Changeset 224055 in webkit for trunk/Source/JavaScriptCore/runtime/JSString.h

Timestamp:

Oct 26, 2017, 3:36:04 PM (8 years ago)

Author:

[email protected]

Message:

JSRopeString::RopeBuilder::append() should check for overflows.
​https://bugs.webkit.org/show_bug.cgi?id=178385
<rdar://problem/35027468>

Reviewed by Saam Barati.

JSTests:

• stress/regress-178385.js: Added.

Source/JavaScriptCore:

1. Made RopeString check for overflow like the Checked class does.
2. Added a missing overflow check in objectProtoFuncToString().

• runtime/JSString.cpp:

(JSC::JSRopeString::RopeBuilder<RecordOverflow>::expand):
(JSC::JSRopeString::RopeBuilder::expand): Deleted.

• runtime/JSString.h:
• runtime/ObjectPrototype.cpp:

(JSC::objectProtoFuncToString):

• runtime/Operations.h:

(JSC::jsStringFromRegisterArray):
(JSC::jsStringFromArguments):

Source/WTF:

• wtf/CheckedArithmetic.h:

File:

• trunk/Source/JavaScriptCore/runtime/JSString.h (modified) (4 diffs)

trunk/Source/JavaScriptCore/runtime/JSString.h

@@ -31 +31 @@
 #include "ThrowScope.h"
 #include <array>
+#include <wtf/CheckedArithmetic.h>
 #include <wtf/text/StringView.h>
 
@@ -243 +244 @@
 
 public:
-    class RopeBuilder {
+    template <class OverflowHandler = CrashOnOverflow>
+    class RopeBuilder : public OverflowHandler {
     public:
         RopeBuilder(VM& vm)
@@ -254 +256 @@
         bool append(JSString* jsString)
         {
+            if (UNLIKELY(this->hasOverflowed()))
+                return false;
             if (m_index == JSRopeString::s_maxInternalRopeLength)
                 expand();
             if (static_cast<int32_t>(m_jsString->length() + jsString->length()) < 0) {
-                m_jsString = nullptr;
+                this->overflowed();
                 return false;
             }
@@ -266 +270 @@
         JSRopeString* release()
         {
-            RELEASE_ASSERT(m_jsString);
+            RELEASE_ASSERT(!this->hasOverflowed());
             JSRopeString* tmp = m_jsString;
-            m_jsString = 0;
+            m_jsString = nullptr;
             return tmp;
         }
 
-        unsigned length() const { return m_jsString->length(); }
+        unsigned length() const
+        {
+            ASSERT(!this->hasOverflowed());
+            return m_jsString->length();
+        }
 
     private: