Reviewers: jarin,
Description:
Fix cluster-fuzz found regression with d8 Workers
This one occurred when serializing an object. When the property getter
threw an
exception, that value was skipped, but the property count wasn't updated.
The
deserializer then tried to deserialize the wrong value.
BUG=chromium:506549
[email protected]
LOG=n
Please review this at https://codereview.chromium.org/1220193004/
Base URL: https://chromium.googlesource.com/v8/v8.git@master
Affected files (+10, -3 lines):
M src/d8.cc
A + test/mjsunit/regress/regress-crbug-506549.js
Index: src/d8.cc
diff --git a/src/d8.cc b/src/d8.cc
index
7db6f3ed9e442081528e05140bd25b8911e26cb6..0b737c6ffe291e6913269f0618d4608127fe5210
100644
--- a/src/d8.cc
+++ b/src/d8.cc
@@ -2024,6 +2024,9 @@ bool Shell::SerializeValue(Isolate* isolate,
Handle<Value> value,
if (!SerializeValue(isolate, element_value, to_transfer,
seen_objects,
out_data))
return false;
+ } else {
+ Throw(isolate, "Failed to serialize array element.");
+ return false;
}
}
} else if (value->IsArrayBuffer()) {
@@ -2098,6 +2101,9 @@ bool Shell::SerializeValue(Isolate* isolate,
Handle<Value> value,
if (!SerializeValue(isolate, property_value, to_transfer,
seen_objects,
out_data))
return false;
+ } else {
+ Throw(isolate, "Failed to serialize property.");
+ return false;
}
}
} else {
Index: test/mjsunit/regress/regress-crbug-506549.js
diff --git a/test/mjsunit/regress/regress-crbug-503698.js
b/test/mjsunit/regress/regress-crbug-506549.js
similarity index 53%
copy from test/mjsunit/regress/regress-crbug-503698.js
copy to test/mjsunit/regress/regress-crbug-506549.js
index
415d1bc81be5ac46fb358ce8ec681b1e5c276e07..69001e2afb04db192d4d5a03c914a9b71a9555f0
100644
--- a/test/mjsunit/regress/regress-crbug-503698.js
+++ b/test/mjsunit/regress/regress-crbug-506549.js
@@ -2,8 +2,9 @@
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
-// Flags: --invoke-weak-callbacks
-
if (this.Worker) {
- var __v_6 = new Worker('');
+ var __v_5 = {};
+ __v_5.__defineGetter__('byteLength', function() {foo();});
+ var __v_8 = new Worker('onmessage = function() {};');
+ __v_8.postMessage(__v_5);
}
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
