nephele
/
haikuwebkit
1
0
Fork 0
Code Issues Releases Activity
haikuwebkit/LayoutTests/js/stringimpl-to-jsstring-on-l...

6 lines
77 B
Plaintext
Raw Permalink Normal View History

OOM Assertion failure in Array.prototype.toString https://bugs.webkit.org/show_bug.cgi?id=158793 Patch by Benjamin Poulain <bpoulain@apple.com> on 2016-06-23 Reviewed by Saam Barati. Source/JavaScriptCore: JSString::create() taking a StringImpl was using a signed integer for the length of the string. The problem is StringImpl uses an unsigned integer. When a large string was passed to JSString, the signed integer would be negative and crash JSString. * runtime/JSString.h: (JSC::JSString::create): LayoutTests: * js/script-tests/stringimpl-to-jsstring-on-large-strings-1.js: Added. (string_appeared_here.createStrings): * js/script-tests/stringimpl-to-jsstring-on-large-strings-2.js: Added. (string_appeared_here.createRegexp): (catch): * js/script-tests/stringimpl-to-jsstring-on-large-strings-3.js: Added. (string_appeared_here.createStrings): (catch): * js/stringimpl-to-jsstring-on-large-strings-1-expected.txt: Added. * js/stringimpl-to-jsstring-on-large-strings-1.html: Added. * js/stringimpl-to-jsstring-on-large-strings-2-expected.txt: Added. * js/stringimpl-to-jsstring-on-large-strings-2.html: Added. * js/stringimpl-to-jsstring-on-large-strings-3-expected.txt: Added. * js/stringimpl-to-jsstring-on-large-strings-3.html: Added. Canonical link: https://commits.webkit.org/177175@main git-svn-id: https://svn.webkit.org/repository/webkit/trunk@202415 268f45cc-cd09-0410-ab3c-d52691b4dbfc
2016-06-24 04:39:35 +00:00
PASS: the test did not crash
PASS successfullyParsed is true
TEST COMPLETE