Changeset 145482 in webkit

Timestamp:

Mar 11, 2013 10:51:05 PM (11 years ago)

Author:

oliver@apple.com

Message:

Harden JSStringJoiner
​https://bugs.webkit.org/show_bug.cgi?id=112093

Reviewed by Filip Pizlo.

Harden JSStringJoiner, make it use our CheckedArithmetic
class to simplify everything.

• runtime/JSStringJoiner.cpp:

(JSC::JSStringJoiner::build):

• runtime/JSStringJoiner.h:

(JSStringJoiner):
(JSC::JSStringJoiner::JSStringJoiner):
(JSC::JSStringJoiner::append):

Location:

trunk/Source/JavaScriptCore

Files:

• ChangeLog (modified) (1 diff)
• runtime/JSStringJoiner.cpp (modified) (2 diffs)
• runtime/JSStringJoiner.h (modified) (3 diffs)

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2013-03-11  Oliver Hunt  <oliver@apple.com>
+
+        Harden JSStringJoiner
+        https://bugs.webkit.org/show_bug.cgi?id=112093
+
+        Reviewed by Filip Pizlo.
+
+        Harden JSStringJoiner, make it use our CheckedArithmetic
+        class to simplify everything.
+
+        * runtime/JSStringJoiner.cpp:
+        (JSC::JSStringJoiner::build):
+        * runtime/JSStringJoiner.h:
+        (JSStringJoiner):
+        (JSC::JSStringJoiner::JSStringJoiner):
+        (JSC::JSStringJoiner::append):
+
 2013-03-11  Michael Saboff  <msaboff@apple.com>
 

trunk/Source/JavaScriptCore/runtime/JSStringJoiner.cpp

@@ -103 +103 @@
         return jsEmptyString(exec);
 
-    size_t separatorLength = m_separator.length();
+    Checked<size_t, RecordOverflow> separatorLength = m_separator.length();
     // FIXME: add special cases of joinStrings() for (separatorLength == 0) and (separatorLength == 1).
     ASSERT(m_strings.size() > 0);
-    size_t totalSeparactorsLength = separatorLength * (m_strings.size() - 1);
-    size_t outputStringSize = totalSeparactorsLength + m_cumulatedStringsLength;
+    Checked<size_t, RecordOverflow> totalSeparactorsLength = separatorLength * (m_strings.size() - 1);
+    Checked<size_t, RecordOverflow> outputStringSize = totalSeparactorsLength + m_accumulatedStringsLength;
 
+    size_t finalSize;
+    if (outputStringSize.safeGet(finalSize))
+        return throwOutOfMemoryError(exec);
+        
     if (!outputStringSize)
         return jsEmptyString(exec);
@@ -114 +118 @@
     RefPtr<StringImpl> outputStringImpl;
     if (m_is8Bits)
-        outputStringImpl = joinStrings<LChar>(m_strings, m_separator, outputStringSize);
+        outputStringImpl = joinStrings<LChar>(m_strings, m_separator, finalSize);
     else
-        outputStringImpl = joinStrings<UChar>(m_strings, m_separator, outputStringSize);
+        outputStringImpl = joinStrings<UChar>(m_strings, m_separator, finalSize);
 
     if (!outputStringImpl)

trunk/Source/JavaScriptCore/runtime/JSStringJoiner.h

@@ -47 +47 @@
     Vector<String> m_strings;
 
-    unsigned m_cumulatedStringsLength;
+    Checked<unsigned, RecordOverflow> m_accumulatedStringsLength;
     bool m_isValid;
     bool m_is8Bits;
@@ -54 +54 @@
 inline JSStringJoiner::JSStringJoiner(const String& separator, size_t stringCount)
     : m_separator(separator)
-    , m_cumulatedStringsLength(0)
     , m_isValid(true)
     , m_is8Bits(m_separator.is8Bit())
@@ -67 +66 @@
         return;
 
-    m_strings.uncheckedAppend(str);
+    m_strings.append(str);
     if (!str.isNull()) {
-        m_cumulatedStringsLength += str.length();
+        m_accumulatedStringsLength += str.length();
         m_is8Bits = m_is8Bits && str.is8Bit();
     }