Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(2)

Side by Side Diff: src/objects.h

Issue 525064: Fixed potential length miscalculations by limiting max size of arrays and strings. (Closed)
Patch Set: Added (unrelated) cast to make Win64 compile. Created 10 years, 11 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View unified diff | Download patch
« no previous file with comments | « src/heap.cc ('k') | src/objects.cc » ('j') | no next file with comments »
Toggle Intra-line Diffs ('i') | Expand Comments ('e') | Collapse Comments ('c') | Show Comments Hide Comments ('s')
OLDNEW
1 // Copyright 2006-2009 the V8 project authors. All rights reserved. 1 // Copyright 2006-2009 the V8 project authors. All rights reserved.
2 // Redistribution and use in source and binary forms, with or without 2 // Redistribution and use in source and binary forms, with or without
3 // modification, are permitted provided that the following conditions are 3 // modification, are permitted provided that the following conditions are
4 // met: 4 // met:
5 // 5 //
6 // * Redistributions of source code must retain the above copyright 6 // * Redistributions of source code must retain the above copyright
7 // notice, this list of conditions and the following disclaimer. 7 // notice, this list of conditions and the following disclaimer.
8 // * Redistributions in binary form must reproduce the above 8 // * Redistributions in binary form must reproduce the above
9 // copyright notice, this list of conditions and the following 9 // copyright notice, this list of conditions and the following
10 // disclaimer in the documentation and/or other materials provided 10 // disclaimer in the documentation and/or other materials provided
(...skipping 1490 matching lines...) Expand 10 before | Expand all | Expand 10 after
1501 int number_of_fast_used_elements_; 1501 int number_of_fast_used_elements_;
1502 int number_of_fast_unused_elements_; 1502 int number_of_fast_unused_elements_;
1503 int number_of_slow_used_elements_; 1503 int number_of_slow_used_elements_;
1504 int number_of_slow_unused_elements_; 1504 int number_of_slow_unused_elements_;
1505 }; 1505 };
1506 1506
1507 void IncrementSpillStatistics(SpillInformation* info); 1507 void IncrementSpillStatistics(SpillInformation* info);
1508 #endif 1508 #endif
1509 Object* SlowReverseLookup(Object* value); 1509 Object* SlowReverseLookup(Object* value);
1510 1510
1511 // Maximal number of elements (numbered 0 .. kMaxElementCount - 1).
1512 // Also maximal value of JSArray's length property.
1513 static const uint32_t kMaxElementCount = 0xffffffffu;
1514
1511 static const uint32_t kMaxGap = 1024; 1515 static const uint32_t kMaxGap = 1024;
1512 static const int kMaxFastElementsLength = 5000; 1516 static const int kMaxFastElementsLength = 5000;
1513 static const int kInitialMaxFastElementArray = 100000; 1517 static const int kInitialMaxFastElementArray = 100000;
1514 static const int kMaxFastProperties = 8; 1518 static const int kMaxFastProperties = 8;
1515 static const int kMaxInstanceSize = 255 * kPointerSize; 1519 static const int kMaxInstanceSize = 255 * kPointerSize;
1516 // When extending the backing storage for property values, we increase 1520 // When extending the backing storage for property values, we increase
1517 // its size by more than the 1 entry necessary, so sequentially adding fields 1521 // its size by more than the 1 entry necessary, so sequentially adding fields
1518 // to the same object requires fewer allocations and copies. 1522 // to the same object requires fewer allocations and copies.
1519 static const int kFieldsAdded = 3; 1523 static const int kFieldsAdded = 3;
1520 1524
(...skipping 109 matching lines...) Expand 10 before | Expand all | Expand 10 after
1630 1634
1631 // Code Generation support. 1635 // Code Generation support.
1632 static int OffsetOfElementAt(int index) { return SizeFor(index); } 1636 static int OffsetOfElementAt(int index) { return SizeFor(index); }
1633 1637
1634 // Casting. 1638 // Casting.
1635 static inline FixedArray* cast(Object* obj); 1639 static inline FixedArray* cast(Object* obj);
1636 1640
1637 // Align data at kPointerSize, even if Array.kHeaderSize isn't aligned. 1641 // Align data at kPointerSize, even if Array.kHeaderSize isn't aligned.
1638 static const int kHeaderSize = POINTER_SIZE_ALIGN(Array::kHeaderSize); 1642 static const int kHeaderSize = POINTER_SIZE_ALIGN(Array::kHeaderSize);
1639 1643
1644 // Maximal allowed size, in bytes, of a single FixedArray.
1645 // Prevents overflowing size computations, as well as extreme memory
1646 // consumption.
1647 static const int kMaxSize = 256 * MB;
1648 // Maximally allowed length of a FixedArray.
1649 static const int kMaxLength = (kMaxSize - kHeaderSize) / kPointerSize;
1650
1640 // Dispatched behavior. 1651 // Dispatched behavior.
1641 int FixedArraySize() { return SizeFor(length()); } 1652 int FixedArraySize() { return SizeFor(length()); }
1642 void FixedArrayIterateBody(ObjectVisitor* v); 1653 void FixedArrayIterateBody(ObjectVisitor* v);
1643 #ifdef DEBUG 1654 #ifdef DEBUG
1644 void FixedArrayPrint(); 1655 void FixedArrayPrint();
1645 void FixedArrayVerify(); 1656 void FixedArrayVerify();
1646 // Checks if two FixedArrays have identical contents. 1657 // Checks if two FixedArrays have identical contents.
1647 bool IsEqualTo(FixedArray* other); 1658 bool IsEqualTo(FixedArray* other);
1648 #endif 1659 #endif
1649 1660
(...skipping 291 matching lines...) Expand 10 before | Expand all | Expand 10 after
1941 static const int kPrefixStartIndex = 3; 1952 static const int kPrefixStartIndex = 3;
1942 static const int kElementsStartIndex = 1953 static const int kElementsStartIndex =
1943 kPrefixStartIndex + Shape::kPrefixSize; 1954 kPrefixStartIndex + Shape::kPrefixSize;
1944 static const int kEntrySize = Shape::kEntrySize; 1955 static const int kEntrySize = Shape::kEntrySize;
1945 static const int kElementsStartOffset = 1956 static const int kElementsStartOffset =
1946 kHeaderSize + kElementsStartIndex * kPointerSize; 1957 kHeaderSize + kElementsStartIndex * kPointerSize;
1947 1958
1948 // Constant used for denoting a absent entry. 1959 // Constant used for denoting a absent entry.
1949 static const int kNotFound = -1; 1960 static const int kNotFound = -1;
1950 1961
1962 // Maximal capacity of HashTable. Based on maximal length of underlying
1963 // FixedArray. Staying below kMaxCapacity also ensures that EntryToIndex
1964 // cannot overflow.
1965 static const int kMaxCapacity =
1966 (FixedArray::kMaxLength - kElementsStartOffset) / kEntrySize;
1967
1951 // Find entry for key otherwise return -1. 1968 // Find entry for key otherwise return -1.
1952 int FindEntry(Key key); 1969 int FindEntry(Key key);
1953 1970
1954 protected: 1971 protected:
1955 1972
1956 // Find the entry at which to insert element with the given key that 1973 // Find the entry at which to insert element with the given key that
1957 // has the given hash value. 1974 // has the given hash value.
1958 uint32_t FindInsertionEntry(uint32_t hash); 1975 uint32_t FindInsertionEntry(uint32_t hash);
1959 1976
1960 // Returns the index for an entry (of the key) 1977 // Returns the index for an entry (of the key)
(...skipping 10 matching lines...) Expand all
1971 void SetNumberOfDeletedElements(int nod) { 1988 void SetNumberOfDeletedElements(int nod) {
1972 fast_set(this, kNumberOfDeletedElementsIndex, Smi::FromInt(nod)); 1989 fast_set(this, kNumberOfDeletedElementsIndex, Smi::FromInt(nod));
1973 } 1990 }
1974 1991
1975 // Sets the capacity of the hash table. 1992 // Sets the capacity of the hash table.
