From 775d9b022f2819021494f984c1bf4332132ee056 Mon Sep 17 00:00:00 2001
From: "mstarzinger@chromium.org"
 <mstarzinger@chromium.org@ce2b1a6d-e550-0410-aec6-3dcde31c8c00>
Date: Thu, 3 Apr 2014 12:23:35 +0000
Subject: [PATCH] Use premordial Object.isSealed/isFrozen in builtins.

R=mvstanton@chromium.org

Review URL: https://codereview.chromium.org/223473002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20477 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
---
 src/array.js                                  | 14 +++++++-------
 test/mjsunit/regress/regress-builtinbust-1.js | 14 ++++++++++++++
 2 files changed, 21 insertions(+), 7 deletions(-)
 create mode 100644 test/mjsunit/regress/regress-builtinbust-1.js

diff --git a/src/array.js b/src/array.js
index e48230e..d158a05 100644
--- a/src/array.js
+++ b/src/array.js
@@ -419,7 +419,7 @@ function ArrayPop() {
     return;
   }
 
-  if ($Object.isSealed(this)) {
+  if (ObjectIsSealed(this)) {
     throw MakeTypeError("array_functions_change_sealed",
                         ["Array.prototype.pop"]);
   }
@@ -460,7 +460,7 @@ function ArrayPush() {
 
   var n = TO_UINT32(this.length);
   var m = %_ArgumentsLength();
-  if (m > 0 && $Object.isSealed(this)) {
+  if (m > 0 && ObjectIsSealed(this)) {
     throw MakeTypeError("array_functions_change_sealed",
                         ["Array.prototype.push"]);
   }
@@ -596,7 +596,7 @@ function ArrayShift() {
     return;
   }
 
-  if ($Object.isSealed(this)) {
+  if (ObjectIsSealed(this)) {
     throw MakeTypeError("array_functions_change_sealed",
                         ["Array.prototype.shift"]);
   }
@@ -641,7 +641,7 @@ function ArrayUnshift(arg1) {  // length == 1
 
   var len = TO_UINT32(this.length);
   var num_arguments = %_ArgumentsLength();
-  var is_sealed = $Object.isSealed(this);
+  var is_sealed = ObjectIsSealed(this);
 
   if (num_arguments > 0 && is_sealed) {
     throw MakeTypeError("array_functions_change_sealed",
@@ -654,7 +654,7 @@ function ArrayUnshift(arg1) {  // length == 1
   if (IS_ARRAY(this) && !is_sealed) {
     SmartMove(this, 0, 0, len, num_arguments);
   } else {
-    if (num_arguments == 0 && $Object.isFrozen(this)) {
+    if (num_arguments == 0 && ObjectIsFrozen(this)) {
       // In the zero argument case, values from the prototype come into the
       // object. This can't be allowed on frozen arrays.
       for (var i = 0; i < len; i++) {
@@ -807,10 +807,10 @@ function ArraySplice(start, delete_count) {
   deleted_elements.length = del_count;
   var num_elements_to_add = num_arguments > 2 ? num_arguments - 2 : 0;
 
-  if (del_count != num_elements_to_add && $Object.isSealed(this)) {
+  if (del_count != num_elements_to_add && ObjectIsSealed(this)) {
     throw MakeTypeError("array_functions_change_sealed",
                         ["Array.prototype.splice"]);
-  } else if (del_count > 0 && $Object.isFrozen(this)) {
+  } else if (del_count > 0 && ObjectIsFrozen(this)) {
     throw MakeTypeError("array_functions_on_frozen",
                         ["Array.prototype.splice"]);
   }
diff --git a/test/mjsunit/regress/regress-builtinbust-1.js b/test/mjsunit/regress/regress-builtinbust-1.js
new file mode 100644
index 0000000..33a7563
--- /dev/null
+++ b/test/mjsunit/regress/regress-builtinbust-1.js
@@ -0,0 +1,14 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function nope() { return false; }
+var a = [ 1, 2, 3 ];
+Object.seal(a);
+Object.isSealed = nope;
+
+assertThrows(function() { a.pop(); }, TypeError);
+assertThrows(function() { a.push(5); }, TypeError);
+assertThrows(function() { a.shift(); }, TypeError);
+assertThrows(function() { a.unshift(5); }, TypeError);
+assertThrows(function() { a.splice(0, 1); }, TypeError);
-- 
2.7.4