Harden global variable accesses in the fast code generator.

src/fast-codegen.cc

 // Copyright 2010 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 202 matching lines @@
 
 void FastCodeGenSyntaxChecker::VisitVariableProxy(VariableProxy* expr) {
   // Only global variable references are supported.
   Variable* var = expr->var();
   if (!var->is_global() || var->is_this()) BAILOUT("Non-global variable");
 
   // Check if the global variable is existing and non-deletable.
   if (info()->has_global_object()) {
     LookupResult lookup;
     info()->global_object()->Lookup(*expr->name(), &lookup);
-    if (!lookup.IsValid() || !lookup.IsDontDelete()) {
-      BAILOUT("Non-existing or deletable global variable");
+    if (!lookup.IsValid()) {
+      BAILOUT("Non-existing global variable");
+    }
+    // We do not handle global variables with accessors or interceptors.
+    if (lookup.type() != NORMAL) {
+      BAILOUT("Global variable with accessors or interceptors.");
+    }
+    // We do not handle deletable global variables.
+    if (!lookup.IsDontDelete()) {
+      BAILOUT("Deletable global variable");
     }
   }
 }
 
 
 void FastCodeGenSyntaxChecker::VisitLiteral(Literal* expr) {
   BAILOUT("Literal");
 }
 
 
@@ skipping 331 matching lines @@
   UNREACHABLE();
 }
 
 
 void FastCodeGenerator::VisitVariableProxy(VariableProxy* expr) {
   ASSERT(expr->var()->is_global() && !expr->var()->is_this());
   // Check if we can compile a global variable load directly from the cell.
   ASSERT(info()->has_global_object());
   LookupResult lookup;
   info()->global_object()->Lookup(*expr->name(), &lookup);
-  // We only support DontDelete properties for now.
+  // We only support normal (non-accessor/interceptor) DontDelete properties
+  // for now.
   ASSERT(lookup.IsValid());
+  ASSERT_EQ(NORMAL, lookup.type());
   ASSERT(lookup.IsDontDelete());
   Handle<Object> cell(info()->global_object()->GetPropertyCell(&lookup));
 
   // Global variable lookups do not have side effects, so we do not need to
   // emit code if we are in an effect context.
   if (!destination().is(no_reg)) {
     Comment cmnt(masm(), ";; Global");
     if (FLAG_print_ir) {
       SmartPointer<char> name = expr->name()->ToCString();
       PrintF("%d: t%d = Global(%s)\n", expr->num(), expr->num(), *name);
@@ skipping 136 matching lines @@
 
 
 void FastCodeGenerator::VisitThisFunction(ThisFunction* expr) {
   UNREACHABLE();
 }
 
 #undef __
 
 
 } }  // namespace v8::internal