Revision: 21584
Author: [email protected]
Date: Fri May 30 17:04:40 2014 UTC
Log: Harden Runtime_FunctionSetPrototype, Isolate::PrintStack
BUG=chromium:377209
LOG=n
[email protected]
Review URL: https://codereview.chromium.org/306543002
http://code.google.com/p/v8/source/detail?r=21584
Modified:
/branches/bleeding_edge/src/frames.cc
/branches/bleeding_edge/src/hydrogen.cc
/branches/bleeding_edge/src/runtime.cc
=======================================
--- /branches/bleeding_edge/src/frames.cc Fri May 23 16:37:27 2014 UTC
+++ /branches/bleeding_edge/src/frames.cc Fri May 30 17:04:40 2014 UTC
@@ -1235,6 +1235,10 @@
if (this->context() != NULL && this->context()->IsContext()) {
context = Context::cast(this->context());
}
+ while (context->IsWithContext()) {
+ context = context->previous();
+ ASSERT(context != NULL);
+ }
// Print heap-allocated local variables.
if (heap_locals_count > 0) {
@@ -1245,8 +1249,9 @@
accumulator->PrintName(scope_info->ContextLocalName(i));
accumulator->Add(" = ");
if (context != NULL) {
- if (i < context->length()) {
- accumulator->Add("%o", context->get(Context::MIN_CONTEXT_SLOTS +
i));
+ int index = Context::MIN_CONTEXT_SLOTS + i;
+ if (index < context->length()) {
+ accumulator->Add("%o", context->get(index));
} else {
accumulator->Add(
"// warning: missing context slot - inconsistent frame?");
=======================================
--- /branches/bleeding_edge/src/hydrogen.cc Thu May 29 04:13:50 2014 UTC
+++ /branches/bleeding_edge/src/hydrogen.cc Fri May 30 17:04:40 2014 UTC
@@ -8733,7 +8733,6 @@
CallRuntime* expr) {
ZoneList<Expression*>* arguments = expr->arguments();
- NoObservableSideEffectsScope scope(this);
ASSERT(arguments->length()== 4);
CHECK_ALIVE(VisitForValue(arguments->at(0)));
HValue* obj = Pop();
@@ -8747,8 +8746,11 @@
CHECK_ALIVE(VisitForValue(arguments->at(3)));
HValue* byte_length = Pop();
- BuildArrayBufferViewInitialization<JSDataView>(
- obj, buffer, byte_offset, byte_length);
+ {
+ NoObservableSideEffectsScope scope(this);
+ BuildArrayBufferViewInitialization<JSDataView>(
+ obj, buffer, byte_offset, byte_length);
+ }
}
@@ -8869,7 +8871,6 @@
CallRuntime* expr) {
ZoneList<Expression*>* arguments = expr->arguments();
- NoObservableSideEffectsScope scope(this);
static const int kObjectArg = 0;
static const int kArrayIdArg = 1;
static const int kBufferArg = 2;
@@ -8924,6 +8925,7 @@
CHECK_ALIVE(VisitForValue(arguments->at(kByteLengthArg)));
HValue* byte_length = Pop();
+ NoObservableSideEffectsScope scope(this);
IfBuilder byte_offset_smi(this);
if (!is_zero_byte_offset) {
=======================================
--- /branches/bleeding_edge/src/runtime.cc Fri May 30 14:27:19 2014 UTC
+++ /branches/bleeding_edge/src/runtime.cc Fri May 30 17:04:40 2014 UTC
@@ -3027,7 +3027,7 @@
CONVERT_ARG_HANDLE_CHECKED(JSFunction, fun, 0);
CONVERT_ARG_HANDLE_CHECKED(Object, value, 1);
- ASSERT(fun->should_have_prototype());
+ RUNTIME_ASSERT(fun->should_have_prototype());
Accessors::FunctionSetPrototype(fun, value);
return args[0]; // return TOS
}
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
