Diff
Modified: trunk/LayoutTests/ChangeLog (264866 => 264867)
--- trunk/LayoutTests/ChangeLog 2020-07-24 22:56:01 UTC (rev 264866)
+++ trunk/LayoutTests/ChangeLog 2020-07-24 23:15:07 UTC (rev 264867)
@@ -1,3 +1,16 @@
+2020-07-24 Tadeu Zagallo <[email protected]>
+
+ WKStringGetMaximumUTF8CStringSize should cast before arithmetic
+ https://bugs.webkit.org/show_bug.cgi?id=214750
+ <rdar://problem/65884455>
+
+ Reviewed by Mark Lam.
+
+ * TestExpectations:
+ * js/throw-large-string-oom-expected.txt: Added.
+ * js/throw-large-string-oom.html: Added.
+ * platform/wk2/TestExpectations:
+
2020-07-24 Mark Lam <[email protected]>
Fix exception check handling below postMessage().
Modified: trunk/LayoutTests/TestExpectations (264866 => 264867)
--- trunk/LayoutTests/TestExpectations 2020-07-24 22:56:01 UTC (rev 264866)
+++ trunk/LayoutTests/TestExpectations 2020-07-24 23:15:07 UTC (rev 264867)
@@ -4873,3 +4873,6 @@
webkit.org/b/214466 imported/w3c/web-platform-tests/css/css-display/display-first-line-002.html [ ImageOnlyFailure ]
webkit.org/b/214467 imported/w3c/web-platform-tests/html/canvas/element/drawing-images-to-the-canvas/image-orientation/drawImage-with-src-rect.tentative.html [ ImageOnlyFailure ]
+
+# WebKit2 only.
+js/throw-large-string-oom.html [ Skip ]
Added: trunk/LayoutTests/js/throw-large-string-oom-expected.txt (0 => 264867)
--- trunk/LayoutTests/js/throw-large-string-oom-expected.txt (rev 0)
+++ trunk/LayoutTests/js/throw-large-string-oom-expected.txt 2020-07-24 23:15:07 UTC (rev 264867)
@@ -0,0 +1,10 @@
+Out of memory
+This test makes sure we don't crash when throwing an error with a very large message
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
Added: trunk/LayoutTests/js/throw-large-string-oom.html (0 => 264867)
--- trunk/LayoutTests/js/throw-large-string-oom.html (rev 0)
+++ trunk/LayoutTests/js/throw-large-string-oom.html 2020-07-24 23:15:07 UTC (rev 264867)
@@ -0,0 +1,21 @@
+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<html>
+<head>
+<script src=""
+</head>
+<body>
+<script>
+description(
+ "This test makes sure we don't crash when throwing an error with a very large message"
+);
+var thrown = false;
+try {
+ throw 'a'.repeat(2 ** 31 - 100);
+} catch(e) {
+ console.log(e);
+}
+
+</script>
+<script src=""
+</body>
+</html>
Modified: trunk/LayoutTests/platform/wk2/TestExpectations (264866 => 264867)
--- trunk/LayoutTests/platform/wk2/TestExpectations 2020-07-24 22:56:01 UTC (rev 264866)
+++ trunk/LayoutTests/platform/wk2/TestExpectations 2020-07-24 23:15:07 UTC (rev 264867)
@@ -802,3 +802,6 @@
# Closed port web socket delays are only supported on wk2.
http/tests/websocket/tests/hybi/closed-port-delay.html [ Pass ]
+
+# WebKit2 only.
+js/throw-large-string-oom.html [ Pass ]
Modified: trunk/Source/WebKit/ChangeLog (264866 => 264867)
--- trunk/Source/WebKit/ChangeLog 2020-07-24 22:56:01 UTC (rev 264866)
+++ trunk/Source/WebKit/ChangeLog 2020-07-24 23:15:07 UTC (rev 264867)
@@ -1,3 +1,18 @@
+2020-07-24 Tadeu Zagallo <[email protected]>
+
+ WKStringGetMaximumUTF8CStringSize should cast before arithmetic
+ https://bugs.webkit.org/show_bug.cgi?id=214750
+ <rdar://problem/65884455>
+
+ Reviewed by Mark Lam.
+
+ When the string is long enough, the multiplication can result in an integer overflow.
