Skip to content
Closed
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion deps/v8/include/v8-version.h
Original file line numberDiff line numberDiff line change
Expand Up@@ -11,7 +11,7 @@
#define V8_MAJOR_VERSION 5
#define V8_MINOR_VERSION 9
#define V8_BUILD_NUMBER 211
#define V8_PATCH_LEVEL 37
#define V8_PATCH_LEVEL 38

// Use 1 for candidates and 0 otherwise.
// (Boolean macro values are not supported by all preprocessors.)
Expand Down
5 changes: 5 additions & 0 deletions deps/v8/src/ic/handler-configuration-inl.h
Original file line numberDiff line numberDiff line change
Expand Up@@ -13,6 +13,11 @@
namespacev8{
namespaceinternal{

// Decodes kind from Smi-handler.
LoadHandler::Kind LoadHandler::GetHandlerKind(Smi* smi_handler){
returnKindBits::decode(smi_handler->value());
}

Handle<Smi> LoadHandler::LoadNormal(Isolate* isolate){
int config = KindBits::encode(kNormal);
returnhandle(Smi::FromInt(config), isolate);
Expand Down
3 changes: 3 additions & 0 deletions deps/v8/src/ic/handler-configuration.h
Original file line numberDiff line numberDiff line change
Expand Up@@ -90,6 +90,9 @@ class LoadHandler{
staticconstintkHolderCellIndex = 2;
staticconstintkFirstPrototypeIndex = 3;

// Decodes kind from Smi-handler.
staticinline Kind GetHandlerKind(Smi* smi_handler);

// Creates a Smi-handler for loading a property from a slow object.
staticinline Handle<Smi> LoadNormal(Isolate* isolate);

Expand Down
21 changes: 16 additions & 5 deletions deps/v8/src/ic/ic.cc
Original file line numberDiff line numberDiff line change
Expand Up@@ -868,10 +868,15 @@ int GetPrototypeCheckCount(Isolate* isolate, Handle<Map> receiver_map,
Handle<FixedArray>(), 0);
}

enum class HolderCellRequest{
kGlobalPropertyCell,
kHolder,
};

Handle<WeakCell> HolderCell(Isolate* isolate, Handle<JSObject> holder,
Handle<Name> name, Handle<Smi> smi_handler){
if (holder->IsJSGlobalObject() &&
*smi_handler != *LoadHandler::LoadInterceptor(isolate)){
Handle<Name> name, HolderCellRequest request){
if (request == HolderCellRequest::kGlobalPropertyCell){
DCHECK(holder->IsJSGlobalObject());
Handle<JSGlobalObject> global = Handle<JSGlobalObject>::cast(holder);
GlobalDictionary* dict = global->global_dictionary();
int number = dict->FindEntry(name);
Expand DownExpand Up@@ -908,8 +913,14 @@ Handle<Object> LoadIC::LoadFromPrototype(Handle<Map> receiver_map,
Map::GetOrCreatePrototypeChainValidityCell(receiver_map, isolate());
DCHECK(!validity_cell.is_null());

Handle<WeakCell> holder_cell =
HolderCell(isolate(), holder, name, smi_handler);
// LoadIC dispatcher expects PropertyCell as a "holder" in case of kGlobal
// handler kind.
HolderCellRequest request =
LoadHandler::GetHandlerKind(*smi_handler) == LoadHandler::kGlobal
? HolderCellRequest::kGlobalPropertyCell
: HolderCellRequest::kHolder;

Handle<WeakCell> holder_cell = HolderCell(isolate(), holder, name, request);

if (checks_count == 0){
return isolate()->factory()->NewTuple3(holder_cell, smi_handler,
Expand Down
35 changes: 35 additions & 0 deletions deps/v8/test/cctest/test-api-interceptors.cc
Original file line numberDiff line numberDiff line change
Expand Up@@ -1383,6 +1383,41 @@ THREADED_TEST(InterceptorLoadGlobalICGlobalWithInterceptor){
CHECK(value->BooleanValue(context.local()).FromJust());
}

// Test load of a non-existing global through prototype chain when a global
// object has an interceptor.
THREADED_TEST(InterceptorLoadICGlobalWithInterceptor){
i::FLAG_allow_natives_syntax = true;
v8::Isolate* isolate = CcTest::isolate();
v8::HandleScope scope(isolate);
v8::Local<v8::ObjectTemplate> templ_global = v8::ObjectTemplate::New(isolate);
templ_global->SetHandler(v8::NamedPropertyHandlerConfiguration(
GenericInterceptorGetter, GenericInterceptorSetter));

LocalContext context(nullptr, templ_global);
i::Handle<i::JSReceiver> global_proxy =
v8::Utils::OpenHandle<Object, i::JSReceiver>(context->Global());
CHECK(global_proxy->IsJSGlobalProxy());
i::Handle<i::JSGlobalObject> global(
i::JSGlobalObject::cast(global_proxy->map()->prototype()));
CHECK(global->map()->has_named_interceptor());

ExpectInt32(
"(function(){"
" var f = function(obj){"
" return obj.foo;"
"};"
" var obj ={__proto__: this, _str_foo: 42 };"
" for (var i = 0; i < 1500; i++) obj['p' + i] = 0;"
" /* Ensure that |obj| is in dictionary mode. */"
" if (%HasFastProperties(obj)) return -1;"
" for (var i = 0; i < 3; i++){"
" f(obj);"
"};"
" return f(obj);"
"})();",
42);
}

static void InterceptorLoadICGetter0(
Local<Name> name, const v8::PropertyCallbackInfo<v8::Value>& info){
ApiTestFuzzer::Fuzz();
Expand Down