<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>[207916] branches/safari-602-branch</title>
</head>
<body>
<style type="text/css"><!--
#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }
#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }
#msg dt:after { content:':';}
#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; }
#msg dl a { font-weight: bold}
#msg dl a:link { color:#fc3; }
#msg dl a:active { color:#ff0; }
#msg dl a:visited { color:#cc6; }
h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }
#msg pre { overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; }
#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }
#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }
#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }
#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; }
#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; }
#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; }
#logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: -1.5em; padding-left: 1.5em; }
#logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; }
#logmsg pre { background: #eee; padding: 1em; }
#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;}
#logmsg dl { margin: 0; }
#logmsg dt { font-weight: bold; }
#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }
#logmsg dd:before { content:'\00bb';}
#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; }
#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; }
#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; }
#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; }
#logmsg table th.Corner { text-align: left; }
#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }
#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }
#patch { width: 100%; }
#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}
#patch .propset h4, #patch .binary h4 {margin:0;}
#patch pre {padding:0;line-height:1.2em;margin:0;}
#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}
#patch .propset .diff, #patch .binary .diff {padding:10px 0;}
#patch span {display:block;padding:0 10px;}
#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}
#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}
#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}
#patch .lines, .info {color:#888;background:#fff;}
--></style>
<div id="msg">
<dl class="meta">
<dt>Revision</dt> <dd><a href="http://trac.webkit.org/projects/webkit/changeset/207916">207916</a></dd>
<dt>Author</dt> <dd>matthew_hanson@apple.com</dd>
<dt>Date</dt> <dd>2016-10-26 16:17:48 -0700 (Wed, 26 Oct 2016)</dd>
</dl>
<h3>Log Message</h3>
<pre>Merge <a href="http://trac.webkit.org/projects/webkit/changeset/206281">r206281</a>. rdar://problem/28870938</pre>
<h3>Modified Paths</h3>
<ul>
<li><a href="#branchessafari602branchJSTestsChangeLog">branches/safari-602-branch/JSTests/ChangeLog</a></li>
<li><a href="#branchessafari602branchSourceJavaScriptCoreChangeLog">branches/safari-602-branch/Source/JavaScriptCore/ChangeLog</a></li>
<li><a href="#branchessafari602branchSourceJavaScriptCoredfgDFGOperationscpp">branches/safari-602-branch/Source/JavaScriptCore/dfg/DFGOperations.cpp</a></li>
<li><a href="#branchessafari602branchSourceJavaScriptCoreruntimeArrayPrototypecpp">branches/safari-602-branch/Source/JavaScriptCore/runtime/ArrayPrototype.cpp</a></li>
<li><a href="#branchessafari602branchSourceJavaScriptCoreruntimeJSStringh">branches/safari-602-branch/Source/JavaScriptCore/runtime/JSString.h</a></li>
<li><a href="#branchessafari602branchSourceJavaScriptCoreruntimeOperationsh">branches/safari-602-branch/Source/JavaScriptCore/runtime/Operations.h</a></li>
</ul>
<h3>Added Paths</h3>
<ul>
<li><a href="#branchessafari602branchJSTestsstressarrayjoinonstringsneedoverflowchecksjs">branches/safari-602-branch/JSTests/stress/array-join-on-strings-need-overflow-checks.js</a></li>
</ul>
</div>
<div id="patch">
<h3>Diff</h3>
<a id="branchessafari602branchJSTestsChangeLog"></a>
<div class="modfile"><h4>Modified: branches/safari-602-branch/JSTests/ChangeLog (207915 => 207916)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-602-branch/JSTests/ChangeLog 2016-10-26 23:17:44 UTC (rev 207915)
+++ branches/safari-602-branch/JSTests/ChangeLog 2016-10-26 23:17:48 UTC (rev 207916)
</span><span class="lines">@@ -1,5 +1,20 @@
</span><span class="cx"> 2016-10-24 Matthew Hanson <matthew_hanson@apple.com>
</span><span class="cx">
</span><ins>+ Merge r206281. rdar://problem/28870938
+
+ 2016-09-22 Mark Lam <mark.lam@apple.com>
+
+ Array.prototype.join should do overflow checks on string joins.
+ https://bugs.webkit.org/show_bug.cgi?id=162459
+
+ Reviewed by Saam Barati.
+
+ * stress/array-join-on-strings-need-overflow-checks.js: Added.
