commit 32ab7b6d784f24161d312f67a505c71f7c34df40
author Bryan Ferris <bferris@google.com> Tue Mar 05 14:38:25 2019 -0800
committer Bryan Ferris <bferris@google.com> Thu Mar 07 16:23:47 2019 -0800
tree d62188e877034a6cde7f3675c4afbf511f4f099b
parent f88303717d5ed67e6ba13c7177ebd3aada958caf

[RESTRICT AUTOMERGE] Fix OOB Access in libpac

From upstream commit
(https://chromium.googlesource.com/v8/v8.git/+/389539ca30406101971745820d3105e7f39bb772%5E%21/#F0):

"""
Fix type of String#indexOf and String#lastIndexOf.

The Typer put the wrong type on String#index and String#lastIndexOf
builtins, with an off by one on the upper bound.
"""

Bug: 117554758

Test: /data/nativetest/proxy_resolver_v8_unittest/proxy_resolver_v8_unittest

Test: gts-tradefed run gts --test \
  com.google.android.gts.devicepolicy.DeviceOwnerTest#testProxyPacProxyTest \
  --module GtsGmscoreHostTestCases

Test: PoC from bug report

Merged-In: I2e02d994f107e64e4f465b4d8a02d4159a95240e

Change-Id: I6230c1b764cacf9349317ad5870d7a679600d7d5

src/compiler/typer.cc

diff --git a/src/compiler/typer.cc b/src/compiler/typer.cc
index ed1a04a..09003ca 100644
--- a/src/compiler/typer.cc
+++ b/src/compiler/typer.cc
@@ -1431,7 +1431,7 @@
           return Type::String();
         case kStringIndexOf:
         case kStringLastIndexOf:
-          return Type::Range(-1.0, String::kMaxLength - 1.0, t->zone());
+          return Type::Range(-1.0, String::kMaxLength, t->zone());
         case kStringEndsWith:
         case kStringIncludes:
           return Type::Boolean();