- 12 Apr, 2013 1 commit
-
-
mstarzinger@chromium.org authored
When defining an indexed property on an Array object, the object's length property should (perhaps) be updated. This was done for any property for which ToUInt32(name) == ToNumber(name) was true, meaning any property name that, when converted to a number, was an integer in the range [0, 2^32). The detection should be more strict; an indexed property is one for which ToString(ToUInt32(name)) == name is true only. Review URL: https://codereview.chromium.org/13914003 Patch from Jens Lindström <jl@opera.com>. git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14242 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
-
- 20 Sep, 2012 1 commit
-
-
ulan@chromium.org authored
BUG=v8:2341 R=jkummerow@chromium.org Review URL: https://chromiumcodereview.appspot.com/10964015 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12564 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
-
- 17 Sep, 2012 1 commit
-
-
yangguo@chromium.org authored
R=mstarzinger@chromium.org BUG=v8:2261 Review URL: https://chromiumcodereview.appspot.com/10907254 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12530 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
-
- 12 Sep, 2012 1 commit
-
-
mstarzinger@chromium.org authored
This fixes materialization of arguments objects for strict mode functions during deoptimization. We materialize arguments from the stack area where optimized code pushes the arguments when entering the inlined environment. For adapted invocations we use the arguments adaptor frame for materialization. R=svenpanne@chromium.org BUG=v8:2261 TEST=mjsunit/regress/regress-2261,mjsunit/compiler/inline-arguments Review URL: https://chromiumcodereview.appspot.com/10908194 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12489 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
-
- 31 Aug, 2012 1 commit
-
-
yangguo@chromium.org authored
BUG=v8:2261 Review URL: https://chromiumcodereview.appspot.com/10910029 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12418 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
-
- 16 Aug, 2012 1 commit
-
-
svenpanne@chromium.org authored
Seeing monomorphic type feedback plus an AccessorPair does not necessarily imply that the corresponding getter/setter is really there, so we have to check for this explictly. TEST=mjsunit/object-define-property Review URL: https://chromiumcodereview.appspot.com/10825384 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12317 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
-
- 04 Jul, 2012 1 commit
-
-
svenpanne@chromium.org authored
Made stub compiler function signatures a bit more consistent on the way. Review URL: https://chromiumcodereview.appspot.com/10735003 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11984 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
-
- 07 Mar, 2012 2 commits
-
-
svenpanne@chromium.org authored
Previously, there were 1 or 2 calls to the runtime when accessors were changed or set. This doesn't really work well with property attributes, leading to some hacks and complicates things even further when trying to share maps in presence of accessors. Therefore, the runtime entry now takes the full triple (getter, setter, attributes), where the getter and/or the setter can be null in case they shouldn't be changed. For now, we do basically the same on the native side as we did before on the JavaScript side, but this will change in future CLs, the current CL is already large enough. Note that object literals with a getter and a setter for the same property still do 2 calls, but this is a little bit more tricky to fix and will be handled in a separate CL. Review URL: https://chromiumcodereview.appspot.com/9616016 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10956 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
-
svenpanne@chromium.org authored
Review URL: https://chromiumcodereview.appspot.com/9605042 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10951 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
-
- 24 Feb, 2012 1 commit
-
-
mstarzinger@chromium.org authored
This allows elements of the non-strict arguments object to be redefined with custom attributes and still maintain an alias into the context. Such a slow alias is maintained by placing a special marker into the dictionary backing store of the arguments object. R=rossberg@chromium.org BUG=v8:1772 TEST=test262,mjsunit/object-define-property Review URL: https://chromiumcodereview.appspot.com/9460004 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10827 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
-
- 08 Jun, 2011 1 commit
-
-
lrn@chromium.org authored
TEST=mjsunit/object-define-property Review URL: http://codereview.chromium.org/7129017 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8215 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
-
- 31 May, 2011 1 commit
-
-
ager@chromium.org authored
Our testing infrastructure uses exceptions to indicate errors. assertUnreachable therefore throws an exception to indicate that it was reached. Therefore, it cannot be used to check that an exception was thrown using the pattern: try { shouldThrow(); assertUnreachable(); } catch(e) { } Such a test will always pass because assertUnreachable will throw an exception if shouldThrow does not. R=ricow@chromium.org Review URL: http://codereview.chromium.org/7053035 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8117 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
-
- 03 Feb, 2011 1 commit
-
-
peterhal@chromium.org authored
