Attachment 339235 Details for Bug 185048 – patch

[patch] patch

0001-Teach-StringBuilder-that-it-is-fallible.patch (text/plain), 475.53 KB, created by JF Bastien on 2018-05-01 16:01:48 PDT

(hide)

Description:

Filename:

MIME Type:

Creator: JF Bastien

Created: 2018-05-01 16:01:48 PDT

Size: 475.53 KB

patch

obsolete

>From 1a3c90a7f20aea982bed7faad9b73f9646dd0207 Mon Sep 17 00:00:00 2001
>From: JF Bastien <jfbastien@apple.com>
>Date: Wed, 25 Apr 2018 21:50:24 -0700
>Subject: [PATCH] Teach StringBuilder that it is fallible
>
>---
> Source/JavaScriptCore/API/JSContextRef.cpp         |   4 +-
> .../API/tests/ExecutionTimeLimitTest.cpp           | 310 +++++++------
> .../API/tests/PingPongStackOverflowTest.cpp        |   9 +-
> Source/JavaScriptCore/ChangeLog                    |  95 ++++
> .../dfg/DFGStrengthReductionPhase.cpp              |  17 +-
> Source/JavaScriptCore/heap/HeapSnapshotBuilder.cpp |   4 +-
> Source/JavaScriptCore/inspector/ConsoleMessage.cpp |  13 +-
> .../inspector/ContentSearchUtilities.cpp           |   4 +-
> Source/JavaScriptCore/interpreter/Interpreter.cpp  |   4 +-
> Source/JavaScriptCore/interpreter/StackVisitor.cpp |   4 +-
> Source/JavaScriptCore/jsc.cpp                      |  11 +-
> Source/JavaScriptCore/runtime/ConfigFile.cpp       |   9 +-
> Source/JavaScriptCore/runtime/ConsoleClient.cpp    |  15 +-
> Source/JavaScriptCore/runtime/DateConversion.cpp   |   4 +-
> Source/JavaScriptCore/runtime/ErrorInstance.cpp    |   4 +-
> Source/JavaScriptCore/runtime/ExceptionHelpers.cpp |   4 +-
> .../JavaScriptCore/runtime/FunctionConstructor.cpp |  34 +-
> .../JavaScriptCore/runtime/IntlDateTimeFormat.cpp  |   6 +-
> Source/JavaScriptCore/runtime/IntlObject.cpp       |  18 +-
> .../runtime/JSGlobalObjectFunctions.cpp            |  21 +-
> Source/JavaScriptCore/runtime/JSONObject.cpp       |  18 +-
> Source/JavaScriptCore/runtime/LiteralParser.cpp    |  10 +-
> Source/JavaScriptCore/runtime/Options.cpp          |  10 +-
> Source/JavaScriptCore/runtime/RegExpPrototype.cpp  |   4 +-
> Source/JavaScriptCore/runtime/SamplingProfiler.cpp |   4 +-
> Source/JavaScriptCore/runtime/StackFrame.cpp       |   4 +-
> .../JavaScriptCore/runtime/StringConstructor.cpp   |   4 +-
> Source/JavaScriptCore/runtime/StringPrototype.cpp  |   4 +-
> Source/JavaScriptCore/runtime/TypeProfiler.cpp     |   6 +-
> Source/JavaScriptCore/runtime/TypeSet.cpp          |  23 +-
> Source/JavaScriptCore/testRegExp.cpp               |  20 +-
> Source/JavaScriptCore/tools/FunctionOverrides.cpp  |   9 +-
> Source/JavaScriptCore/wasm/WasmBBQPlan.cpp         |   7 +-
> Source/JavaScriptCore/yarr/YarrParser.h            |  30 +-
> Source/WTF/ChangeLog                               | 143 ++++++
> Source/WTF/wtf/Assertions.cpp                      |   8 +-
> Source/WTF/wtf/DateMath.cpp                        |   4 +-
> Source/WTF/wtf/JSONValues.cpp                      |  11 +-
> Source/WTF/wtf/Logger.h                            |  11 +-
> Source/WTF/wtf/MediaTime.cpp                       |   4 +-
> Source/WTF/wtf/UUID.cpp                            |   4 +-
> Source/WTF/wtf/text/StringBuilder.cpp              | 265 ++++++-----
> Source/WTF/wtf/text/StringBuilder.h                | 297 ++++++------
> Source/WTF/wtf/text/StringBuilderJSON.cpp          |  31 +-
> Source/WTF/wtf/text/StringImpl.cpp                 |  34 +-
> Source/WTF/wtf/text/StringImpl.h                   |  18 +-
> Source/WTF/wtf/text/TextStream.cpp                 |   8 +-
> Source/WebCore/ChangeLog                           | 510 +++++++++++++++++++++
> .../Modules/applepay/cocoa/PaymentContactCocoa.mm  |   5 +-
> .../WebCore/Modules/entriesapi/DOMFileSystem.cpp   |   4 +-
> Source/WebCore/Modules/geolocation/Geolocation.cpp |   5 +-
> Source/WebCore/Modules/indexeddb/IDBKeyData.cpp    |  15 +-
> Source/WebCore/Modules/indexeddb/IDBKeyPath.cpp    |   4 +-
> .../Modules/indexeddb/server/IndexValueStore.cpp   |   4 +-
> .../Modules/indexeddb/server/SQLiteIDBCursor.cpp   |   8 +-
> .../Modules/indexeddb/shared/IDBDatabaseInfo.cpp   |   4 +-
> .../indexeddb/shared/IDBObjectStoreInfo.cpp        |   4 +-
> .../mediasession/WebMediaSessionManager.cpp        |   8 +-
> .../Modules/mediastream/PeerConnectionBackend.cpp  |   8 +-
> .../Modules/plugins/YouTubePluginReplacement.cpp   |   4 +-
> .../Modules/webdatabase/DatabaseTracker.cpp        |   4 +-
> Source/WebCore/Modules/websockets/WebSocket.cpp    |   8 +-
> .../websockets/WebSocketExtensionDispatcher.cpp    |   8 +-
> .../Modules/websockets/WebSocketHandshake.cpp      |  23 +-
> .../accessibility/AccessibilityNodeObject.cpp      |  18 +-
> .../WebCore/accessibility/AccessibilityObject.cpp  |  10 +-
> .../mac/WebAccessibilityObjectWrapperMac.mm        |  11 +-
> Source/WebCore/bindings/js/JSDOMConvertStrings.cpp |   4 +-
> .../WebCore/bindings/js/JSDOMExceptionHandling.cpp |  16 +-
> .../contentextensions/CombinedURLFilters.cpp       |   4 +-
> .../WebCore/contentextensions/ContentExtension.cpp |   7 +-
> .../contentextensions/ContentExtensionCompiler.cpp |   5 +-
> .../ContentExtensionStyleSheet.cpp                 |   5 +-
> Source/WebCore/contentextensions/Term.h            |   8 +-
> .../WebCore/css/CSSAnimationTriggerScrollValue.cpp |   4 +-
> Source/WebCore/css/CSSBasicShapes.cpp              |  20 +-
> Source/WebCore/css/CSSCalculationValue.cpp         |   8 +-
> Source/WebCore/css/CSSComputedStyleDeclaration.cpp |   4 +-
> Source/WebCore/css/CSSCrossfadeValue.cpp           |   4 +-
> Source/WebCore/css/CSSCursorImageValue.cpp         |   4 +-
> Source/WebCore/css/CSSCustomIdentValue.cpp         |   4 +-
> Source/WebCore/css/CSSFilterImageValue.cpp         |   4 +-
> Source/WebCore/css/CSSFontFaceRule.cpp             |   4 +-
> Source/WebCore/css/CSSFontFaceSrcValue.cpp         |   4 +-
> Source/WebCore/css/CSSFontFeatureValue.cpp         |   4 +-
> Source/WebCore/css/CSSFontStyleRangeValue.cpp      |   4 +-
> Source/WebCore/css/CSSFontStyleValue.cpp           |   4 +-
> Source/WebCore/css/CSSFontValue.cpp                |   4 +-
> Source/WebCore/css/CSSFontVariationValue.cpp       |   4 +-
> Source/WebCore/css/CSSFunctionValue.cpp            |   4 +-
> Source/WebCore/css/CSSGradientValue.cpp            |  12 +-
> Source/WebCore/css/CSSGridAutoRepeatValue.cpp      |   4 +-
> Source/WebCore/css/CSSGridTemplateAreasValue.cpp   |   4 +-
> Source/WebCore/css/CSSImageSetValue.cpp            |   4 +-
> Source/WebCore/css/CSSImportRule.cpp               |   4 +-
> Source/WebCore/css/CSSKeyframeRule.cpp             |   8 +-
> Source/WebCore/css/CSSKeyframesRule.cpp            |   4 +-
> Source/WebCore/css/CSSLineBoxContainValue.cpp      |   4 +-
> Source/WebCore/css/CSSMarkup.cpp                   |   8 +-
> Source/WebCore/css/CSSMediaRule.cpp                |   4 +-
> Source/WebCore/css/CSSNamespaceRule.cpp            |   4 +-
> Source/WebCore/css/CSSPageRule.cpp                 |   8 +-
> Source/WebCore/css/CSSPrimitiveValue.cpp           |  12 +-
> Source/WebCore/css/CSSPropertySourceData.cpp       |   4 +-
> Source/WebCore/css/CSSSelector.cpp                 |  17 +-
> Source/WebCore/css/CSSSelectorList.cpp             |   4 +-
> Source/WebCore/css/CSSShadowValue.cpp              |   4 +-
> Source/WebCore/css/CSSStyleRule.cpp                |   4 +-
> Source/WebCore/css/CSSStyleSheet.cpp               |   9 +-
> Source/WebCore/css/CSSSupportsRule.cpp             |   4 +-
> Source/WebCore/css/CSSTimingFunctionValue.cpp      |  16 +-
> Source/WebCore/css/CSSValueList.cpp                |   4 +-
> Source/WebCore/css/CSSVariableData.cpp             |   5 +-
> Source/WebCore/css/DOMCSSNamespace.cpp             |   4 +-
> Source/WebCore/css/DOMMatrixReadOnly.cpp           |   4 +-
> Source/WebCore/css/DeprecatedCSSOMValueList.cpp    |   4 +-
> Source/WebCore/css/FontFace.cpp                    |  12 +-
> Source/WebCore/css/MediaList.cpp                   |   4 +-
> Source/WebCore/css/MediaQuery.cpp                  |   4 +-
> Source/WebCore/css/MediaQueryExpression.cpp        |   5 +-
> Source/WebCore/css/Rect.h                          |   4 +-
> Source/WebCore/css/StyleProperties.cpp             |  30 +-
> Source/WebCore/css/WebKitCSSMatrix.cpp             |   4 +-
> Source/WebCore/css/WebKitCSSViewportRule.cpp       |   4 +-
> Source/WebCore/css/parser/CSSParser.cpp            |  11 +-
> Source/WebCore/css/parser/CSSParserToken.cpp       |  87 ++--
> Source/WebCore/css/parser/CSSParserTokenRange.cpp  |   4 +-
> Source/WebCore/css/parser/CSSPropertyParser.cpp    |  27 +-
> Source/WebCore/css/parser/CSSTokenizer.cpp         |  38 +-
> Source/WebCore/dom/DatasetDOMStringMap.cpp         |   4 +-
> Source/WebCore/dom/Element.cpp                     |   5 +-
> Source/WebCore/dom/Node.cpp                        |  22 +-
> Source/WebCore/dom/Position.cpp                    |   5 +-
> Source/WebCore/dom/Range.cpp                       |   9 +-
> Source/WebCore/dom/ScriptedAnimationController.cpp |   4 +-
> Source/WebCore/dom/SecurityContext.cpp             |   5 +-
> Source/WebCore/dom/Text.cpp                        |   9 +-
> Source/WebCore/dom/TextNodeTraversal.cpp           |   8 +-
> Source/WebCore/editing/ApplyStyleCommand.cpp       |   5 +-
> Source/WebCore/editing/Editing.cpp                 |   4 +-
> Source/WebCore/editing/HTMLInterchange.cpp         |   4 +-
> Source/WebCore/editing/MarkupAccumulator.cpp       |  17 +-
> Source/WebCore/editing/TextIterator.cpp            |  11 +-
> Source/WebCore/editing/TypingCommand.cpp           |   4 +-
> Source/WebCore/editing/VisibleSelection.cpp        |   5 +-
> Source/WebCore/editing/cocoa/DataDetection.mm      |   8 +-
> Source/WebCore/editing/cocoa/HTMLConverter.mm      |   5 +-
> Source/WebCore/editing/ios/EditorIOS.mm            |   5 +-
> Source/WebCore/editing/markup.cpp                  |  27 +-
> Source/WebCore/fileapi/FileReaderLoader.cpp        |  24 +-
> Source/WebCore/html/DOMTokenList.cpp               |   9 +-
> Source/WebCore/html/EmailInputType.cpp             |   4 +-
> Source/WebCore/html/FileInputType.cpp              |   4 +-
> Source/WebCore/html/FormController.cpp             |   4 +-
> Source/WebCore/html/HTMLAnchorElement.cpp          |  12 +-
> Source/WebCore/html/HTMLCanvasElement.cpp          |  21 +-
> Source/WebCore/html/HTMLFontElement.cpp            |   7 +-
> Source/WebCore/html/HTMLImageElement.cpp           |   4 +-
> Source/WebCore/html/HTMLMediaElement.cpp           |   9 +-
> Source/WebCore/html/HTMLOptionElement.cpp          |   4 +-
> Source/WebCore/html/HTMLTextFormControlElement.cpp |  12 +-
> Source/WebCore/html/MediaDocument.cpp              |   5 +-
> Source/WebCore/html/MediaElementSession.cpp        |   4 +-
> Source/WebCore/html/MediaFragmentURIParser.cpp     |   8 +-
> Source/WebCore/html/TypeAhead.cpp                  |  14 +-
> .../html/canvas/CanvasRenderingContext2D.cpp       |   4 +-
> .../html/canvas/CanvasRenderingContext2DBase.cpp   |   7 +-
> .../html/canvas/WebGLRenderingContextBase.cpp      |   4 +-
> Source/WebCore/html/parser/HTMLSourceTracker.cpp   |   7 +-
> Source/WebCore/html/parser/HTMLTokenizer.cpp       |  12 +-
> Source/WebCore/html/parser/HTMLTreeBuilder.cpp     |  27 +-
> Source/WebCore/html/parser/XSSAuditorDelegate.cpp  |   4 +-
> Source/WebCore/html/track/BufferedLineReader.cpp   |   8 +-
> Source/WebCore/html/track/TrackBase.cpp            |   5 +-
> Source/WebCore/html/track/VTTCue.cpp               |   6 +-
> Source/WebCore/html/track/WebVTTParser.cpp         |   5 +-
> Source/WebCore/html/track/WebVTTTokenizer.cpp      |  63 ++-
> Source/WebCore/inspector/InspectorStyleSheet.cpp   |  17 +-
> .../agents/InspectorApplicationCacheAgent.cpp      |  13 +-
> .../inspector/agents/InspectorNetworkAgent.cpp     |   7 +-
> .../WebCore/inspector/agents/WebConsoleAgent.cpp   |   5 +-
> Source/WebCore/loader/CrossOriginAccessControl.cpp |   8 +-
> Source/WebCore/loader/ResourceLoadStatistics.cpp   |   4 +-
> .../loader/appcache/ApplicationCacheStorage.cpp    |  25 +-
> .../WebCore/loader/archive/cf/LegacyWebArchive.cpp |  25 +-
> .../WebCore/loader/archive/mhtml/MHTMLArchive.cpp  |  34 +-
> .../WebCore/page/CaptionUserPreferencesMediaAF.cpp |  64 ++-
> Source/WebCore/page/Frame.cpp                      |   4 +-
> Source/WebCore/page/FrameTree.cpp                  |   4 +-
> Source/WebCore/page/FrameView.cpp                  |   5 +-
> Source/WebCore/page/PageSerializer.cpp             |   7 +-
> Source/WebCore/page/PerformanceLoggingClient.cpp   |   4 +-
> Source/WebCore/page/SecurityOriginData.cpp         |   4 +-
> Source/WebCore/page/WheelEventTestTrigger.cpp      |   5 +-
> Source/WebCore/page/csp/ContentSecurityPolicy.cpp  |   9 +-
> .../page/scrolling/AxisScrollSnapOffsets.cpp       |   8 +-
> .../page/scrolling/ScrollingCoordinator.cpp        |   4 +-
> Source/WebCore/platform/Decimal.cpp                |  12 +-
> Source/WebCore/platform/FileSystem.cpp             |   8 +-
> Source/WebCore/platform/PODInterval.h              |   4 +-
> Source/WebCore/platform/PODRedBlackTree.h          |   5 +-
> Source/WebCore/platform/URL.cpp                    |  18 +-
> .../WebCore/platform/animation/TimingFunction.cpp  |   5 +-
> Source/WebCore/platform/glib/FileSystemGlib.cpp    |   4 +-
> Source/WebCore/platform/glib/UserAgentGLib.cpp     |   4 +-
> Source/WebCore/platform/graphics/Color.cpp         |   8 +-
> Source/WebCore/platform/graphics/ExtendedColor.cpp |   4 +-
> Source/WebCore/platform/graphics/FontCascade.cpp   |   4 +-
> .../platform/graphics/FontTaggedSettings.cpp       |   5 +-
> Source/WebCore/platform/graphics/GraphicsLayer.cpp |   4 +-
> .../avfoundation/InbandTextTrackPrivateAVF.cpp     |  13 +-
> .../platform/graphics/ca/TileController.cpp        |   5 +-
> Source/WebCore/platform/graphics/ca/TileGrid.cpp   |   4 +-
> .../graphics/ca/win/PlatformCALayerWin.cpp         |   4 +-
> .../platform/graphics/cv/VideoTextureCopierCV.cpp  |  10 +-
> .../opengl/GraphicsContext3DOpenGLCommon.cpp       |  11 +-
> .../graphics/texmap/TextureMapperShaderProgram.cpp |  15 +-
> Source/WebCore/platform/gtk/SelectionData.cpp      |   5 +-
> Source/WebCore/platform/mac/PasteboardMac.mm       |   4 +-
> Source/WebCore/platform/mac/StringUtilities.mm     |   6 +-
> .../WebCore/platform/mock/ScrollAnimatorMock.cpp   |  15 +-
> .../WebCore/platform/mock/mediasource/MockBox.cpp  |   9 +-
> Source/WebCore/platform/network/HTTPParsers.cpp    |   4 +-
> Source/WebCore/platform/network/MIMEHeader.cpp     |  13 +-
> Source/WebCore/platform/network/ProxyServer.cpp    |   4 +-
> .../network/curl/CookieJarCurlDatabase.cpp         |   4 +-
> .../WebCore/platform/network/mac/CookieJarMac.mm   |   5 +-
> Source/WebCore/platform/posix/FileSystemPOSIX.cpp  |   4 +-
> Source/WebCore/platform/text/DateTimeFormat.cpp    |  26 +-
> .../WebCore/platform/text/DecodeEscapeSequences.h  |   8 +-
> Source/WebCore/platform/text/PlatformLocale.cpp    |  20 +-
> Source/WebCore/platform/text/SegmentedString.cpp   |   4 +-
> Source/WebCore/platform/text/TextCodecICU.cpp      |  13 +-
> .../WebCore/platform/text/TextCodecUserDefined.cpp |   4 +-
> .../platform/vr/openvr/VRPlatformDisplayOpenVR.cpp |   5 +-
> .../WebCore/platform/win/ClipboardUtilitiesWin.cpp |   5 +-
> Source/WebCore/platform/win/UserAgentWin.cpp       |   4 +-
> Source/WebCore/platform/wpe/RenderThemeWPE.cpp     |   4 +-
> Source/WebCore/plugins/DOMMimeType.cpp             |   4 +-
> Source/WebCore/rendering/RenderLayer.cpp           |   4 +-
> Source/WebCore/rendering/RenderLayerCompositor.cpp |   5 +-
> Source/WebCore/rendering/RenderListMarker.cpp      |   9 +-
> Source/WebCore/rendering/RenderText.cpp            |  23 +-
> Source/WebCore/rendering/RenderThemeGtk.cpp        |   4 +-
> Source/WebCore/rendering/RenderThemeIOS.mm         |  10 +-
> Source/WebCore/rendering/RenderThemeWin.cpp        |   5 +-
> Source/WebCore/rendering/RenderTreeAsText.cpp      |   8 +-
> .../rendering/mathml/RenderMathMLFenced.cpp        |   5 +-
> .../rendering/updating/RenderTreeBuilderMathML.cpp |   5 +-
> Source/WebCore/svg/SVGLengthListValues.cpp         |   4 +-
> Source/WebCore/svg/SVGNumberListValues.cpp         |   4 +-
> Source/WebCore/svg/SVGPathStringBuilder.cpp        |   4 +-
> Source/WebCore/svg/SVGPathUtilities.cpp            |   4 +-
> Source/WebCore/svg/SVGPointListValues.cpp          |   4 +-
> Source/WebCore/svg/SVGStringListValues.cpp         |   4 +-
> Source/WebCore/svg/SVGTransformListValues.cpp      |   4 +-
> Source/WebCore/svg/SVGTransformValue.cpp           |  20 +-
> Source/WebCore/svg/properties/SVGPropertyTraits.h  |   8 +-
> Source/WebCore/testing/Internals.cpp               |  64 +--
> Source/WebCore/testing/MockPageOverlayClient.cpp   |  10 +-
> Source/WebCore/workers/WorkerScriptLoader.cpp      |   4 +-
> Source/WebCore/xml/XMLErrors.cpp                   |   7 +-
> Source/WebCore/xml/XMLHttpRequest.cpp              |  15 +-
> Source/WebCore/xml/XMLHttpRequest.h                |   7 +-
> Source/WebCore/xml/XPathFunctions.cpp              |  21 +-
> Source/WebCore/xml/XSLTProcessorLibxslt.cpp        |  14 +-
> .../xml/parser/CharacterReferenceParserInlines.h   |   5 +-
> Source/WebDriver/SessionHost.cpp                   |   5 +-
> Source/WebKit/ChangeLog                            |  49 ++
> .../NetworkProcess/cache/CacheStorageEngine.cpp    |   4 +-
> .../WebKit/NetworkProcess/cache/NetworkCache.cpp   |  18 +-
> .../NetworkProcess/cache/NetworkCacheKey.cpp       |   4 +-
> .../capture/NetworkCaptureManager.cpp              |   6 +-
> .../NetworkProcess/soup/NetworkProcessSoup.cpp     |   4 +-
> .../Shared/Databases/IndexedDB/IDBUtilities.cpp    |   4 +-
> Source/WebKit/Shared/Gamepad/GamepadData.cpp       |   4 +-
> .../Netscape/unix/NetscapePluginModuleUnix.cpp     |   4 +-
> Source/WebKit/Shared/WebMemorySampler.cpp          |   7 +-
> Source/WebKit/UIProcess/API/APIUserScript.cpp      |   4 +-
> Source/WebKit/UIProcess/API/APIUserStyleSheet.cpp  |   4 +-
> Source/WebKit/UIProcess/API/glib/WebKitWebView.cpp |   9 +-
> .../UIProcess/Cocoa/ViewGestureController.cpp      |   6 +-
> Source/WebKit/UIProcess/WebBackForwardList.cpp     |   4 +-
> Source/WebKit/UIProcess/WebProcessPool.cpp         |   5 +-
> Source/WebKit/UIProcess/WebProcessProxy.cpp        |   5 +-
> .../UIProcess/WebResourceLoadStatisticsStore.cpp   |  20 +-
> .../WebResourceLoadStatisticsTelemetry.cpp         |  33 +-
> .../InjectedBundle/API/glib/WebKitWebPage.cpp      |  10 +-
> .../Plugins/Netscape/NetscapeBrowserFuncs.cpp      |   4 +-
> Source/WebKit/WebProcess/Plugins/PluginView.cpp    |   4 +-
> Source/WebKit/WebProcess/WebPage/WebFrame.cpp      |   4 +-
> Source/WebKitLegacy/mac/ChangeLog                  |  12 +
> .../mac/WebView/WebHTMLRepresentation.mm           |   5 +-
> Source/WebKitLegacy/win/AccessibleBase.cpp         |   5 +-
> Source/WebKitLegacy/win/Plugins/PluginStream.cpp   |   5 +-
> Source/WebKitLegacy/win/WebKitStatistics.cpp       |   7 +-
> Tools/ChangeLog                                    |  78 ++++
> Tools/TestWebKitAPI/Tests/WTF/CrossThreadTask.cpp  |   4 +-
> Tools/TestWebKitAPI/Tests/WTF/StringBuilder.cpp    |  92 ++--
> Tools/TestWebKitAPI/Tests/WTF/StringView.cpp       |  80 ++--
> .../Tests/WebCore/ContentExtensions.cpp            |  86 ++--
> Tools/TestWebKitAPI/Tests/WebCore/FileMonitor.cpp  |  37 +-
> Tools/TestWebKitAPI/Tests/WebCore/Logging.cpp      |  30 +-
> Tools/TestWebKitAPI/Tests/WebCore/TextCodec.cpp    |   4 +-
> .../Tests/WebKitGLib/TestAutomationSession.cpp     |   9 +-
> .../Tests/WebKitGLib/TestWebKitWebContext.cpp      |   4 +-
> Tools/TestWebKitAPI/WTFStringUtilities.h           |   4 +-
> .../InjectedBundle/InjectedBundlePage.cpp          | 196 ++++++--
> .../WebKitTestRunner/InjectedBundle/TestRunner.cpp |  18 +-
> .../atk/AccessibilityUIElementAtk.cpp              |  24 +-
> Tools/WebKitTestRunner/TestController.cpp          |  15 +-
> Tools/WebKitTestRunner/TestInvocation.cpp          |   9 +-
> 312 files changed, 3690 insertions(+), 1348 deletions(-)
>
>diff --git a/Source/JavaScriptCore/API/JSContextRef.cpp b/Source/JavaScriptCore/API/JSContextRef.cpp
>index 025eba4..5edf681 100644
>--- a/Source/JavaScriptCore/API/JSContextRef.cpp
