192833 2018-12-18 15:27:51 -0800 String overflow in JSC::createError results in ASSERT in WTF::makeString 2018-12-19 03:33:21 -0800 1 1 1 Unclassified WebKit JavaScriptCore WebKit Nightly Build Unspecified Unspecified RESOLVED FIXED InRadar P2 Normal --- 1 tzagallo tzagallo commit-queue ews-watchlist guijemont guijemont+jsc-armv7-ews keith_miller mark.lam msaboff saam webkit-bug-importer oldest_to_newest 1489100 0 tzagallo 2018-12-18 15:27:51 -0800 ... 1489104 1 tzagallo 2018-12-18 15:31:50 -0800 <rdar://problem/45706868> 1489108 2 357625 tzagallo 2018-12-18 15:42:31 -0800 Created attachment 357625 Patch 1489124 3 357625 mark.lam 2018-12-18 16:12:23 -0800 Comment on attachment 357625 Patch View in context: https://bugs.webkit.org/attachment.cgi?id=357625&action=review r=me > JSTests/stress/string-overflow-createError.js:3 > +bar = '2.3023e-320' > +foo = bar.padEnd(2147483644, 1); > +foo(true, 1).value; Does this test throw an exception? If so, don't you have to put it in a try catch statement? 1489155 4 357625 ews-watchlist 2018-12-18 17:33:09 -0800 Comment on attachment 357625 Patch Attachment 357625 did not pass jsc-ews (mac): Output: https://webkit-queues.webkit.org/results/10465801 New failing tests: stress/string-overflow-createError.js.dfg-eager-no-cjit-validate stress/string-overflow-createError.js.no-cjit-validate-phases stress/string-overflow-createError.js.ftl-eager stress/string-overflow-createError.js.ftl-no-cjit-no-inline-validate stress/string-overflow-createError.js.ftl-eager-no-cjit stress/string-overflow-createError.js.dfg-eager stress/string-overflow-createError.js.ftl-no-cjit-no-put-stack-validate stress/string-overflow-createError.js.ftl-no-cjit-validate-sampling-profiler stress/string-overflow-createError.js.ftl-no-cjit-b3o1 stress/string-overflow-createError.js.dfg-maximal-flush-validate-no-cjit stress/string-overflow-createError.js.no-llint stress/string-overflow-createError.js.default stress/string-overflow-createError.js.ftl-eager-no-cjit-b3o1 stress/string-overflow-createError.js.no-cjit-collect-continuously stress/string-overflow-createError.js.ftl-no-cjit-small-pool