Revision: 25132
Author: [email protected]
Date: Wed Nov 5 09:02:10 2014 UTC
Log: Version 3.28.71.18 (merged r24849)
Fixed mutable heap numbers leak in JSON parser.
BUG=chromium:423687
LOG=N
[email protected]
Review URL: https://codereview.chromium.org/698153004
https://code.google.com/p/v8/source/detail?r=25132
Added:
/branches/3.28/test/mjsunit/regress/regress-crbug-423687.js
Modified:
/branches/3.28/src/json-parser.h
/branches/3.28/src/version.cc
=======================================
--- /dev/null
+++ /branches/3.28/test/mjsunit/regress/regress-crbug-423687.js Wed Nov 5
09:02:10 2014 UTC
@@ -0,0 +1,10 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var json = '{"a":{"c":2.1,"d":0},"b":{"c":7,"1024":8}}';
+var data = JSON.parse(json);
+
+data.b.c++;
=======================================
--- /branches/3.28/src/json-parser.h Wed Sep 24 07:33:46 2014 UTC
+++ /branches/3.28/src/json-parser.h Wed Nov 5 09:02:10 2014 UTC
@@ -181,6 +181,9 @@
private:
Zone* zone() { return &zone_; }
+
+ void CommitStateToJsonObject(Handle<JSObject> json_object, Handle<Map>
map,
+ ZoneList<Handle<Object> >* properties);
Handle<String> source_;
int source_length_;
@@ -408,13 +411,7 @@
}
// Commit the intermediate state to the object and stop
transitioning.
- JSObject::AllocateStorageForMap(json_object, map);
- int length = properties.length();
- for (int i = 0; i < length; i++) {
- Handle<Object> value = properties[i];
- FieldIndex index = FieldIndex::ForPropertyIndex(*map, i);
- json_object->FastPropertyAtPut(index, *value);
- }
+ CommitStateToJsonObject(json_object, map, &properties);
} else {
key = ParseJsonInternalizedString();
if (key.is_null() || c0_ != ':') return
ReportUnexpectedCharacter();
@@ -432,18 +429,49 @@
// If we transitioned until the very end, transition the map now.
if (transitioning) {
- JSObject::AllocateStorageForMap(json_object, map);
- int length = properties.length();
- for (int i = 0; i < length; i++) {
- Handle<Object> value = properties[i];
- FieldIndex index = FieldIndex::ForPropertyIndex(*map, i);
- json_object->FastPropertyAtPut(index, *value);
- }
+ CommitStateToJsonObject(json_object, map, &properties);
}
}
AdvanceSkipWhitespace();
return scope.CloseAndEscape(json_object);
}
+
+
+template <bool seq_one_byte>
+void JsonParser<seq_one_byte>::CommitStateToJsonObject(
+ Handle<JSObject> json_object, Handle<Map> map,
+ ZoneList<Handle<Object> >* properties) {
+ JSObject::AllocateStorageForMap(json_object, map);
+ DCHECK(!json_object->map()->is_dictionary_map());
+
+ DisallowHeapAllocation no_gc;
+ Factory* factory = isolate()->factory();
+ // If the |json_object|'s map is exactly the same as |map| then the
+ // |properties| values correspond to the |map| and nothing more has to be
+ // done. But if the |json_object|'s map is different then we have to
+ // iterate descriptors to ensure that properties still correspond to the
+ // map.
+ bool slow_case = json_object->map() != *map;
+ DescriptorArray* descriptors = NULL;
+
+ int length = properties->length();
+ if (slow_case) {
+ descriptors = json_object->map()->instance_descriptors();
+ DCHECK(json_object->map()->NumberOfOwnDescriptors() == length);
+ }
+ for (int i = 0; i < length; i++) {
+ Handle<Object> value = (*properties)[i];
+ if (slow_case && value->IsMutableHeapNumber() &&
+ !descriptors->GetDetails(i).representation().IsDouble()) {
+ // Turn mutable heap numbers into immutable if the field
representation
+ // is not double.
+ HeapNumber::cast(*value)->set_map(*factory->heap_number_map());
+ }
+ FieldIndex index = FieldIndex::ForPropertyIndex(*map, i);
+ json_object->FastPropertyAtPut(index, *value);
+ }
+}
+
// Parse a JSON array. Position must be right at '['.
template <bool seq_ascii>
=======================================
--- /branches/3.28/src/version.cc Mon Oct 20 20:15:35 2014 UTC
+++ /branches/3.28/src/version.cc Wed Nov 5 09:02:10 2014 UTC
@@ -35,7 +35,7 @@
#define MAJOR_VERSION 3
#define MINOR_VERSION 28
#define BUILD_NUMBER 71
-#define PATCH_LEVEL 17
+#define PATCH_LEVEL 18
// Use 1 for candidates and 0 otherwise.
// (Boolean macro values are not supported by all preprocessors.)
#define IS_CANDIDATE_VERSION 0
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
