Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(667)

Unified Diff: src/x87/code-stubs-x87.cc

Issue 1259853002: Cross-script variables handling fixed. It was possible to write to read-only global variable. (Closed) Base URL: https://chromium.googlesource.com/v8/v8.git@master
Patch Set: Created 5 years, 5 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View side-by-side diff with in-line comments
Download patch
« no previous file with comments | « src/x64/code-stubs-x64.cc ('k') | test/mjsunit/regress/cross-script-vars.js » ('j') | no next file with comments »
Expand Comments ('e') | Collapse Comments ('c') | Show Comments Hide Comments ('s')
Index: src/x87/code-stubs-x87.cc
diff --git a/src/x87/code-stubs-x87.cc b/src/x87/code-stubs-x87.cc
index 48ab6bb270c5deadf637f6e9819a31585f703bfd..c3903f99ecb04694fabc425f62f3cc0f71275a4b 100644
--- a/src/x87/code-stubs-x87.cc
+++ b/src/x87/code-stubs-x87.cc
@@ -4833,6 +4833,15 @@ void StoreGlobalViaContextStub::Generate(MacroAssembler* masm) {
// Load the PropertyCell at the specified slot.
__ mov(cell_reg, ContextOperand(context_reg, slot_reg));
+ // Check that cell value is not the_hole.
+ {
+ // TODO(bmeurer): use ecx (name_reg) when name parameter is removed.
+ Register cell_value_reg = cell_details_reg;
+ __ mov(cell_value_reg, FieldOperand(cell_reg, PropertyCell::kValueOffset));
+ __ CompareRoot(cell_value_reg, Heap::kTheHoleValueRootIndex);
+ __ j(equal, &slow_case, FLAG_debug_code ? Label::kFar : Label::kNear);
+ }
+
// Load PropertyDetails for the cell (actually only the cell_type and kind).
__ mov(cell_details_reg,
FieldOperand(cell_reg, PropertyCell::kDetailsOffset));
@@ -4900,6 +4909,7 @@ void StoreGlobalViaContextStub::Generate(MacroAssembler* masm) {
// Now either both old and new values must be SMIs or both must be heap
// objects with same map.
Label value_is_heap_object;
+ // TODO(bmeurer): use ecx (name_reg) when name parameter is removed.
Register cell_value_reg = cell_details_reg;
__ mov(cell_value_reg, FieldOperand(cell_reg, PropertyCell::kValueOffset));
__ JumpIfNotSmi(value_reg, &value_is_heap_object, Label::kNear);
« no previous file with comments | « src/x64/code-stubs-x64.cc ('k') | test/mjsunit/regress/cross-script-vars.js » ('j') | no next file with comments »

Powered by Google App Engine
This is Rietveld 408576698