stress/string-overflow-createError.js.no-ftl apiTests 1489157 5 357625 mark.lam 2018-12-18 17:35:46 -0800 Comment on attachment 357625 Patch View in context: https://bugs.webkit.org/attachment.cgi?id=357625&action=review >> JSTests/stress/string-overflow-createError.js:3 >> +foo(true, 1).value; > > Does this test throw an exception? If so, don't you have to put it in a try catch statement? EWS bot is not happy. It does look like you need to wrap this in a try-catch. Something like this: var exception; try { bar = '2.3023e-320' foo = bar.padEnd(2147483644, 1); foo(true, 1).value; } catch (e) { exception = e; } if (exception != "Error: Out of memory") throw "FAILED"; 1489256 6 357625 tzagallo 2018-12-19 02:50:20 -0800 Comment on attachment 357625 Patch View in context: https://bugs.webkit.org/attachment.cgi?id=357625&action=review >>> JSTests/stress/string-overflow-createError.js:3 >>> +foo(true, 1).value; >> >> Does this test throw an exception? If so, don't you have to put it in a try catch statement? > > EWS bot is not happy. It does look like you need to wrap this in a try-catch. Something like this: > > var exception; > try { > bar = '2.3023e-320' > foo = bar.padEnd(2147483644, 1); > foo(true, 1).value; > } catch (e) { > exception = e; > } > > if (exception != "Error: Out of memory") > throw "FAILED"; Oops... I should have checked that. I will update, thanks! 1489258 7 357666 tzagallo 2018-12-19 02:53:58 -0800 Created attachment 357666 Patch for landing 1489264 8 357666 commit-queue 2018-12-19 03:33:19 -0800 Comment on attachment 357666 Patch for landing Clearing flags on attachment: 357666 Committed r239375: <https://trac.webkit.org/changeset/239375> 1489265 9 commit-queue 2018-12-19 03:33:21 -0800 All reviewed patches have been landed. Closing bug. 357625 2018-12-18 15:42:31 -0800 2018-12-19 02:53:53 -0800 Patch bug-192833-20181219004126.patch text/plain 3047 tzagallo U3VidmVyc2lvbiBSZXZpc2lvbjogMjM5MzI4CmRpZmYgLS1naXQgYS9Tb3VyY2UvSmF2YVNjcmlw dENvcmUvQ2hhbmdlTG9nIGIvU291cmNlL0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwppbmRleCAz ODY1Y2RiMzhiNTQxOTE2ZDEyZDc4ODBjNTdkODllMjdlYjUyNmIyLi43YmFlY2QzZTUyN2NhMTZm OGVlMmNhNmE2OWI3NGY1YjI1NTZiNmI5IDEwMDY0NAotLS0gYS9Tb3VyY2UvSmF2YVNjcmlwdENv cmUvQ2hhbmdlTG9nCisrKyBiL1NvdXJjZS9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cKQEAgLTEs MyArMSwxOSBAQAorMjAxOC0xMi0xOCAgVGFkZXUgWmFnYWxsbyAgPHR6YWdhbGxvQGFwcGxlLmNv bT4KKworICAgICAgICBTdHJpbmcgb3ZlcmZsb3cgaW4gSlNDOjpjcmVhdGVFcnJvciByZXN1bHRz IGluIEFTU0VSVCBpbiBXVEY6Om1ha2VTdHJpbmcKKyAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtp dC5vcmcvc2hvd19idWcuY2dpP2lkPTE5MjgzMworICAgICAgICA8cmRhcjovL3Byb2JsZW0vNDU3 MDY4Njg+CisKKyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BTISkuCisKKyAgICAgICAg SlNDOjpjcmVhdGVFcnJvciB3YXMgY2FsbGluZyBXVEY6Om1ha2VTdHJpbmcgd2hpY2ggd291bGQg cmVzdWx0IGluIGFuCisgICAgICAgIGFzc2VydGlvbiBmYWlsdXJlIHdoZW4gdGhlIHN0cmluZyB3 YXMgdG9vIGJpZy4gQ2hhbmdlIGl0IHRvIGNhbGwKKyAgICAgICAgV1RGOjp0cnlNYWtlU3RyaW5n IGluc3RlYWQgYW5kIHJldHVybiBhbiBPdXRPZk1lbW9yeSBlcnJvciBpZiB3ZSBmYWlsCisgICAg ICAgIHRvIGNyZWF0ZSB0aGUgZXJyb3Igc3RyaW5nLgorCisgICAgICAgICogcnVudGltZS9FeGNl cHRpb25IZWxwZXJzLmNwcDoKKyAgICAgICAgKEpTQzo6Y3JlYXRlRXJyb3IpOgorCiAyMDE4LTEy LTE3ICBNYXJrIExhbSAgPG1hcmsubGFtQGFwcGxlLmNvbT4KIAogICAgICAgICBBcnJheSB1bnNo aWZ0L3NoaWZ0IHNob3VsZCBub3QgcmFjZSBhZ2FpbnN0IHRoZSBBSSBpbiB0aGUgY29tcGlsZXIg dGhyZWFkLgpkaWZmIC0tZ2l0IGEvU291cmNlL0phdmFTY3JpcHRDb3JlL3J1bnRpbWUvRXhjZXB0 aW9uSGVscGVycy5jcHAgYi9Tb3VyY2UvSmF2YVNjcmlwdENvcmUvcnVudGltZS9FeGNlcHRpb25I ZWxwZXJzLmNwcAppbmRleCAyMGNiNWZjNzdjMDhjNDY1MjMxMjhmNWY2ODQzNjVkOTQ0OTY2MGM4 Li44YTYxN2I0ODBmNWJjZjMzNGVkYTg5NDdmOGVlYTFhNGI2NGQxZTVkIDEwMDY0NAotLS0gYS9T b3VyY2UvSmF2YVNjcmlwdENvcmUvcnVudGltZS9FeGNlcHRpb25IZWxwZXJzLmNwcAorKysgYi9T b3VyY2UvSmF2YVNjcmlwdENvcmUvcnVudGltZS9FeGNlcHRpb25IZWxwZXJzLmNwcApAQCAtMjY3 LDcgKzI2Nyw5IEBAIEpTT2JqZWN0KiBjcmVhdGVFcnJvcihFeGVjU3RhdGUqIGV4ZWMsIEpTVmFs dWUgdmFsdWUsIGNvbnN0IFN0cmluZyYgbWVzc2FnZSwgRXJyCiAgICAgVk0mIHZtID0gZXhlYy0+ dm0oKTsKICAgICBhdXRvIHNjb3BlID0gREVDTEFSRV9DQVRDSF9TQ09QRSh2bSk7CiAKLSAgICBT dHJpbmcgZXJyb3JNZXNzYWdlID0gbWFrZVN0cmluZyhlcnJvckRlc2NyaXB0aW9uRm9yVmFsdWUo ZXhlYywgdmFsdWUpLT52YWx1ZShleGVjKSwgJyAnLCBtZXNzYWdlKTsKKyAgICBTdHJpbmcgZXJy