4c28563bd7
The crash scenario is as follows: 1) Add a getter for 'then' to the Object prototype that is considered side-effecting. 2) Evaluate a simple string using 'REPL' mode with side-effect checks enabled. Note: REPL mode is not strictly necessary, but it causes a 'then' lookup as the evaluation result is not a promise. 3) Calling the 'then' getter causes a termination exception, due to the side-effect check. JSPromise::Resolve then tries to put the termination exception as the reject reason, which causes a CHECK failure. The solution is to check for termination in the "abrupt completion" case when 'then' was retrieved. Bug: chromium:1140845 Change-Id: I72b644cd49355cea40f599fcbe80264e99ed7bd6 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2501283 Reviewed-by: Yang Guo <yangguo@chromium.org> Reviewed-by: Camillo Bruni <cbruni@chromium.org> Commit-Queue: Simon Zünd <szuend@chromium.org> Cr-Commit-Position: refs/heads/master@{#70785} |
||
---|---|---|
build_overrides | ||
custom_deps | ||
docs | ||
gni | ||
include | ||
infra | ||
samples | ||
src | ||
test | ||
testing | ||
third_party | ||
tools | ||
.clang-format | ||
.clang-tidy | ||
.editorconfig | ||
.flake8 | ||
.git-blame-ignore-revs | ||
.gitattributes | ||
.gitignore | ||
.gn | ||
.vpython | ||
.ycm_extra_conf.py | ||
AUTHORS | ||
BUILD.gn | ||
CODE_OF_CONDUCT.md | ||
codereview.settings | ||
COMMON_OWNERS | ||
DEPS | ||
DIR_METADATA | ||
ENG_REVIEW_OWNERS | ||
INFRA_OWNERS | ||
INTL_OWNERS | ||
LICENSE | ||
LICENSE.fdlibm | ||
LICENSE.strongtalk | ||
LICENSE.v8 | ||
MIPS_OWNERS | ||
OWNERS | ||
PPC_OWNERS | ||
PRESUBMIT.py | ||
README.md | ||
S390_OWNERS | ||
WATCHLISTS |
V8 JavaScript Engine
V8 is Google's open source JavaScript engine.
V8 implements ECMAScript as specified in ECMA-262.
V8 is written in C++ and is used in Google Chrome, the open source browser from Google.
V8 can run standalone, or can be embedded into any C++ application.
V8 Project page: https://v8.dev/docs
Getting the Code
Checkout depot tools, and run
fetch v8
This will checkout V8 into the directory v8
and fetch all of its dependencies.
To stay up to date, run
git pull origin
gclient sync
For fetching all branches, add the following into your remote
configuration in .git/config
:
fetch = +refs/branch-heads/*:refs/remotes/branch-heads/*
fetch = +refs/tags/*:refs/tags/*
Contributing
Please follow the instructions mentioned at v8.dev/docs/contribute.