Changeset 216076 in webkit

Timestamp:

May 2, 2017, 10:55:11 AM (8 years ago)

Author:

mark.lam@apple.com

Message:

JSFixedArray::allocationSize() should not allow for allocation failure.
​https://bugs.webkit.org/show_bug.cgi?id=171516

Reviewed by Geoffrey Garen.

Since JSFixedArray::createFromArray() now handles allocation failures by throwing
OutOfMemoryErrors, its helper function allocationSize() (which computes the buffer
size to allocate) should also allow for allocation failure on overflow.

This issue is covered by the stress/js-fixed-array-out-of-memory.js test when
run on 32-bit builds.

• runtime/JSFixedArray.h:

(JSC::JSFixedArray::tryCreate):
(JSC::JSFixedArray::allocationSize):

Location:

trunk/Source/JavaScriptCore

Files:

• ChangeLog (modified) (1 diff)
• runtime/JSFixedArray.h (modified) (2 diffs)

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2017-05-02  Mark Lam  <mark.lam@apple.com>
+
+        JSFixedArray::allocationSize() should not allow for allocation failure.
+        https://bugs.webkit.org/show_bug.cgi?id=171516
+
+        Reviewed by Geoffrey Garen.
+
+        Since JSFixedArray::createFromArray() now handles allocation failures by throwing
+        OutOfMemoryErrors, its helper function allocationSize() (which computes the buffer
+        size to allocate) should also allow for allocation failure on overflow.
+
+        This issue is covered by the stress/js-fixed-array-out-of-memory.js test when
+        run on 32-bit builds.
+
+        * runtime/JSFixedArray.h:
+        (JSC::JSFixedArray::tryCreate):
+        (JSC::JSFixedArray::allocationSize):
+
 2017-05-01  Zan Dobersek  <zdobersek@igalia.com>
 

trunk/Source/JavaScriptCore/runtime/JSFixedArray.h

@@ -123 +123 @@
     ALWAYS_INLINE static JSFixedArray* tryCreate(VM& vm, Structure* structure, unsigned size)
     {
-        void* buffer = tryAllocateCell<JSFixedArray>(vm.heap, allocationSize(size));
+        Checked<size_t, RecordOverflow> checkedAllocationSize = allocationSize(size);
+        if (UNLIKELY(checkedAllocationSize.hasOverflowed()))
+            return nullptr;
+
+        void* buffer = tryAllocateCell<JSFixedArray>(vm.heap, checkedAllocationSize.unsafeGet());
         if (UNLIKELY(!buffer))
             return nullptr;
@@ -141 +145 @@
 
 
-    static size_t allocationSize(Checked<size_t> numItems)
+    static Checked<size_t, RecordOverflow> allocationSize(Checked<size_t, RecordOverflow> numItems)
     {
-        return (offsetOfData() + numItems * sizeof(WriteBarrier<Unknown>)).unsafeGet();
+        return offsetOfData() + numItems * sizeof(WriteBarrier<Unknown>);
     }
 };