From c4d25c8f374a432ee3a989bc44b906d2ad707af1 Mon Sep 17 00:00:00 2001 From: "mstarzinger@chromium.org" Date: Tue, 18 Oct 2011 13:49:19 +0000 Subject: [PATCH] Fix updating of property attributes for elements. This fixes updating of property attributes for getters and setters on dictionary elements while redefining. This just updates the property details on the existing element. R=rossberg@chromium.org BUG=v8:1772 TEST=test262 Review URL: http://codereview.chromium.org/8337013 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9685 ce2b1a6d-e550-0410-aec6-3dcde31c8c00 --- src/objects.cc | 35 ++++++++++----- test/test262/test262.status | 102 -------------------------------------------- 2 files changed, 24 insertions(+), 113 deletions(-) diff --git a/src/objects.cc b/src/objects.cc index 9fd936a..ee16ec4 100644 --- a/src/objects.cc +++ b/src/objects.cc @@ -4093,19 +4093,27 @@ void JSObject::LookupCallback(String* name, LookupResult* result) { } -// Search for a getter or setter in an elements dictionary. Returns either -// undefined if the element is read-only, or the getter/setter pair (fixed -// array) if there is an existing one, or the hole value if the element does -// not exist or is a normal non-getter/setter data element. -static Object* FindGetterSetterInDictionary(NumberDictionary* dictionary, - uint32_t index, - Heap* heap) { +// Search for a getter or setter in an elements dictionary and update its +// attributes. Returns either undefined if the element is read-only, or the +// getter/setter pair (fixed array) if there is an existing one, or the hole +// value if the element does not exist or is a normal non-getter/setter data +// element. +static Object* UpdateGetterSetterInDictionary(NumberDictionary* dictionary, + uint32_t index, + PropertyAttributes attributes, + Heap* heap) { int entry = dictionary->FindEntry(index); if (entry != NumberDictionary::kNotFound) { Object* result = dictionary->ValueAt(entry); PropertyDetails details = dictionary->DetailsAt(entry); if (details.IsReadOnly()) return heap->undefined_value(); - if (details.type() == CALLBACKS && result->IsFixedArray()) return result; + if (details.type() == CALLBACKS && result->IsFixedArray()) { + if (details.attributes() != attributes) { + dictionary->DetailsAtPut(entry, + PropertyDetails(attributes, CALLBACKS, index)); + } + return result; + } } return heap->the_hole_value(); } @@ -4147,8 +4155,10 @@ MaybeObject* JSObject::DefineGetterSetter(String* name, // elements. return heap->undefined_value(); case DICTIONARY_ELEMENTS: { - Object* probe = - FindGetterSetterInDictionary(element_dictionary(), index, heap); + Object* probe = UpdateGetterSetterInDictionary(element_dictionary(), + index, + attributes, + heap); if (!probe->IsTheHole()) return probe; // Otherwise allow to override it. break; @@ -4165,7 +4175,10 @@ MaybeObject* JSObject::DefineGetterSetter(String* name, FixedArray* arguments = FixedArray::cast(parameter_map->get(1)); if (arguments->IsDictionary()) { NumberDictionary* dictionary = NumberDictionary::cast(arguments); - probe = FindGetterSetterInDictionary(dictionary, index, heap); + probe = UpdateGetterSetterInDictionary(dictionary, + index, + attributes, + heap); if (!probe->IsTheHole()) return probe; } } diff --git a/test/test262/test262.status b/test/test262/test262.status index 5cbb267..9172ba8 100644 --- a/test/test262/test262.status +++ b/test/test262/test262.status @@ -328,74 +328,6 @@ S15.4.4.3_A2_T1: FAIL_OK # is a generic descriptor which only contains [[Enumerable]] attribute # as true, 'name' property is an index data property (8.12.9 step 8) 15.2.3.6-4-82-18: FAIL -# Bug? Object.defineProperty - Update [[Enumerable]] attribute of 'name' -# property to false successfully when [[Enumerable]] and [[Configurable]] -# attributes of 'name' property are true, the 'desc' is a generic -# descriptor which only contains [Enumerable]] attribute as false and -# 'name' property is an index accessor property (8.12.9 step 8) -15.2.3.6-4-82-19: FAIL -# Bug? Object.defineProperty - Update [[Enumerable]] attribute of 'name' -# property to false successfully when [[Enumerable]] and [[Configurable]] -# attributes of 'name' property are true, the 'desc' is a generic -# descriptor which contains [Enumerable]] attribute as false and -# [[Configurable]] property is true, 'name' property is an index accessor -# property (8.12.9 step 8) -15.2.3.6-4-82-20: FAIL -# Bug? Object.defineProperty - Update [[Configurable]] attribute of 'name' -# property to false successfully when [[Enumerable]] and [[Configurable]] -# attributes of 'name' property are true, the 'desc' is a generic -# descriptor which only contains [[Configurable]] attribute as false, -# 'name' property is an index accessor property (8.12.9 step 8) -15.2.3.6-4-82-21: FAIL -# Bug? Object.defineProperty - Update [[Configurable]] attribute of 'name' -# property to false successfully when [[Enumerable]] and [[Configurable]] -# attributes of 'name' property are true, the 'desc' is a generic -# descriptor which contains [[Enumerable]] attribute as true and -# [[Configurable]] attribute is false, 'name' property is an index accessor -# property (8.12.9 step 8) -15.2.3.6-4-82-22: FAIL -# Bug? Object.defineProperty - Update [[Enumerable]] and [[Configurable]] -# attributes of 'name' property to false successfully when [[Enumerable]] -# and [[Configurable]] attributes of 'name' property are true, the 'desc' -# is a generic descriptor which contains [[Enumerable]] and -# [[Configurable]] attributes as false, 'name' property is an index -# accessor property (8.12.9 step 8) -15.2.3.6-4-82-23: FAIL -# Bug? Object.defineProperty - Update [[Enumerable]] attributes of 'name' -# property to true successfully when [[Enumerable]] attribute of 'name' is -# false and [[Configurable]] attribute of 'name' is true, the 'desc' is a -# generic descriptor which only contains [[Enumerable]] attribute as true, -# 'name' property is an index accessor property (8.12.9 step 8) -15.2.3.6-4-82-24: FAIL -# Bug? Object.defineProperty - 'O' is an Array, 'name' is an array index named -# property, 'desc' is accessor descriptor, test updating all attribute -# values of 'name' (15.4.5.1 step 4.c) -15.2.3.6-4-209: FAIL -# Bug? Object.defineProperty - 'O' is an Array, 'name' is an array index named -# property, name is accessor property and 'desc' is accessor descriptor, -# test updating the [[Enumerable]] attribute value of 'name' (15.4.5.1 step -# 4.c) -15.2.3.6-4-271: FAIL -# Bug? Object.defineProperty - 'O' is an Array, 'name' is an array index named -# property, name is accessor property and 'desc' is accessor descriptor, -# test updating the [[Configurable]] attribute value of 'name' (15.4.5.1 -# step 4.c) -15.2.3.6-4-272: FAIL -# Bug? Object.defineProperty - 'O' is an Array, 'name' is an array index named -# property, name is accessor property and 'desc' is accessor descriptor, -# test updating multiple attribute values of 'name' (15.4.5.1 step 4.c) -15.2.3.6-4-273: FAIL -# Bug? Object.defineProperty - 'O' is an Arguments object of a function that has -# formal parameters, 'name' is own accessor property of 'O' which is also -# defined in [[ParameterMap]] of 'O', and 'desc' is accessor descriptor, -# test updating multiple attribute values of 