Reviewers: Jakob,
Description:
Merged r17711 into 3.22 branch.
Fix overflow in TypedArray initialization function
BUG=chromium:319120
[email protected]
Please review this at https://codereview.chromium.org/60733022/
SVN Base: https://v8.googlecode.com/svn/branches/3.22
Affected files (+4, -5 lines):
M src/runtime.cc
M src/version.cc
A + test/mjsunit/regress/regress-319120.js
Index: src/runtime.cc
diff --git a/src/runtime.cc b/src/runtime.cc
index
15cfc854bfad6501cab80faed3743f81663fc629..7f37af0bd7241ee0cbbc1eee0d97e4b5b2cfb676
100644
--- a/src/runtime.cc
+++ b/src/runtime.cc
@@ -961,12 +961,12 @@ RUNTIME_FUNCTION(MaybeObject*,
Runtime_TypedArrayInitializeFromArrayLike) {
Handle<JSArrayBuffer> buffer = isolate->factory()->NewJSArrayBuffer();
size_t length = NumberToSize(isolate, *length_obj);
- size_t byte_length = length * element_size;
- if (byte_length < length) { // Overflow
+ if (length > (kMaxInt / element_size)) {
return isolate->Throw(*isolate->factory()->
NewRangeError("invalid_array_buffer_length",
HandleVector<Object>(NULL, 0)));
}
+ size_t byte_length = length * element_size;
// NOTE: not initializing backing store.
// We assume that the caller of this function will initialize holder
Index: src/version.cc
diff --git a/src/version.cc b/src/version.cc
index
9b0ab0a42854d1822e0117d6df9d0be56a9874b2..b77a6b910f821834aa5f879b11e6e4438d641d12
100644
--- a/src/version.cc
+++ b/src/version.cc
@@ -35,7 +35,7 @@
#define MAJOR_VERSION 3
#define MINOR_VERSION 22
#define BUILD_NUMBER 24
-#define PATCH_LEVEL 2
+#define PATCH_LEVEL 3
// Use 1 for candidates and 0 otherwise.
// (Boolean macro values are not supported by all preprocessors.)
#define IS_CANDIDATE_VERSION 0
Index: test/mjsunit/regress/regress-319120.js
diff --git a/test/mjsunit/regress/regress-2690.js
b/test/mjsunit/regress/regress-319120.js
similarity index 96%
copy from test/mjsunit/regress/regress-2690.js
copy to test/mjsunit/regress/regress-319120.js
index
5fe7dc42dc693cf7f0a3e9a2b13c0f7b306189e2..2899da25d9d9d82da0714270880cd203a9c5e96b
100644
--- a/test/mjsunit/regress/regress-2690.js
+++ b/test/mjsunit/regress/regress-319120.js
@@ -25,5 +25,4 @@
// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-assertTrue(/\1[a]/.test("\1a"));
-
+assertThrows('x = new Float64Array({length: 0x24924925})');
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/groups/opt_out.
