Reviewers: mvstanton,
Description:
Fix missing bounds check in n-arguments Array constructor.
[email protected]
BUG=v8:3027
TEST=mjsunit/regress/regress-3027
Please review this at https://codereview.chromium.org/92103003/
SVN Base: https://v8.googlecode.com/svn/branches/bleeding_edge
Affected files (+24, -15 lines):
M src/code-stubs-hydrogen.cc
A + test/mjsunit/regress/regress-3027.js
Index: src/code-stubs-hydrogen.cc
diff --git a/src/code-stubs-hydrogen.cc b/src/code-stubs-hydrogen.cc
index
894c3d3b22df7f8e40ccf968d580091accc4a540..f717d75c192423425453b25f4da792b281e83662
100644
--- a/src/code-stubs-hydrogen.cc
+++ b/src/code-stubs-hydrogen.cc
@@ -742,6 +742,15 @@ HValue*
CodeStubGraphBuilderBase::BuildArraySingleArgumentConstructor(
HValue* CodeStubGraphBuilderBase::BuildArrayNArgumentsConstructor(
JSArrayBuilder* array_builder, ElementsKind kind) {
+ // Insert a bounds check because the number of arguments might exceed
+ // the kInitialMaxFastElementArray limit. This cannot happen for code
+ // that was parsed, but calling via Array.apply(thisArg, [...]) might
+ // trigger it.
+ HValue* length = GetArgumentsLength();
+ HConstant* max_alloc_length =
+ Add<HConstant>(JSObject::kInitialMaxFastElementArray);
+ HValue* checked_length = Add<HBoundsCheck>(length, max_alloc_length);
+
// We need to fill with the hole if it's a smi array in the
multi-argument
// case because we might have to bail out while copying arguments into
// the array because they aren't compatible with a smi array.
@@ -750,12 +759,11 @@ HValue*
CodeStubGraphBuilderBase::BuildArrayNArgumentsConstructor(
//
// TODO(mvstanton): consider an instruction to memset fill the array
// with zero in this case instead.
- HValue* length = GetArgumentsLength();
JSArrayBuilder::FillMode fill_mode = IsFastSmiElementsKind(kind)
? JSArrayBuilder::FILL_WITH_HOLE
: JSArrayBuilder::DONT_FILL_WITH_HOLE;
- HValue* new_object = array_builder->AllocateArray(length,
- length,
+ HValue* new_object = array_builder->AllocateArray(checked_length,
+ checked_length,
fill_mode);
HValue* elements = array_builder->GetElementsLocation();
ASSERT(elements != NULL);
@@ -765,10 +773,10 @@ HValue*
CodeStubGraphBuilderBase::BuildArrayNArgumentsConstructor(
context(),
LoopBuilder::kPostIncrement);
HValue* start = graph()->GetConstant0();
- HValue* key = builder.BeginBody(start, length, Token::LT);
+ HValue* key = builder.BeginBody(start, checked_length, Token::LT);
HInstruction* argument_elements = Add<HArgumentsElements>(false);
HInstruction* argument = Add<HAccessArgumentsAt>(
- argument_elements, length, key);
+ argument_elements, checked_length, key);
Add<HStoreKeyed>(elements, key, argument, kind);
builder.EndBody();
Index: test/mjsunit/regress/regress-3027.js
diff --git a/test/mjsunit/regress/regress-crbug-245424.js
b/test/mjsunit/regress/regress-3027.js
similarity index 83%
copy from test/mjsunit/regress/regress-crbug-245424.js
copy to test/mjsunit/regress/regress-3027.js
index
005c8baba9492dd339b4fbdc3b48f7577b9c308a..c7ebd539b685763ae30c778922c484d64ae44e6b
100644
--- a/test/mjsunit/regress/regress-crbug-245424.js
+++ b/test/mjsunit/regress/regress-3027.js
@@ -25,17 +25,18 @@
// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-// Flags: --allow-natives-syntax
+// Test to exceed the Heap::MaxRegularSpaceAllocationSize with an array
+// constructor call taking many arguments.
function boom() {
- var a = {
- foo: "bar",
- foo: "baz"
- };
- return a;
+ var args = [];
+ for (var i = 0; i < 125000; i++) {
+ args.push(i);
+ }
+ return Array.apply(Array, args);
}
-assertEquals("baz", boom().foo);
-assertEquals("baz", boom().foo);
-%OptimizeFunctionOnNextCall(boom);
-assertEquals("baz", boom().foo);
+var array = boom();
+
+assertEquals(125000, array.length);
+assertEquals(124999, array[124999]);
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/groups/opt_out.