>+++ b/Source/JavaScriptCore/API/JSContextRef.cpp
>@@ -314,7 +314,9 @@ JSStringRef JSContextCreateBacktrace(JSContextRef ctx, unsigned maxStackSize)
>     BacktraceFunctor functor(builder, maxStackSize);
>     frame->iterate(functor);
> 
>-    return OpaqueJSString::create(builder.toString()).leakRef();
>+    if (auto string = builder.toString())
>+        return OpaqueJSString::create(*string).leakRef();
>+    CRASH();
> }
> 
> bool JSGlobalContextGetRemoteInspectionEnabled(JSGlobalContextRef ctx)
>diff --git a/Source/JavaScriptCore/API/tests/ExecutionTimeLimitTest.cpp b/Source/JavaScriptCore/API/tests/ExecutionTimeLimitTest.cpp
>index 637b304..1652839 100644
>--- a/Source/JavaScriptCore/API/tests/ExecutionTimeLimitTest.cpp
>+++ b/Source/JavaScriptCore/API/tests/ExecutionTimeLimitTest.cpp
>@@ -194,22 +194,25 @@ int testExecutionTimeLimit()
>             scriptBuilder.appendNumber(timeAfterWatchdogShouldHaveFired.seconds());
>             scriptBuilder.appendLiteral(") break; } } foo();");
> 
>-            JSStringRef script = JSStringCreateWithUTF8CString(scriptBuilder.toString().utf8().data());
>-            exception = nullptr;
>-            shouldTerminateCallbackWasCalled = false;
>-            auto startTime = CPUTime::forCurrentThread();
>-            JSEvaluateScript(context, script, nullptr, nullptr, 1, &exception);
>-            auto endTime = CPUTime::forCurrentThread();
>-
>-            if (((endTime - startTime) < timeAfterWatchdogShouldHaveFired) && shouldTerminateCallbackWasCalled)
>-                printf("PASS: %s script timed out as expected.\n", tierOptions.tier);
>-            else {
>-                if ((endTime - startTime) >= timeAfterWatchdogShouldHaveFired)
>-                    printf("FAIL: %s script did not time out as expected.\n", tierOptions.tier);
>-                if (!shouldTerminateCallbackWasCalled)
>-                    printf("FAIL: %s script timeout callback was not called.\n", tierOptions.tier);
>-                failed = true;
>-            }
>+            if (auto string = scriptBuilder.toString()) {
>+                JSStringRef script = JSStringCreateWithUTF8CString(string->utf8().data());
>+                exception = nullptr;
>+                shouldTerminateCallbackWasCalled = false;
>+                auto startTime = CPUTime::forCurrentThread();
>+                JSEvaluateScript(context, script, nullptr, nullptr, 1, &exception);
>+                auto endTime = CPUTime::forCurrentThread();
>+
>+                if (((endTime - startTime) < timeAfterWatchdogShouldHaveFired) && shouldTerminateCallbackWasCalled)
>+                    printf("PASS: %s script timed out as expected.\n", tierOptions.tier);
>+                else {
>+                    if ((endTime - startTime) >= timeAfterWatchdogShouldHaveFired)
>+                        printf("FAIL: %s script did not time out as expected.\n", tierOptions.tier);
>+                    if (!shouldTerminateCallbackWasCalled)
>+                        printf("FAIL: %s script timeout callback was not called.\n", tierOptions.tier);
>+                    failed = true;
>+                }
>+            } else
>+                CRASH();
>             
>             if (!exception) {
>                 printf("FAIL: %s TerminatedExecutionException was not thrown.\n", tierOptions.tier);
>@@ -237,22 +240,25 @@ int testExecutionTimeLimit()
>             scriptBuilder.appendLiteral("    return recurse(i + 1); }");
>             scriptBuilder.appendLiteral("recurse(0);");
> 
>-            JSStringRef script = JSStringCreateWithUTF8CString(scriptBuilder.toString().utf8().data());
>-            exception = nullptr;
>-            shouldTerminateCallbackWasCalled = false;
>-            auto startTime = CPUTime::forCurrentThread();
>-            JSEvaluateScript(context, script, nullptr, nullptr, 1, &exception);
>-            auto endTime = CPUTime::forCurrentThread();
>-
>-            if (((endTime - startTime) < timeAfterWatchdogShouldHaveFired) && shouldTerminateCallbackWasCalled)
>-                printf("PASS: %s script with infinite tail calls timed out as expected .\n", tierOptions.tier);
>-            else {
>-                if ((endTime - startTime) >= timeAfterWatchdogShouldHaveFired)
>-                    printf("FAIL: %s script with infinite tail calls did not time out as expected.\n", tierOptions.tier);
>-                if (!shouldTerminateCallbackWasCalled)
>-                    printf("FAIL: %s script with infinite tail calls' timeout callback was not called.\n", tierOptions.tier);
>-                failed = true;
>-            }
>+            if (auto string = scriptBuilder.toString()) {
>+                JSStringRef script = JSStringCreateWithUTF8CString(string->utf8().data());
>+                exception = nullptr;
>+                shouldTerminateCallbackWasCalled = false;
>+                auto startTime = CPUTime::forCurrentThread();
>+                JSEvaluateScript(context, script, nullptr, nullptr, 1, &exception);
>+                auto endTime = CPUTime::forCurrentThread();
>+
>+                if (((endTime - startTime) < timeAfterWatchdogShouldHaveFired) && shouldTerminateCallbackWasCalled)
>+                    printf("PASS: %s script with infinite tail calls timed out as expected .\n", tierOptions.tier);
>+                else {
>+                    if ((endTime - startTime) >= timeAfterWatchdogShouldHaveFired)
>+                        printf("FAIL: %s script with infinite tail calls did not time out as expected.\n", tierOptions.tier);
>+                    if (!shouldTerminateCallbackWasCalled)
>+                        printf("FAIL: %s script with infinite tail calls' timeout callback was not called.\n", tierOptions.tier);
>+                    failed = true;
>+                }
>+            } else
>+                CRASH();
>             
>             if (!exception) {
>                 printf("FAIL: %s TerminatedExecutionException was not thrown.\n", tierOptions.tier);
>@@ -273,21 +279,24 @@ int testExecutionTimeLimit()
>             scriptBuilder.appendNumber(timeAfterWatchdogShouldHaveFired.seconds());
>             scriptBuilder.appendLiteral(") break; } } catch(e) { } } foo();");
> 
>-            JSStringRef script = JSStringCreateWithUTF8CString(scriptBuilder.toString().utf8().data());
>-            exception = nullptr;
>-            shouldTerminateCallbackWasCalled = false;
>+            if (auto string = scriptBuilder.toString()) {
>+                JSStringRef script = JSStringCreateWithUTF8CString(string->utf8().data());
>+                exception = nullptr;
>+                shouldTerminateCallbackWasCalled = false;
> 
>-            auto startTime = CPUTime::forCurrentThread();
>-            JSEvaluateScript(context, script, nullptr, nullptr, 1, &exception);
>-            auto endTime = CPUTime::forCurrentThread();
>+                auto startTime = CPUTime::forCurrentThread();
>+                JSEvaluateScript(context, script, nullptr, nullptr, 1, &exception);
>+                auto endTime = CPUTime::forCurrentThread();
>             
>-            if (((endTime - startTime) >= timeAfterWatchdogShouldHaveFired) || !shouldTerminateCallbackWasCalled) {
>-                if (!((endTime - startTime) < timeAfterWatchdogShouldHaveFired))
>-                    printf("FAIL: %s script did not time out as expected.\n", tierOptions.tier);
>-                if (!shouldTerminateCallbackWasCalled)
>-                    printf("FAIL: %s script timeout callback was not called.\n", tierOptions.tier);
>-                failed = true;
>-            }
>+                if (((endTime - startTime) >= timeAfterWatchdogShouldHaveFired) || !shouldTerminateCallbackWasCalled) {
>+                    if (!((endTime - startTime) < timeAfterWatchdogShouldHaveFired))
>+                        printf("FAIL: %s script did not time out as expected.\n", tierOptions.tier);
>+                    if (!shouldTerminateCallbackWasCalled)
>+                        printf("FAIL: %s script timeout callback was not called.\n", tierOptions.tier);
>+                    failed = true;
>+                }
>+            } else
>+                CRASH();
>             
>             if (exception)
>                 printf("PASS: %s TerminatedExecutionException was not catchable as expected.\n", tierOptions.tier);
>@@ -309,24 +318,27 @@ int testExecutionTimeLimit()
>             scriptBuilder.appendLiteral("function foo() { var startTime = currentCPUTime(); while (true) { for (var i = 0; i < 1000; i++); if (currentCPUTime() - startTime > ");
>             scriptBuilder.appendNumber(timeAfterWatchdogShouldHaveFired.seconds());
>             scriptBuilder.appendLiteral(") break; } } foo();");
>-            
>-            JSStringRef script = JSStringCreateWithUTF8CString(scriptBuilder.toString().utf8().data());
>-            exception = nullptr;
>-            shouldTerminateCallbackWasCalled = false;
> 
>-            auto startTime = CPUTime::forCurrentThread();
>-            JSEvaluateScript(context, script, nullptr, nullptr, 1, &exception);
>-            auto endTime = CPUTime::forCurrentThread();
>+            if (auto string = scriptBuilder.toString()) {
>+                JSStringRef script = JSStringCreateWithUTF8CString(string->utf8().data());
>+                exception = nullptr;
>+                shouldTerminateCallbackWasCalled = false;
>+
>+                auto startTime = CPUTime::forCurrentThread();
>+                JSEvaluateScript(context, script, nullptr, nullptr, 1, &exception);
>+                auto endTime = CPUTime::forCurrentThread();
>             
>-            if (((endTime - startTime) < timeAfterWatchdogShouldHaveFired) && !shouldTerminateCallbackWasCalled)
>-                printf("PASS: %s script timed out as expected when no callback is specified.\n", tierOptions.tier);
>-            else {
>-                if ((endTime - startTime) >= timeAfterWatchdogShouldHaveFired)
>-                    printf("FAIL: %s script did not time out as expected when no callback is specified.\n", tierOptions.tier);
>-                else
>-                    printf("FAIL: %s script called stale callback function.\n", tierOptions.tier);
>-                failed = true;
>-            }
>+                if (((endTime - startTime) < timeAfterWatchdogShouldHaveFired) && !shouldTerminateCallbackWasCalled)
>+                    printf("PASS: %s script timed out as expected when no callback is specified.\n", tierOptions.tier);
>+                else {
>+                    if ((endTime - startTime) >= timeAfterWatchdogShouldHaveFired)
>+                        printf("FAIL: %s script did not time out as expected when no callback is specified.\n", tierOptions.tier);
>+                    else
>+                        printf("FAIL: %s script called stale callback function.\n", tierOptions.tier);
>+                    failed = true;
>+                }
>+            } else
>+                CRASH();
>             
>             if (!exception) {
>                 printf("FAIL: %s TerminatedExecutionException was not thrown.\n", tierOptions.tier);
>@@ -347,23 +359,26 @@ int testExecutionTimeLimit()
>             scriptBuilder.appendNumber(timeAfterWatchdogShouldHaveFired.seconds());
>             scriptBuilder.appendLiteral(") break; } } foo();");
> 
>-            JSStringRef script = JSStringCreateWithUTF8CString(scriptBuilder.toString().utf8().data());
>-            exception = nullptr;
>-            cancelTerminateCallbackWasCalled = false;
>+            if (auto string = scriptBuilder.toString()) {
>+                JSStringRef script = JSStringCreateWithUTF8CString(string->utf8().data());
>+                exception = nullptr;
>+                cancelTerminateCallbackWasCalled = false;
> 
>-            auto startTime = CPUTime::forCurrentThread();
>-            JSEvaluateScript(context, script, nullptr, nullptr, 1, &exception);
>-            auto endTime = CPUTime::forCurrentThread();
>+                auto startTime = CPUTime::forCurrentThread();
>+                JSEvaluateScript(context, script, nullptr, nullptr, 1, &exception);
>+                auto endTime = CPUTime::forCurrentThread();
>             
>-            if (((endTime - startTime) >= timeAfterWatchdogShouldHaveFired) && cancelTerminateCallbackWasCalled && !exception)
>-                printf("PASS: %s script timeout was cancelled as expected.\n", tierOptions.tier);
>-            else {
>-                if (((endTime - startTime) < timeAfterWatchdogShouldHaveFired) || exception)
>-                    printf("FAIL: %s script timeout was not cancelled.\n", tierOptions.tier);
>-                if (!cancelTerminateCallbackWasCalled)
>-                    printf("FAIL: %s script timeout callback was not called.\n", tierOptions.tier);
>-                failed = true;
>-            }
>+                if (((endTime - startTime) >= timeAfterWatchdogShouldHaveFired) && cancelTerminateCallbackWasCalled && !exception)
>+                    printf("PASS: %s script timeout was cancelled as expected.\n", tierOptions.tier);
>+                else {
>+                    if (((endTime - startTime) < timeAfterWatchdogShouldHaveFired) || exception)
>+                        printf("FAIL: %s script timeout was not cancelled.\n", tierOptions.tier);
>+                    if (!cancelTerminateCallbackWasCalled)
>+                        printf("FAIL: %s script timeout callback was not called.\n", tierOptions.tier);
>+                    failed = true;
>+                }
>+            } else
>+                CRASH();
>             
>             if (exception) {
>                 printf("FAIL: %s Unexpected TerminatedExecutionException thrown.\n", tierOptions.tier);
>@@ -384,33 +399,36 @@ int testExecutionTimeLimit()
>             scriptBuilder.appendNumber(maxBusyLoopTime.seconds()); // in seconds.
>             scriptBuilder.appendLiteral(") break; } } foo();");
> 
>-            JSStringRef script = JSStringCreateWithUTF8CString(scriptBuilder.toString().utf8().data());
>-            exception = nullptr;
>-            extendTerminateCallbackCalled = 0;
>+            if (auto string = scriptBuilder.toString()) {
>+                JSStringRef script = JSStringCreateWithUTF8CString(string->utf8().data());
>+                exception = nullptr;
>+                extendTerminateCallbackCalled = 0;
> 
>-            auto startTime = CPUTime::forCurrentThread();
>-            JSEvaluateScript(context, script, nullptr, nullptr, 1, &exception);
>-            auto endTime = CPUTime::forCurrentThread();
>-            auto deltaTime = endTime - startTime;
>+                auto startTime = CPUTime::forCurrentThread();
>+                JSEvaluateScript(context, script, nullptr, nullptr, 1, &exception);
>+                auto endTime = CPUTime::forCurrentThread();
>+                auto deltaTime = endTime - startTime;
>             
>-            if ((deltaTime >= timeBeforeExtendedDeadline) && (deltaTime < timeAfterExtendedDeadline) && (extendTerminateCallbackCalled == 2) && exception)
>-                printf("PASS: %s script timeout was extended as expected.\n", tierOptions.tier);
>-            else {
>-                if (deltaTime < timeBeforeExtendedDeadline)
>-                    printf("FAIL: %s script timeout was not extended as expected.\n", tierOptions.tier);
>-                else if (deltaTime >= timeAfterExtendedDeadline)
>-                    printf("FAIL: %s script did not timeout.\n", tierOptions.tier);
>+                if ((deltaTime >= timeBeforeExtendedDeadline) && (deltaTime < timeAfterExtendedDeadline) && (extendTerminateCallbackCalled == 2) && exception)
>+                    printf("PASS: %s script timeout was extended as expected.\n", tierOptions.tier);
>+                else {
>+                    if (deltaTime < timeBeforeExtendedDeadline)
>+                        printf("FAIL: %s script timeout was not extended as expected.\n", tierOptions.tier);
>+                    else if (deltaTime >= timeAfterExtendedDeadline)
>+                        printf("FAIL: %s script did not timeout.\n", tierOptions.tier);
>                 
>-                if (extendTerminateCallbackCalled < 1)
>-                    printf("FAIL: %s script timeout callback was not called.\n", tierOptions.tier);
>-                if (extendTerminateCallbackCalled < 2)
>-                    printf("FAIL: %s script timeout callback was not called after timeout extension.\n", tierOptions.tier);
>+                    if (extendTerminateCallbackCalled < 1)
>+                        printf("FAIL: %s script timeout callback was not called.\n", tierOptions.tier);
>+                    if (extendTerminateCallbackCalled < 2)
>+                        printf("FAIL: %s script timeout callback was not called after timeout extension.\n", tierOptions.tier);
>                 
>-                if (!exception)
>-                    printf("FAIL: %s TerminatedExecutionException was not thrown during timeout extension test.\n", tierOptions.tier);
>+                    if (!exception)
>+                        printf("FAIL: %s TerminatedExecutionException was not thrown during timeout extension test.\n", tierOptions.tier);
>                 
>-                failed = true;
>-            }
>+                    failed = true;
>+                }
>+            } else
>+                CRASH();
>         }
> 
> #if HAVE(MACH_EXCEPTIONS)
>@@ -425,56 +443,62 @@ int testExecutionTimeLimit()
>             scriptBuilder.appendNumber(timeAfterWatchdogShouldHaveFired.seconds());
>             scriptBuilder.appendLiteral(") break; } } foo();");
> 
>-            JSStringRef script = JSStringCreateWithUTF8CString(scriptBuilder.toString().utf8().data());
>-            exception = nullptr;
>-            dispatchTerminateCallbackCalled = false;
>-
>-            // We have to do this since blocks can only capture things as const.
>-            JSGlobalContextRef& contextRef = context;
>-            JSStringRef& scriptRef = script;
>-            JSValueRef& exceptionRef = exception;
>-
>-            Lock syncLock;
>-            Lock& syncLockRef = syncLock;
>-            Condition synchronize;
>-            Condition& synchronizeRef = synchronize;
>-            bool didSynchronize = false;
>-            bool& didSynchronizeRef = didSynchronize;
>-
>-            Seconds startTime;
>-            Seconds endTime;
>-
>-            Seconds& startTimeRef = startTime;
>-            Seconds& endTimeRef = endTime;
>-
>-            dispatch_group_t group = dispatch_group_create();
>-            dispatch_group_async(group, dispatch_get_global_queue(0, 0), ^{
>-                startTimeRef = CPUTime::forCurrentThread();
>-                JSEvaluateScript(contextRef, scriptRef, nullptr, nullptr, 1, &exceptionRef);
>-                endTimeRef = CPUTime::forCurrentThread();
>-                auto locker = WTF::holdLock(syncLockRef);
>-                didSynchronizeRef = true;
>-                synchronizeRef.notifyAll();
>-            });
>-
>-            auto locker = holdLock(syncLock);
>-            synchronize.wait(syncLock, [&] { return didSynchronize; });
>-
>-            if (((endTime - startTime) < timeAfterWatchdogShouldHaveFired) && dispatchTerminateCallbackCalled)
>-                printf("PASS: %s script on dispatch queue timed out as expected.\n", tierOptions.tier);
>-            else {
>-                if ((endTime - startTime) >= timeAfterWatchdogShouldHaveFired)
>-                    printf("FAIL: %s script on dispatch queue did not time out as expected.\n", tierOptions.tier);
>-                if (!shouldTerminateCallbackWasCalled)
>-                    printf("FAIL: %s script on dispatch queue timeout callback was not called.\n", tierOptions.tier);
>-                failed = true;
>-            }
>+            if (auto string = scriptBuilder.toString()) {
>+                JSStringRef script = JSStringCreateWithUTF8CString(string->utf8().data());
>+                exception = nullptr;
>+                dispatchTerminateCallbackCalled = false;
>+
>+                // We have to do this since blocks can only capture things as const.
