Enforce length/size limits for variable size heap object in order to

vm/object.cc

 // Copyright (c) 2012, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 #include "vm/object.h"
 
 #include "include/dart_api.h"
 #include "platform/assert.h"
 #include "vm/assembler.h"
 #include "vm/bigint_operations.h"
@@ skipping 3440 matching lines @@
     if (!type.IsInstantiated()) {
       type = type.InstantiateFrom(instantiator_type_arguments);
     }
     instantiated_array.SetTypeAt(i, type);
   }
   return instantiated_array.raw();
 }
 
 
 RawTypeArguments* TypeArguments::New(intptr_t len, Heap::Space space) {
-  if ((len < 0) || (len > kMaxTypes)) {
-    // TODO(iposva): Should we throw an illegal parameter exception?
-    UNIMPLEMENTED();
-    return null();
+  if (len < 0 || len > kMaxElements) {
+    // This should be caught before we reach here.
+    FATAL1("Fatal error in TypeArguments::New: invalid len %ld\n", len);
   }
-
   TypeArguments& result = TypeArguments::Handle();
   {
     RawObject* raw = Object::Allocate(TypeArguments::kInstanceKind,
                                       TypeArguments::InstanceSize(len),
                                       space);
     NoGCScope no_gc;
     result ^= raw;
     // Length must be set before we start storing into the array.
     result.SetLength(len);
   }
@@ skipping 1235 matching lines @@
     iterator.Advance();
     kind = iterator.CurrentTokenKind();
     index += 1;
   }
   return iterator.CurrentPosition();
 }
 
 
 RawTokenStream* TokenStream::New(intptr_t len) {
   ASSERT(Object::token_stream_class() != Class::null());
+  if (len < 0 || len > kMaxElements) {
+    // This should be caught before we reach here.
+    FATAL1("Fatal error in TokenStream::New: invalid len %ld\n", len);
+  }
   TokenStream& result = TokenStream::Handle();
   {
     RawObject* raw = Object::Allocate(TokenStream::kInstanceKind,
                                       TokenStream::InstanceSize(len),
                                       Heap::kOld);
     NoGCScope no_gc;
     result ^= raw;
     result.SetLength(len);
   }
   return result.raw();
@@ skipping 1734 matching lines @@
         return error.raw();
       }
     }
   }
   return error.raw();
 }
 
 
 RawInstructions* Instructions::New(intptr_t size) {
   ASSERT(Object::instructions_class() != Class::null());
+  if (size < 0 || size > kMaxElements) {
+    // This should be caught before we reach here.
+    FATAL1("Fatal error in Instructions::New: invalid size %ld\n", size);
+  }
   Instructions& result = Instructions::Handle();
   {
     uword aligned_size = Instructions::InstanceSize(size);
     RawObject* raw = Object::Allocate(Instructions::kInstanceKind,
                                       aligned_size,
                                       Heap::kCode);
     NoGCScope no_gc;
     // TODO(iposva): Remove premarking once old and code spaces are merged.
     raw->SetMarkBit();
     result ^= raw;
@@ skipping 65 matching lines @@
 }
 
 
 void PcDescriptors::SetTryIndex(intptr_t index, intptr_t value) const {
   *(EntryAddr(index, kTryIndexEntry)) = value;
 }
 
 
 RawPcDescriptors* PcDescriptors::New(intptr_t num_descriptors) {
   ASSERT(Object::pc_descriptors_class() != Class::null());
+  if (num_descriptors < 0 || num_descriptors > kMaxElements) {
+    // This should be caught before we reach here.
+    FATAL1("Fatal error in PcDescriptors::New: invalid num_descriptors %ld\n",
+           num_descriptors);
+  }
   PcDescriptors& result = PcDescriptors::Handle();
   {
     uword size = PcDescriptors::InstanceSize(num_descriptors);
     RawObject* raw = Object::Allocate(PcDescriptors::kInstanceKind,
                                       size,
                                       Heap::kOld);
     NoGCScope no_gc;
     result ^= raw;
     result.SetLength(num_descriptors);
   }
@@ skipping 106 matching lines @@
     *byte_addr &= ~byte_mask;
   }
 }
 
