<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>[212019] trunk</title>
</head>
<body>
<style type="text/css"><!--
#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }
#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }
#msg dt:after { content:':';}
#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; }
#msg dl a { font-weight: bold}
#msg dl a:link { color:#fc3; }
#msg dl a:active { color:#ff0; }
#msg dl a:visited { color:#cc6; }
h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }
#msg pre { overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; }
#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }
#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }
#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }
#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; }
#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; }
#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; }
#logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: -1.5em; padding-left: 1.5em; }
#logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; }
#logmsg pre { background: #eee; padding: 1em; }
#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;}
#logmsg dl { margin: 0; }
#logmsg dt { font-weight: bold; }
#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }
#logmsg dd:before { content:'\00bb';}
#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; }
#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; }
#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; }
#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; }
#logmsg table th.Corner { text-align: left; }
#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }
#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }
#patch { width: 100%; }
#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}
#patch .propset h4, #patch .binary h4 {margin:0;}
#patch pre {padding:0;line-height:1.2em;margin:0;}
#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}
#patch .propset .diff, #patch .binary .diff {padding:10px 0;}
#patch span {display:block;padding:0 10px;}
#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}
#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}
#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}
#patch .lines, .info {color:#888;background:#fff;}
--></style>
<div id="msg">
<dl class="meta">
<dt>Revision</dt> <dd><a href="http://trac.webkit.org/projects/webkit/changeset/212019">212019</a></dd>
<dt>Author</dt> <dd>bfulgham@apple.com</dd>
<dt>Date</dt> <dd>2017-02-09 17:54:24 -0800 (Thu, 09 Feb 2017)</dd>
</dl>
<h3>Log Message</h3>
<pre>Fix max length check in ArrayPrototype.js' concatSlowPath().
https://bugs.webkit.org/show_bug.cgi?id=167270
<rdar://problem/30128133>
Patch by Mark Lam <mark.lam@apple.com> on 2017-02-09
Reviewed by Filip Pizlo.
JSTests:
* stress/array-prototype-concat-of-long-spliced-arrays.js: Added.
* stress/array-prototype-concat-of-long-spliced-arrays2.js: Added.
Source/JavaScriptCore:
1. Fixed concatSlowPath() to ensure that the result array length does not exceed
@MAX_ARRAY_INDEX. The old code was checking against @MAX_SAFE_INTEGER in some
cases, but this is overly permissive.
2. Changed concatSlowPath() to throw a RangeError instead of a TypeError to be
consistent with the C++ runtime functions in JSArray.cpp.
3. Changed the RangeError message in concatSlowPath() and JSArray.cpp to "Length
exceeded the maximum array length" when the error is that the result length
exceeds MAX_ARRAY_INDEX. We do this for 2 reasons:
a. "Length exceeded the maximum array length" is more informative than
"Invalid array length".
b. We want to use the same string consistently for the same error.
There are still 2 places in JSArray.cpp that still throws a RangeError with
message "Invalid array length". In those cases, the error is not necessarily
due to the result length exceeding MAX_ARRAY_INDEX, but is due to attempting to
set a length value that is not an integer that fits in MAX_ARRAY_INDEX e.g.
an attempt to set a fractional length value. Hence, "Invalid array length" is
appropriate for those cases.
4. Fixed JSArray::appendMemcpy() to handle overflows when computing the result
array length.
* builtins/ArrayPrototype.js:
(concatSlowPath):
* bytecode/BytecodeIntrinsicRegistry.cpp:
(JSC::BytecodeIntrinsicRegistry::BytecodeIntrinsicRegistry):
* bytecode/BytecodeIntrinsicRegistry.h:
* runtime/ArrayPrototype.cpp:
(JSC::concatAppendOne):
(JSC::arrayProtoPrivateFuncAppendMemcpy):
* runtime/JSArray.cpp:
(JSC::JSArray::appendMemcpy):
(JSC::JSArray::push):</pre>
<h3>Modified Paths</h3>
<ul>
<li><a href="#trunkJSTestsChangeLog">trunk/JSTests/ChangeLog</a></li>
<li><a href="#trunkSourceJavaScriptCoreChangeLog">trunk/Source/JavaScriptCore/ChangeLog</a></li>
<li><a href="#trunkSourceJavaScriptCorebuiltinsArrayPrototypejs">trunk/Source/JavaScriptCore/builtins/ArrayPrototype.js</a></li>
<li><a href="#trunkSourceJavaScriptCorebytecodeBytecodeIntrinsicRegistrycpp">trunk/Source/JavaScriptCore/bytecode/BytecodeIntrinsicRegistry.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCorebytecodeBytecodeIntrinsicRegistryh">trunk/Source/JavaScriptCore/bytecode/BytecodeIntrinsicRegistry.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeArrayPrototypecpp">trunk/Source/JavaScriptCore/runtime/ArrayPrototype.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSArraycpp">trunk/Source/JavaScriptCore/runtime/JSArray.cpp</a></li>
</ul>
<h3>Added Paths</h3>
<ul>
<li><a href="#trunkJSTestsstressarrayprototypeconcatoflongsplicedarraysjs">trunk/JSTests/stress/array-prototype-concat-of-long-spliced-arrays.js</a></li>
<li><a href="#trunkJSTestsstressarrayprototypeconcatoflongsplicedarrays2js">trunk/JSTests/stress/array-prototype-concat-of-long-spliced-arrays2.js</a></li>
</ul>
</div>
<div id="patch">
<h3>Diff</h3>
<a id="trunkJSTestsChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/JSTests/ChangeLog (212018 => 212019)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/JSTests/ChangeLog 2017-02-10 01:49:41 UTC (rev 212018)
+++ trunk/JSTests/ChangeLog 2017-02-10 01:54:24 UTC (rev 212019)
</span><span class="lines">@@ -1,3 +1,14 @@
</span><ins>+2017-02-09 Mark Lam <mark.lam@apple.com>
+
+ Fix max length check in ArrayPrototype.js' concatSlowPath().
+ https://bugs.webkit.org/show_bug.cgi?id=167270
+ <rdar://problem/30128133>
+
+ Reviewed by Filip Pizlo.
+
+ * stress/array-prototype-concat-of-long-spliced-arrays.js: Added.
+ * stress/array-prototype-concat-of-long-spliced-arrays2.js: Added.
+
</ins><span class="cx"> 2017-02-09 Keith Miller <keith_miller@apple.com>
</span><span class="cx">
</span><span class="cx"> We should not allow Function.caller to be used on native functions
</span></span></pre></div>
<a id="trunkJSTestsstressarrayprototypeconcatoflongsplicedarraysjs"></a>
<div class="addfile"><h4>Added: trunk/JSTests/stress/array-prototype-concat-of-long-spliced-arrays.js (0 => 212019)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/JSTests/stress/array-prototype-concat-of-long-spliced-arrays.js (rev 0)
+++ trunk/JSTests/stress/array-prototype-concat-of-long-spliced-arrays.js 2017-02-10 01:54:24 UTC (rev 212019)
</span><span class="lines">@@ -0,0 +1,36 @@
</span><ins>+function shouldEqual(actual, expected) {
+ if (actual != expected) {
+ throw "ERROR: expect " + expected + ", actual " + actual;
+ }
+}
+
+function test() {
+ var exception;
+ try {
+ var a = [];
+ a.length = 0xffffff00;
+
+ var b = a.splice(0, 0x100000); // Undecided array
+
+ var args = [];
+ args.length = 4094;
+ args.fill(b);
+
+ var q = [];
+ q.length = 0x1000;
+ q.fill(7);
+
+ var c = a.splice(0, 0xfffef); //Shorter undecided array
+
+ args[4094] = c;
+ args[4095] = q;
+
+ b.concat.apply(b, args);
+ } catch (e) {
+ exception = e;
+ }
+
+ shouldEqual(exception, "RangeError: Length exceeded the maximum array length");
+}
+
+test();
</ins></span></pre></div>
<a id="trunkJSTestsstressarrayprototypeconcatoflongsplicedarrays2js"></a>
<div class="addfile"><h4>Added: trunk/JSTests/stress/array-prototype-concat-of-long-spliced-arrays2.js (0 => 212019)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/JSTests/stress/array-prototype-concat-of-long-spliced-arrays2.js (rev 0)
+++ trunk/JSTests/stress/array-prototype-concat-of-long-spliced-arrays2.js 2017-02-10 01:54:24 UTC (rev 212019)
</span><span class="lines">@@ -0,0 +1,26 @@
</span><ins>+function shouldEqual(actual, expected) {
+ if (actual != expected) {
+ throw "ERROR: expect " + expected + ", actual " + actual;
+ }
+}
+
+function test() {
+ var exception;
+ try {
+ var a = [];
+ a.length = 0xffffff00;
+
+ var b = a.splice(0, 0x100000); // Undecided array
+
+ var args = [];
+ args.length = 4096;
+ args.fill(b);
+
+ b.concat.apply(b, args);
+ } catch (e) {
+ exception = e;
+ }
+ shouldEqual(exception, "RangeError: Length exceeded the maximum array length");
+}
+
+test();
</ins></span></pre></div>
<a id="trunkSourceJavaScriptCoreChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/ChangeLog (212018 => 212019)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/ChangeLog 2017-02-10 01:49:41 UTC (rev 212018)
+++ trunk/Source/JavaScriptCore/ChangeLog 2017-02-10 01:54:24 UTC (rev 212019)
</span><span class="lines">@@ -1,5 +1,49 @@
</span><span class="cx"> 2017-02-09 Mark Lam <mark.lam@apple.com>
</span><span class="cx">
</span><ins>+ Fix max length check in ArrayPrototype.js' concatSlowPath().
+ https://bugs.webkit.org/show_bug.cgi?id=167270
+ <rdar://problem/30128133>
+
+ Reviewed by Filip Pizlo.
+
+ 1. Fixed concatSlowPath() to ensure that the result array length does not exceed
+ @MAX_ARRAY_INDEX. The old code was checking against @MAX_SAFE_INTEGER in some
+ cases, but this is overly permissive.
+
+ 2. Changed concatSlowPath() to throw a RangeError instead of a TypeError to be
+ consistent with the C++ runtime functions in JSArray.cpp.
+
+ 3. Changed the RangeError message in concatSlowPath() and JSArray.cpp to "Length
+ exceeded the maximum array length" when the error is that the result length
+ exceeds MAX_ARRAY_INDEX. We do this for 2 reasons:
+ a. "Length exceeded the maximum array length" is more informative than
+ "Invalid array length".
+ b. We want to use the same string consistently for the same error.
+
+ There are still 2 places in JSArray.cpp that still throws a RangeError with
+ message "Invalid array length". In those cases, the error is not necessarily
+ due to the result length exceeding MAX_ARRAY_INDEX, but is due to attempting to
+ set a length value that is not an integer that fits in MAX_ARRAY_INDEX e.g.
+ an attempt to set a fractional length value. Hence, "Invalid array length" is
+ appropriate for those cases.
+
+ 4. Fixed JSArray::appendMemcpy() to handle overflows when computing the result
+ array length.
+
+ * builtins/ArrayPrototype.js:
+ (concatSlowPath):
+ * bytecode/BytecodeIntrinsicRegistry.cpp:
+ (JSC::BytecodeIntrinsicRegistry::BytecodeIntrinsicRegistry):
+ * bytecode/BytecodeIntrinsicRegistry.h:
+ * runtime/ArrayPrototype.cpp:
+ (JSC::concatAppendOne):
+ (JSC::arrayProtoPrivateFuncAppendMemcpy):
+ * runtime/JSArray.cpp:
+ (JSC::JSArray::appendMemcpy):
+ (JSC::JSArray::push):
+
+2017-02-09 Mark Lam <mark.lam@apple.com>
+
</ins><span class="cx"> Constructed object's global object should be the global object of the constructor.
</span><span class="cx"> https://bugs.webkit.org/show_bug.cgi?id=167121
</span><span class="cx"> <rdar://problem/30054759>
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorebuiltinsArrayPrototypejs"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/builtins/ArrayPrototype.js (212018 => 212019)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/builtins/ArrayPrototype.js 2017-02-10 01:49:41 UTC (rev 212018)
+++ trunk/Source/JavaScriptCore/builtins/ArrayPrototype.js 2017-02-10 01:54:24 UTC (rev 212019)
</span><span class="lines">@@ -1,5 +1,5 @@
</span><span class="cx"> /*
</span><del>- * Copyright (C) 2014-2016 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2014-2017 Apple Inc. All rights reserved.
</ins><span class="cx"> * Copyright (C) 2015 Yusuke Suzuki <utatane.tea@gmail.com>.
</span><span class="cx"> *
</span><span class="cx"> * Redistribution and use in source and binary forms, with or without
</span><span class="lines">@@ -686,12 +686,12 @@
</span><span class="cx"> let spreadable = @isObject(currentElement) && currentElement.@isConcatSpreadableSymbol;
</span><span class="cx"> if ((spreadable === @undefined && @isArray(currentElement)) || spreadable) {
</span><span class="cx"> let length = @toLength(currentElement.length);
</span><ins>+ if (length + resultIndex > @MAX_ARRAY_INDEX)
+ @throwRangeError("Length exceeded the maximum array length");
</ins><span class="cx"> if (resultIsArray && @isJSArray(currentElement)) {
</span><span class="cx"> @appendMemcpy(result, currentElement, resultIndex);
</span><span class="cx"> resultIndex += length;
</span><span class="cx"> } else {
</span><del>- if (length + resultIndex > @MAX_SAFE_INTEGER)
- @throwTypeError("length exceeded the maximum safe integer");
</del><span class="cx"> for (var i = 0; i < length; i++) {
</span><span class="cx"> if (i in currentElement)
</span><span class="cx"> @putByValDirect(result, resultIndex, currentElement[i]);
</span><span class="lines">@@ -699,8 +699,8 @@
</span><span class="cx"> }
</span><span class="cx"> }
</span><span class="cx"> } else {
</span><del>- if (resultIndex >= @MAX_SAFE_INTEGER)
- @throwTypeError("length exceeded the maximum safe integer");
</del><ins>+ if (resultIndex >= @MAX_ARRAY_INDEX)
+ @throwRangeError("Length exceeded the maximum array length");
</ins><span class="cx"> @putByValDirect(result, resultIndex++, currentElement);
</span><span class="cx"> }
</span><span class="cx"> currentElement = arguments[argIndex];
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorebytecodeBytecodeIntrinsicRegistrycpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/bytecode/BytecodeIntrinsicRegistry.cpp (212018 => 212019)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/bytecode/BytecodeIntrinsicRegistry.cpp 2017-02-10 01:49:41 UTC (rev 212018)
+++ trunk/Source/JavaScriptCore/bytecode/BytecodeIntrinsicRegistry.cpp 2017-02-10 01:54:24 UTC (rev 212019)
</span><span class="lines">@@ -1,6 +1,6 @@
</span><span class="cx"> /*
</span><span class="cx"> * Copyright (C) 2015 Yusuke Suzuki <utatane.tea@gmail.com>.
</span><del>- * Copyright (C) 2016 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2016-2017 Apple Inc. All rights reserved.
</ins><span class="cx"> *
</span><span class="cx"> * Redistribution and use in source and binary forms, with or without
</span><span class="cx"> * modification, are permitted provided that the following conditions
</span><span class="lines">@@ -53,6 +53,7 @@
</span><span class="cx"> m_iterationKindKey.set(m_vm, jsNumber(IterateKey));
</span><span class="cx"> m_iterationKindValue.set(m_vm, jsNumber(IterateValue));
</span><span class="cx"> m_iterationKindKeyValue.set(m_vm, jsNumber(IterateKeyValue));
</span><ins>+ m_MAX_ARRAY_INDEX.set(m_vm, jsNumber(MAX_ARRAY_INDEX));
</ins><span class="cx"> m_MAX_STRING_LENGTH.set(m_vm, jsNumber(JSString::MaxLength));
</span><span class="cx"> m_MAX_SAFE_INTEGER.set(m_vm, jsDoubleNumber(maxSafeInteger()));
</span><span class="cx"> m_ModuleFetch.set(m_vm, jsNumber(static_cast<unsigned>(JSModuleLoader::Status::Fetch)));
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorebytecodeBytecodeIntrinsicRegistryh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/bytecode/BytecodeIntrinsicRegistry.h (212018 => 212019)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/bytecode/BytecodeIntrinsicRegistry.h 2017-02-10 01:49:41 UTC (rev 212018)
+++ trunk/Source/JavaScriptCore/bytecode/BytecodeIntrinsicRegistry.h 2017-02-10 01:54:24 UTC (rev 212019)
</span><span class="lines">@@ -1,6 +1,6 @@
</span><span class="cx"> /*
</span><span class="cx"> * Copyright (C) 2015 Yusuke Suzuki <utatane.tea@gmail.com>.
</span><del>- * Copyright (C) 2016 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2016-2017 Apple Inc. All rights reserved.
</ins><span class="cx"> *
</span><span class="cx"> * Redistribution and use in source and binary forms, with or without
</span><span class="cx"> * modification, are permitted provided that the following conditions
</span><span class="lines">@@ -64,6 +64,7 @@
</span><span class="cx"> macro(iterationKindKey) \
</span><span class="cx"> macro(iterationKindValue) \
</span><span class="cx"> macro(iterationKindKeyValue) \
</span><ins>+ macro(MAX_ARRAY_INDEX) \
</ins><span class="cx"> macro(MAX_STRING_LENGTH) \
</span><span class="cx"> macro(MAX_SAFE_INTEGER) \
</span><span class="cx"> macro(ModuleFetch) \
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeArrayPrototypecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/ArrayPrototype.cpp (212018 => 212019)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/ArrayPrototype.cpp 2017-02-10 01:49:41 UTC (rev 212018)
+++ trunk/Source/JavaScriptCore/runtime/ArrayPrototype.cpp 2017-02-10 01:54:24 UTC (rev 212019)
</span><span class="lines">@@ -1,6 +1,6 @@
</span><span class="cx"> /*
</span><span class="cx"> * Copyright (C) 1999-2000 Harri Porten (porten@kde.org)
</span><del>- * Copyright (C) 2003, 2007-2009, 2011, 2013, 2015-2016 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2003, 2007-2009, 2011, 2013, 2015-2017 Apple Inc. All rights reserved.
</ins><span class="cx"> * Copyright (C) 2003 Peter Kelly (pmk@post.com)
</span><span class="cx"> * Copyright (C) 2006 Alexey Proskuryakov (ap@nypop.com)
</span><span class="cx"> *
</span><span class="lines">@@ -1216,8 +1216,10 @@
</span><span class="cx"> return JSValue::encode(throwOutOfMemoryError(exec, scope));
</span><span class="cx">
</span><span class="cx"> bool success = result->appendMemcpy(exec, vm, 0, first);
</span><del>- RETURN_IF_EXCEPTION(scope, encodedJSValue());
</del><ins>+ ASSERT(!success || !scope.exception());
</ins><span class="cx"> if (!success) {
</span><ins>+ RETURN_IF_EXCEPTION(scope, encodedJSValue());
+
</ins><span class="cx"> bool success = moveElements(exec, vm, result, 0, first, firstArraySize);
</span><span class="cx"> ASSERT(!scope.exception() == success);
</span><span class="cx"> if (UNLIKELY(!success))
</span><span class="lines">@@ -1311,14 +1313,18 @@
</span><span class="cx"> ASSERT(exec->argumentCount() == 3);
</span><span class="cx">
</span><span class="cx"> VM& vm = exec->vm();
</span><ins>+ auto scope = DECLARE_THROW_SCOPE(vm);
</ins><span class="cx"> JSArray* resultArray = jsCast<JSArray*>(exec->uncheckedArgument(0));
</span><span class="cx"> JSArray* otherArray = jsCast<JSArray*>(exec->uncheckedArgument(1));
</span><span class="cx"> JSValue startValue = exec->uncheckedArgument(2);
</span><span class="cx"> ASSERT(startValue.isAnyInt() && startValue.asAnyInt() >= 0 && startValue.asAnyInt() <= std::numeric_limits<unsigned>::max());
</span><span class="cx"> unsigned startIndex = static_cast<unsigned>(startValue.asAnyInt());
</span><del>- if (!resultArray->appendMemcpy(exec, vm, startIndex, otherArray))
</del><ins>+ bool success = resultArray->appendMemcpy(exec, vm, startIndex, otherArray);
+ ASSERT(!success || !scope.exception());
+ if (!success) {
+ RETURN_IF_EXCEPTION(scope, encodedJSValue());
</ins><span class="cx"> moveElements(exec, vm, resultArray, startIndex, otherArray, otherArray->length());
</span><del>-
</del><ins>+ }
</ins><span class="cx"> return JSValue::encode(jsUndefined());
</span><span class="cx"> }
</span><span class="cx">
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSArraycpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSArray.cpp (212018 => 212019)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSArray.cpp 2017-02-10 01:49:41 UTC (rev 212018)
