DescriptionFix crash due RegExpAtom method called on RegExpCharacterClass object.
In the RegExpUnparser::VisitText(RegExpText* that, void* data) function always RegExpUnparser::VisitAtom function called via that->elements()->at(i).data.u_atom->Accept(this, data); even if the type of the object is RegExpCharacterClass.
The problem shows using g++ 4.7(.2, .3) since r16232, since GCC optimizes virtual method calls to direct calls based on __final/final hints. Tested on MIPS and x64:
Program received signal SIGSEGV, Segmentation fault.
0x0000000000588928 in v8::internal::RegExpUnparser::VisitAtom(v8::internal::RegExpAtom*, void*) ()
This cleans up the TextElement class to avoid the unsafe+unchecked union access, that caused the crash.
TEST=cctest/test-regexp/ParserRegression
R=jkummerow@chromium.org
Committed: https://code.google.com/p/v8/source/detail?r=16289
Patch Set 1 #
Messages
Total messages: 3 (0 generated)
|