Fix bug in function context slot lookup. There were two problems: we

read at the wrong index in the scope information and we forgot to add
Context::MIN_CONTEXT_SLOTS to the index.

This fixes issue 24.
Review URL: http://codereview.chromium.org/1938

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@279 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

diff --git a/src/log.cc b/src/log.cc
index a9600d65482846b4f4bb097b7f6666bb98359a81..92d18d0b8091e4bd3396d37cf358d31954d41e99 100644 (file)
--- a/src/log.cc
+++ b/src/log.cc
@@ -434,7 +434,7 @@ void Logger::RegExpExecEvent(Handle<JSValue> regexp,
 
   fprintf(logfile_, "regexp-run,");
   LogRegExpSource(regexp);
-  fprintf(logfile_, ",0x%08x,%d..%d\n", 
+  fprintf(logfile_, ",0x%08x,%d..%d\n",
       input_string->Hash(), start_index, input_string->length());
 #endif
 }

diff --git a/src/log.h b/src/log.h
index e481447b45a171544a041367d68ca412a796c108..1e67fe9485fe456f21835b8cf1cc6f274710ce45 100644 (file)
--- a/src/log.h
+++ b/src/log.h
@@ -54,7 +54,7 @@ namespace v8 { namespace internal {
 // is off.  --log-gc implies --log.
 //
 // --log-regexp
-// Log creation and use of regular expressions, Default is off.  
+// Log creation and use of regular expressions, Default is off.
 // --log-regexp implies --log.
 //
 // --logfile <filename>

diff --git a/src/scopeinfo.cc b/src/scopeinfo.cc
index b51cb986fa8a820e0da972fae0bddd51c2b2531d..64706b5eb079c94a7d4e626a308e400299dc053d 100644 (file)
--- a/src/scopeinfo.cc
+++ b/src/scopeinfo.cc
@@ -484,10 +484,13 @@ int ScopeInfo<Allocator>::FunctionContextSlotIndex(Code* code, String* name) {
   ASSERT(name->IsSymbol());
   if (code->sinfo_size() > 0) {
     Object** p = &Memory::Object_at(code->sinfo_start());
-    if (*p++ == name) {
-      int n;
-      ReadInt(p, &n);  // n = number of context slots
-      return n -1;  // the function context slot is the last entry
+    if (*p == name) {
+      p = ContextEntriesAddr(code);
+      int n;  // number of context slots
+      ReadInt(p, &n);
+      ASSERT(n != 0);
+      // The function context slot is the last entry.
+      return n + Context::MIN_CONTEXT_SLOTS - 1;
     }
   }
   return -1;

diff --git a/test/mjsunit/with-function-expression.js b/test/mjsunit/with-function-expression.js
new file mode 100644 (file)
index 0000000..17de817
--- /dev/null
+++ b/test/mjsunit/with-function-expression.js
@@ -0,0 +1,36 @@
+// Copyright 2008 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+var source = "(function x() { with({}) { return '' + x; } })()";
+
+// Don't throw exceptions.
+assertDoesNotThrow(source);
+
+// Check that the return value is a function.  Use regexp to avoid
+// depending on the exact printing of the function.
+var regexp = /function/;
+var res = assertTrue(eval(source).match(regexp) == 'function');