Reviewers: jarin,
Description:
Fix cluster-fuzz bug introduced in refs/heads/master@{#28796}
Don't DCHECK in the atomic runtime functions.
BUG=chromium:501809,chromium:497295
[email protected]
LOG=n
Please review this at https://codereview.chromium.org/1189223003/
Base URL: https://chromium.googlesource.com/v8/v8.git@master
Affected files (+27, -18 lines):
M src/runtime/runtime-atomics.cc
A test/mjsunit/regress/regress-crbug-501809.js
Index: src/runtime/runtime-atomics.cc
diff --git a/src/runtime/runtime-atomics.cc b/src/runtime/runtime-atomics.cc
index
5a939097d6009b02e9a202d5f74a2079cd9a2837..f5366ac612e5978e0e0c8da86a2a538327f14e1a
100644
--- a/src/runtime/runtime-atomics.cc
+++ b/src/runtime/runtime-atomics.cc
@@ -445,8 +445,8 @@ RUNTIME_FUNCTION(Runtime_AtomicsCompareExchange) {
CONVERT_SIZE_ARG_CHECKED(index, 1);
CONVERT_NUMBER_ARG_HANDLE_CHECKED(oldobj, 2);
CONVERT_NUMBER_ARG_HANDLE_CHECKED(newobj, 3);
- DCHECK(sta->GetBuffer()->is_shared());
- DCHECK(index < NumberToSize(isolate, sta->length()));
+ RUNTIME_ASSERT(sta->GetBuffer()->is_shared());
+ RUNTIME_ASSERT(index < NumberToSize(isolate, sta->length()));
void* buffer = sta->GetBuffer()->backing_store();
@@ -472,8 +472,8 @@ RUNTIME_FUNCTION(Runtime_AtomicsLoad) {
DCHECK(args.length() == 2);
CONVERT_ARG_HANDLE_CHECKED(JSTypedArray, sta, 0);
CONVERT_SIZE_ARG_CHECKED(index, 1);
- DCHECK(sta->GetBuffer()->is_shared());
- DCHECK(index < NumberToSize(isolate, sta->length()));
+ RUNTIME_ASSERT(sta->GetBuffer()->is_shared());
+ RUNTIME_ASSERT(index < NumberToSize(isolate, sta->length()));
void* buffer = sta->GetBuffer()->backing_store();
@@ -500,8 +500,8 @@ RUNTIME_FUNCTION(Runtime_AtomicsStore) {
CONVERT_ARG_HANDLE_CHECKED(JSTypedArray, sta, 0);
CONVERT_SIZE_ARG_CHECKED(index, 1);
CONVERT_NUMBER_ARG_HANDLE_CHECKED(value, 2);
- DCHECK(sta->GetBuffer()->is_shared());
- DCHECK(index < NumberToSize(isolate, sta->length()));
+ RUNTIME_ASSERT(sta->GetBuffer()->is_shared());
+ RUNTIME_ASSERT(index < NumberToSize(isolate, sta->length()));
void* buffer = sta->GetBuffer()->backing_store();
@@ -528,8 +528,8 @@ RUNTIME_FUNCTION(Runtime_AtomicsAdd) {
CONVERT_ARG_HANDLE_CHECKED(JSTypedArray, sta, 0);
CONVERT_SIZE_ARG_CHECKED(index, 1);
CONVERT_NUMBER_ARG_HANDLE_CHECKED(value, 2);
- DCHECK(sta->GetBuffer()->is_shared());
- DCHECK(index < NumberToSize(isolate, sta->length()));
+ RUNTIME_ASSERT(sta->GetBuffer()->is_shared());
+ RUNTIME_ASSERT(index < NumberToSize(isolate, sta->length()));
void* buffer = sta->GetBuffer()->backing_store();
@@ -558,8 +558,8 @@ RUNTIME_FUNCTION(Runtime_AtomicsSub) {
CONVERT_ARG_HANDLE_CHECKED(JSTypedArray, sta, 0);
CONVERT_SIZE_ARG_CHECKED(index, 1);
CONVERT_NUMBER_ARG_HANDLE_CHECKED(value, 2);
- DCHECK(sta->GetBuffer()->is_shared());