>+                JSGlobalContextRef& contextRef = context;
>+                JSStringRef& scriptRef = script;
>+                JSValueRef& exceptionRef = exception;
>+
>+                Lock syncLock;
>+                Lock& syncLockRef = syncLock;
>+                Condition synchronize;
>+                Condition& synchronizeRef = synchronize;
>+                bool didSynchronize = false;
>+                bool& didSynchronizeRef = didSynchronize;
>+
>+                Seconds startTime;
>+                Seconds endTime;
>+
>+                Seconds& startTimeRef = startTime;
>+                Seconds& endTimeRef = endTime;
>+
>+                dispatch_group_t group = dispatch_group_create();
>+                dispatch_group_async(group, dispatch_get_global_queue(0, 0), ^{
>+                    startTimeRef = CPUTime::forCurrentThread();
>+                    JSEvaluateScript(contextRef, scriptRef, nullptr, nullptr, 1, &exceptionRef);
>+                    endTimeRef = CPUTime::forCurrentThread();
>+                    auto locker = WTF::holdLock(syncLockRef);
>+                    didSynchronizeRef = true;
>+                    synchronizeRef.notifyAll();
>+                });
>+
>+                auto locker = holdLock(syncLock);
>+                synchronize.wait(syncLock, [&] { return didSynchronize; });
>+
>+                if (((endTime - startTime) < timeAfterWatchdogShouldHaveFired) && dispatchTerminateCallbackCalled)
>+                    printf("PASS: %s script on dispatch queue timed out as expected.\n", tierOptions.tier);
>+                else {
>+                    if ((endTime - startTime) >= timeAfterWatchdogShouldHaveFired)
>+                        printf("FAIL: %s script on dispatch queue did not time out as expected.\n", tierOptions.tier);
>+                    if (!shouldTerminateCallbackWasCalled)
>+                        printf("FAIL: %s script on dispatch queue timeout callback was not called.\n", tierOptions.tier);
>+                    failed = true;
>+                }
>+            } else
>+                CRASH();
>         }
> #endif
> 
>         JSGlobalContextRelease(context);
> 
>-        Options::setOptions(savedOptionsBuilder.toString().ascii().data());
>+        if (auto string = savedOptionsBuilder.toString())
>+            Options::setOptions(string->ascii().data());
>+        else
>+            CRASH();
>     }
>     
>     return failed;
>diff --git a/Source/JavaScriptCore/API/tests/PingPongStackOverflowTest.cpp b/Source/JavaScriptCore/API/tests/PingPongStackOverflowTest.cpp
>index 042bebf..112309b 100644
>--- a/Source/JavaScriptCore/API/tests/PingPongStackOverflowTest.cpp
>+++ b/Source/JavaScriptCore/API/tests/PingPongStackOverflowTest.cpp
>@@ -64,9 +64,12 @@ static bool PingPongStackOverflowObject_hasInstance(JSContextRef context, JSObje
>         }
>         builder.appendLiteral(");");
> 
>-        JSStringRef script = JSStringCreateWithUTF8CString(builder.toString().utf8().data());
>-        result = JSEvaluateScript(context, script, NULL, NULL, 1, exception);
>-        JSStringRelease(script);
>+        if (auto string = builder.toString()) {
>+            JSStringRef script = JSStringCreateWithUTF8CString(string->utf8().data());
>+            result = JSEvaluateScript(context, script, nullptr, nullptr, 1, exception);
>+            JSStringRelease(script);
>+        } else
>+            CRASH();
>     }
> 
>     --nativeRecursionCount;
>diff --git a/Source/JavaScriptCore/ChangeLog b/Source/JavaScriptCore/ChangeLog
>index e1c3d21..43676a4 100644
>--- a/Source/JavaScriptCore/ChangeLog
>+++ b/Source/JavaScriptCore/ChangeLog
>@@ -1,3 +1,98 @@
>+2018-04-26  JF Bastien  <jfbastien@apple.com>
>+
>+        StringBuilder is fallible
>+        https://bugs.webkit.org/show_bug.cgi?id=185048
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        StringBuilder can fail when allocating memory. StringBuilder is
>+        mostly used with user input, which often means that just crashing
>+        isn't the right outcome. Our fuzzers often encounter such things
>+        for JavaScriptCore, and so far we've applied point solutions. No
>+        more!
>+
>+        * API/JSContextRef.cpp:
>+        (JSContextCreateBacktrace):
>+        * API/tests/ExecutionTimeLimitTest.cpp:
>+        (testExecutionTimeLimit):
>+        * API/tests/PingPongStackOverflowTest.cpp:
>+        (PingPongStackOverflowObject_hasInstance):
>+        * dfg/DFGStrengthReductionPhase.cpp:
>+        (JSC::DFG::StrengthReductionPhase::handleNode):
>+        * heap/HeapSnapshotBuilder.cpp:
>+        (JSC::HeapSnapshotBuilder::json):
>+        * inspector/ConsoleMessage.cpp:
>+        (Inspector::ConsoleMessage::ConsoleMessage):
>+        * inspector/ContentSearchUtilities.cpp:
>+        (Inspector::ContentSearchUtilities::createSearchRegexSource):
>+        * interpreter/Interpreter.cpp:
>+        (JSC::Interpreter::stackTraceAsString):
>+        * interpreter/StackVisitor.cpp:
>+        (JSC::StackVisitor::Frame::toString const):
>+        * jsc.cpp:
>+        (resolvePath):
>+        (functionJSCStack):
>+        * runtime/ConfigFile.cpp:
>+        (JSC::ConfigFile::parse):
>+        * runtime/ConsoleClient.cpp:
>+        (JSC::ConsoleClient::printConsoleMessage):
>+        (JSC::ConsoleClient::printConsoleMessageWithArguments):
>+        * runtime/DateConversion.cpp:
>+        (JSC::formatDateTime):
>+        * runtime/ErrorInstance.cpp:
>+        (JSC::ErrorInstance::sanitizedToString):
>+        * runtime/ExceptionHelpers.cpp:
>+        (JSC::notAFunctionSourceAppender):
>+        * runtime/FunctionConstructor.cpp:
>+        (JSC::constructFunctionSkippingEvalEnabledCheck):
>+        * runtime/IntlDateTimeFormat.cpp:
>+        (JSC::IntlDateTimeFormat::initializeDateTimeFormat):
>+        * runtime/IntlObject.cpp:
>+        (JSC::privateUseLangTag):
>+        (JSC::canonicalLangTag):
>+        (JSC::removeUnicodeLocaleExtension):
>+        * runtime/JSGlobalObjectFunctions.cpp:
>+        (JSC::encode):
>+        (JSC::decode):
>+        (JSC::globalFuncEscape):
>+        (JSC::globalFuncUnescape):
>+        * runtime/JSONObject.cpp:
>+        (JSC::Stringifier::stringify):
>+        (JSC::Stringifier::Holder::appendNextProperty):
>+        * runtime/LiteralParser.cpp:
>+        (JSC::LiteralParser<CharType>::Lexer::lexStringSlow):
>+        * runtime/Options.cpp:
>+        (JSC::Options::dumpOptionsIfNeeded):
>+        (JSC::Options::dumpAllOptions):
>+        * runtime/RegExpPrototype.cpp:
>+        (JSC::regExpProtoGetterSourceInternal):
>+        * runtime/SamplingProfiler.cpp:
>+        (JSC::SamplingProfiler::stackTracesAsJSON):
>+        * runtime/StackFrame.cpp:
>+        (JSC::StackFrame::toString const):
>+        * runtime/StringConstructor.cpp:
>+        (JSC::stringFromCodePoint):
>+        * runtime/StringPrototype.cpp:
>+        (JSC::substituteBackreferencesSlow):
>+        * runtime/TypeProfiler.cpp:
>+        (JSC::TypeProfiler::typeInformationForExpressionAtOffset):
>+        * runtime/TypeSet.cpp:
>+        (JSC::TypeSet::dumpTypes const):
>+        (JSC::TypeSet::toJSONString const):
>+        (JSC::StructureShape::propertyHash):
>+        (JSC::StructureShape::stringRepresentation):
>+        (JSC::StructureShape::toJSONString const):
>+        * testRegExp.cpp:
>+        (parseRegExpLine):
>+        (parseTestLine):
>+        * tools/FunctionOverrides.cpp:
>+        (JSC::parseClause):
>+        * wasm/WasmBBQPlan.cpp:
>+        (JSC::Wasm::BBQPlan::prepare):
>+        * yarr/YarrParser.h:
>+        (JSC::Yarr::Parser::tryConsumeGroupName):
>+        (JSC::Yarr::Parser::tryConsumeUnicodePropertyExpression):
>+
> 2018-05-01  Robin Morisset  <rmorisset@apple.com>
> 
>         Use CheckedArithmetic for length computation in JSArray::unshiftCountWithAnyIndexingType
>diff --git a/Source/JavaScriptCore/dfg/DFGStrengthReductionPhase.cpp b/Source/JavaScriptCore/dfg/DFGStrengthReductionPhase.cpp
>index 91ee1c3..f1ecead 100644
>--- a/Source/JavaScriptCore/dfg/DFGStrengthReductionPhase.cpp
>+++ b/Source/JavaScriptCore/dfg/DFGStrengthReductionPhase.cpp
>@@ -361,7 +361,10 @@ private:
>                 StringBuilder builder;
>                 builder.append(leftString);
>                 builder.append(rightString);
>-                convertToLazyJSValue(m_node, LazyJSValue::newString(m_graph, builder.toString()));
>+                if (auto string = builder.toString())
>+                    convertToLazyJSValue(m_node, LazyJSValue::newString(m_graph, *string));
>+                else
>+                    CRASH();
>                 m_changed = true;
>             }
>             break;
>@@ -387,8 +390,10 @@ private:
>             builder.append(rightString);
>             if (!!extraString)
>                 builder.append(extraString);
>-
>-            convertToLazyJSValue(m_node, LazyJSValue::newString(m_graph, builder.toString()));
>+            if (auto string = builder.toString())
>+                convertToLazyJSValue(m_node, LazyJSValue::newString(m_graph, *string));
>+            else
>+                CRASH();
>             m_changed = true;
>             break;
>         }
>@@ -884,8 +889,10 @@ private:
>             else {
>                 if (lastIndex < string.length())
>                     builder.append(string, lastIndex, string.length() - lastIndex);
>-                
>-                m_node->convertToLazyJSConstant(m_graph, LazyJSValue::newString(m_graph, builder.toString()));
>+                if (auto string = builder.toString())
>+                    m_node->convertToLazyJSConstant(m_graph, LazyJSValue::newString(m_graph, *string));
>+                else
>+                    CRASH();
>             }
> 
>             m_node->origin = origin;
>diff --git a/Source/JavaScriptCore/heap/HeapSnapshotBuilder.cpp b/Source/JavaScriptCore/heap/HeapSnapshotBuilder.cpp
>index 65f633f..e1aad1b 100644
>--- a/Source/JavaScriptCore/heap/HeapSnapshotBuilder.cpp
>+++ b/Source/JavaScriptCore/heap/HeapSnapshotBuilder.cpp
>@@ -387,7 +387,9 @@ String HeapSnapshotBuilder::json(std::function<bool (const HeapSnapshotNode&)> a
>     json.append(']');
> 
>     json.append('}');
>-    return json.toString();
>+    if (auto string = json.toString())
>+        return *string;
>+    CRASH();
> }
> 
> } // namespace JSC
>diff --git a/Source/JavaScriptCore/inspector/ConsoleMessage.cpp b/Source/JavaScriptCore/inspector/ConsoleMessage.cpp
>index 5cfb04d..71e4fc5 100644
>--- a/Source/JavaScriptCore/inspector/ConsoleMessage.cpp
>+++ b/Source/JavaScriptCore/inspector/ConsoleMessage.cpp
>@@ -115,7 +115,10 @@ ConsoleMessage::ConsoleMessage(MessageSource source, MessageType type, MessageLe
>             break;
>         case JSONLogValue::Type::JSON:
>             if (builder.length()) {
>-                m_jsonLogValues.append({ JSONLogValue::Type::String, JSON::Value::create(builder.toString())->toJSONString() });
>+                if (auto string = builder.toString())
>+                    m_jsonLogValues.append({ JSONLogValue::Type::String, JSON::Value::create(*string)->toJSONString() });
>+                else
>+                    CRASH();
>                 builder.resize(0);
>             }
> 
>@@ -124,8 +127,12 @@ ConsoleMessage::ConsoleMessage(MessageSource source, MessageType type, MessageLe
>         }
>     }
> 
>-    if (builder.length())
>-        m_jsonLogValues.append({ JSONLogValue::Type::String, JSON::Value::create(builder.toString())->toJSONString() });
>+    if (builder.length()) {
>+        if (auto string = builder.toString())
>+            m_jsonLogValues.append({ JSONLogValue::Type::String, JSON::Value::create(*string)->toJSONString() });
>+        else
>+            CRASH();
>+    }
> 
>     if (m_jsonLogValues.size())
>         m_message = m_jsonLogValues[0].value;
>diff --git a/Source/JavaScriptCore/inspector/ContentSearchUtilities.cpp b/Source/JavaScriptCore/inspector/ContentSearchUtilities.cpp
>index aaa81e2..b0c1944 100644
>--- a/Source/JavaScriptCore/inspector/ContentSearchUtilities.cpp
>+++ b/Source/JavaScriptCore/inspector/ContentSearchUtilities.cpp
>@@ -55,7 +55,9 @@ static String createSearchRegexSource(const String& text)
>         result.append(character);
>     }
> 
>-    return result.toString();
>+    if (auto string = result.toString())
>+        return *string;
>+    CRASH();
> }
> 
> static inline size_t sizetExtractor(const size_t* value)
>diff --git a/Source/JavaScriptCore/interpreter/Interpreter.cpp b/Source/JavaScriptCore/interpreter/Interpreter.cpp
>index 4f72709..ed17494 100644
>--- a/Source/JavaScriptCore/interpreter/Interpreter.cpp
>+++ b/Source/JavaScriptCore/interpreter/Interpreter.cpp
>@@ -577,7 +577,9 @@ JSString* Interpreter::stackTraceAsString(VM& vm, const Vector<StackFrame>& stac
>         if (i != stackTrace.size() - 1)
>             builder.append('\n');
>     }
>-    return jsString(&vm, builder.toString());
>+    if (auto string = builder.toString())
>+        return jsString(&vm, *string);
>+    CRASH();
> }
> 
> ALWAYS_INLINE static HandlerInfo* findExceptionHandler(StackVisitor& visitor, CodeBlock* codeBlock, RequiredHandler requiredHandler)
>diff --git a/Source/JavaScriptCore/interpreter/StackVisitor.cpp b/Source/JavaScriptCore/interpreter/StackVisitor.cpp
>index 1d1ff73..70cd117 100644
>--- a/Source/JavaScriptCore/interpreter/StackVisitor.cpp
>+++ b/Source/JavaScriptCore/interpreter/StackVisitor.cpp
>@@ -347,7 +347,9 @@ String StackVisitor::Frame::toString() const
>             traceBuild.appendNumber(column);
>         }
>     }
>-    return traceBuild.toString().impl();
>+    if (auto string = traceBuild.toString())
>+        return string->impl();
>+    CRASH();
> }
> 
> intptr_t StackVisitor::Frame::sourceID()
>diff --git a/Source/JavaScriptCore/jsc.cpp b/Source/JavaScriptCore/jsc.cpp
>index 3b17248..be93951 100644
>--- a/Source/JavaScriptCore/jsc.cpp
>+++ b/Source/JavaScriptCore/jsc.cpp
>@@ -767,7 +767,9 @@ static String resolvePath(const DirectoryName& directoryName, const ModuleName&
>         if (i + 1 != directoryPieces.size())
>             builder.append(pathSeparator());
>     }
>-    return builder.toString();
>+    if (auto string = builder.toString())
>+        return *string;
>+    CRASH();
> }
> 
> static String absolutePath(const String& fileName)
>@@ -1127,8 +1129,11 @@ EncodedJSValue JSC_HOST_CALL functionJSCStack(ExecState* exec)
> 
>     FunctionJSCStackFunctor functor(trace);
>     exec->iterate(functor);
>-    fprintf(stderr, "%s", trace.toString().utf8().data());
>-    return JSValue::encode(jsUndefined());
>+    if (auto string = trace.toString()) {
>+        fprintf(stderr, "%s", string->utf8().data());
>+        return JSValue::encode(jsUndefined());
>+    }
>+    CRASH();
> }
> 
> EncodedJSValue JSC_HOST_CALL functionGCAndSweep(ExecState* exec)
>diff --git a/Source/JavaScriptCore/runtime/ConfigFile.cpp b/Source/JavaScriptCore/runtime/ConfigFile.cpp
>index bb87666..f7ecdaa 100644
>--- a/Source/JavaScriptCore/runtime/ConfigFile.cpp
>+++ b/Source/JavaScriptCore/runtime/ConfigFile.cpp
>@@ -465,9 +465,12 @@ void ConfigFile::parse()
>             WTF::setDataFile(logPathname);
> 
>         if (!jscOptionsBuilder.isEmpty()) {
>-            const char* optionsStr = jscOptionsBuilder.toString().utf8().data();
>-            Options::enableRestrictedOptions(true);
>-            Options::setOptions(optionsStr);
>+            if (auto string = jscOptionsBuilder.toString()) {
>+                const char* optionsStr = string->utf8().data();
>+                Options::enableRestrictedOptions(true);
>+                Options::setOptions(optionsStr);
>+            } else
>+                CRASH();
>         }
>     } else
>         WTF::dataLogF("Error in JSC Config file on or near line %u, parsing '%s'\n", scanner.lineNumber(), scanner.currentBuffer());
>diff --git a/Source/JavaScriptCore/runtime/ConsoleClient.cpp b/Source/JavaScriptCore/runtime/ConsoleClient.cpp
>index 2917d768..b86643b 100644
>--- a/Source/JavaScriptCore/runtime/ConsoleClient.cpp
>+++ b/Source/JavaScriptCore/runtime/ConsoleClient.cpp
>@@ -144,7 +144,10 @@ void ConsoleClient::printConsoleMessage(MessageSource source, MessageType type,
>     builder.append(' ');
>     builder.append(message);
> 
>-    WTFLogAlways("%s", builder.toString().utf8().data());
>+    if (auto string = builder.toString())
>+        WTFLogAlways("%s", string->utf8().data());
>+    else
>+        CRASH();
> }
> 
> void ConsoleClient::printConsoleMessageWithArguments(MessageSource source, MessageType type, MessageLevel level, JSC::ExecState* exec, Ref<ScriptArguments>&& arguments)
>@@ -170,7 +173,10 @@ void ConsoleClient::printConsoleMessageWithArguments(MessageSource source, Messa
>         scope.clearException();
>     }
> 
>-    WTFLogAlways("%s", builder.toString().utf8().data());
>+    if (auto string = builder.toString())
>+        WTFLogAlways("%s", string->utf8().data());
>+    else
>+        CRASH();
> 
>     if (isTraceMessage) {
>         for (size_t i = 0; i < callStack->size(); ++i) {
>@@ -187,7 +193,10 @@ void ConsoleClient::printConsoleMessageWithArguments(MessageSource source, Messa
>             appendURLAndPosition(callFrameBuilder, callFrame.sourceURL(), callFrame.lineNumber(), callFrame.columnNumber());
>             callFrameBuilder.append(')');
> 
>-            WTFLogAlways("%s", callFrameBuilder.toString().utf8().data());
>+            if (auto string = callFrameBuilder.toString())
>+                WTFLogAlways("%s", string->utf8().data());
>+            else
>+                CRASH();
>         }
>     }
> }
>diff --git a/Source/JavaScriptCore/runtime/DateConversion.cpp b/Source/JavaScriptCore/runtime/DateConversion.cpp
>index 8a87cc6..423be24 100644
>--- a/Source/JavaScriptCore/runtime/DateConversion.cpp
>+++ b/Source/JavaScriptCore/runtime/DateConversion.cpp
>@@ -123,7 +123,9 @@ String formatDateTime(const GregorianDateTime& t, DateTimeFormat format, bool as
>         }
>     }
> 
>-    return builder.toString().impl();
>+    if (auto string = builder.toString())
>+        return string->impl();
>+    CRASH();
> }
> 
> } // namespace JSC
>diff --git a/Source/JavaScriptCore/runtime/ErrorInstance.cpp b/Source/JavaScriptCore/runtime/ErrorInstance.cpp
>index c172428..78d2997 100644
>--- a/Source/JavaScriptCore/runtime/ErrorInstance.cpp
>+++ b/Source/JavaScriptCore/runtime/ErrorInstance.cpp
>@@ -199,7 +199,9 @@ String ErrorInstance::sanitizedToString(ExecState* exec)
>     builder.append(nameString);
>     builder.appendLiteral(": ");
>     builder.append(messageString);
>-    return builder.toString();
>+    if (auto string = builder.toString())
>+        return *string;
>+    CRASH();
> }
> 
> bool ErrorInstance::materializeErrorInfoIfNeeded(VM& vm)
>diff --git a/Source/JavaScriptCore/runtime/ExceptionHelpers.cpp b/Source/JavaScriptCore/runtime/ExceptionHelpers.cpp
>index 699144b..6e01b9d 100644
>--- a/Source/JavaScriptCore/runtime/ExceptionHelpers.cpp
>+++ b/Source/JavaScriptCore/runtime/ExceptionHelpers.cpp
>@@ -211,7 +211,9 @@ static String notAFunctionSourceAppender(const String& originalMessage, const St
>     }
>     builder.append(')');
> 
>-    return builder.toString();
>+    if (auto string = builder.toString())
>+        return *string;
>+    CRASH();
> }
> 
> static String invalidParameterInSourceAppender(const String& originalMessage, const String& sourceText, RuntimeType type, ErrorInstance::SourceTextWhereErrorOccurred occurrence)
>diff --git a/Source/JavaScriptCore/runtime/FunctionConstructor.cpp b/Source/JavaScriptCore/runtime/FunctionConstructor.cpp
>index 1b72af5..aabff69 100644
>--- a/Source/JavaScriptCore/runtime/FunctionConstructor.cpp
>+++ b/Source/JavaScriptCore/runtime/FunctionConstructor.cpp
>@@ -125,22 +125,22 @@ JSObject* constructFunctionSkippingEvalEnabledCheck(
>         program = makeString("{", prefix, functionName.string(), "() {\n", body, "\n}}");
>     } else {
>         StringBuilder builder;
>-        bool success = true;
>-        success &= builder.tryAppend('{');
>-        success &= builder.tryAppend(prefix);
>-        success &= builder.tryAppend(functionName.string());
>-        success &= builder.tryAppend('(');
>+        builder.append('{');
>+        builder.append(prefix);
>+        builder.append(functionName.string());
>+        builder.append('(');
>         StringBuilder parameterBuilder;
>         auto viewWithString = args.at(0).toString(exec)->viewWithUnderlyingString(exec);
>         RETURN_IF_EXCEPTION(scope, nullptr);
>-        success &= parameterBuilder.tryAppend(viewWithString.view);
>+        parameterBuilder.append(viewWithString.view);
>         for (size_t i = 1; i < args.size() - 1; i++) {
>-            success &= parameterBuilder.tryAppendLiteral(", ");
>+            parameterBuilder.appendLiteral(", ");
>             auto viewWithString = args.at(i).toString(exec)->viewWithUnderlyingString(exec);
>             RETURN_IF_EXCEPTION(scope, nullptr);
>-            success &= parameterBuilder.tryAppend(viewWithString.view);
>+            parameterBuilder.append(viewWithString.view);
>         }
>-        if (!success) {
>+
>+        if (builder.failed() || parameterBuilder.failed()) {
>             throwOutOfMemoryError(exec, scope);
>             return nullptr;
>         }
>@@ -148,7 +148,8 @@ JSObject* constructFunctionSkippingEvalEnabledCheck(
>         {
>             // The spec mandates that the parameters parse as a valid parameter list
>             // independent of the function body.
>-            String program = makeString("(", prefix, "(", parameterBuilder.toString(), "){\n\n})");
>+            auto string = parameterBuilder.toString().value();
>+            String program = makeString("(", prefix, "(", string, "){\n\n})");
>             SourceCode source = makeSource(program, sourceOrigin, sourceURL, position);
>             JSValue exception;
>             checkSyntax(exec, source, &exception);
>@@ -158,19 +159,20 @@ JSObject* constructFunctionSkippingEvalEnabledCheck(
>             }
>         }
> 
>-        success &= builder.tryAppend(parameterBuilder);
>-        success &= builder.tryAppendLiteral(") {\n");
>+        builder.append(parameterBuilder);
>+        builder.appendLiteral(") {\n");
>         auto body = args.at(args.size() - 1).toWTFString(exec);
>         RETURN_IF_EXCEPTION(scope, nullptr);
>         checkBody(body);
>         RETURN_IF_EXCEPTION(scope, nullptr);
>-        success &= builder.tryAppend(body);
>-        success &= builder.tryAppendLiteral("\n}}");
>-        if (!success) {
>+        builder.append(body);
>+        builder.appendLiteral("\n}}");
>+        if (auto string = builder.toString())
>+            program = *string;
>+        else {
>             throwOutOfMemoryError(exec, scope);
>             return nullptr;
>         }
>-        program = builder.toString();
>     }
> 
>     SourceCode source = makeSource(program, sourceOrigin, sourceURL, position);
>diff --git a/Source/JavaScriptCore/runtime/IntlDateTimeFormat.cpp b/Source/JavaScriptCore/runtime/IntlDateTimeFormat.cpp
>index c920acf..2c2f045 100644
>--- a/Source/JavaScriptCore/runtime/IntlDateTimeFormat.cpp
>+++ b/Source/JavaScriptCore/runtime/IntlDateTimeFormat.cpp
>@@ -646,7 +646,11 @@ void IntlDateTimeFormat::initializeDateTimeFormat(ExecState& exec, JSValue local
>         return;
>     }
> 
>-    String skeleton = skeletonBuilder.toString();
>+    String skeleton;
>+    if (auto string = skeletonBuilder.toString())
>+        skeleton = *string;
>+    else
>+        CRASH();
>     StringView skeletonView(skeleton);
>     Vector<UChar, 32> patternBuffer(32);
>     status = U_ZERO_ERROR;
>diff --git a/Source/JavaScriptCore/runtime/IntlObject.cpp b/Source/JavaScriptCore/runtime/IntlObject.cpp
>index 4a7f6de..f6978db 100644
>--- a/Source/JavaScriptCore/runtime/IntlObject.cpp
>+++ b/Source/JavaScriptCore/runtime/IntlObject.cpp
>@@ -258,7 +258,9 @@ static String privateUseLangTag(const Vector<String>& parts, size_t startIndex)
>     if (currentIndex < numParts)
>         return String();
> 
>-    return privateuse.toString();
>+    if (auto string = privateuse.toString())
>+        return *string;
>+    CRASH();
> }
> 
> static String canonicalLangTag(const Vector<String>& parts)
>@@ -391,7 +393,10 @@ static String canonicalLangTag(const Vector<String>& parts)
>         if (!numExtParts)
>             return String();
> 
>-        extensions.append(extension.toString());
>+        if (auto string = extension.toString())
>+            extensions.append(*string);
>+        else
>+            CRASH();
>     }
> 
>     // Add extensions to canonical sorted by singleton.