+++ trunk/Source/JavaScriptCore/runtime/JSArray.cpp 2017-02-10 01:54:24 UTC (rev 212019)
</span><span class="lines">@@ -40,6 +40,8 @@
</span><span class="cx">
</span><span class="cx"> namespace JSC {
</span><span class="cx">
</span><ins>+static const char* const LengthExceededTheMaximumArrayLengthError = "Length exceeded the maximum array length";
+
</ins><span class="cx"> STATIC_ASSERT_IS_TRIVIALLY_DESTRUCTIBLE(JSArray);
</span><span class="cx">
</span><span class="cx"> const ClassInfo JSArray::s_info = {"Array", &JSNonFinalObject::s_info, 0, CREATE_METHOD_TABLE(JSArray)};
</span><span class="lines">@@ -495,7 +497,15 @@
</span><span class="cx"> return false;
</span><span class="cx">
</span><span class="cx"> unsigned otherLength = otherArray->length();
</span><del>- unsigned newLength = startIndex + otherLength;
</del><ins>+ Checked<unsigned, RecordOverflow> checkedNewLength = startIndex;
+ checkedNewLength += otherLength;
+
+ unsigned newLength;
+ if (checkedNewLength.safeGet(newLength) == CheckedState::DidOverflow) {
+ throwException(exec, scope, createRangeError(exec, ASCIILiteral(LengthExceededTheMaximumArrayLengthError)));
+ return false;
+ }
+
</ins><span class="cx"> if (newLength >= MIN_SPARSE_ARRAY_INDEX)
</span><span class="cx"> return false;
</span><span class="cx">
</span><span class="lines">@@ -724,7 +734,7 @@
</span><span class="cx"> if (UNLIKELY(length > MAX_ARRAY_INDEX)) {
</span><span class="cx"> methodTable(vm)->putByIndex(this, exec, length, value, true);
</span><span class="cx"> if (!scope.exception())
</span><del>- throwException(exec, scope, createRangeError(exec, ASCIILiteral("Invalid array length")));
</del><ins>+ throwException(exec, scope, createRangeError(exec, ASCIILiteral(LengthExceededTheMaximumArrayLengthError)));
</ins><span class="cx"> return;
</span><span class="cx"> }
</span><span class="cx">
</span><span class="lines">@@ -745,7 +755,7 @@
</span><span class="cx"> if (UNLIKELY(length > MAX_ARRAY_INDEX)) {
</span><span class="cx"> methodTable(vm)->putByIndex(this, exec, length, value, true);
</span><span class="cx"> if (!scope.exception())
</span><del>- throwException(exec, scope, createRangeError(exec, ASCIILiteral("Invalid array length")));
</del><ins>+ throwException(exec, scope, createRangeError(exec, ASCIILiteral(LengthExceededTheMaximumArrayLengthError)));
</ins><span class="cx"> return;
</span><span class="cx"> }
</span><span class="cx">
</span><span class="lines">@@ -780,7 +790,7 @@
</span><span class="cx"> if (UNLIKELY(length > MAX_ARRAY_INDEX)) {
</span><span class="cx"> methodTable(vm)->putByIndex(this, exec, length, value, true);
</span><span class="cx"> if (!scope.exception())
</span><del>- throwException(exec, scope, createRangeError(exec, ASCIILiteral("Invalid array length")));
</del><ins>+ throwException(exec, scope, createRangeError(exec, ASCIILiteral(LengthExceededTheMaximumArrayLengthError)));
</ins><span class="cx"> return;
</span><span class="cx"> }
</span><span class="cx">
</span><span class="lines">@@ -819,7 +829,7 @@
</span><span class="cx"> methodTable(vm)->putByIndex(this, exec, storage->length(), value, true);
</span><span class="cx"> // Per ES5.1 15.4.4.7 step 6 & 15.4.5.1 step 3.d.
</span><span class="cx"> if (!scope.exception())
</span><del>- throwException(exec, scope, createRangeError(exec, ASCIILiteral("Invalid array length")));
</del><ins>+ throwException(exec, scope, createRangeError(exec, ASCIILiteral(LengthExceededTheMaximumArrayLengthError)));
</ins><span class="cx"> return;
</span><span class="cx"> }
</span><span class="cx">
</span></span></pre>
</div>
</div>
</body>
</html>