diff --git a/js/src/frontend/BinASTTokenReaderContext.cpp b/js/src/frontend/BinASTTokenReaderContext.cpp index 8ab6a65b5c83..54e77daf7818 100644 --- a/js/src/frontend/BinASTTokenReaderContext.cpp +++ b/js/src/frontend/BinASTTokenReaderContext.cpp @@ -6,8 +6,9 @@ #include "frontend/BinASTTokenReaderContext.h" -#include "mozilla/Result.h" // MOZ_TRY* -#include "mozilla/ScopeExit.h" // mozilla::MakeScopeExit +#include "mozilla/IntegerTypeTraits.h" // mozilla::MaxValue +#include "mozilla/Result.h" // MOZ_TRY* +#include "mozilla/ScopeExit.h" // mozilla::MakeScopeExit #include // memchr, memcmp, memmove @@ -1785,8 +1786,15 @@ JS::Result HuffmanTableImplementationGeneric::init( JSContext* cx, size_t numberOfSymbols, uint8_t maxBitLength) { MOZ_ASSERT(this->implementation.template is< HuffmanTableUnreachable>()); // Make sure that we're initializing. - if (maxBitLength > MAX_BIT_LENGTH_IN_SATURATED_TABLE || - numberOfSymbols > 256) { + if ( + // If the bit length is too large, don't put it in a saturated table + // as this would need too much space. + maxBitLength > MAX_BIT_LENGTH_IN_SATURATED_TABLE || + // If there are too many symbols, don't put it in a saturated table + // as indices wouldn't fit into `InternalIndex` . + numberOfSymbols > + mozilla::MaxValue::InternalIndex>::value) { this->implementation = { mozilla::VariantType>{}, cx}; MOZ_TRY(this->implementation.template as>() diff --git a/js/src/frontend/BinASTTokenReaderContext.h b/js/src/frontend/BinASTTokenReaderContext.h index af805da65db5..f9cb030e3c87 100644 --- a/js/src/frontend/BinASTTokenReaderContext.h +++ b/js/src/frontend/BinASTTokenReaderContext.h @@ -451,6 +451,12 @@ class HuffmanTableImplementationSaturated { Iterator begin() const { return Iterator(values.begin()); } Iterator end() const { return Iterator(values.end()); } + public: + // An index into table `values`. + // We use `uint8_t` instead of `size_t` to limit the space + // used by the table. + using InternalIndex = uint8_t; + private: // The entries in this Huffman Table, sorted in the order of insertion. // @@ -460,12 +466,11 @@ class HuffmanTableImplementationSaturated { Vector> values; // The entries in this Huffman table, prepared for lookup. - // The `size_t` argument is an index into `values`. // // Invariant (once `init*` has been called): // - Length is `1 << maxBitLength`. // - for all i, `saturated[i] < values.length()` - Vector saturated; + Vector saturated; // The maximal bitlength of a value in this table. //