Revision: 19787
Author: [email protected]
Date: Tue Mar 11 10:30:10 2014 UTC
Log: Fix for 350887: CHECK failure on new_length->IsSmi()
In ElementsAccessorBase::SetLengthImpl for a dictionary array, we try to
optimize setting array length if the new length is a smi. However, we
refuse to set an array length to less than the index of the highest
non-configurable array element. This index may be outside of smi range.
Handle this case accordingly.
BUG=350887
LOG=N
[email protected]
Review URL: https://codereview.chromium.org/194803002
http://code.google.com/p/v8/source/detail?r=19787
Added:
/branches/bleeding_edge/test/mjsunit/regress/regress-350887.js
Modified:
/branches/bleeding_edge/src/elements.cc
=======================================
--- /dev/null
+++ /branches/bleeding_edge/test/mjsunit/regress/regress-350887.js Tue Mar
11 10:30:10 2014 UTC
@@ -0,0 +1,12 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var arr = [];
+assertSame(0, arr.length);
+assertSame(undefined, arr[0]);
+Object.defineProperty(arr, '2501866687', { value: 4, configurable: false
});
+// 2501866688 is out of smi range.
+assertSame(2501866688, arr.length);
+assertSame(undefined, arr[0]);
+arr.length = 0;
=======================================
--- /branches/bleeding_edge/src/elements.cc Fri Jan 24 16:01:15 2014 UTC
+++ /branches/bleeding_edge/src/elements.cc Tue Mar 11 10:30:10 2014 UTC
@@ -1859,10 +1859,18 @@
MaybeObject* result = ElementsAccessorSubclass::
SetLengthWithoutNormalize(backing_store, array, smi_length,
value);
if (!result->ToObject(&new_length)) return result;
- ASSERT(new_length->IsSmi() || new_length->IsUndefined());
+ // even though the proposed length was a smi, new_length could
+ // still be a heap number because SetLengthWithoutNormalize doesn't
+ // allow the array length property to drop below the index of
+ // non-deletable elements.
+ ASSERT(new_length->IsSmi() || new_length->IsHeapNumber() ||
+ new_length->IsUndefined());
if (new_length->IsSmi()) {
array->set_length(Smi::cast(new_length));
return array;
+ } else if (new_length->IsHeapNumber()) {
+ array->set_length(new_length);
+ return array;
}
} else {
return ThrowArrayLengthRangeError(array->GetHeap());
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
