Changeset 167336 in webkit for trunk/Source/JavaScriptCore/dfg/DFGOperations.cpp

Timestamp:

Apr 15, 2014, 4:33:11 PM (11 years ago)

Author:

[email protected]

Message:

compileMakeRope does not emit necessary bounds checks
​https://bugs.webkit.org/show_bug.cgi?id=130684
<rdar://problem/16398388>

Reviewed by Oliver Hunt.

Add string length bounds checks in a bunch of places. We should never allow a string
to have a length greater than 2<sup>31-1 because it's not clear that the language has
semantics for it and because there is code that assumes that this cannot happen.

Also add a bunch of tests to that effect to cover the various ways in which this was
previously allowed to happen.</sup>

• dfg/DFGOperations.cpp:
• dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::compileMakeRope):

• ftl/FTLLowerDFGToLLVM.cpp:

(JSC::FTL::LowerDFGToLLVM::compileMakeRope):

• runtime/JSString.cpp:

(JSC::JSRopeString::RopeBuilder::expand):

• runtime/JSString.h:

(JSC::JSString::create):
(JSC::JSRopeString::RopeBuilder::append):
(JSC::JSRopeString::RopeBuilder::release):
(JSC::JSRopeString::append):

• runtime/Operations.h:

(JSC::jsString):
(JSC::jsStringFromRegisterArray):
(JSC::jsStringFromArguments):

• runtime/StringPrototype.cpp:

(JSC::stringProtoFuncIndexOf):
(JSC::stringProtoFuncSlice):
(JSC::stringProtoFuncSubstring):
(JSC::stringProtoFuncToLowerCase):

• tests/stress/make-large-string-jit-strcat.js: Added.

(foo):

• tests/stress/make-large-string-jit.js: Added.

(foo):

• tests/stress/make-large-string-strcat.js: Added.
• tests/stress/make-large-string.js: Added.

File:

• trunk/Source/JavaScriptCore/dfg/DFGOperations.cpp (modified) (2 diffs)

trunk/Source/JavaScriptCore/dfg/DFGOperations.cpp

@@ -969 +969 @@
     VM& vm = exec->vm();
     NativeCallFrameTracer tracer(&vm, exec);
+    
+    if (static_cast<int32_t>(left->length() + right->length()) < 0) {
+        throwOutOfMemoryError(exec);
+        return 0;
+    }
 
     return JSRopeString::create(vm, left, right);
@@ -977 +982 @@
     VM& vm = exec->vm();
     NativeCallFrameTracer tracer(&vm, exec);
+
+    Checked<int32_t, RecordOverflow> length = a->length();
+    length += b->length();
+    length += c->length();
+    if (length.hasOverflowed()) {
+        throwOutOfMemoryError(exec);
+        return 0;
+    }
 
     return JSRopeString::create(vm, a, b, c);