b3JNZXNzYWdlID0gdHJ5TWFrZVN0cmluZyhlcnJvckRlc2NyaXB0aW9uRm9yVmFsdWUoZXhlYywg dmFsdWUpLT52YWx1ZShleGVjKSwgJyAnLCBtZXNzYWdlKTsKKyAgICBpZiAoZXJyb3JNZXNzYWdl LmlzTnVsbCgpKQorICAgICAgICByZXR1cm4gY3JlYXRlT3V0T2ZNZW1vcnlFcnJvcihleGVjKTsK ICAgICBzY29wZS5hc3NlcnROb0V4Y2VwdGlvbigpOwogICAgIEpTT2JqZWN0KiBleGNlcHRpb24g PSBjcmVhdGVUeXBlRXJyb3IoZXhlYywgZXJyb3JNZXNzYWdlLCBhcHBlbmRlciwgcnVudGltZVR5 cGVGb3JWYWx1ZSh2bSwgdmFsdWUpKTsKICAgICBBU1NFUlQoZXhjZXB0aW9uLT5pc0Vycm9ySW5z dGFuY2UoKSk7CmRpZmYgLS1naXQgYS9KU1Rlc3RzL0NoYW5nZUxvZyBiL0pTVGVzdHMvQ2hhbmdl TG9nCmluZGV4IDc3MmNmZmMxYjFiMGZiMzExNDEyNmI4MGQ5MDNjNmRmYmYyNGI0ZGQuLmZiOTMy ODVhZDU0YTgyYjBlNDJiNzQ3MjNmNWZhNThjNzFiYjhjNzcgMTAwNjQ0Ci0tLSBhL0pTVGVzdHMv Q2hhbmdlTG9nCisrKyBiL0pTVGVzdHMvQ2hhbmdlTG9nCkBAIC0xLDMgKzEsMTMgQEAKKzIwMTgt MTItMTggIFRhZGV1IFphZ2FsbG8gIDx0emFnYWxsb0BhcHBsZS5jb20+CisKKyAgICAgICAgU3Ry aW5nIG92ZXJmbG93IGluIEpTQzo6Y3JlYXRlRXJyb3IgcmVzdWx0cyBpbiBBU1NFUlQgaW4gV1RG OjptYWtlU3RyaW5nCisgICAgICAgIGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNn aT9pZD0xOTI4MzMKKyAgICAgICAgPHJkYXI6Ly9wcm9ibGVtLzQ1NzA2ODY4PgorCisgICAgICAg IFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgICogc3RyZXNzL3N0cmluZy1v dmVyZmxvdy1jcmVhdGVFcnJvci5qczogQWRkZWQuCisKIDIwMTgtMTItMTggIE1hcmsgTGFtICA8 bWFyay5sYW1AYXBwbGUuY29tPgogCiAgICAgICAgIFNraXAgdGhlIHN0cmVzcy9lbGlkYWJsZS1u ZXctb2JqZWN0LXJvZmxjb3B0ZXItdGhlbi1leGl0LmpzIHRlc3Qgb24gMzItYml0LgpkaWZmIC0t Z2l0IGEvSlNUZXN0cy9zdHJlc3Mvc3RyaW5nLW92ZXJmbG93LWNyZWF0ZUVycm9yLmpzIGIvSlNU ZXN0cy9zdHJlc3Mvc3RyaW5nLW92ZXJmbG93LWNyZWF0ZUVycm9yLmpzCm5ldyBmaWxlIG1vZGUg MTAwNjQ0CmluZGV4IDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAuLjFm MmMxZDQ3MDFhMDNlMjYyOTk3YmE3MmI5YjcwYmQ5NDczZTgyM2UKLS0tIC9kZXYvbnVsbAorKysg Yi9KU1Rlc3RzL3N0cmVzcy9zdHJpbmctb3ZlcmZsb3ctY3JlYXRlRXJyb3IuanMKQEAgLTAsMCAr MSwzIEBACitiYXIgPSAnMi4zMDIzZS0zMjAnCitmb28gPSBiYXIucGFkRW5kKDIxNDc0ODM2NDQs IDEpOworZm9vKHRydWUsIDEpLnZhbHVlOwo= 357666 2018-12-19 02:53:58 -0800 2018-12-19 03:33:19 -0800 Patch for landing bug-192833-20181219115253.patch text/plain 3131 tzagallo U3VidmVyc2lvbiBSZXZpc2lvbjogMjM5MzczCmRpZmYgLS1naXQgYS9Tb3VyY2UvSmF2YVNjcmlw