Snap for 5637977 from d38b089ebf465f0e6ab713c43988ff8ae7abd0e5 to qt-aml-releaseandroid-mainline-10.0.0_r3android-mainline-10.0.0_r2android-mainline-10.0.0_r1android10-mainline-releaseandroid10-mainline-a-release

Change-Id: I124ee0ffbb076adc221239b1dd5e1ea9463e7f93

4 files changed, 64 insertions, 3 deletions

diff --git a/src/proxy_resolver_v8.cc b/src/proxy_resolver_v8.cc
index 227fea3..289102e 100644
--- a/src/proxy_resolver_v8.cc
+++ b/src/proxy_resolver_v8.cc
@@ -760,9 +760,11 @@ int ProxyResolverV8::SetPacScript(const std::u16string& script_data) {
   if (script_data.length() == 0)
     return ERR_PAC_SCRIPT_FAILED;
 
-  // To help debugging v8 initialization issues, uncomment the following lines
-  // static const char kOptions[] = "--log_all --print_all_exceptions";
-  // v8::V8::SetFlagsFromString(kOptions, strlen(kOptions));
+  // To help debugging v8 initialization issues, add "--log_all --print_all_exceptions"
+  // to the options
+  // Disable JIT
+  static const char kNoOpt[] = "--no-opt";
+  v8::V8::SetFlagsFromString(kNoOpt, strlen(kNoOpt));
 
   // Try parsing the PAC script.
   ArrayBufferAllocator allocator;
diff --git a/test/js-unittest/b_132073833.js b/test/js-unittest/b_132073833.js
new file mode 100644
index 0000000..79d1967
--- /dev/null
+++ b/test/js-unittest/b_132073833.js
@@ -0,0 +1,21 @@
+function FindProxyForURL(url, host){
+    function opt() {
+        opt['x'] = 1.1;
+        try {
+            Object.create(object);
+        } catch (e) {
+        }
+
+        for (let i = 0; i < 100000; i++) {
+
+        }
+    }
+
+    opt();
+    object = opt;
+    opt();
+
+    return "DIRECT";
+}
+
+var object;
\ No newline at end of file
diff --git a/test/proxy_resolver_v8_unittest.cc b/test/proxy_resolver_v8_unittest.cc
index b549cda..66b2a23 100644
--- a/test/proxy_resolver_v8_unittest.cc
+++ b/test/proxy_resolver_v8_unittest.cc
@@ -629,5 +629,19 @@ TEST(ProxyResolverV8Test, GetterChangesElementKind) {
   EXPECT_EQ("DIRECT", proxies[0]);
 }
 
+TEST(ProxyResolverV8Test, B_132073833) {
+  ProxyResolverV8WithMockBindings resolver(new MockJSBindings());
+  int result = resolver.SetPacScript(SCRIPT(B_132073833_JS));
+  EXPECT_EQ(OK, result);
+
+  // Execute FindProxyForURL().
+  result = resolver.GetProxyForURL(kQueryUrl, kQueryHost, &kResults);
+
+  EXPECT_EQ(OK, result);
+  std::vector<std::string> proxies = string16ToProxyList(kResults);
+  EXPECT_EQ(1U, proxies.size());
+  EXPECT_EQ("DIRECT", proxies[0]);
+}
+
 }  // namespace
 }  // namespace net
diff --git a/test/proxy_test_script.h b/test/proxy_test_script.h
index 092e262..0d1b77e 100644
--- a/test/proxy_test_script.h
+++ b/test/proxy_test_script.h
@@ -4,6 +4,30 @@
 #ifndef PROXY_TEST_SCRIPT_H_
 #define PROXY_TEST_SCRIPT_H_
 
+#define B_132073833_JS \
+  u""\
+  "function FindProxyForURL(url, host){\n" \
+  "    function opt() {\n" \
+  "        opt['x'] = 1.1;\n" \
+  "        try {\n" \
+  "            Object.create(object);\n" \
+  "        } catch (e) {\n" \
+  "        }\n" \
+  "\n" \
+  "        for (let i = 0; i < 100000; i++) {\n" \
+  "\n" \
+  "        }\n" \
+  "    }\n" \
+  "\n" \
+  "    opt();\n" \
+  "    object = opt;\n" \
+  "    opt();\n" \
+  "\n" \
+  "    return \"DIRECT\";\n" \
+  "}\n" \
+  "\n" \
+  "var object;\n" \
+
 #define BINDING_FROM_GLOBAL_JS \
   u""\
   "// Calls a bindings outside of FindProxyForURL(). This causes the code to\n" \