>@@ -419,7 +424,9 @@ static String canonicalLangTag(const Vector<String>& parts)
> 
>     // FIXME: Replace subtags with their preferred values.
> 
>-    return canonical.toString();
>+    if (auto string = canonical.toString())
>+        return *string;
>+    CRASH();
> }
> 
> static String grandfatheredLangTag(const String& locale)
>@@ -624,7 +631,10 @@ String removeUnicodeLocaleExtension(const String& locale)
>             builder.append(parts[p]);
>         }
>     }
>-    return builder.toString();
>+
>+    if (auto string = builder.toString())
>+        return *string;
>+    CRASH();
> }
> 
> static MatcherResult lookupMatcher(ExecState& state, const HashSet<String>& availableLocales, const Vector<String>& requestedLocales)
>diff --git a/Source/JavaScriptCore/runtime/JSGlobalObjectFunctions.cpp b/Source/JavaScriptCore/runtime/JSGlobalObjectFunctions.cpp
>index 7313673..19b52ad 100644
>--- a/Source/JavaScriptCore/runtime/JSGlobalObjectFunctions.cpp
>+++ b/Source/JavaScriptCore/runtime/JSGlobalObjectFunctions.cpp
>@@ -151,7 +151,9 @@ static JSValue encode(ExecState* exec, const Bitmap<256>& doNotEscape, const Cha
>         }
>     }
> 
>-    return jsString(exec, builder.toString());
>+    if (auto string = builder.toString())
>+        return jsString(exec, *string);
>+    CRASH();
> }
> 
> static JSValue encode(ExecState* exec, const Bitmap<256>& doNotEscape)
>@@ -230,7 +232,10 @@ static JSValue decode(ExecState* exec, const CharType* characters, int length, c
>         builder.append(c);
>     }
>     scope.release();
>-    return jsString(&vm, builder.toString());
>+
>+    if (auto string = builder.toString())
>+        return jsString(&vm, *string);
>+    CRASH();
> }
> 
> static JSValue decode(ExecState* exec, const Bitmap<256>& doNotUnescape, bool strict)
>@@ -603,7 +608,9 @@ EncodedJSValue JSC_HOST_CALL globalFuncEscape(ExecState* exec)
>                     appendByteAsHex(static_cast<LChar>(u), builder);
>                 }
>             }
>-            return jsString(exec, builder.toString());
>+            if (auto string = builder.toString())
>+                return jsString(exec, *string);
>+            CRASH();
>         }
> 
>         const UChar* c = view.characters16();
>@@ -622,7 +629,9 @@ EncodedJSValue JSC_HOST_CALL globalFuncEscape(ExecState* exec)
>             }
>         }
> 
>-        return jsString(exec, builder.toString());
>+        if (auto string = builder.toString())
>+            return jsString(exec, *string);
>+        CRASH();
>     }));
> }
> 
>@@ -678,7 +687,9 @@ EncodedJSValue JSC_HOST_CALL globalFuncUnescape(ExecState* exec)
>             }
>         }
> 
>-        return jsString(exec, builder.toString());
>+        if (auto string = builder.toString())
>+            return jsString(exec, *string);
>+        CRASH();
>     }));
> }
> 
>diff --git a/Source/JavaScriptCore/runtime/JSONObject.cpp b/Source/JavaScriptCore/runtime/JSONObject.cpp
>index 7e9b3d6a..d7c06dd 100644
>--- a/Source/JavaScriptCore/runtime/JSONObject.cpp
>+++ b/Source/JavaScriptCore/runtime/JSONObject.cpp
>@@ -278,7 +278,9 @@ JSValue Stringifier::stringify(JSValue value)
>         return jsUndefined();
> 
>     scope.release();
>-    return jsString(m_exec, result.toString());
>+    if (auto string = result.toString())
>+        return jsString(m_exec, *string);
>+    CRASH();
> }
> 
> ALWAYS_INLINE JSValue Stringifier::toJSON(JSValue value, const PropertyNameForFunctionCall& propertyName)
>@@ -357,7 +359,7 @@ Stringifier::StringifyResult Stringifier::appendStringifiedValue(StringBuilder&
>     if (value.isString()) {
>         const String& string = asString(value)->value(m_exec);
>         RETURN_IF_EXCEPTION(scope, StringifyFailed);
>-        if (builder.tryAppendQuotedJSONString(string))
>+        if (builder.appendQuotedJSONString(string))
>             return StringifySucceeded;
>         throwOutOfMemoryError(m_exec, scope);
>         return StringifyFailed;
>@@ -504,8 +506,12 @@ bool Stringifier::Holder::appendNextProperty(Stringifier& stringifier, StringBui
>     // Last time through, finish up and return false.
>     if (m_index == m_size) {
>         stringifier.unindent();
>-        if (m_size && builder[builder.length() - 1] != '{')
>-            stringifier.startNewLine(builder);
>+        if (m_size) {
>+            if (builder.failed())
>+                CRASH();
>+            if (*builder[builder.length() - 1] != '{')
>+                stringifier.startNewLine(builder);
>+        }
>         builder.append(m_isArray ? ']' : '}');
>         return false;
>     }
>@@ -548,7 +554,9 @@ bool Stringifier::Holder::appendNextProperty(Stringifier& stringifier, StringBui
>         rollBackPoint = builder.length();
> 
>         // Append the separator string.
>-        if (builder[rollBackPoint - 1] != '{')
>+        if (builder.failed())
>+            CRASH();
>+        if (*builder[rollBackPoint - 1] != '{')
>             builder.append(',');
>         stringifier.startNewLine(builder);
> 
>diff --git a/Source/JavaScriptCore/runtime/LiteralParser.cpp b/Source/JavaScriptCore/runtime/LiteralParser.cpp
>index f00fe07..b86868a 100644
>--- a/Source/JavaScriptCore/runtime/LiteralParser.cpp
>+++ b/Source/JavaScriptCore/runtime/LiteralParser.cpp
>@@ -466,10 +466,16 @@ slowPathBegin:
>     } else {
>         if (m_builder.is8Bit()) {
>             token.stringIs8Bit = 1;
>-            token.stringToken8 = m_builder.characters8();
>+            if (auto chars = m_builder.characters8())
>+                token.stringToken8 = *chars;
>+            else
>+                CRASH();
>         } else {
>             token.stringIs8Bit = 0;
>-            token.stringToken16 = m_builder.characters16();
>+            if (auto chars = m_builder.characters16())
>+                token.stringToken16 = *chars;
>+            else
>+                CRASH();
>         }
>         token.stringLength = m_builder.length();
>     }
>diff --git a/Source/JavaScriptCore/runtime/Options.cpp b/Source/JavaScriptCore/runtime/Options.cpp
>index df98220..5b4dc15 100644
>--- a/Source/JavaScriptCore/runtime/Options.cpp
>+++ b/Source/JavaScriptCore/runtime/Options.cpp
>@@ -595,7 +595,10 @@ void Options::dumpOptionsIfNeeded()
> 
>         StringBuilder builder;
>         dumpAllOptions(builder, level, title, nullptr, "   ", "\n", DumpDefaults);
>-        dataLog(builder.toString());
>+        if (auto string = builder.toString())
>+            dataLog(*string);
>+        else
>+            CRASH();
>     }
> }
> 
>@@ -804,7 +807,10 @@ void Options::dumpAllOptions(FILE* stream, DumpLevel level, const char* title)
> {
>     StringBuilder builder;
>     dumpAllOptions(builder, level, title, nullptr, "   ", "\n", DumpDefaults);
>-    fprintf(stream, "%s", builder.toString().utf8().data());
>+    if (auto string = builder.toString())
>+        fprintf(stream, "%s", string->utf8().data());
>+    else
>+        CRASH();
> }
> 
> void Options::dumpOption(StringBuilder& builder, DumpLevel level, Options::ID id,
>diff --git a/Source/JavaScriptCore/runtime/RegExpPrototype.cpp b/Source/JavaScriptCore/runtime/RegExpPrototype.cpp
>index 7631047..8bdd2d3 100644
>--- a/Source/JavaScriptCore/runtime/RegExpPrototype.cpp
>+++ b/Source/JavaScriptCore/runtime/RegExpPrototype.cpp
>@@ -467,7 +467,9 @@ static inline JSValue regExpProtoGetterSourceInternal(ExecState* exec, const Str
>             previousCharacterWasBackslash = ch == '\\';
>     }
> 
>-    return jsString(exec, result.toString());
>+    if (auto string = result.toString())
>+        return jsString(exec, *string);
>+    CRASH();
> }
> 
> EncodedJSValue JSC_HOST_CALL regExpProtoGetterSource(ExecState* exec)
>diff --git a/Source/JavaScriptCore/runtime/SamplingProfiler.cpp b/Source/JavaScriptCore/runtime/SamplingProfiler.cpp
>index 592af41..f08c4fe 100644
>--- a/Source/JavaScriptCore/runtime/SamplingProfiler.cpp
>+++ b/Source/JavaScriptCore/runtime/SamplingProfiler.cpp
>@@ -904,7 +904,9 @@ String SamplingProfiler::stackTracesAsJSON()
> 
>     clearData(locker);
> 
>-    return json.toString();
>+    if (auto string = json.toString())
>+        return *string;
>+    CRASH();
> }
> 
> void SamplingProfiler::registerForReportAtExit()
>diff --git a/Source/JavaScriptCore/runtime/StackFrame.cpp b/Source/JavaScriptCore/runtime/StackFrame.cpp
>index 9f2d60d..48a22b0 100644
>--- a/Source/JavaScriptCore/runtime/StackFrame.cpp
>+++ b/Source/JavaScriptCore/runtime/StackFrame.cpp
>@@ -139,7 +139,9 @@ String StackFrame::toString(VM& vm) const
>             traceBuild.appendNumber(column);
>         }
>     }
>-    return traceBuild.toString().impl();
>+    if (auto string = traceBuild.toString())
>+        return string->impl();
>+    CRASH();
> }
> 
> void StackFrame::visitChildren(SlotVisitor& visitor)
>diff --git a/Source/JavaScriptCore/runtime/StringConstructor.cpp b/Source/JavaScriptCore/runtime/StringConstructor.cpp
>index 0b10d8f..5ed2ead 100644
>--- a/Source/JavaScriptCore/runtime/StringConstructor.cpp
>+++ b/Source/JavaScriptCore/runtime/StringConstructor.cpp
>@@ -125,7 +125,9 @@ static EncodedJSValue JSC_HOST_CALL stringFromCodePoint(ExecState* exec)
>     }
> 
>     scope.release();
>-    return JSValue::encode(jsString(exec, builder.toString()));
>+    if (auto string = builder.toString())
>+        return JSValue::encode(jsString(exec, *string));
>+    CRASH();
> }
> 
> static EncodedJSValue JSC_HOST_CALL constructWithStringConstructor(ExecState* exec)
>diff --git a/Source/JavaScriptCore/runtime/StringPrototype.cpp b/Source/JavaScriptCore/runtime/StringPrototype.cpp
>index a0d3601..58ccd57 100644
>--- a/Source/JavaScriptCore/runtime/StringPrototype.cpp
>+++ b/Source/JavaScriptCore/runtime/StringPrototype.cpp
>@@ -280,7 +280,9 @@ static NEVER_INLINE String substituteBackreferencesSlow(StringView replacement,
>     if (replacement.length() - offset)
>         substitutedReplacement.append(replacement.substring(offset));
> 
>-    return substitutedReplacement.toString();
>+    if (auto string = substitutedReplacement.toString())
>+        return *string;
>+    CRASH();
> }
> 
> inline String substituteBackreferencesInline(const String& replacement, StringView source, const int* ovector, RegExp* reg)
>diff --git a/Source/JavaScriptCore/runtime/TypeProfiler.cpp b/Source/JavaScriptCore/runtime/TypeProfiler.cpp
>index 0f85ef8..7ae9745 100644
>--- a/Source/JavaScriptCore/runtime/TypeProfiler.cpp
>+++ b/Source/JavaScriptCore/runtime/TypeProfiler.cpp
>@@ -104,8 +104,10 @@ String TypeProfiler::typeInformationForExpressionAtOffset(TypeProfilerSearchDesc
>         json.appendLiteral("false");
> 
>     json.append('}');
>-    
>-    return json.toString();
>+
>+    if (auto string = json.toString())
>+        return *string;
>+    CRASH();
> }
> 
> TypeLocation* TypeProfiler::findLocation(unsigned divot, intptr_t sourceID, TypeProfilerSearchDescriptor descriptor, VM& vm)
>diff --git a/Source/JavaScriptCore/runtime/TypeSet.cpp b/Source/JavaScriptCore/runtime/TypeSet.cpp
>index 7a412e6..c3a05c7 100644
>--- a/Source/JavaScriptCore/runtime/TypeSet.cpp
>+++ b/Source/JavaScriptCore/runtime/TypeSet.cpp
>@@ -131,7 +131,9 @@ String TypeSet::dumpTypes() const
>         seen.append(leastCommonAncestor());
>     }
> 
>-    return seen.toString();
>+    if (auto string = seen.toString())
>+        return *string;
>+    CRASH();
> }
> 
> bool TypeSet::doesTypeConformTo(RuntimeTypeMask test) const
>@@ -317,7 +319,9 @@ String TypeSet::toJSONString() const
>     json.append(']');
> 
>     json.append('}');
>-    return json.toString();
>+    if (auto string = json.toString())
>+        return *string;
>+    CRASH();
> }
> 
> StructureShape::StructureShape()
>@@ -362,8 +366,11 @@ String StructureShape::propertyHash()
>         builder.append(m_proto->propertyHash());
>     }
> 
>-    m_propertyHash = std::make_unique<String>(builder.toString());
>-    return *m_propertyHash;
>+    if (auto string = builder.toString()) {
>+        m_propertyHash = std::make_unique<String>(*string);
>+        return *m_propertyHash;
>+    }
>+    CRASH();
> }
> 
> String StructureShape::leastCommonAncestor(const Vector<Ref<StructureShape>>& shapes)
>@@ -427,7 +434,9 @@ String StructureShape::stringRepresentation()
> 
>     representation.append('}');
> 
>-    return representation.toString();
>+    if (auto string = representation.toString())
>+        return *string;
>+    CRASH();
> }
> 
> String StructureShape::toJSONString() const
>@@ -494,7 +503,9 @@ String StructureShape::toJSONString() const
> 
>     json.append('}');
> 
>-    return json.toString();
>+    if (auto string = json.toString())
>+        return *string;
>+    CRASH();
> }
> 
> Ref<Inspector::Protocol::Runtime::StructureDescription> StructureShape::inspectorRepresentation()
>diff --git a/Source/JavaScriptCore/testRegExp.cpp b/Source/JavaScriptCore/testRegExp.cpp
>index e6cdd50..c4d8ded 100644
>--- a/Source/JavaScriptCore/testRegExp.cpp
>+++ b/Source/JavaScriptCore/testRegExp.cpp
>@@ -329,12 +329,15 @@ static RegExp* parseRegExpLine(VM& vm, char* line, int lineLength, const char**
> 
>     ++i;
> 
>-    RegExp* r = RegExp::create(vm, pattern.toString(), regExpFlags(line + i));
>-    if (!r->isValid()) {
>-        *regexpError = r->errorMessage();
>-        return nullptr;
>+    if (auto string = pattern.toString()) {
>+        RegExp* r = RegExp::create(vm, *string, regExpFlags(line + i));
>+        if (!r->isValid()) {
>+            *regexpError = r->errorMessage();
>+            return nullptr;
>+        }
>+        return r;
>     }
>-    return r;
>+    CRASH();
> }
> 
> static RegExpTest* parseTestLine(char* line, int lineLength)
>@@ -377,8 +380,11 @@ static RegExpTest* parseTestLine(char* line, int lineLength)
>     int start, end;
>     
>     RegExpTest* result = new RegExpTest();
>-    
>-    result->subject = subjectString.toString();
>+
>+    if (auto string = subjectString.toString())
>+        result->subject = *string;
>+    else
>+        CRASH();
>     result->offset = offset;
>     result->result = matchResult;
> 
>diff --git a/Source/JavaScriptCore/tools/FunctionOverrides.cpp b/Source/JavaScriptCore/tools/FunctionOverrides.cpp
>index e83b6ee..4ac27c5 100644
>--- a/Source/JavaScriptCore/tools/FunctionOverrides.cpp
>+++ b/Source/JavaScriptCore/tools/FunctionOverrides.cpp
>@@ -218,13 +218,18 @@ static String parseClause(const char* keyword, size_t keywordLength, FILE* file,
>                 FAIL_WITH_ERROR(SYNTAX_ERROR, ("Unexpected characters after '", keyword, "' clause end delimiter '", delimiter, "':\n", line, "\n"));
> 
>             builder.append(line, p - line + 1);
>-            return builder.toString();
>+            if (auto string = builder.toString())
>+                return *string;
>+            CRASH();
>         }
>         builder.append(line);
> 
>     } while ((line = fgets(buffer, bufferSize, file)));
> 
>-    FAIL_WITH_ERROR(SYNTAX_ERROR, ("'", keyword, "' clause end delimiter '", delimiter, "' not found:\n", builder.toString(), "\n", "Are you missing a '}' before the delimiter?\n"));
>+    if (auto string = builder.toString())
>+        FAIL_WITH_ERROR(SYNTAX_ERROR, ("'", keyword, "' clause end delimiter '", delimiter, "' not found:\n", *string, "\n", "Are you missing a '}' before the delimiter?\n"));
>+    else
>+        CRASH();
> }
> 
> void FunctionOverrides::parseOverridesInFile(const char* fileName)
>diff --git a/Source/JavaScriptCore/wasm/WasmBBQPlan.cpp b/Source/JavaScriptCore/wasm/WasmBBQPlan.cpp
>index a7820c9..fa00341 100644
>--- a/Source/JavaScriptCore/wasm/WasmBBQPlan.cpp
>+++ b/Source/JavaScriptCore/wasm/WasmBBQPlan.cpp
>@@ -150,8 +150,11 @@ void BBQPlan::prepare()
>             builder.appendLiteral("Failed allocating enough space for ");
>             builder.appendNumber(size);
>             builder.append(what);
>-            fail(holdLock(m_lock), builder.toString());
>-            return false;
>+            if (auto string = builder.toString()) {
>+                fail(holdLock(m_lock), WTFMove(*string));
>+                return false;
>+            }
>+            CRASH();
>         }
>         return true;
>     };
>diff --git a/Source/JavaScriptCore/yarr/YarrParser.h b/Source/JavaScriptCore/yarr/YarrParser.h
>index f16f11f..8b758ec 100644
>--- a/Source/JavaScriptCore/yarr/YarrParser.h
>+++ b/Source/JavaScriptCore/yarr/YarrParser.h
>@@ -1031,8 +1031,11 @@ private:
> 
>             while (!atEndOfPattern()) {
>                 ch = tryConsumeIdentifierCharacter();
>-                if (ch == '>')
>-                    return std::optional<String>(identifierBuilder.toString());
>+                if (ch == '>') {
>+                    if (auto string = identifierBuilder.toString())
>+                        return std::optional<String>(*string);
>+                    CRASH();
>+                }
> 
>                 if (!isIdentifierPart(ch))
>                     break;
>@@ -1070,23 +1073,32 @@ private:
>                 }
> 
>                 if (foundEquals) {
>-                    auto result = unicodeMatchPropertyValue(unicodePropertyName, expressionBuilder.toString());
>+                    if (auto string = expressionBuilder.toString()) {
>+                        auto result = unicodeMatchPropertyValue(unicodePropertyName, *string);
>+                        if (!result)
>+                            m_errorCode = ErrorCode::InvalidUnicodePropertyExpression;
>+                        return result;
>+                    }
>+                    CRASH();
>+                }
>+
>+                if (auto string = expressionBuilder.toString()) {
>+                    auto result = unicodeMatchProperty(*string);
>                     if (!result)
>                         m_errorCode = ErrorCode::InvalidUnicodePropertyExpression;
>                     return result;
>                 }
>-
>-                auto result = unicodeMatchProperty(expressionBuilder.toString());
>-                if (!result)
>-                    m_errorCode = ErrorCode::InvalidUnicodePropertyExpression;
>-                return result;
>+                CRASH();
>             }
> 
>             consume();
>             if (ch == '=') {
>                 if (!foundEquals) {
>                     foundEquals = true;
>-                    unicodePropertyName = expressionBuilder.toString();
>+                    if (auto string = expressionBuilder.toString())
>+                        unicodePropertyName = *string;
>+                    else
>+                        CRASH();
>                     expressionBuilder.clear();
>                 } else
>                     errors++;
>diff --git a/Source/WTF/ChangeLog b/Source/WTF/ChangeLog
>index 881b164..8fe1552 100644
>--- a/Source/WTF/ChangeLog
>+++ b/Source/WTF/ChangeLog
>@@ -1,3 +1,146 @@
>+2018-04-26  JF Bastien  <jfbastien@apple.com>
>+
>+        StringBuilder is fallible
>+        https://bugs.webkit.org/show_bug.cgi?id=185048
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        StringBuilder can fail when allocating memory. StringBuilder is
>+        mostly used with user input, which often means that just crashing
>+        isn't the right outcome. Our fuzzers often encounter such things
>+        for JavaScriptCore, and so far we've applied point solutions. No
>+        more! This patch makes StringBuilder fallible and enforces this in
>+        two ways:
>+
>+          - Each step of building a string can be checked for failure
>+            because they now return a "Fallible<T>". This can be ignored at
>+            every step!
>+          - The final step of StringBuilder, getting the string out,
>+            returns a "Fallible<String>" which is marked with
>+            WARN_UNUSED_RETURN. Failure is communicated if any of the building
>+            steps failed.
>+
>+        Doing this two-step approach means that code can continue
>+        operating as it did before (append a bunch and then get a string)
>+        and only needs to care about the string potentially not being
>+        available. This is enforced by the type system: Fallible<T> is
>+        std::expected<T, StringBuilder::Failure>.
