Check that array length stays a safe integer in Array.prototype.push

src/js/array.js

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 (function(global, utils, extrasUtils) {
 
 "use strict";
 
 %CheckIsBootstrapping();
 
@@ skipping 499 matching lines @@
 function ArrayPush() {
   CHECK_OBJECT_COERCIBLE(this, "Array.prototype.push");
 
   if (%IsObserved(this))
     return ObservedArrayPush.apply(this, arguments);
 
   var array = TO_OBJECT(this);
   var n = TO_LENGTH_OR_UINT32(array.length);
   var m = %_ArgumentsLength();
 
+  // It appears that there is no enforced, absolute limit on the number of
+  // arguments, but it would be very slow for users to use 2**32 or more.
+  // To avoid integer overflow, do the comparison to the max safe integer
+  // after subtracting 2**32 from both sides. To stay on the safe side, also
+  // prohibit this function from being called with more than 2**32 arguments.
+  if (m > 1 << 32 || (n - (1 << 32)) + m > kMaxSafeInteger - (1 << 32)) {

[adamk, 2015/10/26 23:14:28]

"1 << 32" isn't doing what you want. It returns 1...

[Dan Ehrenberg, 2015/10/27 00:47:36]

Right. I finally settled on something that works, WDYT?

+    throw MakeTypeError(kPushPastSafeLength, m, n);
+  }
+
   for (var i = 0; i < m; i++) {
     array[i+n] = %_Arguments(i);
   }
 
   var new_length = n + m;
   array.length = new_length;
   return new_length;
 }
 
 
@@ skipping 1142 matching lines @@
 %InstallToContext([
   "array_pop", ArrayPop,
   "array_push", ArrayPush,
   "array_shift", ArrayShift,
   "array_splice", ArraySplice,
   "array_slice", ArraySlice,
   "array_unshift", ArrayUnshift,
 ]);
 
 });