Fix receiver for calls to strict-mode and builtin functions that are

potentially shadowed by eval.

R=sgjesse@chromium.org
TEST=mjsunit/regress/regress-124.js

Review URL: http://codereview.chromium.org/7096004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8116 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

diff --git a/src/arm/full-codegen-arm.cc b/src/arm/full-codegen-arm.cc
index 98e2268..298935a 100644 (file)
--- a/src/arm/full-codegen-arm.cc
+++ b/src/arm/full-codegen-arm.cc
@@ -2300,9 +2300,9 @@ void FullCodeGenerator::VisitCall(Call* expr) {
       __ bind(&done);
       // Push function.
       __ push(r0);
-      // Push global receiver.
-      __ ldr(r1, GlobalObjectOperand());
-      __ ldr(r1, FieldMemOperand(r1, GlobalObject::kGlobalReceiverOffset));
+      // The receiver is implicitly the global receiver. Indicate this
+      // by passing the hole to the call function stub.
+      __ LoadRoot(r1, Heap::kTheHoleValueRootIndex);
       __ push(r1);
       __ bind(&call);
     }

diff --git a/src/ia32/full-codegen-ia32.cc b/src/ia32/full-codegen-ia32.cc
index 2e0b722..9abb428 100644 (file)
--- a/src/ia32/full-codegen-ia32.cc
+++ b/src/ia32/full-codegen-ia32.cc
@@ -2230,9 +2230,9 @@ void FullCodeGenerator::VisitCall(Call* expr) {
       __ bind(&done);
       // Push function.
       __ push(eax);
-      // Push global receiver.
-      __ mov(ebx, GlobalObjectOperand());
-      __ push(FieldOperand(ebx, GlobalObject::kGlobalReceiverOffset));
+      // The receiver is implicitly the global receiver. Indicate this
+      // by passing the hole to the call function stub.
+      __ push(Immediate(isolate()->factory()->the_hole_value()));
       __ bind(&call);
     }
 

diff --git a/src/x64/full-codegen-x64.cc b/src/x64/full-codegen-x64.cc
index e1bb4c0..2fb85a5 100644 (file)
--- a/src/x64/full-codegen-x64.cc
+++ b/src/x64/full-codegen-x64.cc
@@ -2206,9 +2206,9 @@ void FullCodeGenerator::VisitCall(Call* expr) {
       __ bind(&done);
       // Push function.
       __ push(rax);
-      // Push global receiver.
-      __ movq(rbx, GlobalObjectOperand());
-      __ push(FieldOperand(rbx, GlobalObject::kGlobalReceiverOffset));
+      // The receiver is implicitly the global receiver. Indicate this
+      // by passing the hole to the call function stub.
+      __ PushRoot(Heap::kTheHoleValueRootIndex);
       __ bind(&call);
     }
 

diff --git a/test/mjsunit/regress/regress-124.js b/test/mjsunit/regress/regress-124.js
index e0df6f5..1197467 100644 (file)
--- a/test/mjsunit/regress/regress-124.js
+++ b/test/mjsunit/regress/regress-124.js
@@ -37,13 +37,13 @@ assertEquals("[object Undefined]", eval("var f; toString()"));
 
 function F(f) {
   assertEquals("[object global]", this.toString());
-  assertEquals("[object global]", toString());
+  assertEquals("[object Undefined]", toString());
 
   assertEquals("[object global]", eval("this.toString()"));
-  assertEquals("[object global]", eval("toString()"));
+  assertEquals("[object Undefined]", eval("toString()"));
 
   assertEquals("[object global]", eval("var f; this.toString()"));
-  assertEquals("[object global]", eval("var f; toString()"));
+  assertEquals("[object Undefined]", eval("var f; toString()"));
 
   assertEquals("[object Undefined]", eval("f()"));
 

diff --git a/test/mjsunit/regress/regress-1365.js b/test/mjsunit/regress/regress-1365.js
index f19bdd0..59290f9 100644 (file)
--- a/test/mjsunit/regress/regress-1365.js
+++ b/test/mjsunit/regress/regress-1365.js
@@ -53,13 +53,30 @@ assertThrows(callGlobalHasOwnProperty);
 function CheckExceptionCallLocal() {
   var valueOf = Object.prototype.valueOf;
   var hasOwnProperty = Object.prototype.hasOwnProperty;
-  try { valueOf(); assertUnreachable(); } catch(e) { }
-  try { hasOwnProperty(); assertUnreachable(); } catch(e) { }
+  var exception = false;
+  try { valueOf(); } catch(e) { exception = true; }
+  assertTrue(exception);
+  exception = false;
+  try { hasOwnProperty(); } catch(e) { exception = true; }
+  assertTrue(exception);
 }
 CheckExceptionCallLocal();
 
 function CheckExceptionCallParameter(f) {
-  try { f(); assertUnreachable(); } catch(e) { }
+  var exception = false;
+  try { f(); } catch(e) { exception = true; }
+  assertTrue(exception);
 }
 CheckExceptionCallParameter(Object.prototype.valueOf);
 CheckExceptionCallParameter(Object.prototype.hasOwnProperty);
+
+function CheckPotentiallyShadowedByEval() {
+  var exception = false;
+  try {
+    eval("hasOwnProperty('x')");
+  } catch(e) {
+    exception = true;
+  }
+  assertTrue(exception);
+}
+CheckPotentiallyShadowedByEval();