Correctly check for stack limit in JSON.stringify.

src/json-stringifier.h

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 27 matching lines @@
 class BasicJsonStringifier BASE_EMBEDDED {
  public:
   explicit BasicJsonStringifier(Isolate* isolate);
 
   MaybeObject* Stringify(Handle<Object> object);
 
  private:
   static const int kInitialPartLength = 32;
   static const int kMaxPartLength = 16 * 1024;
   static const int kPartLengthGrowthFactor = 2;
-  static const int kStackLimit = 4 * 1024;
 
   enum Result { UNCHANGED, SUCCESS, BAILOUT, CIRCULAR, STACK_OVERFLOW };
 
   template <bool is_ascii> void Extend();
 
   void ChangeEncoding();
 
   void ShrinkCurrentPart();
 
   template <bool is_ascii, typename Char>
@@ skipping 11 matching lines @@
   }
 
   INLINE(void Append(const char* chars)) {
     if (is_ascii_) {
       Append_<true>(chars);
     } else {
       Append_<false>(chars);
     }
   }
 
-  INLINE(Handle<Object> GetProperty(Handle<JSObject> object,
-                                    Handle<String> key));
+  Handle<Object> GetProperty(Handle<JSObject> object,
+                             Handle<String> key);
 
-  INLINE(bool MayHaveToJsonFunction(Handle<JSObject> object));
+  bool MayHaveToJsonFunction(Handle<JSObject> object);
 
   INLINE(Result Serialize(Handle<Object> object)) {
     return Serialize_<false>(object);
   }
 
   INLINE(Result SerializeDeferred(Handle<Object> object,
                            bool deferred_comma,
                            Handle<String> deferred_key)) {
     ASSERT(!deferred_key.is_null());
     return Serialize_<true>(object, deferred_comma, deferred_key);
   }
 
   template <bool deferred_key>
   Result Serialize_(Handle<Object> object,
                     bool comma = false,
                     Handle<String> key = Handle<String>::null());
 
-  INLINE(void SerializeDeferredKey(bool deferred_comma,
-                                   Handle<String> deferred_key)) {
+  void SerializeDeferredKey(bool deferred_comma, Handle<String> deferred_key) {
     if (deferred_comma) Append(',');
     SerializeString(deferred_key);
     Append(':');
   }
 
-  INLINE(Result SerializeSmi(Smi* object));
+  Result SerializeSmi(Smi* object);
 
-  INLINE(Result SerializeDouble(double number));
+  Result SerializeDouble(double number);
   INLINE(Result SerializeHeapNumber(Handle<HeapNumber> object)) {
     return SerializeDouble(object->value());
   }
 
-  Result SerializeArray(Handle<JSArray> object);
-  Result SerializeObject(Handle<JSObject> object);
+  INLINE(Result SerializeArray(Handle<JSArray> object));
+  INLINE(Result SerializeObject(Handle<JSObject> object));
 
   void SerializeString(Handle<String> object);
 
   template <typename SrcChar, typename DestChar>
   INLINE(void SerializeStringUnchecked_(const SrcChar* src,
                                         DestChar* dest,
                                         int length));
 
   template <bool is_ascii, typename Char>
   INLINE(void SerializeString_(Vector<const Char> vector,
                                Handle<String> string));
 
   template <typename Char>
   INLINE(bool DoNotEscape(Char c));
 
   template <typename Char>
   INLINE(Vector<const Char> GetCharVector(Handle<String> string));
 
-  INLINE(Result StackPush(Handle<Object> object));
-  INLINE(void StackPop());
+  Result StackPush(Handle<Object> object);
+  void StackPop();
 
   INLINE(Handle<String> accumulator()) {
     return Handle<String>(String::cast(accumulator_store_->value()));
   }
 
   INLINE(void set_accumulator(Handle<String> string)) {
     return accumulator_store_->set_value(*string);
   }
 
   Isolate* isolate_;
@@ skipping 144 matching lines @@
     default:
       return true;
   }
   ASSERT(!value->IsTheHole());
   return value->IsSpecFunction();
 }
 
 
 BasicJsonStringifier::Result BasicJsonStringifier::StackPush(
     Handle<Object> object) {
+  StackLimitCheck check(isolate_);
+  if (check.HasOverflowed()) return STACK_OVERFLOW;
+
   int length = Smi::cast(stack_->length())->value();
-  if (length > kStackLimit) return STACK_OVERFLOW;
   FixedArray* elements = FixedArray::cast(stack_->elements());
   for (int i = 0; i < length; i++) {
     if (elements->get(i) == *object) {
       return CIRCULAR;
     }
   }
   stack_->EnsureSize(length + 1);
   FixedArray::cast(stack_->elements())->set(length, *object);
   stack_->set_length(Smi::FromInt(length + 1));
   return SUCCESS;
@@ skipping 153 matching lines @@
     Handle<JSObject> object) {
   HandleScope handle_scope(isolate_);
   Result stack_push = StackPush(object);
   if (stack_push != SUCCESS) return stack_push;
   if (object->IsJSGlobalProxy()) return BAILOUT;
   bool threw = false;
   Handle<FixedArray> contents =
       GetKeysInFixedArrayFor(object, LOCAL_ONLY, &threw);
   if (threw) return BAILOUT;
   Append('{');
-  int length = contents->length();
   bool comma = false;
-  for (int i = 0; i < length; i++) {
+  for (int i = 0; i < contents->length(); i++) {
     Object* key = contents->get(i);
     Handle<String> key_handle;
     Handle<Object> property;
     if (key->IsString()) {
       key_handle = Handle<String>(String::cast(key));
       property = GetProperty(object, key_handle);
     } else {
       ASSERT(key->IsNumber());
       key_handle = isolate_->factory()->NumberToString(Handle<Object>(key));
       uint32_t index;
@@ skipping 189 matching lines @@
       SerializeString_<false, char>(flat.ToAsciiVector(), object);
     } else {
       SerializeString_<false, uc16>(flat.ToUC16Vector(), object);
     }
   }
 }
 
 } }  // namespace v8::internal
 
 #endif  // V8_JSON_STRINGIFIER_H_