Enforce length/size limits for variable size heap object in order to

vm/object.cc

Index: vm/object.cc
===================================================================
--- vm/object.cc	(revision 9641)
+++ vm/object.cc	(working copy)
@@ -3367,12 +3367,10 @@
 
 
 RawTypeArguments* TypeArguments::New(intptr_t len, Heap::Space space) {
-  if ((len < 0) || (len > kMaxTypes)) {
-    // TODO(iposva): Should we throw an illegal parameter exception?
-    UNIMPLEMENTED();
-    return null();
+  if (len < 0 || len > kMaxElements) {
+    // This should be caught before we reach here.
+    FATAL1("Fatal error in TypeArguments::New: invalid len %ld\n", len);
   }
-
   const Class& type_arguments_class =
       Class::Handle(Object::type_arguments_class());
   TypeArguments& result = TypeArguments::Handle();
@@ -4528,6 +4526,10 @@
 
 
 RawTokenStream* TokenStream::New(intptr_t len) {
+  if (len < 0 || len > kMaxElements) {
+    // This should be caught before we reach here.
+    FATAL1("Fatal error in TokenStream::New: invalid len %ld\n", len);
+  }
   const Class& token_stream_class = Class::Handle(Object::token_stream_class());
   TokenStream& result = TokenStream::Handle();
   {
@@ -6275,6 +6277,10 @@
 
 
 RawInstructions* Instructions::New(intptr_t size) {
+  if (size < 0 || size > kMaxElements) {
+    // This should be caught before we reach here.
+    FATAL1("Fatal error in Instructions::New: invalid size %ld\n", size);
+  }
   const Class& instructions_class = Class::Handle(Object::instructions_class());
   Instructions& result = Instructions::Handle();
   {
@@ -6360,6 +6366,11 @@
 
 
 RawPcDescriptors* PcDescriptors::New(intptr_t num_descriptors) {
+  if (num_descriptors < 0 || num_descriptors > kMaxElements) {
+    // This should be caught before we reach here.
+    FATAL1("Fatal error in PcDescriptors::New: invalid num_descriptors %ld\n",
+           num_descriptors);
+  }
   const Class& cls = Class::Handle(Object::pc_descriptors_class());
   PcDescriptors& result = PcDescriptors::Handle();
   {
@@ -6486,6 +6497,10 @@
   ASSERT(bmap != NULL);
   Stackmap& result = Stackmap::Handle();
   intptr_t size = bmap->SizeInBytes();
+  if (size < 0 || size > kMaxElements) {
+    // This should be caught before we reach here.
+    FATAL1("Fatal error in PcDescriptors::New: invalid size %ld\n", size);
+  }
   {
     // Stackmap data objects are associated with a code object, allocate them
     // in old generation.
@@ -6570,6 +6585,11 @@
 
 
 RawLocalVarDescriptors* LocalVarDescriptors::New(intptr_t num_variables) {
+  if (num_variables < 0 || num_variables > kMaxElements) {
+    // This should be caught before we reach here.
+    FATAL1("Fatal error in LocalVarDescriptors::New: "
+           "invalid num_variables %ld\n", num_variables);
+  }
   const Class& cls = Class::Handle(Object::var_descriptors_class());
   LocalVarDescriptors& result = LocalVarDescriptors::Handle();
   {
@@ -6624,6 +6644,11 @@
 
 
 RawExceptionHandlers* ExceptionHandlers::New(intptr_t num_handlers) {
+  if (num_handlers < 0 || num_handlers > kMaxElements) {
+    // This should be caught before we reach here.
+    FATAL1("Fatal error in ExceptionHandlers::New: invalid num_handlers %ld\n",
+           num_handlers);
+  }
   const Class& cls = Class::Handle(Object::exception_handlers_class());
   ExceptionHandlers& result = ExceptionHandlers::Handle();
   {
@@ -6665,6 +6690,10 @@
 
 Code::Comments& Code::Comments::New(intptr_t count) {
   Comments* comments;
+  if (count < 0 || count > (kIntptrMax / kNumberOfEntries)) {
+    // This should be caught before we reach here.
+    FATAL1("Fatal error in Code::Comments::New: invalid count %ld\n", count);
+  }
   if (count == 0) {
     comments = new Comments(Array::Empty());
   } else {
@@ -6726,7 +6755,12 @@
 }
 
