Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(99)

Unified Diff: src/x87/builtins-x87.cc

Issue 1582173002: X87: [builtins] Sanitize receiver patching for API functions. (Closed) Base URL: https://chromium.googlesource.com/v8/v8.git@master
Patch Set: Created 4 years, 11 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View side-by-side diff with in-line comments
Download patch
« no previous file with comments | « no previous file | no next file » | no next file with comments »
Expand Comments ('e') | Collapse Comments ('c') | Show Comments Hide Comments ('s')
Index: src/x87/builtins-x87.cc
diff --git a/src/x87/builtins-x87.cc b/src/x87/builtins-x87.cc
index beb47f428d48e6d6eacc96e49469bc09de358496..67b79f7f2ed4425adf2aeafa7725cec6ac69582d 100644
--- a/src/x87/builtins-x87.cc
+++ b/src/x87/builtins-x87.cc
@@ -2254,10 +2254,6 @@ static void CompatibleReceiverCheck(MacroAssembler* masm, Register receiver,
Register function_template_info,
Register scratch0, Register scratch1,
Label* receiver_check_failed) {
- // If receiver is not an object, jump to receiver_check_failed.
- __ CmpObjectType(receiver, FIRST_JS_OBJECT_TYPE, scratch0);
- __ j(below, receiver_check_failed);
-
// If there is no signature, return the holder.
__ CompareRoot(FieldOperand(function_template_info,
FunctionTemplateInfo::kSignatureOffset),
@@ -2331,22 +2327,13 @@ void Builtins::Generate_HandleFastApiCall(MacroAssembler* masm) {
// -- esp[(eax + 1) * 4] : receiver
// -----------------------------------
- // Load the receiver.
- Operand receiver_operand(esp, eax, times_pointer_size, kPCOnStackSize);
- __ mov(ecx, receiver_operand);
-
- // Update the receiver if this is a contextual call.
- Label set_global_proxy, valid_receiver;
- __ CompareRoot(ecx, Heap::kUndefinedValueRootIndex);
- __ j(equal, &set_global_proxy);
- __ bind(&valid_receiver);
-
// Load the FunctionTemplateInfo.
__ mov(ebx, FieldOperand(edi, JSFunction::kSharedFunctionInfoOffset));
__ mov(ebx, FieldOperand(ebx, SharedFunctionInfo::kFunctionDataOffset));
// Do the compatible receiver check.
Label receiver_check_failed;
+ __ mov(ecx, Operand(esp, eax, times_pointer_size, kPCOnStackSize));
__ Push(eax);
CompatibleReceiverCheck(masm, ecx, ebx, edx, eax, &receiver_check_failed);
__ Pop(eax);
@@ -2357,12 +2344,6 @@ void Builtins::Generate_HandleFastApiCall(MacroAssembler* masm) {
__ add(edx, Immediate(Code::kHeaderSize - kHeapObjectTag));
__ jmp(edx);
- __ bind(&set_global_proxy);
- __ mov(ecx, NativeContextOperand());
- __ mov(ecx, ContextOperand(ecx, Context::GLOBAL_PROXY_INDEX));
- __ mov(receiver_operand, ecx);
- __ jmp(&valid_receiver, Label::kNear);
-
// Compatible receiver check failed: pop return address, arguments and
// receiver and throw an Illegal Invocation exception.
__ bind(&receiver_check_failed);
« no previous file with comments | « no previous file | no next file » | no next file with comments »

Powered by Google App Engine
This is Rietveld 408576698