Reviewers: Jakob,
Description:
Merged r17711 into 3.21 branch.
Fix overflow in TypedArray initialization function
BUG=chromium:319120
[email protected]
Please review this at https://codereview.chromium.org/68213014/
SVN Base: https://v8.googlecode.com/svn/branches/3.21
Affected files (+4, -5 lines):
M src/runtime.cc
M src/version.cc
A + test/mjsunit/regress/regress-319120.js
Index: src/runtime.cc
diff --git a/src/runtime.cc b/src/runtime.cc
index
c09fb1d49904585d0eb6f673d350de65c8c38abb..b8d9737cd17bbb6c0ba8de676f9566bdd920eda3
100644
--- a/src/runtime.cc
+++ b/src/runtime.cc
@@ -947,12 +947,12 @@ RUNTIME_FUNCTION(MaybeObject*,
Runtime_TypedArrayInitializeFromArrayLike) {
Handle<JSArrayBuffer> buffer = isolate->factory()->NewJSArrayBuffer();
size_t length = NumberToSize(isolate, *length_obj);
- size_t byte_length = length * element_size;
- if (byte_length < length) { // Overflow
+ if (length > (kMaxInt / element_size)) {
return isolate->Throw(*isolate->factory()->
NewRangeError("invalid_array_buffer_length",
HandleVector<Object>(NULL, 0)));
}
+ size_t byte_length = length * element_size;
// We assume that the caller of this function will initialize holder
// with the loop
Index: src/version.cc
diff --git a/src/version.cc b/src/version.cc
index
d0f1640b47a0ac0cce302f16fe3933e9417089ee..aff3a73fcc63740dc6ede20900d12689ec28e19b
100644
--- a/src/version.cc
+++ b/src/version.cc
@@ -35,7 +35,7 @@
#define MAJOR_VERSION 3
#define MINOR_VERSION 21
#define BUILD_NUMBER 18
-#define PATCH_LEVEL 6
+#define PATCH_LEVEL 7
// Use 1 for candidates and 0 otherwise.
// (Boolean macro values are not supported by all preprocessors.)
#define IS_CANDIDATE_VERSION 0
Index: test/mjsunit/regress/regress-319120.js
diff --git a/test/mjsunit/regress/regress-2690.js
b/test/mjsunit/regress/regress-319120.js
similarity index 96%
copy from test/mjsunit/regress/regress-2690.js
copy to test/mjsunit/regress/regress-319120.js
index
5fe7dc42dc693cf7f0a3e9a2b13c0f7b306189e2..2899da25d9d9d82da0714270880cd203a9c5e96b
100644
--- a/test/mjsunit/regress/regress-2690.js
+++ b/test/mjsunit/regress/regress-319120.js
@@ -25,5 +25,4 @@
// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-assertTrue(/\1[a]/.test("\1a"));
-
+assertThrows('x = new Float64Array({length: 0x24924925})');
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/groups/opt_out.
