Use a different map to distinguish eval contexts

src/factory.cc

Index: src/factory.cc
diff --git a/src/factory.cc b/src/factory.cc
index 4f42888164de48ec0b5f88a01b886f27ad80065e..026ded119e1e43893b32baa99e125b71bf586a12 100644
--- a/src/factory.cc
+++ b/src/factory.cc
@@ -876,7 +876,6 @@ Handle<Context> Factory::NewModuleContext(Handle<Module> module,
   return context;
 }
 
-
 Handle<Context> Factory::NewFunctionContext(int length,
                                             Handle<JSFunction> function) {
   DCHECK(function->shared()->scope_info()->scope_type() == FUNCTION_SCOPE);
@@ -891,6 +890,20 @@ Handle<Context> Factory::NewFunctionContext(int length,
   return context;
 }
 
+Handle<Context> Factory::NewEvalContext(int length,
+                                        Handle<JSFunction> function) {
+  DCHECK(function->shared()->scope_info()->scope_type() == FUNCTION_SCOPE);

[adamk, 2016/11/12 00:26:05]

I would have expected this DCHECK to fail...shouldn't this be EVAL_SCOPE?

[Dan Ehrenberg, 2016/12/07 05:41:26]

Fixed the DCHECK. Added a new test which triggers this path in
test/mjsunit/regress/regress-655573.js . Verified that it crashes in a debug
build with the incorrect DCHECK.

+  DCHECK(length >= Context::MIN_CONTEXT_SLOTS);
+  Handle<FixedArray> array = NewFixedArray(length);
+  array->set_map_no_write_barrier(*eval_context_map());
+  Handle<Context> context = Handle<Context>::cast(array);
+  context->set_closure(*function);
+  context->set_previous(function->context());
+  context->set_extension(*the_hole_value());
+  context->set_native_context(function->native_context());
+  return context;
+}
+
 Handle<Context> Factory::NewCatchContext(Handle<JSFunction> function,
                                          Handle<Context> previous,
                                          Handle<ScopeInfo> scope_info,