Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(165)

Unified Diff: src/objects.cc

Issue 7217005: Fix wrong bounds check on arguments object. (Closed) Base URL: https://v8.googlecode.com/svn/branches/bleeding_edge
Patch Set: Created 9 years, 6 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View side-by-side diff with in-line comments
Download patch
« no previous file with comments | « no previous file | test/mjsunit/arguments.js » ('j') | no next file with comments »
Expand Comments ('e') | Collapse Comments ('c') | Show Comments Hide Comments ('s')
Index: src/objects.cc
diff --git a/src/objects.cc b/src/objects.cc
index 1e67169029071c4ad816207fb50043ce86f2ea8e..6c9f52b2df89839306e30b8f925f87412fc111f4 100644
--- a/src/objects.cc
+++ b/src/objects.cc
@@ -3107,7 +3107,7 @@ MaybeObject* JSObject::DeleteElement(uint32_t index, DeleteMode mode) {
FixedArray* parameter_map = FixedArray::cast(elements());
uint32_t length = parameter_map->length();
Object* probe =
- (index + 2) < length ? parameter_map->get(index + 2) : NULL;
+ index < (length - 2) ? parameter_map->get(index + 2) : NULL;
William Hesse 2011/06/21 08:57:06 Are these parentheses really helpful? Maybe aroun
if (probe != NULL && !probe->IsTheHole()) {
// TODO(kmillikin): We could check if this was the last aliased
// parameter, and revert to normal elements in that case. That
@@ -3554,7 +3554,7 @@ MaybeObject* JSObject::DefineGetterSetter(String* name,
FixedArray* parameter_map = FixedArray::cast(elements());
uint32_t length = parameter_map->length();
Object* probe =
- (index + 2) < length ? parameter_map->get(index + 2) : NULL;
+ index < (length - 2) ? parameter_map->get(index + 2) : NULL;
William Hesse 2011/06/21 08:57:06 Perhaps add an assert that length is >= 2?
if (probe == NULL || probe->IsTheHole()) {
FixedArray* arguments = FixedArray::cast(parameter_map->get(1));
if (arguments->IsDictionary()) {
@@ -3652,7 +3652,7 @@ MaybeObject* JSObject::SetElementCallback(uint32_t index,
// would allow GC of the context.
FixedArray* parameter_map = FixedArray::cast(elements());
uint32_t length = parameter_map->length();
- if (index + 2 < length) {
+ if (index < length - 2) {
parameter_map->set(index + 2, GetHeap()->the_hole_value());
}
parameter_map->set(1, dictionary);
@@ -7902,7 +7902,7 @@ JSObject::LocalElementType JSObject::HasLocalElement(uint32_t index) {
FixedArray* parameter_map = FixedArray::cast(elements());
uint32_t length = parameter_map->length();
Object* probe =
- (index + 2) < length ? parameter_map->get(index + 2) : NULL;
+ index < (length - 2) ? parameter_map->get(index + 2) : NULL;
if (probe != NULL && !probe->IsTheHole()) return FAST_ELEMENT;
// If not aliased, check the arguments.
FixedArray* arguments = FixedArray::cast(parameter_map->get(1));
@@ -8007,7 +8007,7 @@ bool JSObject::HasElementWithReceiver(JSReceiver* receiver, uint32_t index) {
FixedArray* parameter_map = FixedArray::cast(elements());
uint32_t length = parameter_map->length();
Object* probe =
- (index + 2 < length) ? parameter_map->get(index + 2) : NULL;
+ (index < length - 2) ? parameter_map->get(index + 2) : NULL;
if (probe != NULL && !probe->IsTheHole()) return true;
// Not a mapped parameter, check the arguments.
@@ -8549,7 +8549,7 @@ MaybeObject* JSObject::SetElementWithoutInterceptor(uint32_t index,
FixedArray* parameter_map = FixedArray::cast(elements());
uint32_t length = parameter_map->length();
Object* probe =
- (index + 2 < length) ? parameter_map->get(index + 2) : NULL;
+ (index < length - 2) ? parameter_map->get(index + 2) : NULL;
if (probe != NULL && !probe->IsTheHole()) {
Context* context = Context::cast(parameter_map->get(0));
int context_index = Smi::cast(probe)->value();
@@ -8763,7 +8763,7 @@ MaybeObject* JSObject::GetElementWithReceiver(Object* receiver,
FixedArray* parameter_map = FixedArray::cast(elements());
uint32_t length = parameter_map->length();
Object* probe =
- (index + 2 < length) ? parameter_map->get(index + 2) : NULL;
+ (index < length - 2) ? parameter_map->get(index + 2) : NULL;
if (probe != NULL && !probe->IsTheHole()) {
Context* context = Context::cast(parameter_map->get(0));
int context_index = Smi::cast(probe)->value();
« no previous file with comments | « no previous file | test/mjsunit/arguments.js » ('j') | no next file with comments »

Powered by Google App Engine
This is Rietveld 408576698