Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(7)

Unified Diff: src/js/array.js

Issue 1428483002: Check that array length stays a safe integer in Array.prototype.push (Closed) Base URL: https://chromium.googlesource.com/v8/v8.git@master
Patch Set: Use 2**30 Created 5 years, 2 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View side-by-side diff with in-line comments
Download patch
« no previous file with comments | « no previous file | src/messages.h » ('j') | no next file with comments »
Expand Comments ('e') | Collapse Comments ('c') | Show Comments Hide Comments ('s')
Index: src/js/array.js
diff --git a/src/js/array.js b/src/js/array.js
index b13e4e239223093af848f17b0b61d4a02390e371..0eb06fac8fd8fbd876446aab61a0515559884359 100644
--- a/src/js/array.js
+++ b/src/js/array.js
@@ -517,6 +517,15 @@ function ArrayPush() {
var n = TO_LENGTH_OR_UINT32(array.length);
var m = %_ArgumentsLength();
+ // It appears that there is no enforced, absolute limit on the number of
+ // arguments, but it would surely blow the stack to use 2**30 or more.
+ // To avoid integer overflow, do the comparison to the max safe integer
+ // after subtracting 2**30 from both sides. (2**31 would seem like a
+ // natural value, but it is negative in JS, and 2**32 is 1.)
+ if (m > (1 << 30) || (n - (1 << 30)) + m > kMaxSafeInteger - (1 << 30)) {
+ throw MakeTypeError(kPushPastSafeLength, m, n);
+ }
+
for (var i = 0; i < m; i++) {
array[i+n] = %_Arguments(i);
}
« no previous file with comments | « no previous file | src/messages.h » ('j') | no next file with comments »

Powered by Google App Engine
This is Rietveld 408576698