Enforce length/size limits for variable size heap object in order to

vm/object.cc

 // Copyright (c) 2012, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 #include "vm/object.h"
 
 #include "platform/assert.h"
 #include "vm/assembler.h"
 #include "vm/bigint_operations.h"
 #include "vm/bootstrap.h"
@@ skipping 3349 matching lines @@
     if (!type.IsInstantiated()) {
       type = type.InstantiateFrom(instantiator_type_arguments);
     }
     instantiated_array.SetTypeAt(i, type);
   }
   return instantiated_array.raw();
 }
 
 
 RawTypeArguments* TypeArguments::New(intptr_t len, Heap::Space space) {
-  if ((len < 0) || (len > kMaxTypes)) {
-    // TODO(iposva): Should we throw an illegal parameter exception?
-    UNIMPLEMENTED();
-    return null();
+  if (len < 0 || len > kMaxElements) {
+    // This should be caught before we reach here.
+    FATAL1("Fatal error in TypeArguments::New: invalid len %ld\n", len);
   }
-
   const Class& type_arguments_class =
       Class::Handle(Object::type_arguments_class());
   TypeArguments& result = TypeArguments::Handle();
   {
     RawObject* raw = Object::Allocate(type_arguments_class,
                                       TypeArguments::InstanceSize(len),
                                       space);
     NoGCScope no_gc;
     result ^= raw;
     // Length must be set before we start storing into the array.
@@ skipping 1135 matching lines @@
   while (index < src_pos && kind != Token::kEOS) {
     iterator.Advance();
     kind = iterator.CurrentTokenKind();
     index += 1;
   }
   return iterator.CurrentPosition();
 }
 
 
 RawTokenStream* TokenStream::New(intptr_t len) {
+  if (len < 0 || len > kMaxElements) {
+    // This should be caught before we reach here.
+    FATAL1("Fatal error in TokenStream::New: invalid len %ld\n", len);
+  }
   const Class& token_stream_class = Class::Handle(Object::token_stream_class());
   TokenStream& result = TokenStream::Handle();
   {
     RawObject* raw = Object::Allocate(token_stream_class,
                                       TokenStream::InstanceSize(len),
                                       Heap::kOld);
     NoGCScope no_gc;
     result ^= raw;
     result.SetLength(len);
   }
@@ skipping 1727 matching lines @@
       if (!error.IsNull()) {
         return error.raw();
       }
     }
   }
   return error.raw();
 }
 
 
 RawInstructions* Instructions::New(intptr_t size) {
+  if (size < 0 || size > kMaxElements) {
+    // This should be caught before we reach here.
+    FATAL1("Fatal error in Instructions::New: invalid size %ld\n", size);
+  }
   const Class& instructions_class = Class::Handle(Object::instructions_class());
   Instructions& result = Instructions::Handle();
   {
     uword aligned_size = Instructions::InstanceSize(size);
     RawObject* raw = Object::Allocate(instructions_class,
                                       aligned_size,
                                       Heap::kCode);
     NoGCScope no_gc;
     // TODO(iposva): Remove premarking once old and code spaces are merged.
     raw->SetMarkBit();
@@ skipping 65 matching lines @@
   return *(EntryAddr(index, kTryIndexEntry));
 }
 
 
 void PcDescriptors::SetTryIndex(intptr_t index, intptr_t value) const {
   *(EntryAddr(index, kTryIndexEntry)) = value;
 }
 
 
 RawPcDescriptors* PcDescriptors::New(intptr_t num_descriptors) {
+  if (num_descriptors < 0 || num_descriptors > kMaxElements) {
+    // This should be caught before we reach here.
+    FATAL1("Fatal error in PcDescriptors::New: invalid num_descriptors %ld\n",
+           num_descriptors);
+  }
   const Class& cls = Class::Handle(Object::pc_descriptors_class());
   PcDescriptors& result = PcDescriptors::Handle();
   {
     uword size = PcDescriptors::InstanceSize(num_descriptors);
     RawObject* raw = Object::Allocate(cls, size, Heap::kOld);
     NoGCScope no_gc;
     result ^= raw;
     result.SetLength(num_descriptors);
   }
   return result.raw();
@@ skipping 106 matching lines @@
   }
 }
 
 
 RawStackmap* Stackmap::New(uword pc_offset, BitmapBuilder* bmap) {
   const Class& cls = Class::Handle(Object::stackmap_class());
   ASSERT(!cls.IsNull());
   ASSERT(bmap != NULL);
   Stackmap& result = Stackmap::Handle();
   intptr_t size = bmap->SizeInBytes();
+  if (size < 0 || size > kMaxElements) {
+    // This should be caught before we reach here.
+    FATAL1("Fatal error in PcDescriptors::New: invalid size %ld\n", size);
+  }
   {
     // Stackmap data objects are associated with a code object, allocate them
     // in old generation.
     RawObject* raw =
         Object::Allocate(cls, Stackmap::InstanceSize(size), Heap::kOld);
     NoGCScope no_gc;
     result ^= raw;
     result.set_bitmap_size_in_bytes(size);
   }
   result.SetPC(pc_offset);
@@ skipping 64 matching lines @@
 }
 
 
 const char* LocalVarDescriptors::ToCString() const {
   UNIMPLEMENTED();
   return "LocalVarDescriptors";
 }
 
 
 RawLocalVarDescriptors* LocalVarDescriptors::New(intptr_t num_variables) {
+  if (num_variables < 0 || num_variables > kMaxElements) {
+    // This should be caught before we reach here.
+    FATAL1("Fatal error in LocalVarDescriptors::New: "
+           "invalid num_variables %ld\n", num_variables);
+  }
   const Class& cls = Class::Handle(Object::var_descriptors_class());
   LocalVarDescriptors& result = LocalVarDescriptors::Handle();
   {
     uword size = LocalVarDescriptors::InstanceSize(num_variables);
     RawObject* raw = Object::Allocate(cls, size, Heap::kOld);
     NoGCScope no_gc;
     result ^= raw;
     result.raw_ptr()->length_ = num_variables;
   }
   const Array& names = Array::Handle(Array::New(num_variables, Heap::kOld));
@@ skipping 34 matching lines @@
 }
 
 
 void ExceptionHandlers::SetHandlerPC(intptr_t index,
                                      intptr_t value) const {
   *(EntryAddr(index, kHandlerPcEntry)) = value;
 }
 
 
 RawExceptionHandlers* ExceptionHandlers::New(intptr_t num_handlers) {
+  if (num_handlers < 0 || num_handlers > kMaxElements) {
+    // This should be caught before we reach here.
+    FATAL1("Fatal error in ExceptionHandlers::New: invalid num_handlers %ld\n",
+           num_handlers);
+  }
   const Class& cls = Class::Handle(Object::exception_handlers_class());
   ExceptionHandlers& result = ExceptionHandlers::Handle();
   {
     uword size = ExceptionHandlers::InstanceSize(num_handlers);
     RawObject* raw = Object::Allocate(cls, size, Heap::kOld);
     NoGCScope no_gc;
     result ^= raw;
     result.SetLength(num_handlers);
   }
   return result.raw();
@@ skipping 21 matching lines @@
                          "%ld => 0x%x\n",
                          TryIndex(i),
                          HandlerPC(i));
   }
   return buffer;
 }
 
 
 Code::Comments& Code::Comments::New(intptr_t count) {
   Comments* comments;
+  if (count < 0 || count > (kIntptrMax / kNumberOfEntries)) {
+    // This should be caught before we reach here.
+    FATAL1("Fatal error in Code::Comments::New: invalid count %ld\n", count);
+  }
   if (count == 0) {
     comments = new Comments(Array::Empty());
   } else {
     comments = new Comments(Array::New(count * kNumberOfEntries));
   }
   return *comments;
 }
 
 
 intptr_t Code::Comments::Length() const {
@@ skipping 41 matching lines @@
   Comments* comments = new Code::Comments(raw_ptr()->comments_);
   return *comments;
 }
 
 
 void Code::set_comments(const Code::Comments& comments) const {
   StorePointer(&raw_ptr()->comments_, comments.comments_.raw());
 }
 
 
-RawCode* Code::New(int pointer_offsets_length) {
+RawCode* Code::New(intptr_t pointer_offsets_length) {
+  if (pointer_offsets_length < 0 || pointer_offsets_length > kMaxElements) {
+    // This should be caught before we reach here.
+    FATAL1("Fatal error in Code::New: invalid pointer_offsets_length %ld\n",
+           pointer_offsets_length);
+  }
   const Class& cls = Class::Handle(Object::code_class());
   Code& result = Code::Handle();
   {
     uword size = Code::InstanceSize(pointer_offsets_length);
     RawObject* raw = Object::Allocate(cls, size, Heap::kOld);
     NoGCScope no_gc;
     result ^= raw;
     result.set_pointer_offsets_length(pointer_offsets_length);
     result.set_is_optimized(false);
     result.set_comments(Comments::New(0));
@@ skipping 207 matching lines @@
       *map = previous_map;
       break;
     }
     previous_map = map->raw();
   }
   return map->raw();
 }
 
 
 RawContext* Context::New(intptr_t num_variables, Heap::Space space) {
-  ASSERT(num_variables >= 0);
-
+  if (num_variables < 0 || num_variables > kMaxElements) {
+    // This should be caught before we reach here.
+    FATAL1("Fatal error in Context::New: invalid num_variables %ld\n",
+           num_variables);
+  }
   const Class& context_class = Class::Handle(Object::context_class());
   Context& result = Context::Handle();
   {
     RawObject* raw = Object::Allocate(context_class,
                                       Context::InstanceSize(num_variables),
                                       space);
     NoGCScope no_gc;
     result ^= raw;
     result.set_num_variables(num_variables);
   }
   result.set_isolate(Isolate::Current());
   return result.raw();
 }
 
 
 const char* Context::ToCString() const {
   return "Context";
 }
 
 
 RawContextScope* ContextScope::New(intptr_t num_variables) {
+  if (num_variables < 0 || num_variables > kMaxElements) {
+    // This should be caught before we reach here.
+    FATAL1("Fatal error in ContextScope::New: invalid num_variables %ld\n",
+           num_variables);
+  }
   const Class& context_scope_class =
     Class::Handle(Object::context_scope_class());
   intptr_t size = ContextScope::InstanceSize(num_variables);
   ContextScope& result = ContextScope::Handle();
   {
     RawObject* raw = Object::Allocate(context_scope_class, size, Heap::kOld);
     NoGCScope no_gc;
     result ^= raw;
     result.set_num_variables(num_variables);
   }
@@ skipping 1149 matching lines @@
     return BigintOperations::Compare(*this, Bigint::Cast(other));
   }
   if (this->IsNegative() == other.IsNegative()) {
     return this->IsNegative() ? -1 : 1;
   }
   return this->IsNegative() ? -1 : 1;
 }
 
 
 RawBigint* Bigint::Allocate(intptr_t length, Heap::Space space) {
-  ASSERT(length >= 0);
+  if (length < 0 || length > kMaxElements) {
+    // This should be caught before we reach here.
+    FATAL1("Fatal error in Bigint::Allocate: invalid length %ld\n", length);
+  }
   Isolate* isolate = Isolate::Current();
   const Class& cls = Class::Handle(isolate->object_store()->bigint_class());
   Bigint& result = Bigint::Handle();
   {
     RawObject* raw = Object::Allocate(cls, Bigint::InstanceSize(length), space);
     NoGCScope no_gc;
     result ^= raw;
     result.raw_ptr()->allocated_length_ = length;  // Chunk length allocated.
     result.raw_ptr()->signed_length_ = length;  // Chunk length in use.
   }
@@ skipping 872 matching lines @@
       }
     }
     return dststr.raw();
   }
   return OneByteString::null();
 }
 
 
 RawOneByteString* OneByteString::New(intptr_t len,
                                      Heap::Space space) {
+  if (len < 0 || len > kMaxElements) {
+    // This should be caught before we reach here.
+    FATAL1("Fatal error in OneByteString::New: invalid len %ld\n", len);
+  }
   Isolate* isolate = Isolate::Current();
 
   const Class& cls =
       Class::Handle(isolate->object_store()->one_byte_string_class());
   OneByteString& result = OneByteString::Handle();
   {
     RawObject* raw = Object::Allocate(cls,
                                       OneByteString::InstanceSize(len),
                                       space);
     NoGCScope no_gc;
@@ skipping 121 matching lines @@
       }
     }
     return dststr.raw();
   }
   return TwoByteString::null();
 }
 
 
 RawTwoByteString* TwoByteString::New(intptr_t len,
                                      Heap::Space space) {
+  if (len < 0 || len > kMaxElements) {
+    // This should be caught before we reach here.
+    FATAL1("Fatal error in TwoByteString::New: invalid len %ld\n", len);
+  }
   Isolate* isolate = Isolate::Current();
 
   const Class& cls =
       Class::Handle(isolate->object_store()->two_byte_string_class());
   TwoByteString& result = TwoByteString::Handle();
   {
     RawObject* raw = Object::Allocate(cls,
                                       TwoByteString::InstanceSize(len),
                                       space);
     NoGCScope no_gc;
@@ skipping 111 matching lines @@
       }
     }
     return dststr.raw();
   }
   return FourByteString::null();
 }
 
