OLD | NEW |
1 // Copyright 2012 the V8 project authors. All rights reserved. | 1 // Copyright 2012 the V8 project authors. All rights reserved. |
2 // Redistribution and use in source and binary forms, with or without | 2 // Redistribution and use in source and binary forms, with or without |
3 // modification, are permitted provided that the following conditions are | 3 // modification, are permitted provided that the following conditions are |
4 // met: | 4 // met: |
5 // | 5 // |
6 // * Redistributions of source code must retain the above copyright | 6 // * Redistributions of source code must retain the above copyright |
7 // notice, this list of conditions and the following disclaimer. | 7 // notice, this list of conditions and the following disclaimer. |
8 // * Redistributions in binary form must reproduce the above | 8 // * Redistributions in binary form must reproduce the above |
9 // copyright notice, this list of conditions and the following | 9 // copyright notice, this list of conditions and the following |
10 // disclaimer in the documentation and/or other materials provided | 10 // disclaimer in the documentation and/or other materials provided |
(...skipping 486 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
497 if (raw_frame->unchecked_code() == apply_builtin) { | 497 if (raw_frame->unchecked_code() == apply_builtin) { |
498 PrintF("apply from "); | 498 PrintF("apply from "); |
499 it.Advance(); | 499 it.Advance(); |
500 raw_frame = it.frame(); | 500 raw_frame = it.frame(); |
501 } | 501 } |
502 } | 502 } |
503 JavaScriptFrame::PrintTop(stdout, false, true); | 503 JavaScriptFrame::PrintTop(stdout, false, true); |
504 } | 504 } |
505 | 505 |
506 | 506 |
507 void CheckArrayAbuse(JSObject* obj, const char* op, uint32_t key) { | 507 void CheckArrayAbuse(JSObject* obj, const char* op, uint32_t key, |
| 508 bool allow_list_append_growth) { |
508 Object* raw_length = NULL; | 509 Object* raw_length = NULL; |
509 const char* elements_type = "array"; | 510 const char* elements_type = "array"; |
510 if (obj->IsJSArray()) { | 511 if (obj->IsJSArray()) { |
511 JSArray* array = JSArray::cast(obj); | 512 JSArray* array = JSArray::cast(obj); |
512 raw_length = array->length(); | 513 raw_length = array->length(); |
513 } else { | 514 } else { |
514 raw_length = Smi::FromInt(obj->elements()->length()); | 515 raw_length = Smi::FromInt(obj->elements()->length()); |
515 elements_type = "object"; | 516 elements_type = "object"; |
516 } | 517 } |
517 | 518 |
518 if (raw_length->IsNumber()) { | 519 if (raw_length->IsNumber()) { |
519 double n = raw_length->Number(); | 520 double n = raw_length->Number(); |
520 if (FastI2D(FastD2UI(n)) == n) { | 521 if (FastI2D(FastD2UI(n)) == n) { |
521 int32_t int32_length = DoubleToInt32(n); | 522 int32_t int32_length = DoubleToInt32(n); |
522 if (key >= static_cast<uint32_t>(int32_length)) { | 523 uint32_t compare_length = static_cast<uint32_t>(int32_length); |
| 524 if (allow_list_append_growth) compare_length++; |
| 525 if (key >= compare_length) { |
523 PrintF("[OOB %s %s (%s length = %d, element accessed = %d) in ", | 526 PrintF("[OOB %s %s (%s length = %d, element accessed = %d) in ", |
524 elements_type, op, elements_type, | 527 elements_type, op, elements_type, |
525 static_cast<int>(int32_length), | 528 static_cast<int>(int32_length), |
526 static_cast<int>(key)); | 529 static_cast<int>(key)); |
527 TraceTopFrame(); | 530 TraceTopFrame(); |
528 PrintF("]\n"); | 531 PrintF("]\n"); |
529 } | 532 } |
530 } else { | 533 } else { |
531 PrintF("[%s elements length not integer value in ", elements_type); | 534 PrintF("[%s elements length not integer value in ", elements_type); |
532 TraceTopFrame(); | 535 TraceTopFrame(); |
(...skipping 88 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
621 } | 624 } |
622 | 625 |
623 MUST_USE_RESULT virtual MaybeObject* Get(Object* receiver, | 626 MUST_USE_RESULT virtual MaybeObject* Get(Object* receiver, |
624 JSObject* holder, | 627 JSObject* holder, |
625 uint32_t key, | 628 uint32_t key, |
626 FixedArrayBase* backing_store) { | 629 FixedArrayBase* backing_store) { |
627 if (backing_store == NULL) { | 630 if (backing_store == NULL) { |
628 backing_store = holder->elements(); | 631 backing_store = holder->elements(); |
629 } | 632 } |
630 | 633 |
631 if (FLAG_trace_array_abuse) { | 634 if (!IsExternalArrayElementsKind(ElementsTraits::Kind) && |
632 CheckArrayAbuse(holder, "element read", key); | 635 FLAG_trace_js_array_abuse) { |
| 636 CheckArrayAbuse(holder, "elements read", key); |
| 637 } |
| 638 |
| 639 if (IsExternalArrayElementsKind(ElementsTraits::Kind) && |
| 640 FLAG_trace_external_array_abuse) { |
| 641 CheckArrayAbuse(holder, "external elements read", key); |
633 } | 642 } |
634 | 643 |
635 return ElementsAccessorSubclass::GetImpl( | 644 return ElementsAccessorSubclass::GetImpl( |
636 receiver, holder, key, backing_store); | 645 receiver, holder, key, backing_store); |
637 } | 646 } |
638 | 647 |
639 MUST_USE_RESULT static MaybeObject* GetImpl(Object* receiver, | 648 MUST_USE_RESULT static MaybeObject* GetImpl(Object* receiver, |
640 JSObject* obj, | 649 JSObject* obj, |
641 uint32_t key, | 650 uint32_t key, |
642 FixedArrayBase* backing_store) { | 651 FixedArrayBase* backing_store) { |
(...skipping 1315 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
1958 if (!maybe_obj->To(&new_backing_store)) return maybe_obj; | 1967 if (!maybe_obj->To(&new_backing_store)) return maybe_obj; |
1959 new_backing_store->set(0, length); | 1968 new_backing_store->set(0, length); |
1960 { MaybeObject* result = array->SetContent(new_backing_store); | 1969 { MaybeObject* result = array->SetContent(new_backing_store); |
1961 if (result->IsFailure()) return result; | 1970 if (result->IsFailure()) return result; |
1962 } | 1971 } |
1963 return array; | 1972 return array; |
1964 } | 1973 } |
1965 | 1974 |
1966 | 1975 |
1967 } } // namespace v8::internal | 1976 } } // namespace v8::internal |
OLD | NEW |