Fixing a subtle bug in receiver resolution when a thrown and caught function ...

src/heap.cc

 // Copyright 2006-2008 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 999 matching lines @@
   obj = AllocateMap(FIXED_ARRAY_TYPE, HeapObject::kHeaderSize);
   if (obj->IsFailure()) return false;
   hash_table_map_ = Map::cast(obj);
 
   obj = AllocateMap(FIXED_ARRAY_TYPE, HeapObject::kHeaderSize);
   if (obj->IsFailure()) return false;
   context_map_ = Map::cast(obj);
 
   obj = AllocateMap(FIXED_ARRAY_TYPE, HeapObject::kHeaderSize);
   if (obj->IsFailure()) return false;
+  catch_context_map_ = Map::cast(obj);
+
+  obj = AllocateMap(FIXED_ARRAY_TYPE, HeapObject::kHeaderSize);
+  if (obj->IsFailure()) return false;
   global_context_map_ = Map::cast(obj);
 
   obj = AllocateMap(JS_FUNCTION_TYPE, JSFunction::kSize);
   if (obj->IsFailure()) return false;
   boilerplate_function_map_ = Map::cast(obj);
 
   obj = AllocateMap(SHARED_FUNCTION_INFO_TYPE, SharedFunctionInfo::kSize);
   if (obj->IsFailure()) return false;
   shared_function_info_map_ = Map::cast(obj);
 
@@ skipping 1350 matching lines @@
   context->set_previous(NULL);
   context->set_extension(NULL);
   context->set_global(function->context()->global());
   ASSERT(!context->IsGlobalContext());
   ASSERT(context->is_function_context());
   ASSERT(result->IsContext());
   return result;
 }
 
 
-Object* Heap::AllocateWithContext(Context* previous, JSObject* extension) {
+Object* Heap::AllocateWithContext(Context* previous,
+                                  JSObject* extension,
+                                  bool is_catch_context) {
   Object* result = Heap::AllocateFixedArray(Context::MIN_CONTEXT_SLOTS);
   if (result->IsFailure()) return result;
   Context* context = reinterpret_cast<Context*>(result);
-  context->set_map(context_map());
+  context->set_map(is_catch_context ? catch_context_map() : context_map());
   context->set_closure(previous->closure());
   context->set_fcontext(previous->fcontext());
   context->set_previous(previous);
   context->set_extension(extension);
   context->set_global(previous->global());
   ASSERT(!context->IsGlobalContext());
   ASSERT(!context->is_function_context());
   ASSERT(result->IsContext());
   return result;
 }
@@ skipping 944 matching lines @@
 #ifdef DEBUG
 bool Heap::GarbageCollectionGreedyCheck() {
   ASSERT(FLAG_gc_greedy);
   if (Bootstrapper::IsActive()) return true;
   if (disallow_allocation_failure()) return true;
   return CollectGarbage(0, NEW_SPACE);
 }
 #endif
 
 } }  // namespace v8::internal