commit 0b3bc8eaaf7c6164c148a6048f63a88535b3a077
author Rubin Xu <rubinxu@google.com> Mon May 18 14:45:11 2020 +0100
committer Anis Assi <anisassi@google.com> Thu Jun 04 11:27:18 2020 -0700
tree 46d75021e9cb0c5e1b54b886d1045a6cb94c95a2
parent 180b7314c627e284f61b00682e5847bbfb338008

Fix integer overflow in NewFixedDoubleArray

Bug: 150706594
Test: atest proxy_resolver_v8_unittest
Change-Id: I23ccda06bdb2dba631236828e5d6eeaf88717812
(cherry picked from commit 0809cf96aa0a547150173bd0cb06452dce878d61)

src/heap/factory.cc

diff --git a/src/heap/factory.cc b/src/heap/factory.cc
index c8528f9..2ac0d99 100644
--- a/src/heap/factory.cc
+++ b/src/heap/factory.cc
@@ -469,7 +469,7 @@
                                                     PretenureFlag pretenure) {
   DCHECK_LE(0, length);
   if (length == 0) return empty_fixed_array();
-  if (length > FixedDoubleArray::kMaxLength) {
+  if (length < 0 || length > FixedDoubleArray::kMaxLength) {
     isolate()->heap()->FatalProcessOutOfMemory("invalid array length");
   }
   int size = FixedDoubleArray::SizeFor(length);