| Index: src/elements.cc
|
| diff --git a/src/elements.cc b/src/elements.cc
|
| index 6459279dea56753cbbdfa194678d77c0cb6b11ea..7f5a573c5d5178de58fcb9b14e785e998aa113be 100644
|
| --- a/src/elements.cc
|
| +++ b/src/elements.cc
|
| @@ -504,7 +504,8 @@ static void TraceTopFrame() {
|
| }
|
|
|
|
|
| -void CheckArrayAbuse(JSObject* obj, const char* op, uint32_t key) {
|
| +void CheckArrayAbuse(JSObject* obj, const char* op, uint32_t key,
|
| + bool allow_list_append_growth) {
|
| Object* raw_length = NULL;
|
| const char* elements_type = "array";
|
| if (obj->IsJSArray()) {
|
| @@ -519,7 +520,9 @@ void CheckArrayAbuse(JSObject* obj, const char* op, uint32_t key) {
|
| double n = raw_length->Number();
|
| if (FastI2D(FastD2UI(n)) == n) {
|
| int32_t int32_length = DoubleToInt32(n);
|
| - if (key >= static_cast<uint32_t>(int32_length)) {
|
| + uint32_t compare_length = static_cast<uint32_t>(int32_length);
|
| + if (allow_list_append_growth) compare_length++;
|
| + if (key >= compare_length) {
|
| PrintF("[OOB %s %s (%s length = %d, element accessed = %d) in ",
|
| elements_type, op, elements_type,
|
| static_cast<int>(int32_length),
|
| @@ -628,8 +631,14 @@ class ElementsAccessorBase : public ElementsAccessor {
|
| backing_store = holder->elements();
|
| }
|
|
|
| - if (FLAG_trace_array_abuse) {
|
| - CheckArrayAbuse(holder, "element read", key);
|
| + if (!IsExternalArrayElementsKind(ElementsTraits::Kind) &&
|
| + FLAG_trace_js_array_abuse) {
|
| + CheckArrayAbuse(holder, "elements read", key);
|
| + }
|
| +
|
| + if (IsExternalArrayElementsKind(ElementsTraits::Kind) &&
|
| + FLAG_trace_external_array_abuse) {
|
| + CheckArrayAbuse(holder, "external elements read", key);
|
| }
|
|
|
| return ElementsAccessorSubclass::GetImpl(
|
|
|