Reviewers: arv,

Description:
Throw illegal exception when formatting with invalid template index.

[email protected]
BUG=chromium:492526

Please review this at https://codereview.chromium.org/1146923004/

Base URL: https://chromium.googlesource.com/v8/v8.git@master

Affected files (+4, -6 lines):
  M src/messages.cc
  A + test/mjsunit/regress/regress-crbug-492526.js


Index: src/messages.cc
diff --git a/src/messages.cc b/src/messages.cc
index c21f96c0187a91370c44f0b948a27fbaf68b6da9..8de00c6f4bf982423c71b3b8f2554b1f25a99314 100644
--- a/src/messages.cc
+++ b/src/messages.cc
@@ -312,6 +312,7 @@ MaybeHandle<String> MessageTemplate::FormatMessage(int template_index,
                                                    Handle<String> arg0,
                                                    Handle<String> arg1,
                                                    Handle<String> arg2) {
+  Isolate* isolate = arg0->GetIsolate();
   const char* template_string;
   switch (template_index) {
 #define CASE(NAME, STRING)    \
@@ -322,12 +323,11 @@ MaybeHandle<String> MessageTemplate::FormatMessage(int template_index,
 #undef CASE
     case kLastMessage:
     default:
-      UNREACHABLE();
-      template_string = "";
+      isolate->ThrowIllegalOperation();
+      return MaybeHandle<String>();
       break;
   }

-  Isolate* isolate = arg0->GetIsolate();
   IncrementalStringBuilder builder(isolate);

   unsigned int i = 0;
Index: test/mjsunit/regress/regress-crbug-492526.js
diff --git a/test/mjsunit/regress/regress-450895.js b/test/mjsunit/regress/regress-crbug-492526.js
similarity index 74%
copy from test/mjsunit/regress/regress-450895.js
copy to test/mjsunit/regress/regress-crbug-492526.js
index 48aa00d956c6f84fdcfe2e02cfc286c0f07180ba..e8ea298f8ba2a4f15d1e82a487d142043ece9efe 100644
--- a/test/mjsunit/regress/regress-450895.js
+++ b/test/mjsunit/regress/regress-crbug-492526.js
@@ -4,6 +4,4 @@

 // Flags: --allow-natives-syntax

-var v = new Array();
-Object.freeze(v);
-v = v.concat(0.5);
+assertThrows(function() { %FormatMessageString(-1, "", "", ""); });


--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
--- You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to [email protected].
For more options, visit https://groups.google.com/d/optout.

Reply via email to