Diff
Modified: branches/safari-536.30-branch/LayoutTests/ChangeLog (145628 => 145629)
--- branches/safari-536.30-branch/LayoutTests/ChangeLog 2013-03-13 00:17:38 UTC (rev 145628)
+++ branches/safari-536.30-branch/LayoutTests/ChangeLog 2013-03-13 00:18:25 UTC (rev 145629)
@@ -1,5 +1,24 @@
2013-03-12 Lucas Forschler <[email protected]>
+ Merge r135794
+
+ 2012-11-26 Daniel Bates <[email protected]>
+
+ _javascript_ fails to handle String.replace() with large replacement string
+ https://bugs.webkit.org/show_bug.cgi?id=102956
+ <rdar://problem/12738012>
+
+ Reviewed by Oliver Hunt.
+
+ Add test to ensure that we handle string replacement with a large replacement string.
+
+ * fast/js/script-tests/string-replacement-outofmemory.js: Added.
+ (createStringWithRepeatedChar):
+ * fast/js/string-replacement-outofmemory-expected.txt: Added.
+ * fast/js/string-replacement-outofmemory.html: Added.
+
+2013-03-12 Lucas Forschler <[email protected]>
+
Merge r135719
2012-11-26 Florin Malita <[email protected]>
Copied: branches/safari-536.30-branch/LayoutTests/fast/js/script-tests/string-replacement-outofmemory.js (from rev 135794, trunk/LayoutTests/fast/js/script-tests/string-replacement-outofmemory.js) (0 => 145629)
--- branches/safari-536.30-branch/LayoutTests/fast/js/script-tests/string-replacement-outofmemory.js (rev 0)
+++ branches/safari-536.30-branch/LayoutTests/fast/js/script-tests/string-replacement-outofmemory.js 2013-03-13 00:18:25 UTC (rev 145629)
@@ -0,0 +1,18 @@
+description(
+'This tests that string replacement with a large replacement string causes an out-of-memory exception. See <a href="" 102956</a> for more details.'
+);
+
+function createStringWithRepeatedChar(c, multiplicity) {
+ while (c.length < multiplicity)
+ c += c;
+ c = c.substring(0, multiplicity);
+ return c;
+}
+
+var x = "1";
+var y = "2";
+x = createStringWithRepeatedChar(x, 1 << 12);
+y = createStringWithRepeatedChar(y, (1 << 20) + 1);
+
+shouldThrow("x.replace(/\\d/g, y)", '"Error: Out of memory"');
+var successfullyParsed = true;
Copied: branches/safari-536.30-branch/LayoutTests/fast/js/string-replacement-outofmemory-expected.txt (from rev 135794, trunk/LayoutTests/fast/js/string-replacement-outofmemory-expected.txt) (0 => 145629)
--- branches/safari-536.30-branch/LayoutTests/fast/js/string-replacement-outofmemory-expected.txt (rev 0)
+++ branches/safari-536.30-branch/LayoutTests/fast/js/string-replacement-outofmemory-expected.txt 2013-03-13 00:18:25 UTC (rev 145629)
@@ -0,0 +1,10 @@
+This tests that string replacement with a large replacement string causes an out-of-memory exception. See bug 102956 for more details.
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+PASS x.replace(/\d/g, y) threw exception Error: Out of memory.
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
Copied: branches/safari-536.30-branch/LayoutTests/fast/js/string-replacement-outofmemory.html (from rev 135794, trunk/LayoutTests/fast/js/string-replacement-outofmemory.html) (0 => 145629)
--- branches/safari-536.30-branch/LayoutTests/fast/js/string-replacement-outofmemory.html (rev 0)
+++ branches/safari-536.30-branch/LayoutTests/fast/js/string-replacement-outofmemory.html 2013-03-13 00:18:25 UTC (rev 145629)
@@ -0,0 +1,10 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script src=""
+</head>
+<body>
+<script src=""
+<script src=""
+</body>
+</html>
Modified: branches/safari-536.30-branch/Source/_javascript_Core/ChangeLog (145628 => 145629)
--- branches/safari-536.30-branch/Source/_javascript_Core/ChangeLog 2013-03-13 00:17:38 UTC (rev 145628)
+++ branches/safari-536.30-branch/Source/_javascript_Core/ChangeLog 2013-03-13 00:18:25 UTC (rev 145629)
@@ -1,5 +1,23 @@
2013-03-12 Lucas Forschler <[email protected]>
+ Merge r135794
+
+ 2012-11-26 Daniel Bates <[email protected]>
+
+ _javascript_ fails to handle String.replace() with large replacement string
+ https://bugs.webkit.org/show_bug.cgi?id=102956
+ <rdar://problem/12738012>
+
+ Reviewed by Oliver Hunt.
+
+ Fix an issue where we didn't check for overflow when computing the length
+ of the result of String.replace() with a large replacement string.
+
+ * runtime/StringPrototype.cpp:
+ (JSC::jsSpliceSubstringsWithSeparators):
+
+2013-03-12 Lucas Forschler <[email protected]>
+
Merge r135454
2012-11-21 Daniel Bates <[email protected]>
Modified: branches/safari-536.30-branch/Source/_javascript_Core/runtime/StringPrototype.cpp (145628 => 145629)
--- branches/safari-536.30-branch/Source/_javascript_Core/runtime/StringPrototype.cpp 2013-03-13 00:17:38 UTC (rev 145628)
+++ branches/safari-536.30-branch/Source/_javascript_Core/runtime/StringPrototype.cpp 2013-03-13 00:18:25 UTC (rev 145629)
@@ -337,7 +337,7 @@
return jsString(exec, StringImpl::create(source.impl(), max(0, position), min(sourceSize, length)));
}
- int totalLength = 0;
+ Checked<int, RecordOverflow> totalLength = 0;
bool allSeperators8Bit = true;
for (int i = 0; i < rangeCount; i++)
totalLength += substringRanges[i].length;
@@ -346,6 +346,8 @@
if (separators[i].length() && !separators[i].is8Bit())
allSeperators8Bit = false;
}
+ if (totalLength.hasOverflowed())
+ return throwOutOfMemoryError(exec);
if (!totalLength)
return jsString(exec, "");
@@ -354,7 +356,7 @@
LChar* buffer;
const LChar* sourceData = source.characters8();
- RefPtr<StringImpl> impl = StringImpl::tryCreateUninitialized(totalLength, buffer);
+ RefPtr<StringImpl> impl = StringImpl::tryCreateUninitialized(totalLength.unsafeGet(), buffer);
if (!impl)
return throwOutOfMemoryError(exec);
@@ -379,7 +381,7 @@
}
UChar* buffer;
- RefPtr<StringImpl> impl = StringImpl::tryCreateUninitialized(totalLength, buffer);
+ RefPtr<StringImpl> impl = StringImpl::tryCreateUninitialized(totalLength.unsafeGet(), buffer);
if (!impl)
return throwOutOfMemoryError(exec);
