openharmony/arkcompiler_ets_runtime
1
0
Fork 0
mirror of https://gitee.com/openharmony/arkcompiler_ets_runtime synced 2024-10-07 16:13:49 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Fix AOT RuntimeOptCopyRestArgs

Browse Source 
The variable actualRestNum in RuntimeOptCopyRestArgs computed mistakely and may out of uint32_t range.
The Bug causes the startup of cocos application crash with OOM error.
Add minimal regression test case.

Issue: https://gitee.com/openharmony/arkcompiler_ets_runtime/issues/I6NAWN

Signed-off-by: dingding <dingding5@huawei.com>
Change-Id: Ie7118a9cc83514e9e0c23c5c6c2bed53dd53c1c2
This commit is contained in:
dingding 2023-03-15 14:19:18 +08:00
parent abed55fff0
commit 67791cca8f
3 changed files with 11 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
ecmascript/stubs/runtime_stubs-inl.h
View File

@ -2236,7 +2236,7 @@ JSTaggedValue RuntimeStubs::RuntimeOptCopyRestArgs(JSThread *thread, uint32_t ac
{
// when only have three fixed args, restIndex in bytecode maybe not zero, but it actually should be zero.
uint32_t actualRestNum = 0;
if (actualArgc > NUM_MANDATORY_JSFUNC_ARGS) {
if (actualArgc > NUM_MANDATORY_JSFUNC_ARGS + restIndex) {
actualRestNum = actualArgc - NUM_MANDATORY_JSFUNC_ARGS - restIndex;
}
JSHandle<JSTaggedValue> restArray = JSArray::ArrayCreate(thread, JSTaggedNumber(actualRestNum));

9
test/aottest/copyrestargs/copyrestargs.ts
View File

@ -22,3 +22,12 @@ function f(a:any,...A:any) {
f(1, 2, 3);
f(1, "success", "fail");
// The following test cases have exposed a bug: the variable actualRestNum in RuntimeOptCopyRestArgs
// computed mistakely and may out of uint32_t range.
function foo(x: number, y?: number, ...restArgs: number[]):void {
let arr = [...restArgs];
print(arr.length);
}
foo(1);

1
test/aottest/copyrestargs/expect_output.txt
View File

@ -15,3 +15,4 @@
3
success
fail
0