Fix overflow in WriteQuoteJsonString and SlowQuoteJsonString

src/runtime.cc

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 5230 matching lines @@
 template <typename Char, typename StringType, bool comma>
 static MaybeObject* SlowQuoteJsonString(Isolate* isolate,
                                         Vector<const Char> characters) {
   int length = characters.length();
   const Char* read_cursor = characters.start();
   const Char* end = read_cursor + length;
   const int kSpaceForQuotes = 2 + (comma ? 1 :0);
   int quoted_length = kSpaceForQuotes;
   while (read_cursor < end) {
     Char c = *(read_cursor++);
-    if (sizeof(Char) > 1u && static_cast<unsigned>(c) >= kQuoteTableLength) {
+    if (static_cast<unsigned>(c) >= kQuoteTableLength) {
       quoted_length++;
     } else {
       quoted_length += JsonQuoteLengths[static_cast<unsigned>(c)];
     }
   }
   MaybeObject* new_alloc = AllocateRawString<StringType>(isolate,
                                                          quoted_length);
   Object* new_object;
   if (!new_alloc->ToObject(&new_object)) {
     return new_alloc;
   }
   StringType* new_string = StringType::cast(new_object);
 
   Char* write_cursor = reinterpret_cast<Char*>(
       new_string->address() + SeqString::kHeaderSize);
   if (comma) *(write_cursor++) = ',';
   *(write_cursor++) = '"';
 
   read_cursor = characters.start();
   while (read_cursor < end) {
     Char c = *(read_cursor++);
-    if (sizeof(Char) > 1u && static_cast<unsigned>(c) >= kQuoteTableLength) {
+    if (static_cast<unsigned>(c) >= kQuoteTableLength) {
       *(write_cursor++) = c;
     } else {
       int len = JsonQuoteLengths[static_cast<unsigned>(c)];
       const char* replacement = JsonQuotes +
           static_cast<unsigned>(c) * kJsonQuotesCharactersPerEntry;
       for (int i = 0; i < len; i++) {
         *write_cursor++ = *replacement++;
       }
     }
   }
   *(write_cursor++) = '"';
   return new_string;
 }
 
 
 template <typename SinkChar, typename SourceChar>
 static inline SinkChar* WriteQuoteJsonString(
     Isolate* isolate,
     SinkChar* write_cursor,
     Vector<const SourceChar> characters) {
   // SinkChar is only char if SourceChar is guaranteed to be char.
   ASSERT(sizeof(SinkChar) >= sizeof(SourceChar));
   const SourceChar* read_cursor = characters.start();
   const SourceChar* end = read_cursor + characters.length();
   *(write_cursor++) = '"';
   while (read_cursor < end) {
     SourceChar c = *(read_cursor++);
-    if (sizeof(SourceChar) > 1u &&
-        static_cast<unsigned>(c) >= kQuoteTableLength) {
+    if (static_cast<unsigned>(c) >= kQuoteTableLength) {
       *(write_cursor++) = static_cast<SinkChar>(c);
     } else {
       int len = JsonQuoteLengths[static_cast<unsigned>(c)];
       const char* replacement = JsonQuotes +
           static_cast<unsigned>(c) * kJsonQuotesCharactersPerEntry;
       write_cursor[0] = replacement[0];
       if (len > 1) {
         write_cursor[1] = replacement[1];
         if (len > 2) {
           ASSERT(len == 6);
@@ skipping 8023 matching lines @@
     // Handle last resort GC and make sure to allow future allocations
     // to grow the heap without causing GCs (if possible).
     isolate->counters()->gc_last_resort_from_js()->Increment();
     isolate->heap()->CollectAllGarbage(Heap::kNoGCFlags,
                                        "Runtime::PerformGC");
   }
 }
 
 
 } }  // namespace v8::internal