>+
>+        The following intermediate functions can now be observed to fail
>+        (or ignored):
>+
>+          - append
>+          - appendUninitialized
>+          - appendUninitializedSlow
>+          - appendQuotedJSONString used to return false on failure, it now returns Fallible<>
>+          - resize
>+          - allocateBuffer
>+          - allocateBufferUpConvert
>+          - reallocateBuffer
>+          - reserveCapacity
>+          - shrinkToFit
>+          - operator[]
>+          - characters8
>+          - characters16
>+
>+        Failure in these methods comes in two forms: out of memory, and
>+        would overflow. When an operation would overflow it leaves the
>+        StringBuilder in its previous state, allowing users to resume
>+        work, keep the string as it existed before failure. When we just
>+        fail allocating it means we expected to succeed, so clearing the
>+        StringBuilder is the right thing to do.
>+
>+        Supporting failure in StringBuilder required adding "try" variants
>+        of some methods in StringImpl.
>+
>+        This patch updates all WebKit code which uses StringBuilder. It
>+        leaves all intermediate function usage alone (code still appends
>+        back-to-back, blissfully unaware of failure), and only checks for
>+        failure when retrieving the string. The pattern used is usually:
>+
>+          if (auto string = builder.toString())
>+            foo(*string); // Use string as before...
>+          else
>+            CRASH();
>+
>+        This makes failure extremely explicit. There's no true behavior
>+        change: what would have crashed when appending now crashes when
>+        retrieving the string. Pulling CRASH() out will give slightly
>+        better crash signatures, and it makes the code very obvious about
>+        failure. I purposefully don't "fix" any failure because these
>+        should be done in a targeted manner with repro tests whenever
>+        possible. I'm very wary of introducing bugs!
>+
>+        When someone inevitably blames code back to this commit (because
>+        hey the code is pretty ugly, and you might be surprised at seeing
>+        CRASH() in your beautiful code) there are a few things which they
>+        can do:
>+
>+          1. Change the else clause to handle failure rather than crash. In JavaScriptCore that's usually throwOutOfMemoryError.
>+          2. Change the code to directly use Fallible's .value() member, and let *that* crash instead. This makes the crash non-obvious in the code, which might be what you want.
>+          3. Change the code to detect failure at the earliest step of string building (likely the append calls), and do something sensible there.
>+
>+        In no circumstance should code just dereference a Fallible without
>+        knowing that its state holds a valid string. This code is
>+        undefined behavior according to the std::expected specification
>+        (whether our implementation should do something else is out of
>+        scope for this patch):
>+
>+          foo(*builder.toString()); // UB when allocation fails.
>+
>+        * wtf/Assertions.cpp:
>+        * wtf/DateMath.cpp:
>+        (WTF::makeRFC2822DateString):
>+        * wtf/JSONValues.cpp:
>+        (WTF::JSONImpl::Value::toJSONString const):
>+        * wtf/Logger.h:
>+        (WTF::LogArgument::toString):
>+        (WTF::LogArgument<Logger::LogSiteIdentifier>::toString):
>+        * wtf/MediaTime.cpp:
>+        (WTF::MediaTime::toString const):
>+        * wtf/UUID.cpp:
>+        (WTF::createCanonicalUUIDString):
>+        * wtf/text/StringBuilder.cpp:
>+        (WTF::StringBuilder::wouldOverflow):
>+        (WTF::StringBuilder::outOfMemory):
>+        (WTF::StringBuilder::resize):
>+        (WTF::StringBuilder::allocateBuffer):
>+        (WTF::StringBuilder::allocateBufferUpConvert):
>+        (WTF::StringBuilder::reallocateBuffer<LChar>):
>+        (WTF::StringBuilder::reallocateBuffer<UChar>):
>+        (WTF::StringBuilder::reserveCapacity):
>+        (WTF::StringBuilder::append):
>+        (WTF::StringBuilder::appendNumber):
>+        (WTF::StringBuilder::appendECMAScriptNumber):
>+        (WTF::StringBuilder::appendFixedWidthNumber):
>+        (WTF::StringBuilder::shrinkToFit):
>+        * wtf/text/StringBuilder.h:
>+        (WTF::StringBuilder::StringBuilder):
>+        (WTF::StringBuilder::append):
>+        (WTF::StringBuilder::appendLiteral):
>+        (WTF::StringBuilder::toString):
>+        (WTF::StringBuilder::toStringPreserveCapacity const):
>+        (WTF::StringBuilder::toAtomicString const):
>+        (WTF::StringBuilder::is8Bit const):
>+        (WTF::StringBuilder::failed const):
>+        (WTF::StringBuilder::operator[] const):
>+        (WTF::StringBuilder:: const):
>+        (WTF::StringBuilder::clear):
>+        (WTF::StringBuilder::swap):
>+        (WTF::equal):
>+        (WTF::IntegerToStringConversionTrait<StringBuilder>::flush):
>+        * wtf/text/StringBuilderJSON.cpp:
>+        (WTF::StringBuilder::appendQuotedJSONString):
>+        * wtf/text/StringImpl.cpp:
>+        (WTF::StringImpl::reallocateInternal):
>+        (WTF::StringImpl::reallocate):
>+        (WTF::StringImpl::tryReallocate):
>+        * wtf/text/StringImpl.h:
>+        (WTF::StringImpl::tryCreateSubstringSharingImpl):
>+        (WTF::StringImpl::createSubstringSharingImpl):
>+        * wtf/text/TextStream.cpp:
>+        (WTF::TextStream::release):
>+
> 2018-05-01  Robin Morisset  <rmorisset@apple.com>
> 
>         Correctly detect string overflow when using the 'Function' constructor
>diff --git a/Source/WTF/wtf/Assertions.cpp b/Source/WTF/wtf/Assertions.cpp
>index e15a092..d7c8319 100644
>--- a/Source/WTF/wtf/Assertions.cpp
>+++ b/Source/WTF/wtf/Assertions.cpp
>@@ -342,9 +342,11 @@ void WTFLoggingAccumulator::resetAccumulatedLogs()
> String WTFLoggingAccumulator::getAndResetAccumulatedLogs()
> {
>     Locker<Lock> locker(accumulatorLock);
>-    String result = loggingAccumulator.toString();
>-    loggingAccumulator.clear();
>-    return result;
>+    if (auto result = loggingAccumulator.toString()) {
>+        loggingAccumulator.clear();
>+        return *result;
>+    }
>+    CRASH();
> }
> 
> static WTFLoggingAccumulator& loggingAccumulator()
>diff --git a/Source/WTF/wtf/DateMath.cpp b/Source/WTF/wtf/DateMath.cpp
>index 6db92eb..a8425f0 100644
>--- a/Source/WTF/wtf/DateMath.cpp
>+++ b/Source/WTF/wtf/DateMath.cpp
>@@ -1187,7 +1187,9 @@ String makeRFC2822DateString(unsigned dayOfWeek, unsigned day, unsigned month, u
>     appendTwoDigitNumber(stringBuilder, absoluteUTCOffset / 60);
>     appendTwoDigitNumber(stringBuilder, absoluteUTCOffset % 60);
> 
>-    return stringBuilder.toString();
>+    if (auto string = stringBuilder.toString())
>+        return *string;
>+    CRASH();
> }
> 
> } // namespace WTF
>diff --git a/Source/WTF/wtf/JSONValues.cpp b/Source/WTF/wtf/JSONValues.cpp
>index bde44ab..08c6227 100644
>--- a/Source/WTF/wtf/JSONValues.cpp
>+++ b/Source/WTF/wtf/JSONValues.cpp
>@@ -327,8 +327,11 @@ bool decodeString(const UChar* start, const UChar* end, String& output)
>     if (!decodeString(start, end, buffer))
>         return false;
> 
>-    output = buffer.toString();
>-    return true;
>+    if (auto string = buffer.toString()) {
>+        output = *string;
>+        return true;
>+    }
>+    return false;
> }
> 
> RefPtr<JSON::Value> buildValue(const UChar* start, const UChar* end, const UChar** valueTokenEnd, int depth)
>@@ -553,7 +556,9 @@ String Value::toJSONString() const
>     StringBuilder result;
>     result.reserveCapacity(512);
>     writeJSON(result);
>-    return result.toString();
>+    if (auto string = result.toString())
>+        return *string;
>+    CRASH();
> }
> 
> bool Value::asBoolean(bool& output) const
>diff --git a/Source/WTF/wtf/Logger.h b/Source/WTF/wtf/Logger.h
>index 6b01b58..48b8d82 100644
>--- a/Source/WTF/wtf/Logger.h
>+++ b/Source/WTF/wtf/Logger.h
>@@ -46,7 +46,12 @@ struct LogArgument {
>     template<typename U = T> static typename std::enable_if<std::is_same<U, double>::value, String>::type toString(double argument) { return String::number(argument); }
>     template<typename U = T> static typename std::enable_if<std::is_same<typename std::remove_reference<U>::type, AtomicString>::value, String>::type toString(AtomicString argument) { return argument.string(); }
>     template<typename U = T> static typename std::enable_if<std::is_same<typename std::remove_reference<U>::type, String>::value, String>::type toString(String argument) { return argument; }
>-    template<typename U = T> static typename std::enable_if<std::is_same<typename std::remove_reference<U>::type, StringBuilder*>::value, String>::type toString(StringBuilder* argument) { return argument->toString(); }
>+    template<typename U = T> static typename std::enable_if<std::is_same<typename std::remove_reference<U>::type, StringBuilder*>::value, String>::type toString(StringBuilder* argument)
>+    {
>+        if (auto string = argument->toString())
>+            return *string;
>+        CRASH();
>+    }
>     template<typename U = T> static typename std::enable_if<std::is_same<U, const char*>::value, String>::type toString(const char* argument) { return String(argument); }
>     template<size_t length> static String toString(const char (&argument)[length]) { return String(argument); }
> };
>@@ -274,7 +279,9 @@ struct LogArgument<Logger::LogSiteIdentifier> {
>         builder.append('(');
>         appendUnsigned64AsHex(value.objectPtr, builder);
>         builder.appendLiteral(") ");
>-        return builder.toString();
>+        if (auto string = builder.toString())
>+            return *string;
>+        CRASH();
>     }
> };
> 
>diff --git a/Source/WTF/wtf/MediaTime.cpp b/Source/WTF/wtf/MediaTime.cpp
>index 03050b5..1f77b47 100644
>--- a/Source/WTF/wtf/MediaTime.cpp
>+++ b/Source/WTF/wtf/MediaTime.cpp
>@@ -574,7 +574,9 @@ String MediaTime::toString() const
>     }
>     builder.appendNumber(toDouble());
>     builder.append('}');
>-    return builder.toString();
>+    if (auto string = builder.toString())
>+        return *string;
>+    CRASH();
> }
> 
> String MediaTime::toJSONString() const
>diff --git a/Source/WTF/wtf/UUID.cpp b/Source/WTF/wtf/UUID.cpp
>index fb5fe5b..b598f00 100644
>--- a/Source/WTF/wtf/UUID.cpp
>+++ b/Source/WTF/wtf/UUID.cpp
>@@ -56,7 +56,9 @@ String createCanonicalUUIDString()
>     builder.append('-');
>     appendUnsignedAsHexFixedSize(randomData[2] & 0x0000ffff, builder, 4, Lowercase);
>     appendUnsignedAsHexFixedSize(randomData[3], builder, 8, Lowercase);
>-    return builder.toString();
>+    if (auto string = builder.toString())
>+        return *string;
>+    CRASH();
> }
> 
> } // namespace WTF
>diff --git a/Source/WTF/wtf/text/StringBuilder.cpp b/Source/WTF/wtf/text/StringBuilder.cpp
>index d79d4c5..2584c57 100644
>--- a/Source/WTF/wtf/text/StringBuilder.cpp
>+++ b/Source/WTF/wtf/text/StringBuilder.cpp
>@@ -1,5 +1,5 @@
> /*
>- * Copyright (C) 2010, 2013, 2016 Apple Inc. All rights reserved.
>+ * Copyright (C) 2010-2018 Apple Inc. All rights reserved.
>  * Copyright (C) 2012 Google Inc. All rights reserved.
>  *
>  * Redistribution and use in source and binary forms, with or without
>@@ -62,26 +62,44 @@ void StringBuilder::reifyString() const
>         m_string = StringImpl::createSubstringSharingImpl(*m_buffer, 0, m_length);
> }
> 
>-void StringBuilder::resize(unsigned newSize)
>+Unexpected<StringBuilder::Failure> StringBuilder::wouldOverflow()
>+{
>+    m_failed = true;
>+    return makeUnexpected(Failure::WouldOverflow);
>+}
>+
>+Unexpected<StringBuilder::Failure> StringBuilder::outOfMemory()
>+{
>+    clear();
>+    m_failed = true;
>+    return makeUnexpected(Failure::OutOfMemory);
>+}
>+
>+StringBuilder::Fallible<> StringBuilder::resize(unsigned newSize)
> {
>     // Check newSize < m_length, hence m_length > 0.
>     ASSERT(newSize <= m_length);
>     if (newSize == m_length)
>-        return;
>+        return { };
>     ASSERT(m_length);
> 
>     // If there is a buffer, we only need to duplicate it if it has more than one ref.
>     if (m_buffer) {
>         m_string = String(); // Clear the string to remove the reference to m_buffer if any before checking the reference count of m_buffer.
>         if (!m_buffer->hasOneRef()) {
>-            if (m_buffer->is8Bit())
>-                allocateBuffer(m_buffer->characters8(), m_buffer->length());
>-            else
>-                allocateBuffer(m_buffer->characters16(), m_buffer->length());
>+            if (m_buffer->is8Bit()) {
>+                auto allocated = allocateBuffer(m_buffer->characters8(), m_buffer->length());
>+                if (!allocated)
>+                    return allocated;
>+            } else {
>+                auto allocated = allocateBuffer(m_buffer->characters16(), m_buffer->length());
>+                if (!allocated)
>+                    return allocated;
>+            }
>         }
>         m_length = newSize;
>         ASSERT(m_buffer->length() >= m_length);
>-        return;
>+        return { };
>     }
> 
>     // Since m_length && !m_buffer, the string must be valid in m_string, and m_string.length() > 0.
>@@ -89,54 +107,60 @@ void StringBuilder::resize(unsigned newSize)
>     ASSERT(m_length == m_string.length());
>     ASSERT(newSize < m_string.length());
>     m_length = newSize;
>-    m_string = StringImpl::createSubstringSharingImpl(*m_string.impl(), 0, newSize);
>+    if (auto created = StringImpl::tryCreateSubstringSharingImpl(*m_string.impl(), 0, newSize)) {
>+        m_string = *created;
>+        return { };
>+    } else
>+        return outOfMemory();
> }
> 
> // Allocate a new 8 bit buffer, copying in currentCharacters (these may come from either m_string
> // or m_buffer, neither will be reassigned until the copy has completed).
>-void StringBuilder::allocateBuffer(const LChar* currentCharacters, unsigned requiredLength)
>+StringBuilder::Fallible<> StringBuilder::allocateBuffer(const LChar* currentCharacters, unsigned requiredLength)
> {
>     ASSERT(m_is8Bit);
>     // Copy the existing data into a new buffer, set result to point to the end of the existing data.
>-    auto buffer = StringImpl::createUninitialized(requiredLength, m_bufferCharacters8);
>+    auto buffer = StringImpl::tryCreateUninitialized(requiredLength, m_bufferCharacters8);
>+    if (!buffer)
>+        return outOfMemory();
>     memcpy(m_bufferCharacters8, currentCharacters, static_cast<size_t>(m_length) * sizeof(LChar)); // This can't overflow.
>     
>     // Update the builder state.
>     m_buffer = WTFMove(buffer);
>     m_string = String();
>     ASSERT(m_buffer->length() == requiredLength);
>+    return { };
> }
> 
> // Allocate a new 16 bit buffer, copying in currentCharacters (these may come from either m_string
> // or m_buffer,  neither will be reassigned until the copy has completed).
>-void StringBuilder::allocateBuffer(const UChar* currentCharacters, unsigned requiredLength)
>+StringBuilder::Fallible<> StringBuilder::allocateBuffer(const UChar* currentCharacters, unsigned requiredLength)
> {
>     ASSERT(!m_is8Bit);
>     // Copy the existing data into a new buffer, set result to point to the end of the existing data.
>-    auto buffer = StringImpl::createUninitialized(requiredLength, m_bufferCharacters16);
>+    auto buffer = StringImpl::tryCreateUninitialized(requiredLength, m_bufferCharacters16);
>+    if (!buffer)
>+        return outOfMemory();
>     memcpy(m_bufferCharacters16, currentCharacters, static_cast<size_t>(m_length) * sizeof(UChar)); // This can't overflow.
>     
>     // Update the builder state.
>     m_buffer = WTFMove(buffer);
>     m_string = String();
>     ASSERT(m_buffer->length() == requiredLength);
>+    return { };
> }
> 
> // Allocate a new 16 bit buffer, copying in currentCharacters (which is 8 bit and may come
> // from either m_string or m_buffer, neither will be reassigned until the copy has completed).
>-void StringBuilder::allocateBufferUpConvert(const LChar* currentCharacters, unsigned requiredLength)
>-{
>-    if (!tryAllocateBufferUpConvert(currentCharacters, requiredLength))
>-        CRASH();
>-}
>-bool StringBuilder::tryAllocateBufferUpConvert(const LChar* currentCharacters, unsigned requiredLength)
>+StringBuilder::Fallible<> StringBuilder::allocateBufferUpConvert(const LChar* currentCharacters, unsigned requiredLength)
> {
>     ASSERT(m_is8Bit);
>     ASSERT(requiredLength >= m_length);
>     // Copy the existing data into a new buffer, set result to point to the end of the existing data.
>     auto buffer = StringImpl::tryCreateUninitialized(requiredLength, m_bufferCharacters16);
>     if (!buffer)
>-        return false;
>+        return outOfMemory();
>+
>     for (unsigned i = 0; i < m_length; ++i)
>         m_bufferCharacters16[i] = currentCharacters[i];
>     
>@@ -146,11 +170,11 @@ bool StringBuilder::tryAllocateBufferUpConvert(const LChar* currentCharacters, u
>     m_buffer = WTFMove(buffer);
>     m_string = String();
>     ASSERT(m_buffer->length() == requiredLength);
>-    return true;
>+    return { };
> }
> 
> template <>
>-void StringBuilder::reallocateBuffer<LChar>(unsigned requiredLength)
>+StringBuilder::Fallible<> StringBuilder::reallocateBuffer<LChar>(unsigned requiredLength)
> {
>     // If the buffer has only one ref (by this StringBuilder), reallocate it,
>     // otherwise fall back to "allocate and copy" method.
>@@ -159,66 +183,89 @@ void StringBuilder::reallocateBuffer<LChar>(unsigned requiredLength)
>     ASSERT(m_is8Bit);
>     ASSERT(m_buffer->is8Bit());
>     
>-    if (m_buffer->hasOneRef())
>-        m_buffer = StringImpl::reallocate(m_buffer.releaseNonNull(), requiredLength, m_bufferCharacters8);
>-    else
>-        allocateBuffer(m_buffer->characters8(), requiredLength);
>+    if (m_buffer->hasOneRef()) {
>+        auto reallocated = StringImpl::tryReallocate(m_buffer.releaseNonNull(), requiredLength, m_bufferCharacters8);
>+        if (!reallocated)
>+            return outOfMemory();
>+        m_buffer = reallocated.get();
>+    } else {
>+        auto allocated = allocateBuffer(m_buffer->characters8(), requiredLength);
>+        if (!allocated)
>+            return allocated;
>+    }
>     ASSERT(m_buffer->length() == requiredLength);
>+    return { };
> }
> 
> template <>
>-void StringBuilder::reallocateBuffer<UChar>(unsigned requiredLength)
>+StringBuilder::Fallible<> StringBuilder::reallocateBuffer<UChar>(unsigned requiredLength)
> {
>     // If the buffer has only one ref (by this StringBuilder), reallocate it,
>     // otherwise fall back to "allocate and copy" method.
>     m_string = String();
>     
>-    if (m_buffer->is8Bit())
>-        allocateBufferUpConvert(m_buffer->characters8(), requiredLength);
>+    if (m_buffer->is8Bit()) {
>+        auto allocated = allocateBufferUpConvert(m_buffer->characters8(), requiredLength);
>+        if (!allocated)
>+            return allocated;
>+    }
>     else if (m_buffer->hasOneRef())
>         m_buffer = StringImpl::reallocate(m_buffer.releaseNonNull(), requiredLength, m_bufferCharacters16);
>     else
>         allocateBuffer(m_buffer->characters16(), requiredLength);
>     ASSERT(m_buffer->length() == requiredLength);
>+    return { };
> }
> 
>-void StringBuilder::reserveCapacity(unsigned newCapacity)
>+StringBuilder::Fallible<> StringBuilder::reserveCapacity(unsigned newCapacity)
> {
>     if (m_buffer) {
>         // If there is already a buffer, then grow if necessary.
>         if (newCapacity > m_buffer->length()) {
>-            if (m_buffer->is8Bit())
>-                reallocateBuffer<LChar>(newCapacity);
>-            else
>-                reallocateBuffer<UChar>(newCapacity);
>+            if (m_buffer->is8Bit()) {
>+                auto reallocated = reallocateBuffer<LChar>(newCapacity);
>+                if (!reallocated)
>+                    return reallocated;
>+            } else {
>+                auto reallocated = reallocateBuffer<UChar>(newCapacity);
>+                if (!reallocated)
>+                    return reallocated;
>+            }
>         }
>     } else {
>         // Grow the string, if necessary.
>         if (newCapacity > m_length) {
>             if (!m_length) {
>                 LChar* nullPlaceholder = 0;
>-                allocateBuffer(nullPlaceholder, newCapacity);
>-            } else if (m_string.is8Bit())
>-                allocateBuffer(m_string.characters8(), newCapacity);
>-            else
>-                allocateBuffer(m_string.characters16(), newCapacity);
>+                auto allocated = allocateBuffer(nullPlaceholder, newCapacity);
>+                if (!allocated)
>+                    return allocated;
>+            } else if (m_string.is8Bit()) {
>+                auto allocated = allocateBuffer(m_string.characters8(), newCapacity);
>+                if (!allocated)
>+                    return allocated;
>+            } else {
>+                auto allocated = allocateBuffer(m_string.characters16(), newCapacity);
>+                if (!allocated)
>+                    return allocated;
>+            }
>         }
>     }
>     ASSERT(!newCapacity || m_buffer->length() >= newCapacity);
>+    return { };
> }
> 
> // Make 'length' additional capacity be available in m_buffer, update m_string & m_length,
> // return a pointer to the newly allocated storage.
>-// Returns nullptr if the size of the new builder would have overflowed
> template <typename CharType>
>-ALWAYS_INLINE CharType* StringBuilder::appendUninitialized(unsigned length)
>+ALWAYS_INLINE StringBuilder::Fallible<CharType*> StringBuilder::appendUninitialized(unsigned length)
> {
>     ASSERT(length);
> 
>     // Calculate the new size of the builder after appending.
>     unsigned requiredLength = length + m_length;
>     if (requiredLength < length)
>-        return nullptr;
>+        return wouldOverflow();
> 
>     if ((m_buffer) && (requiredLength <= m_buffer->length())) {
>         // If the buffer is valid it must be at least as long as the current builder contents!
>@@ -235,7 +282,7 @@ ALWAYS_INLINE CharType* StringBuilder::appendUninitialized(unsigned length)
> // Make 'length' additional capacity be available in m_buffer, update m_string & m_length,
> // return a pointer to the newly allocated storage.
> template <typename CharType>
>-CharType* StringBuilder::appendUninitializedSlow(unsigned requiredLength)
>+StringBuilder::Fallible<CharType*> StringBuilder::appendUninitializedSlow(unsigned requiredLength)
> {
>     ASSERT(requiredLength);
> 
>@@ -243,10 +290,14 @@ CharType* StringBuilder::appendUninitializedSlow(unsigned requiredLength)
>         // If the buffer is valid it must be at least as long as the current builder contents!
