Merge r3560, r3562 and r3568 from bleeding_edge to 1.3 branch to fix...

src/heap.cc

 // Copyright 2009 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 1972 matching lines @@
 
   Object* result = Heap::AllocateRawTwoByteString(1);
   if (result->IsFailure()) return result;
   String* answer = String::cast(result);
   answer->Set(0, code);
   return answer;
 }
 
 
 Object* Heap::AllocateByteArray(int length, PretenureFlag pretenure) {
+  if (length < 0 || length > ByteArray::kMaxLength) {
+    return Failure::OutOfMemoryException();
+  }
   if (pretenure == NOT_TENURED) {
     return AllocateByteArray(length);
   }
   int size = ByteArray::SizeFor(length);
   AllocationSpace space =
       size > MaxObjectSizeInPagedSpace() ? LO_SPACE : OLD_DATA_SPACE;
 
   Object* result = AllocateRaw(size, space, OLD_DATA_SPACE);
 
   if (result->IsFailure()) return result;
 
   reinterpret_cast<Array*>(result)->set_map(byte_array_map());
   reinterpret_cast<Array*>(result)->set_length(length);
   return result;
 }
 
 
 Object* Heap::AllocateByteArray(int length) {
+  if (length < 0 || length > ByteArray::kMaxLength) {
+    return Failure::OutOfMemoryException();
+  }
   int size = ByteArray::SizeFor(length);
   AllocationSpace space =
       size > MaxObjectSizeInPagedSpace() ? LO_SPACE : NEW_SPACE;
 
   // New space can't cope with forced allocation.
   if (always_allocate()) space = LO_SPACE;
 
   Object* result = AllocateRaw(size, space, OLD_DATA_SPACE);
 
   if (result->IsFailure()) return result;
@@ skipping 638 matching lines @@
   }
 
   // No match found.
   return NULL;
 }
 
 
 Object* Heap::AllocateInternalSymbol(unibrow::CharacterStream* buffer,
                                      int chars,
                                      uint32_t length_field) {
+  ASSERT(chars >= 0);
   // Ensure the chars matches the number of characters in the buffer.
   ASSERT(static_cast<unsigned>(chars) == buffer->Length());
   // Determine whether the string is ascii.
   bool is_ascii = true;
-  while (buffer->has_more() && is_ascii) {
-    if (buffer->GetNext() > unibrow::Utf8::kMaxOneByteChar) is_ascii = false;
+  while (buffer->has_more()) {
+    if (buffer->GetNext() > unibrow::Utf8::kMaxOneByteChar) {
+      is_ascii = false;
+      break;
+    }
   }
   buffer->Rewind();
 
   // Compute map and object size.
   int size;
   Map* map;
 
   if (is_ascii) {
+    if (chars > SeqAsciiString::kMaxLength) {
+      return Failure::OutOfMemoryException();
+    }
     if (chars <= String::kMaxShortSize) {
       map = short_ascii_symbol_map();
     } else if (chars <= String::kMaxMediumSize) {
       map = medium_ascii_symbol_map();
     } else {
       map = long_ascii_symbol_map();
     }
     size = SeqAsciiString::SizeFor(chars);
   } else {
+    if (chars > SeqTwoByteString::kMaxLength) {
+      return Failure::OutOfMemoryException();
+    }
     if (chars <= String::kMaxShortSize) {
       map = short_symbol_map();
     } else if (chars <= String::kMaxMediumSize) {
       map = medium_symbol_map();
     } else {
       map = long_symbol_map();
     }
     size = SeqTwoByteString::SizeFor(chars);
   }
 
@@ skipping 12 matching lines @@
 
   // Fill in the characters.
   for (int i = 0; i < chars; i++) {
     answer->Set(i, buffer->GetNext());
   }
   return answer;
 }
 
 
 Object* Heap::AllocateRawAsciiString(int length, PretenureFlag pretenure) {
+  if (length < 0 || length > SeqAsciiString::kMaxLength) {
+    return Failure::OutOfMemoryException();
+  }
+  int size = SeqAsciiString::SizeFor(length);
+  ASSERT(size <= SeqAsciiString::kMaxSize);
+
   AllocationSpace space = (pretenure == TENURED) ? OLD_DATA_SPACE : NEW_SPACE;
 
