Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(242)

Unified Diff: src/runtime.cc

Issue 6529020: Fix issue 1160: check array elements in ArrayJoin. (Closed)
Patch Set: Created 9 years, 10 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View side-by-side diff with in-line comments
Download patch
« no previous file with comments | « no previous file | test/mjsunit/regress/regress-1160.js » ('j') | no next file with comments »
Expand Comments ('e') | Collapse Comments ('c') | Show Comments Hide Comments ('s')
Index: src/runtime.cc
diff --git a/src/runtime.cc b/src/runtime.cc
index 75bb1ae1f133ade6824baf3afd4f2a1cd3b40825..48ff69f5d273071e0615743e2b2760f2abb71e70 100644
--- a/src/runtime.cc
+++ b/src/runtime.cc
@@ -5849,7 +5849,12 @@ static MaybeObject* Runtime_StringBuilderJoin(Arguments args) {
}
int length = (array_length - 1) * separator_length;
for (int i = 0; i < array_length; i++) {
- String* element = String::cast(fixed_array->get(i));
+ Object* element_obj = fixed_array->get(i);
+ if (!element_obj->IsString()) {
+ // TODO(1161): handle this case.
+ return Top::Throw(Heap::illegal_argument_symbol());
+ }
+ String* element = String::cast(element_obj);
int increment = element->length();
if (increment > String::kMaxLength - length) {
Top::context()->mark_out_of_memory();
« no previous file with comments | « no previous file | test/mjsunit/regress/regress-1160.js » ('j') | no next file with comments »

Powered by Google App Engine
This is Rietveld 408576698