Author: [email protected]
Date: Thu Jul 2 03:51:46 2009
New Revision: 2334
Modified:
branches/bleeding_edge/src/ic.cc
branches/bleeding_edge/test/mjsunit/call-non-function.js
Log:
Fix crash when calling non-function globals.
Review URL: http://codereview.chromium.org/151199
Modified: branches/bleeding_edge/src/ic.cc
==============================================================================
--- branches/bleeding_edge/src/ic.cc (original)
+++ branches/bleeding_edge/src/ic.cc Thu Jul 2 03:51:46 2009
@@ -460,11 +460,10 @@
if (lookup->holder() != *global) return;
JSGlobalPropertyCell* cell =
JSGlobalPropertyCell::cast(global->GetPropertyCell(lookup));
- if (cell->value()->IsJSFunction()) {
- JSFunction* function = JSFunction::cast(cell->value());
- code = StubCache::ComputeCallGlobal(argc, in_loop, *name,
*global,
- cell, function);
- }
+ if (!cell->value()->IsJSFunction()) return;
+ JSFunction* function = JSFunction::cast(cell->value());
+ code = StubCache::ComputeCallGlobal(argc, in_loop, *name,
*global,
+ cell, function);
} else {
// There is only one shared stub for calling normalized
// properties. It does not traverse the prototype chain, so the
@@ -489,7 +488,7 @@
// If we're unable to compute the stub (not enough memory left), we
// simply avoid updating the caches.
- if (code->IsFailure()) return;
+ if (code == NULL || code->IsFailure()) return;
// Patch the call site depending on the state of the cache.
if (state == UNINITIALIZED ||
@@ -700,7 +699,7 @@
// If we're unable to compute the stub (not enough memory left), we
// simply avoid updating the caches.
- if (code->IsFailure()) return;
+ if (code == NULL || code->IsFailure()) return;
// Patch the call site depending on the state of the cache.
if (state == UNINITIALIZED || state == PREMONOMORPHIC ||
@@ -890,7 +889,7 @@
// If we're unable to compute the stub (not enough memory left), we
// simply avoid updating the caches.
- if (code->IsFailure()) return;
+ if (code == NULL || code->IsFailure()) return;
// Patch the call site depending on the state of the cache. Make
// sure to always rewrite from monomorphic to megamorphic.
@@ -1042,7 +1041,7 @@
// If we're unable to compute the stub (not enough memory left), we
// simply avoid updating the caches.
- if (code->IsFailure()) return;
+ if (code == NULL || code->IsFailure()) return;
// Patch the call site depending on the state of the cache.
if (state == UNINITIALIZED || state == MONOMORPHIC_PROTOTYPE_FAILURE) {
@@ -1164,7 +1163,7 @@
// If we're unable to compute the stub (not enough memory left), we
// simply avoid updating the caches.
- if (code->IsFailure()) return;
+ if (code == NULL || code->IsFailure()) return;
// Patch the call site depending on the state of the cache. Make
// sure to always rewrite from monomorphic to megamorphic.
Modified: branches/bleeding_edge/test/mjsunit/call-non-function.js
==============================================================================
--- branches/bleeding_edge/test/mjsunit/call-non-function.js (original)
+++ branches/bleeding_edge/test/mjsunit/call-non-function.js Thu Jul 2
03:51:46 2009
@@ -51,4 +51,13 @@
TryCall("hest");
-
+// Make sure that calling a non-function global doesn't crash the
+// system while building the IC for it.
+var NonFunction = 42;
+function WillThrow() {
+ NonFunction();
+}
+assertThrows(WillThrow);
+assertThrows(WillThrow);
+assertThrows(WillThrow);
+assertThrows(WillThrow);
--~--~---------~--~----~------------~-------~--~----~
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
-~----------~----~----~----~------~----~------~--~---
