Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(429)

Unified Diff: src/hydrogen.cc

Issue 893993007: Protect against uninitialized lexical variables at top-level. (Closed) Base URL: https://chromium.googlesource.com/v8/v8.git@master
Patch Set: Created 5 years, 10 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View side-by-side diff with in-line comments
Download patch
« no previous file with comments | « no previous file | src/ic/ic.cc » ('j') | no next file with comments »
Expand Comments ('e') | Collapse Comments ('c') | Show Comments Hide Comments ('s')
Index: src/hydrogen.cc
diff --git a/src/hydrogen.cc b/src/hydrogen.cc
index e40316f74ab5c12c42fa61e9e161682b20392162..47cddd0a10dce599dd3f353e7d19fbfa99abca92 100644
--- a/src/hydrogen.cc
+++ b/src/hydrogen.cc
@@ -5382,6 +5382,14 @@ void HOptimizedGraphBuilder::VisitVariableProxy(VariableProxy* expr) {
&lookup)) {
Handle<Context> script_context = ScriptContextTable::GetContext(
script_contexts, lookup.context_index);
+ Handle<Object> current_value =
+ FixedArray::get(script_context, lookup.context_index);
+
+ // If the values is not the hole, it will stay initialized,
+ // so no need to generate a check.
+ if (*current_value == *isolate()->factory()->the_hole_value()) {
+ return Bailout(kReferenceToUninitializedVariable);
+ }
HInstruction* result = New<HLoadNamedField>(
Add<HConstant>(script_context), nullptr,
HObjectAccess::ForContextSlot(lookup.slot_index));
« no previous file with comments | « no previous file | src/ic/ic.cc » ('j') | no next file with comments »

Powered by Google App Engine
This is Rietveld 408576698