| OLD | NEW |
| 1 // Copyright 2006-2008 the V8 project authors. All rights reserved. | 1 // Copyright 2006-2008 the V8 project authors. All rights reserved. |
| 2 // Redistribution and use in source and binary forms, with or without | 2 // Redistribution and use in source and binary forms, with or without |
| 3 // modification, are permitted provided that the following conditions are | 3 // modification, are permitted provided that the following conditions are |
| 4 // met: | 4 // met: |
| 5 // | 5 // |
| 6 // * Redistributions of source code must retain the above copyright | 6 // * Redistributions of source code must retain the above copyright |
| 7 // notice, this list of conditions and the following disclaimer. | 7 // notice, this list of conditions and the following disclaimer. |
| 8 // * Redistributions in binary form must reproduce the above | 8 // * Redistributions in binary form must reproduce the above |
| 9 // copyright notice, this list of conditions and the following | 9 // copyright notice, this list of conditions and the following |
| 10 // disclaimer in the documentation and/or other materials provided | 10 // disclaimer in the documentation and/or other materials provided |
| (...skipping 491 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 502 void*) { | 502 void*) { |
| 503 // Before we can set the prototype we need to be sure | 503 // Before we can set the prototype we need to be sure |
| 504 // prototype cycles are prevented. | 504 // prototype cycles are prevented. |
| 505 // It is sufficient to validate that the receiver is not in the new prototype | 505 // It is sufficient to validate that the receiver is not in the new prototype |
| 506 // chain. | 506 // chain. |
| 507 | 507 |
| 508 // Silently ignore the change if value is not a JSObject or null. | 508 // Silently ignore the change if value is not a JSObject or null. |
| 509 // SpiderMonkey behaves this way. | 509 // SpiderMonkey behaves this way. |
| 510 if (!value->IsJSObject() && !value->IsNull()) return value; | 510 if (!value->IsJSObject() && !value->IsNull()) return value; |
| 511 | 511 |
| 512 bool clear_ics = false; | |
| 513 for (Object* pt = value; pt != Heap::null_value(); pt = pt->GetPrototype()) { | 512 for (Object* pt = value; pt != Heap::null_value(); pt = pt->GetPrototype()) { |
| 514 JSObject *obj = JSObject::cast(pt); | 513 if (JSObject::cast(pt) == receiver) { |
| 515 if (obj == receiver) { | |
| 516 // Cycle detected. | 514 // Cycle detected. |
| 517 HandleScope scope; | 515 HandleScope scope; |
| 518 return Top::Throw(*Factory::NewError("cyclic_proto", | 516 return Top::Throw(*Factory::NewError("cyclic_proto", |
| 519 HandleVector<Object>(NULL, 0))); | 517 HandleVector<Object>(NULL, 0))); |
| 520 } | 518 } |
| 521 if (obj->HasLocalPropertyWithType(CALLBACKS)) | |
| 522 clear_ics = true; | |
| 523 } | 519 } |
| 524 | 520 |
| 525 // Find the first object in the chain whose prototype object is not | 521 // Find the first object in the chain whose prototype object is not |
| 526 // hidden and set the new prototype on that object. | 522 // hidden and set the new prototype on that object. |
| 527 JSObject* current = receiver; | 523 JSObject* current = receiver; |
| 528 Object* current_proto = receiver->GetPrototype(); | 524 Object* current_proto = receiver->GetPrototype(); |
| 529 while (current_proto->IsJSObject() && | 525 while (current_proto->IsJSObject() && |
| 530 JSObject::cast(current_proto)->map()->is_hidden_prototype()) { | 526 JSObject::cast(current_proto)->map()->is_hidden_prototype()) { |
| 531 current = JSObject::cast(current_proto); | 527 current = JSObject::cast(current_proto); |
| 532 current_proto = current_proto->GetPrototype(); | 528 current_proto = current_proto->GetPrototype(); |
| 533 } | 529 } |
| 534 | 530 |
| 535 // Set the new prototype of the object. | 531 // Set the new prototype of the object. |
| 536 Object* new_map = current->map()->CopyDropTransitions(); | 532 Object* new_map = current->map()->CopyDropTransitions(); |
| 537 if (new_map->IsFailure()) return new_map; | 533 if (new_map->IsFailure()) return new_map; |
| 538 Map::cast(new_map)->set_prototype(value); | 534 Map::cast(new_map)->set_prototype(value); |
| 539 current->set_map(Map::cast(new_map)); | 535 current->set_map(Map::cast(new_map)); |
| 540 | 536 |
| 541 // Finally, if the prototype contains a setter we may have broken | |
| 542 // the assumptions made when creating ics so we have to clear them. | |
| 543 if (clear_ics) Heap::ClearStoreICs(); | |
| 544 | |
| 545 // To be consistent with other Set functions, return the value. | 537 // To be consistent with other Set functions, return the value. |
| 546 return value; | 538 return value; |
| 547 } | 539 } |
| 548 | 540 |
| 549 | 541 |
| 550 const AccessorDescriptor Accessors::ObjectPrototype = { | 542 const AccessorDescriptor Accessors::ObjectPrototype = { |
| 551 ObjectGetPrototype, | 543 ObjectGetPrototype, |
| 552 ObjectSetPrototype, | 544 ObjectSetPrototype, |
| 553 0 | 545 0 |
| 554 }; | 546 }; |
| 555 | 547 |
| 556 } } // namespace v8::internal | 548 } } // namespace v8::internal |
| OLD | NEW |