Use a different map to distinguish eval contexts

src/factory.cc

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/factory.h"
 
 #include "src/accessors.h"
 #include "src/allocation-site-scopes.h"
 #include "src/base/bits.h"
 #include "src/bootstrapper.h"
@@ skipping 858 matching lines @@
   array->set_map_no_write_barrier(*module_context_map());
   Handle<Context> context = Handle<Context>::cast(array);
   context->set_closure(*function);
   context->set_previous(function->context());
   context->set_extension(*module);
   context->set_native_context(function->native_context());
   DCHECK(context->IsModuleContext());
   return context;
 }
 
-
 Handle<Context> Factory::NewFunctionContext(int length,
                                             Handle<JSFunction> function) {
   DCHECK(function->shared()->scope_info()->scope_type() == FUNCTION_SCOPE);
   DCHECK(length >= Context::MIN_CONTEXT_SLOTS);
   Handle<FixedArray> array = NewFixedArray(length);
   array->set_map_no_write_barrier(*function_context_map());
   Handle<Context> context = Handle<Context>::cast(array);
   context->set_closure(*function);
   context->set_previous(function->context());
   context->set_extension(*the_hole_value());
   context->set_native_context(function->native_context());
   return context;
 }
 
+Handle<Context> Factory::NewEvalContext(int length,
+                                        Handle<JSFunction> function) {
+  DCHECK(function->shared()->scope_info()->scope_type() == FUNCTION_SCOPE);

[adamk, 2016/11/12 00:26:05]

I would have expected this DCHECK to fail...shouldn't this be EVAL_SCOPE?

[Dan Ehrenberg, 2016/12/07 05:41:26]

Fixed the DCHECK. Added a new test which triggers this path in
test/mjsunit/regress/regress-655573.js . Verified that it crashes in a debug
build with the incorrect DCHECK.

+  DCHECK(length >= Context::MIN_CONTEXT_SLOTS);
+  Handle<FixedArray> array = NewFixedArray(length);
+  array->set_map_no_write_barrier(*eval_context_map());
+  Handle<Context> context = Handle<Context>::cast(array);
+  context->set_closure(*function);
+  context->set_previous(function->context());
+  context->set_extension(*the_hole_value());
+  context->set_native_context(function->native_context());
+  return context;
+}
+
 Handle<Context> Factory::NewCatchContext(Handle<JSFunction> function,
                                          Handle<Context> previous,
                                          Handle<ScopeInfo> scope_info,
                                          Handle<String> name,
                                          Handle<Object> thrown_object) {
   STATIC_ASSERT(Context::MIN_CONTEXT_SLOTS == Context::THROWN_OBJECT_INDEX);
   Handle<ContextExtension> extension = NewContextExtension(scope_info, name);
   Handle<FixedArray> array = NewFixedArray(Context::MIN_CONTEXT_SLOTS + 1);
   array->set_map_no_write_barrier(*catch_context_map());
   Handle<Context> context = Handle<Context>::cast(array);
@@ skipping 1803 matching lines @@
       Handle<JSFixedArrayIterator>::cast(NewJSObjectFromMap(map));
   iterator->set_initial_next(*next);
   iterator->set_array(*array);
   iterator->set_index(0);
   iterator->InObjectPropertyAtPut(JSFixedArrayIterator::kNextIndex, *next);
   return iterator;
 }
 
 }  // namespace internal
 }  // namespace v8