AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

Fix crash in JSReceiver::GetCreationContext

Browse Source 
It failed on the CHECK when receiver object was JSAsyncFunctionObject.

BUG=chromium:901241

Change-Id: I7ce563758185908728135005cb5ba2878fdea446
Reviewed-on: https://chromium-review.googlesource.com/c/1382822
Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Alexei Filippov <alph@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58412}
This commit is contained in:
Alexei Filippov 2018-12-18 15:29:35 -08:00 committed by Commit Bot
parent 9711d27b75
commit 379b3e384d
1 changed files with 2 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
src/objects.cc
View File

@ -4035,6 +4035,8 @@ Handle<Context> JSReceiver::GetCreationContext() {
} else if (constructor->IsFunctionTemplateInfo()) {
// Remote objects don't have a creation context.
return Handle<Context>::null();
} else if (receiver->IsJSGeneratorObject()) {
function = JSGeneratorObject::cast(receiver)->function();
} else {
// Functions have null as a constructor,
// but any JSFunction knows its context immediately.