<html>
<head>
<base href="https://bugs.webkit.org/" />
</head>
<body><table border="1" cellspacing="0" cellpadding="8">
<tr>
<th>Bug ID</th>
<td><a class="bz_bug_link
bz_status_NEW "
title="NEW - OOM Assertion failure in Array.prototype.toString"
href="https://bugs.webkit.org/show_bug.cgi?id=158793">158793</a>
</td>
</tr>
<tr>
<th>Summary</th>
<td>OOM Assertion failure in Array.prototype.toString
</td>
</tr>
<tr>
<th>Classification</th>
<td>Unclassified
</td>
</tr>
<tr>
<th>Product</th>
<td>WebKit
</td>
</tr>
<tr>
<th>Version</th>
<td>WebKit Local Build
</td>
</tr>
<tr>
<th>Hardware</th>
<td>Unspecified
</td>
</tr>
<tr>
<th>OS</th>
<td>Unspecified
</td>
</tr>
<tr>
<th>Status</th>
<td>NEW
</td>
</tr>
<tr>
<th>Severity</th>
<td>Normal
</td>
</tr>
<tr>
<th>Priority</th>
<td>P2
</td>
</tr>
<tr>
<th>Component</th>
<td>JavaScriptCore
</td>
</tr>
<tr>
<th>Assignee</th>
<td>webkit-unassigned@lists.webkit.org
</td>
</tr>
<tr>
<th>Reporter</th>
<td>andre.bargull@gmail.com
</td>
</tr></table>
<p>
<div>
<pre>SVN: rev202088
Build with: perl Tools/Scripts/build-jsc --gtk --debug
The following test case triggers this assertion error:
---
ASSERTION FAILED: length >= 0
---
Test case:
---
var p = "a".repeat(0x7ffffff)
var r = [
p, p, p, p, p,
p, p, p, p, p,
p, p, p, p, p,
p, p, p, p, p,
p, p, p, p, p
].toString();
---
Stack trace:
---
#0 0x00007ffff6de7098 in WTFCrash () at ../../Source/WTF/wtf/Assertions.cpp:317
#1 0x0000000000443945 in JSC::JSString::create (vm=..., value=...) at ../../Source/JavaScriptCore/runtime/JSString.h:136
#2 0x0000000000444033 in JSC::jsString (vm=0x7fffb09f1000, s=...) at ../../Source/JavaScriptCore/runtime/JSString.h:562
#3 0x00000000004440aa in JSC::jsString (exec=0x7fffffffcb30, s=...) at ../../Source/JavaScriptCore/runtime/JSString.h:628
#4 0x00007ffff6c358fb in JSC::JSStringJoiner::join (this=0x7fffffffcad0, state=...) at ../../Source/JavaScriptCore/runtime/JSStringJoiner.cpp:120
#5 0x00007ffff6ae5dc3 in JSC::arrayProtoFuncToString (exec=0x7fffffffcb30) at ../../Source/JavaScriptCore/runtime/ArrayPrototype.cpp:385
...
---
Also reproducible with:
---
var s = "a".repeat(0x3fffffff);
var r = RegExp.prototype.toString.call({
source: s,
flags: s,
});
---</pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are the assignee for the bug.</li>
</ul>
</body>
</html>