Changeset 62432 in webkit for trunk/JavaScriptCore/interpreter

Timestamp:

Jul 2, 2010, 9:52:45 PM (15 years ago)

Author:

[email protected]

Message:

Clamp the number of arguments supported by function.apply
​https://bugs.webkit.org/show_bug.cgi?id=41351
<rdar://problem/8142141>

Reviewed by Gavin Barraclough.

JavaScriptCore:

Add clamping logic to function.apply similar to that
enforced by firefox. We have a smaller clamp than
firefox as our calling convention means that stack
usage is proportional to argument count -- the firefox
limit is larger than you could actually call.

• interpreter/Interpreter.cpp:

(JSC::Interpreter::privateExecute):

• jit/JITStubs.cpp:

(JSC::DEFINE_STUB_FUNCTION):

• runtime/Arguments.h:

(JSC::Arguments::):

LayoutTests:

Testcases.

• fast/js/function-apply-many-args-expected.txt: Added.
• fast/js/function-apply-many-args.html: Added.
• fast/js/script-tests/function-apply-many-args.js: Added.

File:

• trunk/JavaScriptCore/interpreter/Interpreter.cpp (modified) (4 diffs)

trunk/JavaScriptCore/interpreter/Interpreter.cpp

@@ -3697 +3697 @@
         if (!arguments) {
             argCount = (uint32_t)(callFrame->argumentCount());
+            argCount = min(argCount, static_cast<int32_t>(Arguments::MaxArguments));
             int32_t sizeDelta = argsOffset + argCount + RegisterFile::CallFrameHeaderSize;
             Register* newEnd = callFrame->registers() + sizeDelta;
@@ -3723 +3724 @@
                 Arguments* args = asArguments(arguments);
                 argCount = args->numProvidedArguments(callFrame);
+                argCount = min(argCount, static_cast<int32_t>(Arguments::MaxArguments));
                 int32_t sizeDelta = argsOffset + argCount + RegisterFile::CallFrameHeaderSize;
                 Register* newEnd = callFrame->registers() + sizeDelta;
@@ -3733 +3735 @@
                 JSArray* array = asArray(arguments);
                 argCount = array->length();
+                argCount = min(argCount, static_cast<int32_t>(Arguments::MaxArguments));
                 int32_t sizeDelta = argsOffset + argCount + RegisterFile::CallFrameHeaderSize;
                 Register* newEnd = callFrame->registers() + sizeDelta;
@@ -3743 +3746 @@
                 JSObject* argObject = asObject(arguments);
                 argCount = argObject->get(callFrame, callFrame->propertyNames().length).toUInt32(callFrame);
+                argCount = min(argCount, static_cast<int32_t>(Arguments::MaxArguments));
                 int32_t sizeDelta = argsOffset + argCount + RegisterFile::CallFrameHeaderSize;
                 Register* newEnd = callFrame->registers() + sizeDelta;