AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

Revert of [d8] bounds-check before getting Shell::Worker internal field (patchset #4 id:80001 of https://codereview.chromium.org/1214053004/)

Browse Source 
Reason for revert:
[Sheriff] Fails here:
http://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20shared/builds/4737

Original issue's description:
> [d8] bounds-check before getting Shell::Worker internal field
>
> Prevents fatal error in debug builds
>
> BUG=v8:4271
> R=binji@chromium.org
> LOG=N
>
> Committed: https://crrev.com/43ce9c6f101c4224addd9a54e0c39963188dc7fa
> Cr-Commit-Position: refs/heads/master@{#29524}

TBR=binji@chromium.org,jochen@chromium.org,adamk@chromium.org,caitpotter88@gmail.com
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4271

Review URL: https://codereview.chromium.org/1215333012

Cr-Commit-Position: refs/heads/master@{#29525}
This commit is contained in:
machenbach 2015-07-07 14:16:48 -07:00 committed by Commit bot
parent 43ce9c6f10
commit 650ef15c00
2 changed files with 7 additions and 39 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

22
src/d8.cc
View File

@ -717,17 +717,14 @@ void Shell::WorkerPostMessage(const v8::FunctionCallbackInfo<v8::Value>& args) {
Isolate* isolate = args.GetIsolate();
HandleScope handle_scope(isolate);
Local<Context> context = isolate->GetCurrentContext();
Local<Value> this_value;
if (args.Length() < 1) {
Throw(isolate, "Invalid argument");
return;
}
if (args.This()->InternalFieldCount() > 0) {
this_value = args.This()->GetInternalField(0);
}
if (this_value.IsEmpty()) {
Local<Value> this_value = args.This()->GetInternalField(0);
if (!this_value->IsExternal()) {
Throw(isolate, "this is not a Worker");
return;
}
@ -773,11 +770,9 @@ void Shell::WorkerPostMessage(const v8::FunctionCallbackInfo<v8::Value>& args) {
void Shell::WorkerGetMessage(const v8::FunctionCallbackInfo<v8::Value>& args) {
Isolate* isolate = args.GetIsolate();
HandleScope handle_scope(isolate);
Local<Value> this_value;
if (args.This()->InternalFieldCount() > 0) {
this_value = args.This()->GetInternalField(0);
}
if (this_value.IsEmpty()) {
Local<Value> this_value = args.This()->GetInternalField(0);
if (!this_value->IsExternal()) {
Throw(isolate, "this is not a Worker");
return;
}
@ -800,11 +795,8 @@ void Shell::WorkerGetMessage(const v8::FunctionCallbackInfo<v8::Value>& args) {
void Shell::WorkerTerminate(const v8::FunctionCallbackInfo<v8::Value>& args) {
Isolate* isolate = args.GetIsolate();
HandleScope handle_scope(isolate);
Local<Value> this_value;
if (args.This()->InternalFieldCount() > 0) {
this_value = args.This()->GetInternalField(0);
}
if (this_value.IsEmpty()) {
Local<Value> this_value = args.This()->GetInternalField(0);
if (!this_value->IsExternal()) {
Throw(isolate, "this is not a Worker");
return;
}

24
test/mjsunit/regress/regress-4271.js
View File

@ -1,24 +0,0 @@
// Copyright 2015 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Throw rather than overflow internal field index
assertThrows(function() {
Worker.prototype.terminate();
});
assertThrows(function() {
Worker.prototype.getMessage();
});
assertThrows(function() {
Worker.prototype.postMessage({});
});
// Don't throw for real worker
var worker = new Worker('');
worker.getMessage();
worker.postMessage({});
worker.terminate();