- DCHECK(index < NumberToSize(isolate, sta->length()));
+ RUNTIME_ASSERT(sta->GetBuffer()->is_shared());
+ RUNTIME_ASSERT(index < NumberToSize(isolate, sta->length()));
void* buffer = sta->GetBuffer()->backing_store();
@@ -588,8 +588,8 @@ RUNTIME_FUNCTION(Runtime_AtomicsAnd) {
CONVERT_ARG_HANDLE_CHECKED(JSTypedArray, sta, 0);
CONVERT_SIZE_ARG_CHECKED(index, 1);
CONVERT_NUMBER_ARG_HANDLE_CHECKED(value, 2);
- DCHECK(sta->GetBuffer()->is_shared());
- DCHECK(index < NumberToSize(isolate, sta->length()));
+ RUNTIME_ASSERT(sta->GetBuffer()->is_shared());
+ RUNTIME_ASSERT(index < NumberToSize(isolate, sta->length()));
void* buffer = sta->GetBuffer()->backing_store();
@@ -618,8 +618,8 @@ RUNTIME_FUNCTION(Runtime_AtomicsOr) {
CONVERT_ARG_HANDLE_CHECKED(JSTypedArray, sta, 0);
CONVERT_SIZE_ARG_CHECKED(index, 1);
CONVERT_NUMBER_ARG_HANDLE_CHECKED(value, 2);
- DCHECK(sta->GetBuffer()->is_shared());
- DCHECK(index < NumberToSize(isolate, sta->length()));
+ RUNTIME_ASSERT(sta->GetBuffer()->is_shared());
+ RUNTIME_ASSERT(index < NumberToSize(isolate, sta->length()));
void* buffer = sta->GetBuffer()->backing_store();
@@ -648,8 +648,8 @@ RUNTIME_FUNCTION(Runtime_AtomicsXor) {
CONVERT_ARG_HANDLE_CHECKED(JSTypedArray, sta, 0);
CONVERT_SIZE_ARG_CHECKED(index, 1);
CONVERT_NUMBER_ARG_HANDLE_CHECKED(value, 2);
- DCHECK(sta->GetBuffer()->is_shared());
- DCHECK(index < NumberToSize(isolate, sta->length()));
+ RUNTIME_ASSERT(sta->GetBuffer()->is_shared());
+ RUNTIME_ASSERT(index < NumberToSize(isolate, sta->length()));
void* buffer = sta->GetBuffer()->backing_store();
@@ -678,8 +678,8 @@ RUNTIME_FUNCTION(Runtime_AtomicsExchange) {
CONVERT_ARG_HANDLE_CHECKED(JSTypedArray, sta, 0);
CONVERT_SIZE_ARG_CHECKED(index, 1);
CONVERT_NUMBER_ARG_HANDLE_CHECKED(value, 2);
- DCHECK(sta->GetBuffer()->is_shared());
- DCHECK(index < NumberToSize(isolate, sta->length()));
+ RUNTIME_ASSERT(sta->GetBuffer()->is_shared());
+ RUNTIME_ASSERT(index < NumberToSize(isolate, sta->length()));
void* buffer = sta->GetBuffer()->backing_store();
Index: test/mjsunit/regress/regress-crbug-501809.js
diff --git a/test/mjsunit/regress/regress-crbug-501809.js
b/test/mjsunit/regress/regress-crbug-501809.js
new file mode 100644
index
0000000000000000000000000000000000000000..b348e5d5f6f27e3bcf6f31df0735ded1d8de4e5b
--- /dev/null
+++ b/test/mjsunit/regress/regress-crbug-501809.js
@@ -0,0 +1,9 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --harmony-sharedarraybuffer --harmony-atomics
+var sab = new SharedArrayBuffer(8);
+var ta = new Int32Array(sab);
+ta.__defineSetter__('length', function() {;});
+assertThrows(function() { Atomics.compareExchange(ta, 4294967295, 0, 0);
});
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
