Skip to content

Commit

Permalink
deps: patch V8 to 7.7.299.8
Browse files Browse the repository at this point in the history
PR-URL: #29336
Refs: v8/v8@7.7.299.4...7.7.299.8
Reviewed-By: Colin Ihrig <[email protected]>
Reviewed-By: Anna Henningsen <[email protected]>
Reviewed-By: Jiawen Geng <[email protected]>
Reviewed-By: Ben Noordhuis <[email protected]>
Reviewed-By: Ujjwal Sharma <[email protected]>
Reviewed-By: Michael Dawson <[email protected]>
  • Loading branch information
targos committed Sep 19, 2019
1 parent 90713c6 commit 7957b39
Show file tree
Hide file tree
Showing 4 changed files with 66 additions and 2 deletions.
2 changes: 1 addition & 1 deletion deps/v8/include/v8-version.h
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,7 @@
#define V8_MAJOR_VERSION 7
#define V8_MINOR_VERSION 7
#define V8_BUILD_NUMBER 299
#define V8_PATCH_LEVEL 4
#define V8_PATCH_LEVEL 8

// Use 1 for candidates and 0 otherwise.
// (Boolean macro values are not supported by all preprocessors.)
Expand Down
16 changes: 16 additions & 0 deletions deps/v8/src/builtins/builtins-console.cc
Original file line number Diff line number Diff line change
Expand Up @@ -47,6 +47,22 @@ void ConsoleCall(
CHECK(!isolate->has_scheduled_exception());
if (!isolate->console_delegate()) return;
HandleScope scope(isolate);

// Access check. The current context has to match the context of all
// arguments, otherwise the inspector might leak objects across contexts.
Handle<Context> context = handle(isolate->context(), isolate);
for (int i = 0; i < args.length(); ++i) {
Handle<Object> argument = args.at<Object>(i);
if (!argument->IsJSObject()) continue;

Handle<JSObject> argument_obj = Handle<JSObject>::cast(argument);
if (argument->IsAccessCheckNeeded(isolate) &&
!isolate->MayAccess(context, argument_obj)) {
isolate->ReportFailedAccessCheck(argument_obj);
return;
}
}

debug::ConsoleCallArguments wrapper(args);
Handle<Object> context_id_obj = JSObject::GetDataProperty(
args.target(), isolate->factory()->console_context_id_symbol());
Expand Down
2 changes: 1 addition & 1 deletion deps/v8/src/flags/flag-definitions.h
Original file line number Diff line number Diff line change
Expand Up @@ -361,7 +361,7 @@ DEFINE_BOOL(enable_one_shot_optimization, true,
"only be executed once")

// Flag for sealed, frozen elements kind instead of dictionary elements kind
DEFINE_BOOL_READONLY(enable_sealed_frozen_elements_kind, true,
DEFINE_BOOL_READONLY(enable_sealed_frozen_elements_kind, false,
"Enable sealed, frozen elements kind")

// Flags for data representation optimizations
Expand Down
48 changes: 48 additions & 0 deletions deps/v8/test/unittests/api/access-check-unittest.cc
Original file line number Diff line number Diff line change
Expand Up @@ -71,4 +71,52 @@ TEST_F(AccessCheckTest, GetOwnPropertyDescriptor) {
" .set.call(other, 42);");
}

namespace {
bool failed_access_check_callback_called;

v8::Local<v8::String> v8_str(const char* x) {
return v8::String::NewFromUtf8(v8::Isolate::GetCurrent(), x,
v8::NewStringType::kNormal)
.ToLocalChecked();
}

class AccessCheckTestConsoleDelegate : public debug::ConsoleDelegate {
public:
void Log(const debug::ConsoleCallArguments& args,
const debug::ConsoleContext& context) {
FAIL();
}
};

} // namespace

// Ensure that {console.log} does an access check for its arguments.
TEST_F(AccessCheckTest, ConsoleLog) {
isolate()->SetFailedAccessCheckCallbackFunction(
[](v8::Local<v8::Object> host, v8::AccessType type,
v8::Local<v8::Value> data) {
failed_access_check_callback_called = true;
});
AccessCheckTestConsoleDelegate console{};
debug::SetConsoleDelegate(isolate(), &console);

Local<ObjectTemplate> object_template = ObjectTemplate::New(isolate());
object_template->SetAccessCheckCallback(AccessCheck);

Local<Context> context1 = Context::New(isolate(), nullptr);
Local<Context> context2 = Context::New(isolate(), nullptr);

Local<Object> object1 =
object_template->NewInstance(context1).ToLocalChecked();
EXPECT_TRUE(context2->Global()
->Set(context2, v8_str("object_from_context1"), object1)
.IsJust());

Context::Scope context_scope(context2);
failed_access_check_callback_called = false;
CompileRun(isolate(), "console.log(object_from_context1);").ToLocalChecked();

ASSERT_TRUE(failed_access_check_callback_called);
}

} // namespace v8

0 comments on commit 7957b39

Please sign in to comment.