Chromium Code Reviews| Index: src/objects.cc |
| diff --git a/src/objects.cc b/src/objects.cc |
| index 405867a908f3f34f91841dbaafac7fa86519f34c..a5d83436ec5ba3c9acb6f0e2771ca15128a3da94 100644 |
| --- a/src/objects.cc |
| +++ b/src/objects.cc |
| @@ -27,6 +27,7 @@ |
| #include "v8.h" |
| +#include "accessors.h" |
| #include "api.h" |
| #include "arguments.h" |
| #include "bootstrapper.h" |
| @@ -3104,9 +3105,18 @@ MaybeObject* JSObject::SetLocalPropertyIgnoreAttributes( |
| Handle<Object> old_value(isolate->heap()->the_hole_value(), isolate); |
| PropertyAttributes old_attributes = ABSENT; |
| - if (FLAG_harmony_observation && map()->is_observed()) { |
| - old_value = handle(lookup.GetLazyValue(), isolate); |
| - old_attributes = lookup.GetAttributes(); |
| + bool is_observed = FLAG_harmony_observation && self->map()->is_observed(); |
| + if (is_observed) { |
| + // Function prototypes are stored specially |
| + if (self->IsJSFunction() && |
| + JSFunction::cast(*self)->should_have_prototype() && |
| + name->Equals(isolate->heap()->prototype_symbol())) { |
| + MaybeObject* maybe = Accessors::FunctionGetPrototype(*self, NULL); |
| + if (!maybe->ToHandle(&old_value, isolate)) return maybe; |
|
rossberg
2012/12/05 12:02:29
I don't understand why this works. How come you do
adamk
2012/12/05 17:38:17
Hmm, I don't understand either. Added a test that
adamk
2012/12/05 19:47:38
Ah, here's why: there's that special case in %Defi
|
| + } else { |
| + old_value = handle(lookup.GetLazyValue(), isolate); |
| + old_attributes = lookup.GetAttributes(); |
| + } |
| } |
| // Check of IsReadOnly removed from here in clone. |
| @@ -3169,7 +3179,7 @@ MaybeObject* JSObject::SetLocalPropertyIgnoreAttributes( |
| Handle<Object> hresult; |
| if (!result->ToHandle(&hresult, isolate)) return result; |
| - if (FLAG_harmony_observation && map()->is_observed()) { |
| + if (is_observed) { |
| if (lookup.IsTransition()) { |
| EnqueueChangeRecord(self, "new", name, old_value); |
| } else { |