Fix redefining of attributes on aliased arguments.

Fix redefining of attributes on aliased arguments.

This allows elements of the non-strict arguments object to be redefined
with custom attributes and still maintain an alias into the context.
Such a slow alias is maintained by placing a special marker into the
dictionary backing store of the arguments object.

R=rossberg@chromium.org
BUG=v8:1772
TEST=test262,mjsunit/object-define-property

Committed: https://code.google.com/p/v8/source/detail?r=10827

[rossberg, 2012-02-24 13:51:05]

lgtm

https://chromiumcodereview.appspot.com/9460004/diff/1/include/v8.h
File include/v8.h (right):

https://chromiumcodereview.appspot.com/9460004/diff/1/include/v8.h#newcode3853
include/v8.h:3853: static const int kJSObjectType = 0xa9;
I love this...

https://chromiumcodereview.appspot.com/9460004/diff/1/src/objects.h
File src/objects.h (right):

https://chromiumcodereview.appspot.com/9460004/diff/1/src/objects.h#newcode6440
src/objects.h:6440: class AliasedArgumentsEntry: public Struct {
Maybe add a comment explaining the role of this type.

https://chromiumcodereview.appspot.com/9460004/diff/1/test/mjsunit/object-def...
File test/mjsunit/object-define-property.js (right):

https://chromiumcodereview.appspot.com/9460004/diff/1/test/mjsunit/object-def...
test/mjsunit/object-define-property.js:1077: })(0);
You could have another test that checks that everything still works correctly
when the arguments object escapes its owner function and is modified elsewhere.

[Michael Starzinger, 2012-02-24 14:36:40]

Added new patch set. Rebased. Landed.

https://chromiumcodereview.appspot.com/9460004/diff/1/include/v8.h
File include/v8.h (right):

https://chromiumcodereview.appspot.com/9460004/diff/1/include/v8.h#newcode3853
include/v8.h:3853: static const int kJSObjectType = 0xa9;
On 2012/02/24 13:51:05, rossberg wrote:
> I love this...

Me too ...

https://chromiumcodereview.appspot.com/9460004/diff/1/src/objects.h
File src/objects.h (right):

https://chromiumcodereview.appspot.com/9460004/diff/1/src/objects.h#newcode6440
src/objects.h:6440: class AliasedArgumentsEntry: public Struct {
On 2012/02/24 13:51:05, rossberg wrote:
> Maybe add a comment explaining the role of this type.

Done.

https://chromiumcodereview.appspot.com/9460004/diff/1/test/mjsunit/object-def...
File test/mjsunit/object-define-property.js (right):

https://chromiumcodereview.appspot.com/9460004/diff/1/test/mjsunit/object-def...
test/mjsunit/object-define-property.js:1077: })(0);
On 2012/02/24 13:51:05, rossberg wrote:
> You could have another test that checks that everything still works correctly
> when the arguments object escapes its owner function and is modified
elsewhere.

Done. As discussed offline, this is a white-box test for a code-path through our
implementation that is not covered by test262. Most other paths (including
manipulating the arguments object outside the function it was instantiated in)
are already covered by test262.