Reviewers: adamk,
Message:
PTAL
Description:
Fix OrderedHashTabelIterator accessors.
They might be undefined for uninitialized iterators.
The rest of the code is ready for this eventuality.
[email protected]
BUG=403292
LOG=N
Please review this at https://codereview.chromium.org/468813003/
SVN Base: https://v8.googlecode.com/svn/branches/bleeding_edge
Affected files (+56, -5 lines):
M src/objects.h
M src/objects.cc
M src/objects-inl.h
A test/mjsunit/regress/regress-403292.js
Index: src/objects-inl.h
diff --git a/src/objects-inl.h b/src/objects-inl.h
index
7e1c5b1eb37ab6cc5653d4f9f8d2c67fbb48f362..89ac974e89e27b4c2e4c5a0b34ae5153cc3084f6
100644
--- a/src/objects-inl.h
+++ b/src/objects-inl.h
@@ -6069,8 +6069,8 @@ ACCESSORS(JSCollection, table, Object, kTableOffset)
}
ORDERED_HASH_TABLE_ITERATOR_ACCESSORS(table, Object, kTableOffset)
-ORDERED_HASH_TABLE_ITERATOR_ACCESSORS(index, Smi, kIndexOffset)
-ORDERED_HASH_TABLE_ITERATOR_ACCESSORS(kind, Smi, kKindOffset)
+ORDERED_HASH_TABLE_ITERATOR_ACCESSORS(index, Object, kIndexOffset)
+ORDERED_HASH_TABLE_ITERATOR_ACCESSORS(kind, Object, kKindOffset)
#undef ORDERED_HASH_TABLE_ITERATOR_ACCESSORS
Index: src/objects.cc
diff --git a/src/objects.cc b/src/objects.cc
index
29af1d83373193db4face20c934c39f939a276be..659d75d871a676fc7e470bb8f9c9600b966434aa
100644
--- a/src/objects.cc
+++ b/src/objects.cc
@@ -16309,7 +16309,7 @@ Smi* OrderedHashTableIterator<Derived,
TableType>::Next(JSArray* value_array) {
FixedArray* array = FixedArray::cast(value_array->elements());
static_cast<Derived*>(this)->PopulateValueArray(array);
MoveNext();
- return kind();
+ return Smi::cast(kind());
}
return Smi::FromInt(0);
}
Index: src/objects.h
diff --git a/src/objects.h b/src/objects.h
index
2bb47e80f547cd59ae32c6ffa692f481aea3a22a..2f52094ba139393372c35e76d29b37f9442dac58
100644
--- a/src/objects.h
+++ b/src/objects.h
@@ -10175,10 +10175,10 @@ class OrderedHashTableIterator: public JSObject {
DECL_ACCESSORS(table, Object)
// [index]: The index into the data table.
- DECL_ACCESSORS(index, Smi)
+ DECL_ACCESSORS(index, Object)
// [kind]: The kind of iteration this is. One of the [Kind] enum values.
- DECL_ACCESSORS(kind, Smi)
+ DECL_ACCESSORS(kind, Object)
#ifdef OBJECT_PRINT
void OrderedHashTableIteratorPrint(OStream& os); // NOLINT
Index: test/mjsunit/regress/regress-403292.js
diff --git a/test/mjsunit/regress/regress-403292.js
b/test/mjsunit/regress/regress-403292.js
new file mode 100644
index
0000000000000000000000000000000000000000..94243930dc616c76cc24dc3480545539c1351ba6
--- /dev/null
+++ b/test/mjsunit/regress/regress-403292.js
@@ -0,0 +1,51 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var __v_7 = [];
+var __v_8 = {};
+var __v_10 = {};
+var __v_11 = this;
+var __v_12 = {};
+var __v_13 = {};
+var __v_14 = "";
+var __v_15 = {};
+try {
+__v_1 = {x:0};
+%OptimizeFunctionOnNextCall(__f_1);
+assertEquals("good", __f_1());
+delete __v_1.x;
+assertEquals("good", __f_1());
+} catch(e) { print("Caught: " + e); }
+try {
+__v_3 = new Set();
+__v_5 = new builtins.SetIterator(__v_3, -12);
+__v_4 = new Map();
+__v_6 = new builtins.MapIterator(__v_4, 2);
+__f_3(Array);
+} catch(e) { print("Caught: " + e); }
+function __f_4(__v_8, filter) {
+ function __f_6(v) {
+ for (var __v_4 in v) {
+ for (var __v_4 in v) {}
+ }
+ %OptimizeFunctionOnNextCall(filter);
+ return filter(v);
+ }
+ var __v_7 = eval(__v_8);
+ gc();
+ return __f_6(__v_7);
+}
+function __f_5(__v_6) {
+ var __v_5 = new Array(__v_6);
+ for (var __v_4 = 0; __v_4 < __v_6; __v_4++) __v_5.push('{}');
+ return __v_5;
+}
+try {
+try {
+ __v_8.test("\x80");
+ assertUnreachable();
+} catch (e) {
+}
+gc();
+} catch(e) { print("Caught: " + e); }
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
