JSTests/ChangeLog

 12021-07-14 Mark Lam <mark.lam@apple.com>
 2
 3 Check for out of memory in JSC::globalFuncEscape() and JSC::globalFuncUnescape().
 4 https://bugs.webkit.org/show_bug.cgi?id=227962
 5 rdar://78392251
 6
 7 Reviewed by NOBODY (OOPS!).
 8
 9 * stress/out-of-memory-in-globalFuncUnescape.js: Added.
 10
1112021-07-14 Mark Lam <mark.lam@apple.com>
212
313 Placate exception checker validation in operationObjectAssignUntyped.
279913

JSTests/stress/out-of-memory-in-globalFuncUnescape.js

 1//@ if $buildType == "release" && !$memoryLimited then runDefault else skip end
 2
 3var exception;
 4try {
 5 unescape('\u0100'.repeat(2**30));
 6} catch (e) {
 7 exception = e;
 8}
 9
 10if (exception != "RangeError: Out of memory")
 11 throw "FAILED";
nonexistent

Source/JavaScriptCore/ChangeLog

 12021-07-14 Mark Lam <mark.lam@apple.com>
 2
 3 Check for out of memory in JSC::globalFuncEscape() and JSC::globalFuncUnescape().
 4 https://bugs.webkit.org/show_bug.cgi?id=227962
 5 rdar://78392251
 6
 7 Reviewed by NOBODY (OOPS!).
 8
 9 * runtime/JSGlobalObjectFunctions.cpp:
 10 (JSC::JSC_DEFINE_HOST_FUNCTION):
 11
1122021-07-12 Mark Lam <mark.lam@apple.com>
213
314 Revert r277027: breaks GC.
279861

Source/JavaScriptCore/runtime/JSGlobalObjectFunctions.cpp

@@JSC_DEFINE_HOST_FUNCTION(globalFuncEscap
586586 );
587587
588588 VM& vm = globalObject->vm();
589  StringBuilder builder;
 589 auto scope = DECLARE_THROW_SCOPE(vm);
 590
 591 StringBuilder builder(StringBuilder::OverflowHandler::RecordOverflow);
590592 if (view.is8Bit()) {
591593 const LChar* c = view.characters8();
592594 for (unsigned k = 0; k < view.length(); k++, c++) {

@@JSC_DEFINE_HOST_FUNCTION(globalFuncEscap
596598 else
597599 builder.append('%', hex(u, 2));
598600 }
599  return jsString(vm, builder.toString());
 601 } else {
 602 const UChar* c = view.characters16();
 603 for (unsigned k = 0; k < view.length(); k++, c++) {
 604 UChar u = c[0];
 605 if (u >= doNotEscape.size())
 606 builder.append("%u", hex(static_cast<uint8_t>(u >> 8), 2), hex(static_cast<uint8_t>(u), 2));
 607 else if (doNotEscape.get(static_cast<LChar>(u)))
 608 builder.append(*c);
 609 else
 610 builder.append('%', hex(u, 2));
 611 }
600612 }
601613
602  const UChar* c = view.characters16();
603  for (unsigned k = 0; k < view.length(); k++, c++) {
604  UChar u = c[0];
605  if (u >= doNotEscape.size())
606  builder.append("%u", hex(static_cast<uint8_t>(u >> 8), 2), hex(static_cast<uint8_t>(u), 2));
607  else if (doNotEscape.get(static_cast<LChar>(u)))
608  builder.append(*c);
609  else
610  builder.append('%', hex(u, 2));
 614 if (UNLIKELY(builder.hasOverflowed())) {
 615 throwOutOfMemoryError(globalObject, scope);
 616 return vm.smallStrings.emptyString();
611617 }
612 
613618 return jsString(vm, builder.toString());
614619 }));
615620}

@@JSC_DEFINE_HOST_FUNCTION(globalFuncUnesc
622627 int k = 0;
623628 int length = view.length();
624629
625  StringBuilder builder;
 630 VM& vm = globalObject->vm();
 631 auto scope = DECLARE_THROW_SCOPE(vm);
 632
 633 StringBuilder builder(StringBuilder::OverflowHandler::RecordOverflow);
626634 builder.reserveCapacity(length);
627635
628636 if (view.is8Bit()) {

@@JSC_DEFINE_HOST_FUNCTION(globalFuncUnesc
666674 }
667675 }
668676
669  return jsString(globalObject->vm(), builder.toString());
 677 if (UNLIKELY(builder.hasOverflowed())) {
 678 throwOutOfMemoryError(globalObject, scope);
 679 return vm.smallStrings.emptyString();
 680 }
 681 return jsString(vm, builder.toString());
670682 }));
671683}
672684
279860