Fix unsafe use of DescriptorWriter across allocation....

src/factory.cc

 // Copyright 2006-2008 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 552 matching lines @@
     Handle<Object> descriptors) {
   v8::NeanderArray callbacks(descriptors);
   int nof_callbacks = callbacks.length();
   Handle<DescriptorArray> result =
       NewDescriptorArray(array->number_of_descriptors() + nof_callbacks);
 
   // Number of descriptors added to the result so far.
   int descriptor_count = 0;
 
   // Copy the descriptors from the array.
-  DescriptorWriter w(*result);
-  for (DescriptorReader r(*array); !r.eos(); r.advance()) {
-    if (!r.IsNullDescriptor()) {
-      w.WriteFrom(&r);
+  {
+    DescriptorWriter w(*result);
+    for (DescriptorReader r(*array); !r.eos(); r.advance()) {
+      if (!r.IsNullDescriptor()) {
+        w.WriteFrom(&r);
+      }
+      descriptor_count++;
     }
-    descriptor_count++;
   }
 
   // Number of duplicates detected.
   int duplicates = 0;
 
   // Fill in new callback descriptors.  Process the callbacks from
   // back to front so that the last callback with a given name takes
   // precedence over previously added callbacks with that name.
   for (int i = nof_callbacks - 1; i >= 0; i--) {
     Handle<AccessorInfo> entry =
         Handle<AccessorInfo>(AccessorInfo::cast(callbacks.get(i)));
     // Ensure the key is a symbol before writing into the instance descriptor.
     Handle<String> key =
         SymbolFromString(Handle<String>(String::cast(entry->name())));
     // Check if a descriptor with this name already exists before writing.
     if (result->LinearSearch(*key, descriptor_count) ==
         DescriptorArray::kNotFound) {
       CallbacksDescriptor desc(*key, *entry, entry->property_attributes());
-      w.Write(&desc);
+      // We do not use a DescriptorWriter because SymbolFromString can
+      // allocate. A DescriptorWriter holds a raw pointer and is
+      // therefore not GC safe.
+      result->Set(descriptor_count, &desc);
       descriptor_count++;
     } else {
       duplicates++;
     }
   }
 
   // If duplicates were detected, allocate a result of the right size
   // and transfer the elements.
   if (duplicates > 0) {
     Handle<DescriptorArray> new_result =
@@ skipping 311 matching lines @@
     Execution::ConfigureInstance(instance,
                                  instance_template,
                                  pending_exception);
   } else {
     *pending_exception = false;
   }
 }
 
 
 } }  // namespace v8::internal