Reviewers: arv,
Description:
Add bounds-checking in runtime implementations of %FixedArray{Get,Set}
The runtime versions of these intrinsics are used by full-codegen;
hopefully this doesn't noticeably degrade performance (in optimized
code, there's no bounds-checking).
BUG=chromium:504786
LOG=n
Please review this at https://codereview.chromium.org/1218503002/
Base URL: https://chromium.googlesource.com/v8/v8.git@master
Affected files (+16, -4 lines):
M src/runtime/runtime-array.cc
A test/mjsunit/regress/regress-504786.js
Index: src/runtime/runtime-array.cc
diff --git a/src/runtime/runtime-array.cc b/src/runtime/runtime-array.cc
index
1617245daf3206fce4638c57e388f88c226f7f8a..a7542ecb2ed9f7391c15c5daee16b3b44687e655
100644
--- a/src/runtime/runtime-array.cc
+++ b/src/runtime/runtime-array.cc
@@ -58,19 +58,21 @@ RUNTIME_FUNCTION(Runtime_SpecialArrayFunctions) {
RUNTIME_FUNCTION(Runtime_FixedArrayGet) {
SealHandleScope shs(isolate);
DCHECK(args.length() == 2);
- CONVERT_ARG_CHECKED(FixedArray, object, 0);
+ CONVERT_ARG_CHECKED(FixedArray, array, 0);
CONVERT_SMI_ARG_CHECKED(index, 1);
- return object->get(index);
+ RUNTIME_ASSERT(index < array->length());
+ return array->get(index);
}
RUNTIME_FUNCTION(Runtime_FixedArraySet) {
SealHandleScope shs(isolate);
DCHECK(args.length() == 3);
- CONVERT_ARG_CHECKED(FixedArray, object, 0);
+ CONVERT_ARG_CHECKED(FixedArray, array, 0);
CONVERT_SMI_ARG_CHECKED(index, 1);
CONVERT_ARG_CHECKED(Object, value, 2);
- object->set(index, value);
+ RUNTIME_ASSERT(index < array->length());
+ array->set(index, value);
return isolate->heap()->undefined_value();
}
Index: test/mjsunit/regress/regress-504786.js
diff --git a/test/mjsunit/regress/regress-504786.js
b/test/mjsunit/regress/regress-504786.js
new file mode 100644
index
0000000000000000000000000000000000000000..f794645c2b0cc950f464eb480b5117f1622b3393
--- /dev/null
+++ b/test/mjsunit/regress/regress-504786.js
@@ -0,0 +1,10 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var a = %GetTypeFeedbackVector(function(){});
+// The runtime versions of these intrinsics include bounds-checking.
+assertThrows(function() { %FixedArrayGet(a, 0xffff) });
+assertThrows(function() { %FixedArraySet(a, 53894378, 0) });
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