1976 void SetCapacity(int capacity) { 1993 void SetCapacity(int capacity) {
1977 // To scale a computed hash code to fit within the hash table, we 1994 // To scale a computed hash code to fit within the hash table, we
1978 // use bit-wise AND with a mask, so the capacity must be positive 1995 // use bit-wise AND with a mask, so the capacity must be positive
1979 // and non-zero. 1996 // and non-zero.
1980 ASSERT(capacity > 0); 1997 ASSERT(capacity > 0);
1998 ASSERT(capacity <= kMaxCapacity);
1981 fast_set(this, kCapacityIndex, Smi::FromInt(capacity)); 1999 fast_set(this, kCapacityIndex, Smi::FromInt(capacity));
1982 } 2000 }
1983 2001
1984 2002
1985 // Returns probe entry. 2003 // Returns probe entry.
1986 static uint32_t GetProbe(uint32_t hash, uint32_t number, uint32_t size) { 2004 static uint32_t GetProbe(uint32_t hash, uint32_t number, uint32_t size) {
1987 ASSERT(IsPowerOf2(size)); 2005 ASSERT(IsPowerOf2(size));
1988 return (hash + GetProbeOffset(number)) & (size - 1); 2006 return (hash + GetProbeOffset(number)) & (size - 1);
1989 } 2007 }
1990 2008
(...skipping 319 matching lines...) Expand 10 before | Expand all | Expand 10 after
2310 int ByteArraySize() { return SizeFor(length()); } 2328 int ByteArraySize() { return SizeFor(length()); }
2311 #ifdef DEBUG 2329 #ifdef DEBUG
2312 void ByteArrayPrint(); 2330 void ByteArrayPrint();
2313 void ByteArrayVerify(); 2331 void ByteArrayVerify();
2314 #endif 2332 #endif
2315 2333
2316 // ByteArray headers are not quadword aligned. 2334 // ByteArray headers are not quadword aligned.
2317 static const int kHeaderSize = Array::kHeaderSize; 2335 static const int kHeaderSize = Array::kHeaderSize;
2318 static const int kAlignedSize = Array::kAlignedSize; 2336 static const int kAlignedSize = Array::kAlignedSize;
2319 2337
2338 // Maximal memory consumption for a single ByteArray.
2339 static const int kMaxSize = 512 * MB;
2340 // Maximal length of a single ByteArray.
2341 static const int kMaxLength = kMaxSize - kHeaderSize;
2342
2320 private: 2343 private:
2321 DISALLOW_IMPLICIT_CONSTRUCTORS(ByteArray); 2344 DISALLOW_IMPLICIT_CONSTRUCTORS(ByteArray);
2322 }; 2345 };
2323 2346
2324 2347
2325 // A PixelArray represents a fixed-size byte array with special semantics 2348 // A PixelArray represents a fixed-size byte array with special semantics
2326 // used for implementing the CanvasPixelArray object. Please see the 2349 // used for implementing the CanvasPixelArray object. Please see the
2327 // specification at: 2350 // specification at:
2328 // http://www.whatwg.org/specs/web-apps/current-work/ 2351 // http://www.whatwg.org/specs/web-apps/current-work/
2329 // multipage/the-canvas-element.html#canvaspixelarray 2352 // multipage/the-canvas-element.html#canvaspixelarray
(...skipping 1689 matching lines...) Expand 10 before | Expand all | Expand 10 after
4019 4042
4020 // Computes the size for an AsciiString instance of a given length. 4043 // Computes the size for an AsciiString instance of a given length.
4021 static int SizeFor(int length) { 4044 static int SizeFor(int length) {
4022 return OBJECT_SIZE_ALIGN(kHeaderSize + length * kCharSize); 4045 return OBJECT_SIZE_ALIGN(kHeaderSize + length * kCharSize);
4023 } 4046 }
4024 4047
4025 // Layout description. 4048 // Layout description.
4026 static const int kHeaderSize = String::kSize; 4049 static const int kHeaderSize = String::kSize;
4027 static const int kAlignedSize = POINTER_SIZE_ALIGN(kHeaderSize); 4050 static const int kAlignedSize = POINTER_SIZE_ALIGN(kHeaderSize);
4028 4051
4052 // Maximal memory usage for a single sequential ASCII string.