 
 RawStackmap* Stackmap::New(uword pc_offset, BitmapBuilder* bmap) {
   ASSERT(Object::stackmap_class() != Class::null());
   ASSERT(bmap != NULL);
   Stackmap& result = Stackmap::Handle();
   intptr_t size = bmap->SizeInBytes();
+  if (size < 0 || size > kMaxElements) {
+    // This should be caught before we reach here.
+    FATAL1("Fatal error in PcDescriptors::New: invalid size %ld\n", size);
+  }
   {
     // Stackmap data objects are associated with a code object, allocate them
     // in old generation.
     RawObject* raw = Object::Allocate(Stackmap::kInstanceKind,
                                       Stackmap::InstanceSize(size),
                                       Heap::kOld);
     NoGCScope no_gc;
     result ^= raw;
     result.set_bitmap_size_in_bytes(size);
   }
@@ skipping 66 matching lines @@
 
 
 const char* LocalVarDescriptors::ToCString() const {
   UNIMPLEMENTED();
   return "LocalVarDescriptors";
 }
 
 
 RawLocalVarDescriptors* LocalVarDescriptors::New(intptr_t num_variables) {
   ASSERT(Object::var_descriptors_class() != Class::null());
+  if (num_variables < 0 || num_variables > kMaxElements) {
+    // This should be caught before we reach here.
+    FATAL1("Fatal error in LocalVarDescriptors::New: "
+           "invalid num_variables %ld\n", num_variables);
+  }
   LocalVarDescriptors& result = LocalVarDescriptors::Handle();
   {
     uword size = LocalVarDescriptors::InstanceSize(num_variables);
     RawObject* raw = Object::Allocate(LocalVarDescriptors::kInstanceKind,
                                       size,
                                       Heap::kOld);
     NoGCScope no_gc;
     result ^= raw;
     result.raw_ptr()->length_ = num_variables;
   }
@@ skipping 36 matching lines @@
 
 
 void ExceptionHandlers::SetHandlerPC(intptr_t index,
                                      intptr_t value) const {
   *(EntryAddr(index, kHandlerPcEntry)) = value;
 }
 
 
 RawExceptionHandlers* ExceptionHandlers::New(intptr_t num_handlers) {
   ASSERT(Object::exception_handlers_class() != Class::null());
+  if (num_handlers < 0 || num_handlers > kMaxElements) {
+    // This should be caught before we reach here.
+    FATAL1("Fatal error in ExceptionHandlers::New: invalid num_handlers %ld\n",
+           num_handlers);
+  }
   ExceptionHandlers& result = ExceptionHandlers::Handle();
   {
     uword size = ExceptionHandlers::InstanceSize(num_handlers);
     RawObject* raw = Object::Allocate(ExceptionHandlers::kInstanceKind,
                                       size,
                                       Heap::kOld);
     NoGCScope no_gc;
     result ^= raw;
     result.SetLength(num_handlers);
   }
@@ skipping 22 matching lines @@
                          "%ld => 0x%x\n",
                          TryIndex(i),
                          HandlerPC(i));
   }
   return buffer;
 }
 
 
 Code::Comments& Code::Comments::New(intptr_t count) {
   Comments* comments;
+  if (count < 0 || count > (kIntptrMax / kNumberOfEntries)) {
+    // This should be caught before we reach here.
+    FATAL1("Fatal error in Code::Comments::New: invalid count %ld\n", count);
+  }
   if (count == 0) {
     comments = new Comments(Array::Empty());
   } else {
     comments = new Comments(Array::New(count * kNumberOfEntries));
   }
   return *comments;
 }
 
 
 intptr_t Code::Comments::Length() const {
@@ skipping 41 matching lines @@
   Comments* comments = new Code::Comments(raw_ptr()->comments_);
   return *comments;
 }
 
 
 void Code::set_comments(const Code::Comments& comments) const {
   StorePointer(&raw_ptr()->comments_, comments.comments_.raw());
 }
 
 
-RawCode* Code::New(int pointer_offsets_length) {
+RawCode* Code::New(intptr_t pointer_offsets_length) {
+  if (pointer_offsets_length < 0 || pointer_offsets_length > kMaxElements) {
+    // This should be caught before we reach here.
+    FATAL1("Fatal error in Code::New: invalid pointer_offsets_length %ld\n",
+           pointer_offsets_length);
+  }
   ASSERT(Object::code_class() != Class::null());
   Code& result = Code::Handle();
   {
     uword size = Code::InstanceSize(pointer_offsets_length);
     RawObject* raw = Object::Allocate(Code::kInstanceKind, size, Heap::kOld);
     NoGCScope no_gc;
     result ^= raw;
     result.set_pointer_offsets_length(pointer_offsets_length);
     result.set_is_optimized(false);
     result.set_comments(Comments::New(0));
@@ skipping 217 matching lines @@
   // If the code has stackmaps, it must have them for all safepoints.
   UNREACHABLE();
   return Stackmap::null();
 }
 
