AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

Fix Error object value lookups.

Browse Source 
Looking up 'name' and 'message' properties at the same time and loading
the properties later can cause assertion failure if one of the properties
is an accessor and calling it changes the holder map. That may invalidate
the other lookup.

R=jkummerow@chromium.org
BUG=chromium:542101
LOG=N

Review URL: https://codereview.chromium.org/1403923002

Cr-Commit-Position: refs/heads/master@{#31229}
This commit is contained in:
yangguo 2015-10-13 02:26:33 -07:00 committed by Commit bot
parent 9b91bf3a63
commit 1a94bc20a1
2 changed files with 24 additions and 16 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

30
src/messages.cc
View File

@ -400,10 +400,6 @@ MaybeHandle<String> ErrorToStringHelper::Stringify(Isolate* isolate,
Handle<String> name_string = isolate->factory()->name_string();
LookupIterator internal_error_lookup(
error, internal_key, LookupIterator::PROTOTYPE_CHAIN_SKIP_INTERCEPTOR);
LookupIterator message_lookup(
error, message_string, LookupIterator::PROTOTYPE_CHAIN_SKIP_INTERCEPTOR);
LookupIterator name_lookup(error, name_string,
LookupIterator::PROTOTYPE_CHAIN_SKIP_INTERCEPTOR);
// Find out whether an internally created error object is on the prototype
// chain. If the name property is found on a holder prior to the internally
@ -412,24 +408,26 @@ MaybeHandle<String> ErrorToStringHelper::Stringify(Isolate* isolate,
// Similar for the message property. If the message property shadows the
// internally created error object, use that message property. Otherwise
// use empty string as message.
if (internal_error_lookup.IsFound()) {
if (!ShadowsInternalError(isolate, &name_lookup, &internal_error_lookup)) {
Handle<JSObject> holder = internal_error_lookup.GetHolder<JSObject>();
name = Handle<String>(holder->constructor_name());
}
if (!ShadowsInternalError(isolate, &message_lookup,
&internal_error_lookup)) {
message = isolate->factory()->empty_string();
}
}
if (name.is_null()) {
LookupIterator name_lookup(error, name_string,
LookupIterator::PROTOTYPE_CHAIN_SKIP_INTERCEPTOR);
if (internal_error_lookup.IsFound() &&
!ShadowsInternalError(isolate, &name_lookup, &internal_error_lookup)) {
Handle<JSObject> holder = internal_error_lookup.GetHolder<JSObject>();
name = Handle<String>(holder->constructor_name());
} else {
ASSIGN_RETURN_ON_EXCEPTION(
isolate, name,
GetStringifiedProperty(isolate, &name_lookup,
isolate->factory()->Error_string()),
String);
}
if (message.is_null()) {
LookupIterator message_lookup(
error, message_string, LookupIterator::PROTOTYPE_CHAIN_SKIP_INTERCEPTOR);
if (internal_error_lookup.IsFound() &&
!ShadowsInternalError(isolate, &message_lookup, &internal_error_lookup)) {
message = isolate->factory()->empty_string();
} else {
ASSIGN_RETURN_ON_EXCEPTION(
isolate, message,
GetStringifiedProperty(isolate, &message_lookup,

10
test/mjsunit/regress/regress-crbug-542101.js Normal file
View File

@ -0,0 +1,10 @@
// Copyright 2015 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
(function() {
Error.prototype.toString.call({
get name() { return { __proto__: this }; },
get message() { }
});
})();