Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(875)

Unified Diff: src/parser.cc

Issue 1023483003: Parser: Fix crash on stack overflow when lazy-parsing arrow functions (Closed) Base URL: https://chromium.googlesource.com/v8/v8.git@master
Patch Set: Add parenthesized version test, comment on expected result Created 5 years, 9 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View side-by-side diff with in-line comments
Download patch
« no previous file with comments | « no previous file | test/mjsunit/regress/regress-crbug-465671.js » ('j') | no next file with comments »
Expand Comments ('e') | Collapse Comments ('c') | Show Comments Hide Comments ('s')
Index: src/parser.cc
diff --git a/src/parser.cc b/src/parser.cc
index 4bcdfdbda7e2233fd25a710caea8f23d9d6d0510..1e5356fc6800ea678c034ef89a49e75564a4bd41 100644
--- a/src/parser.cc
+++ b/src/parser.cc
@@ -1145,8 +1145,20 @@ FunctionLiteral* Parser::ParseLazy(Isolate* isolate, ParseInfo* info,
// from creating unresolved variables in already-resolved scopes.
parsing_lazy_arrow_parameters_ = true;
Expression* expression = ParseExpression(false, &ok);
- DCHECK(expression->IsFunctionLiteral());
- result = expression->AsFunctionLiteral();
+ if (ok) {
+ // Scanning must end at the same position that was recorded
+ // previously. If not, parsing has been interrupted due to a
+ // stack overflow, at which point the partially parsed arrow
+ // function concise body happens to be a valid expression.
+ if (scanner()->location().end_pos == shared_info->end_position()) {
+ // The input is known to be a function that is being lazy-parsed.
wingo 2015/03/19 13:21:40 lazy-parsed is not great terminology IMO. How abo
aperez 2015/03/19 23:57:39 Acknowledged.
+ DCHECK(expression->IsFunctionLiteral());
+ result = expression->AsFunctionLiteral();
+ } else {
+ result = NULL;
+ ok = false;
+ }
+ }
} else if (shared_info->is_default_constructor()) {
result = DefaultConstructor(IsSubclassConstructor(shared_info->kind()),
scope, shared_info->start_position(),
« no previous file with comments | « no previous file | test/mjsunit/regress/regress-crbug-465671.js » ('j') | no next file with comments »

Powered by Google App Engine
This is Rietveld 408576698