Prevent stack overflow in the serializer/deserializer.

test/cctest/test-serialize.cc

 // Copyright 2007-2010 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 311 matching lines @@
 
     SnapshotByteSink startup_sink;
     StartupSerializer startup_serializer(isolate, &startup_sink);
     startup_serializer.SerializeStrongReferences();
 
     SnapshotByteSink partial_sink;
     PartialSerializer partial_serializer(isolate, &startup_serializer,
                                          &partial_sink);
     partial_serializer.Serialize(&raw_foo);
 
-    startup_serializer.SerializeWeakReferences();
+    startup_serializer.SerializeWeakReferencesAndDeferred();
 
     SnapshotData startup_snapshot(startup_serializer);
     SnapshotData partial_snapshot(partial_serializer);
 
     WritePayload(partial_snapshot.RawData(), FLAG_testing_serialization_file);
     WritePayload(startup_snapshot.RawData(), startup_name.start());
 
     startup_name.Dispose();
   }
   v8_isolate->Exit();
@@ skipping 97 matching lines @@
     env.Reset();
 
     SnapshotByteSink startup_sink;
     StartupSerializer startup_serializer(isolate, &startup_sink);
     startup_serializer.SerializeStrongReferences();
 
     SnapshotByteSink partial_sink;
     PartialSerializer partial_serializer(isolate, &startup_serializer,
                                          &partial_sink);
     partial_serializer.Serialize(&raw_context);
-    startup_serializer.SerializeWeakReferences();
+    startup_serializer.SerializeWeakReferencesAndDeferred();
 
     SnapshotData startup_snapshot(startup_serializer);
     SnapshotData partial_snapshot(partial_serializer);
 
     WritePayload(partial_snapshot.RawData(), FLAG_testing_serialization_file);
     WritePayload(startup_snapshot.RawData(), startup_name.start());
 
     startup_name.Dispose();
   }
   v8_isolate->Dispose();
@@ skipping 114 matching lines @@
     env.Reset();
 
     SnapshotByteSink startup_sink;
     StartupSerializer startup_serializer(isolate, &startup_sink);
     startup_serializer.SerializeStrongReferences();
 
     SnapshotByteSink partial_sink;
     PartialSerializer partial_serializer(isolate, &startup_serializer,
                                          &partial_sink);
     partial_serializer.Serialize(&raw_context);
-    startup_serializer.SerializeWeakReferences();
+    startup_serializer.SerializeWeakReferencesAndDeferred();
 
     SnapshotData startup_snapshot(startup_serializer);
     SnapshotData partial_snapshot(partial_serializer);
 
     WritePayload(partial_snapshot.RawData(), FLAG_testing_serialization_file);
     WritePayload(startup_snapshot.RawData(), startup_name.start());
 
     startup_name.Dispose();
   }
   v8_isolate->Dispose();
@@ skipping 135 matching lines @@
     v8::HandleScope h_scope(isolate1);
     v8::Local<v8::Context> context = v8::Context::New(isolate1);
     delete[] data1.data;  // We can dispose of the snapshot blob now.
     v8::Context::Scope c_scope(context);
     CHECK_EQ(42, CompileRun("f()")->ToInt32(isolate1)->Int32Value());
   }
   isolate1->Dispose();
 }
 
 
+TEST(SnapshotBlobsStackOverflow) {
+  DisableTurbofan();
+  const char* source =
+      "var a = [0];"
+      "var b = a;"
+      "for (var i = 0; i < 10000; i++) {"
+      "  var c = [i];"
+      "  b.push(c);"
+      "  b.push(c);"
+      "  b = c;"
+      "}";
+
+  v8::StartupData data = v8::V8::CreateSnapshotDataBlob(source);
+
+  v8::Isolate::CreateParams params;
+  params.snapshot_blob = &data;
+  params.array_buffer_allocator = CcTest::array_buffer_allocator();
+
+  v8::Isolate* isolate = v8::Isolate::New(params);
+  {
+    v8::Isolate::Scope i_scope(isolate);
+    v8::HandleScope h_scope(isolate);
+    v8::Local<v8::Context> context = v8::Context::New(isolate);
+    delete[] data.data;  // We can dispose of the snapshot blob now.
+    v8::Context::Scope c_scope(context);
+    const char* test =
+        "var sum = 0;"
+        "while (a) {"
+        "  sum += a[0];"
+        "  a = a[1];"
+        "}"
+        "sum";
+    CHECK_EQ(9999 * 5000, CompileRun(test)->ToInt32(isolate)->Int32Value());
+  }
+  isolate->Dispose();
+}
+
+
 TEST(TestThatAlwaysSucceeds) {
 }
 
 
 TEST(TestThatAlwaysFails) {
   bool ArtificialFailure = false;
   CHECK(ArtificialFailure);
 }
 
 
@@ skipping 818 matching lines @@
   isolate->Dispose();
 }
 
 
 TEST(SerializationMemoryStats) {
   FLAG_profile_deserialization = true;
   FLAG_always_opt = false;
   v8::StartupData blob = v8::V8::CreateSnapshotDataBlob();
   delete[] blob.data;
 }