My previous patch added an assert which uncovered 1092 in the sputnik tests. This patch adds the fix for 1092, which is to ensure that NormalizeProperties does not get called for a JSGlobalProxy along all code paths. Add sputnik tests to .gitignore. BUG= TEST= Review URL: http://codereview.chromium.org/6286060 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6627 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
-
- 01 Feb, 2011 2 commits
-
-
peterhal@chromium.org authored
This reverts commit 6561 as the new assert caused failures in sputnik. git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6562 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
-
peterhal@chromium.org authored
Fixes JS portion of DefineOwnProperty when there is an existing property and the new descriptor is generic. Makes code follow spec steps more closely. Fixes typo for check for unchanged enumerable in step 6. Adds regression tests. Fixes errors in object-define-property test Don't normalize the JSGlobalProxy. Gets webkit http/tests/security/xss-DENIED-defineProperty.html working. git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6561 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
-
- 10 Jan, 2011 1 commit
-
-
ricow@chromium.org authored
This change caused a webkit failure in http/tests/security/xss-DENIED-defineProperty.html. I will look into this and reapply when I find a solution. Review URL: http://codereview.chromium.org/6134005 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6232 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
-
- 07 Jan, 2011 1 commit
-
-
ricow@chromium.org authored
First cut at bug 992 Fixes JS portion of DefineOwnProperty when there is an existing property and the new descriptor is generic. Makes code follow spec steps more closely. Fixes typo for check for unchanged enumerable in step 6. Adds regression test. Codereview url: http://codereview.chromium.org/6035014/ git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6220 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
-
- 16 Dec, 2010 1 commit
-
-
ricow@chromium.org authored
Change Object.defineProperty to accept undefined as getters and setters and to correctly accept overriding an accessor with a data property. In the past we only accepted functions as argument for setting an accessor. Since one should be able to set an accessor to undefined this had to be changed to take either. In addition, we did not lookup properties in the prototype chain, causing us to call the setter of an existing accessor up the prototype chain when trying to replace an existing accessor (that was not local) with a data property. Review URL: http://codereview.chromium.org/5861006 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6045 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
-
- 10 Dec, 2010 1 commit
-
-
lrn@chromium.org authored
Review URL: http://codereview.chromium.org/5773002 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5960 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
-
- 14 Jun, 2010 1 commit
-
-
ricow@chromium.org authored
(fixes bug 619). This also fixes a bug in GetOwnProperty in runtime.cc discovered by the new test cases. That part of the code was not testable before since we had no way of correctly defining properties on elements. Review URL: http://codereview.chromium.org/2832001 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@4862 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
-
- 26 May, 2010 1 commit
-
-
ricow@chromium.org authored
The existing version will overwrite the existing writable flag with false even in the case where no new value is given and the existing writable flag is true. The reason for the issue is that there is no check to see if the provided descriptor actually has a writable attribute. This causes us to use the default value (false) even in the case where nothing was provided. In addition, the existing tests makes wrong assumptions (that writable is always set to false if not provided) and has been changed to follow the specification. Review URL: http://codereview.chromium.org/2271001 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@4720 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
-
- 25 May, 2010 1 commit
-
-
ricow@chromium.org authored
Object.defineProperty with empty property descriptor. The issue is fixed by implementing step 5 and 6 from DefineOwnProperty in the specification (ES5 8.12.9). This also fixes a bug in SameValue when used on boolean values (it would priorly return a number - not a boolean). Review URL: http://codereview.chromium.org/2131019 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@4708 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
-
- 04 Feb, 2010 1 commit
-
-
ricow@chromium.org authored
DefineOrRedefineDataProperty to avoid invalid input. Added tests to object-define-property.js to test that it does not crash on invalid input. Review URL: http://codereview.chromium.org/572005 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@3798 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
-
- 03 Feb, 2010 1 commit
-
-
ricow@chromium.org authored
DefineOwnProperty (changed to allow for redefinition of existing property) SameValue Extra info on propertydescriptor GetProperty HasProperty Currently the DefineOrRedefineAccessorProperty deletes the existing property on the object if it is a dataproperty (FIELD or NORMAL) and adds a new one. This can potentially be optimized. Review URL: http://codereview.chromium.org/555149 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@3786 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
-