Commit 014cadc9 authored by Camillo's avatar Camillo Committed by V8 LUCI CQ

[deserializer] ReadVarint and ReadVarintLoop should behave the same

Make sure both the fast and slow version return the same value in case
of wrong follow-bit values in the input.

Bug: chromium:1359230, chromium:1360735
Change-Id: Ic65f81109e5bbc288fa41a5540ec7e6cece10ffc
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3890998
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: 's avatarSamuel Groß <saelo@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83307}
parent 6dab3f2d
......@@ -1340,6 +1340,9 @@ Maybe<T> ValueDeserializer::ReadVarintLoop() {
// Since {value} is not modified in this branch we can safely skip the
// DCHECK when fuzzing.
DCHECK_IMPLIES(!v8_flags.fuzzing, !has_another_byte);
// For consistency with the fast unrolled loop in ReadVarint we return
// after we have read size(T) + 1 bytes.
return Just(value);
}
position_++;
} while (has_another_byte);
......
......@@ -14,11 +14,12 @@ try {
} catch(e) { }
const str = /\dei7/sgiuy;
const obj = {"a":str, "length":9007199254740991};
const increment = 2061353130;
let n = increment * 21;
for (let i = 0; i < 52; i++) {
function test(length) {
const str = /\dei7/sgiuy;
const obj = {"a":str, "length":length};
const increment = 2061353130;
let n = increment * 21;
for (let i = 0; i < 52; i++) {
n += increment;
try {
const v9 = d8.serializer.serialize(obj);
......@@ -27,4 +28,10 @@ for (let i = 0; i < 52; i++) {
const v11 = d8.serializer.deserialize(v9);
} catch(v12) {
}
}
}
test(9007199254740991);
test(0xFFFFFFFFFFFF3F43);
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment