<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>[198676] trunk/Source/JavaScriptCore</title>
</head>
<body>
<style type="text/css"><!--
#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }
#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }
#msg dt:after { content:':';}
#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; }
#msg dl a { font-weight: bold}
#msg dl a:link { color:#fc3; }
#msg dl a:active { color:#ff0; }
#msg dl a:visited { color:#cc6; }
h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }
#msg pre { overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; }
#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }
#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }
#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }
#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; }
#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; }
#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; }
#logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: -1.5em; padding-left: 1.5em; }
#logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; }
#logmsg pre { background: #eee; padding: 1em; }
#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;}
#logmsg dl { margin: 0; }
#logmsg dt { font-weight: bold; }
#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }
#logmsg dd:before { content:'\00bb';}
#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; }
#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; }
#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; }
#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; }
#logmsg table th.Corner { text-align: left; }
#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }
#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }
#patch { width: 100%; }
#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}
#patch .propset h4, #patch .binary h4 {margin:0;}
#patch pre {padding:0;line-height:1.2em;margin:0;}
#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}
#patch .propset .diff, #patch .binary .diff {padding:10px 0;}
#patch span {display:block;padding:0 10px;}
#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}
#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}
#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}
#patch .lines, .info {color:#888;background:#fff;}
--></style>
<div id="msg">
<dl class="meta">
<dt>Revision</dt> <dd><a href="http://trac.webkit.org/projects/webkit/changeset/198676">198676</a></dd>
<dt>Author</dt> <dd>keith_miller@apple.com</dd>
<dt>Date</dt> <dd>2016-03-25 11:07:35 -0700 (Fri, 25 Mar 2016)</dd>
</dl>
<h3>Log Message</h3>
<pre>putByIndexBeyondVectorLengthWithoutAttributes should not crash if it can't ensureLength
https://bugs.webkit.org/show_bug.cgi?id=155730
Reviewed by Saam Barati.
This patch makes ensureLength return a boolean indicating if it was able to set the length.
ensureLength also no longer sets the butterfly to null if the allocation of the butterfly
fails. All of ensureLengths callers including putByIndexBeyondVectorLengthWithoutAttributes
have been adapted to throw an out of memory error if ensureLength fails.
* runtime/JSArray.cpp:
(JSC::JSArray::setLength):
(JSC::JSArray::unshiftCountWithAnyIndexingType):
* runtime/JSObject.cpp:
(JSC::JSObject::putByIndexBeyondVectorLengthWithoutAttributes):
(JSC::JSObject::ensureLengthSlow):
* runtime/JSObject.h:
(JSC::JSObject::ensureLength):</pre>
<h3>Modified Paths</h3>
<ul>
<li><a href="#trunkSourceJavaScriptCoreChangeLog">trunk/Source/JavaScriptCore/ChangeLog</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSArraycpp">trunk/Source/JavaScriptCore/runtime/JSArray.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSObjectcpp">trunk/Source/JavaScriptCore/runtime/JSObject.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSObjecth">trunk/Source/JavaScriptCore/runtime/JSObject.h</a></li>
</ul>
</div>
<div id="patch">
<h3>Diff</h3>
<a id="trunkSourceJavaScriptCoreChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/ChangeLog (198675 => 198676)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/ChangeLog 2016-03-25 18:07:31 UTC (rev 198675)
+++ trunk/Source/JavaScriptCore/ChangeLog 2016-03-25 18:07:35 UTC (rev 198676)
</span><span class="lines">@@ -1,3 +1,24 @@
</span><ins>+2016-03-25 Keith Miller <keith_miller@apple.com>
+
+ putByIndexBeyondVectorLengthWithoutAttributes should not crash if it can't ensureLength
+ https://bugs.webkit.org/show_bug.cgi?id=155730
+
+ Reviewed by Saam Barati.
+
+ This patch makes ensureLength return a boolean indicating if it was able to set the length.
