Check for proper types from error handling code

A bug in error printing meant that we failed to do proper type checks
before calling into C++ code, which could lead to RUNTIME_ASSERT
failures if methods are called on alternative receivers. This patch
adds the right type checks.

BUG=chromium:596718
LOG=Y
R=adamk

Review URL: https://codereview.chromium.org/1831053003

Cr-Commit-Position: refs/heads/master@{#35069}

src/js/messages.js

@@ -570,69 +570,90 @@ function CallSite(receiver, fun, pos, strict_mode) {
   SET_PRIVATE(this, callSiteStrictSymbol, TO_BOOLEAN(strict_mode));
 }
 
+function CheckCallSite(obj, name) {
+  if (!IS_RECEIVER(obj) || !HAS_PRIVATE(obj, callSiteFunctionSymbol)) {
+    throw MakeTypeError(kCallSiteMethod, name);
+  }
+}
+
 function CallSiteGetThis() {
+  CheckCallSite(this, "getThis");
   return GET_PRIVATE(this, callSiteStrictSymbol)
       ? UNDEFINED : GET_PRIVATE(this, callSiteReceiverSymbol);
 }
 
 function CallSiteGetFunction() {
+  CheckCallSite(this, "getFunction");
   return GET_PRIVATE(this, callSiteStrictSymbol)
       ? UNDEFINED : GET_PRIVATE(this, callSiteFunctionSymbol);
 }
 
 function CallSiteGetPosition() {
+  CheckCallSite(this, "getPosition");
   return GET_PRIVATE(this, callSitePositionSymbol);
 }
 
 function CallSiteGetTypeName() {
+  CheckCallSite(this, "getTypeName");
   return GetTypeName(GET_PRIVATE(this, callSiteReceiverSymbol), false);
 }
 
 function CallSiteIsToplevel() {
+  CheckCallSite(this, "isTopLevel");
   return %CallSiteIsToplevelRT(this);
 }
 
 function CallSiteIsEval() {
+  CheckCallSite(this, "isEval");
   return %CallSiteIsEvalRT(this);
 }
 
 function CallSiteGetEvalOrigin() {
+  CheckCallSite(this, "getEvalOrigin");
   var script = %FunctionGetScript(GET_PRIVATE(this, callSiteFunctionSymbol));
   return FormatEvalOrigin(script);
 }
 
 function CallSiteGetScriptNameOrSourceURL() {
+  CheckCallSite(this, "getScriptNameOrSourceURL");
   return %CallSiteGetScriptNameOrSourceUrlRT(this);
 }
 
 function CallSiteGetFunctionName() {
   // See if the function knows its own name
+  CheckCallSite(this, "getFunctionName");
   return %CallSiteGetFunctionNameRT(this);
 }
 
 function CallSiteGetMethodName() {
   // See if we can find a unique property on the receiver that holds
   // this function.
+  CheckCallSite(this, "getMethodName");
   return %CallSiteGetMethodNameRT(this);
 }
 
 function CallSiteGetFileName() {
+  CheckCallSite(this, "getFileName");
   return %CallSiteGetFileNameRT(this);
 }
 
 function CallSiteGetLineNumber() {
+  CheckCallSite(this, "getLineNumber");
   return %CallSiteGetLineNumberRT(this);
 }
 
 function CallSiteGetColumnNumber() {
+  CheckCallSite(this, "getColumnNumber");
   return %CallSiteGetColumnNumberRT(this);
 }
 
 function CallSiteIsNative() {
+  CheckCallSite(this, "isNative");
   return %CallSiteIsNativeRT(this);
 }
 
 function CallSiteIsConstructor() {
+  CheckCallSite(this, "isConstructor");
   return %CallSiteIsConstructorRT(this);
 }
 

src/messages.h

@@ -100,6 +100,7 @@ class CallSite {
   T(CalledOnNullOrUndefined, "% called on null or undefined")                  \
   T(CallSiteExpectsFunction,                                                   \
     "CallSite expects function as second argument, got %")                     \
+  T(CallSiteMethod, "CallSite method % expects CallSite as receiver")          \
   T(CannotConvertToPrimitive, "Cannot convert object to primitive value")      \
   T(CannotPreventExt, "Cannot prevent extensions")                             \
   T(CannotFreezeArrayBufferView,                                               \

test/cctest/interpreter/bytecode_expectations/ForOf.golden

@@ -119,7 +119,7 @@ bytecodes: [
   B(TestEqualStrict), R(12),
   B(JumpIfFalse), U8(4),
   B(Jump), U8(18),
-  B(Wide), B(LdaSmi), U16(138),
+  B(Wide), B(LdaSmi), U16(139),
   B(Star), R(12),
   B(LdaConstant), U8(8),
   B(Star), R(13),
@@ -302,7 +302,7 @@ bytecodes: [
   B(TestEqualStrict), R(13),
   B(JumpIfFalse), U8(4),
   B(Jump), U8(18),
-  B(Wide), B(LdaSmi), U16(138),
+  B(Wide), B(LdaSmi), U16(139),
   B(Star), R(13),
   B(LdaConstant), U8(8),
   B(Star), R(14),
@@ -499,7 +499,7 @@ bytecodes: [
   B(TestEqualStrict), R(12),
   B(JumpIfFalse), U8(4),
   B(Jump), U8(18),
-  B(Wide), B(LdaSmi), U16(138),
+  B(Wide), B(LdaSmi), U16(139),
   B(Star), R(12),
   B(LdaConstant), U8(8),
   B(Star), R(13),
@@ -686,7 +686,7 @@ bytecodes: [
   B(TestEqualStrict), R(11),
   B(JumpIfFalse), U8(4),
   B(Jump), U8(18),
-  B(Wide), B(LdaSmi), U16(138),
+  B(Wide), B(LdaSmi), U16(139),
   B(Star), R(11),
   B(LdaConstant), U8(10),
   B(Star), R(12),

test/mjsunit/regress/regress-596718.js

+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+Error.prepareStackTrace = function(e, frames) { return frames; }
+assertThrows(() => new Error().stack[0].getMethodName.call({}), TypeError);
+
+Error.prepareStackTrace = function(e, frames) { return frames.map(frame => new Proxy(frame, {})); }
+assertThrows(() => new Error().stack[0].getMethodName(), TypeError);
+
+Error.prepareStackTrace = function(e, frames) { return frames; }
+assertEquals(null, new Error().stack[0].getMethodName());