AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

Harden global variable accesses in the fast code generator.

Browse Source 
Explicitly check that global variables do not have accessors or
interceptors in the fast code generator syntax checker.

Review URL: http://codereview.chromium.org/595022

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@3828 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
This commit is contained in:
kmillikin@chromium.org 2010-02-10 13:46:15 +00:00
parent a9664cbd0d
commit b04a26dc31
2 changed files with 21 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
src/fast-codegen.cc
View File

@ -220,8 +220,16 @@ void FastCodeGenSyntaxChecker::VisitVariableProxy(VariableProxy* expr) {
if (info()->has_global_object()) {
LookupResult lookup;
info()->global_object()->Lookup(*expr->name(), &lookup);
if (!lookup.IsValid() || !lookup.IsDontDelete()) {
BAILOUT("Non-existing or deletable global variable");
if (!lookup.IsValid()) {
BAILOUT("Non-existing global variable");
}
// We do not handle global variables with accessors or interceptors.
if (lookup.type() != NORMAL) {
BAILOUT("Global variable with accessors or interceptors.");
}
// We do not handle deletable global variables.
if (!lookup.IsDontDelete()) {
BAILOUT("Deletable global variable");
}
}
}
@ -573,8 +581,10 @@ void FastCodeGenerator::VisitVariableProxy(VariableProxy* expr) {
ASSERT(info()->has_global_object());
LookupResult lookup;
info()->global_object()->Lookup(*expr->name(), &lookup);
// We only support DontDelete properties for now.
// We only support normal (non-accessor/interceptor) DontDelete properties
// for now.
ASSERT(lookup.IsValid());
ASSERT_EQ(NORMAL, lookup.type());
ASSERT(lookup.IsDontDelete());
Handle<Object> cell(info()->global_object()->GetPropertyCell(&lookup));

14
test/mjsunit/compiler/simple-global-access.js
View File

@ -31,21 +31,23 @@
var g1 = 42;
var g2 = 43;
var g3 = 44;
this.__defineGetter__("g4", function () { return 45; });
function f1() { this.x = this.y = this.z = g1; }
function f2() { this.x = g1; this.y = g2; this.z = g3; }
function f3() { this.x = g4; }
var o = {x:0, y:0, z:0, m1:f1, m2:f2}
o.m1();
var o = { x:0, y:0, z:0, test1:f1, test2:f2, test3:f3 }
o.test1();
assertEquals(42, o.x);
assertEquals(42, o.y);
assertEquals(42, o.z);
o.m2();
o.test2();
assertEquals(42, o.x);
assertEquals(43, o.y);
assertEquals(44, o.z);
o.test3();
assertEquals(45, o.x);