From da463ab4841004e0934245ca50fda74c4fbf75a4 Mon Sep 17 00:00:00 2001 From: "antonm@chromium.org" Date: Thu, 24 Feb 2011 17:42:56 +0000 Subject: [PATCH] Get property may throw an exception thanks to JS accessors. Check result before and bail out if exception has been thrown. BUG=v8:1172 TEST=test/mjsunit/regress/regress-1172-bis.js Review URL: http://codereview.chromium.org/6580030 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6939 ce2b1a6d-e550-0410-aec6-3dcde31c8c00 --- src/ic.cc | 1 + test/mjsunit/regress/regress-1172-bis.js | 37 ++++++++++++++++++++++++++++++++ 2 files changed, 38 insertions(+) create mode 100644 test/mjsunit/regress/regress-1172-bis.js diff --git a/src/ic.cc b/src/ic.cc index 7482830..4f75ade 100644 --- a/src/ic.cc +++ b/src/ic.cc @@ -804,6 +804,7 @@ MaybeObject* KeyedCallIC::LoadFunction(State state, HandleScope scope; Handle result = GetProperty(object, key); + RETURN_IF_EMPTY_HANDLE(result); // Make receiver an object if the callee requires it. Strict mode or builtin // functions do not wrap the receiver, non-strict functions and objects diff --git a/test/mjsunit/regress/regress-1172-bis.js b/test/mjsunit/regress/regress-1172-bis.js new file mode 100644 index 0000000..e8d5c81 --- /dev/null +++ b/test/mjsunit/regress/regress-1172-bis.js @@ -0,0 +1,37 @@ +// Copyright 2011 the V8 project authors. All rights reserved. +// Redistribution and use in source and binary forms, with or without +// modification, are permitted provided that the following conditions are +// met: +// +// * Redistributions of source code must retain the above copyright +// notice, this list of conditions and the following disclaimer. +// * Redistributions in binary form must reproduce the above +// copyright notice, this list of conditions and the following +// disclaimer in the documentation and/or other materials provided +// with the distribution. +// * Neither the name of Google Inc. nor the names of its +// contributors may be used to endorse or promote products derived +// from this software without specific prior written permission. +// +// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS +// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT +// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR +// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT +// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, +// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT +// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, +// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY +// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT +// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE +// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + +// Verifies that exception thrown from JS accessors when attempting a call +// are properly treated. + +Object.prototype.__defineGetter__(0, function() { throw 42; }); +try { + Object[0](); + assertUnreachable(); +} catch(e) { + assertEquals(42, e); +} -- 2.7.4