 
-RawCode* Code::New(int pointer_offsets_length) {
+RawCode* Code::New(intptr_t pointer_offsets_length) {
+  if (pointer_offsets_length < 0 || pointer_offsets_length > kMaxElements) {
+    // This should be caught before we reach here.
+    FATAL1("Fatal error in Code::New: invalid pointer_offsets_length %ld\n",
+           pointer_offsets_length);
+  }
   const Class& cls = Class::Handle(Object::code_class());
   Code& result = Code::Handle();
   {
@@ -6954,8 +6988,11 @@
 
 
 RawContext* Context::New(intptr_t num_variables, Heap::Space space) {
-  ASSERT(num_variables >= 0);
-
+  if (num_variables < 0 || num_variables > kMaxElements) {
+    // This should be caught before we reach here.
+    FATAL1("Fatal error in Context::New: invalid num_variables %ld\n",
+           num_variables);
+  }
   const Class& context_class = Class::Handle(Object::context_class());
   Context& result = Context::Handle();
   {
@@ -6977,6 +7014,11 @@
 
 
 RawContextScope* ContextScope::New(intptr_t num_variables) {
+  if (num_variables < 0 || num_variables > kMaxElements) {
+    // This should be caught before we reach here.
+    FATAL1("Fatal error in ContextScope::New: invalid num_variables %ld\n",
+           num_variables);
+  }
   const Class& context_scope_class =
     Class::Handle(Object::context_scope_class());
   intptr_t size = ContextScope::InstanceSize(num_variables);
@@ -8146,7 +8188,10 @@
 
 
 RawBigint* Bigint::Allocate(intptr_t length, Heap::Space space) {
-  ASSERT(length >= 0);
+  if (length < 0 || length > kMaxElements) {
+    // This should be caught before we reach here.
+    FATAL1("Fatal error in Bigint::Allocate: invalid length %ld\n", length);
+  }
   Isolate* isolate = Isolate::Current();
   const Class& cls = Class::Handle(isolate->object_store()->bigint_class());
   Bigint& result = Bigint::Handle();
@@ -9039,6 +9084,10 @@
 
 RawOneByteString* OneByteString::New(intptr_t len,
                                      Heap::Space space) {
+  if (len < 0 || len > kMaxElements) {
+    // This should be caught before we reach here.
+    FATAL1("Fatal error in OneByteString::New: invalid len %ld\n", len);
+  }
   Isolate* isolate = Isolate::Current();
 
   const Class& cls =
@@ -9180,6 +9229,10 @@
 
 RawTwoByteString* TwoByteString::New(intptr_t len,
                                      Heap::Space space) {
+  if (len < 0 || len > kMaxElements) {
+    // This should be caught before we reach here.
+    FATAL1("Fatal error in TwoByteString::New: invalid len %ld\n", len);
+  }
   Isolate* isolate = Isolate::Current();
 
   const Class& cls =
@@ -9311,6 +9364,10 @@
 
 RawFourByteString* FourByteString::New(intptr_t len,
                                        Heap::Space space) {
+  if (len < 0 || len > kMaxElements) {
+    // This should be caught before we reach here.
+    FATAL1("Fatal error in FourByteString::New: invalid len %ld\n", len);
+  }
   Isolate* isolate = Isolate::Current();
 
   const Class& cls =
@@ -9421,6 +9478,14 @@
     Dart_PeerFinalizer callback,
     Heap::Space space) {
   Isolate* isolate = Isolate::Current();
+  if (len < 0) {

[cshapiro, 2012/07/17 22:54:30]

This should check against a kMaxElements, preferably the same kMaxElements in
the non-external OneByteString type.

External types will be serialized as their internal counterpart in a snapshot.

[turnidge, 2012/07/18 18:17:04]

I went further than that.  I have made all strings share a common kMaxElements. 
Seems simpler.

