Fix second half of issue 1151, the first change (r6765) only fixed FunctionGe...

src/accessors.cc

Index: src/accessors.cc
===================================================================
--- src/accessors.cc	(revision 6865)
+++ src/accessors.cc	(working copy)
@@ -447,7 +447,22 @@
   JSFunction* function = FindInPrototypeChain<JSFunction>(object, &found_it);
   if (!found_it) return Heap::undefined_value();
   if (!function->has_prototype()) {
-    if (!function->should_have_prototype()) return Heap::undefined_value();
+    if (!function->should_have_prototype()) {

[Mads Ager (chromium), 2011/02/22 10:17:07]

Can we simplify this? How about moving this before the
!function->has_prototype() check and doing something like:

while (!function->should_have_prototype()) {
  found_it = false;
  function = FindInPrototypeChain<JSFunction>(object->GetPrototype(),
&found_it);
  ASSERT(found_it);  // There has to be one because we hit the getter
}

That should be all that we need. Then the original code will do the right thing
as far as I can tell?

[Rico, 2011/02/22 12:22:44]

Done.

+      // Check if there is a 'prototype' property.
+      LookupResult result;
+      Handle<String> proto_name =

[Mads Ager (chromium), 2011/02/22 10:17:07]

This code does not use handles. You can use Heap::prototype_symbol() below
instead. 

[Rico, 2011/02/22 12:22:44]

Done.

+          Factory::NewStringFromAscii(CStrVector("prototype"));
+      function->Lookup(*proto_name, &result);
+
+      if (result.IsProperty()) {
+        if (result.holder()->IsJSFunction()) {
+          JSFunction* jsfunction = JSFunction::cast(result.holder());
+          if (jsfunction->has_prototype()) return jsfunction->prototype();
+        }
+      }
+      // There was no prototype in the prototype chain, return undefined.
+      return Heap::undefined_value();
+    }
     Object* prototype;
     { MaybeObject* maybe_prototype = Heap::AllocateFunctionPrototype(function);
       if (!maybe_prototype->ToObject(&prototype)) return maybe_prototype;
@@ -467,6 +482,13 @@
   bool found_it = false;
   JSFunction* function = FindInPrototypeChain<JSFunction>(object, &found_it);
   if (!found_it) return Heap::undefined_value();
+  if (!function->should_have_prototype()) {
+    return object->SetLocalPropertyIgnoreAttributes(

[Mads Ager (chromium), 2011/02/22 10:17:07]

Please add a comment stating that object does not have a prototype property
since we hit this accessor.

[Rico, 2011/02/22 12:22:44]

Done.

+        *Factory::NewStringFromAscii(CStrVector("prototype")),

[Mads Ager (chromium), 2011/02/22 10:17:07]

Heap::prototype_symbol()

[Rico, 2011/02/22 12:22:44]

Done.

+        value,
+        NONE);
+  }
+
   if (function->has_initial_map()) {
     // If the function has allocated the initial map
     // replace it with a copy containing the new prototype.