8020357: throw RangeError for too large NativeArrayBuffer size

Reviewed-by: jlaskey, hannesw, sundar

3 files changed, 60 insertions, 2 deletions

diff --git a/src/jdk/nashorn/internal/objects/ArrayBufferView.java b/src/jdk/nashorn/internal/objects/ArrayBufferView.java
index 73969fa5..40b1a95c 100644
--- a/src/jdk/nashorn/internal/objects/ArrayBufferView.java
+++ b/src/jdk/nashorn/internal/objects/ArrayBufferView.java
@@ -25,6 +25,8 @@
 
 package jdk.nashorn.internal.objects;
 
+import static jdk.nashorn.internal.runtime.ECMAErrors.rangeError;
+
 import jdk.nashorn.internal.objects.annotations.Attribute;
 import jdk.nashorn.internal.objects.annotations.Getter;
 import jdk.nashorn.internal.objects.annotations.ScriptClass;
@@ -34,8 +36,6 @@ import jdk.nashorn.internal.runtime.ScriptObject;
 import jdk.nashorn.internal.runtime.ScriptRuntime;
 import jdk.nashorn.internal.runtime.arrays.ArrayData;
 
-import static jdk.nashorn.internal.runtime.ECMAErrors.rangeError;
-
 @ScriptClass("ArrayBufferView")
 abstract class ArrayBufferView extends ScriptObject {
 
@@ -275,12 +275,17 @@ abstract class ArrayBufferView extends ScriptObject {
 
     protected static abstract class Factory {
         final int bytesPerElement;
+        final int maxElementLength;
 
         public Factory(final int bytesPerElement) {
             this.bytesPerElement = bytesPerElement;
+            this.maxElementLength = Integer.MAX_VALUE / bytesPerElement;
         }
 
         public final ArrayBufferView construct(final int elementLength) {
+            if(elementLength > maxElementLength) {
+                throw rangeError("inappropriate.array.buffer.length", JSType.toString(elementLength));
+            }
             return construct(new NativeArrayBuffer(elementLength * bytesPerElement), 0, elementLength);
         }
 
diff --git a/test/script/basic/JDK-8020357.js b/test/script/basic/JDK-8020357.js
new file mode 100644
index 00000000..e74bca8a
--- /dev/null
+++ b/test/script/basic/JDK-8020357.js
@@ -0,0 +1,52 @@
+/*
+ * Copyright (c) 2010, 2013, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ * 
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.
+ * 
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ * 
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ * 
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+/**
+ * JDK-8020357: Return range error for too big native array buffers
+ *
+ * @test
+ * @run
+ */
+
+var UNSIGNED_INT_BITS = 31
+var BYTES_PER_INT_32  =  4
+
+var limit = Math.pow(2, UNSIGNED_INT_BITS)/BYTES_PER_INT_32
+
+try {
+    // A value at or under the limit should either succeed if we have
+    // enough heap, or throw an OutOfMemoryError if we don't.
+    Int32Array(limit - 1)
+} catch(e) {
+    if(!(e instanceof java.lang.OutOfMemoryError)) {
+        // Only print an unexpected result; OutOfMemoryError is expected
+        print(e)
+    }
+}
+
+// A value over the limit should throw a RangeError.
+try {
+    Int32Array(limit)
+} catch(e) {
+    print(e)
+}
diff --git a/test/script/basic/JDK-8020357.js.EXPECTED b/test/script/basic/JDK-8020357.js.EXPECTED
new file mode 100644
index 00000000..cf6c27b0
--- /dev/null
+++ b/test/script/basic/JDK-8020357.js.EXPECTED
@@ -0,0 +1 @@
+RangeError: inappropriate array buffer length: 536870912