+ (assert):
+ (catch):
+
+2016-10-24 Matthew Hanson <matthew_hanson@apple.com>
+
</ins><span class="cx"> Merge r207623. rdar://problem/28857477
</span><span class="cx">
</span><span class="cx"> 2016-10-20 Keith Miller <keith_miller@apple.com>
</span></span></pre></div>
<a id="branchessafari602branchJSTestsstressarrayjoinonstringsneedoverflowchecksjs"></a>
<div class="addfile"><h4>Added: branches/safari-602-branch/JSTests/stress/array-join-on-strings-need-overflow-checks.js (0 => 207916)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-602-branch/JSTests/stress/array-join-on-strings-need-overflow-checks.js (rev 0)
+++ branches/safari-602-branch/JSTests/stress/array-join-on-strings-need-overflow-checks.js 2016-10-26 23:17:48 UTC (rev 207916)
</span><span class="lines">@@ -0,0 +1,33 @@
</span><ins>+function assert(x, y) {
+ if (x != y)
+ throw(" Expect: " + y + ", actual: " + x);
+}
+
+s1 = "";
+for (var k = 0; k < 2000; ++k)
+ s1 += "z";
+var expectedLength = 2000;
+assert(s1.length, 2000);
+
+s2 = 'x';
+expectedLength = 1;
+assert(s2.length, expectedLength);
+
+for (var i = 0; i < 22; ++i) {
+ expectedLength += expectedLength;
+ s2 += s2;
+ assert(s2.length, expectedLength);
+}
+
+var caughtException;
+try {
+ expectedLength = ((s1.length - 1) * s2.length) + 1;
+ result = Array.prototype.join.apply(s1, [s2]);
+ assert(result.length, expectedLength);
+} catch (e) {
+ caughtException = e;
+}
+
+if (!caughtException)
+ throw("Array.prototype.join should have thrown an exception when string length overflows");
+assert(caughtException, "Error: Out of memory");
</ins></span></pre></div>
<a id="branchessafari602branchSourceJavaScriptCoreChangeLog"></a>
<div class="modfile"><h4>Modified: branches/safari-602-branch/Source/JavaScriptCore/ChangeLog (207915 => 207916)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-602-branch/Source/JavaScriptCore/ChangeLog 2016-10-26 23:17:44 UTC (rev 207915)
+++ branches/safari-602-branch/Source/JavaScriptCore/ChangeLog 2016-10-26 23:17:48 UTC (rev 207916)
</span><span class="lines">@@ -1,5 +1,27 @@
</span><span class="cx"> 2016-10-24 Matthew Hanson <matthew_hanson@apple.com>
</span><span class="cx">
</span><ins>+ Merge r206281. rdar://problem/28870938
+
+ 2016-09-22 Mark Lam <mark.lam@apple.com>
+
+ Array.prototype.join should do overflow checks on string joins.
+ https://bugs.webkit.org/show_bug.cgi?id=162459
+
+ Reviewed by Saam Barati.
+
+ Change the 2 JSRopeString::create() functions that do joins to be private, and
+ force all clients of it to go through the jsString() utility functions that do
+ overflow checks before creating the ropes.
+
+ * dfg/DFGOperations.cpp:
+ * runtime/ArrayPrototype.cpp:
+ (JSC::slowJoin):
+ * runtime/JSString.h:
+ * runtime/Operations.h:
+ (JSC::jsString):
+
+2016-10-24 Matthew Hanson <matthew_hanson@apple.com>
+
</ins><span class="cx"> Merge r207623. rdar://problem/28857477
</span><span class="cx">
</span><span class="cx"> 2016-10-20 Keith Miller <keith_miller@apple.com>
</span></span></pre></div>
<a id="branchessafari602branchSourceJavaScriptCoredfgDFGOperationscpp"></a>
<div class="modfile"><h4>Modified: branches/safari-602-branch/Source/JavaScriptCore/dfg/DFGOperations.cpp (207915 => 207916)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-602-branch/Source/JavaScriptCore/dfg/DFGOperations.cpp 2016-10-26 23:17:44 UTC (rev 207915)
+++ branches/safari-602-branch/Source/JavaScriptCore/dfg/DFGOperations.cpp 2016-10-26 23:17:48 UTC (rev 207916)
</span><span class="lines">@@ -51,6 +51,7 @@
</span><span class="cx"> #include "JSGenericTypedArrayViewConstructorInlines.h"
</span><span class="cx"> #include "JSLexicalEnvironment.h"
</span><span class="cx"> #include "ObjectConstructor.h"
</span><ins>+#include "Operations.h"
</ins><span class="cx"> #include "Repatch.h"
</span><span class="cx"> #include "ScopedArguments.h"
</span><span class="cx"> #include "StringConstructor.h"
</span><span class="lines">@@ -1304,12 +1305,7 @@
</span><span class="cx"> VM& vm = exec->vm();
</span><span class="cx"> NativeCallFrameTracer tracer(&vm, exec);
</span><span class="cx">
</span><del>- if (sumOverflows<int32_t>(left->length(), right->length())) {
- throwOutOfMemoryError(exec);
- return nullptr;
- }
-
- return JSRopeString::create(vm, left, right);
</del><ins>+ return jsString(exec, left, right);
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> JSCell* JIT_OPERATION operationMakeRope3(ExecState* exec, JSString* a, JSString* b, JSString* c)
</span><span class="lines">@@ -1317,12 +1313,7 @@
</span><span class="cx"> VM& vm = exec->vm();
</span><span class="cx"> NativeCallFrameTracer tracer(&vm, exec);
</span><span class="cx">
</span><del>- if (sumOverflows<int32_t>(a->length(), b->length(), c->length())) {
- throwOutOfMemoryError(exec);
- return nullptr;
- }
-
- return JSRopeString::create(vm, a, b, c);
</del><ins>+ return jsString(exec, a, b, c);
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> JSCell* JIT_OPERATION operationStrCat2(ExecState* exec, EncodedJSValue a, EncodedJSValue b)
</span><span class="lines">@@ -1335,12 +1326,7 @@
</span><span class="cx"> JSString* str2 = JSValue::decode(b).toString(exec);
</span><span class="cx"> ASSERT(!vm.exception());
</span><span class="cx">
</span><del>- if (sumOverflows<int32_t>(str1->length(), str2->length())) {
- throwOutOfMemoryError(exec);
- return nullptr;
- }
-
- return JSRopeString::create(vm, str1, str2);
</del><ins>+ return jsString(exec, str1, str2);
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> JSCell* JIT_OPERATION operationStrCat3(ExecState* exec, EncodedJSValue a, EncodedJSValue b, EncodedJSValue c)
</span><span class="lines">@@ -1355,12 +1341,7 @@
</span><span class="cx"> JSString* str3 = JSValue::decode(c).toString(exec);
</span><span class="cx"> ASSERT(!vm.exception());
</span><span class="cx">
</span><del>- if (sumOverflows<int32_t>(str1->length(), str2->length(), str3->length())) {
- throwOutOfMemoryError(exec);
- return nullptr;
- }
-
- return JSRopeString::create(vm, str1, str2, str3);
</del><ins>+ return jsString(exec, str1, str2, str3);
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> char* JIT_OPERATION operationFindSwitchImmTargetForDouble(
</span></span></pre></div>
<a id="branchessafari602branchSourceJavaScriptCoreruntimeArrayPrototypecpp"></a>
<div class="modfile"><h4>Modified: branches/safari-602-branch/Source/JavaScriptCore/runtime/ArrayPrototype.cpp (207915 => 207916)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-602-branch/Source/JavaScriptCore/runtime/ArrayPrototype.cpp 2016-10-26 23:17:44 UTC (rev 207915)
+++ branches/safari-602-branch/Source/JavaScriptCore/runtime/ArrayPrototype.cpp 2016-10-26 23:17:48 UTC (rev 207916)
</span><span class="lines">@@ -42,6 +42,7 @@
</span><span class="cx"> #include "Lookup.h"
</span><span class="cx"> #include "ObjectConstructor.h"
</span><span class="cx"> #include "ObjectPrototype.h"
</span><ins>+#include "Operations.h"
</ins><span class="cx"> #include "StringRecursionChecker.h"
</span><span class="cx"> #include <algorithm>
</span><span class="cx"> #include <wtf/Assertions.h>
</span><span class="lines">@@ -535,7 +536,9 @@
</span><span class="cx">
</span><span class="cx"> // a. Let S be the String value produced by concatenating R and sep.
</span><span class="cx"> // d. Let R be a String value produced by concatenating S and next.
</span><del>- r = JSRopeString::create(vm, r, separator, next);
</del><ins>+ r = jsString(&exec, r, separator, next);
+ if (UNLIKELY(vm.exception()))
+ return JSValue();
</ins><span class="cx"> }
</span><span class="cx"> // 10. Return R.
