Diff
Modified: branches/safari-536.30-branch/LayoutTests/ChangeLog (145623 => 145624)
--- branches/safari-536.30-branch/LayoutTests/ChangeLog 2013-03-13 00:03:42 UTC (rev 145623)
+++ branches/safari-536.30-branch/LayoutTests/ChangeLog 2013-03-13 00:06:23 UTC (rev 145624)
@@ -1,5 +1,23 @@
2013-03-12 Lucas Forschler <[email protected]>
+ Merge r135454
+
+ 2012-11-21 Daniel Bates <[email protected]>
+
+ _javascript_ fails to concatenate large strings
+ <https://bugs.webkit.org/show_bug.cgi?id=102963>
+
+ Reviewed by Michael Saboff.
+
+ Add tests to ensure that we handle concatenating large strings.
+
+ * fast/js/concat-large-strings-crash-expected.txt: Added.
+ * fast/js/concat-large-strings-crash.html: Added.
+ * fast/js/concat-large-strings-crash2-expected.txt: Added.
+ * fast/js/concat-large-strings-crash2.html: Added.
+
+2013-03-12 Lucas Forschler <[email protected]>
+
Merge r135303
2012-11-20 Abhishek Arya <[email protected]>
Copied: branches/safari-536.30-branch/LayoutTests/fast/js/concat-large-strings-crash-expected.txt (from rev 135454, trunk/LayoutTests/fast/js/concat-large-strings-crash-expected.txt) (0 => 145624)
--- branches/safari-536.30-branch/LayoutTests/fast/js/concat-large-strings-crash-expected.txt (rev 0)
+++ branches/safari-536.30-branch/LayoutTests/fast/js/concat-large-strings-crash-expected.txt 2013-03-13 00:06:23 UTC (rev 145624)
@@ -0,0 +1,4 @@
+CONSOLE MESSAGE: line 16: Error: Out of memory
+Test for bug 102963. This test passed if you see the word PASS below.
+
+PASS: Didn't crash.
Copied: branches/safari-536.30-branch/LayoutTests/fast/js/concat-large-strings-crash.html (from rev 135454, trunk/LayoutTests/fast/js/concat-large-strings-crash.html) (0 => 145624)
--- branches/safari-536.30-branch/LayoutTests/fast/js/concat-large-strings-crash.html (rev 0)
+++ branches/safari-536.30-branch/LayoutTests/fast/js/concat-large-strings-crash.html 2013-03-13 00:06:23 UTC (rev 145624)
@@ -0,0 +1,21 @@
+<html>
+ <script>
+ if (window.testRunner)
+ testRunner.dumpAsText();
+ </script>
+ <p>Test for <a href="" 102963</a>. This test passed if you see the word PASS below.</p>
+ <script>
+ function createStringWithRepeatedChar(c, multiplicity){
+ while (c.length < multiplicity)
+ c += c;
+ return c;
+ }
+ var x = "1";
+ var y = "2";
+ x = createStringWithRepeatedChar(x, 1 << 30);
+ y = createStringWithRepeatedChar(y, 1 << 16);
+ x = x.concat(x, x, x, y);
+ x = x.blink(); // Flatten string
+ </script>
+ <p>PASS: Didn't crash.</p>
+</html>
Copied: branches/safari-536.30-branch/LayoutTests/fast/js/concat-large-strings-crash2-expected.txt (from rev 135454, trunk/LayoutTests/fast/js/concat-large-strings-crash2-expected.txt) (0 => 145624)
--- branches/safari-536.30-branch/LayoutTests/fast/js/concat-large-strings-crash2-expected.txt (rev 0)
+++ branches/safari-536.30-branch/LayoutTests/fast/js/concat-large-strings-crash2-expected.txt 2013-03-13 00:06:23 UTC (rev 145624)
@@ -0,0 +1,4 @@
+CONSOLE MESSAGE: line 14: Error: Out of memory
+Test for bug 102963. This test passed if you see the word PASS below.
+
+PASS: Didn't crash.
Copied: branches/safari-536.30-branch/LayoutTests/fast/js/concat-large-strings-crash2.html (from rev 135454, trunk/LayoutTests/fast/js/concat-large-strings-crash2.html) (0 => 145624)
--- branches/safari-536.30-branch/LayoutTests/fast/js/concat-large-strings-crash2.html (rev 0)
+++ branches/safari-536.30-branch/LayoutTests/fast/js/concat-large-strings-crash2.html 2013-03-13 00:06:23 UTC (rev 145624)
@@ -0,0 +1,18 @@
+<html>
+ <script>
+ if (window.testRunner)
+ testRunner.dumpAsText();
+ </script>
+ <p>Test for <a href="" 102963</a>. This test passed if you see the word PASS below.</p>
+ <script>
+ function createStringWithRepeatedChar(c, multiplicity){
+ while (c.length < multiplicity)
+ c += c;
+ return c;
+ }
+ var string = createStringWithRepeatedChar("1", 1 << 30);
+ var largeString = string + " AND " + string + " AND " + string + " AND " + string;
+ largeString.blink(); // Flatten string
+ </script>
+ <p>PASS: Didn't crash.</p>
+</html>
Modified: branches/safari-536.30-branch/Source/_javascript_Core/ChangeLog (145623 => 145624)
--- branches/safari-536.30-branch/Source/_javascript_Core/ChangeLog 2013-03-13 00:03:42 UTC (rev 145623)
+++ branches/safari-536.30-branch/Source/_javascript_Core/ChangeLog 2013-03-13 00:06:23 UTC (rev 145624)
@@ -1,3 +1,21 @@
+2013-03-12 Lucas Forschler <[email protected]>
+
+ Merge r135454
+
+ 2012-11-21 Daniel Bates <[email protected]>
+
+ _javascript_ fails to concatenate large strings
+ <https://bugs.webkit.org/show_bug.cgi?id=102963>
+
+ Reviewed by Michael Saboff.
+
+ Fixes an issue where we inadvertently didn't check the length of
+ a _javascript_ string for overflow.
+
+ * runtime/Operations.h:
+ (JSC::jsString):
+ (JSC::jsStringFromArguments):
+
2013-01-30 Lucas Forschler <[email protected]>
Merge r138606
Modified: branches/safari-536.30-branch/Source/_javascript_Core/runtime/Operations.h (145623 => 145624)
--- branches/safari-536.30-branch/Source/_javascript_Core/runtime/Operations.h 2013-03-13 00:03:42 UTC (rev 145623)
+++ branches/safari-536.30-branch/Source/_javascript_Core/runtime/Operations.h 2013-03-13 00:06:23 UTC (rev 145624)
@@ -85,6 +85,7 @@
if (ropeBuilder.length() < oldLength) // True for overflow
return throwOutOfMemoryError(exec);
+ oldLength = ropeBuilder.length();
}
return ropeBuilder.release();
@@ -104,6 +105,7 @@
if (ropeBuilder.length() < oldLength) // True for overflow
return throwOutOfMemoryError(exec);
+ oldLength = ropeBuilder.length();
}
return ropeBuilder.release();