>         ASSERT(m_buffer->length() >= m_length);
>         
>-        reallocateBuffer<CharType>(expandedCapacity(capacity(), requiredLength));
>+        auto reallocated = reallocateBuffer<CharType>(expandedCapacity(capacity(), requiredLength));
>+        if (!reallocated)
>+            return makeUnexpected(reallocated.error());
>     } else {
>         ASSERT(m_string.length() == m_length);
>-        allocateBuffer(m_length ? m_string.characters<CharType>() : 0, expandedCapacity(capacity(), requiredLength));
>+        auto allocated = allocateBuffer(m_length ? m_string.characters<CharType>() : 0, expandedCapacity(capacity(), requiredLength));
>+        if (!allocated)
>+            return makeUnexpected(allocated.error());
>     }
>     
>     CharType* result = getBufferCharacters<CharType>() + m_length;
>@@ -255,16 +306,10 @@ CharType* StringBuilder::appendUninitializedSlow(unsigned requiredLength)
>     return result;
> }
> 
>-void StringBuilder::append(const UChar* characters, unsigned length)
>-{
>-    if (!tryAppend(characters, length))
>-        CRASH();
>-}
>-
>-bool StringBuilder::tryAppend(const UChar* characters, unsigned length)
>+StringBuilder::Fallible<> StringBuilder::append(const UChar* characters, unsigned length)
> {
>     if (!length)
>-        return true;
>+        return { };
> 
>     ASSERT(characters);
> 
>@@ -272,54 +317,51 @@ bool StringBuilder::tryAppend(const UChar* characters, unsigned length)
>         if (length == 1 && !(*characters & ~0xff)) {
>             // Append as 8 bit character
>             LChar lChar = static_cast<LChar>(*characters);
>-            return tryAppend(&lChar, 1);
>+            return append(&lChar, 1);
>         }
> 
>         // Calculate the new size of the builder after appending.
>         unsigned requiredLength = length + m_length;
>         if (requiredLength < length)
>-            return false;
>+            return wouldOverflow();
>         
>         if (m_buffer) {
>             // If the buffer is valid it must be at least as long as the current builder contents!
>             ASSERT(m_buffer->length() >= m_length);
>-            if (!tryAllocateBufferUpConvert(m_buffer->characters8(), expandedCapacity(capacity(), requiredLength)))
>-                return false;
>+            
>+            auto allocated = allocateBufferUpConvert(m_buffer->characters8(), expandedCapacity(capacity(), requiredLength));
>+            if (!allocated)
>+                return allocated;
>         } else {
>             ASSERT(m_string.length() == m_length);
>-            if (!tryAllocateBufferUpConvert(m_string.isNull() ? 0 : m_string.characters8(), expandedCapacity(capacity(), requiredLength)))
>-                return false;
>+            auto allocated = allocateBufferUpConvert(m_string.isNull() ? 0 : m_string.characters8(), expandedCapacity(capacity(), requiredLength));
>+            if (!allocated)
>+                return allocated;
>         }
> 
>         memcpy(m_bufferCharacters16 + m_length, characters, static_cast<size_t>(length) * sizeof(UChar));
>         m_length = requiredLength;
>     } else {
>-        UChar* dest = appendUninitialized<UChar>(length);
>-        if (!dest)
>-            return false;
>-        memcpy(dest, characters, static_cast<size_t>(length) * sizeof(UChar));
>+        if (auto appended = appendUninitialized<UChar>(length))
>+            memcpy(*appended, characters, static_cast<size_t>(length) * sizeof(UChar));
>+        else
>+            return makeUnexpected(appended.error());
>     }
>     ASSERT(m_buffer->length() >= m_length);
>-    return true;
>+    return { };
> }
> 
>-void StringBuilder::append(const LChar* characters, unsigned length)
>-{
>-    if (!tryAppend(characters, length))
>-        CRASH();
>-}
>-
>-bool StringBuilder::tryAppend(const LChar* characters, unsigned length)
>+StringBuilder::Fallible<> StringBuilder::append(const LChar* characters, unsigned length)
> {
>     if (!length)
>-        return true;
>-
>+        return { };
>     ASSERT(characters);
> 
>     if (m_is8Bit) {
>-        LChar* dest = appendUninitialized<LChar>(length);
>-        if (!dest)
>-            return false;
>+        auto appended = appendUninitialized<LChar>(length);
>+        if (!appended)
>+            return makeUnexpected(appended.error());
>+        LChar* dest = *appended;
>         if (length > 8)
>             memcpy(dest, characters, static_cast<size_t>(length) * sizeof(LChar));
>         else {
>@@ -328,76 +370,79 @@ bool StringBuilder::tryAppend(const LChar* characters, unsigned length)
>                 *(dest++) = *(characters++);
>         }
>     } else {
>-        UChar* dest = appendUninitialized<UChar>(length);
>-        if (!dest)
>-            return false;
>+        auto appended = appendUninitialized<UChar>(length);
>+        if (!appended)
>+            return makeUnexpected(appended.error());
>+        UChar* dest = *appended;
>         const LChar* end = characters + length;
>         while (characters < end)
>             *(dest++) = *(characters++);
>     }
>-    return true;
>+    return { };
> }
> 
> #if USE(CF)
> 
>-void StringBuilder::append(CFStringRef string)
>+StringBuilder::Fallible<> StringBuilder::append(CFStringRef string)
> {
>     // Fast path: avoid constructing a temporary String when possible.
>     if (auto* characters = CFStringGetCStringPtr(string, kCFStringEncodingISOLatin1)) {
>-        append(reinterpret_cast<const LChar*>(characters), CFStringGetLength(string));
>-        return;
>+        if (auto appended = append(reinterpret_cast<const LChar*>(characters), CFStringGetLength(string)))
>+            return { };
>+        else
>+            return appended;
>     }
>-    append(String(string));
>+    return append(String(string));
> }
> 
> #endif
> 
>-void StringBuilder::appendNumber(int number)
>+StringBuilder::Fallible<> StringBuilder::appendNumber(int number)
> {
>-    numberToStringSigned<StringBuilder>(number, this);
>+    return numberToStringSigned<StringBuilder>(number, this);
> }
> 
>-void StringBuilder::appendNumber(unsigned int number)
>+StringBuilder::Fallible<> StringBuilder::appendNumber(unsigned int number)
> {
>-    numberToStringUnsigned<StringBuilder>(number, this);
>+    return numberToStringUnsigned<StringBuilder>(number, this);
> }
> 
>-void StringBuilder::appendNumber(long number)
>+StringBuilder::Fallible<> StringBuilder::appendNumber(long number)
> {
>-    numberToStringSigned<StringBuilder>(number, this);
>+    return numberToStringSigned<StringBuilder>(number, this);
> }
> 
>-void StringBuilder::appendNumber(unsigned long number)
>+StringBuilder::Fallible<> StringBuilder::appendNumber(unsigned long number)
> {
>-    numberToStringUnsigned<StringBuilder>(number, this);
>+    return numberToStringUnsigned<StringBuilder>(number, this);
> }
> 
>-void StringBuilder::appendNumber(long long number)
>+StringBuilder::Fallible<> StringBuilder::appendNumber(long long number)
> {
>-    numberToStringSigned<StringBuilder>(number, this);
>+    return numberToStringSigned<StringBuilder>(number, this);
> }
> 
>-void StringBuilder::appendNumber(unsigned long long number)
>+StringBuilder::Fallible<> StringBuilder::appendNumber(unsigned long long number)
> {
>-    numberToStringUnsigned<StringBuilder>(number, this);
>+    return numberToStringUnsigned<StringBuilder>(number, this);
> }
> 
>-void StringBuilder::appendNumber(double number, unsigned precision, TrailingZerosTruncatingPolicy trailingZerosTruncatingPolicy)
>+StringBuilder::Fallible<> StringBuilder::appendNumber(double number, unsigned precision, TrailingZerosTruncatingPolicy trailingZerosTruncatingPolicy)
> {
>     NumberToStringBuffer buffer;
>-    append(numberToFixedPrecisionString(number, precision, buffer, trailingZerosTruncatingPolicy == TruncateTrailingZeros));
>+    return append(numberToFixedPrecisionString(number, precision, buffer, trailingZerosTruncatingPolicy == TruncateTrailingZeros));
> }
> 
>-void StringBuilder::appendECMAScriptNumber(double number)
>+StringBuilder::Fallible<> StringBuilder::appendECMAScriptNumber(double number)
> {
>     NumberToStringBuffer buffer;
>-    append(numberToString(number, buffer));
>+    return append(numberToString(number, buffer));
> }
> 
>-void StringBuilder::appendFixedWidthNumber(double number, unsigned decimalPlaces)
>+StringBuilder::Fallible<> StringBuilder::appendFixedWidthNumber(double number, unsigned decimalPlaces)
> {
>     NumberToStringBuffer buffer;
>-    append(numberToFixedWidthString(number, decimalPlaces, buffer));
>+    return append(numberToFixedWidthString(number, decimalPlaces, buffer));
> }
> 
> bool StringBuilder::canShrink() const
>@@ -406,15 +451,21 @@ bool StringBuilder::canShrink() const
>     return m_buffer && m_buffer->length() > (m_length + (m_length >> 2));
> }
> 
>-void StringBuilder::shrinkToFit()
>+StringBuilder::Fallible<> StringBuilder::shrinkToFit()
> {
>     if (canShrink()) {
>-        if (m_is8Bit)
>-            reallocateBuffer<LChar>(m_length);
>-        else
>-            reallocateBuffer<UChar>(m_length);
>+        if (m_is8Bit) {
>+            auto reallocated = reallocateBuffer<LChar>(m_length);
>+            if (!reallocated)
>+                return reallocated;
>+        } else {
>+            auto reallocated = reallocateBuffer<UChar>(m_length);
>+            if (!reallocated)
>+                return reallocated;
>+        }
>         m_string = WTFMove(m_buffer);
>     }
>+    return { };
> }
> 
> } // namespace WTF
>diff --git a/Source/WTF/wtf/text/StringBuilder.h b/Source/WTF/wtf/text/StringBuilder.h
>index 7e974c1..2c0ddcc 100644
>--- a/Source/WTF/wtf/text/StringBuilder.h
>+++ b/Source/WTF/wtf/text/StringBuilder.h
>@@ -1,5 +1,5 @@
> /*
>- * Copyright (C) 2009-2010, 2012-2013, 2016 Apple Inc. All rights reserved.
>+ * Copyright (C) 2009-2018 Apple Inc. All rights reserved.
>  * Copyright (C) 2012 Google Inc. All rights reserved.
>  *
>  * Redistribution and use in source and binary forms, with or without
>@@ -27,6 +27,7 @@
> #ifndef StringBuilder_h
> #define StringBuilder_h
> 
>+#include <wtf/Expected.h>
> #include <wtf/text/AtomicString.h>
> #include <wtf/text/IntegerToStringConversion.h>
> #include <wtf/text/StringView.h>
>@@ -40,36 +41,33 @@ class StringBuilder {
> 
> public:
>     StringBuilder()
>-        : m_length(0)
>-        , m_is8Bit(true)
>-        , m_bufferCharacters8(nullptr)
>+        : m_bufferCharacters8(nullptr)
>     {
>     }
>     StringBuilder(StringBuilder&&) = default;
>     StringBuilder& operator=(StringBuilder&&) = default;
> 
>-    WTF_EXPORT_PRIVATE void append(const UChar*, unsigned);
>-    WTF_EXPORT_PRIVATE bool tryAppend(const UChar*, unsigned);
>-    WTF_EXPORT_PRIVATE void append(const LChar*, unsigned);
>-    WTF_EXPORT_PRIVATE bool tryAppend(const LChar*, unsigned);
>+    enum class Failure {
>+        WouldOverflow,
>+        OutOfMemory,
>+        UnhandledFailure,
>+    };
>+    template<typename Expect = void> using Fallible = Expected<Expect, StringBuilder::Failure>;
> 
>-    ALWAYS_INLINE void append(const char* characters, unsigned length) { append(reinterpret_cast<const LChar*>(characters), length); }
>-    ALWAYS_INLINE bool tryAppend(const char* characters, unsigned length) { return tryAppend(reinterpret_cast<const LChar*>(characters), length); }
>+    WTF_EXPORT_PRIVATE Fallible<> append(const UChar*, unsigned);
>+    WTF_EXPORT_PRIVATE Fallible<> append(const LChar*, unsigned);
> 
>-    void append(const AtomicString& atomicString)
>-    {
>-        append(atomicString.string());
>-    }
>+    ALWAYS_INLINE Fallible<> append(const char* characters, unsigned length) { return append(reinterpret_cast<const LChar*>(characters), length); }
> 
>-    void append(const String& string)
>+    Fallible<> append(const AtomicString& atomicString)
>     {
>-        if (!tryAppend(string))
>-            CRASH();
>+        return append(atomicString.string());
>     }
>-    bool tryAppend(const String& string)
>+
>+    Fallible<> append(const String& string)
>     {
>         if (!string.length())
>-            return true;
>+            return { };
> 
>         // If we're appending to an empty string, and there is not a buffer (reserveCapacity has not been called)
>         // then just retain the string.
>@@ -77,174 +75,164 @@ public:
>             m_string = string;
>             m_length = string.length();
>             m_is8Bit = m_string.is8Bit();
>-            return true;
>+            return { };
>         }
> 
>         if (string.is8Bit())
>-            return tryAppend(string.characters8(), string.length());
>+            return append(string.characters8(), string.length());
>         else
>-            return tryAppend(string.characters16(), string.length());
>+            return append(string.characters16(), string.length());
>     }
> 
>-    void append(const StringBuilder& other)
>-    {
>-        if (!tryAppend(other))
>-            CRASH();
>-    }
>-    bool tryAppend(const StringBuilder& other)
>+    Fallible<> append(const StringBuilder& other)
>     {
>+        if (other.failed())
>+            return makeUnexpected(Failure::UnhandledFailure);            
>         if (!other.m_length)
>-            return true;
>+            return { };
> 
>         // If we're appending to an empty string, and there is not a buffer (reserveCapacity has not been called)
>         // then just retain the string.
>         if (!m_length && !m_buffer && !other.m_string.isNull()) {
>             m_string = other.m_string;
>             m_length = other.m_length;
>-            return true;
>+            return { };
>         }
> 
>         if (other.is8Bit())
>-            return tryAppend(other.characters8(), other.m_length);
>+            return append(*other.characters8(), other.m_length);
>         else
>-            return tryAppend(other.characters16(), other.m_length);
>+            return append(*other.characters16(), other.m_length);
>     }
> 
>-    void append(StringView stringView)
>-    {
>-        if (!tryAppend(stringView))
>-            CRASH();
>-    }
>-    bool tryAppend(StringView stringView)
>+    Fallible<> append(StringView stringView)
>     {
>         if (stringView.is8Bit())
>-            return tryAppend(stringView.characters8(), stringView.length());
>+            return append(stringView.characters8(), stringView.length());
>         else
>-            return tryAppend(stringView.characters16(), stringView.length());
>+            return append(stringView.characters16(), stringView.length());
>     }
> 
> #if USE(CF)
>-    WTF_EXPORT_PRIVATE void append(CFStringRef);
>+    WTF_EXPORT_PRIVATE Fallible<> append(CFStringRef);
> #endif
> #if USE(CF) && defined(__OBJC__)
>-    void append(NSString *string) { append((__bridge CFStringRef)string); }
>+    Fallible<> append(NSString *string) { return append((__bridge CFStringRef)string); }
> #endif
>     
>-    void append(const String& string, unsigned offset, unsigned length)
>+    Fallible<> append(const String& string, unsigned offset, unsigned length)
>     {
>         if (!string.length())
>-            return;
>+            return { };
> 
>         if ((offset + length) > string.length())
>-            return;
>+            return { };
> 
>         if (string.is8Bit())
>-            append(string.characters8() + offset, length);
>+            return append(string.characters8() + offset, length);
>         else
>-            append(string.characters16() + offset, length);
>+            return append(string.characters16() + offset, length);
>     }
> 
>-    void append(const char* characters)
>+    Fallible<> append(const char* characters)
>     {
>         if (characters)
>-            append(characters, strlen(characters));
>-    }
>-    bool tryAppend(const char* characters)
>-    {
>-        if (characters)
>-            return tryAppend(characters, strlen(characters));
>-        return true;
>+            return append(characters, strlen(characters));
>+        return { };
>     }
> 
>-    void append(UChar c)
>+    Fallible<> append(UChar c)
>     {
>         if (m_buffer && m_length < m_buffer->length() && m_string.isNull()) {
>             if (!m_is8Bit) {
>                 m_bufferCharacters16[m_length++] = c;
>-                return;
>+                return { };
>             }
> 
>             if (!(c & ~0xff)) {
>                 m_bufferCharacters8[m_length++] = static_cast<LChar>(c);
>-                return;
>+                return { };
>             }
>         }
>-        append(&c, 1);
>+        return append(&c, 1);
>     }
> 
>-    void append(LChar c)
>-    {
>-        if (!tryAppend(c))
>-            CRASH();
>-    }
>-    bool tryAppend(LChar c)
>+    Fallible<> append(LChar c)
>     {
>         if (m_buffer && m_length < m_buffer->length() && m_string.isNull()) {
>             if (m_is8Bit)
>                 m_bufferCharacters8[m_length++] = c;
>             else
>                 m_bufferCharacters16[m_length++] = c;
>-            return true;
>-        } else
>-            return tryAppend(&c, 1);
>+            return { };
>+        }
>+        return append(&c, 1);
>     }
> 
>-    void append(char c) { append(static_cast<LChar>(c)); }
>-    bool tryAppend(char c) { return tryAppend(static_cast<LChar>(c)); }
>+    Fallible<> append(char c)
>+    {
>+        return append(static_cast<LChar>(c));
>+    }
> 
>-    void append(UChar32 c)
>+    Fallible<> append(UChar32 c)
>     {
>-        if (U_IS_BMP(c)) {
>-            append(static_cast<UChar>(c));
>-            return;
>-        }
>-        append(U16_LEAD(c));
>-        append(U16_TRAIL(c));
>+        if (U_IS_BMP(c))
>+            return append(static_cast<UChar>(c));
>+        auto appended = append(U16_LEAD(c));
>+        if (!appended)
>+            return appended;
>+        return append(U16_TRAIL(c));
>     }
> 
>-    WTF_EXPORT_PRIVATE void appendQuotedJSONString(const String&);
>-    WTF_EXPORT_PRIVATE bool tryAppendQuotedJSONString(const String&);
>+    WTF_EXPORT_PRIVATE Fallible<> appendQuotedJSONString(const String&);
> 
>     template<unsigned characterCount>
>-    ALWAYS_INLINE void appendLiteral(const char (&characters)[characterCount]) { append(characters, characterCount - 1); }
>-    template<unsigned characterCount>
>-    ALWAYS_INLINE bool tryAppendLiteral(const char (&characters)[characterCount]) { return tryAppend(characters, characterCount - 1); }
>-
>-    WTF_EXPORT_PRIVATE void appendNumber(int);
>-    WTF_EXPORT_PRIVATE void appendNumber(unsigned int);
>-    WTF_EXPORT_PRIVATE void appendNumber(long);
>-    WTF_EXPORT_PRIVATE void appendNumber(unsigned long);
>-    WTF_EXPORT_PRIVATE void appendNumber(long long);
>-    WTF_EXPORT_PRIVATE void appendNumber(unsigned long long);
>-    WTF_EXPORT_PRIVATE void appendNumber(double, unsigned precision = 6, TrailingZerosTruncatingPolicy = TruncateTrailingZeros);
>-    WTF_EXPORT_PRIVATE void appendECMAScriptNumber(double);
>-    WTF_EXPORT_PRIVATE void appendFixedWidthNumber(double, unsigned decimalPlaces);
>-
>-    String toString()
>+    ALWAYS_INLINE Fallible<> appendLiteral(const char (&characters)[characterCount]) { return append(characters, characterCount - 1); }
>+
>+    WTF_EXPORT_PRIVATE Fallible<> appendNumber(int);
>+    WTF_EXPORT_PRIVATE Fallible<> appendNumber(unsigned int);
>+    WTF_EXPORT_PRIVATE Fallible<> appendNumber(long);
>+    WTF_EXPORT_PRIVATE Fallible<> appendNumber(unsigned long);
>+    WTF_EXPORT_PRIVATE Fallible<> appendNumber(long long);
>+    WTF_EXPORT_PRIVATE Fallible<> appendNumber(unsigned long long);
>+    WTF_EXPORT_PRIVATE Fallible<> appendNumber(double, unsigned precision = 6, TrailingZerosTruncatingPolicy = TruncateTrailingZeros);
>+    WTF_EXPORT_PRIVATE Fallible<> appendECMAScriptNumber(double);
>+    WTF_EXPORT_PRIVATE Fallible<> appendFixedWidthNumber(double, unsigned decimalPlaces);
>+
>+    WARN_UNUSED_RETURN Fallible<String> toString()
>     {
>-        shrinkToFit();
>-        if (m_string.isNull())
>-            reifyString();
>-        return m_string;
>+        if (m_failed)
>+            return makeUnexpected(Failure::UnhandledFailure);
>+        if (auto shrank = shrinkToFit()) {
>+            if (m_string.isNull())
>+                reifyString();
>+            return m_string;
>+        } else
>+            return makeUnexpected(shrank.error());
>     }
> 
>-    const String& toStringPreserveCapacity() const
>+    WARN_UNUSED_RETURN Fallible<String> toStringPreserveCapacity() const
>     {
>+        if (m_failed)
>+            return makeUnexpected(Failure::UnhandledFailure);
>         if (m_string.isNull())
>             reifyString();
>         return m_string;
>     }
> 
>-    AtomicString toAtomicString() const
>+    WARN_UNUSED_RETURN Fallible<AtomicString> toAtomicString() const
>     {
>+        if (m_failed)
>+            return makeUnexpected(Failure::UnhandledFailure);
>+
>         if (!m_length)
>             return emptyAtom();
> 
>         // If the buffer is sufficiently over-allocated, make a new AtomicString from a copy so its buffer is not so large.