 
 RawContext* Context::New(intptr_t num_variables, Heap::Space space) {
   ASSERT(num_variables >= 0);
   ASSERT(Object::context_class() != Class::null());
 
+  if (num_variables < 0 || num_variables > kMaxElements) {
+    // This should be caught before we reach here.
+    FATAL1("Fatal error in Context::New: invalid num_variables %ld\n",
+           num_variables);
+  }
   Context& result = Context::Handle();
   {
     RawObject* raw = Object::Allocate(Context::kInstanceKind,
                                       Context::InstanceSize(num_variables),
                                       space);
     NoGCScope no_gc;
     result ^= raw;
     result.set_num_variables(num_variables);
   }
   result.set_isolate(Isolate::Current());
   return result.raw();
 }
 
 
 const char* Context::ToCString() const {
   return "Context";
 }
 
 
 RawContextScope* ContextScope::New(intptr_t num_variables) {
   ASSERT(Object::context_scope_class() != Class::null());
+  if (num_variables < 0 || num_variables > kMaxElements) {
+    // This should be caught before we reach here.
+    FATAL1("Fatal error in ContextScope::New: invalid num_variables %ld\n",
+           num_variables);
+  }
   intptr_t size = ContextScope::InstanceSize(num_variables);
   ContextScope& result = ContextScope::Handle();
   {
     RawObject* raw = Object::Allocate(ContextScope::kInstanceKind,
                                       size,
                                       Heap::kOld);
     NoGCScope no_gc;
     result ^= raw;
     result.set_num_variables(num_variables);
   }
@@ skipping 1205 matching lines @@
     return BigintOperations::Compare(*this, Bigint::Cast(other));
   }
   if (this->IsNegative() == other.IsNegative()) {
     return this->IsNegative() ? -1 : 1;
   }
   return this->IsNegative() ? -1 : 1;
 }
 
 
 RawBigint* Bigint::Allocate(intptr_t length, Heap::Space space) {
-  ASSERT(length >= 0);
+  if (length < 0 || length > kMaxElements) {
+    // This should be caught before we reach here.
+    FATAL1("Fatal error in Bigint::Allocate: invalid length %ld\n", length);
+  }
   ASSERT(Isolate::Current()->object_store()->bigint_class() != Class::null());
   Bigint& result = Bigint::Handle();
   {
     RawObject* raw = Object::Allocate(Bigint::kInstanceKind,
                                       Bigint::InstanceSize(length),
                                       space);
     NoGCScope no_gc;
     result ^= raw;
     result.raw_ptr()->allocated_length_ = length;  // Chunk length allocated.
     result.raw_ptr()->signed_length_ = length;  // Chunk length in use.
@@ skipping 740 matching lines @@
   ASSERT(pos == len);
   return (name_pos == name_len);
 }
 
 
 RawOneByteString* OneByteString::New(intptr_t len,
                                      Heap::Space space) {
   ASSERT(Isolate::Current() == Dart::vm_isolate() ||
          Isolate::Current()->object_store()->one_byte_string_class() !=
          Class::null());
+  if (len < 0 || len > kMaxElements) {
+    // This should be caught before we reach here.
+    FATAL1("Fatal error in OneByteString::New: invalid len %ld\n", len);
+  }
   OneByteString& result = OneByteString::Handle();
   {
     RawObject* raw = Object::Allocate(OneByteString::kInstanceKind,
                                       OneByteString::InstanceSize(len),
                                       space);
     NoGCScope no_gc;
     result ^= raw;
     result.SetLength(len);
     result.SetHash(0);
   }
@@ skipping 118 matching lines @@
     }
     return dststr.raw();
   }
   return TwoByteString::null();
 }
 
 
 RawTwoByteString* TwoByteString::New(intptr_t len,
                                      Heap::Space space) {
   ASSERT(Isolate::Current()->object_store()->two_byte_string_class());
+  if (len < 0 || len > kMaxElements) {
+    // This should be caught before we reach here.
+    FATAL1("Fatal error in TwoByteString::New: invalid len %ld\n", len);
+  }
   TwoByteString& result = TwoByteString::Handle();
   {
     RawObject* raw = Object::Allocate(TwoByteString::kInstanceKind,
                                       TwoByteString::InstanceSize(len),
                                       space);
     NoGCScope no_gc;
     result ^= raw;
     result.SetLength(len);
     result.SetHash(0);
   }
@@ skipping 109 matching lines @@
     return dststr.raw();
   }
   return FourByteString::null();
 }
 
 
 RawFourByteString* FourByteString::New(intptr_t len,
                                        Heap::Space space) {
   ASSERT(Isolate::Current()->object_store()->four_byte_string_class() !=
          Class::null());
+  if (len < 0 || len > kMaxElements) {
+    // This should be caught before we reach here.
+    FATAL1("Fatal error in FourByteString::New: invalid len %ld\n", len);
+  }
   FourByteString& result = FourByteString::Handle();
   {
     RawObject* raw = Object::Allocate(FourByteString::kInstanceKind,
                                       FourByteString::InstanceSize(len),
                                       space);
     NoGCScope no_gc;
     result ^= raw;
     result.SetLength(len);
     result.SetHash(0);
   }
@@ skipping 87 matching lines @@
 
 
 RawExternalOneByteString* ExternalOneByteString::New(
     const uint8_t* data,
     intptr_t len,
     void* peer,
     Dart_PeerFinalizer callback,
     Heap::Space space) {
   ASSERT(Isolate::Current()->object_store()->external_one_byte_string_class() !=
          Class::null());
+  if (len < 0 || len > kMaxElements) {
+    // This should be caught before we reach here.
+    FATAL1("Fatal error in ExternalOneByteString::New: invalid len %ld\n", len);
+  }
   ExternalOneByteString& result = ExternalOneByteString::Handle();
   ExternalStringData<uint8_t>* external_data =
       new ExternalStringData<uint8_t>(data, peer, callback);
   {
     RawObject* raw = Object::Allocate(ExternalOneByteString::kInstanceKind,
                                       ExternalOneByteString::InstanceSize(),
                                       space);
     NoGCScope no_gc;
     result ^= raw;
     result.SetLength(len);
@@ skipping 27 matching lines @@
 
 
 RawExternalTwoByteString* ExternalTwoByteString::New(
     const uint16_t* data,
     intptr_t len,
     void* peer,
     Dart_PeerFinalizer callback,
     Heap::Space space) {
   ASSERT(Isolate::Current()->object_store()->external_two_byte_string_class() !=
          Class::null());
+  if (len < 0 || len > kMaxElements) {
+    // This should be caught before we reach here.
+    FATAL1("Fatal error in ExternalTwoByteString::New: invalid len %ld\n", len);
+  }
   ExternalTwoByteString& result = ExternalTwoByteString::Handle();
   ExternalStringData<uint16_t>* external_data =
       new ExternalStringData<uint16_t>(data, peer, callback);
   {
     RawObject* raw = Object::Allocate(ExternalTwoByteString::kInstanceKind,
                                       ExternalTwoByteString::InstanceSize(),
                                       space);
     NoGCScope no_gc;
     result ^= raw;
     result.SetLength(len);
@@ skipping 17 matching lines @@
 
 
 RawExternalFourByteString* ExternalFourByteString::New(
     const uint32_t* data,
     intptr_t len,
     void* peer,
     Dart_PeerFinalizer callback,
     Heap::Space space) {
   ASSERT(Isolate::Current()->object_store()->
          external_four_byte_string_class() != Class::null());
+  if (len < 0 || len > kMaxElements) {
+    // This should be caught before we reach here.
+    FATAL1("Fatal error in ExternalFourByteString::New: invalid len %ld\n",
+           len);
+  }
   ExternalFourByteString& result = ExternalFourByteString::Handle();
   ExternalStringData<uint32_t>* external_data =
       new ExternalStringData<uint32_t>(data, peer, callback);
   {
     RawObject* raw = Object::Allocate(ExternalFourByteString::kInstanceKind,
                                       ExternalFourByteString::InstanceSize(),
                                       space);
     NoGCScope no_gc;
     result ^= raw;
     result.SetLength(len);
@@ skipping 83 matching lines @@
 
 RawArray* Array::New(intptr_t len, Heap::Space space) {
   ObjectStore* object_store = Isolate::Current()->object_store();
   ASSERT(object_store->array_class() != Class::null());
   Class& cls = Class::Handle(object_store->array_class());
   return New(cls, len, space);
 }
 