</span><span class="cx"> return r;
</span></span></pre></div>
<a id="branchessafari602branchSourceJavaScriptCoreruntimeJSStringh"></a>
<div class="modfile"><h4>Modified: branches/safari-602-branch/Source/JavaScriptCore/runtime/JSString.h (207915 => 207916)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-602-branch/Source/JavaScriptCore/runtime/JSString.h 2016-10-26 23:17:44 UTC (rev 207915)
+++ branches/safari-602-branch/Source/JavaScriptCore/runtime/JSString.h 2016-10-26 23:17:48 UTC (rev 207916)
</span><span class="lines">@@ -219,7 +219,7 @@
</span><span class="cx"> String& string() { ASSERT(!isRope()); return m_value; }
</span><span class="cx"> StringView unsafeView(ExecState&) const;
</span><span class="cx">
</span><del>- friend JSValue jsString(ExecState*, JSString*, JSString*);
</del><ins>+ friend JSString* jsString(ExecState*, JSString*, JSString*);
</ins><span class="cx"> friend JSString* jsSubstring(ExecState*, JSString*, unsigned offset, unsigned length);
</span><span class="cx"> };
</span><span class="cx">
</span><span class="lines">@@ -277,6 +277,7 @@
</span><span class="cx"> void finishCreation(VM& vm, JSString* s1, JSString* s2)
</span><span class="cx"> {
</span><span class="cx"> Base::finishCreation(vm);
</span><ins>+ ASSERT(!sumOverflows<int32_t>(s1->length(), s2->length()));
</ins><span class="cx"> m_length = s1->length() + s2->length();
</span><span class="cx"> setIs8Bit(s1->is8Bit() && s2->is8Bit());
</span><span class="cx"> setIsSubstring(false);
</span><span class="lines">@@ -288,6 +289,7 @@
</span><span class="cx"> void finishCreation(VM& vm, JSString* s1, JSString* s2, JSString* s3)
</span><span class="cx"> {
</span><span class="cx"> Base::finishCreation(vm);
</span><ins>+ ASSERT(!sumOverflows<int32_t>(s1->length(), s2->length(), s3->length()));
</ins><span class="cx"> m_length = s1->length() + s2->length() + s3->length();
</span><span class="cx"> setIs8Bit(s1->is8Bit() && s2->is8Bit() && s3->is8Bit());
</span><span class="cx"> setIsSubstring(false);
</span><span class="lines">@@ -357,19 +359,6 @@
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> public:
</span><del>- static JSString* create(VM& vm, JSString* s1, JSString* s2)
- {
- JSRopeString* newString = new (NotNull, allocateCell<JSRopeString>(vm.heap)) JSRopeString(vm);
- newString->finishCreation(vm, s1, s2);
- return newString;
- }
- static JSString* create(VM& vm, JSString* s1, JSString* s2, JSString* s3)
- {
- JSRopeString* newString = new (NotNull, allocateCell<JSRopeString>(vm.heap)) JSRopeString(vm);
- newString->finishCreation(vm, s1, s2, s3);
- return newString;
- }
-
</del><span class="cx"> static JSString* create(VM& vm, ExecState* exec, JSString* base, unsigned offset, unsigned length)
</span><span class="cx"> {
</span><span class="cx"> JSRopeString* newString = new (NotNull, allocateCell<JSRopeString>(vm.heap)) JSRopeString(vm);
</span><span class="lines">@@ -391,6 +380,19 @@
</span><span class="cx"> static const unsigned s_maxInternalRopeLength = 3;
</span><span class="cx">
</span><span class="cx"> private:
</span><ins>+ static JSString* create(VM& vm, JSString* s1, JSString* s2)
+ {
+ JSRopeString* newString = new (NotNull, allocateCell<JSRopeString>(vm.heap)) JSRopeString(vm);
+ newString->finishCreation(vm, s1, s2);
+ return newString;
+ }
+ static JSString* create(VM& vm, JSString* s1, JSString* s2, JSString* s3)
+ {
+ JSRopeString* newString = new (NotNull, allocateCell<JSRopeString>(vm.heap)) JSRopeString(vm);
+ newString->finishCreation(vm, s1, s2, s3);
+ return newString;
+ }
+
</ins><span class="cx"> friend JSValue jsStringFromRegisterArray(ExecState*, Register*, unsigned);
</span><span class="cx"> friend JSValue jsStringFromArguments(ExecState*, JSValue);
</span><span class="cx">
</span><span class="lines">@@ -449,6 +451,11 @@
</span><span class="cx"> uintptr_t number;
</span><span class="cx"> WriteBarrierBase<JSString> string;
</span><span class="cx"> } u[s_maxInternalRopeLength];
</span><ins>+
+
+ friend JSString* jsString(ExecState*, JSString*, JSString*);
