AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

[turbofan] Fix invalid access to Parameter index.

Browse Source 
A Parameter operator contains a ParameterInfo payload, not an int
payload, so the OpParameter<int> cast is invalid (and only worked by
coincidence currently).

BUG=chromium:515215
LOG=n
R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/1266743002

Cr-Commit-Position: refs/heads/master@{#29919}
This commit is contained in:
bmeurer 2015-07-30 02:16:12 -07:00 committed by Commit bot
parent a67f31c48c
commit efab0b74dd
1 changed files with 6 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
src/compiler/typer.cc
View File

@ -7,6 +7,7 @@
#include "src/base/flags.h" #include "src/base/flags.h"
#include "src/base/lazy-instance.h" #include "src/base/lazy-instance.h"
#include "src/bootstrapper.h" #include "src/bootstrapper.h"
#include "src/compiler/common-operator.h"
#include "src/compiler/graph-reducer.h" #include "src/compiler/graph-reducer.h"
#include "src/compiler/js-operator.h" #include "src/compiler/js-operator.h"
#include "src/compiler/node.h" #include "src/compiler/node.h"
@ -571,11 +572,11 @@ Bounds Typer::Visitor::TypeIfException(Node* node) {
Bounds Typer::Visitor::TypeParameter(Node* node) { Bounds Typer::Visitor::TypeParameter(Node* node) {
int param = OpParameter<int>(node); if (Type::FunctionType* function_type = typer_->function_type()) {
Type::FunctionType* function_type = typer_->function_type(); int const index = ParameterIndexOf(node->op());
if (function_type != nullptr && param >= 0 && if (index >= 0 && index < function_type->Arity()) {
param < static_cast<int>(function_type->Arity())) { return Bounds(Type::None(), function_type->Parameter(index));
return Bounds(Type::None(), function_type->Parameter(param)); }
} }
return Bounds::Unbounded(zone()); return Bounds::Unbounded(zone());
} }