Commit 7897dea
committed
Array handling improvements, fix svaaralaGH-2023
When array size is limited to 16 bits, some internal operations which
don't support abandoning the array could try to grow it beyond 16 bits
rather than abandoning the array part. This caused an assertion failure
and also potentially memory unsafe behavior.
Changes:
* When growing the property table, sanity check entry and array sizes.
If the new values won't fit in the duk_hobject structure (which may
happen with 16-bit fields), fail the grow attempt with an internal
error. This avoids field truncation and potentially memory unsafe
behavior as a result.
* Rework array part growth vs. abandon code to avoid the svaaralaGH-2023 issue.
* Add support for keeping array part when possible into
Object.defineProperty().
* Add support for abandoning array part when using internal variants
for defining properties (such as in Array .map()).
* Executor compile warning fix.
* Debug logging trivia, downgrade a noisy log entry.
* Fix compile warning in duk_cmdline.c.1 parent 6fa9215 commit 7897dea
3 files changed
Lines changed: 211 additions & 140 deletions
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
229 | 229 | | |
230 | 230 | | |
231 | 231 | | |
232 | | - | |
| 232 | + | |
233 | 233 | | |
234 | 234 | | |
235 | 235 | | |
| |||
0 commit comments