Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(43)

Unified Diff: src/accessors.cc

Issue 2543553002: [accessors] handle `writable` changing during ArrayLengthSetter (Closed)
Patch Set: s/name_string()/length_string()/ Created 4 years ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View side-by-side diff with in-line comments
Download patch
« no previous file with comments | « no previous file | test/mjsunit/array-length.js » ('j') | no next file with comments »
Expand Comments ('e') | Collapse Comments ('c') | Show Comments Hide Comments ('s')
Index: src/accessors.cc
diff --git a/src/accessors.cc b/src/accessors.cc
index 7c6d344ec0b9f1b86e8fd251f109eee6ae7a6d85..7c5305b33bb37d23dabc9ea8065ce2061be08e7a 100644
--- a/src/accessors.cc
+++ b/src/accessors.cc
@@ -167,16 +167,39 @@ void Accessors::ArrayLengthSetter(
i::Isolate* isolate = reinterpret_cast<i::Isolate*>(info.GetIsolate());
HandleScope scope(isolate);
+ DCHECK(Utils::OpenHandle(*name)->SameValue(isolate->heap()->length_string()));
+
Handle<JSReceiver> object = Utils::OpenHandle(*info.Holder());
Handle<JSArray> array = Handle<JSArray>::cast(object);
Handle<Object> length_obj = Utils::OpenHandle(*val);
+ bool was_readonly = JSArray::HasReadOnlyLength(array);
+
uint32_t length = 0;
if (!JSArray::AnythingToArrayLength(isolate, length_obj, &length)) {
isolate->OptionalRescheduleException(false);
return;
}
+ if (!was_readonly && length != array->length()->Number()) {
+ // AnythingToArrayLength() may have called setter re-entrantly and modified
+ // its property descriptor. Don't perform this check if "length" was
+ // previously readonly, as this may have been called during
+ // DefineOwnPropertyIgnoreAttributes().
Toon Verwaest 2016/11/30 18:05:52 What about if (!was_readonly && V8_UNLIKELY(is rea
caitp 2016/11/30 18:13:36 `I think the combination of !was_readonly && lengt
+ if (V8_UNLIKELY(JSArray::HasReadOnlyLength(array))) {
+ if (info.ShouldThrowOnError()) {
+ Factory* factory = isolate->factory();
+ isolate->Throw(*factory->NewTypeError(
+ MessageTemplate::kStrictReadOnlyProperty, Utils::OpenHandle(*name),
+ i::Object::TypeOf(isolate, object), object));
+ isolate->OptionalRescheduleException(false);
+ } else {
+ info.GetReturnValue().Set(false);
+ }
+ return;
+ }
+ }
+
JSArray::SetLength(array, length);
uint32_t actual_new_len = 0;
« no previous file with comments | « no previous file | test/mjsunit/array-length.js » ('j') | no next file with comments »

Powered by Google App Engine
This is Rietveld 408576698