'name' (10.6 -# [[DefineOwnProperty]] step 3 and 5.a.i) -15.2.3.6-4-291-1: FAIL -# Bug? Object.defineProperty - 'O' is an Arguments object, 'name' is own -# accessor property of 'O', and 'desc' is accessor descriptor, test -# updating multiple attribute values of 'name' (10.6 [[DefineOwnProperty]] -# step 3) -15.2.3.6-4-291: FAIL # Bug? Object.defineProperty - 'O' is an Arguments object of a function that has # formal parameters, 'name' is own property of 'O' which is also defined in # [[ParameterMap]] of 'O', and 'desc' is data descriptor, test updating @@ -434,11 +366,6 @@ S15.4.4.3_A2_T1: FAIL_OK # updating the [[Configurable]] attribute value of 'name' which is defined # as non-configurable (10.6 [[DefineOwnProperty]] step 4 and step 5b) 15.2.3.6-4-296-1: FAIL -# Bug? Object.defineProperty - 'O' is an Arguments object, 'name' is an index -# named accessor property of 'O' but not defined in [[ParameterMap]] of -# 'O', and 'desc' is accessor descriptor, test updating multiple attribute -# values of 'name' (10.6 [[DefineOwnProperty]] step 3) -15.2.3.6-4-303: FAIL # Bug? ES5 Attributes - indexed property 'P' with attributes [[Writable]]: true, # [[Enumerable]]: true, [[Configurable]]: false is writable using simple # assignment, 'O' is an Arguments object @@ -499,30 +426,6 @@ S15.4.4.3_A2_T1: FAIL_OK 15.2.3.6-4-623: FAIL # Bug? ES5 Attributes - all attributes in Date.prototype.toJSON are correct 15.2.3.6-4-624: FAIL -# Bug? Object.defineProperties - 'O' is an Array, 'P' is an array index named -# property, 'desc' is accessor descriptor, test updating all attribute -# values of 'P' (15.4.5.1 step 4.c) -15.2.3.7-6-a-205: FAIL -# Bug? Object.defineProperties - 'O' is an Array, 'P' is an array index named -# property that already exists on 'O' is accessor property and 'desc' is -# accessor descriptor, test updating the [[Enumerable]] attribute value of -# 'P' (15.4.5.1 step 4.c) -15.2.3.7-6-a-260: FAIL -# Bug? Object.defineProperties - 'O' is an Array, 'P' is an array index named -# property that already exists on 'O' is accessor property and 'desc' is -# accessor descriptor, test updating the [[Configurable]] attribute value -# of 'P' (15.4.5.1 step 4.c) -15.2.3.7-6-a-261: FAIL -# Bug? Object.defineProperties - 'O' is an Array, 'P' is an array index named -# property that already exists on 'O' is accessor property and 'desc' is -# accessor descriptor, test updating multiple attribute values of 'P' -# (15.4.5.1 step 4.c) -15.2.3.7-6-a-262: FAIL -# Bug? Object.defineProperties - 'O' is an Arguments object, 'P' is own accessor -# property of 'O' which is also defined in [[ParameterMap]] of 'O', and -# 'desc' is accessor descriptor, test updating multiple attribute values of -# 'P' (10.6 [[DefineOwnProperty]] step 3) -15.2.3.7-6-a-280: FAIL # Bug? Object.defineProperties - 'O' is an Arguments object, 'P' is own data # property of 'O' which is also defined in [[ParameterMap]] of 'O', and # 'desc' is data descriptor, test updating multiple attribute values of 'P' @@ -551,11 +454,6 @@ S15.4.4.3_A2_T1: FAIL_OK # 'P' which is defined as non-configurable (10.6 [[DefineOwnProperty]] step # 4) 15.2.3.7-6-a-285: FAIL -# Bug? Object.defineProperties - 'O' is an Arguments object, 'P' is an array -# index named accessor property of 'O' but not defined in [[ParameterMap]] -# of 'O', and 'desc' is accessor descriptor, test updating multiple -# attribute values of 'P' (10.6 [[DefineOwnProperty]] step 3) -15.2.3.7-6-a-292: FAIL # Bug? Strict Mode - 'this' value is a string which cannot be converted to # wrapper objects when the function is called with an array of arguments 15.3.4.3-1-s: FAIL -- 2.7.4