AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

Check for validity when accessing call site objects in runtime.

Browse Source 
R=jkummerow@chromium.org
BUG=chromium:528379
LOG=N

Review URL: https://codereview.chromium.org/1404613002

Cr-Commit-Position: refs/heads/master@{#31233}
This commit is contained in:
yangguo 2015-10-13 03:53:06 -07:00 committed by Commit bot
parent 2633401137
commit 82b30828bd
4 changed files with 16 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
src/messages.cc
View File

@ -144,10 +144,13 @@ base::SmartArrayPointer<char> MessageHandler::GetLocalizedMessage(
CallSite::CallSite(Isolate* isolate, Handle<JSObject> call_site_obj)
: isolate_(isolate) {
Handle<Object> maybe_function = JSObject::GetDataProperty(
call_site_obj, isolate->factory()->call_site_function_symbol());
if (!maybe_function->IsJSFunction()) return;
fun_ = Handle<JSFunction>::cast(maybe_function);
receiver_ = JSObject::GetDataProperty(
call_site_obj, isolate->factory()->call_site_receiver_symbol());
fun_ = Handle<JSFunction>::cast(JSObject::GetDataProperty(
call_site_obj, isolate->factory()->call_site_function_symbol()));
pos_ = Handle<Smi>::cast(JSObject::GetDataProperty(
call_site_obj,
isolate->factory()->call_site_position_symbol()))

2
src/messages.h
View File

@ -62,6 +62,8 @@ class CallSite {
bool IsEval();
bool IsConstructor();
bool IsValid() { return !fun_.is_null(); }
private:
Isolate* isolate_;
Handle<Object> receiver_;

1
src/runtime/runtime-internal.cc
View File

@ -318,6 +318,7 @@ RUNTIME_FUNCTION(Runtime_FormatMessageString) {
CONVERT_ARG_HANDLE_CHECKED(JSObject, call_site_obj, 0); \
Handle<String> result; \
CallSite call_site(isolate, call_site_obj); \
RUNTIME_ASSERT(call_site.IsValid()) \
return RETURN(call_site.NAME(), isolate); \
}

8
test/mjsunit/regress-crbug-528379.js Normal file
View File

@ -0,0 +1,8 @@
// Copyright 2015 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --enable-slow-asserts
Error.prepareStackTrace = function(e, frames) { return frames; }
assertThrows(function() { new Error().stack[0].getMethodName.call({}); });