From 68f205b2a7a0e3a344294d7d707fcebaa4cc8b87 Mon Sep 17 00:00:00 2001 From: adamk Date: Wed, 13 Jul 2016 18:59:27 -0700 Subject: [PATCH] Revert of Don't compile functions in a context the caller doesn't have access to (patchset #9 id:160001 of https://codereview.chromium.org/2034083002/ ) Reason for revert: Causes crashes on Canary Original issue's description: > Don't compile functions in a context the caller doesn't have access to > > Instead just return undefined > > A side effect of this is that it's no longer possible to compile > functions in a detached context. > > BUG=chromium:541703 > R=verwaest@chromium.org,bmeurer@chromium.org > CQ_INCLUDE_TRYBOTS=tryserver.chromium.linux:linux_chromium_rel_ng > > Committed: https://crrev.com/992e34c21635b179a993b82ac1d81753e7a6a57a > Cr-Commit-Position: refs/heads/master@{#37657} TBR=bmeurer@chromium.org,verwaest@chromium.org,jochen@chromium.org # Not skipping CQ checks because original CL landed more than 1 days ago. BUG=chromium:541703, chromium:628053 Review-Url: https://codereview.chromium.org/2148163002 Cr-Commit-Position: refs/heads/master@{#37736} --- include/v8.h | 1 - src/builtins.cc | 41 ++++++--------- src/flag-definitions.h | 4 -- test/cctest/test-api.cc | 76 --------------------------- test/mjsunit/cross-realm-filtering.js | 76 --------------------------- test/mjsunit/es6/reflect-construct.js | 2 - 6 files changed, 15 insertions(+), 185 deletions(-) diff --git a/include/v8.h b/include/v8.h index c3c7743dfd..b4deb77c55 100644 --- a/include/v8.h +++ b/include/v8.h @@ -5732,7 +5732,6 @@ class V8_EXPORT Isolate { kDecimalWithLeadingZeroInStrictMode = 32, kLegacyDateParser = 33, kDefineGetterOrSetterWouldThrow = 34, - kFunctionConstructorReturnedUndefined = 35, // If you add new values here, you'll also need to update Chromium's: // UseCounter.h, V8PerIsolateData.cpp, histograms.xml diff --git a/src/builtins.cc b/src/builtins.cc index 546d149b49..8be2870449 100644 --- a/src/builtins.cc +++ b/src/builtins.cc @@ -4723,23 +4723,13 @@ void Builtins::Generate_DatePrototypeGetUTCSeconds(MacroAssembler* masm) { namespace { // ES6 section 19.2.1.1.1 CreateDynamicFunction -MaybeHandle CreateDynamicFunction(Isolate* isolate, - BuiltinArguments args, - const char* token) { +MaybeHandle CreateDynamicFunction(Isolate* isolate, + BuiltinArguments args, + const char* token) { // Compute number of arguments, ignoring the receiver. DCHECK_LE(1, args.length()); int const argc = args.length() - 1; - Handle target = args.target(); - Handle target_global_proxy(target->global_proxy(), isolate); - - HandleScopeImplementer* impl = isolate->handle_scope_implementer(); - if (!FLAG_allow_unsafe_function_constructor && - !isolate->MayAccess(impl->LastEnteredContext(), target_global_proxy)) { - isolate->CountUsage(v8::Isolate::kFunctionConstructorReturnedUndefined); - return isolate->factory()->undefined_value(); - } - // Build the source string. Handle source; { @@ -4754,7 +4744,7 @@ MaybeHandle CreateDynamicFunction(Isolate* isolate, Handle param; ASSIGN_RETURN_ON_EXCEPTION( isolate, param, Object::ToString(isolate, args.at(i)), - Object); + JSFunction); param = String::Flatten(param); builder.AppendString(param); // If the formal parameters string include ) - an illegal @@ -4779,35 +4769,37 @@ MaybeHandle CreateDynamicFunction(Isolate* isolate, Handle body; ASSIGN_RETURN_ON_EXCEPTION( isolate, body, Object::ToString(isolate, args.at(argc)), - Object); + JSFunction); builder.AppendString(body); } builder.AppendCString("\n})"); - ASSIGN_RETURN_ON_EXCEPTION(isolate, source, builder.Finish(), Object); + ASSIGN_RETURN_ON_EXCEPTION(isolate, source, builder.Finish(), JSFunction); // The SyntaxError must be thrown after all the (observable) ToString // conversions are done. if (parenthesis_in_arg_string) { THROW_NEW_ERROR(isolate, NewSyntaxError(MessageTemplate::kParenthesisInArgString), - Object); + JSFunction); } } // Compile the string in the constructor and not a helper so that errors to // come from here. + Handle target = args.target(); + Handle target_global_proxy(target->global_proxy(), isolate); Handle function; { ASSIGN_RETURN_ON_EXCEPTION( isolate, function, CompileString(handle(target->native_context(), isolate), source, ONLY_SINGLE_FUNCTION_LITERAL), - Object); + JSFunction); Handle result; ASSIGN_RETURN_ON_EXCEPTION( isolate, result, Execution::Call(isolate, function, target_global_proxy, 0, nullptr), - Object); + JSFunction); function = Handle::cast(result); function->shared()->set_name_should_print_as_anonymous(true); } @@ -4826,7 +4818,7 @@ MaybeHandle CreateDynamicFunction(Isolate* isolate, Handle initial_map; ASSIGN_RETURN_ON_EXCEPTION( isolate, initial_map, - JSFunction::GetDerivedMap(isolate, target, new_target), Object); + JSFunction::GetDerivedMap(isolate, target, new_target), JSFunction); Handle shared_info(function->shared(), isolate); Handle map = Map::AsLanguageMode( @@ -4845,7 +4837,7 @@ MaybeHandle CreateDynamicFunction(Isolate* isolate, // ES6 section 19.2.1.1 Function ( p1, p2, ... , pn, body ) BUILTIN(FunctionConstructor) { HandleScope scope(isolate); - Handle result; + Handle result; ASSIGN_RETURN_FAILURE_ON_EXCEPTION( isolate, result, CreateDynamicFunction(isolate, args, "function")); return *result; @@ -4978,15 +4970,12 @@ BUILTIN(GeneratorFunctionConstructor) { BUILTIN(AsyncFunctionConstructor) { HandleScope scope(isolate); - Handle maybe_func; + Handle func; ASSIGN_RETURN_FAILURE_ON_EXCEPTION( - isolate, maybe_func, - CreateDynamicFunction(isolate, args, "async function")); - if (!maybe_func->IsJSFunction()) return *maybe_func; + isolate, func, CreateDynamicFunction(isolate, args, "async function")); // Do not lazily compute eval position for AsyncFunction, as they may not be // determined after the function is resumed. - Handle func = Handle::cast(maybe_func); Handle