Skip to content

Commit 9aeffab

Browse files
ofrobotsrvagg
authored andcommitted
deps: V8: cherry-pick 8361fa58 from upstream
Original commit message: [runtime] Fix derived class instantiation Bug: chromium:806388 Change-Id: Ieb343f0d532c16b6102e85222b77713f23bacf8c Reviewed-on: https://chromium-review.googlesource.com/894942 Reviewed-by: Igor Sheludko <[email protected]> Commit-Queue: Camillo Bruni <[email protected]> Cr-Commit-Position: refs/heads/master@{#50990} PR-URL: #21294 Reviewed-By: Myles Borins <[email protected]>
1 parent b1110b2 commit 9aeffab

File tree

4 files changed

+42
-9
lines changed

4 files changed

+42
-9
lines changed

deps/v8/include/v8-version.h

+1-1
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@
1111
#define V8_MAJOR_VERSION 6
1212
#define V8_MINOR_VERSION 2
1313
#define V8_BUILD_NUMBER 414
14-
#define V8_PATCH_LEVEL 58
14+
#define V8_PATCH_LEVEL 59
1515

1616
// Use 1 for candidates and 0 otherwise.
1717
// (Boolean macro values are not supported by all preprocessors.)

deps/v8/src/objects.cc

+20-7
Original file line numberDiff line numberDiff line change
@@ -13056,14 +13056,19 @@ MaybeHandle<Map> JSFunction::GetDerivedMap(Isolate* isolate,
1305613056
constructor_initial_map->unused_property_fields();
1305713057
int instance_size;
1305813058
int in_object_properties;
13059-
CalculateInstanceSizeForDerivedClass(function, instance_type,
13060-
embedder_fields, &instance_size,
13061-
&in_object_properties);
13059+
bool success = CalculateInstanceSizeForDerivedClass(
13060+
function, instance_type, embedder_fields, &instance_size,
13061+
&in_object_properties);
1306213062

1306313063
int unused_property_fields = in_object_properties - pre_allocated;
13064-
Handle<Map> map =
13065-
Map::CopyInitialMap(constructor_initial_map, instance_size,
13066-
in_object_properties, unused_property_fields);
13064+
13065+
Handle<Map> map;
13066+
if (success) {
13067+
map = Map::CopyInitialMap(constructor_initial_map, instance_size,
13068+
in_object_properties, unused_property_fields);
13069+
} else {
13070+
map = Map::CopyInitialMap(constructor_initial_map);
13071+
}
1306713072
map->set_new_target_is_base(false);
1306813073

1306913074
JSFunction::SetInitialMap(function, map, prototype);
@@ -13789,12 +13794,14 @@ void JSFunction::CalculateInstanceSizeHelper(InstanceType instance_type,
1378913794
requested_embedder_fields;
1379013795
}
1379113796

13792-
void JSFunction::CalculateInstanceSizeForDerivedClass(
13797+
// static
13798+
bool JSFunction::CalculateInstanceSizeForDerivedClass(
1379313799
Handle<JSFunction> function, InstanceType instance_type,
1379413800
int requested_embedder_fields, int* instance_size,
1379513801
int* in_object_properties) {
1379613802
Isolate* isolate = function->GetIsolate();
1379713803
int expected_nof_properties = 0;
13804+
bool result = true;
1379813805
for (PrototypeIterator iter(isolate, function, kStartAtReceiver);
1379913806
!iter.IsAtEnd(); iter.Advance()) {
1380013807
Handle<JSReceiver> current =
@@ -13808,6 +13815,11 @@ void JSFunction::CalculateInstanceSizeForDerivedClass(
1380813815
Compiler::Compile(func, Compiler::CLEAR_EXCEPTION)) {
1380913816
DCHECK(shared->is_compiled());
1381013817
expected_nof_properties += shared->expected_nof_properties();
13818+
} else if (!shared->is_compiled()) {
13819+
// In case there was a compilation error for the constructor we will
13820+
// throw an error during instantiation. Hence we directly return 0;
13821+
result = false;
13822+
break;
1381113823
}
1381213824
if (!IsDerivedConstructor(shared->kind())) {
1381313825
break;
@@ -13816,6 +13828,7 @@ void JSFunction::CalculateInstanceSizeForDerivedClass(
1381613828
CalculateInstanceSizeHelper(instance_type, requested_embedder_fields,
1381713829
expected_nof_properties, instance_size,
1381813830
in_object_properties);
13831+
return result;
1381913832
}
1382013833

1382113834

deps/v8/src/objects.h

+1-1
Original file line numberDiff line numberDiff line change
@@ -5003,7 +5003,7 @@ class JSFunction: public JSObject {
50035003
DECL_CAST(JSFunction)
50045004

50055005
// Calculate the instance size and in-object properties count.
5006-
static void CalculateInstanceSizeForDerivedClass(
5006+
static bool CalculateInstanceSizeForDerivedClass(
50075007
Handle<JSFunction> function, InstanceType instance_type,
50085008
int requested_embedder_fields, int* instance_size,
50095009
int* in_object_properties);
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
// Copyright 2018 the V8 project authors. All rights reserved.
2+
// Use of this source code is governed by a BSD-style license that can be
3+
// found in the LICENSE file.
4+
5+
// Flags: --allow-natives-syntax --enable-slow-asserts --expose-gc
6+
7+
class Derived extends Array {
8+
constructor(a) {
9+
// Syntax Error.
10+
const a = 1;
11+
}
12+
}
13+
14+
// Derived is not a subclass of RegExp
15+
let o = Reflect.construct(RegExp, [], Derived);
16+
o.lastIndex = 0x1234;
17+
%HeapObjectVerify(o);
18+
19+
gc();
20+
%HeapObjectVerify(o);

0 commit comments

Comments
 (0)