Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(89)

Unified Diff: src/parser.cc

Issue 1023483003: Parser: Fix crash on stack overflow when lazy-parsing arrow functions (Closed) Base URL: https://chromium.googlesource.com/v8/v8.git@master
Patch Set: Fix nits as per review comments Created 5 years, 9 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View side-by-side diff with in-line comments
Download patch
« no previous file with comments | « no previous file | test/mjsunit/regress/regress-crbug-465671.js » ('j') | no next file with comments »
Expand Comments ('e') | Collapse Comments ('c') | Show Comments Hide Comments ('s')
Index: src/parser.cc
diff --git a/src/parser.cc b/src/parser.cc
index 4bcdfdbda7e2233fd25a710caea8f23d9d6d0510..96ee2bd033537d85169f342668757b9a0544c69f 100644
--- a/src/parser.cc
+++ b/src/parser.cc
@@ -1145,8 +1145,24 @@ FunctionLiteral* Parser::ParseLazy(Isolate* isolate, ParseInfo* info,
// from creating unresolved variables in already-resolved scopes.
parsing_lazy_arrow_parameters_ = true;
Expression* expression = ParseExpression(false, &ok);
- DCHECK(expression->IsFunctionLiteral());
- result = expression->AsFunctionLiteral();
+ if (ok) {
+ // Scanning must end at the same position that was recorded
+ // previously. If not, parsing has been interrupted due to a
+ // stack overflow, at which point the partially parsed arrow
+ // function concise body happens to be a valid expression. This
+ // is a problem only for arrow functions with single statement
+ // bodies, since there is no end token suck as "}" for normal
marja 2015/03/23 10:56:31 ... unintentional swearing? :)
+ // functions.
+ if (scanner()->location().end_pos == shared_info->end_position()) {
+ // The pre-parser saw an arrow function here, so the full parser
+ // must produce a FunctionLiteral.
+ DCHECK(expression->IsFunctionLiteral());
+ result = expression->AsFunctionLiteral();
+ } else {
+ result = NULL;
+ ok = false;
+ }
+ }
} else if (shared_info->is_default_constructor()) {
result = DefaultConstructor(IsSubclassConstructor(shared_info->kind()),
scope, shared_info->start_position(),
« no previous file with comments | « no previous file | test/mjsunit/regress/regress-crbug-465671.js » ('j') | no next file with comments »

Powered by Google App Engine
This is Rietveld 408576698