[Webkit-unassigned] [Bug 158793] New: OOM Assertion failure in Array.prototype.toString

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=158793

            Bug ID: 158793
           Summary: OOM Assertion failure in Array.prototype.toString
    Classification: Unclassified
           Product: WebKit
           Version: WebKit Local Build
          Hardware: Unspecified
                OS: Unspecified
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: JavaScriptCore
          Assignee: webkit-unassigned at lists.webkit.org
          Reporter: andre.bargull at gmail.com

SVN: rev202088
Build with: perl Tools/Scripts/build-jsc --gtk --debug


The following test case triggers this assertion error:
---
ASSERTION FAILED: length >= 0
---


Test case:
---
var p = "a".repeat(0x7ffffff)
var r = [
  p, p, p, p, p,
  p, p, p, p, p,
  p, p, p, p, p,
  p, p, p, p, p,
  p, p, p, p, p
].toString();
---


Stack trace:
---
#0  0x00007ffff6de7098 in WTFCrash () at ../../Source/WTF/wtf/Assertions.cpp:317
#1  0x0000000000443945 in JSC::JSString::create (vm=..., value=...) at ../../Source/JavaScriptCore/runtime/JSString.h:136
#2  0x0000000000444033 in JSC::jsString (vm=0x7fffb09f1000, s=...) at ../../Source/JavaScriptCore/runtime/JSString.h:562
#3  0x00000000004440aa in JSC::jsString (exec=0x7fffffffcb30, s=...) at ../../Source/JavaScriptCore/runtime/JSString.h:628
#4  0x00007ffff6c358fb in JSC::JSStringJoiner::join (this=0x7fffffffcad0, state=...) at ../../Source/JavaScriptCore/runtime/JSStringJoiner.cpp:120
#5  0x00007ffff6ae5dc3 in JSC::arrayProtoFuncToString (exec=0x7fffffffcb30) at ../../Source/JavaScriptCore/runtime/ArrayPrototype.cpp:385
...
---


Also reproducible with:
---
var s = "a".repeat(0x3fffffff);
var r = RegExp.prototype.toString.call({
    source: s,
    flags: s,
});
---

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.webkit.org/pipermail/webkit-unassigned/attachments/20160615/9fe20c2b/attachment.html>