Changeset 214374 in webkit

Timestamp:

Mar 24, 2017 1:56:45 PM (7 years ago)

Author:

mark.lam@apple.com

Message:

Array memcpy'ing fast paths should check if we're having a bad time if they cannot handle it.
​https://bugs.webkit.org/show_bug.cgi?id=170064
<rdar://problem/31246098>

Reviewed by Geoffrey Garen.

• runtime/ArrayPrototype.cpp:

(JSC::arrayProtoPrivateFuncConcatMemcpy):

• runtime/JSArray.cpp:

(JSC::JSArray::fastSlice):

Location:

trunk/Source/JavaScriptCore

Files:

• ChangeLog (modified) (1 diff)
• runtime/ArrayPrototype.cpp (modified) (1 diff)
• runtime/JSArray.cpp (modified) (1 diff)

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2017-03-24  Mark Lam  <mark.lam@apple.com>
+
+        Array memcpy'ing fast paths should check if we're having a bad time if they cannot handle it.
+        https://bugs.webkit.org/show_bug.cgi?id=170064
+        <rdar://problem/31246098>
+
+        Reviewed by Geoffrey Garen.
+
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoPrivateFuncConcatMemcpy):
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::fastSlice):
+
 2017-03-23  Yusuke Suzuki  <utatane.tea@gmail.com>
 

trunk/Source/JavaScriptCore/runtime/ArrayPrototype.cpp

@@ -1328 +1328 @@
     }
 
-    Structure* resultStructure = exec->lexicalGlobalObject()->arrayStructureForIndexingTypeDuringAllocation(type);
+    JSGlobalObject* lexicalGlobalObject = exec->lexicalGlobalObject();
+    Structure* resultStructure = lexicalGlobalObject->arrayStructureForIndexingTypeDuringAllocation(type);
+    if (UNLIKELY(hasAnyArrayStorage(resultStructure->indexingType())))
+        return JSValue::encode(jsNull());
+
+    ASSERT(!lexicalGlobalObject->isHavingABadTime());
     JSArray* result = JSArray::tryCreateForInitializationPrivate(vm, resultStructure, resultSize);
     if (UNLIKELY(!result)) {

trunk/Source/JavaScriptCore/runtime/JSArray.cpp

@@ -856 +856 @@
             return nullptr;
 
-        Structure* resultStructure = exec.lexicalGlobalObject()->arrayStructureForIndexingTypeDuringAllocation(arrayType);
+        JSGlobalObject* lexicalGlobalObject = exec.lexicalGlobalObject();
+        Structure* resultStructure = lexicalGlobalObject->arrayStructureForIndexingTypeDuringAllocation(arrayType);
+        if (UNLIKELY(hasAnyArrayStorage(resultStructure->indexingType())))
+            return nullptr;
+
+        ASSERT(!lexicalGlobalObject->isHavingABadTime());
         JSArray* resultArray = JSArray::tryCreateForInitializationPrivate(vm, resultStructure, count);
         if (UNLIKELY(!resultArray))