Commit 1bf71164 authored by Jakob Gruber's avatar Jakob Gruber Committed by Commit Bot

[regexp] Check regexp type in %RegexpHasNativeCode

Without the type check, Code() may read OOB. Note that this is an
internal, test-only runtime function.

Bug: chromium:1041316
Change-Id: I8c0b21ce3c2aea8aa3d065b99d8ab45a8c9e754f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2000749
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Auto-Submit: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: 's avatarDominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65775}
parent 377b5060
......@@ -1131,8 +1131,13 @@ RUNTIME_FUNCTION(Runtime_RegexpHasNativeCode) {
DCHECK_EQ(2, args.length());
CONVERT_ARG_CHECKED(JSRegExp, regexp, 0);
CONVERT_BOOLEAN_ARG_CHECKED(is_latin1, 1);
bool is_irregexp_native_code = regexp.Code(is_latin1).IsCode();
return isolate->heap()->ToBoolean(is_irregexp_native_code);
bool result;
if (regexp.TypeTag() == JSRegExp::IRREGEXP) {
result = regexp.Code(is_latin1).IsCode();
} else {
result = false;
}
return isolate->heap()->ToBoolean(result);
}
#define ELEMENTS_KIND_CHECK_RUNTIME_FUNCTION(Name) \
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment