Fix sloppy block-scoped function hoisting with nested zones

Fix sloppy block-scoped function hoisting with nested zones

The sloppy block-scoped function declaration placeholder statements
are held in parser_zone_-allocated hashtables. These hashtables are
not updated when local_zone_s are removed. Therefore, the
NewSloppyBlockFunctionStatement method should allocate
SloppyBlockScopeFunctionStatements in the parser_zone_ to avoid a
use-after-free. Scope fixup code may end up updating something which
is thrown away, but this is a small cost and much simpler than
removing dead hashtable entries later.

R=adamk
LOG=Y
BUG=chromium:537816
Committed: https://crrev.com/eb9deba81545e294e83c6c96ce84d74b4fc9ae52
Cr-Commit-Position: refs/heads/master@{#33185}

[Dan Ehrenberg, 2016-01-07 23:13:11]

The CQ bit was checked by littledan@chromium.org to run a CQ dry run

[commit-bot: I haz the power, 2016-01-07 23:13:19]

Dry run: CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/1564923007/1
View timeline at
 https://chromium-cq-status.appspot.com/patch-timeline/1564923007/1

[adamk, 2016-01-07 23:14:31]

https://codereview.chromium.org/1564923007/diff/1/src/ast/ast.h
File src/ast/ast.h (right):

https://codereview.chromium.org/1564923007/diff/1/src/ast/ast.h#newcode3458
src/ast/ast.h:3458: return new (local_zone_)
Don't you need to allocate the statement itself in the parser_zone_ too?

[Dan Ehrenberg, 2016-01-07 23:18:21]

https://codereview.chromium.org/1564923007/diff/1/src/ast/ast.h
File src/ast/ast.h (right):

https://codereview.chromium.org/1564923007/diff/1/src/ast/ast.h#newcode3458
src/ast/ast.h:3458: return new (local_zone_)
On 2016/01/07 at 23:14:31, adamk wrote:
> Don't you need to allocate the statement itself in the parser_zone_ too?

Oops, done, looks like I really need to figure out how to test this...

[Dan Ehrenberg, 2016-01-08 02:51:45]

The new version has a test. PTAL.

[Dan Ehrenberg, 2016-01-08 02:51:48]

The CQ bit was checked by littledan@chromium.org to run a CQ dry run

[commit-bot: I haz the power, 2016-01-08 02:51:59]

Dry run: CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/1564923007/40001
View timeline at
 https://chromium-cq-status.appspot.com/patch-timeline/1564923007/40001

[commit-bot: I haz the power, 2016-01-08 03:44:43]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2016-01-08 03:44:43]

Dry run: This issue passed the CQ dry run.

[adamk, 2016-01-08 16:04:13]

The CQ bit was checked by adamk@chromium.org

[adamk, 2016-01-08 16:04:14]

lgtm

[commit-bot: I haz the power, 2016-01-08 16:04:26]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/1564923007/40001
View timeline at
 https://chromium-cq-status.appspot.com/patch-timeline/1564923007/40001

[commit-bot: I haz the power, 2016-01-08 16:16:00]

Committed patchset #3 (id:40001)

[commit-bot: I haz the power, 2016-01-08 16:16:50]

Description was changed from

==========
Fix sloppy block-scoped function hoisting with nested zones

The sloppy block-scoped function declaration placeholder statements
are held in parser_zone_-allocated hashtables. These hashtables are
not updated when local_zone_s are removed. Therefore, the
NewSloppyBlockFunctionStatement method should allocate
SloppyBlockScopeFunctionStatements in the parser_zone_ to avoid a
use-after-free. Scope fixup code may end up updating something which
is thrown away, but this is a small cost and much simpler than
removing dead hashtable entries later.

R=adamk
LOG=Y
BUG=chromium:537816
==========

to

==========
Fix sloppy block-scoped function hoisting with nested zones

The sloppy block-scoped function declaration placeholder statements
are held in parser_zone_-allocated hashtables. These hashtables are
not updated when local_zone_s are removed. Therefore, the
NewSloppyBlockFunctionStatement method should allocate
SloppyBlockScopeFunctionStatements in the parser_zone_ to avoid a
use-after-free. Scope fixup code may end up updating something which
is thrown away, but this is a small cost and much simpler than
removing dead hashtable entries later.

R=adamk
LOG=Y
BUG=chromium:537816

Committed: https://crrev.com/eb9deba81545e294e83c6c96ce84d74b4fc9ae52
Cr-Commit-Position: refs/heads/master@{#33185}
==========

[commit-bot: I haz the power, 2016-01-08 16:16:51]

Patchset 3 (id:??) landed as
https://crrev.com/eb9deba81545e294e83c6c96ce84d74b4fc9ae52
Cr-Commit-Position: refs/heads/master@{#33185}