Changeset 266257 in webkit for trunk/Source/JavaScriptCore

Timestamp:

Aug 27, 2020, 2:32:55 PM (5 years ago)

Author:

[email protected]

Message:

[JSC] setLength in Array#push could get very large length
​https://bugs.webkit.org/show_bug.cgi?id=215897
<rdar://problem/67859149>

Reviewed by Keith Miller.

JSTests:

• stress/array-push-more-than-max-size.js: Added.

(shouldBe):
(shouldThrow):

Source/JavaScriptCore:

Array#push can get length larger than UINT32_MAX. And in this case, we should throw a RangeError.
Before r266215, it was using putLength which throws an error. But it was replaced with setLength,
and JSC::setLength assumes that it never gets a length greater than UINT32_MAX by asserting. We
should fix it so that Array#push should thrown an error correctly.

• runtime/ArrayPrototype.cpp:

(JSC::setLength):

Location:

trunk/Source/JavaScriptCore

Files:

• ChangeLog (modified) (1 diff)
• runtime/ArrayPrototype.cpp (modified) (1 diff)

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2020-08-27  Yusuke Suzuki  <[email protected]>
+
+        [JSC] setLength in Array#push could get very large length
+        https://bugs.webkit.org/show_bug.cgi?id=215897
+        <rdar://problem/67859149>
+
+        Reviewed by Keith Miller.
+
+        Array#push can get length larger than UINT32_MAX. And in this case, we should throw a RangeError.
+        Before r266215, it was using putLength which throws an error. But it was replaced with setLength,
+        and JSC::setLength assumes that it never gets a length greater than UINT32_MAX by asserting. We
+        should fix it so that Array#push should thrown an error correctly.
+
+        * runtime/ArrayPrototype.cpp:
+        (JSC::setLength):
+
 2020-08-27  Saam Barati  <[email protected]>
 

trunk/Source/JavaScriptCore/runtime/ArrayPrototype.cpp

@@ -163 +163 @@
 static ALWAYS_INLINE void setLength(JSGlobalObject* globalObject, VM& vm, JSObject* obj, uint64_t value)
 {
+    auto scope = DECLARE_THROW_SCOPE(vm);
     static constexpr bool throwException = true;
     if (LIKELY(isJSArray(obj))) {
-        ASSERT(static_cast<uint32_t>(value) == value);
+        if (UNLIKELY(value > UINT32_MAX)) {
+            throwRangeError(globalObject, scope, "Invalid array length"_s);
+            return;
+        }
+        scope.release();
         jsCast<JSArray*>(obj)->setLength(globalObject, static_cast<uint32_t>(value), throwException);
-    } else {
-        PutPropertySlot slot(obj, throwException);
-        obj->methodTable(vm)->put(obj, globalObject, vm.propertyNames->length, jsNumber(value), slot);
-    }
+        return;
+    }
+    scope.release();
+    PutPropertySlot slot(obj, throwException);
+    obj->methodTable(vm)->put(obj, globalObject, vm.propertyNames->length, jsNumber(value), slot);
 }