+    // This should be caught before we reach here.
+    //
+    // Note that we don't have a max length for an external one byte
+    // string.  We can safely compute the offset of all array elements
+    // without causing overflow.
+    FATAL1("Fatal error in ExternalOneByteString::New: invalid len %ld\n", len);
+  }
 
   const Class& cls =
       Class::Handle(isolate->object_store()->external_one_byte_string_class());
@@ -9470,6 +9535,10 @@
     Dart_PeerFinalizer callback,
     Heap::Space space) {
   Isolate* isolate = Isolate::Current();
+  if (len < 0 || len > kMaxElements) {
+    // This should be caught before we reach here.
+    FATAL1("Fatal error in ExternalTwoByteString::New: invalid len %ld\n", len);
+  }
 
   const Class& cls =
       Class::Handle(isolate->object_store()->external_two_byte_string_class());
@@ -9509,6 +9578,11 @@
     Dart_PeerFinalizer callback,
     Heap::Space space) {
   Isolate* isolate = Isolate::Current();
+  if (len < 0 || len > kMaxElements) {
+    // This should be caught before we reach here.
+    FATAL1("Fatal error in ExternalFourByteString::New: invalid len %ld\n",
+           len);
+  }
 
   const Class& cls =
       Class::Handle(isolate->object_store()->external_four_byte_string_class());
@@ -9614,11 +9688,9 @@
 
 
 RawArray* Array::New(const Class& cls, intptr_t len, Heap::Space space) {
-  if ((len < 0) || (len > kMaxArrayElements)) {
-    // TODO(srdjan): Verify that illegal argument is the right thing to throw.
-    GrowableArray<const Object*> args;
-    args.Add(&Smi::Handle(Smi::New(len)));
-    Exceptions::ThrowByType(Exceptions::kIllegalArgument, args);
+  if (len < 0 || len > Array::kMaxElements) {
+    // This should be caught before we reach here.
+    FATAL1("Fatal error in Array::New: invalid len %ld\n", len);
   }
   Array& result = Array::Handle();
   {
@@ -9918,6 +9990,12 @@
                                  void* peer,
                                  Dart_PeerFinalizer callback,
                                  Heap::Space space) {
+  if (len < 0) {

[cshapiro, 2012/07/17 22:54:30]

This needs an upper bound, use the non-external one.

[turnidge, 2012/07/18 18:17:04]

Done.

+    // This should be caught before we reach here.
+    //
+    // TODO(turnidge): Determine whether we need to check for a max here too.
+    FATAL1("Fatal error in ByteArray::NewExternalImpl: invalid len %ld\n", len);
+  }
   HandleT& result = HandleT::Handle();
   ExternalByteArrayData<ElementT>* external_data =
       new ExternalByteArrayData<ElementT>(data, peer, callback);
@@ -9956,6 +10034,10 @@
 
 template<typename HandleT, typename RawT>
 RawT* ByteArray::NewImpl(const Class& cls, intptr_t len, Heap::Space space) {
+  if (len < 0 || len > HandleT::kMaxElements) {
+    // This should be caught before we reach here.
+    FATAL1("Fatal error in ByteArray::NewImpl: invalid len %ld\n", len);
+  }
   HandleT& result = HandleT::Handle();
   {
     RawObject* raw = Object::Allocate(cls, HandleT::InstanceSize(len), space);
@@ -9975,6 +10057,10 @@
                          const ElementT* data,
                          intptr_t len,
                          Heap::Space space) {
+  if (len < 0 || len > HandleT::kMaxElements) {
+    // This should be caught before we reach here.
+    FATAL1("Fatal error in ByteArray::NewImpl: invalid len %ld\n", len);
+  }
   HandleT& result = HandleT::Handle();
   {
     RawObject* raw = Object::Allocate(cls, HandleT::InstanceSize(len), space);
@@ -10634,6 +10720,10 @@
 
 
 RawJSRegExp* JSRegExp::New(intptr_t len, Heap::Space space) {
+  if (len < 0 || len > kMaxElements) {
+    // This should be caught before we reach here.
+    FATAL1("Fatal error in JSRegexp::New: invalid len %ld\n", len);
+  }
   const Class& cls = Class::Handle(
       Isolate::Current()->object_store()->jsregexp_class());
   JSRegExp& result = JSRegExp::Handle();