[Webkit-unassigned] [Bug 180139] New: [ESNext] Enables a way to throw an error on ByteCodeGenerator step

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=180139

            Bug ID: 180139
           Summary: [ESNext] Enables a way to throw an error on
                    ByteCodeGenerator step
           Product: WebKit
           Version: WebKit Nightly Build
          Hardware: Unspecified
                OS: Unspecified
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: JavaScriptCore
          Assignee: webkit-unassigned at lists.webkit.org
          Reporter: ticaiolima at gmail.com

When generating bytecode into ByteCodeGenerator, we aren't considering cases where we doesn't have memory for constants like String. The same is true for BigInt, but we could throw OOM instead of use RELEASE_ASSERT in such cases. Here is a sample of program that crashes due to OOM.

```
var longStr = "f";
for (var i = 0; i < 30; ++i)
    longStr = longStr + longStr;

let sub = longStr.substring(0, longStr.length - 4)
let mscript = "0x" + longStr + sub + "n";

eval(mscript);
```

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20171129/f6bb22a1/attachment.html>