Fix uninitialized memory read in CallOptimization.

src/ia32/stub-cache-ia32.cc

 // Copyright 2006-2009 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 461 matching lines @@
   }
 
  private:
   Register name_;
 };
 
 
 // Holds information about possible function call optimizations.
 class CallOptimization BASE_EMBEDDED {
  public:
-  explicit CallOptimization(LookupResult* lookup)
-    : constant_function_(NULL),
-      is_simple_api_call_(false),
-      expected_receiver_type_(NULL),
-      api_call_info_(NULL) {
-    if (!lookup->IsProperty() || !lookup->IsCacheable()) return;
-
-    // We only optimize constant function calls.
-    if (lookup->type() != CONSTANT_FUNCTION) return;
-
-    Initialize(lookup->GetConstantFunction());
+  explicit CallOptimization(LookupResult* lookup) {
+    if (!lookup->IsProperty() || !lookup->IsCacheable() ||
+        lookup->type() != CONSTANT_FUNCTION) {
+      Initialize(NULL);
+    } else {
+      // We only optimize constant function calls.
+      Initialize(lookup->GetConstantFunction());
+    }
   }
 
   explicit CallOptimization(JSFunction* function) {
     Initialize(function);
   }
 
   bool is_constant_call() const {
     return constant_function_ != NULL;
   }
 
@@ skipping 27 matching lines @@
       if (object->IsInstanceOf(expected_receiver_type_)) return depth;
       object = JSObject::cast(object->GetPrototype());
       ++depth;
     }
     if (holder->IsInstanceOf(expected_receiver_type_)) return depth;
     return kInvalidProtoDepth;
   }
 
  private:
   void Initialize(JSFunction* function) {
-    if (!function->is_compiled()) return;
+    constant_function_ = NULL;
+    is_simple_api_call_ = false;
+    expected_receiver_type_ = NULL;
+    api_call_info_ = NULL;
+
+    if (function == NULL || !function->is_compiled()) return;
 
     constant_function_ = function;
-    is_simple_api_call_ = false;
-
     AnalyzePossibleApiFunction(function);
   }
 
   // Determines whether the given function can be called using the
   // fast api call builtin.
   void AnalyzePossibleApiFunction(JSFunction* function) {
     SharedFunctionInfo* sfi = function->shared();
     if (sfi->function_data()->IsUndefined()) return;
     FunctionTemplateInfo* info =
         FunctionTemplateInfo::cast(sfi->function_data());
@@ skipping 1647 matching lines @@
   __ jmp(generic_construct_stub, RelocInfo::CODE_TARGET);
 
   // Return the generated code.
   return GetCode();
 }
 
 
 #undef __
 
 } }  // namespace v8::internal