AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

Correctly hook up materialized receiver into the evaluation context chain.

Browse Source 
R=ulan@chromium.org
BUG=chromium:491943
LOG=Y

Review URL: https://codereview.chromium.org/1157993002

Cr-Commit-Position: refs/heads/master@{#28628}
This commit is contained in:
yangguo 2015-05-26 06:06:38 -07:00 committed by Commit bot
parent daaedddf7b
commit 0837b43720
3 changed files with 35 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
src/runtime/runtime-debug.cc
View File

@ -2500,18 +2500,21 @@ class EvaluationContextBuilder {
outer_info_ = handle(function->shared());
Handle<Context> inner_context;
// The "this" binding, if any, can't be bound via "with". If we need to,
// add another node onto the outer context to bind "this".
if (!MaterializeReceiver(isolate, outer_context, function, frame)
.ToHandle(&outer_context))
return;
bool stop = false;
for (ScopeIterator it(isolate, frame, inlined_jsframe_index);
!it.Failed() && !it.Done() && !stop; it.Next()) {
ScopeIterator::ScopeType scope_type = it.Type();
if (scope_type == ScopeIterator::ScopeTypeLocal) {
Handle<Context> parent_context =
it.HasContext() ? it.CurrentContext() : outer_context;
// The "this" binding, if any, can't be bound via "with". If we need
// to, add another node onto the outer context to bind "this".
if (!MaterializeReceiver(isolate, parent_context, function, frame)
.ToHandle(&parent_context))
return;
Handle<JSObject> materialized_function =
NewJSObjectWithNullProto(isolate);
@ -2525,8 +2528,6 @@ class EvaluationContextBuilder {
.ToHandle(&materialized_function))
return;
Handle<Context> parent_context =
it.HasContext() ? it.CurrentContext() : outer_context;
Handle<Context> with_context = isolate->factory()->NewWithContext(
function, parent_context, materialized_function);

1
test/mjsunit/mjsunit.status
View File

@ -118,6 +118,7 @@
'regress/regress-crbug-107996': [PASS, NO_VARIANTS],
'regress/regress-crbug-171715': [PASS, NO_VARIANTS],
'regress/regress-crbug-222893': [PASS, NO_VARIANTS],
'regress/regress-crbug-491943': [PASS, NO_VARIANTS],
'regress/regress-325676': [PASS, NO_VARIANTS],
'debug-evaluate-closure': [PASS, NO_VARIANTS],
'debug-evaluate-with': [PASS, NO_VARIANTS],

25
test/mjsunit/regress/regress-crbug-491943.js Normal file
View File

@ -0,0 +1,25 @@
// Copyright 2015 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --expose-debug-as debug
var Debug = debug.Debug;
var receiver = null;
Debug.setListener(function(event, exec_state, event_data, data) {
if (event != Debug.DebugEvent.Break) return;
receiver = exec_state.frame(0).evaluate('this').value();
});
function f() {
var context_local = 1;
(function() { return context_local; })();
debugger;
}
var expected = {};
f.call(expected);
assertEquals(expected, receiver);