Changeset 214071 in webkit for trunk/Source/JavaScriptCore/ftl/FTLOperations.cpp

Timestamp:

Mar 16, 2017, 2:53:33 PM (8 years ago)

Author:

[email protected]

Message:

The new array with spread operation needs to check for length overflows.
​https://bugs.webkit.org/show_bug.cgi?id=169780
<rdar://problem/31072182>

Reviewed by Filip Pizlo.

• dfg/DFGOperations.cpp:
• dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::compileNewArrayWithSpread):

• ftl/FTLLowerDFGToB3.cpp:

(JSC::FTL::DFG::LowerDFGToB3::compileNewArrayWithSpread):

• ftl/FTLOperations.cpp:

(JSC::FTL::operationMaterializeObjectInOSR):

• llint/LLIntSlowPaths.cpp:
• runtime/CommonSlowPaths.cpp:

(JSC::SLOW_PATH_DECL):

• runtime/JSGlobalObject.cpp:

File:

• trunk/Source/JavaScriptCore/ftl/FTLOperations.cpp (modified) (3 diffs)

trunk/Source/JavaScriptCore/ftl/FTLOperations.cpp

@@ -1 +1 @@
 /*
- * Copyright (C) 2014, 2015 Apple Inc. All rights reserved.
+ * Copyright (C) 2014-2017 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -439 +439 @@
         Structure* structure = globalObject->arrayStructureForIndexingTypeDuringAllocation(ArrayWithContiguous);
 
-        unsigned arraySize = 0;
+        Checked<unsigned, RecordOverflow> checkedArraySize = 0;
         unsigned numProperties = 0;
         for (unsigned i = materialization->properties().size(); i--;) {
@@ -447 +447 @@
                 JSValue value = JSValue::decode(values[i]);
                 if (JSFixedArray* fixedArray = jsDynamicCast<JSFixedArray*>(vm, value))
-                    arraySize += fixedArray->size();
+                    checkedArraySize += fixedArray->size();
                 else
-                    arraySize += 1;
-            }
-        }
-
+                    checkedArraySize += 1;
+            }
+        }
+
+        unsigned arraySize = checkedArraySize.unsafeGet(); // Crashes if overflowed.
         JSArray* result = JSArray::tryCreateForInitializationPrivate(vm, structure, arraySize);
         RELEASE_ASSERT(result);