Classes: Fix issue with default constructor crash

src/runtime/runtime-classes.cc

Index: src/runtime/runtime-classes.cc
diff --git a/src/runtime/runtime-classes.cc b/src/runtime/runtime-classes.cc
index cc4e09b52f699a997809220bccf2393ea3a33d47..2f1963924ef1a30069bf8b228d1627a2801cb0ab 100644
--- a/src/runtime/runtime-classes.cc
+++ b/src/runtime/runtime-classes.cc
@@ -101,26 +101,25 @@ RUNTIME_FUNCTION(Runtime_DefineClass) {
   map->set_prototype(*prototype_parent);
   Handle<JSObject> prototype = isolate->factory()->NewJSObjectFromMap(map);
 
-  Handle<String> name_string = name->IsString()
-                                   ? Handle<String>::cast(name)
-                                   : isolate->factory()->empty_string();
-
   Handle<JSFunction> ctor;
   if (constructor->IsSpecFunction()) {
     ctor = Handle<JSFunction>::cast(constructor);
-    JSFunction::SetPrototype(ctor, prototype);
-    PropertyAttributes attribs =
-        static_cast<PropertyAttributes>(DONT_ENUM | DONT_DELETE | READ_ONLY);
-    RETURN_FAILURE_ON_EXCEPTION(
-        isolate,
-        JSObject::SetOwnPropertyIgnoreAttributes(
-            ctor, isolate->factory()->prototype_string(), prototype, attribs));
   } else {
-    // TODO(arv): This should not use an empty function but a function that
-    // calls super.
-    Handle<Code> code(isolate->builtins()->builtin(Builtins::kEmptyFunction));
-    ctor = isolate->factory()->NewFunction(name_string, code, prototype, true);
+    Handle<JSFunction> default_constructor =
+        super_class->IsTheHole() ? isolate->default_constructor_no_super()
+                                 : isolate->default_constructor();
+    Handle<SharedFunctionInfo> shared(default_constructor->shared());
+    Handle<Context> context(default_constructor->context());

[Dmitry Lomov (no reviews), 2014/11/04 20:52:38]

This is wrong - you create a constructor in builtins context here! (since that
is default_constructor's context)
You will have to pass a correct context to this function (see generated calls to
Runtime_NewClosure).

+    ctor =
+        isolate->factory()->NewFunctionFromSharedFunctionInfo(shared, context);
   }
+  JSFunction::SetPrototype(ctor, prototype);
+  PropertyAttributes attribs =
+      static_cast<PropertyAttributes>(DONT_ENUM | DONT_DELETE | READ_ONLY);
+  RETURN_FAILURE_ON_EXCEPTION(
+      isolate,
+      JSObject::SetOwnPropertyIgnoreAttributes(
+          ctor, isolate->factory()->prototype_string(), prototype, attribs));
 
   Handle<Symbol> home_object_symbol(isolate->heap()->home_object_symbol());
   RETURN_FAILURE_ON_EXCEPTION(
@@ -132,6 +131,14 @@ RUNTIME_FUNCTION(Runtime_DefineClass) {
         isolate, JSObject::SetPrototype(ctor, constructor_parent, false));
   }
 
+  Handle<String> name_string = name->IsString()
+                                   ? Handle<String>::cast(name)
+                                   : isolate->factory()->empty_string();
+  RETURN_FAILURE_ON_EXCEPTION(
+      isolate,
+      JSObject::SetOwnPropertyIgnoreAttributes(
+          ctor, isolate->factory()->name_string(), name_string, attribs));
+
   JSObject::AddProperty(prototype, isolate->factory()->constructor_string(),
                         ctor, DONT_ENUM);