4053 static const int kMaxSize = 512 * MB;
4054 // Maximal length of a single sequential ASCII string.
4055 // Q.v. String::kMaxLength which is the maximal size of concatenated strings.
4056 static const int kMaxLength = (kMaxSize - kHeaderSize);
4057
4029 // Support for StringInputBuffer. 4058 // Support for StringInputBuffer.
4030 inline void SeqAsciiStringReadBlockIntoBuffer(ReadBlockBuffer* buffer, 4059 inline void SeqAsciiStringReadBlockIntoBuffer(ReadBlockBuffer* buffer,
4031 unsigned* offset, 4060 unsigned* offset,
4032 unsigned chars); 4061 unsigned chars);
4033 inline const unibrow::byte* SeqAsciiStringReadBlock(unsigned* remaining, 4062 inline const unibrow::byte* SeqAsciiStringReadBlock(unsigned* remaining,
4034 unsigned* offset, 4063 unsigned* offset,
4035 unsigned chars); 4064 unsigned chars);
4036 4065
4037 private: 4066 private:
4038 DISALLOW_IMPLICIT_CONSTRUCTORS(SeqAsciiString); 4067 DISALLOW_IMPLICIT_CONSTRUCTORS(SeqAsciiString);
(...skipping 26 matching lines...) Expand all
4065 4094
4066 // Computes the size for a TwoByteString instance of a given length. 4095 // Computes the size for a TwoByteString instance of a given length.
4067 static int SizeFor(int length) { 4096 static int SizeFor(int length) {
4068 return OBJECT_SIZE_ALIGN(kHeaderSize + length * kShortSize); 4097 return OBJECT_SIZE_ALIGN(kHeaderSize + length * kShortSize);
4069 } 4098 }
4070 4099
4071 // Layout description. 4100 // Layout description.
4072 static const int kHeaderSize = String::kSize; 4101 static const int kHeaderSize = String::kSize;
4073 static const int kAlignedSize = POINTER_SIZE_ALIGN(kHeaderSize); 4102 static const int kAlignedSize = POINTER_SIZE_ALIGN(kHeaderSize);
4074 4103
4104 // Maximal memory usage for a single sequential two-byte string.
4105 static const int kMaxSize = 512 * MB;
4106 // Maximal length of a single sequential two-byte string.
4107 // Q.v. String::kMaxLength which is the maximal size of concatenated strings.
4108 static const int kMaxLength = (kMaxSize - kHeaderSize) / sizeof(uint16_t);
4109
4075 // Support for StringInputBuffer. 4110 // Support for StringInputBuffer.
4076 inline void SeqTwoByteStringReadBlockIntoBuffer(ReadBlockBuffer* buffer, 4111 inline void SeqTwoByteStringReadBlockIntoBuffer(ReadBlockBuffer* buffer,
4077 unsigned* offset_ptr, 4112 unsigned* offset_ptr,
4078 unsigned chars); 4113 unsigned chars);
4079 4114
4080 private: 4115 private:
4081 DISALLOW_IMPLICIT_CONSTRUCTORS(SeqTwoByteString); 4116 DISALLOW_IMPLICIT_CONSTRUCTORS(SeqTwoByteString);
4082 }; 4117 };
4083 4118
4084 4119
(...skipping 815 matching lines...) Expand 10 before | Expand all | Expand 10 after
4900 } else { 4935 } else {
4901 value &= ~(1 << bit_position); 4936 value &= ~(1 << bit_position);
4902 } 4937 }
4903 return value; 4938 return value;
4904 } 4939 }
4905 }; 4940 };
4906 4941
4907 } } // namespace v8::internal 4942 } } // namespace v8::internal
4908 4943
4909 #endif // V8_OBJECTS_H_ 4944 #endif // V8_OBJECTS_H_
OLDNEW
« no previous file with comments | « src/heap.cc ('k') | src/objects.cc » ('j') | no next file with comments »

Powered by Google App Engine
This is Rietveld 408576698