AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

Properly set function index in CallSite constructor

Browse Source 
BUG=632965
R=yangguo@chromium.org

Review-Url: https://codereview.chromium.org/2199673002
Cr-Commit-Position: refs/heads/master@{#38208}
This commit is contained in:
jgruber 2016-08-01 05:57:31 -07:00 committed by Commit bot
parent 45d0c051e2
commit 061d082dd3
3 changed files with 6 additions and 36 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
src/builtins/builtins-callsite.cc
View File

@ -58,12 +58,11 @@ BUILTIN(CallSiteConstructor) {
}
if (is_wasm_object) {
DCHECK(!fun->IsJSFunction());
SET_CALLSITE_PROPERTY(obj, call_site_wasm_obj_symbol, receiver);
DCHECK(fun->IsSmi());
DCHECK(wasm::GetNumberOfFunctions(JSObject::cast(*receiver)) >
Smi::cast(*fun)->value());
Handle<Object> fun_index;
ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, fun_index,
Object::ToUint32(isolate, fun));
SET_CALLSITE_PROPERTY(obj, call_site_wasm_obj_symbol, receiver);
SET_CALLSITE_PROPERTY(obj, call_site_wasm_func_index_symbol, fun);
} else {
DCHECK(fun->IsJSFunction());
@ -71,10 +70,8 @@ BUILTIN(CallSiteConstructor) {
SET_CALLSITE_PROPERTY(obj, call_site_function_symbol, fun);
}
Handle<Object> pos_int32;
ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, pos_int32,
Object::ToInt32(isolate, pos));
SET_CALLSITE_PROPERTY(obj, call_site_position_symbol, pos_int32);
DCHECK(pos->IsSmi());
SET_CALLSITE_PROPERTY(obj, call_site_position_symbol, pos);
SET_CALLSITE_PROPERTY(
obj, call_site_strict_symbol,
isolate->factory()->ToBoolean(strict_mode->BooleanValue()));

17
test/mjsunit/callsite.js
View File

@ -1,17 +0,0 @@
// Copyright 2015 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
Error.prepareStackTrace = (e,s) => s;
var constructor = Error().stack[0].constructor;
// Second argument needs to be a function.
assertThrows(()=>constructor({}, {}, 1, false), TypeError);
var receiver = {};
function f() {}
var site = constructor.call(null, receiver, f, {valueOf() { return 0 }}, false);
assertEquals(receiver, site.getThis());
assertEquals(1, site.getLineNumber());
assertEquals(1, site.getColumnNumber());

10
test/mjsunit/regress/regress-crbug-570651.js
View File

@ -1,10 +0,0 @@
// Copyright 2015 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
Error.prepareStackTrace = (e,s) => s;
var __v_3 = Error().stack[0].constructor;
var __v_4 = {};
function __f_3() {}
var __v_5 = __v_3.call(null, __v_4, __f_3, {valueOf() { return 1611877293 }});
__v_5.getColumnNumber();