Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(83)

Side by Side Diff: src/objects.cc

Issue 2201023004: [api] Fix possible OOB when using SetAndGrow (Closed) Base URL: https://chromium.googlesource.com/v8/v8.git@master
Patch Set: Created 4 years, 4 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View unified diff | Download patch
« no previous file with comments | « no previous file | no next file » | no next file with comments »
Toggle Intra-line Diffs ('i') | Expand Comments ('e') | Collapse Comments ('c') | Show Comments Hide Comments ('s')
OLDNEW
1 // Copyright 2015 the V8 project authors. All rights reserved. 1 // Copyright 2015 the V8 project authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style license that can be 2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file. 3 // found in the LICENSE file.
4 4
5 #include "src/objects.h" 5 #include "src/objects.h"
6 6
7 #include <cmath> 7 #include <cmath>
8 #include <iomanip> 8 #include <iomanip>
9 #include <memory> 9 #include <memory>
10 #include <sstream> 10 #include <sstream>
(...skipping 9764 matching lines...) Expand 10 before | Expand all | Expand 10 after
9775 9775
9776 Handle<FixedArray> FixedArray::SetAndGrow(Handle<FixedArray> array, int index, 9776 Handle<FixedArray> FixedArray::SetAndGrow(Handle<FixedArray> array, int index,
9777 Handle<Object> value) { 9777 Handle<Object> value) {
9778 if (index < array->length()) { 9778 if (index < array->length()) {
9779 array->set(index, *value); 9779 array->set(index, *value);
9780 return array; 9780 return array;
9781 } 9781 }
9782 int capacity = array->length(); 9782 int capacity = array->length();
9783 do { 9783 do {
9784 capacity = JSObject::NewElementsCapacity(capacity); 9784 capacity = JSObject::NewElementsCapacity(capacity);
9785 } while (capacity < index); 9785 } while (capacity <= index);
9786 Handle<FixedArray> new_array = 9786 Handle<FixedArray> new_array =
9787 array->GetIsolate()->factory()->NewUninitializedFixedArray(capacity); 9787 array->GetIsolate()->factory()->NewUninitializedFixedArray(capacity);
9788 array->CopyTo(0, *new_array, 0, array->length()); 9788 array->CopyTo(0, *new_array, 0, array->length());
9789 new_array->FillWithHoles(array->length(), new_array->length()); 9789 new_array->FillWithHoles(array->length(), new_array->length());
9790 new_array->set(index, *value); 9790 new_array->set(index, *value);
9791 return new_array; 9791 return new_array;
9792 } 9792 }
9793 9793
9794 void FixedArray::Shrink(int new_length) { 9794 void FixedArray::Shrink(int new_length) {
9795 DCHECK(0 <= new_length && new_length <= length()); 9795 DCHECK(0 <= new_length && new_length <= length());
(...skipping 9241 matching lines...) Expand 10 before | Expand all | Expand 10 after
19037 for (PrototypeIterator iter(isolate, this, kStartAtReceiver, 19037 for (PrototypeIterator iter(isolate, this, kStartAtReceiver,
19038 PrototypeIterator::END_AT_NULL); 19038 PrototypeIterator::END_AT_NULL);
19039 !iter.IsAtEnd(); iter.AdvanceIgnoringProxies()) { 19039 !iter.IsAtEnd(); iter.AdvanceIgnoringProxies()) {
19040 if (iter.GetCurrent<Object>()->IsJSProxy()) return true; 19040 if (iter.GetCurrent<Object>()->IsJSProxy()) return true;
19041 } 19041 }
19042 return false; 19042 return false;
19043 } 19043 }
19044 19044
19045 } // namespace internal 19045 } // namespace internal
19046 } // namespace v8 19046 } // namespace v8
OLDNEW
« no previous file with comments | « no previous file | no next file » | no next file with comments »

Powered by Google App Engine
This is Rietveld 408576698