AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

[typedarray] Really check that the JSTypedArray::length is always a Smi.

Browse Source 
Even after https://codereview.chromium.org/2371963002 we might still
create JSTypedArray instances where the length field is a HeapNumber,
especially when TurboFan no longer canonicalizes all values in Smi
range to Smis (which we try to achieve currently). This adds strict
checking for this fact now.

R=mstarzinger@chromium.org

Review-Url: https://codereview.chromium.org/2373013002
Cr-Commit-Position: refs/heads/master@{#39771}
This commit is contained in:
bmeurer 2016-09-27 06:23:08 -07:00 committed by Commit bot
parent d32d7e3211
commit bda4774c37
2 changed files with 2 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
src/objects-debug.cc
View File

@ -888,9 +888,7 @@ void JSTypedArray::JSTypedArrayVerify() {
CHECK(IsJSTypedArray());
JSArrayBufferViewVerify();
VerifyPointer(raw_length());
CHECK(raw_length()->IsSmi() || raw_length()->IsHeapNumber() ||
raw_length()->IsUndefined(GetIsolate()));
CHECK(raw_length()->IsSmi() || raw_length()->IsUndefined(GetIsolate()));
VerifyPointer(elements());
}

1
src/runtime/runtime-typedarray.cc
View File

@ -204,6 +204,7 @@ RUNTIME_FUNCTION(Runtime_TypedArrayInitializeFromArrayLike) {
length = JSTypedArray::cast(*source)->length_value();
} else {
CHECK(TryNumberToSize(*length_obj, &length));
CHECK(length_obj->IsSmi());
}
if ((length > static_cast<unsigned>(Smi::kMaxValue)) ||