 
 RawArray* Array::New(const Class& cls, intptr_t len, Heap::Space space) {
-  if ((len < 0) || (len > kMaxArrayElements)) {
-    // TODO(srdjan): Verify that illegal argument is the right thing to throw.
-    GrowableArray<const Object*> args;
-    args.Add(&Smi::Handle(Smi::New(len)));
-    Exceptions::ThrowByType(Exceptions::kIllegalArgument, args);
+  if (len < 0 || len > Array::kMaxElements) {
+    // This should be caught before we reach here.
+    FATAL1("Fatal error in Array::New: invalid len %ld\n", len);
   }
   Array& result = Array::Handle();
   {
     RawObject* raw = Object::Allocate(cls.id(),
                                       Array::InstanceSize(len),
                                       space);
     NoGCScope no_gc;
     result ^= raw;
     result.SetLength(len);
   }
@@ skipping 280 matching lines @@
 }
 
 
 template<typename HandleT, typename RawT, typename ElementT>
 RawT* ByteArray::NewExternalImpl(const Class& cls,
                                  ElementT* data,
                                  intptr_t len,
                                  void* peer,
                                  Dart_PeerFinalizer callback,
                                  Heap::Space space) {
+  if (len < 0 || len > HandleT::kMaxElements) {
+    // This should be caught before we reach here.
+    FATAL1("Fatal error in ByteArray::NewExternalImpl: invalid len %ld\n", len);
+  }
   HandleT& result = HandleT::Handle();
   ExternalByteArrayData<ElementT>* external_data =
       new ExternalByteArrayData<ElementT>(data, peer, callback);
   {
     RawObject* raw = Object::Allocate(cls.id(), HandleT::InstanceSize(), space);
     NoGCScope no_gc;
     result ^= raw;
     result.SetLength(len);
     result.SetExternalData(external_data);
   }
@@ skipping 18 matching lines @@
 
 const char* ByteArray::ToCString() const {
   // ByteArray is an abstract class.
   UNREACHABLE();
   return "ByteArray";
 }
 
 
 template<typename HandleT, typename RawT>
 RawT* ByteArray::NewImpl(const Class& cls, intptr_t len, Heap::Space space) {
+  if (len < 0 || len > HandleT::kMaxElements) {
+    // This should be caught before we reach here.
+    FATAL1("Fatal error in ByteArray::NewImpl: invalid len %ld\n", len);
+  }
   HandleT& result = HandleT::Handle();
   {
     RawObject* raw = Object::Allocate(cls.id(),
                                       HandleT::InstanceSize(len),
                                       space);
     NoGCScope no_gc;
     result ^= raw;
     result.SetLength(len);
     if (len > 0) {
       memset(result.ByteAddr(0), 0, result.ByteLength());
     }
   }
   return result.raw();
 }
 
 
 template<typename HandleT, typename RawT, typename ElementT>
 RawT* ByteArray::NewImpl(const Class& cls,
                          const ElementT* data,
                          intptr_t len,
                          Heap::Space space) {
+  if (len < 0 || len > HandleT::kMaxElements) {
+    // This should be caught before we reach here.
+    FATAL1("Fatal error in ByteArray::NewImpl: invalid len %ld\n", len);
+  }
   HandleT& result = HandleT::Handle();
   {
     RawObject* raw = Object::Allocate(cls.id(),
                                       HandleT::InstanceSize(len),
                                       space);
     NoGCScope no_gc;
     result ^= raw;
     result.SetLength(len);
     if (len > 0) {
       memmove(result.ByteAddr(0), data, result.ByteLength());
@@ skipping 682 matching lines @@
 
 
 void JSRegExp::set_num_bracket_expressions(intptr_t value) const {
   raw_ptr()->num_bracket_expressions_ = Smi::New(value);
 }
 
 
 RawJSRegExp* JSRegExp::New(intptr_t len, Heap::Space space) {
   ASSERT(Isolate::Current()->object_store()->jsregexp_class() !=
          Class::null());
+  if (len < 0 || len > kMaxElements) {
+    // This should be caught before we reach here.
+    FATAL1("Fatal error in JSRegexp::New: invalid len %ld\n", len);
+  }
   JSRegExp& result = JSRegExp::Handle();
   {
     RawObject* raw = Object::Allocate(JSRegExp::kInstanceKind,
                                       JSRegExp::InstanceSize(len),
                                       space);
     NoGCScope no_gc;
     result ^= raw;
     result.set_type(kUnitialized);
     result.set_flags(0);
     result.SetLength(len);
@@ skipping 62 matching lines @@
   const String& str = String::Handle(pattern());
   const char* format = "JSRegExp: pattern=%s flags=%s";
   intptr_t len = OS::SNPrint(NULL, 0, format, str.ToCString(), Flags());
   char* chars = reinterpret_cast<char*>(
       Isolate::Current()->current_zone()->Allocate(len + 1));
   OS::SNPrint(chars, (len + 1), format, str.ToCString(), Flags());
   return chars;
 }
 
 }  // namespace dart