+ friend JSString* jsString(ExecState*, JSString*, JSString*, JSString*);
+ friend JSString* jsString(ExecState*, const String&, const String&, const String&);
</ins><span class="cx"> };
</span><span class="cx">
</span><span class="cx"> class JSString::SafeView {
</span></span></pre></div>
<a id="branchessafari602branchSourceJavaScriptCoreruntimeOperationsh"></a>
<div class="modfile"><h4>Modified: branches/safari-602-branch/Source/JavaScriptCore/runtime/Operations.h (207915 => 207916)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-602-branch/Source/JavaScriptCore/runtime/Operations.h 2016-10-26 23:17:44 UTC (rev 207915)
+++ branches/safari-602-branch/Source/JavaScriptCore/runtime/Operations.h 2016-10-26 23:17:48 UTC (rev 207916)
</span><span class="lines">@@ -37,7 +37,7 @@
</span><span class="cx"> bool jsIsFunctionType(JSValue);
</span><span class="cx"> size_t normalizePrototypeChain(CallFrame*, Structure*);
</span><span class="cx">
</span><del>-ALWAYS_INLINE JSValue jsString(ExecState* exec, JSString* s1, JSString* s2)
</del><ins>+ALWAYS_INLINE JSString* jsString(ExecState* exec, JSString* s1, JSString* s2)
</ins><span class="cx"> {
</span><span class="cx"> VM& vm = exec->vm();
</span><span class="cx">
</span><span class="lines">@@ -47,14 +47,37 @@
</span><span class="cx"> int32_t length2 = s2->length();
</span><span class="cx"> if (!length2)
</span><span class="cx"> return s1;
</span><del>- if (sumOverflows<int32_t>(length1, length2))
- return throwOutOfMemoryError(exec);
</del><ins>+ if (sumOverflows<int32_t>(length1, length2)) {
+ throwOutOfMemoryError(exec);
+ return nullptr;
+ }
</ins><span class="cx">
</span><span class="cx"> return JSRopeString::create(vm, s1, s2);
</span><span class="cx"> }
</span><span class="cx">
</span><del>-ALWAYS_INLINE JSValue jsString(ExecState* exec, const String& u1, const String& u2, const String& u3)
</del><ins>+ALWAYS_INLINE JSString* jsString(ExecState* exec, JSString* s1, JSString* s2, JSString* s3)
</ins><span class="cx"> {
</span><ins>+ VM& vm = exec->vm();
+
+ int32_t length1 = s1->length();
+ if (!length1)
+ return jsString(exec, s2, s3);
+ int32_t length2 = s2->length();
+ if (!length2)
+ return jsString(exec, s1, s3);
+ int32_t length3 = s3->length();
+ if (!length3)
+ return jsString(exec, s1, s2);
+
+ if (sumOverflows<int32_t>(length1, length2, length3)) {
+ throwOutOfMemoryError(exec);
+ return nullptr;
+ }
+ return JSRopeString::create(vm, s1, s2, s3);
+}
+
+ALWAYS_INLINE JSString* jsString(ExecState* exec, const String& u1, const String& u2, const String& u3)
+{
</ins><span class="cx"> VM* vm = &exec->vm();
</span><span class="cx">
</span><span class="cx"> int32_t length1 = u1.length();
</span><span class="lines">@@ -61,8 +84,10 @@
</span><span class="cx"> int32_t length2 = u2.length();
</span><span class="cx"> int32_t length3 = u3.length();
</span><span class="cx">
</span><del>- if (length1 < 0 || length2 < 0 || length3 < 0)
- return throwOutOfMemoryError(exec);
</del><ins>+ if (length1 < 0 || length2 < 0 || length3 < 0) {
+ throwOutOfMemoryError(exec);
+ return nullptr;
+ }
</ins><span class="cx">
</span><span class="cx"> if (!length1)
</span><span class="cx"> return jsString(exec, jsString(vm, u2), jsString(vm, u3));
</span><span class="lines">@@ -71,10 +96,12 @@
</span><span class="cx"> if (!length3)
</span><span class="cx"> return jsString(exec, jsString(vm, u1), jsString(vm, u2));
</span><span class="cx">
</span><del>- if (sumOverflows<int32_t>(length1, length2, length3))
- return throwOutOfMemoryError(exec);
</del><ins>+ if (sumOverflows<int32_t>(length1, length2, length3)) {
+ throwOutOfMemoryError(exec);
+ return nullptr;
+ }
</ins><span class="cx">
</span><del>- return JSRopeString::create(exec->vm(), jsString(vm, u1), jsString(vm, u2), jsString(vm, u3));
</del><ins>+ return JSRopeString::create(*vm, jsString(vm, u1), jsString(vm, u2), jsString(vm, u3));
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> ALWAYS_INLINE JSValue jsStringFromRegisterArray(ExecState* exec, Register* strings, unsigned count)
</span></span></pre>
</div>
</div>
</body>
</html>