AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

ExecutableAccessorInfo::clear_setter should set a null foreign pointer

Browse Source 
R=jkummerow@chromium.org
BUG=433458
LOG=N

Review URL: https://codereview.chromium.org/759683004

Cr-Commit-Position: refs/heads/master@{#25737}
This commit is contained in:
dcarney 2014-12-10 02:18:00 -08:00 committed by Commit bot
parent aae665862f
commit ea11ffc65b
2 changed files with 30 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
src/objects-inl.h
View File

@ -7022,7 +7022,9 @@ bool AccessorInfo::IsCompatibleReceiver(Object* receiver) {
void ExecutableAccessorInfo::clear_setter() {
set_setter(GetIsolate()->heap()->undefined_value(), SKIP_WRITE_BARRIER);
set_setter(*GetIsolate()->factory()->NewForeign(
reinterpret_cast<v8::internal::Address>(
reinterpret_cast<intptr_t>(nullptr))));
}

27
test/cctest/test-accessors.cc
View File

@ -578,3 +578,30 @@ THREADED_TEST(GlobalObjectAccessor) {
CHECK(v8::Utils::OpenHandle(*CompileRun("getter()"))->IsJSGlobalProxy());
CHECK(v8::Utils::OpenHandle(*CompileRun("set_value"))->IsJSGlobalProxy());
}
static void EmptyGetter(Local<Name> name,
const v8::PropertyCallbackInfo<v8::Value>& info) {
ApiTestFuzzer::Fuzz();
}
static void OneProperty(Local<String> name,
const v8::PropertyCallbackInfo<v8::Value>& info) {
ApiTestFuzzer::Fuzz();
info.GetReturnValue().Set(v8_num(1));
}
THREADED_TEST(Regress433458) {
LocalContext env;
v8::Isolate* isolate = env->GetIsolate();
v8::HandleScope scope(isolate);
v8::Handle<v8::ObjectTemplate> obj = ObjectTemplate::New(isolate);
obj->SetHandler(v8::NamedPropertyHandlerConfiguration(EmptyGetter));
obj->SetNativeDataProperty(v8_str("prop"), OneProperty);
env->Global()->Set(v8_str("obj"), obj->NewInstance());
CompileRun(
"Object.defineProperty(obj, 'prop', { writable: false });"
"Object.defineProperty(obj, 'prop', { writable: true });");
}