dENvcmUvQ2hhbmdlTG9nIGIvU291cmNlL0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwppbmRleCAz NGRhYjk5OTQwNzJjZDI5YTA4ZGVkMjNmMjFmMTdiYTZhNmRkODA1Li45NjdiMjA0ZTA0ZWEwZGMz YzRjMTdhMWY5Y2JiZjgzNzlhZDBjNjQ5IDEwMDY0NAotLS0gYS9Tb3VyY2UvSmF2YVNjcmlwdENv cmUvQ2hhbmdlTG9nCisrKyBiL1NvdXJjZS9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cKQEAgLTEs MyArMSwxOSBAQAorMjAxOC0xMi0xOCAgVGFkZXUgWmFnYWxsbyAgPHR6YWdhbGxvQGFwcGxlLmNv bT4KKworICAgICAgICBTdHJpbmcgb3ZlcmZsb3cgaW4gSlNDOjpjcmVhdGVFcnJvciByZXN1bHRz IGluIEFTU0VSVCBpbiBXVEY6Om1ha2VTdHJpbmcKKyAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtp dC5vcmcvc2hvd19idWcuY2dpP2lkPTE5MjgzMworICAgICAgICA8cmRhcjovL3Byb2JsZW0vNDU3 MDY4Njg+CisKKyAgICAgICAgUmV2aWV3ZWQgYnkgTWFyayBMYW0uCisKKyAgICAgICAgSlNDOjpj cmVhdGVFcnJvciB3YXMgY2FsbGluZyBXVEY6Om1ha2VTdHJpbmcgd2hpY2ggd291bGQgcmVzdWx0 IGluIGFuCisgICAgICAgIGFzc2VydGlvbiBmYWlsdXJlIHdoZW4gdGhlIHN0cmluZyB3YXMgdG9v IGJpZy4gQ2hhbmdlIGl0IHRvIGNhbGwKKyAgICAgICAgV1RGOjp0cnlNYWtlU3RyaW5nIGluc3Rl YWQgYW5kIHJldHVybiBhbiBPdXRPZk1lbW9yeSBlcnJvciBpZiB3ZSBmYWlsCisgICAgICAgIHRv IGNyZWF0ZSB0aGUgZXJyb3Igc3RyaW5nLgorCisgICAgICAgICogcnVudGltZS9FeGNlcHRpb25I ZWxwZXJzLmNwcDoKKyAgICAgICAgKEpTQzo6Y3JlYXRlRXJyb3IpOgorCiAyMDE4LTEyLTE4ICBS b3NzIEtpcnNsaW5nICA8cm9zcy5raXJzbGluZ0Bzb255LmNvbT4KIAogICAgICAgICBFcnJvciBt ZXNzYWdlIGZvciBgLXggKiogeWAgY29udGFpbnMgYSB0eXBvLgpkaWZmIC0tZ2l0IGEvU291cmNl L0phdmFTY3JpcHRDb3JlL3J1bnRpbWUvRXhjZXB0aW9uSGVscGVycy5jcHAgYi9Tb3VyY2UvSmF2 YVNjcmlwdENvcmUvcnVudGltZS9FeGNlcHRpb25IZWxwZXJzLmNwcAppbmRleCAyMGNiNWZjNzdj MDhjNDY1MjMxMjhmNWY2ODQzNjVkOTQ0OTY2MGM4Li44YTYxN2I0ODBmNWJjZjMzNGVkYTg5NDdm OGVlYTFhNGI2NGQxZTVkIDEwMDY0NAotLS0gYS9Tb3VyY2UvSmF2YVNjcmlwdENvcmUvcnVudGlt ZS9FeGNlcHRpb25IZWxwZXJzLmNwcAorKysgYi9Tb3VyY2UvSmF2YVNjcmlwdENvcmUvcnVudGlt ZS9FeGNlcHRpb25IZWxwZXJzLmNwcApAQCAtMjY3LDcgKzI2Nyw5IEBAIEpTT2JqZWN0KiBjcmVh dGVFcnJvcihFeGVjU3RhdGUqIGV4ZWMsIEpTVmFsdWUgdmFsdWUsIGNvbnN0IFN0cmluZyYgbWVz c2FnZSwgRXJyCiAgICAgVk0mIHZtID0gZXhlYy0+dm0oKTsKICAgICBhdXRvIHNjb3BlID0gREVD TEFSRV9DQVRDSF9TQ09QRSh2bSk7CiAKLSAgICBTdHJpbmcgZXJyb3JNZXNzYWdlID0gbWFrZVN0 cmluZyhlcnJvckRlc2NyaXB0aW9uRm9yVmFsdWUoZXhlYywgdmFsdWUpLT52YWx1ZShleGVjKSwg