AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

[serializer] do not serialize script wrappers.

Browse Source 
The scenario here: the asm function fails asm validation,
so we emit a message. In doing so, we create a JSValue wrapper for
the script object that we cache on the script object. This wrapper
is context-dependent and causes the code serializer to choke.

R=mtrofin@chromium.org, titzer@chromium.org
BUG=chromium:674446,chromium:673321

Review-Url: https://codereview.chromium.org/2586943003
Cr-Commit-Position: refs/heads/master@{#41794}
This commit is contained in:
yangguo 2016-12-19 02:53:02 -08:00 committed by Commit bot
parent d0bb789f03
commit 07fa0f4967
2 changed files with 16 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
src/snapshot/code-serializer.cc
View File

@ -104,6 +104,12 @@ void CodeSerializer::SerializeObject(HeapObject* obj, HowToCode how_to_code,
return SerializeObject(isolate()->heap()->undefined_value(), how_to_code,
where_to_point, skip);
}
if (obj->IsScript()) {
// Wrapper object is a context-dependent JSValue. Reset it here.
Script::cast(obj)->set_wrapper(isolate()->heap()->undefined_value());
}
// Past this point we should not see any (context-specific) maps anymore.
CHECK(!obj->IsMap());
// There should be no references to the global object embedded.

10
test/mjsunit/regress/wasm/regression-674447.js Normal file
View File

@ -0,0 +1,10 @@
// Copyright 2016 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --validate-asm --cache=code
(function() {
"use asm";
return function f() {}
})();