+
+ Test: js/throw-large-string-oom.html
+
+ * Shared/API/c/WKString.cpp:
+ (WKStringGetMaximumUTF8CStringSize):
+
2020-07-24 Devin Rousso <[email protected]>
Adopt more descriptive symbol image name
Modified: trunk/Source/WebKit/Shared/API/c/WKString.cpp (264866 => 264867)
--- trunk/Source/WebKit/Shared/API/c/WKString.cpp 2020-07-24 22:56:01 UTC (rev 264866)
+++ trunk/Source/WebKit/Shared/API/c/WKString.cpp 2020-07-24 23:15:07 UTC (rev 264867)
@@ -65,7 +65,7 @@
size_t WKStringGetMaximumUTF8CStringSize(WKStringRef stringRef)
{
- return WebKit::toImpl(stringRef)->stringView().length() * 3 + 1;
+ return static_cast<size_t>(WebKit::toImpl(stringRef)->stringView().length()) * 3 + 1;
}
enum StrictType { NonStrict = false, Strict = true };
Modified: trunk/Tools/ChangeLog (264866 => 264867)
--- trunk/Tools/ChangeLog 2020-07-24 22:56:01 UTC (rev 264866)
+++ trunk/Tools/ChangeLog 2020-07-24 23:15:07 UTC (rev 264867)
@@ -1,3 +1,15 @@
+2020-07-24 Tadeu Zagallo <[email protected]>
+
+ WKStringGetMaximumUTF8CStringSize should cast before arithmetic
+ https://bugs.webkit.org/show_bug.cgi?id=214750
+ <rdar://problem/65884455>
+
+ Reviewed by Mark Lam.
+
+ * WebKitTestRunner/InjectedBundle/InjectedBundle.cpp:
+ (WTR::InjectedBundle::dumpToStdErr):
+ (WTR::InjectedBundle::outputText):
+
2020-07-24 Youenn Fablet <[email protected]>
Add some logging to debug WebKit.QuotaDelegate test that times out on a Debug bot
Modified: trunk/Tools/WebKitTestRunner/InjectedBundle/InjectedBundle.cpp (264866 => 264867)
--- trunk/Tools/WebKitTestRunner/InjectedBundle/InjectedBundle.cpp 2020-07-24 22:56:01 UTC (rev 264866)
+++ trunk/Tools/WebKitTestRunner/InjectedBundle/InjectedBundle.cpp 2020-07-24 23:15:07 UTC (rev 264867)
@@ -699,7 +699,11 @@
if (output.isEmpty())
return;
WKRetainPtr<WKStringRef> messageName = adoptWK(WKStringCreateWithUTF8CString("DumpToStdErr"));
- WKRetainPtr<WKStringRef> messageBody = adoptWK(WKStringCreateWithUTF8CString(output.utf8().data()));
+ WKRetainPtr<WKStringRef> messageBody;
+ if (auto utf8 = output.tryGetUtf8())
+ messageBody = adoptWK(WKStringCreateWithUTF8CString(utf8->data()));
+ else
+ messageBody = adoptWK(WKStringCreateWithUTF8CString("Out of memory\n"));
WKBundlePagePostMessage(page()->page(), messageName.get(), messageBody.get());
}
@@ -710,7 +714,11 @@
if (output.isEmpty())
return;
WKRetainPtr<WKStringRef> messageName = adoptWK(WKStringCreateWithUTF8CString("TextOutput"));
- WKRetainPtr<WKStringRef> messageBody = adoptWK(WKStringCreateWithUTF8CString(output.utf8().data()));
+ WKRetainPtr<WKStringRef> messageBody;
+ if (auto utf8 = output.tryGetUtf8())
+ messageBody = adoptWK(WKStringCreateWithUTF8CString(utf8->data()));
+ else
+ messageBody = adoptWK(WKStringCreateWithUTF8CString("Out of memory\n"));
// We use WKBundlePagePostMessageIgnoringFullySynchronousMode() instead of WKBundlePagePostMessage() to make sure that all text output
// is done via asynchronous IPC, even if the connection is in fully synchronous mode due to a WKBundlePagePostSynchronousMessageForTesting()
// call. Otherwise, messages logged via sync and async IPC may end up out of order and cause flakiness.
