Fixed a bug exposed by the Mozilla test suite where the result of ...

src/objects.cc

 // Copyright 2006-2008 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 417 matching lines @@
   }
   return value;
 }
 
 
 Object* JSObject::SetNormalizedProperty(String* name,
                                         Object* value,
                                         PropertyDetails details) {
   ASSERT(!HasFastProperties());
   int entry = property_dictionary()->FindStringEntry(name);
   Object* store_value = value;

[Kasper Lund, 2009/03/09 09:27:33]

Maybe move the declaration of store_value to the (entry == -1) case?

   if (entry == -1) {
     if (IsJSGlobalObject()) {
       store_value = Heap::AllocateJSGlobalPropertyCell(value);
     }
     if (store_value->IsFailure()) return store_value;

[Kasper Lund, 2009/03/09 09:27:33]

Move inside the IsJSGlobalObject() case?

     Object* dict =
         property_dictionary()->AddStringEntry(name, store_value, details);
     if (dict->IsFailure()) return dict;
     set_properties(Dictionary::cast(dict));
     return value;
   }
   // Preserve enumeration index.
   details = PropertyDetails(details.attributes(),
                             details.type(),
                             property_dictionary()->DetailsAt(entry).index());
   if (IsJSGlobalObject()) {
     JSGlobalPropertyCell* cell =
         JSGlobalPropertyCell::cast(property_dictionary()->ValueAt(entry));
     cell->set_value(value);
     store_value = cell;

[Kasper Lund, 2009/03/09 09:27:33]

Remove. You're not going to use store_value from here.

+    // No need to update the property dictionary.
+  } else {
+    property_dictionary()->SetStringEntry(entry, name, store_value, details);

[Kasper Lund, 2009/03/09 09:27:33]

store_value -> value?

   }
-  property_dictionary()->SetStringEntry(entry, name, store_value, details);
   return value;
 }
 
 
 Object* Object::GetProperty(Object* receiver,
                             LookupResult* result,
                             String* name,
                             PropertyAttributes* attributes) {
   // Make sure that the top context does not change when doing
   // callbacks or interceptor calls.
@@ skipping 844 matching lines @@
 
   return function;
 }
 
 
 // Add property in slow mode
 Object* JSObject::AddSlowProperty(String* name,
                                   Object* value,
                                   PropertyAttributes attributes) {
   PropertyDetails details = PropertyDetails(attributes, NORMAL);
+  Object* store_value = value;
   if (IsJSGlobalObject()) {
-    value = Heap::AllocateJSGlobalPropertyCell(value);
-    if (value->IsFailure()) return value;
+    store_value = Heap::AllocateJSGlobalPropertyCell(value);
+    if (store_value->IsFailure()) return store_value;
   }
-  Object* result = property_dictionary()->AddStringEntry(name, value, details);
+  Object* result = property_dictionary()->AddStringEntry(name,
+                                                         store_value,
+                                                         details);
   if (result->IsFailure()) return result;
   if (property_dictionary() != result) {
      set_properties(Dictionary::cast(result));

[Kasper Lund, 2009/03/09 09:27:33]

Weird indentation.

   }
   return value;
 }
 
 
 Object* JSObject::AddProperty(String* name,
                               Object* value,
                               PropertyAttributes attributes) {
   ASSERT(!IsJSGlobalProxy());
   if (HasFastProperties()) {
@@ skipping 5991 matching lines @@
   // No break point.
   if (break_point_objects()->IsUndefined()) return 0;
   // Single beak point.
   if (!break_point_objects()->IsFixedArray()) return 1;
   // Multiple break points.
   return FixedArray::cast(break_point_objects())->length();
 }
 
 
 } }  // namespace v8::internal