Revision: 3432 Author: [email protected] Date: Tue Dec 8 01:43:51 2009 Log: Fix for issue 545: don't reuse this VariableProxy.
Review URL: http://codereview.chromium.org/464069 http://code.google.com/p/v8/source/detail?r=3432 Added: /branches/bleeding_edge/test/mjsunit/regress/regress-545.js Modified: /branches/bleeding_edge/src/compiler.cc /branches/bleeding_edge/src/scopes.cc /branches/bleeding_edge/src/scopes.h ======================================= --- /dev/null +++ /branches/bleeding_edge/test/mjsunit/regress/regress-545.js Tue Dec 8 01:43:51 2009 @@ -0,0 +1,47 @@ +// Copyright 2009 the V8 project authors. All rights reserved. +// Redistribution and use in source and binary forms, with or without +// modification, are permitted provided that the following conditions are +// met: +// +// * Redistributions of source code must retain the above copyright +// notice, this list of conditions and the following disclaimer. +// * Redistributions in binary form must reproduce the above +// copyright notice, this list of conditions and the following +// disclaimer in the documentation and/or other materials provided +// with the distribution. +// * Neither the name of Google Inc. nor the names of its +// contributors may be used to endorse or promote products derived +// from this software without specific prior written permission. +// +// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS +// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT +// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR +// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT +// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, +// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT +// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, +// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY +// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT +// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE +// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + +// See: http://code.google.com/p/v8/issues/detail?id=545 +// and: http://code.google.com/p/chromium/issues/detail?id=28353 + +// The "this" variable proxy was reused. If context annotations differ between +// uses, this can cause a use in a value context to assume a test context. Since +// it has no true/false labels set, it causes a null-pointer dereference and +// segmentation fault. + +// Code should not crash: + +// Original bug report by Robert Swiecki (wrapped to not throw): +try { + new IsPrimitive(load())?this.join():String(' ').charCodeAt((!this>Math)); +} catch (e) {} + +// Shorter examples: + +this + !this; + +this + (this ? 1 : 2); ======================================= --- /branches/bleeding_edge/src/compiler.cc Mon Dec 7 07:10:39 2009 +++ /branches/bleeding_edge/src/compiler.cc Tue Dec 8 01:43:51 2009 @@ -56,6 +56,8 @@ private: // Visit an expression in a given expression context. void ProcessExpression(Expression* expr, Expression::Context context) { + ASSERT(expr->context() == Expression::kUninitialized || + expr->context() == context); Expression::Context saved = context_; context_ = context; Visit(expr); ======================================= --- /branches/bleeding_edge/src/scopes.cc Wed Nov 11 01:50:06 2009 +++ /branches/bleeding_edge/src/scopes.cc Tue Dec 8 01:43:51 2009 @@ -189,8 +189,7 @@ variables_.Declare(this, Factory::this_symbol(), Variable::VAR, false, Variable::THIS); var->rewrite_ = new Slot(var, Slot::PARAMETER, -1); - receiver_ = new VariableProxy(Factory::this_symbol(), true, false); - receiver_->BindTo(var); + receiver_ = var; if (is_function_scope()) { // Declare 'arguments' variable which exists in all functions. ======================================= --- /branches/bleeding_edge/src/scopes.h Wed Aug 19 05:44:45 2009 +++ /branches/bleeding_edge/src/scopes.h Tue Dec 8 01:43:51 2009 @@ -206,8 +206,13 @@ // --------------------------------------------------------------------------- // Accessors. - // The variable corresponding to the (function) receiver. - VariableProxy* receiver() const { return receiver_; } + // A new variable proxy corresponding to the (function) receiver. + VariableProxy* receiver() const { + VariableProxy* proxy = + new VariableProxy(Factory::this_symbol(), true, false); + proxy->BindTo(receiver_); + return proxy; + } // The variable holding the function literal for named function // literals, or NULL. @@ -314,7 +319,7 @@ // Declarations. ZoneList<Declaration*> decls_; // Convenience variable. - VariableProxy* receiver_; + Variable* receiver_; // Function variable, if any; function scopes only. Variable* function_; // Convenience variable; function scopes only. -- v8-dev mailing list [email protected] http://groups.google.com/group/v8-dev
