diff options
author | android-build-team Robot <android-build-team-robot@google.com> | 2019-06-11 21:07:17 +0000 |
---|---|---|
committer | android-build-team Robot <android-build-team-robot@google.com> | 2019-06-11 21:07:17 +0000 |
commit | 93b800c4a212c5d3f9c23a11831c6bc3e70ae3ea (patch) | |
tree | 5d13e7fa4a9f0026540613b74318c9597a440aeb | |
parent | d735970ceec445c8b4cc6e4041a621774c738b63 (diff) | |
parent | b06753df9207e6751a6e8208f539be520a2cf248 (diff) | |
download | chromium-libpac-pie-qpr3-release.tar.gz |
Merge cherrypicks of [7982564, 7982192, 7982565, 7981411, 7982522, 7982682, 7982193, 7982194, 7982523, 7982480, 7982623, 7981412, 7981413, 7982605, 7982606, 7982607, 7982608, 7981749, 7981750, 7981751, 7981752, 7981753, 7981754, 7982624, 7982394, 7982395, 7982625, 7982687, 7982566, 7982567, 7982568, 7982688, 7982689, 7982690, 7982195, 7982196, 7982611, 7982612, 7982396, 7982694, 7982695, 7982215] into pi-qpr3-releaseandroid-9.0.0_r46pie-qpr3-release
Change-Id: I293f0b9a4567cdfe808ebf09de15f779114e3439
-rw-r--r-- | src/proxy_resolver_v8.cc | 4 | ||||
-rw-r--r-- | test/js-unittest/b_132073833.js | 21 | ||||
-rw-r--r-- | test/proxy_resolver_v8_unittest.cc | 14 | ||||
-rw-r--r-- | test/proxy_test_script.h | 27 |
4 files changed, 64 insertions, 2 deletions
diff --git a/src/proxy_resolver_v8.cc b/src/proxy_resolver_v8.cc index f978694..0504b03 100644 --- a/src/proxy_resolver_v8.cc +++ b/src/proxy_resolver_v8.cc @@ -762,6 +762,10 @@ int ProxyResolverV8::SetPacScript(const android::String16& script_data) { if (script_data.size() == 0) return ERR_PAC_SCRIPT_FAILED; + // Disable JIT + static const char kNoOpt[] = "--no-opt"; + v8::V8::SetFlagsFromString(kNoOpt, strlen(kNoOpt)); + // Try parsing the PAC script. ArrayBufferAllocator allocator; v8::Isolate::CreateParams create_params; diff --git a/test/js-unittest/b_132073833.js b/test/js-unittest/b_132073833.js new file mode 100644 index 0000000..79d1967 --- /dev/null +++ b/test/js-unittest/b_132073833.js @@ -0,0 +1,21 @@ +function FindProxyForURL(url, host){ + function opt() { + opt['x'] = 1.1; + try { + Object.create(object); + } catch (e) { + } + + for (let i = 0; i < 100000; i++) { + + } + } + + opt(); + object = opt; + opt(); + + return "DIRECT"; +} + +var object;
\ No newline at end of file diff --git a/test/proxy_resolver_v8_unittest.cc b/test/proxy_resolver_v8_unittest.cc index be7ecee..73e4405 100644 --- a/test/proxy_resolver_v8_unittest.cc +++ b/test/proxy_resolver_v8_unittest.cc @@ -558,5 +558,19 @@ TEST(ProxyResolverV8Test, GetterChangesElementKind) { EXPECT_EQ("DIRECT", proxies[0]); } +TEST(ProxyResolverV8Test, B_132073833) { + ProxyResolverV8WithMockBindings resolver(new MockJSBindings()); + int result = resolver.SetPacScript(String16(B_132073833_JS)); + EXPECT_EQ(OK, result); + + // Execute FindProxyForURL(). + result = resolver.GetProxyForURL(kQueryUrl, kQueryHost, &kResults); + + EXPECT_EQ(OK, result); + std::vector<std::string> proxies = string16ToProxyList(kResults); + EXPECT_EQ(1U, proxies.size()); + EXPECT_EQ("DIRECT", proxies[0]); +} + } // namespace } // namespace net diff --git a/test/proxy_test_script.h b/test/proxy_test_script.h index 80c96c7..aa10016 100644 --- a/test/proxy_test_script.h +++ b/test/proxy_test_script.h @@ -4,6 +4,29 @@ #ifndef PROXY_TEST_SCRIPT_H_ #define PROXY_TEST_SCRIPT_H_ +#define B_132073833_JS \ + "function FindProxyForURL(url, host){\n" \ + " function opt() {\n" \ + " opt['x'] = 1.1;\n" \ + " try {\n" \ + " Object.create(object);\n" \ + " } catch (e) {\n" \ + " }\n" \ + "\n" \ + " for (let i = 0; i < 100000; i++) {\n" \ + "\n" \ + " }\n" \ + " }\n" \ + "\n" \ + " opt();\n" \ + " object = opt;\n" \ + " opt();\n" \ + "\n" \ + " return \"DIRECT\";\n" \ + "}\n" \ + "\n" \ + "var object;\n" \ + #define BINDING_FROM_GLOBAL_JS \ "// Calls a bindings outside of FindProxyForURL(). This causes the code to\n" \ "// get exercised during initialization.\n" \ @@ -80,7 +103,7 @@ #define CHANGE_ELEMENT_KIND_JS \ "// PAC script with getter that changes element kind.\n" \ - " \n" \ + "\n" \ "function FindProxyForURL(url, host) {\n" \ " let arr = [];\n" \ " arr[1000] = 0x1234;\n" \ @@ -91,7 +114,7 @@ " });\n" \ "\n" \ " let results = Object.entries(arr);\n" \ - " let str = results.toString(); \n" \ + " let str = results.toString();\n" \ " return \"DIRECT\";\n" \ "}\n" \ |