Fix snapshot bug. (#267)

3 files changed, 17 insertions, 1 deletions

diff --git a/deno2/deno.cc b/deno2/deno.cc
index d21e0bcea..ec3665c93 100644
--- a/deno2/deno.cc
+++ b/deno2/deno.cc
@@ -250,8 +250,10 @@ v8::StartupData MakeSnapshot(v8::StartupData* prev_natives_blob,
                                             SerializeInternalFields, nullptr));
   }
 
+  // Note that using kKeep here will cause segfaults. This is demoed in the
+  // "SnapshotBug" test case.
   auto snapshot_blob =
-      creator->CreateBlob(v8::SnapshotCreator::FunctionCodeHandling::kKeep);
+      creator->CreateBlob(v8::SnapshotCreator::FunctionCodeHandling::kClear);
 
   return snapshot_blob;
 }
diff --git a/deno2/js/mock_runtime.js b/deno2/js/mock_runtime.js
index f16161cf7..f845dae20 100644
--- a/deno2/js/mock_runtime.js
+++ b/deno2/js/mock_runtime.js
@@ -67,3 +67,11 @@ function DoubleSubFails() {
   deno.sub((channel, msg) => assert(false));
   deno.sub((channel, msg) => assert(false));
 }
+
+
+// The following join has caused SnapshotBug to segfault when using kKeep.
+[].join("");
+
+function SnapshotBug() {
+  assert("1,2,3" === String([1, 2, 3]));
+}
diff --git a/deno2/mock_runtime_test.cc b/deno2/mock_runtime_test.cc
index 908e2a7e6..4abf61d4d 100644
--- a/deno2/mock_runtime_test.cc
+++ b/deno2/mock_runtime_test.cc
@@ -90,6 +90,12 @@ TEST(MockRuntimeTest, TypedArraySnapshots) {
   deno_delete(d);
 }
 
+TEST(MockRuntimeTest, SnapshotBug) {
+  Deno* d = deno_new(nullptr, nullptr);
+  EXPECT_TRUE(deno_execute(d, "a.js", "SnapshotBug()"));
+  deno_delete(d);
+}
+
 int main(int argc, char** argv) {
   testing::InitGoogleTest(&argc, argv);
   deno_init();