JyAnLCBtZXNzYWdlKTsKKyAgICBTdHJpbmcgZXJyb3JNZXNzYWdlID0gdHJ5TWFrZVN0cmluZyhl cnJvckRlc2NyaXB0aW9uRm9yVmFsdWUoZXhlYywgdmFsdWUpLT52YWx1ZShleGVjKSwgJyAnLCBt ZXNzYWdlKTsKKyAgICBpZiAoZXJyb3JNZXNzYWdlLmlzTnVsbCgpKQorICAgICAgICByZXR1cm4g Y3JlYXRlT3V0T2ZNZW1vcnlFcnJvcihleGVjKTsKICAgICBzY29wZS5hc3NlcnROb0V4Y2VwdGlv bigpOwogICAgIEpTT2JqZWN0KiBleGNlcHRpb24gPSBjcmVhdGVUeXBlRXJyb3IoZXhlYywgZXJy b3JNZXNzYWdlLCBhcHBlbmRlciwgcnVudGltZVR5cGVGb3JWYWx1ZSh2bSwgdmFsdWUpKTsKICAg ICBBU1NFUlQoZXhjZXB0aW9uLT5pc0Vycm9ySW5zdGFuY2UoKSk7CmRpZmYgLS1naXQgYS9KU1Rl c3RzL0NoYW5nZUxvZyBiL0pTVGVzdHMvQ2hhbmdlTG9nCmluZGV4IGRiZDViM2M5YWEwOGQ5M2Jh NWYyMWRmY2MyMzIwMTNlOGI4MTNhZTIuLmM2ZDRiYzdhZjA0Y2U0MjYxN2Y0NjllODI0NDhjYWYx MGE1ODdmMjQgMTAwNjQ0Ci0tLSBhL0pTVGVzdHMvQ2hhbmdlTG9nCisrKyBiL0pTVGVzdHMvQ2hh bmdlTG9nCkBAIC0xLDMgKzEsMTMgQEAKKzIwMTgtMTItMTggIFRhZGV1IFphZ2FsbG8gIDx0emFn YWxsb0BhcHBsZS5jb20+CisKKyAgICAgICAgU3RyaW5nIG92ZXJmbG93IGluIEpTQzo6Y3JlYXRl RXJyb3IgcmVzdWx0cyBpbiBBU1NFUlQgaW4gV1RGOjptYWtlU3RyaW5nCisgICAgICAgIGh0dHBz Oi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD0xOTI4MzMKKyAgICAgICAgPHJkYXI6 Ly9wcm9ibGVtLzQ1NzA2ODY4PgorCisgICAgICAgIFJldmlld2VkIGJ5IE1hcmsgTGFtLgorCisg ICAgICAgICogc3RyZXNzL3N0cmluZy1vdmVyZmxvdy1jcmVhdGVFcnJvci5qczogQWRkZWQuCisK IDIwMTgtMTItMTggIFJvc3MgS2lyc2xpbmcgIDxyb3NzLmtpcnNsaW5nQHNvbnkuY29tPgogCiAg ICAgICAgIEVycm9yIG1lc3NhZ2UgZm9yIGAteCAqKiB5YCBjb250YWlucyBhIHR5cG8uCmRpZmYg LS1naXQgYS9KU1Rlc3RzL3N0cmVzcy9zdHJpbmctb3ZlcmZsb3ctY3JlYXRlRXJyb3IuanMgYi9K U1Rlc3RzL3N0cmVzcy9zdHJpbmctb3ZlcmZsb3ctY3JlYXRlRXJyb3IuanMKbmV3IGZpbGUgbW9k ZSAxMDA2NDQKaW5kZXggMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMC4u MDFkOTVhZDYyMjEwOTQ3OTE5MTEyYmRmMWUzZTg3MGY3YmMzOTk0NAotLS0gL2Rldi9udWxsCisr KyBiL0pTVGVzdHMvc3RyZXNzL3N0cmluZy1vdmVyZmxvdy1jcmVhdGVFcnJvci5qcwpAQCAtMCww ICsxLDExIEBACit2YXIgZXhjZXB0aW9uOwordHJ5IHsKKyAgICBiYXIgPSAnMi4zMDIzZS0zMjAn CisgICAgZm9vID0gYmFyLnBhZEVuZCgyMTQ3NDgzNjQ0LCAxKTsKKyAgICBmb28odHJ1ZSwgMSku dmFsdWU7Cit9IGNhdGNoIChlKSB7CisgICAgZXhjZXB0aW9uID0gZTsKK30KKworaWYgKGV4Y2Vw dGlvbiAhPSAiRXJyb3I6IE91dCBvZiBtZW1vcnkiKQorICAgIHRocm93ICJGQUlMRUQiOwo=