Cross-script variables handling fixed. It was possible to write to read-only global variable.

src/ia32/code-stubs-ia32.cc

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/v8.h"
 
 #if V8_TARGET_ARCH_IA32
 
 #include "src/base/bits.h"
 #include "src/bootstrapper.h"
@@ skipping 5155 matching lines @@
 
   // Go up context chain to the script context.
   for (int i = 0; i < depth(); ++i) {
     __ mov(cell_reg, ContextOperand(context_reg, Context::PREVIOUS_INDEX));
     context_reg = cell_reg;
   }
 
   // Load the PropertyCell at the specified slot.
   __ mov(cell_reg, ContextOperand(context_reg, slot_reg));
 
+  // Check that cell value is not the_hole.
+  {
+    // TODO(bmeurer): use ecx (name_reg) when name parameter is removed.
+    Register cell_value_reg = cell_details_reg;
+    __ mov(cell_value_reg, FieldOperand(cell_reg, PropertyCell::kValueOffset));
+    __ CompareRoot(cell_value_reg, Heap::kTheHoleValueRootIndex);
+    __ j(equal, &slow_case, FLAG_debug_code ? Label::kFar : Label::kNear);
+  }
+
   // Load PropertyDetails for the cell (actually only the cell_type and kind).
   __ mov(cell_details_reg,
          FieldOperand(cell_reg, PropertyCell::kDetailsOffset));
   __ SmiUntag(cell_details_reg);
   __ and_(cell_details_reg,
           Immediate(PropertyDetails::PropertyCellTypeField::kMask |
                     PropertyDetails::KindField::kMask));
 
 
   // Check if PropertyCell holds mutable data.
@@ skipping 47 matching lines @@
   // Check if PropertyCell contains data with constant type.
   __ cmp(cell_details_reg,
          Immediate(PropertyDetails::PropertyCellTypeField::encode(
                        PropertyCellType::kConstantType) |
                    PropertyDetails::KindField::encode(kData)));
   __ j(not_equal, &slow_case, Label::kNear);
 
   // Now either both old and new values must be SMIs or both must be heap
   // objects with same map.
   Label value_is_heap_object;
+  // TODO(bmeurer): use ecx (name_reg) when name parameter is removed.
   Register cell_value_reg = cell_details_reg;
   __ mov(cell_value_reg, FieldOperand(cell_reg, PropertyCell::kValueOffset));
   __ JumpIfNotSmi(value_reg, &value_is_heap_object, Label::kNear);
   __ JumpIfNotSmi(cell_value_reg, &slow_case, Label::kNear);
   // Old and new values are SMIs, no need for a write barrier here.
   __ bind(&fast_smi_case);
   __ mov(FieldOperand(cell_reg, PropertyCell::kValueOffset), value_reg);
   __ Ret();
   __ bind(&value_is_heap_object);
   __ JumpIfSmi(cell_value_reg, &slow_case, Label::kNear);
@@ skipping 401 matching lines @@
                            Operand(ebp, 7 * kPointerSize), NULL);
 }
 
 
 #undef __
 
 }  // namespace internal
 }  // namespace v8
 
 #endif  // V8_TARGET_ARCH_IA32