>         if (canShrink()) {
>             if (is8Bit())
>-                return AtomicString(characters8(), length());
>-            return AtomicString(characters16(), length());            
>+                return AtomicString(*characters8(), length());
>+            return AtomicString(*characters16(), length());            
>         }
> 
>         if (!m_string.isNull())
>@@ -261,29 +249,37 @@ public:
> 
>     bool isEmpty() const { return !m_length; }
> 
>-    WTF_EXPORT_PRIVATE void reserveCapacity(unsigned newCapacity);
>+    WTF_EXPORT_PRIVATE Fallible<> reserveCapacity(unsigned newCapacity);
> 
>     unsigned capacity() const
>     {
>         return m_buffer ? m_buffer->length() : m_length;
>     }
> 
>-    WTF_EXPORT_PRIVATE void resize(unsigned newSize);
>+    WTF_EXPORT_PRIVATE Fallible<> resize(unsigned newSize);
> 
>     WTF_EXPORT_PRIVATE bool canShrink() const;
> 
>-    WTF_EXPORT_PRIVATE void shrinkToFit();
>+    WTF_EXPORT_PRIVATE Fallible<> shrinkToFit();
>+
>+    bool is8Bit() const { return m_is8Bit; }
> 
>-    UChar operator[](unsigned i) const
>+    bool failed() const { return m_failed; }
>+
>+    Fallible<UChar> operator[](unsigned i) const
>     {
>+        if (m_failed)
>+            return makeUnexpected(Failure::UnhandledFailure);
>         ASSERT_WITH_SECURITY_IMPLICATION(i < m_length);
>         if (m_is8Bit)
>-            return characters8()[i];
>-        return characters16()[i];
>+            return (*characters8())[i];
>+        return (*characters16())[i];
>     }
> 
>-    const LChar* characters8() const
>+    Fallible<const LChar*> characters8() const
>     {
>+        if (m_failed)
>+            return makeUnexpected(Failure::UnhandledFailure);
>         ASSERT(m_is8Bit);
>         if (!m_length)
>             return 0;
>@@ -293,8 +289,10 @@ public:
>         return m_buffer->characters8();
>     }
> 
>-    const UChar* characters16() const
>+    Fallible<const UChar*> characters16() const
>     {
>+        if (m_failed)
>+            return makeUnexpected(Failure::UnhandledFailure);
>         ASSERT(!m_is8Bit);
>         if (!m_length)
>             return 0;
>@@ -303,16 +301,15 @@ public:
>         ASSERT(m_buffer);
>         return m_buffer->characters16();
>     }
>-    
>-    bool is8Bit() const { return m_is8Bit; }
> 
>     void clear()
>     {
>         m_length = 0;
>         m_string = String();
>         m_buffer = nullptr;
>-        m_bufferCharacters8 = 0;
>         m_is8Bit = true;
>+        m_failed = false;
>+        m_bufferCharacters8 = 0;
>     }
> 
>     void swap(StringBuilder& stringBuilder)
>@@ -321,29 +318,32 @@ public:
>         m_string.swap(stringBuilder.m_string);
>         m_buffer.swap(stringBuilder.m_buffer);
>         std::swap(m_is8Bit, stringBuilder.m_is8Bit);
>+        std::swap(m_failed, stringBuilder.m_failed);
>         std::swap(m_bufferCharacters8, stringBuilder.m_bufferCharacters8);
>         ASSERT(!m_buffer || m_buffer->length() >= m_length);
>     }
> 
> private:
>-    void allocateBuffer(const LChar* currentCharacters, unsigned requiredLength);
>-    void allocateBuffer(const UChar* currentCharacters, unsigned requiredLength);
>-    void allocateBufferUpConvert(const LChar* currentCharacters, unsigned requiredLength);
>-    bool tryAllocateBufferUpConvert(const LChar* currentCharacters, unsigned requiredLength);
>+    Fallible<> allocateBuffer(const LChar* currentCharacters, unsigned requiredLength);
>+    Fallible<> allocateBuffer(const UChar* currentCharacters, unsigned requiredLength);
>+    Fallible<> allocateBufferUpConvert(const LChar* currentCharacters, unsigned requiredLength);
>     template <typename CharType>
>-    void reallocateBuffer(unsigned requiredLength);
>+    Fallible<> reallocateBuffer(unsigned requiredLength);
>     template <typename CharType>
>-    ALWAYS_INLINE CharType* appendUninitialized(unsigned length);
>+    ALWAYS_INLINE Fallible<CharType*> appendUninitialized(unsigned length);
>     template <typename CharType>
>-    CharType* appendUninitializedSlow(unsigned length);
>+    Fallible<CharType*> appendUninitializedSlow(unsigned length);
>     template <typename CharType>
>-    ALWAYS_INLINE CharType * getBufferCharacters();
>+    ALWAYS_INLINE CharType* getBufferCharacters();
>     WTF_EXPORT_PRIVATE void reifyString() const;
>+    WARN_UNUSED_RETURN Unexpected<Failure> wouldOverflow();
>+    WARN_UNUSED_RETURN Unexpected<Failure> outOfMemory();
> 
>-    unsigned m_length;
>+    unsigned m_length { 0 };
>     mutable String m_string;
>     RefPtr<StringImpl> m_buffer;
>-    bool m_is8Bit;
>+    bool m_is8Bit { true };
>+    bool m_failed { false };
>     union {
>         LChar* m_bufferCharacters8;
>         UChar* m_bufferCharacters16;
>@@ -365,20 +365,48 @@ ALWAYS_INLINE UChar* StringBuilder::getBufferCharacters<UChar>()
> }    
> 
> template <typename CharType>
>-bool equal(const StringBuilder& s, const CharType* buffer, unsigned length)
>+inline bool equal(const StringBuilder& s, const CharType* buffer, unsigned length)
> {
>+    if (s.failed())
>+        return false;
>+
>     if (s.length() != length)
>         return false;
> 
>     if (s.is8Bit())
>-        return equal(s.characters8(), buffer, length);
>+        return equal(*s.characters8(), buffer, length);
>+
>+    return equal(*s.characters16(), buffer, length);
>+}
>+
>+inline bool equal(const StringBuilder& a, const StringBuilder& b)
>+{
>+    if (a.failed() || b.failed())
>+        return a.failed() == b.failed();
>+
>+    if (a.length() != b.length())
>+        return false;
>+
>+    if (!a.length())
>+        return true;
> 
>-    return equal(s.characters16(), buffer, length);
>+    if (a.is8Bit()) {
>+        if (b.is8Bit())
>+            return equal(*a.characters8(), *b.characters8(), a.length());
>+        return equal(*a.characters8(), *b.characters16(), a.length());
>+    }
>+
>+    if (b.is8Bit())
>+        return equal(*a.characters16(), *b.characters8(), a.length());
>+    return equal(*a.characters16(), *b.characters16(), a.length());
> }
> 
> template <typename StringType>
>-bool equal(const StringBuilder& a, const StringType& b)
>+inline bool equal(const StringBuilder& a, const StringType& b)
> {
>+    if (a.failed())
>+        return false;
>+
>     if (a.length() != b.length())
>         return false;
> 
>@@ -387,13 +415,13 @@ bool equal(const StringBuilder& a, const StringType& b)
> 
>     if (a.is8Bit()) {
>         if (b.is8Bit())
>-            return equal(a.characters8(), b.characters8(), a.length());
>-        return equal(a.characters8(), b.characters16(), a.length());
>+            return equal(*a.characters8(), b.characters8(), a.length());
>+        return equal(*a.characters8(), b.characters16(), a.length());
>     }
> 
>     if (b.is8Bit())
>-        return equal(a.characters16(), b.characters8(), a.length());
>-    return equal(a.characters16(), b.characters16(), a.length());
>+        return equal(*a.characters16(), b.characters8(), a.length());
>+    return equal(*a.characters16(), b.characters16(), a.length());
> }
> 
> inline bool operator==(const StringBuilder& a, const StringBuilder& b) { return equal(a, b); }
>@@ -404,9 +432,12 @@ inline bool operator==(const String& a, const StringBuilder& b) { return equal(b
> inline bool operator!=(const String& a, const StringBuilder& b) { return !equal(b, a); }
> 
> template<> struct IntegerToStringConversionTrait<StringBuilder> {
>-    using ReturnType = void;
>+    using ReturnType = StringBuilder::Fallible<>;
>     using AdditionalArgumentType = StringBuilder;
>-    static void flush(LChar* characters, unsigned length, StringBuilder* stringBuilder) { stringBuilder->append(characters, length); }
>+    static ReturnType flush(LChar* characters, unsigned length, StringBuilder* stringBuilder)
>+    {
>+        return stringBuilder->append(characters, length);
>+    }
> };
> 
> } // namespace WTF
>diff --git a/Source/WTF/wtf/text/StringBuilderJSON.cpp b/Source/WTF/wtf/text/StringBuilderJSON.cpp
>index 4c2766c..70dbb86 100644
>--- a/Source/WTF/wtf/text/StringBuilderJSON.cpp
>+++ b/Source/WTF/wtf/text/StringBuilderJSON.cpp
>@@ -1,5 +1,5 @@
> /*
>- * Copyright (C) 2010, 2013, 2016 Apple Inc. All rights reserved.
>+ * Copyright (C) 2010-2018 Apple Inc. All rights reserved.
>  * Copyright (C) 2012 Google Inc. All rights reserved.
>  * Copyright (C) 2017 Yusuke Suzuki <utatane.tea@gmail.com>. All rights reserved.
>  * Copyright (C) 2017 Mozilla Foundation. All rights reserved.
>@@ -74,13 +74,7 @@ ALWAYS_INLINE static void appendQuotedJSONStringInternal(OutputCharacterType*& o
>     }
> }
> 
>-void StringBuilder::appendQuotedJSONString(const String& string)
>-{
>-    if (!tryAppendQuotedJSONString(string))
>-        CRASH();
>-}
>-
>-bool StringBuilder::tryAppendQuotedJSONString(const String& string)
>+StringBuilder::Fallible<> StringBuilder::appendQuotedJSONString(const String& string)
> {
>     // Make sure we have enough buffer space to append this string without having
>     // to worry about reallocating in the middle.
>@@ -91,20 +85,21 @@ bool StringBuilder::tryAppendQuotedJSONString(const String& string)
>     maximumCapacityRequired += 2 + stringLength * 6;
>     unsigned allocationSize;
>     if (CheckedState::DidOverflow == maximumCapacityRequired.safeGet(allocationSize))
>-        return false;
>+        return wouldOverflow();
>     // This max() is here to allow us to allocate sizes between the range [2^31, 2^32 - 2] because roundUpToPowerOfTwo(1<<31 + some int smaller than 1<<31) == 0.
>     // FIXME: roundUpToPowerOfTwo should take Checked<unsigned> and abort if it fails to round up.
>     // https://bugs.webkit.org/show_bug.cgi?id=176086
>     allocationSize = std::max(allocationSize, roundUpToPowerOfTwo(allocationSize));
> 
>-    // Allocating this much will definitely fail.
>-    if (allocationSize >= 0x80000000)
>-        return false;
>-
>-    if (is8Bit() && !string.is8Bit())
>-        allocateBufferUpConvert(m_bufferCharacters8, allocationSize);
>-    else
>-        reserveCapacity(allocationSize);
>+    if (is8Bit() && !string.is8Bit()) {
>+        auto allocated = allocateBufferUpConvert(m_bufferCharacters8, allocationSize);
>+        if (!allocated)
>+            return allocated;
>+    } else {
>+        auto reserved = reserveCapacity(allocationSize);
>+        if (!reserved)
>+            return reserved;
>+    }
>     ASSERT(m_buffer->length() >= allocationSize);
> 
>     if (is8Bit()) {
>@@ -125,7 +120,7 @@ bool StringBuilder::tryAppendQuotedJSONString(const String& string)
>         m_length = output - m_bufferCharacters16;
>     }
>     ASSERT(m_buffer->length() >= m_length);
>-    return true;
>+    return { };
> }
> 
> } // namespace WTF
>diff --git a/Source/WTF/wtf/text/StringImpl.cpp b/Source/WTF/wtf/text/StringImpl.cpp
>index 774876b..eed09aa 100644
>--- a/Source/WTF/wtf/text/StringImpl.cpp
>+++ b/Source/WTF/wtf/text/StringImpl.cpp
>@@ -206,22 +206,24 @@ Ref<StringImpl> StringImpl::createUninitialized(unsigned length, UChar*& data)
>     return createUninitializedInternal(length, data);
> }
> 
>-template<typename CharacterType> inline Ref<StringImpl> StringImpl::reallocateInternal(Ref<StringImpl>&& originalString, unsigned length, CharacterType*& data)
>+template<typename CharacterType> inline RefPtr<StringImpl> StringImpl::reallocateInternal(Ref<StringImpl>&& originalString, unsigned length, CharacterType*& data)
> {
>     ASSERT(originalString->hasOneRef());
>     ASSERT(originalString->bufferOwnership() == BufferInternal);
> 
>     if (!length) {
>         data = 0;
>-        return *empty();
>+        return empty();
>     }
> 
>     // Same as createUninitialized() except here we use stringRealloc.
>-    if (length > ((std::numeric_limits<unsigned>::max() - sizeof(StringImpl)) / sizeof(CharacterType)))
>-        CRASH();
>+    if (UNLIKELY(length > ((std::numeric_limits<unsigned>::max() - sizeof(StringImpl)) / sizeof(CharacterType))))
>+        return nullptr;
> 
>     originalString->~StringImpl();
>     auto* string = static_cast<StringImpl*>(stringRealloc(&originalString.leakRef(), allocationSize<CharacterType>(length)));
>+    if (UNLIKELY(!string))
>+        return nullptr;
> 
>     data = string->tailPointer<CharacterType>();
>     return constructInternal<CharacterType>(*string, length);
>@@ -230,13 +232,33 @@ template<typename CharacterType> inline Ref<StringImpl> StringImpl::reallocateIn
> Ref<StringImpl> StringImpl::reallocate(Ref<StringImpl>&& originalString, unsigned length, LChar*& data)
> {
>     ASSERT(originalString->is8Bit());
>-    return reallocateInternal(WTFMove(originalString), length, data);
>+    if (auto reallocated = reallocateInternal(WTFMove(originalString), length, data))
>+        return *reallocated;
>+    CRASH();
> }
> 
> Ref<StringImpl> StringImpl::reallocate(Ref<StringImpl>&& originalString, unsigned length, UChar*& data)
> {
>     ASSERT(!originalString->is8Bit());
>-    return reallocateInternal(WTFMove(originalString), length, data);
>+    if (auto reallocated = reallocateInternal(WTFMove(originalString), length, data))
>+        return *reallocated;
>+    CRASH();
>+}
>+
>+RefPtr<StringImpl> StringImpl::tryReallocate(Ref<StringImpl>&& originalString, unsigned length, LChar*& data)
>+{
>+    ASSERT(originalString->is8Bit());
>+    if (auto reallocated = reallocateInternal(WTFMove(originalString), length, data))
>+        return reallocated.get();
>+    return nullptr;
>+}
>+
>+RefPtr<StringImpl> StringImpl::tryReallocate(Ref<StringImpl>&& originalString, unsigned length, UChar*& data)
>+{
>+    ASSERT(!originalString->is8Bit());
>+    if (auto reallocated = reallocateInternal(WTFMove(originalString), length, data))
>+        return reallocated.get();
>+    return nullptr;
> }
> 
> template<typename CharacterType> inline Ref<StringImpl> StringImpl::createInternal(const CharacterType* characters, unsigned length)
>diff --git a/Source/WTF/wtf/text/StringImpl.h b/Source/WTF/wtf/text/StringImpl.h
>index 616da25..8df9e35 100644
>--- a/Source/WTF/wtf/text/StringImpl.h
>+++ b/Source/WTF/wtf/text/StringImpl.h
>@@ -229,6 +229,7 @@ public:
>     WTF_EXPORT_PRIVATE static Ref<StringImpl> create(const LChar*);
>     ALWAYS_INLINE static Ref<StringImpl> create(const char* string) { return create(reinterpret_cast<const LChar*>(string)); }
> 
>+    static RefPtr<StringImpl> tryCreateSubstringSharingImpl(StringImpl&, unsigned offset, unsigned length);
>     static Ref<StringImpl> createSubstringSharingImpl(StringImpl&, unsigned offset, unsigned length);
> 
>     template<unsigned characterCount> static Ref<StringImpl> createFromLiteral(const char (&)[characterCount]);
>@@ -248,6 +249,8 @@ public:
>     // the originalString can't be used after this function.
>     static Ref<StringImpl> reallocate(Ref<StringImpl>&& originalString, unsigned length, LChar*& data);
>     static Ref<StringImpl> reallocate(Ref<StringImpl>&& originalString, unsigned length, UChar*& data);
>+    static RefPtr<StringImpl> tryReallocate(Ref<StringImpl>&& originalString, unsigned length, LChar*& data);
>+    static RefPtr<StringImpl> tryReallocate(Ref<StringImpl>&& originalString, unsigned length, UChar*& data);
> 
>     static unsigned flagsOffset() { return OBJECT_OFFSETOF(StringImpl, m_hashAndFlags); }
>     static unsigned flagIs8Bit() { return s_hashFlag8BitBuffer; }
>@@ -503,7 +506,7 @@ private:
>     template<typename CharacterType> static Ref<StringImpl> constructInternal(StringImpl&, unsigned);
>     template<typename CharacterType> static Ref<StringImpl> createUninitializedInternal(unsigned, CharacterType*&);
>     template<typename CharacterType> static Ref<StringImpl> createUninitializedInternalNonEmpty(unsigned, CharacterType*&);
>-    template<typename CharacterType> static Ref<StringImpl> reallocateInternal(Ref<StringImpl>&&, unsigned, CharacterType*&);
>+    template<typename CharacterType> static RefPtr<StringImpl> reallocateInternal(Ref<StringImpl>&&, unsigned, CharacterType*&);
>     template<typename CharacterType> static Ref<StringImpl> createInternal(const CharacterType*, unsigned);
>     WTF_EXPORT_PRIVATE NEVER_INLINE unsigned hashSlowCase() const;
> 
>@@ -914,22 +917,31 @@ template<size_t inlineCapacity> inline Ref<StringImpl> StringImpl::create8BitIfP
>     return create8BitIfPossible(vector.data(), vector.size());
> }
> 
>-ALWAYS_INLINE Ref<StringImpl> StringImpl::createSubstringSharingImpl(StringImpl& rep, unsigned offset, unsigned length)
>+ALWAYS_INLINE RefPtr<StringImpl> StringImpl::tryCreateSubstringSharingImpl(StringImpl& rep, unsigned offset, unsigned length)
> {
>     ASSERT(length <= rep.length());
> 
>     if (!length)
>-        return *empty();
>+        return empty();
> 
>     auto* ownerRep = ((rep.bufferOwnership() == BufferSubstring) ? rep.substringBuffer() : &rep);
> 
>     // We allocate a buffer that contains both the StringImpl struct as well as the pointer to the owner string.
>     auto* stringImpl = static_cast<StringImpl*>(stringMalloc(allocationSize<StringImpl*>(1)));
>+    if (!stringImpl)
>+        return nullptr;
>     if (rep.is8Bit())
>         return adoptRef(*new (NotNull, stringImpl) StringImpl(rep.m_data8 + offset, length, *ownerRep));
>     return adoptRef(*new (NotNull, stringImpl) StringImpl(rep.m_data16 + offset, length, *ownerRep));
> }
> 
>+ALWAYS_INLINE Ref<StringImpl> StringImpl::createSubstringSharingImpl(StringImpl& rep, unsigned offset, unsigned length)
>+{
>+    if (auto created = tryCreateSubstringSharingImpl(rep, offset, length))
>+        return *created;
>+    CRASH();
>+}
>+
> template<unsigned characterCount> ALWAYS_INLINE Ref<StringImpl> StringImpl::createFromLiteral(const char (&characters)[characterCount])
> {
>     COMPILE_ASSERT(characterCount > 1, StringImplFromLiteralNotEmpty);
>diff --git a/Source/WTF/wtf/text/TextStream.cpp b/Source/WTF/wtf/text/TextStream.cpp
>index aaf6194..d3b5318 100644
>--- a/Source/WTF/wtf/text/TextStream.cpp
>+++ b/Source/WTF/wtf/text/TextStream.cpp
>@@ -132,9 +132,11 @@ TextStream& TextStream::operator<<(const FormatNumberRespectingIntegers& numberT
> 
> String TextStream::release()
> {
>-    String result = m_text.toString();
>-    m_text.clear();
>-    return result;
>+    if (auto result = m_text.toString()) {
>+        m_text.clear();
>+        return *result;
>+    }
>+    CRASH();
> }
> 
> void TextStream::startGroup()
>diff --git a/Source/WebCore/ChangeLog b/Source/WebCore/ChangeLog
>index 2a5ab73..1b73286 100644
>--- a/Source/WebCore/ChangeLog
>+++ b/Source/WebCore/ChangeLog
>@@ -1,3 +1,513 @@
>+2018-04-26  JF Bastien  <jfbastien@apple.com>
>+
>+        StringBuilder is fallible
>+        https://bugs.webkit.org/show_bug.cgi?id=185048
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        StringBuilder can fail when allocating memory. StringBuilder is
>+        mostly used with user input, which often means that just crashing
>+        isn't the right outcome. Our fuzzers often encounter such things
>+        for JavaScriptCore, and so far we've applied point solutions. No
>+        more!
