OLD | NEW |
1 // Copyright 2006-2008 the V8 project authors. All rights reserved. | 1 // Copyright 2006-2008 the V8 project authors. All rights reserved. |
2 // Redistribution and use in source and binary forms, with or without | 2 // Redistribution and use in source and binary forms, with or without |
3 // modification, are permitted provided that the following conditions are | 3 // modification, are permitted provided that the following conditions are |
4 // met: | 4 // met: |
5 // | 5 // |
6 // * Redistributions of source code must retain the above copyright | 6 // * Redistributions of source code must retain the above copyright |
7 // notice, this list of conditions and the following disclaimer. | 7 // notice, this list of conditions and the following disclaimer. |
8 // * Redistributions in binary form must reproduce the above | 8 // * Redistributions in binary form must reproduce the above |
9 // copyright notice, this list of conditions and the following | 9 // copyright notice, this list of conditions and the following |
10 // disclaimer in the documentation and/or other materials provided | 10 // disclaimer in the documentation and/or other materials provided |
(...skipping 491 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
502 void*) { | 502 void*) { |
503 // Before we can set the prototype we need to be sure | 503 // Before we can set the prototype we need to be sure |
504 // prototype cycles are prevented. | 504 // prototype cycles are prevented. |
505 // It is sufficient to validate that the receiver is not in the new prototype | 505 // It is sufficient to validate that the receiver is not in the new prototype |
506 // chain. | 506 // chain. |
507 | 507 |
508 // Silently ignore the change if value is not a JSObject or null. | 508 // Silently ignore the change if value is not a JSObject or null. |
509 // SpiderMonkey behaves this way. | 509 // SpiderMonkey behaves this way. |
510 if (!value->IsJSObject() && !value->IsNull()) return value; | 510 if (!value->IsJSObject() && !value->IsNull()) return value; |
511 | 511 |
512 bool clear_ics = false; | |
513 for (Object* pt = value; pt != Heap::null_value(); pt = pt->GetPrototype()) { | 512 for (Object* pt = value; pt != Heap::null_value(); pt = pt->GetPrototype()) { |
514 JSObject *obj = JSObject::cast(pt); | 513 if (JSObject::cast(pt) == receiver) { |
515 if (obj == receiver) { | |
516 // Cycle detected. | 514 // Cycle detected. |
517 HandleScope scope; | 515 HandleScope scope; |
518 return Top::Throw(*Factory::NewError("cyclic_proto", | 516 return Top::Throw(*Factory::NewError("cyclic_proto", |
519 HandleVector<Object>(NULL, 0))); | 517 HandleVector<Object>(NULL, 0))); |
520 } | 518 } |
521 if (obj->HasLocalPropertyWithType(CALLBACKS)) | |
522 clear_ics = true; | |
523 } | 519 } |
524 | 520 |
525 // Find the first object in the chain whose prototype object is not | 521 // Find the first object in the chain whose prototype object is not |
526 // hidden and set the new prototype on that object. | 522 // hidden and set the new prototype on that object. |
527 JSObject* current = receiver; | 523 JSObject* current = receiver; |
528 Object* current_proto = receiver->GetPrototype(); | 524 Object* current_proto = receiver->GetPrototype(); |
529 while (current_proto->IsJSObject() && | 525 while (current_proto->IsJSObject() && |
530 JSObject::cast(current_proto)->map()->is_hidden_prototype()) { | 526 JSObject::cast(current_proto)->map()->is_hidden_prototype()) { |
531 current = JSObject::cast(current_proto); | 527 current = JSObject::cast(current_proto); |
532 current_proto = current_proto->GetPrototype(); | 528 current_proto = current_proto->GetPrototype(); |
533 } | 529 } |
534 | 530 |
535 // Set the new prototype of the object. | 531 // Set the new prototype of the object. |
536 Object* new_map = current->map()->CopyDropTransitions(); | 532 Object* new_map = current->map()->CopyDropTransitions(); |
537 if (new_map->IsFailure()) return new_map; | 533 if (new_map->IsFailure()) return new_map; |
538 Map::cast(new_map)->set_prototype(value); | 534 Map::cast(new_map)->set_prototype(value); |
539 current->set_map(Map::cast(new_map)); | 535 current->set_map(Map::cast(new_map)); |
540 | 536 |
541 // Finally, if the prototype contains a setter we may have broken | |
542 // the assumptions made when creating ics so we have to clear them. | |
543 if (clear_ics) Heap::ClearStoreICs(); | |
544 | |
545 // To be consistent with other Set functions, return the value. | 537 // To be consistent with other Set functions, return the value. |
546 return value; | 538 return value; |
547 } | 539 } |
548 | 540 |
549 | 541 |
550 const AccessorDescriptor Accessors::ObjectPrototype = { | 542 const AccessorDescriptor Accessors::ObjectPrototype = { |
551 ObjectGetPrototype, | 543 ObjectGetPrototype, |
552 ObjectSetPrototype, | 544 ObjectSetPrototype, |
553 0 | 545 0 |
554 }; | 546 }; |
555 | 547 |
556 } } // namespace v8::internal | 548 } } // namespace v8::internal |
OLD | NEW |