Always check copy_size before getting accessor and trying to copy.

src/builtins.cc

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 556 matching lines @@
 
     int new_length = len + to_add;
 
     if (new_length > elms->length()) {
       // New backing storage is needed.
       int capacity = new_length + (new_length >> 1) + 16;
       FixedArray* new_elms;
       MaybeObject* maybe_obj = heap->AllocateUninitializedFixedArray(capacity);
       if (!maybe_obj->To(&new_elms)) return maybe_obj;
 
-      ElementsAccessor* accessor = array->GetElementsAccessor();
-      MaybeObject* maybe_failure =
-          accessor->CopyElements(array, 0, new_elms, kind, 0, len, elms_obj);
-      ASSERT(!maybe_failure->IsFailure());
-      USE(maybe_failure);
+      if (len > 0) {
+        ElementsAccessor* accessor = array->GetElementsAccessor();
+        MaybeObject* maybe_failure =
+            accessor->CopyElements(array, 0, new_elms, kind, 0, len, elms_obj);
+        ASSERT(!maybe_failure->IsFailure());
+        USE(maybe_failure);
+      }
       FillWithHoles(heap, new_elms, new_length, capacity);
 
       elms = new_elms;
     }
 
     // Add the provided values.
     AssertNoAllocation no_gc;
     WriteBarrierMode mode = elms->GetWriteBarrierMode(no_gc);
     for (int index = 0; index < to_add; index++) {
       elms->set(index + len, args[index + 1], mode);
@@ skipping 22 matching lines @@
 
     FixedDoubleArray* new_elms;
 
     if (new_length > elms_len) {
       // New backing storage is needed.
       int capacity = new_length + (new_length >> 1) + 16;
       MaybeObject* maybe_obj =
           heap->AllocateUninitializedFixedDoubleArray(capacity);
       if (!maybe_obj->To(&new_elms)) return maybe_obj;
 
-      ElementsAccessor* accessor = array->GetElementsAccessor();
-      MaybeObject* maybe_failure =
-          accessor->CopyElements(array, 0, new_elms, kind, 0, len, elms_obj);
-      ASSERT(!maybe_failure->IsFailure());
-      USE(maybe_failure);
+      if (len > 0) {
+        ElementsAccessor* accessor = array->GetElementsAccessor();
+        MaybeObject* maybe_failure =
+            accessor->CopyElements(array, 0, new_elms, kind, 0, len, elms_obj);
+        ASSERT(!maybe_failure->IsFailure());
+        USE(maybe_failure);
+      }
 
       FillWithHoles(new_elms, len + to_add, new_elms->length());
     } else {
       // to_add is > 0 and new_length <= elms_len, so elms_obj cannot be the
       // empty_fixed_array.
       new_elms = FixedDoubleArray::cast(elms_obj);
     }
 
     // Add the provided values.
     AssertNoAllocation no_gc;
@@ skipping 137 matching lines @@
                                       DONT_ALLOW_DOUBLE_ELEMENTS);
   if (maybe_object->IsFailure()) return maybe_object;
 
   if (new_length > elms->length()) {
     // New backing storage is needed.
     int capacity = new_length + (new_length >> 1) + 16;
     FixedArray* new_elms;
     MaybeObject* maybe_elms = heap->AllocateUninitializedFixedArray(capacity);
     if (!maybe_elms->To(&new_elms)) return maybe_elms;
 
-    ElementsKind kind = array->GetElementsKind();
-    ElementsAccessor* accessor = array->GetElementsAccessor();
-    MaybeObject* maybe_failure =
-        accessor->CopyElements(array, 0, new_elms, kind, to_add, len, elms);
-    ASSERT(!maybe_failure->IsFailure());
-    USE(maybe_failure);
+    if (len > 0) {
+      ElementsKind kind = array->GetElementsKind();
+      ElementsAccessor* accessor = array->GetElementsAccessor();
+      MaybeObject* maybe_failure =
+          accessor->CopyElements(array, 0, new_elms, kind, to_add, len, elms);
+      ASSERT(!maybe_failure->IsFailure());
+      USE(maybe_failure);
+    }
 
     FillWithHoles(heap, new_elms, new_length, capacity);
     elms = new_elms;
     array->set_elements(elms);
   } else {
     AssertNoAllocation no_gc;
     MoveElements(heap, &no_gc, elms, to_add, elms, 0, len);
   }
 
   // Add the provided values.
@@ skipping 120 matching lines @@
   int final = (relative_end < 0) ? Max(len + relative_end, 0)
                                  : Min(relative_end, len);
 
   // Calculate the length of result array.
   int result_len = Max(final - k, 0);
 
   JSArray* result_array;
   MaybeObject* maybe_array = heap->AllocateJSArrayAndStorage(kind,
                                                              result_len,
                                                              result_len);
+
+  if (result_len == 0) return maybe_array;
   if (!maybe_array->To(&result_array)) return maybe_array;
 
   ElementsAccessor* accessor = object->GetElementsAccessor();
   MaybeObject* maybe_failure =
       accessor->CopyElements(object, k, result_array->elements(),
                              kind, 0, result_len, elms);
   ASSERT(!maybe_failure->IsFailure());
   USE(maybe_failure);
 
   return result_array;
@@ skipping 146 matching lines @@
     ASSERT((item_count - actual_delete_count) <= (Smi::kMaxValue - len));
 
