/strict-mode.js
index 9137f8d03a9652f6c974436bff62dc478a08ec57..69be19c28a708a8ce5894402bffe249592355952 100644 (file)
--- a/test/mjsunit/strict-mode.js
+++ b/test/mjsunit/strict-mode.js
@@ -944,3 +944,16 @@ repeat(10, function() { testAssignToUndefined(false); });
 
   assertEquals(o[7], 17);
 })();
+
+
+(function TestAssignmentToStringLength() {
+  "use strict";
+
+  var str_val = "string";
+  var str_obj = new String(str_val);
+  var str_cat = str_val + str_val + str_obj;
+
+  assertThrows(function() { str_val.length = 1; }, TypeError);
+  assertThrows(function() { str_obj.length = 1; }, TypeError);
+  assertThrows(function() { str_cat.length = 1; }, TypeError);
+})();