Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: fb8194b34646f00c7bbaec04c45f6944dd8b804c
https://github.com/WebKit/WebKit/commit/fb8194b34646f00c7bbaec04c45f6944dd8b804c
Author: Sosuke Suzuki <[email protected]>
Date: 2026-06-22 (Mon, 22 Jun 2026)
Changed paths:
A JSTests/stress/regexp-symbol-split-huge-flags-string-overflow.js
M Source/JavaScriptCore/runtime/RegExpPrototype.cpp
Log Message:
-----------
[JSC] `RegExp#@@split` should not crash on huge flags string
https://bugs.webkit.org/show_bug.cgi?id=317555
Reviewed by Yusuke Suzuki.
When regExpSplitSlow concatenates "y" to a user-supplied flags string, it
used makeString, which calls WTFCrash on length overflow or allocation
failure. Since flags is obtained via Get(rx, "flags") and ToString, a
custom flags getter can return a string of String::MaxLength characters,
making the concatenation crash the process instead of throwing.
Before 315243@main moved Symbol.split to C++, the JS builtin used
`flags + "y"`, which threw a catchable RangeError. This is a regression
from that migration.
Fix by using tryMakeString and throwing an out-of-memory error on failure,
matching the pattern used elsewhere in JSC for user-controlled string
concatenation.
Test: JSTests/stress/regexp-symbol-split-huge-flags-string-overflow.js
* JSTests/stress/regexp-symbol-split-huge-flags-string-overflow.js: Added.
(shouldThrow):
(shouldThrow.fakeRegExp.get flags):
* Source/JavaScriptCore/runtime/RegExpPrototype.cpp:
(JSC::regExpSplitSlow):
Canonical link: https://commits.webkit.org/315644@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
