AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

[turbofan] Properly restrict {JSCreate} to constructors.

Browse Source 
This makes sure that the lowering of {JSCreate} operator during create
lowering is only applied to operations where both target and new.target
are known to be constructors.

R=jarin@chromium.org
TEST=mjsunit/regress/regress-crbug-768080
BUG=chromium:774780,chromium:768080

Change-Id: I55a582a3453bba7e14655b594b7714a3940eeaae
Reviewed-on: https://chromium-review.googlesource.com/725332
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48680}
This commit is contained in:
Michael Starzinger 2017-10-18 13:21:35 +02:00 committed by Commit Bot
parent 713da2d5f3
commit 2d80e84153
2 changed files with 5 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
src/compiler/js-create-lowering.cc
View File

@ -180,13 +180,14 @@ Reduction JSCreateLowering::ReduceJSCreate(Node* node) {
Node* const control = NodeProperties::GetControlInput(node);
// Extract constructor and original constructor function.
if (target_type->IsHeapConstant() && new_target_type->IsHeapConstant() &&
target_type->AsHeapConstant()->Value()->IsJSFunction() &&
new_target_type->AsHeapConstant()->Value()->IsJSFunction()) {
Handle<JSFunction> constructor =
Handle<JSFunction>::cast(target_type->AsHeapConstant()->Value());
if (!constructor->IsConstructor()) return NoChange();
Handle<JSFunction> original_constructor =
Handle<JSFunction>::cast(new_target_type->AsHeapConstant()->Value());
DCHECK(constructor->IsConstructor());
DCHECK(original_constructor->IsConstructor());
if (!original_constructor->IsConstructor()) return NoChange();
// Check if we can inline the allocation.
if (IsAllocationInlineable(constructor, original_constructor)) {

2
test/mjsunit/regress/regress-crbug-768080.js
View File

@ -12,6 +12,7 @@
function f() {
return new g();
}
new C(); // Warm-up!
assertThrows(f, TypeError);
assertThrows(f, TypeError);
%OptimizeFunctionOnNextCall(f);
@ -29,6 +30,7 @@
function f() {
return new g();
}
new C(); // Warm-up!
assertThrows(f, TypeError);
assertThrows(f, TypeError);
%OptimizeFunctionOnNextCall(f);