Strict mode object literal validation

src/ast.cc

 // Copyright 2010 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 221 matching lines @@
     Handle<Object> handle = literal->handle();
 
     if (handle->IsNull()) {
       continue;
     }
 
     uint32_t hash;
     HashMap* table;
     void* key;
     uint32_t index;
-    if (handle->IsSymbol()) {
+
+    // Check for array index first because symbol may still be an array index:
+    // var y = {get "1234"() {return 42; }};
+    if (handle->ToArrayIndex(&index)) {

[Lasse Reichstein, 2011/01/25 11:19:03]

I already committed a patch for this case.
During that I checked what happens, and this change isn't even sufficient. The
ToArrayIndex function only works on numbers (Smi and HeapNumber), not strings.
You need a second case inside the IsSymbol case to account for a string that
represents an array index.

[Martin Maly, 2011/01/25 18:29:23]

Thanks, I reverted this part of my change.

+      key = handle.location();
+      hash = index;
+      table = &elements;
+    } else if (handle->IsSymbol()) {
       Handle<String> name(String::cast(*handle));
-      ASSERT(!name->AsArrayIndex(&index));
       key = name.location();
       hash = name->Hash();
       table = &properties;
-    } else if (handle->ToArrayIndex(&index)) {
-      key = handle.location();
-      hash = index;
-      table = &elements;
     } else {
       ASSERT(handle->IsNumber());
       double num = handle->Number();
       char arr[100];
       Vector<char> buffer(arr, ARRAY_SIZE(arr));
       const char* str = DoubleToCString(num, buffer);
       Handle<String> name = Factory::NewStringFromAscii(CStrVector(str));
       key = name.location();
       hash = name->Hash();
       table = &properties;
@@ skipping 778 matching lines @@
 
 CaseClause::CaseClause(Expression* label,
                        ZoneList<Statement*>* statements,
                        int pos)
     : label_(label),
       statements_(statements),
       position_(pos),
       compare_type_(NONE) {}
 
 } }  // namespace v8::internal