Attachment 319085 Details for Bug 163955 – Patch

[patch] Patch

bug-163955-20170825093632.patch (text/plain), 2.90 KB, created by Keith Miller on 2017-08-25 09:36:33 PDT

(hide)

Description:

Filename:

MIME Type:

Creator: Keith Miller

Created: 2017-08-25 09:36:33 PDT

Size: 2.90 KB

patch

obsolete

>Subversion Revision: 221021
>diff --git a/Source/JavaScriptCore/ChangeLog b/Source/JavaScriptCore/ChangeLog
>index 7634e19039ec2b2684c55618db95041c006199ec..76293717236c6331c3f31b9c29baa1731dc56b9b 100644
>--- a/Source/JavaScriptCore/ChangeLog
>+++ b/Source/JavaScriptCore/ChangeLog
>@@ -1,3 +1,21 @@
>+2017-08-25  Keith Miller  <keith_miller@apple.com>
>+
>+        Explore increasing max JSString::m_length to UINT_MAX.
>+        https://bugs.webkit.org/show_bug.cgi?id=163955
>+        <rdar://problem/32001499>
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        This can cause us to release assert on some code paths. I don't
>+        see a reason to maintain this restriction.
>+
>+        * runtime/JSString.h:
>+        (JSC::JSString::length const):
>+        (JSC::JSString::setLength):
>+        (JSC::JSString::isValidLength): Deleted.
>+        * runtime/JSStringBuilder.h:
>+        (JSC::jsMakeNontrivialString):
>+
> 2017-08-22  Keith Miller  <keith_miller@apple.com>
> 
>         Unriviewed, fix windows build... for realz.
>diff --git a/Source/JavaScriptCore/runtime/JSString.h b/Source/JavaScriptCore/runtime/JSString.h
>index 310570559a880ce36299014f84bb0da3889f4bb8..ab54572b952d7d5f3085e2768c6a6dce62308679 100644
>--- a/Source/JavaScriptCore/runtime/JSString.h
>+++ b/Source/JavaScriptCore/runtime/JSString.h
>@@ -164,14 +164,6 @@ public:
>     const String& tryGetValue() const;
>     const StringImpl* tryGetValueImpl() const;
>     ALWAYS_INLINE unsigned length() const { return m_length; }
>-    ALWAYS_INLINE static bool isValidLength(size_t length)
>-    {
>-        // While length is of type unsigned, the runtime and compilers are all
>-        // expecting that m_length is a positive value <= INT_MAX.
>-        // FIXME: Look into making the max length UINT_MAX to match StringImpl's max length.
>-        // https://bugs.webkit.org/show_bug.cgi?id=163955
>-        return length <= std::numeric_limits<int32_t>::max();
>-    }
> 
>     JSValue toPrimitive(ExecState*, PreferredPrimitiveType) const;
>     bool toBoolean() const { return !!length(); }
>@@ -219,7 +211,6 @@ protected:
> 
>     ALWAYS_INLINE void setLength(unsigned length)
>     {
>-        RELEASE_ASSERT(isValidLength(length));
>         m_length = length;
>     }
> 
>diff --git a/Source/JavaScriptCore/runtime/JSStringBuilder.h b/Source/JavaScriptCore/runtime/JSStringBuilder.h
>index 88ad6ddef1f447cc55875e02d39a54dc1808282c..9b4294aadae1ddcc6c300e31642e9aa00915bff9 100644
>--- a/Source/JavaScriptCore/runtime/JSStringBuilder.h
>+++ b/Source/JavaScriptCore/runtime/JSStringBuilder.h
>@@ -131,7 +131,7 @@ inline JSValue jsMakeNontrivialString(ExecState* exec, const StringType& string,
>     VM& vm = exec->vm();
>     auto scope = DECLARE_THROW_SCOPE(vm);
>     String result = tryMakeString(string, strings...);
>-    if (UNLIKELY(!result || !JSString::isValidLength(result.length())))
>+    if (UNLIKELY(!result))
>         return throwOutOfMemoryError(exec, scope);
>     return jsNontrivialString(exec, WTFMove(result));
> }

Actions: View | Formatted Diff | Diff

Attachments on bug 163955: 319083 | 319085