Changeset 202415 in webkit

Timestamp:

Jun 23, 2016 9:39:35 PM (8 years ago)

Author:

commit-queue@webkit.org

Message:

OOM Assertion failure in Array.prototype.toString
​https://bugs.webkit.org/show_bug.cgi?id=158793

Patch by Benjamin Poulain <​bpoulain@apple.com> on 2016-06-23
Reviewed by Saam Barati.

Source/JavaScriptCore:

JSString::create() taking a StringImpl was using a signed integer
for the length of the string.
The problem is StringImpl uses an unsigned integer. When a large string
was passed to JSString, the signed integer would be negative and crash
JSString.

• runtime/JSString.h:

(JSC::JSString::create):

LayoutTests:

• js/script-tests/stringimpl-to-jsstring-on-large-strings-1.js: Added.

(string_appeared_here.createStrings):

• js/script-tests/stringimpl-to-jsstring-on-large-strings-2.js: Added.

(string_appeared_here.createRegexp):
(catch):

• js/script-tests/stringimpl-to-jsstring-on-large-strings-3.js: Added.

(string_appeared_here.createStrings):
(catch):

• js/stringimpl-to-jsstring-on-large-strings-1-expected.txt: Added.
• js/stringimpl-to-jsstring-on-large-strings-1.html: Added.
• js/stringimpl-to-jsstring-on-large-strings-2-expected.txt: Added.
• js/stringimpl-to-jsstring-on-large-strings-2.html: Added.
• js/stringimpl-to-jsstring-on-large-strings-3-expected.txt: Added.
• js/stringimpl-to-jsstring-on-large-strings-3.html: Added.

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/js/script-tests/stringimpl-to-jsstring-on-large-strings-1.js (added)
• LayoutTests/js/script-tests/stringimpl-to-jsstring-on-large-strings-2.js (added)
• LayoutTests/js/script-tests/stringimpl-to-jsstring-on-large-strings-3.js (added)
• LayoutTests/js/stringimpl-to-jsstring-on-large-strings-1-expected.txt (added)
• LayoutTests/js/stringimpl-to-jsstring-on-large-strings-1.html (added)
• LayoutTests/js/stringimpl-to-jsstring-on-large-strings-2-expected.txt (added)
• LayoutTests/js/stringimpl-to-jsstring-on-large-strings-2.html (added)
• LayoutTests/js/stringimpl-to-jsstring-on-large-strings-3-expected.txt (added)
• LayoutTests/js/stringimpl-to-jsstring-on-large-strings-3.html (added)
• Source/JavaScriptCore/ChangeLog (modified) (1 diff)
• Source/JavaScriptCore/runtime/JSString.h (modified) (1 diff)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2016-06-23  Benjamin Poulain  <bpoulain@apple.com>
+
+        OOM Assertion failure in Array.prototype.toString
+        https://bugs.webkit.org/show_bug.cgi?id=158793
+
+        Reviewed by Saam Barati.
+
+        * js/script-tests/stringimpl-to-jsstring-on-large-strings-1.js: Added.
+        (string_appeared_here.createStrings):
+        * js/script-tests/stringimpl-to-jsstring-on-large-strings-2.js: Added.
+        (string_appeared_here.createRegexp):
+        (catch):
+        * js/script-tests/stringimpl-to-jsstring-on-large-strings-3.js: Added.
+        (string_appeared_here.createStrings):
+        (catch):
+        * js/stringimpl-to-jsstring-on-large-strings-1-expected.txt: Added.
+        * js/stringimpl-to-jsstring-on-large-strings-1.html: Added.
+        * js/stringimpl-to-jsstring-on-large-strings-2-expected.txt: Added.
+        * js/stringimpl-to-jsstring-on-large-strings-2.html: Added.
+        * js/stringimpl-to-jsstring-on-large-strings-3-expected.txt: Added.
+        * js/stringimpl-to-jsstring-on-large-strings-3.html: Added.
+
 2016-06-23  Brady Eidson  <beidson@apple.com>
 

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2016-06-23  Benjamin Poulain  <bpoulain@apple.com>
+
+        OOM Assertion failure in Array.prototype.toString
+        https://bugs.webkit.org/show_bug.cgi?id=158793
+
+        Reviewed by Saam Barati.
+
+        JSString::create() taking a StringImpl was using a signed integer
+        for the length of the string.
+        The problem is StringImpl uses an unsigned integer. When a large string
+        was passed to JSString, the signed integer would be negative and crash
+        JSString.
+
+        * runtime/JSString.h:
+        (JSC::JSString::create):
+
 2016-06-23  Joseph Pecoraro  <pecoraro@apple.com> and Yusuke Suzuki  <utatane.tea@gmail.com>
 

trunk/Source/JavaScriptCore/runtime/JSString.h

@@ -133 +133 @@
     {
         ASSERT(value);
-        int32_t length = value->length();
-        RELEASE_ASSERT(length >= 0);
+        unsigned length = value->length();
         size_t cost = value->cost();
         JSString* newString = new (NotNull, allocateCell<JSString>(vm.heap)) JSString(vm, value);