AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

ThrowTypeError should not be constructable, so shouldn't have a prototype.

Browse Source 
In addition to ThrowTypeError not being a constructor, it was invalidly set up by simply swapping the map. Swapping the map is insufficient since NewFunction* actually set up the function depending on the used map.

BUG=chromium:573858
LOG=n

Review URL: https://codereview.chromium.org/1552223002

Cr-Commit-Position: refs/heads/master@{#33082}
This commit is contained in:
verwaest 2016-01-04 05:32:19 -08:00 committed by Commit bot
parent 72ddee79c3
commit 09c41d9bfd
3 changed files with 18 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
src/bootstrapper.cc
View File

@ -672,7 +672,6 @@ Handle<JSFunction> Genesis::GetThrowTypeErrorIntrinsic(
Handle<Code> code(isolate()->builtins()->builtin(builtin_name));
Handle<JSFunction> function =
factory()->NewFunctionWithoutPrototype(name, code);
function->set_map(native_context()->sloppy_function_map());
function->shared()->DontAdaptArguments();
// %ThrowTypeError% must not have a name property.

16
test/mjsunit/regress/regress-crbug-573858.js Normal file
View File

@ -0,0 +1,16 @@
// Copyright 2016 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --allow-natives-syntax
var throw_type_error = Object.getOwnPropertyDescriptor(
(function() {"use strict"}).__proto__, "caller").get;
function create_initial_map() { this instanceof throw_type_error }
%OptimizeFunctionOnNextCall(create_initial_map);
create_initial_map();
function test() { new throw_type_error }
%OptimizeFunctionOnNextCall(test);
assertThrows(test);

12
test/mjsunit/strict-mode.js
View File

@ -1018,11 +1018,7 @@ function CheckFunctionPillDescriptor(func, name) {
assertThrows(function() { 'use strict'; pill.property = "value"; },
TypeError);
assertThrows(pill, TypeError);
assertEquals(pill.prototype, (function(){}).prototype);
var d = Object.getOwnPropertyDescriptor(pill, "prototype");
assertFalse(d.writable);
assertFalse(d.configurable);
assertFalse(d.enumerable);
assertEquals(undefined, pill.prototype);
}
// Poisoned accessors are no longer own properties
@ -1046,11 +1042,7 @@ function CheckArgumentsPillDescriptor(func, name) {
assertThrows(function() { 'use strict'; pill.property = "value"; },
TypeError);
assertThrows(pill, TypeError);
assertEquals(pill.prototype, (function(){}).prototype);
var d = Object.getOwnPropertyDescriptor(pill, "prototype");
assertFalse(d.writable);
assertFalse(d.configurable);
assertFalse(d.enumerable);
assertEquals(undefined, pill.prototype);
}
var descriptor = Object.getOwnPropertyDescriptor(func, name);