Fix some corner cases in skipping native methods using caller.

src/accessors.cc

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 733 matching lines @@
   // Find previously called non-toplevel function.
   JSFunction* caller;
   do {
     caller = it.next();
     if (caller == NULL) return isolate->heap()->null_value();
   } while (caller->shared()->is_toplevel());
 
   // If caller is a built-in function and caller's caller is also built-in,
   // use that instead.
   JSFunction* potential_caller = caller;
   while (potential_caller != NULL && potential_caller->IsBuiltin()) {

[Yang, 2012/09/04 12:43:57]

This suggest that potential_caller can become NULL, in which case setting caller
to potential_caller would cause NULL dereference later.

[Erik Corry, 2012/09/05 07:22:33]

I think it can't happen, but I will check for NULL before setting caller to
potential_caller.

     caller = potential_caller;
     potential_caller = it.next();
   }
+  if (!caller->shared()->native()) {
+    caller = potential_caller;
+  }
   // If caller is bound, return null. This is compatible with JSC, and
   // allows us to make bound functions use the strict function map
   // and its associated throwing caller and arguments.
   if (caller->shared()->bound()) {
     return isolate->heap()->null_value();
   }
   return CheckNonStrictCallerOrThrow(isolate, caller);
 }
 
 
@@ skipping 93 matching lines @@
   info->set_data(Smi::FromInt(index));
   Handle<Object> getter = v8::FromCData(&ModuleGetExport);
   Handle<Object> setter = v8::FromCData(&ModuleSetExport);
   info->set_getter(*getter);
   if (!(attributes & ReadOnly)) info->set_setter(*setter);
   return info;
 }
 
 
 } }  // namespace v8::internal