+ ensureLength also no longer sets the butterfly to null if the allocation of the butterfly
+ fails. All of ensureLengths callers including putByIndexBeyondVectorLengthWithoutAttributes
+ have been adapted to throw an out of memory error if ensureLength fails.
+
+ * runtime/JSArray.cpp:
+ (JSC::JSArray::setLength):
+ (JSC::JSArray::unshiftCountWithAnyIndexingType):
+ * runtime/JSObject.cpp:
+ (JSC::JSObject::putByIndexBeyondVectorLengthWithoutAttributes):
+ (JSC::JSObject::ensureLengthSlow):
+ * runtime/JSObject.h:
+ (JSC::JSObject::ensureLength):
+
</ins><span class="cx"> 2016-03-25 Caitlin Potter <caitp@igalia.com>
</span><span class="cx">
</span><span class="cx"> [JSC] implement String.prototype.padStart() and String.prototype.padEnd() proposal
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSArraycpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSArray.cpp (198675 => 198676)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSArray.cpp 2016-03-25 18:07:31 UTC (rev 198675)
+++ trunk/Source/JavaScriptCore/runtime/JSArray.cpp 2016-03-25 18:07:35 UTC (rev 198676)
</span><span class="lines">@@ -421,7 +421,10 @@
</span><span class="cx"> ensureArrayStorage(exec->vm()));
</span><span class="cx"> }
</span><span class="cx"> if (newLength > butterfly->publicLength()) {
</span><del>- ensureLength(exec->vm(), newLength);
</del><ins>+ if (!ensureLength(exec->vm(), newLength)) {
+ throwOutOfMemoryError(exec);
+ return false;
+ }
</ins><span class="cx"> return true;
</span><span class="cx"> }
</span><span class="cx">
</span><span class="lines">@@ -1014,7 +1017,10 @@
</span><span class="cx"> if (oldLength - startIndex >= MIN_SPARSE_ARRAY_INDEX)
</span><span class="cx"> return unshiftCountWithArrayStorage(exec, startIndex, count, ensureArrayStorage(exec->vm()));
</span><span class="cx">
</span><del>- ensureLength(exec->vm(), oldLength + count);
</del><ins>+ if (!ensureLength(exec->vm(), oldLength + count)) {
+ throwOutOfMemoryError(exec);
+ return false;
+ }
</ins><span class="cx"> butterfly = m_butterfly.get();
</span><span class="cx">
</span><span class="cx"> // We have to check for holes before we start moving things around so that we don't get halfway
</span><span class="lines">@@ -1047,7 +1053,10 @@
</span><span class="cx"> if (oldLength - startIndex >= MIN_SPARSE_ARRAY_INDEX)
</span><span class="cx"> return unshiftCountWithArrayStorage(exec, startIndex, count, ensureArrayStorage(exec->vm()));
</span><span class="cx">
</span><del>- ensureLength(exec->vm(), oldLength + count);
</del><ins>+ if (!ensureLength(exec->vm(), oldLength + count)) {
+ throwOutOfMemoryError(exec);
+ return false;
+ }
</ins><span class="cx"> butterfly = m_butterfly.get();
</span><span class="cx">
</span><span class="cx"> // We have to check for holes before we start moving things around so that we don't get halfway
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSObjectcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSObject.cpp (198675 => 198676)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSObject.cpp 2016-03-25 18:07:31 UTC (rev 198675)
+++ trunk/Source/JavaScriptCore/runtime/JSObject.cpp 2016-03-25 18:07:35 UTC (rev 198676)
</span><span class="lines">@@ -2235,7 +2235,10 @@
</span><span class="cx"> return result;
</span><span class="cx"> }
</span><span class="cx">
</span><del>- ensureLength(vm, i + 1);
</del><ins>+ if (!ensureLength(vm, i + 1)) {
+ throwOutOfMemoryError(exec);
+ return false;
+ }
</ins><span class="cx"> butterfly = m_butterfly.get();
