Reviewers: Michael Starzinger,

Description:
[d8 Workers] Add max worker count, throw an exception if too many.

BUG=chromium:518748
[email protected]
LOG=n

Please review this at https://codereview.chromium.org/1284683004/

Base URL: https://chromium.googlesource.com/v8/v8.git@master

Affected files (+12, -3 lines):
  M src/d8.cc
  A + test/mjsunit/regress/regress-crbug-518748.js


Index: src/d8.cc
diff --git a/src/d8.cc b/src/d8.cc
index d55faabe8bcc414624f485a9af2c432516185dd6..259afb48bb76a5f1b18c49ef29858c773f67608f 100644
--- a/src/d8.cc
+++ b/src/d8.cc
@@ -75,6 +75,7 @@ namespace v8 {
 namespace {

 const int MB = 1024 * 1024;
+const int kMaxWorkers = 100;


 class ShellArrayBufferAllocator : public v8::ArrayBuffer::Allocator {
@@ -706,6 +707,11 @@ void Shell::WorkerNew(const v8::FunctionCallbackInfo<v8::Value>& args) {

   {
     base::LockGuard<base::Mutex> lock_guard(workers_mutex_.Pointer());
+    if (workers_.length() >= kMaxWorkers) {
+ Throw(args.GetIsolate(), "Too many workers, I won't let you create more");
+      return;
+    }
+
     // Initialize the internal field to NULL; if we return early without
// creating a new Worker (because the main thread is terminating) we can
     // early-out from the instance calls.
Index: test/mjsunit/regress/regress-crbug-518748.js
diff --git a/test/mjsunit/regress/regress-crbug-503698.js b/test/mjsunit/regress/regress-crbug-518748.js
similarity index 56%
copy from test/mjsunit/regress/regress-crbug-503698.js
copy to test/mjsunit/regress/regress-crbug-518748.js
index 415d1bc81be5ac46fb358ce8ec681b1e5c276e07..bbbf4d60197821e4b95a47f886b2e3861ccf4484 100644
--- a/test/mjsunit/regress/regress-crbug-503698.js
+++ b/test/mjsunit/regress/regress-crbug-518748.js
@@ -2,8 +2,11 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.

-// Flags: --invoke-weak-callbacks
-
 if (this.Worker) {
-  var __v_6 = new Worker('');
+  function f(a) {
+    assertThrows(function() {
+ for (var i = 0; new Worker('onmessage = function() {};'); i++) a[i] = i;
+    });
+  }
+  f([]);
 }


--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
--- You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to [email protected].
For more options, visit https://groups.google.com/d/optout.

Reply via email to