Fix computed properties on object literals with a double as propertyname.

BUG=390732
LOG=y
R=ishell@chromium.org

Review URL: https://codereview.chromium.org/371973002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@22255 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

diff --git a/src/arm/full-codegen-arm.cc b/src/arm/full-codegen-arm.cc
index bb6beec..4255d66 100644 (file)
--- a/src/arm/full-codegen-arm.cc
+++ b/src/arm/full-codegen-arm.cc
@@ -1708,9 +1708,9 @@ void FullCodeGenerator::VisitObjectLiteral(ObjectLiteral* expr) {
         VisitForStackValue(key);
         VisitForStackValue(value);
         if (property->emit_store()) {
-          __ mov(r0, Operand(Smi::FromInt(NONE)));  // PropertyAttributes
+          __ mov(r0, Operand(Smi::FromInt(SLOPPY)));  // PropertyAttributes
           __ push(r0);
-          __ CallRuntime(Runtime::kAddProperty, 4);
+          __ CallRuntime(Runtime::kSetProperty, 4);
         } else {
           __ Drop(3);
         }

diff --git a/src/arm64/full-codegen-arm64.cc b/src/arm64/full-codegen-arm64.cc
index 438907e..afd5f72 100644 (file)
--- a/src/arm64/full-codegen-arm64.cc
+++ b/src/arm64/full-codegen-arm64.cc
@@ -1697,9 +1697,9 @@ void FullCodeGenerator::VisitObjectLiteral(ObjectLiteral* expr) {
           __ Push(x0);
           VisitForStackValue(key);
           VisitForStackValue(value);
-          __ Mov(x0, Smi::FromInt(NONE));  // PropertyAttributes
+          __ Mov(x0, Smi::FromInt(SLOPPY));  // Strict mode
           __ Push(x0);
-          __ CallRuntime(Runtime::kAddProperty, 4);
+          __ CallRuntime(Runtime::kSetProperty, 4);
         } else {
           VisitForEffect(key);
           VisitForEffect(value);

diff --git a/src/ia32/full-codegen-ia32.cc b/src/ia32/full-codegen-ia32.cc
index fbe41fc..e9f13c1 100644 (file)
--- a/src/ia32/full-codegen-ia32.cc
+++ b/src/ia32/full-codegen-ia32.cc
@@ -1646,8 +1646,8 @@ void FullCodeGenerator::VisitObjectLiteral(ObjectLiteral* expr) {
         VisitForStackValue(key);
         VisitForStackValue(value);
         if (property->emit_store()) {
-          __ push(Immediate(Smi::FromInt(NONE)));  // PropertyAttributes
-          __ CallRuntime(Runtime::kAddProperty, 4);
+          __ push(Immediate(Smi::FromInt(SLOPPY)));  // Strict mode
+          __ CallRuntime(Runtime::kSetProperty, 4);
         } else {
           __ Drop(3);
         }

diff --git a/src/runtime.cc b/src/runtime.cc
index 893e31b..2848138 100644 (file)
--- a/src/runtime.cc
+++ b/src/runtime.cc
@@ -270,12 +270,9 @@ MUST_USE_RESULT static MaybeHandle<Object> CreateObjectLiteralBoilerplate(
     if (key->IsInternalizedString()) {
       if (Handle<String>::cast(key)->AsArrayIndex(&element_index)) {
         // Array index as string (uint32).
-        if (value->IsUninitialized()) {
-          maybe_result = value;
-        } else {
-          maybe_result = JSObject::SetOwnElement(
-              boilerplate, element_index, value, SLOPPY);
-        }
+        if (value->IsUninitialized()) value = handle(Smi::FromInt(0), isolate);
+        maybe_result =
+            JSObject::SetOwnElement(boilerplate, element_index, value, SLOPPY);
       } else {
         Handle<String> name(String::cast(*key));
         ASSERT(!name->AsArrayIndex(&element_index));
@@ -284,12 +281,9 @@ MUST_USE_RESULT static MaybeHandle<Object> CreateObjectLiteralBoilerplate(
       }
     } else if (key->ToArrayIndex(&element_index)) {
       // Array index (uint32).
-      if (value->IsUninitialized()) {
-        maybe_result = value;
-      } else {
-        maybe_result = JSObject::SetOwnElement(
-            boilerplate, element_index, value, SLOPPY);
-      }
+      if (value->IsUninitialized()) value = handle(Smi::FromInt(0), isolate);
+      maybe_result =
+          JSObject::SetOwnElement(boilerplate, element_index, value, SLOPPY);
     } else {
       // Non-uint32 number.
       ASSERT(key->IsNumber());
@@ -5330,14 +5324,17 @@ RUNTIME_FUNCTION(Runtime_AddProperty) {
 
 #ifdef DEBUG
   bool duplicate;
-  if (key->IsName()) {
+  uint32_t index = 0;
+  if (key->IsName() || !key->ToArrayIndex(&index)) {
+    if (key->IsNumber()) {
+      ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, key,
+                                         Execution::ToString(isolate, key));
+    }
     LookupIterator it(object, Handle<Name>::cast(key),
                       LookupIterator::CHECK_OWN_REAL);
     JSReceiver::GetPropertyAttributes(&it);
     duplicate = it.IsFound();
   } else {
-    uint32_t index = 0;
-    RUNTIME_ASSERT(key->ToArrayIndex(&index));
     duplicate = JSReceiver::HasOwnElement(object, index);
   }
   RUNTIME_ASSERT(!duplicate);

diff --git a/src/x64/full-codegen-x64.cc b/src/x64/full-codegen-x64.cc
index 54e68ae..e0fe835 100644 (file)
--- a/src/x64/full-codegen-x64.cc
+++ b/src/x64/full-codegen-x64.cc
@@ -1679,8 +1679,8 @@ void FullCodeGenerator::VisitObjectLiteral(ObjectLiteral* expr) {
         VisitForStackValue(key);
         VisitForStackValue(value);
         if (property->emit_store()) {
-          __ Push(Smi::FromInt(NONE));    // PropertyAttributes
-          __ CallRuntime(Runtime::kAddProperty, 4);
+          __ Push(Smi::FromInt(SLOPPY));  // Strict mode
+          __ CallRuntime(Runtime::kSetProperty, 4);
         } else {
           __ Drop(3);
         }

diff --git a/test/mjsunit/regress/regress-double-property.js b/test/mjsunit/regress/regress-double-property.js
new file mode 100644 (file)
index 0000000..2ddb45b
--- /dev/null
+++ b/test/mjsunit/regress/regress-double-property.js
@@ -0,0 +1,9 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function f(a) {
+  return {0.1: a};
+}
+
+f();