     // Check if array need to grow.
     if (new_length > elms->length()) {
       // New backing storage is needed.
       int capacity = new_length + (new_length >> 1) + 16;
       FixedArray* new_elms;
       MaybeObject* maybe_obj = heap->AllocateUninitializedFixedArray(capacity);
       if (!maybe_obj->To(&new_elms)) return maybe_obj;
 
-      // Copy the part before actual_start as is.
       ElementsKind kind = array->GetElementsKind();
       ElementsAccessor* accessor = array->GetElementsAccessor();
-      MaybeObject* maybe_failure = accessor->CopyElements(
-          array, 0, new_elms, kind, 0, actual_start, elms);
-      ASSERT(!maybe_failure->IsFailure());
-      USE(maybe_failure);
+      if (actual_start > 0) {
+        // Copy the part before actual_start as is.
+        MaybeObject* maybe_failure = accessor->CopyElements(
+            array, 0, new_elms, kind, 0, actual_start, elms);
+        ASSERT(!maybe_failure->IsFailure());
+        USE(maybe_failure);
+      }
       const int to_copy = len - actual_delete_count - actual_start;
-      maybe_failure = accessor->CopyElements(
-          array, actual_start + actual_delete_count, new_elms, kind,
-          actual_start + item_count, to_copy, elms);
-      ASSERT(!maybe_failure->IsFailure());
-      USE(maybe_failure);
+      if (to_copy > 0) {
+        MaybeObject* maybe_failure = accessor->CopyElements(
+            array, actual_start + actual_delete_count, new_elms, kind,
+            actual_start + item_count, to_copy, elms);
+        ASSERT(!maybe_failure->IsFailure());
+        USE(maybe_failure);
+      }
 
       FillWithHoles(heap, new_elms, new_length, capacity);
 
       elms_obj = new_elms;
       elms_changed = true;
     } else {
       AssertNoAllocation no_gc;
       MoveElements(heap, &no_gc,
                    elms, actual_start + item_count,
                    elms, actual_start + actual_delete_count,
@@ skipping 58 matching lines @@
     STATIC_ASSERT(FixedArray::kMaxLength < kHalfOfMaxInt);
     USE(kHalfOfMaxInt);
     result_len += len;
     ASSERT(result_len >= 0);
 
     if (result_len > FixedDoubleArray::kMaxLength) {
       return CallJsBuiltin(isolate, "ArrayConcat", args);
     }
 
     ElementsKind arg_kind = JSArray::cast(arg)->map()->elements_kind();
-    ElementsKind packed_kind = GetPackedElementsKind(arg_kind);
-    if (IsMoreGeneralElementsKindTransition(
-            GetPackedElementsKind(elements_kind), packed_kind)) {
-      if (IsFastHoleyElementsKind(elements_kind)) {
-        elements_kind = GetHoleyElementsKind(arg_kind);
-      } else {
-        elements_kind = arg_kind;
-      }
+    if (IsMoreGeneralElementsKindTransition(elements_kind, arg_kind)) {
+      elements_kind = IsFastHoleyElementsKind(elements_kind)
+          ? GetHoleyElementsKind(arg_kind) : arg_kind;
     }
   }
 
   JSArray* result_array;
   // Allocate result.
   MaybeObject* maybe_array =
       heap->AllocateJSArrayAndStorage(elements_kind,
                                       result_len,
                                       result_len);
   if (!maybe_array->To(&result_array)) return maybe_array;
   if (result_len == 0) return result_array;
 
   int j = 0;
   FixedArrayBase* storage = result_array->elements();
   for (int i = 0; i < n_arguments; i++) {
     JSArray* array = JSArray::cast(args[i]);
-    ElementsAccessor* accessor = array->GetElementsAccessor();
     int len = Smi::cast(array->length())->value();
-    MaybeObject* maybe_failure =
-        accessor->CopyElements(array, 0, storage, elements_kind, j, len);
-    if (maybe_failure->IsFailure()) return maybe_failure;
-    j += len;
+    if (len > 0) {
+      ElementsAccessor* accessor = array->GetElementsAccessor();
+      MaybeObject* maybe_failure =
+          accessor->CopyElements(array, 0, storage, elements_kind, j, len);
+      if (maybe_failure->IsFailure()) return maybe_failure;
+      j += len;
+    }
   }
 
   ASSERT(j == result_len);
 
   return result_array;
 }
 
 
 // -----------------------------------------------------------------------------
 // Strict mode poison pills
@@ skipping 692 matching lines @@
   return Handle<Code>(code_address);                        \
 }
 BUILTIN_LIST_C(DEFINE_BUILTIN_ACCESSOR_C)
 BUILTIN_LIST_A(DEFINE_BUILTIN_ACCESSOR_A)
 BUILTIN_LIST_DEBUG_A(DEFINE_BUILTIN_ACCESSOR_A)
 #undef DEFINE_BUILTIN_ACCESSOR_C
 #undef DEFINE_BUILTIN_ACCESSOR_A
 
 
 } }  // namespace v8::internal