Commit 7ee518df authored by barraclough@apple.com's avatar barraclough@apple.com

JavaScriptCore:

2008-07-22  Gavin Barraclough  <barraclough@apple.com>

        Reviewed by Alexey Proskuryakov.

        Prevent integer overflow when reallocating storage vector for arrays.

        Sunspider reports 1.005x as fast (no change expected).

        * kjs/JSArray.cpp:

WebCore:

2008-07-22  Gavin Barraclough  <barraclough@apple.com>

        Reviewed by Alexey Proskuryakov.

        New test to check that arrays fail gracefully (throw an out of memory exception)
        when the vector grows to large.

        * manual-tests/array-out-of-memory.html:         Added.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@35285 268f45cc-cd09-0410-ab3c-d52691b4dbfc
parent 565d7524
2008-07-22 Gavin Barraclough <barraclough@apple.com>
Reviewed by Alexey Proskuryakov.
Prevent integer overflow when reallocating storage vector for arrays.
Sunspider reports 1.005x as fast (no change expected).
* kjs/JSArray.cpp:
2008-07-21 Mark Rowe <mrowe@apple.com>
Reviewed by Sam Weinig.
This diff is collapsed.
2008-07-22 Gavin Barraclough <barraclough@apple.com>
Reviewed by Alexey Proskuryakov.
New test to check that arrays fail gracefully (throw an out of memory exception)
when the vector grows to large.
* manual-tests/array-out-of-memory.html: Added.
2008-07-21 Alexey Proskuryakov <ap@webkit.org>
Reviewed by Dan Bernstein.
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
<html>
<head>
<script>
function runArrayOOMTest() {
document.write("<p>Starting test...</p>");
// The index 'target' is the location in the array we expect to fault on access, should the size calculation of the realloc of the vector be allowed
// to overflow. The vector needs to be ((target + 1) * sizeof(JSValue*)) bytes long to hold 'target', or approximately 2/3 UINT32_MAX. Upon growing
// the array an additional 50% capacity will be allocated, plus the storage object header, taking the size of the allocation over UINT32_MAX.
var target = Math.floor(0xFFFFFFFF / 6);
// In order to force arr[target] to be stored in the vector, rather than the sparse map, we need ensure the vector is sufficiently densely populated.
var populate = Math.floor(target / 8 + 1);
try {
var arr = new Array();
for (i=0; i < populate; ++i)
arr[i] = 0;
arr[target] = 0;
} catch(e) {
var expect_name = "Error";
var expect_message = "Out of memory";
if ((e.name == expect_name) && (e.message == expect_message))
document.write("<p>SUCCESS</p>");
else
document.write("<p>FAIL - Expected \"" + expect_name + "/" + expect_message + "\", got \"" + e.name + "/" + e.message + "\".</p>");
return;
}
document.write("<p>FAIL - Expected exception.</p>");
}
</script>
</head>
<body>
<p>This test checks that Array objects fail gracefully (throw exception) when array length grows large.</p>
<p>This test may run for over 20 seconds on a fast machine, and will consume hundereds of MB of memory.</p>
<input type="button" onclick="runArrayOOMTest()" value="Start">
</body>
</html>
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment