[elements] Fix length bounds precheck for Array.prototype.concat

src/elements.cc

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/elements.h"
 
 #include "src/arguments.h"
 #include "src/conversions.h"
 #include "src/factory.h"
 #include "src/isolate-inl.h"
@@ skipping 2975 matching lines @@
     bool is_holey = false;
     // Iterate through all the arguments performing checks
     // and calculating total length.
     for (uint32_t i = 0; i < concat_size; i++) {
       JSArray* array = JSArray::cast((*args)[i]);
       uint32_t len = 0;
       array->length()->ToArrayLength(&len);
 
       // We shouldn't overflow when adding another len.
       const int kHalfOfMaxInt = 1 << (kBitsPerInt - 2);
-      STATIC_ASSERT(FixedArray::kMaxLength < kHalfOfMaxInt);
+      STATIC_ASSERT(FixedDoubleArray::kMaxLength < kHalfOfMaxInt);

[Igor Sheludko, 2016/04/05 12:53:27]

You could probably also hoist these checks out of the loop as above.

[Camillo Bruni, 2016/04/05 15:07:48]

done

       USE(kHalfOfMaxInt);
       result_len += len;
       DCHECK(0 <= result_len);
       DCHECK(result_len <= FixedDoubleArray::kMaxLength);

[Igor Sheludko, 2016/04/05 12:53:27]

How about also adding:
  STATIC_ASSERT(FixedDoubleArray::kMaxLength < FixedArray::kMaxLength);

 
       ElementsKind arg_kind = array->GetElementsKind();
       has_raw_doubles = has_raw_doubles || IsFastDoubleElementsKind(arg_kind);
       is_holey = is_holey || IsFastHoleyElementsKind(arg_kind);
       result_elements_kind =
           GetMoreGeneralElementsKind(result_elements_kind, arg_kind);
     }
     if (is_holey) {
       result_elements_kind = GetHoleyElementsKind(result_elements_kind);
     }
@@ skipping 26 matching lines @@
     insertion_index += len;
   }
 
   DCHECK_EQ(insertion_index, result_len);
   return result_array;
 }
 
 ElementsAccessor** ElementsAccessor::elements_accessors_ = NULL;
 }  // namespace internal
 }  // namespace v8