Reviewers: rossberg,
Message:
PTAL.
cq if looks good to you as is.
Description:
Protect against uninitialized lexical variables at top-level.
[email protected]
BUG=chromium:452510
LOG=Y
Please review this at https://codereview.chromium.org/893993007/
Base URL: https://chromium.googlesource.com/v8/v8.git@master
Affected files (+37, -3 lines):
M src/hydrogen.cc
M src/ic/ic.cc
M test/cctest/test-decls.cc
Index: src/hydrogen.cc
diff --git a/src/hydrogen.cc b/src/hydrogen.cc
index
e40316f74ab5c12c42fa61e9e161682b20392162..47cddd0a10dce599dd3f353e7d19fbfa99abca92
100644
--- a/src/hydrogen.cc
+++ b/src/hydrogen.cc
@@ -5382,6 +5382,14 @@ void
HOptimizedGraphBuilder::VisitVariableProxy(VariableProxy* expr) {
&lookup)) {
Handle<Context> script_context = ScriptContextTable::GetContext(
script_contexts, lookup.context_index);
+ Handle<Object> current_value =
+ FixedArray::get(script_context, lookup.context_index);
+
+ // If the values is not the hole, it will stay initialized,
+ // so no need to generate a check.
+ if (*current_value == *isolate()->factory()->the_hole_value()) {
+ return Bailout(kReferenceToUninitializedVariable);
+ }
HInstruction* result = New<HLoadNamedField>(
Add<HConstant>(script_context), nullptr,
HObjectAccess::ForContextSlot(lookup.slot_index));
Index: src/ic/ic.cc
diff --git a/src/ic/ic.cc b/src/ic/ic.cc
index
537b18324d6868e29b5a494090f0b4cad59e4e26..d20d0c5b2fd40918c5bbb4207189e2123e8db6b2
100644
--- a/src/ic/ic.cc
+++ b/src/ic/ic.cc
@@ -725,13 +725,21 @@ MaybeHandle<Object> LoadIC::Load(Handle<Object>
object, Handle<Name> name) {
ScriptContextTable::LookupResult lookup_result;
if (ScriptContextTable::Lookup(script_contexts, str_name,
&lookup_result)) {
+ Handle<Object> result =
+ FixedArray::get(ScriptContextTable::GetContext(
+ script_contexts,
lookup_result.context_index),
+ lookup_result.slot_index);
+ if (*result == *isolate()->factory()->the_hole_value()) {
+ // Do not install stubs and stay pre-monomorphic for
+ // uninitialized accesses.
+ return ReferenceError("not_defined", name);
+ }
+
if (use_ic && LoadScriptContextFieldStub::Accepted(&lookup_result)) {
LoadScriptContextFieldStub stub(isolate(), &lookup_result);
PatchCache(name, stub.GetCode());
}
- return FixedArray::get(ScriptContextTable::GetContext(
- script_contexts,
lookup_result.context_index),
- lookup_result.slot_index);
+ return result;
}
}
Index: test/cctest/test-decls.cc
diff --git a/test/cctest/test-decls.cc b/test/cctest/test-decls.cc
index
781bf9ec858efce6d565a97d2b3b731a258ed5ac..5d487bb7da549aa165328558b13bcbad3d04f881
100644
--- a/test/cctest/test-decls.cc
+++ b/test/cctest/test-decls.cc
@@ -1145,3 +1145,21 @@ TEST(CrossScriptAssignmentToConst) {
context.Check("x", EXPECT_RESULT, Number::New(CcTest::isolate(), 1));
}
}
+
+
+TEST(Regress425510) {
+ i::FLAG_harmony_scoping = true;
+ i::FLAG_allow_natives_syntax = true;
+
+ HandleScope handle_scope(CcTest::isolate());
+
+ {
+ SimpleContext context;
+
+ context.Check("'use strict'; o; const o = 10", EXPECT_EXCEPTION);
+
+ for (int i = 0; i < 100; i++) {
+ context.Check("o.prototype", EXPECT_EXCEPTION);
+ }
+ }
+}
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
