Changeset 217869 in webkit


Ignore:
Timestamp:
Jun 6, 2017, 5:28:47 PM (8 years ago)
Author:
mark.lam@apple.com
Message:

Contiguous storage butterfly length should not exceed MAX_STORAGE_VECTOR_LENGTH.
​https://bugs.webkit.org/show_bug.cgi?id=173035
<rdar://problem/32554593>

Reviewed by Geoffrey Garen and Filip Pizlo.

JSTests:

  • stress/regress-173035.js: Added.

Source/JavaScriptCore:

Also added and fixed up some assertions.

  • runtime/ArrayConventions.h:
  • runtime/JSArray.cpp:

(JSC::JSArray::setLength):

  • runtime/JSObject.cpp:

(JSC::JSObject::createInitialIndexedStorage):
(JSC::JSObject::ensureLengthSlow):
(JSC::JSObject::reallocateAndShrinkButterfly):

  • runtime/JSObject.h:

(JSC::JSObject::ensureLength):

  • runtime/RegExpObject.cpp:

(JSC::collectMatches):

  • runtime/RegExpPrototype.cpp:

(JSC::regExpProtoFuncSplitFast):

Location:
trunk
Files:
1 added
8 edited

Legend:

Unmodified
Added
Removed

  • trunk/JSTests/ChangeLog

    r217866 r217869  
     12017-06-06  Mark Lam  <mark.lam@apple.com>
     2
     3        Contiguous storage butterfly length should not exceed MAX_STORAGE_VECTOR_LENGTH.
     4        https://bugs.webkit.org/show_bug.cgi?id=173035
     5        <rdar://problem/32554593>
     6
     7        Reviewed by Geoffrey Garen and Filip Pizlo.
     8
     9        * stress/regress-173035.js: Added.
     10
    1112017-06-06  Saam Barati  <sbarati@apple.com>
    212

  • trunk/Source/JavaScriptCore/ChangeLog

    r217866 r217869  
     12017-06-06  Mark Lam  <mark.lam@apple.com>
     2
     3        Contiguous storage butterfly length should not exceed MAX_STORAGE_VECTOR_LENGTH.
     4        https://bugs.webkit.org/show_bug.cgi?id=173035
     5        <rdar://problem/32554593>
     6
     7        Reviewed by Geoffrey Garen and Filip Pizlo.
     8
     9        Also added and fixed up some assertions.
     10
     11        * runtime/ArrayConventions.h:
     12        * runtime/JSArray.cpp:
     13        (JSC::JSArray::setLength):
     14        * runtime/JSObject.cpp:
     15        (JSC::JSObject::createInitialIndexedStorage):
     16        (JSC::JSObject::ensureLengthSlow):
     17        (JSC::JSObject::reallocateAndShrinkButterfly):
     18        * runtime/JSObject.h:
     19        (JSC::JSObject::ensureLength):
     20        * runtime/RegExpObject.cpp:
     21        (JSC::collectMatches):
     22        * runtime/RegExpPrototype.cpp:
     23        (JSC::regExpProtoFuncSplitFast):
     24
    1252017-06-06  Saam Barati  <sbarati@apple.com>
    226

  • trunk/Source/JavaScriptCore/runtime/ArrayConventions.h

    r206525 r217869  
    11/*
    22 *  Copyright (C) 1999-2000 Harri Porten (porten@kde.org)
    3  *  Copyright (C) 2003, 2007, 2008, 2009, 2012, 2016 Apple Inc. All rights reserved.
     3 *  Copyright (C) 2003-2017 Apple Inc. All rights reserved.
    44 *
    55 *  This library is free software; you can redistribute it and/or
    … …  
    6969// 0xFFFFFFFF is a bit weird -- is not an array index even though it's an integer.
    7070#define MAX_ARRAY_INDEX 0xFFFFFFFEU
     71
     72static_assert(MIN_SPARSE_ARRAY_INDEX <= MAX_STORAGE_VECTOR_INDEX, "MIN_SPARSE_ARRAY_INDEX must be less than or equal to MAX_STORAGE_VECTOR_INDEX");
     73static_assert(MAX_STORAGE_VECTOR_INDEX <= MAX_ARRAY_INDEX, "MAX_STORAGE_VECTOR_INDEX must be less than or equal to MAX_ARRAY_INDEX");
    7174
    7275// The value BASE_XXX_VECTOR_LEN is the maximum number of vector elements we'll allocate

