| Index: src/runtime.cc
|
| diff --git a/src/runtime.cc b/src/runtime.cc
|
| index 4e1940d81a08c4097eb81a7e20457ae3379320e6..ab4572d42284736082f5b83b90805c11d9ae5250 100644
|
| --- a/src/runtime.cc
|
| +++ b/src/runtime.cc
|
| @@ -522,7 +522,7 @@ static Object* Runtime_GetTemplateField(Arguments args) {
|
| RUNTIME_ASSERT(type == FUNCTION_TEMPLATE_INFO_TYPE ||
|
| type == OBJECT_TEMPLATE_INFO_TYPE);
|
| RUNTIME_ASSERT(offset > 0);
|
| - if (type == FUNCTION_TEMPLATE_INFO_TYPE) {
|
| + if (type == FUNCTION_TEMPLATE_INFO_TYPE) {
|
| RUNTIME_ASSERT(offset < FunctionTemplateInfo::kSize);
|
| } else {
|
| RUNTIME_ASSERT(offset < ObjectTemplateInfo::kSize);
|
| @@ -3252,8 +3252,8 @@ static Object* Runtime_URIEscape(Arguments args) {
|
| } else {
|
| escaped_length += 3;
|
| }
|
| - // We don't allow strings that are longer than Smi range.
|
| - if (!Smi::IsValid(escaped_length)) {
|
| + // We don't allow strings that are longer than a maximal length.
|
| + if (escaped_length > String::kMaxLength) {
|
| Top::context()->mark_out_of_memory();
|
| return Failure::OutOfMemoryException();
|
| }
|
| @@ -3804,10 +3804,6 @@ static Object* Runtime_StringBuilderConcat(Arguments args) {
|
| } else if (elt->IsString()) {
|
| String* element = String::cast(elt);
|
| int element_length = element->length();
|
| - if (!Smi::IsValid(element_length + position)) {
|
| - Top::context()->mark_out_of_memory();
|
| - return Failure::OutOfMemoryException();
|
| - }
|
| position += element_length;
|
| if (ascii && !element->IsAsciiRepresentation()) {
|
| ascii = false;
|
| @@ -3815,6 +3811,10 @@ static Object* Runtime_StringBuilderConcat(Arguments args) {
|
| } else {
|
| return Top::Throw(Heap::illegal_argument_symbol());
|
| }
|
| + if (position > String::kMaxLength) {
|
| + Top::context()->mark_out_of_memory();
|
| + return Failure::OutOfMemoryException();
|
| + }
|
| }
|
|
|
| int length = position;
|
|
|