3c20dfeda1
Any function with heap-allocated variables starts by creating and pushing a new context for its execution. When entering the debugger due to the stack check in the beginning of InterpreterEntryTrampoline, the function has not yet had a chance to push that new context. The code in ScopeIterator currently assumes that any function which needs a context already has one by the time the debugger attempts to iterate scopes, but in this case that assumption is invalid, which can cause a null deref. This change introduces a new function ScopeIterator::NeedsAndHasContext to replace previous calls to current_scope_->NeedsContext(). This new function checks for the case where the current scope matches the closure scope but the context matches the containing context for the function, which implies that the function has not yet pushed its own context. Bug: v8:10319, chromium:1038747 Change-Id: I29636f269c44d35b68d8446769d17170eed50e89 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2168021 Commit-Queue: Seth Brenith <seth.brenith@microsoft.com> Reviewed-by: Simon Zünd <szuend@chromium.org> Cr-Commit-Position: refs/heads/master@{#67519}
47 lines
1.6 KiB
JavaScript
47 lines
1.6 KiB
JavaScript
// Copyright 2020 the V8 project authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style license that can be
|
|
// found in the LICENSE file.
|
|
|
|
var Debug = debug.Debug;
|
|
|
|
var frame;
|
|
|
|
Debug.setListener(function (event, exec_state, event_data, data) {
|
|
if (event == Debug.DebugEvent.Break) {
|
|
frame = exec_state.frame(0);
|
|
|
|
// Try changing the value, which hasn't yet been initialized.
|
|
assertEquals(3, frame.evaluate("result = 3").value());
|
|
assertEquals(3, frame.evaluate("result").value());
|
|
}
|
|
});
|
|
|
|
function makeCounter() {
|
|
// If the variable `result` were stack-allocated, it would be 3 at this point
|
|
// due to the debugging activity during function entry. However, for a
|
|
// heap-allocated variable, the debugger evaluated `result = 3` in a temporary
|
|
// scope instead and had no effect on this variable.
|
|
assertEquals(undefined, result);
|
|
|
|
var result = 0;
|
|
|
|
// Regardless of how `result` is allocated, it should now be initialized.
|
|
assertEquals(0, result);
|
|
|
|
// Close over `result` to cause it to be heap-allocated.
|
|
return () => ++result;
|
|
}
|
|
|
|
// Break on entry to a function which includes heap-allocated variables.
|
|
%ScheduleBreak();
|
|
makeCounter();
|
|
|
|
// Check the frame state which was collected during the breakpoint.
|
|
assertEquals(1, frame.localCount());
|
|
assertEquals('result', frame.localName(0));
|
|
assertEquals(undefined, frame.localValue(0).value());
|
|
assertEquals(3, frame.scopeCount());
|
|
assertEquals(debug.ScopeType.Local, frame.scope(0).scopeType());
|
|
assertEquals(debug.ScopeType.Script, frame.scope(1).scopeType());
|
|
assertEquals(debug.ScopeType.Global, frame.scope(2).scopeType());
|