  • trunk/Source/JavaScriptCore/runtime/JSArray.cpp

    r217108 r217869  
    570570        if (newLength == butterfly->publicLength())
    571571            return true;
    572         if (newLength >= MAX_ARRAY_INDEX // This case ensures that we can do fast push.
     572        if (newLength > MAX_STORAGE_VECTOR_LENGTH // This check ensures that we can do fast push.
    573573            || (newLength >= MIN_SPARSE_ARRAY_INDEX
    574574                && !isDenseEnoughForVector(newLength, countElements()))) {

  • trunk/Source/JavaScriptCore/runtime/JSObject.cpp

    r217843 r217869  
    10021002Butterfly* JSObject::createInitialIndexedStorage(VM& vm, unsigned length)
    10031003{
    1004     ASSERT(length < MAX_ARRAY_INDEX);
     1004    ASSERT(length <= MAX_STORAGE_VECTOR_LENGTH);
    10051005    IndexingType oldType = indexingType();
    10061006    ASSERT_UNUSED(oldType, !hasIndexedProperties(oldType));
    … …  
    31303130    Butterfly* butterfly = m_butterfly.get();
    31313131   
    3132     ASSERT(length < MAX_ARRAY_INDEX);
     3132    ASSERT(length <= MAX_STORAGE_VECTOR_LENGTH);
    31333133    ASSERT(hasContiguous(indexingType()) || hasInt32(indexingType()) || hasDouble(indexingType()) || hasUndecided(indexingType()));
    31343134    ASSERT(length > butterfly->vectorLength());
    … …  
    31823182void JSObject::reallocateAndShrinkButterfly(VM& vm, unsigned length)
    31833183{
    3184     ASSERT(length < MAX_ARRAY_INDEX);
    3185     ASSERT(length < MAX_STORAGE_VECTOR_LENGTH);
     3184    ASSERT(length <= MAX_STORAGE_VECTOR_LENGTH);
    31863185    ASSERT(hasContiguous(indexingType()) || hasInt32(indexingType()) || hasDouble(indexingType()) || hasUndecided(indexingType()));
    31873186    ASSERT(m_butterfly.get()->vectorLength() > length);

  • trunk/Source/JavaScriptCore/runtime/JSObject.h

    r216279 r217869  
    968968    bool WARN_UNUSED_RETURN ensureLength(VM& vm, unsigned length)
    969969    {
    970         ASSERT(length < MAX_ARRAY_INDEX);
     970        ASSERT(length <= MAX_STORAGE_VECTOR_LENGTH);
    971971        ASSERT(hasContiguous(indexingType()) || hasInt32(indexingType()) || hasDouble(indexingType()) || hasUndecided(indexingType()));
    972972

  • trunk/Source/JavaScriptCore/runtime/RegExpObject.cpp

    r217108 r217869  
    11/*
    22 *  Copyright (C) 1999-2000 Harri Porten (porten@kde.org)
    3  *  Copyright (C) 2003, 2007-2008, 2012, 2016 Apple Inc. All Rights Reserved.
     3 *  Copyright (C) 2003-2017 Apple Inc. All Rights Reserved.
    44 *
    55 *  This library is free software; you can redistribute it and/or
    … …  
    205205            MatchResult savedResult = result;
    206206            do {
    207                 if (array->length() + matchCount >= MAX_STORAGE_VECTOR_LENGTH) {
     207                if (array->length() + matchCount > MAX_STORAGE_VECTOR_LENGTH) {
    208208                    throwOutOfMemoryError(exec, scope);
    209209                    return jsUndefined();

  • trunk/Source/JavaScriptCore/runtime/RegExpPrototype.cpp

    r217108 r217869  
    11/*
    22 *  Copyright (C) 1999-2000 Harri Porten (porten@kde.org)
    3  *  Copyright (C) 2003, 2007-2008, 2016 Apple Inc. All Rights Reserved.
     3 *  Copyright (C) 2003-2017 Apple Inc. All Rights Reserved.
    44 *
    55 *  This library is free software; you can redistribute it and/or
    … …  
    680680        vm, regexp, input, inputSize, position, matchPosition, regExpIsSticky, regExpIsUnicode,
    681681        [&] () -> SplitControl {
    682             if (resultLength + dryRunCount >= MAX_STORAGE_VECTOR_LENGTH)
     682            if (resultLength + dryRunCount > MAX_STORAGE_VECTOR_LENGTH)
    683683                return AbortSplit;
    684684            return ContinueSplit;
    … …  
    691691        });
    692692   
    693     if (resultLength + dryRunCount >= MAX_STORAGE_VECTOR_LENGTH) {
     693    if (resultLength + dryRunCount > MAX_STORAGE_VECTOR_LENGTH) {
    694694        throwOutOfMemoryError(exec, scope);
    695695        return encodedJSValue();
Note: See TracChangeset for help on using the changeset viewer.