ic: perform interceptor query in LookupForWrite

ic: perform interceptor query in LookupForWrite

Right now, v8 in a strict mode will give up setting a property on global
object if it has setter interceptor. Correct behaviour would be calling query
interceptor or getter, if present, to figure out if the property (variable) was
declared.

See node.js issue for details: https://github.com/joyent/node/issues/6235

[ Closed since it's subsumed by https://chromiumcodereview.appspot.com/23533012 ]

R=svenpanne@chromium.org
BUG=

[danno, 2013-09-20 09:08:36]

Adding Toon for reivew.

[Toon Verwaest, 2013-09-23 13:09:59]

It's not entirely clear to me what problem you are fixing. Can we have a
test-case for this?

Previously if there was an interceptor setter, we'd always initialize the IC
because lookup->CanHoldValue(value) would always return true (given that
representation is Tagged).

Could it be that you are trying to fix a problem that was already fixed by
https://chromiumcodereview.appspot.com/23533012?

https://codereview.chromium.org/24272005/diff/1/src/ic.cc
File src/ic.cc (right):

https://codereview.chromium.org/24272005/diff/1/src/ic.cc#newcode1618
src/ic.cc:1618: ASSERT(lookup->representation()->IsNone());
Why would the representation be none? It's explicitly set to Tagged in
InterceptorResult in src/property.h

[indutny, 2013-09-23 13:15:18]

On 2013/09/23 13:09:59, Toon Verwaest wrote:
> It's not entirely clear to me what problem you are fixing. Can we have a
> test-case for this?
> 
> Previously if there was an interceptor setter, we'd always initialize the IC
> because lookup->CanHoldValue(value) would always return true (given that
> representation is Tagged).
> 
> Could it be that you are trying to fix a problem that was already fixed by
> https://chromiumcodereview.appspot.com/23533012?
> 
> https://codereview.chromium.org/24272005/diff/1/src/ic.cc
> File src/ic.cc (right):
> 
> https://codereview.chromium.org/24272005/diff/1/src/ic.cc#newcode1618
> src/ic.cc:1618: ASSERT(lookup->representation()->IsNone());
> Why would the representation be none? It's explicitly set to Tagged in
> InterceptorResult in src/property.h

It seems like CL you're referencing should fix the problem, I'll try it and will
let you know if it'll work for me.

Is there any chance of backporting it to 3.20.17 ?

[Toon Verwaest, 2013-09-23 13:20:13]

Done 14 minutes ago ;) https://codereview.chromium.org/23480102/

[indutny, 2013-09-23 16:24:39]

On 2013/09/23 13:20:13, Toon Verwaest wrote:
> Done 14 minutes ago ;) https://codereview.chromium.org/23480102/

Great! :)

Seems to be working for me in node.js, thank you for letting me know and looking
at this CL.