Version 4.3.61.32 (cherry-pick)

test/cctest/test-serialize.cc

 // Copyright 2007-2010 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 679 matching lines @@
     v8::Local<v8::Context> context = v8::Context::New(isolate2);
     delete[] data2.data;  // We can dispose of the snapshot blob now.
     v8::Context::Scope c_scope(context);
     CHECK_EQ(86, CompileRun("f()")->ToInt32(isolate2)->Int32Value());
     CHECK_EQ(43, CompileRun("g()")->ToInt32(isolate2)->Int32Value());
   }
   isolate2->Dispose();
 }
 
 
+static void SerializationFunctionTemplate(
+    const v8::FunctionCallbackInfo<v8::Value>& args) {
+  args.GetReturnValue().Set(args[0]);
+}
+
+
+TEST(PerIsolateSnapshotBlobsOutdatedContextWithOverflow) {
+  DisableTurbofan();
+
+  const char* source1 =
+      "var o = {};"
+      "(function() {"
+      "  function f1(x) { return f2(x) instanceof Array; }"
+      "  function f2(x) { return foo.bar(x); }"
+      "  o.a = f2.bind(null);"
+      "  o.b = 1;"
+      "  o.c = 2;"
+      "  o.d = 3;"
+      "  o.e = 4;"
+      "})();\n";
+
+  const char* source2 = "o.a(42)";
+
+  v8::StartupData data = v8::V8::CreateSnapshotDataBlob(source1);
+
+  v8::Isolate::CreateParams params;
+  params.snapshot_blob = &data;
+
+  v8::Isolate* isolate = v8::Isolate::New(params);
+  {
+    v8::Isolate::Scope i_scope(isolate);
+    v8::HandleScope h_scope(isolate);
+
+    v8::Local<v8::ObjectTemplate> global = v8::ObjectTemplate::New(isolate);
+    v8::Local<v8::ObjectTemplate> property = v8::ObjectTemplate::New(isolate);
+    v8::Local<v8::FunctionTemplate> function =
+        v8::FunctionTemplate::New(isolate, SerializationFunctionTemplate);
+    property->Set(isolate, "bar", function);
+    global->Set(isolate, "foo", property);
+
+    v8::Local<v8::Context> context = v8::Context::New(isolate, NULL, global);
+    delete[] data.data;  // We can dispose of the snapshot blob now.
+    v8::Context::Scope c_scope(context);
+    v8::Local<v8::Value> result = CompileRun(source2);
+    CHECK(v8_str("42")->Equals(result));
+  }
+  isolate->Dispose();
+}
+
+
 TEST(PerIsolateSnapshotBlobsWithLocker) {
   DisableTurbofan();
   v8::Isolate* isolate0 = v8::Isolate::New();
   {
     v8::Locker locker(isolate0);
     v8::Isolate::Scope i_scope(isolate0);
     v8::HandleScope h_scope(isolate0);
     v8::Local<v8::Context> context = v8::Context::New(isolate0);
     v8::Context::Scope c_scope(context);
     CHECK_EQ(1, CompileRun("Math.cos(0)")->ToInt32(isolate0)->Int32Value());
@@ skipping 869 matching lines @@
     CHECK_EQ(11, CompileRun("foo(0)")->ToInt32(isolate)->Int32Value());
     CHECK_EQ(11, CompileRun("foo(1)")->ToInt32(isolate)->Int32Value());
     CHECK_EQ(12, CompileRun("foo(2)")->ToInt32(isolate)->Int32Value());
     CHECK_EQ(12, CompileRun("foo(3)")->ToInt32(isolate)->Int32Value());
     CHECK_EQ(23, CompileRun("foo(4)")->ToInt32(isolate)->Int32Value());
     CHECK_EQ(23, CompileRun("foo(5)")->ToInt32(isolate)->Int32Value());
     CHECK_EQ(10, CompileRun("foo(6)")->ToInt32(isolate)->Int32Value());
   }
   isolate->Dispose();
 }