Classes: Fix issue with default constructor crash

src/runtime/runtime-classes.cc

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include <stdlib.h>
 #include <limits>
 
 #include "src/v8.h"
 
 #include "src/isolate-inl.h"
@@ skipping 83 matching lines @@
           isolate,
           NewTypeError("extends_value_not_a_function", HandleVector(args, 1)));
     }
   }
 
   Handle<Map> map =
       isolate->factory()->NewMap(JS_OBJECT_TYPE, JSObject::kHeaderSize);
   map->set_prototype(*prototype_parent);
   Handle<JSObject> prototype = isolate->factory()->NewJSObjectFromMap(map);
 
-  Handle<String> name_string = name->IsString()
-                                   ? Handle<String>::cast(name)
-                                   : isolate->factory()->empty_string();
-
   Handle<JSFunction> ctor;
   if (constructor->IsSpecFunction()) {
     ctor = Handle<JSFunction>::cast(constructor);
-    JSFunction::SetPrototype(ctor, prototype);
-    PropertyAttributes attribs =
-        static_cast<PropertyAttributes>(DONT_ENUM | DONT_DELETE | READ_ONLY);
-    RETURN_FAILURE_ON_EXCEPTION(
-        isolate,
-        JSObject::SetOwnPropertyIgnoreAttributes(
-            ctor, isolate->factory()->prototype_string(), prototype, attribs));
   } else {
-    // TODO(arv): This should not use an empty function but a function that
-    // calls super.
-    Handle<Code> code(isolate->builtins()->builtin(Builtins::kEmptyFunction));
-    ctor = isolate->factory()->NewFunction(name_string, code, prototype, true);
+    Handle<JSFunction> default_constructor =
+        super_class->IsTheHole() ? isolate->default_constructor_no_super()
+                                 : isolate->default_constructor();
+    Handle<SharedFunctionInfo> shared(default_constructor->shared());
+    Handle<Context> context(default_constructor->context());

[Dmitry Lomov (no reviews), 2014/11/04 20:52:38]

This is wrong - you create a constructor in builtins context here! (since that
is default_constructor's context)
You will have to pass a correct context to this function (see generated calls to
Runtime_NewClosure).

+    ctor =
+        isolate->factory()->NewFunctionFromSharedFunctionInfo(shared, context);
   }
+  JSFunction::SetPrototype(ctor, prototype);
+  PropertyAttributes attribs =
+      static_cast<PropertyAttributes>(DONT_ENUM | DONT_DELETE | READ_ONLY);
+  RETURN_FAILURE_ON_EXCEPTION(
+      isolate,
+      JSObject::SetOwnPropertyIgnoreAttributes(
+          ctor, isolate->factory()->prototype_string(), prototype, attribs));
 
   Handle<Symbol> home_object_symbol(isolate->heap()->home_object_symbol());
   RETURN_FAILURE_ON_EXCEPTION(
       isolate, JSObject::SetOwnPropertyIgnoreAttributes(
                    ctor, home_object_symbol, prototype, DONT_ENUM));
 
   if (!constructor_parent.is_null()) {
     RETURN_FAILURE_ON_EXCEPTION(
         isolate, JSObject::SetPrototype(ctor, constructor_parent, false));
   }
 
+  Handle<String> name_string = name->IsString()
+                                   ? Handle<String>::cast(name)
+                                   : isolate->factory()->empty_string();
+  RETURN_FAILURE_ON_EXCEPTION(
+      isolate,
+      JSObject::SetOwnPropertyIgnoreAttributes(
+          ctor, isolate->factory()->name_string(), name_string, attribs));
+
   JSObject::AddProperty(prototype, isolate->factory()->constructor_string(),
                         ctor, DONT_ENUM);
 
   // Install private properties that are used to construct the FunctionToString.
   RETURN_FAILURE_ON_EXCEPTION(
       isolate,
       Object::SetProperty(ctor, isolate->factory()->class_script_symbol(),
                           script, STRICT));
   RETURN_FAILURE_ON_EXCEPTION(
       isolate, Object::SetProperty(
@@ skipping 305 matching lines @@
   DCHECK(args.length() == 4);
   CONVERT_ARG_HANDLE_CHECKED(Object, receiver, 0);
   CONVERT_ARG_HANDLE_CHECKED(JSObject, home_object, 1);
   CONVERT_ARG_HANDLE_CHECKED(Object, key, 2);
   CONVERT_ARG_HANDLE_CHECKED(Object, value, 3);
 
   return StoreKeyedToSuper(isolate, home_object, receiver, key, value, SLOPPY);
 }
 }
 }  // namespace v8::internal