Index: src/runtime.js |
diff --git a/src/runtime.js b/src/runtime.js |
index fff0884df00054dfba016bd7d9f5e32c81e42e93..e4cb4ff312a86f8e09e757ec4114d2a9f7b48d49 100644 |
--- a/src/runtime.js |
+++ b/src/runtime.js |
@@ -418,7 +418,7 @@ function APPLY_PREPARE(args) { |
// that takes care of more eventualities. |
if (IS_ARRAY(args)) { |
length = args.length; |
- if (%_IsSmi(length) && length >= 0 && length < 0x800000 && |
+ if (%_IsSmi(length) && length >= 0 && length < kSafeArgumentsLength && |
IS_SPEC_FUNCTION(this)) { |
return length; |
} |
@@ -429,7 +429,7 @@ function APPLY_PREPARE(args) { |
// We can handle any number of apply arguments if the stack is |
// big enough, but sanity check the value to avoid overflow when |
// multiplying with pointer size. |
- if (length > 0x800000) { |
+ if (length > kSafeArgumentsLength) { |
throw %MakeRangeError('stack_overflow', []); |
} |
@@ -449,6 +449,93 @@ function APPLY_PREPARE(args) { |
} |
+function REFLECT_APPLY_PREPARE(args) { |
+ var length; |
+ // First check whether length is a positive Smi and args is an |
+ // array. This is the fast case. If this fails, we do the slow case |
+ // that takes care of more eventualities. |
+ if (IS_ARRAY(args)) { |
+ length = args.length; |
+ if (%_IsSmi(length) && length >= 0 && length < kSafeArgumentsLength && |
+ IS_SPEC_FUNCTION(this)) { |
+ return length; |
+ } |
+ } |
+ |
+ if (!IS_SPEC_FUNCTION(this)) { |
+ throw %MakeTypeError('called_non_callable', [ %ToString(this) ]); |
+ } |
+ |
+ if (!IS_SPEC_OBJECT(args)) { |
+ throw %MakeTypeError('reflect_apply_wrong_args', [ ]); |
+ } |
+ |
+ length = %ToLength(args.length); |
+ |
+ // We can handle any number of apply arguments if the stack is |
+ // big enough, but sanity check the value to avoid overflow when |
+ // multiplying with pointer size. |
+ if (length > kSafeArgumentsLength) { |
+ throw %MakeRangeError('stack_overflow', []); |
+ } |
+ |
+ // Return the length which is the number of arguments to copy to the |
+ // stack. It is guaranteed to be a small integer at this point. |
+ return length; |
+} |
+ |
+ |
+function REFLECT_CONSTRUCT_PREPARE(args, newTarget) { |
+ var length; |
+ var ctorOk = IS_SPEC_FUNCTION(this) && %IsConstructor(this); |
+ var newTargetOk = IS_SPEC_FUNCTION(newTarget) && %IsConstructor(newTarget); |
+ |
+ // First check whether length is a positive Smi and args is an |
+ // array. This is the fast case. If this fails, we do the slow case |
+ // that takes care of more eventualities. |
+ if (IS_ARRAY(args)) { |
+ length = args.length; |
+ if (%_IsSmi(length) && length >= 0 && length < kSafeArgumentsLength && |
+ ctorOk && newTargetOk) { |
+ return length; |
+ } |
+ } |
+ |
+ if (!ctorOk) { |
+ if (!IS_SPEC_FUNCTION(this)) { |
+ throw %MakeTypeError('called_non_callable', [ %ToString(this) ]); |
+ } else { |
+ throw %MakeTypeError('not_constructor', [ %ToString(this) ]); |
+ } |
+ } |
+ |
+ if (!newTargetOk) { |
+ if (!IS_SPEC_FUNCTION(newTarget)) { |
+ throw %MakeTypeError('called_non_callable', [ %ToString(newTarget) ]); |
+ } else { |
+ throw %MakeTypeError('not_constructor', [ %ToString(newTarget) ]); |
+ } |
+ } |
+ |
+ if (!IS_SPEC_OBJECT(args)) { |
+ throw %MakeTypeError('reflect_construct_wrong_args', [ ]); |
+ } |
+ |
+ length = %ToLength(args.length); |
+ |
+ // We can handle any number of apply arguments if the stack is |
+ // big enough, but sanity check the value to avoid overflow when |
+ // multiplying with pointer size. |
+ if (length > kSafeArgumentsLength) { |
+ throw %MakeRangeError('stack_overflow', []); |
+ } |
+ |
+ // Return the length which is the number of arguments to copy to the |
+ // stack. It is guaranteed to be a small integer at this point. |
+ return length; |
+} |
+ |
+ |
function STACK_OVERFLOW(length) { |
throw %MakeRangeError('stack_overflow', []); |
} |