AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

[crankshaft] Properly handle OOB string accesses.

Browse Source 
BUG=chromium:665793

Review-Url: https://codereview.chromium.org/2589823003
Cr-Commit-Position: refs/heads/master@{#41842}
This commit is contained in:
ishell 2016-12-20 02:01:59 -08:00 committed by Commit bot
parent 119db080c5
commit 576a46f520
2 changed files with 18 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
src/crankshaft/hydrogen.cc
View File

@ -7508,6 +7508,12 @@ void HOptimizedGraphBuilder::BuildLoad(Property* expr,
HValue* string = Pop(); HValue* string = Pop();
HInstruction* char_code = BuildStringCharCodeAt(string, index); HInstruction* char_code = BuildStringCharCodeAt(string, index);
AddInstruction(char_code); AddInstruction(char_code);
if (char_code->IsConstant()) {
HConstant* c_code = HConstant::cast(char_code);
if (c_code->HasNumberValue() && std::isnan(c_code->DoubleValue())) {
Add<HDeoptimize>(DeoptimizeReason::kOutOfBounds, Deoptimizer::EAGER);
}
}
instr = NewUncasted<HStringCharFromCode>(char_code); instr = NewUncasted<HStringCharFromCode>(char_code);
} else if (expr->key()->IsPropertyName()) { } else if (expr->key()->IsPropertyName()) {

12
test/mjsunit/regress/regress-crbug-665793.js Normal file
View File

@ -0,0 +1,12 @@
// Copyright 2016 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --allow-natives-syntax
function foo() {
return 'x'[1];
}
assertEquals(undefined, foo());
%OptimizeFunctionOnNextCall(foo);
assertEquals(undefined, foo());