   // New space can't cope with forced allocation.
   if (always_allocate()) space = OLD_DATA_SPACE;
 
-  int size = SeqAsciiString::SizeFor(length);
-
   Object* result = Failure::OutOfMemoryException();
   if (space == NEW_SPACE) {
     result = size <= kMaxObjectSizeInNewSpace
         ? new_space_.AllocateRaw(size)
         : lo_space_->AllocateRaw(size);
   } else {
     if (size > MaxObjectSizeInPagedSpace()) space = LO_SPACE;
     result = AllocateRaw(size, space, OLD_DATA_SPACE);
   }
   if (result->IsFailure()) return result;
@@ skipping 10 matching lines @@
 
   // Partially initialize the object.
   HeapObject::cast(result)->set_map(map);
   String::cast(result)->set_length(length);
   ASSERT_EQ(size, HeapObject::cast(result)->Size());
   return result;
 }
 
 
 Object* Heap::AllocateRawTwoByteString(int length, PretenureFlag pretenure) {
+  if (length < 0 || length > SeqTwoByteString::kMaxLength) {
+    return Failure::OutOfMemoryException();
+  }
+  int size = SeqTwoByteString::SizeFor(length);
+  ASSERT(size <= SeqTwoByteString::kMaxSize);
+
   AllocationSpace space = (pretenure == TENURED) ? OLD_DATA_SPACE : NEW_SPACE;
 
   // New space can't cope with forced allocation.
   if (always_allocate()) space = OLD_DATA_SPACE;
 
-  int size = SeqTwoByteString::SizeFor(length);
-
   Object* result = Failure::OutOfMemoryException();
   if (space == NEW_SPACE) {
     result = size <= kMaxObjectSizeInNewSpace
         ? new_space_.AllocateRaw(size)
         : lo_space_->AllocateRaw(size);
   } else {
     if (size > MaxObjectSizeInPagedSpace()) space = LO_SPACE;
     result = AllocateRaw(size, space, OLD_DATA_SPACE);
   }
   if (result->IsFailure()) return result;
@@ skipping 21 matching lines @@
   Object* result = AllocateRaw(size, OLD_DATA_SPACE, OLD_DATA_SPACE);
   if (result->IsFailure()) return result;
   // Initialize the object.
   reinterpret_cast<Array*>(result)->set_map(fixed_array_map());
   reinterpret_cast<Array*>(result)->set_length(0);
   return result;
 }
 
 
 Object* Heap::AllocateRawFixedArray(int length) {
+  if (length < 0 || length > FixedArray::kMaxLength) {
+    return Failure::OutOfMemoryException();
+  }
   // Use the general function if we're forced to always allocate.
   if (always_allocate()) return AllocateFixedArray(length, TENURED);
   // Allocate the raw data for a fixed array.
   int size = FixedArray::SizeFor(length);
   return size <= kMaxObjectSizeInNewSpace
       ? new_space_.AllocateRaw(size)
       : lo_space_->AllocateRawFixedArray(size);
 }
 
 
@@ skipping 31 matching lines @@
     // Initialize body.
     for (int index = 0; index < length; index++) {
       array->set(index, value, SKIP_WRITE_BARRIER);
     }
   }
   return result;
 }
 
 
 Object* Heap::AllocateFixedArray(int length, PretenureFlag pretenure) {
+  ASSERT(length >= 0);
   ASSERT(empty_fixed_array()->IsFixedArray());
+  if (length < 0 || length > FixedArray::kMaxLength) {
+    return Failure::OutOfMemoryException();
+  }
   if (length == 0) return empty_fixed_array();
 
   // New space can't cope with forced allocation.
   if (always_allocate()) pretenure = TENURED;
 
   int size = FixedArray::SizeFor(length);
   Object* result = Failure::OutOfMemoryException();
   if (pretenure != TENURED) {
     result = size <= kMaxObjectSizeInNewSpace
         ? new_space_.AllocateRaw(size)
@@ skipping 1200 matching lines @@
   for (int i = 0; i < kNumberOfCaches; i++) {
     if (caches_[i] != NULL) {
       delete caches_[i];
       caches_[i] = NULL;
     }
   }
 }
 
 
 } }  // namespace v8::internal