Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(141)

Unified Diff: src/messages.cc

Issue 2006603002: [runtime] Don't crash when trying to access manually constructed CallSite object. (Closed) Base URL: https://chromium.googlesource.com/v8/v8.git@master
Patch Set: Created 4 years, 7 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View side-by-side diff with in-line comments
Download patch
« no previous file with comments | « no previous file | test/mjsunit/regress/regress-crbug-613905.js » ('j') | no next file with comments »
Expand Comments ('e') | Collapse Comments ('c') | Show Comments Hide Comments ('s')
Index: src/messages.cc
diff --git a/src/messages.cc b/src/messages.cc
index 74f4729b1f5f5627976b02dc3a147af0751c1de0..2062917e457a08a1baac6d1ea648bb3fb90cbfad 100644
--- a/src/messages.cc
+++ b/src/messages.cc
@@ -182,9 +182,14 @@ CallSite::CallSite(Isolate* isolate, Handle<JSObject> call_site_obj)
// invalid: neither javascript nor wasm
return;
}
+ Handle<Object> maybe_wasm_obj = JSObject::GetDataProperty(
+ call_site_obj, isolate->factory()->call_site_wasm_obj_symbol());
+ if (!maybe_wasm_obj->IsJSObject()) {
+ // invalid: neither javascript nor wasm
+ return;
+ }
// wasm
- wasm_obj_ = Handle<JSObject>::cast(JSObject::GetDataProperty(
- call_site_obj, isolate->factory()->call_site_wasm_obj_symbol()));
+ wasm_obj_ = Handle<JSObject>::cast(maybe_wasm_obj);
wasm_func_index_ = Smi::cast(*maybe_wasm_func_index)->value();
DCHECK(static_cast<int>(wasm_func_index_) >= 0);
}
@@ -205,11 +210,8 @@ Handle<Object> CallSite::GetFileName() {
Handle<Object> CallSite::GetFunctionName() {
if (IsWasm()) {
- MaybeHandle<String> name;
- if (!wasm_obj_->IsUndefined()) {
- name = wasm::GetWasmFunctionName(Handle<JSObject>::cast(wasm_obj_),
- wasm_func_index_);
- }
+ MaybeHandle<String> name = wasm::GetWasmFunctionName(
+ Handle<JSObject>::cast(wasm_obj_), wasm_func_index_);
if (name.is_null()) return isolate_->factory()->null_value();
return name.ToHandleChecked();
}
« no previous file with comments | « no previous file | test/mjsunit/regress/regress-crbug-613905.js » ('j') | no next file with comments »

Powered by Google App Engine
This is Rietveld 408576698