Reviewers: ulan,
Message:
PTAL.
Description:
Catch stack overflow in JSON.parse.
BUG=
Please review this at http://codereview.chromium.org/11275039/
SVN Base: https://v8.googlecode.com/svn/branches/bleeding_edge
Affected files:
M src/json-parser.h
M test/mjsunit/json-recursive.js
Index: src/json-parser.h
diff --git a/src/json-parser.h b/src/json-parser.h
index
9aa42013f9650fc070515f8c1d311c0976e4ea02..d481ed02b6744a827a98185106d560170e36ea12
100644
--- a/src/json-parser.h
+++ b/src/json-parser.h
@@ -195,8 +195,10 @@ Handle<Object>
JsonParser<seq_ascii>::ParseJson(Handle<String> source,
AdvanceSkipWhitespace();
Handle<Object> result = ParseJsonValue();
if (result.is_null() || c0_ != kEndOfString) {
- // Parse failed. Current character is the unexpected token.
+ // Some exception (for example stack overflow) is already pending.
+ if (isolate_->has_pending_exception()) return Handle<Object>::null();
+ // Parse failed. Current character is the unexpected token.
const char* message;
Factory* factory = this->factory();
Handle<JSArray> array;
@@ -247,6 +249,12 @@ Handle<Object>
JsonParser<seq_ascii>::ParseJson(Handle<String> source,
// Parse any JSON value.
template <bool seq_ascii>
Handle<Object> JsonParser<seq_ascii>::ParseJsonValue() {
+ StackLimitCheck stack_check(isolate_);
+ if (stack_check.HasOverflowed()) {
+ isolate_->StackOverflow();
+ return Handle<Object>::null();
+ }
+
if (c0_ == '"') return ParseJsonString();
if ((c0_ >= '0' && c0_ <= '9') || c0_ == '-') return ParseJsonNumber();
if (c0_ == '{') return ParseJsonObject();
Index: test/mjsunit/json-recursive.js
diff --git a/test/mjsunit/json-recursive.js b/test/mjsunit/json-recursive.js
index
adfd93bbcd6f693f8ffad2d758eed5009899b591..0ecca2b5d5bcdd255f6a11141ca479bccc4c87d8
100644
--- a/test/mjsunit/json-recursive.js
+++ b/test/mjsunit/json-recursive.js
@@ -56,3 +56,11 @@ for (var i = 0; i < depth1; i++) deepObject = { next:
deepObject };
JSON.stringify(deepObject);
for (var i = depth1; i < depth2; i++) deepObject = { next: deepObject };
assertThrows(function() { JSON.stringify(deepObject); }, RangeError);
+
+
+var str = "[1]";
+for (var i = 0; i < 100000; i++) {
+ str = "[1," + str + "]";
+}
+
+assertThrows(function() { JSON.parse(str); }, RangeError);
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
