Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(18)

Side by Side Diff: src/interpreter/interpreter.cc

Issue 2000203002: [Interpreter] Fix getIgnitionDispatchCounters crash with modified Object prototype. (Closed) Base URL: https://chromium.googlesource.com/v8/v8.git@master
Patch Set: Created 4 years, 7 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View unified diff | Download patch
« no previous file with comments | « no previous file | no next file » | no next file with comments »
Toggle Intra-line Diffs ('i') | Expand Comments ('e') | Collapse Comments ('c') | Show Comments Hide Comments ('s')
OLDNEW
1 // Copyright 2015 the V8 project authors. All rights reserved. 1 // Copyright 2015 the V8 project authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style license that can be 2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file. 3 // found in the LICENSE file.
4 4
5 #include "src/interpreter/interpreter.h" 5 #include "src/interpreter/interpreter.h"
6 6
7 #include <fstream> 7 #include <fstream>
8 8
9 #include "src/ast/prettyprinter.h" 9 #include "src/ast/prettyprinter.h"
10 #include "src/code-factory.h" 10 #include "src/code-factory.h"
(...skipping 232 matching lines...) Expand 10 before | Expand all | Expand 10 after
243 Bytecode to_bytecode = Bytecodes::FromByte(to_index); 243 Bytecode to_bytecode = Bytecodes::FromByte(to_index);
244 uintptr_t counter = GetDispatchCounter(from_bytecode, to_bytecode); 244 uintptr_t counter = GetDispatchCounter(from_bytecode, to_bytecode);
245 245
246 if (counter > 0) { 246 if (counter > 0) {
247 std::string to_name = Bytecodes::ToString(to_bytecode); 247 std::string to_name = Bytecodes::ToString(to_bytecode);
248 Local<v8::String> to_name_object = 248 Local<v8::String> to_name_object =
249 v8::String::NewFromUtf8(isolate, to_name.c_str(), 249 v8::String::NewFromUtf8(isolate, to_name.c_str(),
250 NewStringType::kNormal) 250 NewStringType::kNormal)
251 .ToLocalChecked(); 251 .ToLocalChecked();
252 Local<v8::Number> counter_object = v8::Number::New(isolate, counter); 252 Local<v8::Number> counter_object = v8::Number::New(isolate, counter);
253 CHECK(counters_row->Set(context, to_name_object, counter_object) 253 CHECK(counters_row
254 ->DefineOwnProperty(context, to_name_object, counter_object)
254 .IsJust()); 255 .IsJust());
255 } 256 }
256 } 257 }
257 258
258 std::string from_name = Bytecodes::ToString(from_bytecode); 259 std::string from_name = Bytecodes::ToString(from_bytecode);
259 Local<v8::String> from_name_object = 260 Local<v8::String> from_name_object =
260 v8::String::NewFromUtf8(isolate, from_name.c_str(), 261 v8::String::NewFromUtf8(isolate, from_name.c_str(),
261 NewStringType::kNormal) 262 NewStringType::kNormal)
262 .ToLocalChecked(); 263 .ToLocalChecked();
263 264
264 CHECK(counters_map->Set(context, from_name_object, counters_row).IsJust()); 265 CHECK(
266 counters_map->DefineOwnProperty(context, from_name_object, counters_row)
267 .IsJust());
265 } 268 }
266 269
267 return counters_map; 270 return counters_map;
268 } 271 }
269 272
270 // LdaZero 273 // LdaZero
271 // 274 //
272 // Load literal '0' into the accumulator. 275 // Load literal '0' into the accumulator.
273 void Interpreter::DoLdaZero(InterpreterAssembler* assembler) { 276 void Interpreter::DoLdaZero(InterpreterAssembler* assembler) {
274 Node* zero_value = __ NumberConstant(0.0); 277 Node* zero_value = __ NumberConstant(0.0);
(...skipping 1506 matching lines...) Expand 10 before | Expand all | Expand 10 after
1781 __ StoreObjectField(generator, JSGeneratorObject::kContinuationOffset, 1784 __ StoreObjectField(generator, JSGeneratorObject::kContinuationOffset,
1782 __ SmiTag(new_state)); 1785 __ SmiTag(new_state));
1783 __ SetAccumulator(old_state); 1786 __ SetAccumulator(old_state);
1784 1787
1785 __ Dispatch(); 1788 __ Dispatch();
1786 } 1789 }
1787 1790
1788 } // namespace interpreter 1791 } // namespace interpreter
1789 } // namespace internal 1792 } // namespace internal
1790 } // namespace v8 1793 } // namespace v8
OLDNEW
« no previous file with comments | « no previous file | no next file » | no next file with comments »

Powered by Google App Engine
This is Rietveld 408576698