Index: src/runtime/runtime-scopes.cc |
diff --git a/src/runtime/runtime-scopes.cc b/src/runtime/runtime-scopes.cc |
index c5890e7071795daf7788577b899410f8b26584bf..997e405bffa056efbe27d938928ca46892201417 100644 |
--- a/src/runtime/runtime-scopes.cc |
+++ b/src/runtime/runtime-scopes.cc |
@@ -65,21 +65,27 @@ static Object* DeclareGlobals(Isolate* isolate, Handle<JSGlobalObject> global, |
// Check whether we can reconfigure the existing property into a |
// function. |
PropertyDetails old_details = it.property_details(); |
- // TODO(verwaest): ACCESSOR_CONSTANT invalidly includes |
- // ExecutableAccessInfo, |
- // which are actually data properties, not accessor properties. |
if (old_details.IsReadOnly() || old_details.IsDontEnum() || |
- old_details.type() == ACCESSOR_CONSTANT) { |
+ (it.state() == LookupIterator::ACCESSOR && |
+ it.GetAccessors()->IsAccessorPair())) { |
return ThrowRedeclarationError(isolate, name); |
} |
// If the existing property is not configurable, keep its attributes. Do |
attr = old_attributes; |
} |
+ |
+ // If the current state is ACCESSOR, this could mean it's an AccessorInfo |
+ // type property. We are not allowed to call into such setters during global |
+ // function declaration since this would break e.g., onload. Meaning |
+ // 'function onload() {}' would invalidly register that function as the |
+ // onload callback. To avoid this situation, we first delete the property |
+ // before readding it as a regular data property below. |
+ if (it.state() == LookupIterator::ACCESSOR) it.Delete(); |
} |
// Define or redefine own property. |
- RETURN_FAILURE_ON_EXCEPTION(isolate, JSObject::SetOwnPropertyIgnoreAttributes( |
- global, name, value, attr)); |
+ RETURN_FAILURE_ON_EXCEPTION( |
+ isolate, JSObject::DefineOwnPropertyIgnoreAttributes(&it, value, attr)); |
return isolate->heap()->undefined_value(); |
} |
@@ -196,8 +202,8 @@ RUNTIME_FUNCTION(Runtime_InitializeConstGlobal) { |
} |
} |
- RETURN_FAILURE_ON_EXCEPTION(isolate, JSObject::SetOwnPropertyIgnoreAttributes( |
- global, name, value, attr)); |
+ RETURN_FAILURE_ON_EXCEPTION( |
+ isolate, JSObject::DefineOwnPropertyIgnoreAttributes(&it, value, attr)); |
return *value; |
} |