Reviewers: Toon Verwaest,
Description:
Use correct LookupIterator in CallSite::GetMethodName.
[email protected]
BUG=chromium:505370
LOG=N
Please review this at https://codereview.chromium.org/1218023002/
Base URL: https://chromium.googlesource.com/v8/v8.git@master
Affected files (+27, -4 lines):
M src/messages.cc
A test/mjsunit/regress/regress-crbug-505370.js
Index: src/messages.cc
diff --git a/src/messages.cc b/src/messages.cc
index
a69df0463a892b8dbcbc93d828cc726b7ace9906..5e050bd2909f17fcf4a27433c30f9ad15cc61093
100644
--- a/src/messages.cc
+++ b/src/messages.cc
@@ -175,10 +175,11 @@ Handle<Object>
CallSite::GetScriptNameOrSourceUrl(Isolate* isolate) {
}
-bool CheckMethodName(Handle<JSObject> obj, Handle<Name> name,
+bool CheckMethodName(Isolate* isolate, Handle<JSObject> obj, Handle<Name>
name,
Handle<JSFunction> fun,
LookupIterator::Configuration config) {
- LookupIterator iter(obj, name, config);
+ LookupIterator iter =
+ LookupIterator::PropertyOrElement(isolate, obj, name, config);
if (iter.state() == LookupIterator::DATA) {
return iter.GetDataValue().is_identical_to(fun);
} else if (iter.state() == LookupIterator::ACCESSOR) {
@@ -203,7 +204,7 @@ Handle<Object> CallSite::GetMethodName(Isolate*
isolate) {
Handle<Object> function_name(fun_->shared()->name(), isolate);
if (function_name->IsName()) {
Handle<Name> name = Handle<Name>::cast(function_name);
- if (CheckMethodName(obj, name, fun_,
+ if (CheckMethodName(isolate, obj, name, fun_,
LookupIterator::PROTOTYPE_CHAIN_SKIP_INTERCEPTOR))
return name;
}
@@ -222,7 +223,7 @@ Handle<Object> CallSite::GetMethodName(Isolate*
isolate) {
HandleScope inner_scope(isolate);
if (!keys->get(i)->IsName()) continue;
Handle<Name> name_key(Name::cast(keys->get(i)), isolate);
- if (!CheckMethodName(current_obj, name_key, fun_,
+ if (!CheckMethodName(isolate, current_obj, name_key, fun_,
LookupIterator::OWN_SKIP_INTERCEPTOR))
continue;
// Return null in case of duplicates to avoid confusion.
Index: test/mjsunit/regress/regress-crbug-505370.js
diff --git a/test/mjsunit/regress/regress-crbug-505370.js
b/test/mjsunit/regress/regress-crbug-505370.js
new file mode 100644
index
0000000000000000000000000000000000000000..f67d82b66f77062bca3fe308b99697671a12a236
--- /dev/null
+++ b/test/mjsunit/regress/regress-crbug-505370.js
@@ -0,0 +1,22 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var o = {
+ get 0() { reference_error; },
+ get length() { return 1; }
+};
+
+var method_name;
+
+try {
+ o[0];
+} catch (e) {
+ thrown = true;
+ Error.prepareStackTrace = function(exception, frames) { return frames; };
+ var frames = e.stack;
+ Error.prepareStackTrace = undefined;
+ method_name = frames[0].getMethodName();
+}
+
+assertEquals("0", method_name);
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
