Commit 5bc286e5 authored by mvstanton's avatar mvstanton Committed by Commit bot

Bugfix - a DCHECK could allocate, invalidating a raw pointer.

HasOrigin() can allocate. Make sure to wrap vulnerable raw pointers
in handles.

BUG=

Review-Url: https://codereview.chromium.org/2788663002
Cr-Commit-Position: refs/heads/master@{#44271}
parent 95120a7e
...@@ -170,11 +170,19 @@ InfoVectorPair CompilationCacheScript::Lookup( ...@@ -170,11 +170,19 @@ InfoVectorPair CompilationCacheScript::Lookup(
// to see if we actually found a cached script. If so, we return a // to see if we actually found a cached script. If so, we return a
// handle created in the caller's handle scope. // handle created in the caller's handle scope.
if (result.has_shared()) { if (result.has_shared()) {
#ifdef DEBUG
// Since HasOrigin can allocate, we need to protect the SharedFunctionInfo
// and the FeedbackVector with handles during the call.
Handle<SharedFunctionInfo> shared(result.shared(), isolate()); Handle<SharedFunctionInfo> shared(result.shared(), isolate());
// TODO(mvstanton): Make sure HasOrigin can't allocate, or it will Handle<Cell> vector_handle;
// mess up our InfoVectorPair. if (result.has_vector()) {
vector_handle = Handle<Cell>(result.vector(), isolate());
}
DCHECK( DCHECK(
HasOrigin(shared, name, line_offset, column_offset, resource_options)); HasOrigin(shared, name, line_offset, column_offset, resource_options));
result =
InfoVectorPair(*shared, result.has_vector() ? *vector_handle : nullptr);
#endif
isolate()->counters()->compilation_cache_hits()->Increment(); isolate()->counters()->compilation_cache_hits()->Increment();
} else { } else {
isolate()->counters()->compilation_cache_misses()->Increment(); isolate()->counters()->compilation_cache_misses()->Increment();
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment