Protect the emptiness of Array prototype elements with a PropertyCell.

test/cctest/test-api.cc

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 16623 matching lines @@
     last_location = last_message = NULL;
     // Still entered, should fail.
     isolate->Dispose();
     CHECK(last_location);
     CHECK(last_message);
   }
   isolate->Dispose();
 }
 
 
+static void BreakArrayGuarantees(const char* script) {
+  printf("script: %s\n", script);

[Jakob Kummerow, 2015/04/21 15:41:49]

nit: debugging leftover?

[mvstanton, 2015/04/22 07:22:33]

Done.

+  v8::Isolate* isolate1 = v8::Isolate::New();
+  isolate1->Enter();
+  v8::Persistent<v8::Context> context1;
+  {
+    v8::HandleScope scope(isolate1);
+    context1.Reset(isolate1, Context::New(isolate1));
+  }
+
+  {
+    v8::HandleScope scope(isolate1);
+    v8::Local<v8::Context> context =
+        v8::Local<v8::Context>::New(isolate1, context1);
+    v8::Context::Scope context_scope(context);
+    v8::internal::Isolate* i_isolate =
+        reinterpret_cast<v8::internal::Isolate*>(isolate1);
+    DCHECK_EQ(true, i_isolate->IsFastArrayConstructorPrototypeChainIntact());

[Jakob Kummerow, 2015/04/21 15:41:49]

s/DCHECK/CHECK/, and again below?

[mvstanton, 2015/04/22 07:22:33]

Done.

+    // Run something in new isolate.
+    CompileRun(script);
+    DCHECK_EQ(false, i_isolate->IsFastArrayConstructorPrototypeChainIntact());
+  }
+  isolate1->Exit();
+  isolate1->Dispose();
+}
+
+
+TEST(VerifyArrayPrototypeGuarantees) {
+  // Break fast array hole handling by element changes.
+  BreakArrayGuarantees("[].__proto__[1] = 3;");
+  BreakArrayGuarantees("Object.prototype[3] = 'three';");
+  BreakArrayGuarantees("Array.prototype.push(1);");
+  BreakArrayGuarantees("Array.prototype.unshift(1);");
+  // Break fast array hole handling by prototype structure changes.
+  BreakArrayGuarantees("[].__proto__.__proto__ = { funny: true };");
+  // By sending elements to dictionary mode.
+  BreakArrayGuarantees("Object.freeze(Array.prototype);");
+  BreakArrayGuarantees("Object.freeze(Object.prototype);");
+  BreakArrayGuarantees(
+      "Object.defineProperty(Array.prototype, 0, {"
+      "  get: function() { return 3; }});");
+  BreakArrayGuarantees(
+      "Object.defineProperty(Object.prototype, 0, {"
+      "  get: function() { return 3; }});");
+}
+
+
 TEST(RunTwoIsolatesOnSingleThread) {
   // Run isolate 1.
   v8::Isolate* isolate1 = v8::Isolate::New();
   isolate1->Enter();
   v8::Persistent<v8::Context> context1;
   {
     v8::HandleScope scope(isolate1);
     context1.Reset(isolate1, Context::New(isolate1));
   }
 
@@ skipping 4364 matching lines @@
 
   {
     v8::HandleScope handle_scope(isolate);
 
     // Should work
     v8::Local<v8::Object> obj = v8::Object::New(isolate);
 
     USE(obj);
   }
 }