</span><span class="cx">
</span><span class="cx"> RELEASE_ASSERT(i < butterfly->vectorLength());
</span><span class="lines">@@ -2753,7 +2756,7 @@
</span><span class="cx"> return true;
</span><span class="cx"> }
</span><span class="cx">
</span><del>-void JSObject::ensureLengthSlow(VM& vm, unsigned length)
</del><ins>+bool JSObject::ensureLengthSlow(VM& vm, unsigned length)
</ins><span class="cx"> {
</span><span class="cx"> Butterfly* butterfly = m_butterfly.get();
</span><span class="cx">
</span><span class="lines">@@ -2770,6 +2773,8 @@
</span><span class="cx"> vm, this, structure(), structure()->outOfLineCapacity(), true,
</span><span class="cx"> oldVectorLength * sizeof(EncodedJSValue),
</span><span class="cx"> newVectorLength * sizeof(EncodedJSValue));
</span><ins>+ if (!butterfly)
+ return false;
</ins><span class="cx"> m_butterfly.set(vm, this, butterfly);
</span><span class="cx">
</span><span class="cx"> butterfly->setVectorLength(newVectorLength);
</span><span class="lines">@@ -2778,6 +2783,7 @@
</span><span class="cx"> for (unsigned i = oldVectorLength; i < newVectorLength; ++i)
</span><span class="cx"> butterfly->contiguousDouble().data()[i] = PNaN;
</span><span class="cx"> }
</span><ins>+ return true;
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> void JSObject::reallocateAndShrinkButterfly(VM& vm, unsigned length)
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSObjecth"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSObject.h (198675 => 198676)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSObject.h 2016-03-25 18:07:31 UTC (rev 198675)
+++ trunk/Source/JavaScriptCore/runtime/JSObject.h 2016-03-25 18:07:35 UTC (rev 198676)
</span><span class="lines">@@ -868,16 +868,18 @@
</span><span class="cx">
</span><span class="cx"> // Call this if you want setIndexQuickly to succeed and you're sure that
</span><span class="cx"> // the array is contiguous.
</span><del>- void ensureLength(VM& vm, unsigned length)
</del><ins>+ bool WARN_UNUSED_RETURN ensureLength(VM& vm, unsigned length)
</ins><span class="cx"> {
</span><span class="cx"> ASSERT(length < MAX_ARRAY_INDEX);
</span><span class="cx"> ASSERT(hasContiguous(indexingType()) || hasInt32(indexingType()) || hasDouble(indexingType()) || hasUndecided(indexingType()));
</span><span class="cx">
</span><ins>+ bool result = true;
</ins><span class="cx"> if (m_butterfly.get()->vectorLength() < length)
</span><del>- ensureLengthSlow(vm, length);
</del><ins>+ result = ensureLengthSlow(vm, length);
</ins><span class="cx">
</span><span class="cx"> if (m_butterfly.get()->publicLength() < length)
</span><span class="cx"> m_butterfly.get()->setPublicLength(length);
</span><ins>+ return result;
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> // Call this if you want to shrink the butterfly backing store, and you're
</span><span class="lines">@@ -933,7 +935,7 @@
</span><span class="cx"> JS_EXPORT_PRIVATE void convertInt32ToDoubleOrContiguousWhilePerformingSetIndex(VM&, unsigned index, JSValue);
</span><span class="cx"> JS_EXPORT_PRIVATE void convertDoubleToContiguousWhilePerformingSetIndex(VM&, unsigned index, JSValue);
</span><span class="cx">
</span><del>- void ensureLengthSlow(VM&, unsigned length);
</del><ins>+ bool ensureLengthSlow(VM&, unsigned length);
</ins><span class="cx">
</span><span class="cx"> ContiguousJSValues ensureInt32Slow(VM&);
</span><span class="cx"> ContiguousDoubles ensureDoubleSlow(VM&);
</span></span></pre>
</div>
</div>
</body>
</html>