Details
-
Bug
-
Resolution: Done
-
P1: Critical
-
5.13.2
-
49cf23bd2a14e2ca7236b261d7960588f07f5a0b (qt/qtdeclarative/5.14)
Description
Performing Array.includes on a sufficiently large array crashes the engine by overflowing the engine stack into one of the guard pages.
let arr = new Array(10000000);
arr.includes(42);
This happens because method_includes (at qv4arrayobject.cpp:1053) turns every object in the array into a ScopedValue, and never cleans it up inbetween even though the object no longer necessarily needs to stay alive once method_includes is done with it (the ScopedValue itself is of course destroyed, but cleanup of the stack only happens when the underlying Scope goes away).
Attachments
For Gerrit Dashboard: QTBUG-81104 | ||||||
---|---|---|---|---|---|---|
# | Subject | Branch | Project | Status | CR | V |
285651,4 | QV4: Array.includes: Support large arrays | 5.14 | qt/qtdeclarative | Status: MERGED | +2 | 0 |