 
 RawFourByteString* FourByteString::New(intptr_t len,
                                        Heap::Space space) {
+  if (len < 0 || len > kMaxElements) {
+    // This should be caught before we reach here.
+    FATAL1("Fatal error in FourByteString::New: invalid len %ld\n", len);
+  }
   Isolate* isolate = Isolate::Current();
 
   const Class& cls =
       Class::Handle(isolate->object_store()->four_byte_string_class());
   FourByteString& result = FourByteString::Handle();
   {
     RawObject* raw = Object::Allocate(cls,
                                       FourByteString::InstanceSize(len),
                                       space);
     NoGCScope no_gc;
@@ skipping 90 matching lines @@
 }
 
 
 RawExternalOneByteString* ExternalOneByteString::New(
     const uint8_t* data,
     intptr_t len,
     void* peer,
     Dart_PeerFinalizer callback,
     Heap::Space space) {
   Isolate* isolate = Isolate::Current();
+  if (len < 0) {

[cshapiro, 2012/07/17 22:54:30]

This should check against a kMaxElements, preferably the same kMaxElements in
the non-external OneByteString type.

External types will be serialized as their internal counterpart in a snapshot.

[turnidge, 2012/07/18 18:17:04]

I went further than that.  I have made all strings share a common kMaxElements. 
Seems simpler.

+    // This should be caught before we reach here.
+    //
+    // Note that we don't have a max length for an external one byte
+    // string.  We can safely compute the offset of all array elements
+    // without causing overflow.
+    FATAL1("Fatal error in ExternalOneByteString::New: invalid len %ld\n", len);
+  }
 
   const Class& cls =
       Class::Handle(isolate->object_store()->external_one_byte_string_class());
   ExternalOneByteString& result = ExternalOneByteString::Handle();
   ExternalStringData<uint8_t>* external_data =
       new ExternalStringData<uint8_t>(data, peer, callback);
   {
     RawObject* raw = Object::Allocate(cls,
                                       ExternalOneByteString::InstanceSize(),
                                       space);
@@ skipping 29 matching lines @@
 }
 
 
 RawExternalTwoByteString* ExternalTwoByteString::New(
     const uint16_t* data,
     intptr_t len,
     void* peer,
     Dart_PeerFinalizer callback,
     Heap::Space space) {
   Isolate* isolate = Isolate::Current();
+  if (len < 0 || len > kMaxElements) {
+    // This should be caught before we reach here.
+    FATAL1("Fatal error in ExternalTwoByteString::New: invalid len %ld\n", len);
+  }
 
   const Class& cls =
       Class::Handle(isolate->object_store()->external_two_byte_string_class());
   ExternalTwoByteString& result = ExternalTwoByteString::Handle();
   ExternalStringData<uint16_t>* external_data =
       new ExternalStringData<uint16_t>(data, peer, callback);
   {
     RawObject* raw = Object::Allocate(cls,
                                       ExternalTwoByteString::InstanceSize(),
                                       space);
@@ skipping 19 matching lines @@
 }
 
 
 RawExternalFourByteString* ExternalFourByteString::New(
     const uint32_t* data,
     intptr_t len,
     void* peer,
     Dart_PeerFinalizer callback,
     Heap::Space space) {
   Isolate* isolate = Isolate::Current();
+  if (len < 0 || len > kMaxElements) {
+    // This should be caught before we reach here.
+    FATAL1("Fatal error in ExternalFourByteString::New: invalid len %ld\n",
+           len);
+  }
 
   const Class& cls =
       Class::Handle(isolate->object_store()->external_four_byte_string_class());
   ExternalFourByteString& result = ExternalFourByteString::Handle();
   ExternalStringData<uint32_t>* external_data =
       new ExternalStringData<uint32_t>(data, peer, callback);
   {
     RawObject* raw = Object::Allocate(cls,
                                       ExternalFourByteString::InstanceSize(),
                                       space);
@@ skipping 85 matching lines @@
 
 
 RawArray* Array::New(intptr_t len, Heap::Space space) {
   ObjectStore* object_store = Isolate::Current()->object_store();
   Class& cls = Class::Handle(object_store->array_class());
   return New(cls, len, space);
 }
 
