AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

Harden Runtime_LiveEditCheckAndDropActivations against unsafe args.

Browse Source 
R=jarin@chromium.org
BUG=390925
LOG=N

Review URL: https://codereview.chromium.org/362983004

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@22169 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
This commit is contained in:
yangguo@chromium.org 2014-07-02 15:09:44 +00:00
parent 7a8a44aaf6
commit f353ff668a
3 changed files with 11 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
src/liveedit.cc
View File

@ -1957,7 +1957,7 @@ Handle<JSArray> LiveEdit::CheckAndDropActivations(
Isolate* isolate = shared_info_array->GetIsolate();
int len = GetArrayLength(shared_info_array);
CHECK(shared_info_array->HasFastElements());
ASSERT(shared_info_array->HasFastElements());
Handle<FixedArray> shared_info_array_elements(
FixedArray::cast(shared_info_array->elements()));

1
src/runtime.cc
View File

@ -13503,6 +13503,7 @@ RUNTIME_FUNCTION(Runtime_LiveEditCheckAndDropActivations) {
CONVERT_ARG_HANDLE_CHECKED(JSArray, shared_array, 0);
CONVERT_BOOLEAN_ARG_CHECKED(do_drop, 1);
RUNTIME_ASSERT(shared_array->length()->IsSmi());
RUNTIME_ASSERT(shared_array->HasFastElements())
int array_length = Smi::cast(shared_array->length())->value();
for (int i = 0; i < array_length; i++) {
Handle<Object> element =

9
test/mjsunit/regress/regress-crbug-390925.js Normal file
View File

@ -0,0 +1,9 @@
// Copyright 2014 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --allow-natives-syntax
var a = new Array();
Object.freeze(a);
assertThrows(function() { %LiveEditCheckAndDropActivations(a, true); });