nagai/fune
3
0
Fork 0
forked from mirrors/gecko-dev
Code Pull requests Activity

Bug 1822710 - Check shortestPaths max paths value r=spidermonkey-reviewers,iain

Browse source 
Differential Revision: https://phabricator.services.mozilla.com/D180271
This commit is contained in:
Steve Fink 2023-06-08 22:24:41 +00:00
parent 5369496be1
commit 1a0618b7b9
2 changed files with 13 additions and 0 deletions
repo.diff.show_diff_stats Download patch file Download diff file Expand all files Collapse all files

7
js/public/UbiNodeShortestPaths.h
View file

@ -7,6 +7,7 @@
#ifndef js_UbiNodeShortestPaths_h
#define js_UbiNodeShortestPaths_h
#include "mozilla/CheckedInt.h"
#include "mozilla/Maybe.h"
#include <utility>
@ -246,6 +247,12 @@ struct JS_PUBLIC_API ShortestPaths {
MOZ_ASSERT(targets.count() > 0);
MOZ_ASSERT(maxNumPaths > 0);
mozilla::CheckedInt<uint32_t> max = maxNumPaths;
max *= targets.count();
if (!max.isValid()) {
return mozilla::Nothing();
}
ShortestPaths paths(maxNumPaths, root, std::move(targets));
Handler handler(paths);

6
js/src/jit-test/tests/heap-analysis/shortestPaths.js
View file

@ -79,6 +79,12 @@ assertEq(e, "TypeError: 100 is not an array object");
try { paths = shortestPaths([f], {start: 200}); } catch (exc) { e = ""+exc; };
assertEq(e, "TypeError: 200 is not a GC thing");
try { paths = shortestPaths([f, {}, {}, {}], { maxNumPaths: 0x40000000 }); } catch (exc) { e = "" + exc; };
assertEq(e, "out of memory");
try { paths = shortestPaths([f], { maxNumPaths: -1 }); } catch (exc) { e = "" + exc; };
assertEq(e, "TypeError: -1 is not greater than 0");
// Bug 1799824.
let arr = [{}];
let objWithGetter = {get start() { arr.length = 0; return {}; }};