Changeset 214334 in webkit

Timestamp:

Mar 23, 2017 9:53:37 PM (7 years ago)

Author:

mark.lam@apple.com

Message:

Array.prototype.splice behaves incorrectly when the VM is "having a bad time".
​https://bugs.webkit.org/show_bug.cgi?id=170025
<rdar://problem/31228679>

Reviewed by Saam Barati.

• runtime/ArrayPrototype.cpp:

(JSC::copySplicedArrayElements):
(JSC::arrayProtoFuncSplice):

Location:

trunk/Source/JavaScriptCore

Files:

• ChangeLog (modified) (1 diff)
• runtime/ArrayPrototype.cpp (modified) (2 diffs)

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2017-03-23  Mark Lam  <mark.lam@apple.com>
+
+        Array.prototype.splice behaves incorrectly when the VM is "having a bad time".
+        https://bugs.webkit.org/show_bug.cgi?id=170025
+        <rdar://problem/31228679>
+
+        Reviewed by Saam Barati.
+
+        * runtime/ArrayPrototype.cpp:
+        (JSC::copySplicedArrayElements):
+        (JSC::arrayProtoFuncSplice):
+
 2017-03-23  Yusuke Suzuki  <utatane.tea@gmail.com>
 

trunk/Source/JavaScriptCore/runtime/ArrayPrototype.cpp

@@ -968 +968 @@
 }
 
+template<bool needToFillHolesManually>
+inline bool copySplicedArrayElements(ExecState* exec, ThrowScope& scope, JSObject* result, JSObject* thisObj, unsigned actualStart, unsigned actualDeleteCount)
+{
+    VM& vm = scope.vm();
+    for (unsigned k = 0; k < actualDeleteCount; ++k) {
+        JSValue v = getProperty(exec, thisObj, k + actualStart);
+        RETURN_IF_EXCEPTION(scope, false);
+        if (UNLIKELY(!v && !needToFillHolesManually))
+            continue;
+        result->initializeIndex(vm, k, v);
+    }
+    return true;
+}
+
 EncodedJSValue JSC_HOST_CALL arrayProtoFuncSplice(ExecState* exec)
 {
@@ -1047 +1061 @@
                 return encodedJSValue();
             }
-            
-            for (unsigned k = 0; k < actualDeleteCount; ++k) {
-                JSValue v = getProperty(exec, thisObj, k + actualStart);
-                RETURN_IF_EXCEPTION(scope, encodedJSValue());
-                if (UNLIKELY(!v))
-                    continue;
-                result->initializeIndex(vm, k, v);
+
+            // The result can have an ArrayStorage indexing type if we're having a bad time.
+            bool isArrayStorage = hasAnyArrayStorage(result->indexingType());
+            bool success = false;
+            if (UNLIKELY(isArrayStorage)) {
+                static const bool needToFillHolesManually = true;
+                success = copySplicedArrayElements<needToFillHolesManually>(exec, scope, result, thisObj, actualStart, actualDeleteCount);
+            } else {
+                ASSERT(hasUndecided(result->indexingType()));
+                static const bool needToFillHolesManually = false;
+                success = copySplicedArrayElements<needToFillHolesManually>(exec, scope, result, thisObj, actualStart, actualDeleteCount);
+            }
+            if (UNLIKELY(!success)) {
+                ASSERT(scope.exception());
+                return encodedJSValue();
             }
         }