 
 RawArray* Array::New(const Class& cls, intptr_t len, Heap::Space space) {
-  if ((len < 0) || (len > kMaxArrayElements)) {
-    // TODO(srdjan): Verify that illegal argument is the right thing to throw.
-    GrowableArray<const Object*> args;
-    args.Add(&Smi::Handle(Smi::New(len)));
-    Exceptions::ThrowByType(Exceptions::kIllegalArgument, args);
+  if (len < 0 || len > Array::kMaxElements) {
+    // This should be caught before we reach here.
+    FATAL1("Fatal error in Array::New: invalid len %ld\n", len);
   }
   Array& result = Array::Handle();
   {
     RawObject* raw = Object::Allocate(cls,
                                       Array::InstanceSize(len),
                                       space);
     NoGCScope no_gc;
     result ^= raw;
     result.SetLength(len);
   }
@@ skipping 279 matching lines @@
 }
 
 
 template<typename HandleT, typename RawT, typename ElementT>
 RawT* ByteArray::NewExternalImpl(const Class& cls,
                                  ElementT* data,
                                  intptr_t len,
                                  void* peer,
                                  Dart_PeerFinalizer callback,
                                  Heap::Space space) {
+  if (len < 0) {

[cshapiro, 2012/07/17 22:54:30]

This needs an upper bound, use the non-external one.

[turnidge, 2012/07/18 18:17:04]

Done.

+    // This should be caught before we reach here.
+    //
+    // TODO(turnidge): Determine whether we need to check for a max here too.
+    FATAL1("Fatal error in ByteArray::NewExternalImpl: invalid len %ld\n", len);
+  }
   HandleT& result = HandleT::Handle();
   ExternalByteArrayData<ElementT>* external_data =
       new ExternalByteArrayData<ElementT>(data, peer, callback);
   {
     RawObject* raw = Object::Allocate(cls, HandleT::InstanceSize(), space);
     NoGCScope no_gc;
     result ^= raw;
     result.SetLength(len);
     result.SetExternalData(external_data);
   }
@@ skipping 18 matching lines @@
 
 const char* ByteArray::ToCString() const {
   // ByteArray is an abstract class.
   UNREACHABLE();
   return "ByteArray";
 }
 
 
 template<typename HandleT, typename RawT>
 RawT* ByteArray::NewImpl(const Class& cls, intptr_t len, Heap::Space space) {
+  if (len < 0 || len > HandleT::kMaxElements) {
+    // This should be caught before we reach here.
+    FATAL1("Fatal error in ByteArray::NewImpl: invalid len %ld\n", len);
+  }
   HandleT& result = HandleT::Handle();
   {
     RawObject* raw = Object::Allocate(cls, HandleT::InstanceSize(len), space);
     NoGCScope no_gc;
     result ^= raw;
     result.SetLength(len);
     if (len > 0) {
       memset(result.ByteAddr(0), 0, result.ByteLength());
     }
   }
   return result.raw();
 }
 
 
 template<typename HandleT, typename RawT, typename ElementT>
 RawT* ByteArray::NewImpl(const Class& cls,
                          const ElementT* data,
                          intptr_t len,
                          Heap::Space space) {
+  if (len < 0 || len > HandleT::kMaxElements) {
+    // This should be caught before we reach here.
+    FATAL1("Fatal error in ByteArray::NewImpl: invalid len %ld\n", len);
+  }
   HandleT& result = HandleT::Handle();
   {
     RawObject* raw = Object::Allocate(cls, HandleT::InstanceSize(len), space);
     NoGCScope no_gc;
     result ^= raw;
     result.SetLength(len);
     if (len > 0) {
       memmove(result.ByteAddr(0), data, result.ByteLength());
     }
   }
@@ skipping 639 matching lines @@
   StorePointer(&raw_ptr()->pattern_, pattern.raw());
 }
 
 
 void JSRegExp::set_num_bracket_expressions(intptr_t value) const {
   raw_ptr()->num_bracket_expressions_ = Smi::New(value);
 }
 
 
 RawJSRegExp* JSRegExp::New(intptr_t len, Heap::Space space) {
+  if (len < 0 || len > kMaxElements) {
+    // This should be caught before we reach here.
+    FATAL1("Fatal error in JSRegexp::New: invalid len %ld\n", len);
+  }
   const Class& cls = Class::Handle(
       Isolate::Current()->object_store()->jsregexp_class());
   JSRegExp& result = JSRegExp::Handle();
   {
     RawObject* raw = Object::Allocate(cls,
                                       JSRegExp::InstanceSize(len),
                                       space);
     NoGCScope no_gc;
     result ^= raw;
     result.set_type(kUnitialized);
@@ skipping 64 matching lines @@
   const String& str = String::Handle(pattern());
   const char* format = "JSRegExp: pattern=%s flags=%s";
   intptr_t len = OS::SNPrint(NULL, 0, format, str.ToCString(), Flags());
   char* chars = reinterpret_cast<char*>(
       Isolate::Current()->current_zone()->Allocate(len + 1));
   OS::SNPrint(chars, (len + 1), format, str.ToCString(), Flags());
   return chars;
 }
 
 }  // namespace dart