Reviewers: Vyacheslav Egorov,
Message:
please review.
Description:
Fix out-of-bounds access in fetching propery names
[email protected]
BUG=chromium:91517
TEST=none
Please review this at http://codereview.chromium.org/7565009/
SVN Base: https://v8.googlecode.com/svn/branches/bleeding_edge
Affected files:
M src/objects.h
M src/objects.cc
M src/runtime.cc
Index: src/objects.cc
diff --git a/src/objects.cc b/src/objects.cc
index
efeed9df8f72e35faee62a26660a2661b5963b4b..a3495900437a4ce04de0992c90945dd02fa34ec4
100644
--- a/src/objects.cc
+++ b/src/objects.cc
@@ -9537,7 +9537,9 @@ void JSObject::GetLocalPropertyNames(FixedArray*
storage, int index) {
}
ASSERT(storage->length() >= index);
} else {
- property_dictionary()->CopyKeysTo(storage, StringDictionary::UNSORTED);
+ property_dictionary()->CopyKeysTo(storage,
+ index,
+ StringDictionary::UNSORTED);
}
}
@@ -10286,6 +10288,7 @@ template MaybeObject*
Dictionary<NumberDictionaryShape, uint32_t>::Shrink(
template void Dictionary<StringDictionaryShape, String*>::CopyKeysTo(
FixedArray*,
+ int,
Dictionary<StringDictionaryShape, String*>::SortMode);
template int
@@ -11415,11 +11418,11 @@ void StringDictionary::CopyEnumKeysTo(FixedArray*
storage,
template<typename Shape, typename Key>
void Dictionary<Shape, Key>::CopyKeysTo(
FixedArray* storage,
+ int index,
typename Dictionary<Shape, Key>::SortMode sort_mode) {
ASSERT(storage->length() >= NumberOfElementsFilterAttributes(
static_cast<PropertyAttributes>(NONE)));
int capacity = HashTable<Shape, Key>::Capacity();
- int index = 0;
for (int i = 0; i < capacity; i++) {
Object* k = HashTable<Shape, Key>::KeyAt(i);
if (HashTable<Shape, Key>::IsKey(k)) {
Index: src/objects.h
diff --git a/src/objects.h b/src/objects.h
index
e23b43b45fa52be6ada8a2b3df3b6db4e85322a9..79ce093245145580d12fca4be5a0179f71cf7293
100644
--- a/src/objects.h
+++ b/src/objects.h
@@ -2810,7 +2810,7 @@ class Dictionary: public HashTable<Shape, Key> {
PropertyAttributes filter,
SortMode sort_mode);
// Fill in details for properties into storage.
- void CopyKeysTo(FixedArray* storage, SortMode sort_mode);
+ void CopyKeysTo(FixedArray* storage, int index, SortMode sort_mode);
// Accessors for next enumeration index.
void SetNextEnumerationIndex(int index) {
Index: src/runtime.cc
diff --git a/src/runtime.cc b/src/runtime.cc
index
e63b9f7613d1a020c41156ad21bbccd4eb21ea49..51091bb4ada9f4f8ddedfe599ee4efa96a6ed7dd
100644
--- a/src/runtime.cc
+++ b/src/runtime.cc
@@ -4583,9 +4583,10 @@ RUNTIME_FUNCTION(MaybeObject*,
Runtime_GetLocalPropertyNames) {
// Get the property names.
jsproto = obj;
int proto_with_hidden_properties = 0;
+ int next_copy_index = 0;
for (int i = 0; i < length; i++) {
- jsproto->GetLocalPropertyNames(*names,
- i == 0 ? 0 : local_property_count[i -
1]);
+ jsproto->GetLocalPropertyNames(*names, next_copy_index);
+ next_copy_index += local_property_count[i];
if (jsproto->HasHiddenProperties()) {
proto_with_hidden_properties++;
}
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
