Fix accessor update of non-extensible maps.

When installing getter/setter of non-extensible map with existing
setter/getter of the same name, we introduce a new transition
(so we have two transitions with the same name!). This triggers
an assertion in map updater.

This fix carefully checks that on the back-pointer path from
non-extensible map to the extensible map there are only
integrity level transitions. Otherwise, we just bail out.

Bug: chromium:932953
Change-Id: I02e91c3b652428a84a9f5c58b6691ea9b1fc44d6
Reviewed-on: https://chromium-review.googlesource.com/c/1477067
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59667}
5 files changed
tree: b6d977b3551c53c83776b85b732c2a4383d7d0e8
  1. .clang-format
  2. .clang-tidy
  3. .editorconfig
  4. .git-blame-ignore-revs
  5. .gitattributes
  6. .gitignore
  7. .gn
  8. .vpython
  9. .ycm_extra_conf.py
  10. AUTHORS
  11. BUILD.gn
  12. CODE_OF_CONDUCT.md
  13. ChangeLog
  14. DEPS
  15. LICENSE
  16. LICENSE.fdlibm
  17. LICENSE.strongtalk
  18. LICENSE.v8
  19. LICENSE.valgrind
  20. OWNERS
  21. PRESUBMIT.py
  22. README.md
  23. WATCHLISTS
  24. benchmarks/
  25. build_overrides/
  26. codereview.settings
  27. custom_deps/
  28. docs/
  29. gni/
  30. include/
  31. infra/
  32. samples/
  33. snapshot_toolchain.gni
  34. src/
  35. test/
  36. testing/
  37. third_party/
  38. tools/
README.md

V8 JavaScript Engine

V8 is Google's open source JavaScript engine.

V8 implements ECMAScript as specified in ECMA-262.

V8 is written in C++ and is used in Google Chrome, the open source browser from Google.

V8 can run standalone, or can be embedded into any C++ application.

V8 Project page: https://github.com/v8/v8/wiki

Getting the Code

Checkout depot tools, and run

    fetch v8

This will checkout V8 into the directory v8 and fetch all of its dependencies. To stay up to date, run

    git pull origin
    gclient sync

For fetching all branches, add the following into your remote configuration in .git/config:

    fetch = +refs/branch-heads/*:refs/remotes/branch-heads/*
    fetch = +refs/tags/*:refs/tags/*

Contributing

Please follow the instructions mentioned on the V8 wiki.