>+
>+
>+        * Modules/applepay/cocoa/PaymentContactCocoa.mm:
>+        (WebCore::convert):
>+        * Modules/entriesapi/DOMFileSystem.cpp:
>+        (WebCore::resolveRelativeVirtualPath):
>+        * Modules/geolocation/Geolocation.cpp:
>+        (WebCore::logError):
>+        * Modules/indexeddb/IDBKeyData.cpp:
>+        (WebCore::IDBKeyData::loggingString const):
>+        * Modules/indexeddb/IDBKeyPath.cpp:
>+        (WebCore::loggingString):
>+        * Modules/indexeddb/server/IndexValueStore.cpp:
>+        (WebCore::IDBServer::IndexValueStore::loggingString const):
>+        * Modules/indexeddb/server/SQLiteIDBCursor.cpp:
>+        (WebCore::IDBServer::buildIndexStatement):
>+        (WebCore::IDBServer::buildObjectStoreStatement):
>+        * Modules/indexeddb/shared/IDBDatabaseInfo.cpp:
>+        (WebCore::IDBDatabaseInfo::loggingString const):
>+        * Modules/indexeddb/shared/IDBObjectStoreInfo.cpp:
>+        (WebCore::IDBObjectStoreInfo::loggingString const):
>+        * Modules/mediasession/WebMediaSessionManager.cpp:
>+        (WebCore::mediaProducerStateString):
>+        (WebCore::WebMediaSessionManager::toString):
>+        * Modules/mediastream/PeerConnectionBackend.cpp:
>+        (WebCore::filterICECandidate):
>+        (WebCore::PeerConnectionBackend::filterSDP const):
>+        * Modules/plugins/YouTubePluginReplacement.cpp:
>+        (WebCore::YouTubePluginReplacement::youTubeURLFromAbsoluteURL):
>+        * Modules/webdatabase/DatabaseTracker.cpp:
>+        (WebCore::generateDatabaseFileName):
>+        * Modules/websockets/WebSocket.cpp:
>+        (WebCore::encodeProtocolString):
>+        (WebCore::joinStrings):
>+        * Modules/websockets/WebSocketExtensionDispatcher.cpp:
>+        (WebCore::WebSocketExtensionDispatcher::createHeaderValue const):
>+        (WebCore::WebSocketExtensionDispatcher::acceptedExtensions const):
>+        * Modules/websockets/WebSocketHandshake.cpp:
>+        (WebCore::resourceName):
>+        (WebCore::hostName):
>+        (WebCore::WebSocketHandshake::clientLocation const):
>+        (WebCore::WebSocketHandshake::clientHandshakeMessage const):
>+        * accessibility/AccessibilityNodeObject.cpp:
>+        (WebCore::shouldAddSpaceBeforeAppendingNextElement):
>+        (WebCore::AccessibilityNodeObject::textUnderElement const):
>+        (WebCore::AccessibilityNodeObject::accessibilityDescriptionForChildren const):
>+        (WebCore::AccessibilityNodeObject::accessibilityDescriptionForElements const):
>+        * accessibility/AccessibilityObject.cpp:
>+        (WebCore::AccessibilityObject::stringForRange const):
>+        (WebCore::AccessibilityObject::stringForVisiblePositionRange):
>+        * accessibility/mac/WebAccessibilityObjectWrapperMac.mm:
>+        (-[WebAccessibilityObjectWrapper valueDescriptionForMeter]):
>+        (formatForDebugger):
>+        * bindings/js/JSDOMConvertStrings.cpp:
>+        (WebCore::stringToUSVString):
>+        * bindings/js/JSDOMExceptionHandling.cpp:
>+        (WebCore::throwArgumentMustBeEnumError):
>+        (WebCore::throwArgumentMustBeFunctionError):
>+        (WebCore::throwArgumentTypeError):
>+        (WebCore::throwRequiredMemberTypeError):
>+        * contentextensions/CombinedURLFilters.cpp:
>+        (WebCore::ContentExtensions::prefixTreeVertexToString):
>+        * contentextensions/ContentExtension.cpp:
>+        (WebCore::ContentExtensions::ContentExtension::compileGlobalDisplayNoneStyleSheet):
>+        * contentextensions/ContentExtensionCompiler.cpp:
>+        (WebCore::ContentExtensions::resolvePendingDisplayNoneActions):
>+        * contentextensions/ContentExtensionStyleSheet.cpp:
>+        (WebCore::ContentExtensions::ContentExtensionStyleSheet::addDisplayNoneSelector):
>+        * contentextensions/Term.h:
>+        (WebCore::ContentExtensions::Term::toString const):
>+        * css/CSSAnimationTriggerScrollValue.cpp:
>+        (WebCore::CSSAnimationTriggerScrollValue::customCSSText const):
>+        * css/CSSBasicShapes.cpp:
>+        (WebCore::buildCircleString):
>+        (WebCore::buildEllipseString):
>+        (WebCore::buildPathString):
>+        (WebCore::buildPolygonString):
>+        (WebCore::buildInsetString):
>+        * css/CSSCalculationValue.cpp:
>+        (WebCore::buildCssText):
>+        * css/CSSComputedStyleDeclaration.cpp:
>+        (WebCore::CSSComputedStyleDeclaration::cssText const):
>+        * css/CSSCrossfadeValue.cpp:
>+        (WebCore::CSSCrossfadeValue::customCSSText const):
>+        * css/CSSCursorImageValue.cpp:
>+        (WebCore::CSSCursorImageValue::customCSSText const):
>+        * css/CSSCustomIdentValue.cpp:
>+        (WebCore::CSSCustomIdentValue::customCSSText const):
>+        * css/CSSFilterImageValue.cpp:
>+        (WebCore::CSSFilterImageValue::customCSSText const):
>+        * css/CSSFontFaceRule.cpp:
>+        (WebCore::CSSFontFaceRule::cssText const):
>+        * css/CSSFontFaceSrcValue.cpp:
>+        (WebCore::CSSFontFaceSrcValue::customCSSText const):
>+        * css/CSSFontFeatureValue.cpp:
>+        (WebCore::CSSFontFeatureValue::customCSSText const):
>+        * css/CSSFontStyleRangeValue.cpp:
>+        (WebCore::CSSFontStyleRangeValue::customCSSText const):
>+        * css/CSSFontStyleValue.cpp:
>+        (WebCore::CSSFontStyleValue::customCSSText const):
>+        * css/CSSFontValue.cpp:
>+        (WebCore::CSSFontValue::customCSSText const):
>+        * css/CSSFontVariationValue.cpp:
>+        (WebCore::CSSFontVariationValue::customCSSText const):
>+        * css/CSSFunctionValue.cpp:
>+        (WebCore::CSSFunctionValue::customCSSText const):
>+        * css/CSSGradientValue.cpp:
>+        (WebCore::CSSLinearGradientValue::customCSSText const):
>+        (WebCore::CSSRadialGradientValue::customCSSText const):
>+        (WebCore::CSSConicGradientValue::customCSSText const):
>+        * css/CSSGridAutoRepeatValue.cpp:
>+        (WebCore::CSSGridAutoRepeatValue::customCSSText const):
>+        * css/CSSGridTemplateAreasValue.cpp:
>+        (WebCore::CSSGridTemplateAreasValue::customCSSText const):
>+        * css/CSSImageSetValue.cpp:
>+        (WebCore::CSSImageSetValue::customCSSText const):
>+        * css/CSSImportRule.cpp:
>+        (WebCore::CSSImportRule::cssText const):
>+        * css/CSSKeyframeRule.cpp:
>+        (WebCore::StyleRuleKeyframe::keyText const):
>+        (WebCore::StyleRuleKeyframe::cssText const):
>+        * css/CSSKeyframesRule.cpp:
>+        (WebCore::CSSKeyframesRule::cssText const):
>+        * css/CSSLineBoxContainValue.cpp:
>+        (WebCore::CSSLineBoxContainValue::customCSSText const):
>+        * css/CSSMarkup.cpp:
>+        (WebCore::serializeString):
>+        (WebCore::serializeAsStringOrCustomIdent):
>+        * css/CSSMediaRule.cpp:
>+        (WebCore::CSSMediaRule::cssText const):
>+        * css/CSSNamespaceRule.cpp:
>+        (WebCore::CSSNamespaceRule::cssText const):
>+        * css/CSSPageRule.cpp:
>+        (WebCore::CSSPageRule::selectorText const):
>+        (WebCore::CSSPageRule::cssText const):
>+        * css/CSSPrimitiveValue.cpp:
>+        (WebCore::CSSPrimitiveValue::formatNumberForCustomCSSText const):
>+        * css/CSSPropertySourceData.cpp:
>+        (WebCore::CSSPropertySourceData::toString const):
>+        * css/CSSSelector.cpp:
>+        (WebCore::CSSSelector::selectorText const):
>+        * css/CSSSelectorList.cpp:
>+        (WebCore::CSSSelectorList::selectorsText const):
>+        * css/CSSShadowValue.cpp:
>+        (WebCore::CSSShadowValue::customCSSText const):
>+        * css/CSSStyleRule.cpp:
>+        (WebCore::CSSStyleRule::cssText const):
>+        * css/CSSStyleSheet.cpp:
>+        (WebCore::CSSStyleSheet::addRule):
>+        * css/CSSSupportsRule.cpp:
>+        (WebCore::CSSSupportsRule::cssText const):
>+        * css/CSSTimingFunctionValue.cpp:
>+        (WebCore::CSSCubicBezierTimingFunctionValue::customCSSText const):
>+        (WebCore::CSSStepsTimingFunctionValue::customCSSText const):
>+        (WebCore::CSSFramesTimingFunctionValue::customCSSText const):
>+        (WebCore::CSSSpringTimingFunctionValue::customCSSText const):
>+        * css/CSSValueList.cpp:
>+        (WebCore::CSSValueList::customCSSText const):
>+        * css/CSSVariableData.cpp:
>+        (WebCore::CSSVariableData::consumeAndUpdateTokens):
>+        * css/DOMCSSNamespace.cpp:
>+        (WebCore::DOMCSSNamespace::escape):
>+        * css/DOMMatrixReadOnly.cpp:
>+        (WebCore::DOMMatrixReadOnly::toString const):
>+        * css/DeprecatedCSSOMValueList.cpp:
>+        (WebCore::DeprecatedCSSOMValueList::cssText const):
>+        * css/FontFace.cpp:
>+        (WebCore::FontFace::style const):
>+        (WebCore::FontFace::weight const):
>+        (WebCore::FontFace::stretch const):
>+        * css/MediaList.cpp:
>+        (WebCore::MediaQuerySet::mediaText const):
>+        * css/MediaQuery.cpp:
>+        (WebCore::MediaQuery::serialize const):
>+        * css/MediaQueryExpression.cpp:
>+        (WebCore::MediaQueryExpression::serialize const):
>+        * css/Rect.h:
>+        * css/StyleProperties.cpp:
>+        (WebCore::StyleProperties::fontValue const):
>+        (WebCore::StyleProperties::get4Values const):
>+        (WebCore::StyleProperties::getLayeredShorthandValue const):
>+        (WebCore::StyleProperties::getShorthandValue const):
>+        (WebCore::StyleProperties::borderPropertyValue const):
>+        (WebCore::StyleProperties::asText const):
>+        (WebCore::StyleProperties::PropertyReference::cssText const):
>+        * css/WebKitCSSMatrix.cpp:
>+        (WebCore::WebKitCSSMatrix::toString const):
>+        * css/WebKitCSSViewportRule.cpp:
>+        (WebCore::WebKitCSSViewportRule::cssText const):
>+        * css/parser/CSSParser.cpp:
>+        (WebCore::CSSParser::parseFontFaceDescriptor):
>+        * css/parser/CSSParserToken.cpp:
>+        (WebCore::CSSParserToken::serialize const):
>+        * css/parser/CSSParserTokenRange.cpp:
>+        (WebCore::CSSParserTokenRange::serialize const):
>+        * css/parser/CSSPropertyParser.cpp:
>+        (WebCore::concatenateFamilyName):
>+        (WebCore::parseGridTemplateAreasColumnNames):
>+        * css/parser/CSSTokenizer.cpp:
>+        (WebCore::CSSTokenizer::consumeStringTokenUntil):
>+        (WebCore::CSSTokenizer::consumeUrlToken):
>+        (WebCore::CSSTokenizer::consumeName):
>+        (WebCore::CSSTokenizer::consumeEscape):
>+        * dom/DatasetDOMStringMap.cpp:
>+        (WebCore::convertAttributeNameToPropertyName):
>+        * dom/Element.cpp:
>+        (WebCore::Element::formatForDebugger const):
>+        * dom/Node.cpp:
>+        (WebCore::Node::textContent const):
>+        (WebCore::Node::showNode const):
>+        (WebCore::traverseTreeAndMark):
>+        * dom/Position.cpp:
>+        (WebCore::Position::formatForDebugger const):
>+        * dom/Range.cpp:
>+        (WebCore::Range::toString const):
>+        (WebCore::Range::formatForDebugger const):
>+        * dom/ScriptedAnimationController.cpp:
>+        (WebCore::throttlingReasonsToString):
>+        * dom/SecurityContext.cpp:
>+        (WebCore::SecurityContext::parseSandboxPolicy):
>+        * dom/Text.cpp:
>+        (WebCore::Text::wholeText const):
>+        (WebCore::Text::formatForDebugger const):
>+        * dom/TextNodeTraversal.cpp:
>+        (WebCore::TextNodeTraversal::contentsAsString):
>+        (WebCore::TextNodeTraversal::childTextContent):
>+        * editing/ApplyStyleCommand.cpp:
>+        (WebCore::ApplyStyleCommand::addBlockStyle):
>+        * editing/Editing.cpp:
>+        (WebCore::stringWithRebalancedWhitespace):
>+        * editing/HTMLInterchange.cpp:
>+        (WebCore::convertHTMLTextToInterchangeFormat):
>+        * editing/MarkupAccumulator.cpp:
>+        (WebCore::MarkupAccumulator::serializeNodes):
>+        (WebCore::MarkupAccumulator::generateUniquePrefix):
>+        * editing/TextIterator.cpp:
>+        (WebCore::plainText):
>+        * editing/TypingCommand.cpp:
>+        (WebCore::TypingCommand::inputEventDataTransfer const):
>+        * editing/VisibleSelection.cpp:
>+        (WebCore::VisibleSelection::formatForDebugger const):
>+        * editing/cocoa/DataDetection.mm:
>+        (WebCore::dataDetectorStringForPath):
>+        * editing/cocoa/HTMLConverter.mm:
>+        (HTMLConverter::_processText):
>+        * editing/markup.cpp:
>+        (WebCore::StyledMarkupAccumulator::wrapWithNode):
>+        (WebCore::StyledMarkupAccumulator::wrapWithStyleNode):
>+        (WebCore::StyledMarkupAccumulator::takeResults):
>+        (WebCore::StyledMarkupAccumulator::appendText):
>+        (WebCore::sanitizedMarkupForFragmentInDocument):
>+        (WebCore::urlToMarkup):
>+        * fileapi/FileReaderLoader.cpp:
>+        (WebCore::FileReaderLoader::convertToDataURL):
>+        * html/DOMTokenList.cpp:
>+        (WebCore::DOMTokenList::updateAssociatedAttributeFromTokens):
>+        * html/EmailInputType.cpp:
>+        (WebCore::EmailInputType::sanitizeValue const):
>+        * html/FileInputType.cpp:
>+        (WebCore::FileInputType::defaultToolTip const):
>+        * html/FormController.cpp:
>+        (WebCore::formSignature):
>+        * html/HTMLAnchorElement.cpp:
>+        (WebCore::HTMLAnchorElement::handleClick):
>+        * html/HTMLCanvasElement.cpp:
>+        (WebCore::HTMLCanvasElement::createContext2d):
>+        (WebCore::HTMLCanvasElement::createImageBuffer const):
>+        * html/HTMLFontElement.cpp:
>+        (WebCore::parseFontSize):
>+        * html/HTMLImageElement.cpp:
>+        (WebCore::HTMLImageElement::completeURLsInAttributeValue const):
>+        * html/HTMLMediaElement.cpp:
>+        (WebCore::actionName):
>+        * html/HTMLOptionElement.cpp:
>+        (WebCore::HTMLOptionElement::collectOptionInnerText const):
>+        * html/HTMLTextFormControlElement.cpp:
>+        (WebCore::HTMLTextFormControlElement::strippedPlaceholder const):
>+        (WebCore::innerTextValueFrom):
>+        (WebCore::HTMLTextFormControlElement::valueWithHardLineBreaks const):
>+        * html/MediaDocument.cpp:
>+        (WebCore::MediaDocumentParser::createDocumentStructure):
>+        * html/MediaElementSession.cpp:
>+        (WebCore::restrictionName):
>+        * html/MediaFragmentURIParser.cpp:
>+        (WebCore::collectDigits):
>+        (WebCore::collectFraction):
>+        * html/TypeAhead.cpp:
>+        (WebCore::TypeAhead::handleEvent):
>+        * html/canvas/CanvasRenderingContext2D.cpp:
>+        (WebCore::CanvasRenderingContext2D::font const):
>+        * html/canvas/CanvasRenderingContext2DBase.cpp:
>+        (WebCore::CanvasRenderingContext2DBase::getImageData const):
>+        * html/canvas/WebGLRenderingContextBase.cpp:
>+        * html/parser/HTMLSourceTracker.cpp:
>+        (WebCore::HTMLSourceTracker::source):
>+        * html/parser/HTMLTokenizer.cpp:
>+        (WebCore::HTMLTokenizer::processEntity):
>+        (WebCore::HTMLTokenizer::processToken):
>+        (WebCore::HTMLTokenizer::bufferedCharacters const):
>+        * html/parser/HTMLTreeBuilder.cpp:
>+        (WebCore::HTMLTreeBuilder::defaultForInTableText):
>+        * html/parser/XSSAuditorDelegate.cpp:
>+        (WebCore::buildConsoleError):
>+        * html/track/BufferedLineReader.cpp:
>+        (WebCore::BufferedLineReader::nextLine):
>+        * html/track/TrackBase.cpp:
>+        (WebCore::TrackBase::setLanguage):
>+        * html/track/VTTCue.cpp:
>+        (WebCore::VTTCue::determineTextDirection):
>+        * html/track/WebVTTParser.cpp:
>+        (WebCore::WebVTTParser::createNewCue):
>+        * html/track/WebVTTTokenizer.cpp:
>+        (WebCore::WebVTTTokenizer::nextToken):
>+        * inspector/InspectorStyleSheet.cpp:
>+        (WebCore::InspectorStyle::shorthandValue const):
>+        * inspector/agents/InspectorApplicationCacheAgent.cpp:
>+        (WebCore::InspectorApplicationCacheAgent::buildObjectForApplicationCacheResource):
>+        * inspector/agents/InspectorNetworkAgent.cpp:
>+        * inspector/agents/WebConsoleAgent.cpp:
>+        (WebCore::WebConsoleAgent::didFailLoading):
>+        * loader/CrossOriginAccessControl.cpp:
>+        (WebCore::createAccessControlPreflightRequest):
>+        * loader/ResourceLoadStatistics.cpp:
>+        (WebCore::ResourceLoadStatistics::toString const):
>+        * loader/appcache/ApplicationCacheStorage.cpp:
>+        (WebCore::ApplicationCacheStorage::store):
>+        * loader/archive/cf/LegacyWebArchive.cpp:
>+        (WebCore::LegacyWebArchive::createFromSelection):
>+        * loader/archive/mhtml/MHTMLArchive.cpp:
>+        (WebCore::generateRandomBoundary):
>+        (WebCore::replaceNonPrintableCharacters):
>+        * page/CaptionUserPreferencesMediaAF.cpp:
>+        (WebCore::CaptionUserPreferencesMediaAF::windowRoundedCornerRadiusCSS const):
>+        (WebCore::CaptionUserPreferencesMediaAF::colorPropertyCSS const):
>+        (WebCore::CaptionUserPreferencesMediaAF::captionsTextEdgeCSS const):
>+        (WebCore::CaptionUserPreferencesMediaAF::captionsDefaultFontCSS const):
>+        (WebCore::CaptionUserPreferencesMediaAF::captionsStyleSheetOverride const):
>+        (WebCore::trackDisplayName):
>+        * page/Frame.cpp:
>+        (WebCore::createRegExpForLabels):
>+        * page/FrameTree.cpp:
>+        (WebCore::FrameTree::uniqueChildName const):
>+        * page/FrameView.cpp:
>+        (WebCore::FrameView::logMockScrollAnimatorMessage const):
>+        * page/PageSerializer.cpp:
>+        (WebCore::PageSerializer::serializeCSSStyleSheet):
>+        * page/PerformanceLoggingClient.cpp:
>+        (WebCore::PerformanceLoggingClient::synchronousScrollingReasonsAsString):
>+        * page/SecurityOriginData.cpp:
>+        (WebCore::SecurityOriginData::databaseIdentifier const):
>+        * page/WheelEventTestTrigger.cpp:
>+        (WebCore::dumpState):
>+        * page/csp/ContentSecurityPolicy.cpp:
>+        (WebCore::consoleMessageForViolation):
>+        (WebCore::ContentSecurityPolicy::allowRunningOrDisplayingInsecureContent):
>+        * page/scrolling/AxisScrollSnapOffsets.cpp:
>+        (WebCore::snapOffsetsToString):
>+        (WebCore::snapOffsetRangesToString):
>+        * page/scrolling/ScrollingCoordinator.cpp:
>+        (WebCore::ScrollingCoordinator::synchronousScrollingReasonsAsText):
>+        * platform/Decimal.cpp:
>+        (WebCore::Decimal::toString const):
>+        * platform/FileSystem.cpp:
>+        (WebCore::FileSystem::encodeForFileName):
>+        (WebCore::FileSystem::decodeFromFilename):
>+        * platform/PODInterval.h:
>+        * platform/PODRedBlackTree.h:
>+        (WebCore::PODRedBlackTree::dumpFromNode const):
>+        * platform/URL.cpp:
>+        (WebCore::URL::setHost):
>+        (WebCore::URL::setHostAndPort):
>+        (WebCore::percentEncodeCharacters):
>+        * platform/animation/TimingFunction.cpp:
>+        (WebCore::TimingFunction::createFromCSSText):
>+        * platform/glib/FileSystemGlib.cpp:
>+        (WebCore::FileSystem::pathByAppendingComponents):
>+        * platform/graphics/Color.cpp:
>+        (WebCore::Color::serialized const):
>+        (WebCore::Color::cssText const):
>+        * platform/graphics/ExtendedColor.cpp:
>+        (WebCore::ExtendedColor::cssText const):
>+        * platform/graphics/FontCascade.cpp:
>+        (WebCore::normalizeSpacesInternal):
>+        * platform/graphics/FontTaggedSettings.cpp:
>+        (WebCore::operator<<):
>+        * platform/graphics/GraphicsLayer.cpp:
>+        (WebCore::GraphicsLayer::animationNameForTransition):
>+        * platform/graphics/avfoundation/InbandTextTrackPrivateAVF.cpp:
>+        (WebCore::InbandTextTrackPrivateAVF::processCueAttributes):
>+        (WebCore::InbandTextTrackPrivateAVF::processNativeSamples):
>+        * platform/graphics/ca/TileController.cpp:
>+        (WebCore::TileController::createTileLayer):
>+        * platform/graphics/ca/TileGrid.cpp:
>+        (WebCore::validationPolicyAsString):
>+        * platform/graphics/ca/win/PlatformCALayerWin.cpp:
>+        (PlatformCALayerWin::layerTreeAsString const):
>+        * platform/graphics/cv/VideoTextureCopierCV.cpp:
>+        (WebCore::VideoTextureCopierCV::initializeContextObjects):
>+        * platform/graphics/opengl/GraphicsContext3DOpenGLCommon.cpp:
>+        (WebCore::generateHashedName):
>+        (WebCore::GraphicsContext3D::getUnmangledInfoLog):
>+        * platform/mac/PasteboardMac.mm:
>+        (WebCore::joinPathnames):
>+        * platform/mac/StringUtilities.mm:
>+        (WebCore::wildcardRegexPatternString):
>+        * platform/mock/ScrollAnimatorMock.cpp:
>+        (WebCore::ScrollAnimatorMock::mouseEnteredScrollbar const):
>+        (WebCore::ScrollAnimatorMock::mouseExitedScrollbar const):
>+        (WebCore::ScrollAnimatorMock::mouseIsDownInScrollbar const):
>+        * platform/mock/mediasource/MockBox.cpp:
>+        (WebCore::MockBox::peekType):
>+        (WebCore::MockTrackBox::MockTrackBox):
>+        * platform/network/HTTPParsers.cpp:
>+        (WebCore::extractMIMETypeFromMediaType):
>+        * platform/network/ProxyServer.cpp:
>+        (WebCore::toString):
>+        * platform/network/mac/CookieJarMac.mm:
>+        (WebCore::cookiesForSession):
>+        * platform/posix/FileSystemPOSIX.cpp:
>+        (WebCore::FileSystem::pathByAppendingComponents):
>+        * platform/text/DecodeEscapeSequences.h:
>+        (WebCore::Unicode16BitEscapeSequence::decodeRun):
>+        (WebCore::decodeEscapeSequences):
>+        * platform/text/PlatformLocale.cpp:
>+        (WebCore::Locale::convertToLocalizedNumber):
>+        (WebCore::Locale::convertFromLocalizedNumber):
>+        (WebCore::Locale::formatDateTime):
>+        * platform/text/SegmentedString.cpp:
>+        (WebCore::SegmentedString::toString const):
>+        * platform/text/TextCodecICU.cpp:
>+        (WebCore::TextCodecICU::decode):
>+        * platform/text/TextCodecUserDefined.cpp:
>+        (WebCore::TextCodecUserDefined::decode):
>+        * plugins/DOMMimeType.cpp:
>+        (WebCore::DOMMimeType::suffixes const):
>+        * rendering/RenderLayer.cpp:
>+        (WebCore::RenderLayer::name const):
>+        * rendering/RenderLayerCompositor.cpp:
>+        (WebCore::RenderLayerCompositor::logLayerInfo):
>+        * rendering/RenderListMarker.cpp:
>+        (WebCore::listMarkerText):
>+        (WebCore::RenderListMarker::paint):
>+        * rendering/RenderText.cpp:
>+        (WebCore::capitalize):
>+        (WebCore::maxWordFragmentWidth):
>+        * rendering/RenderTreeAsText.cpp:
>+        (WebCore::quoteAndEscapeNonPrintables):
>+        (WebCore::nodePosition):
>+        * rendering/mathml/RenderMathMLFenced.cpp:
>+        (WebCore::RenderMathMLFenced::updateFromElement):
>+        * rendering/updating/RenderTreeBuilderMathML.cpp:
>+        (WebCore::RenderTreeBuilder::MathML::attach):
>+        * svg/SVGLengthListValues.cpp:
>+        (WebCore::SVGLengthListValues::valueAsString const):
>+        * svg/SVGNumberListValues.cpp:
>+        (WebCore::SVGNumberListValues::valueAsString const):
>+        * svg/SVGPathStringBuilder.cpp:
>+        (WebCore::SVGPathStringBuilder::result):
>+        * svg/SVGPathUtilities.cpp:
>+        (WebCore::buildStringFromPath):
>+        * svg/SVGPointListValues.cpp:
>+        (WebCore::SVGPointListValues::valueAsString const):
>+        * svg/SVGStringListValues.cpp:
>+        (WebCore::SVGStringListValues::valueAsString const):
>+        * svg/SVGTransformListValues.cpp:
>+        (WebCore::SVGTransformListValues::valueAsString const):
>+        * svg/SVGTransformValue.cpp:
>+        (WebCore::SVGTransformValue::valueAsString const):
>+        * svg/properties/SVGPropertyTraits.h:
>+        (WebCore::SVGPropertyTraits<FloatPoint>::toString):
>+        (WebCore::SVGPropertyTraits<FloatRect>::toString):
>+        * testing/Internals.cpp:
>+        (WebCore::Internals::dumpMarkerRects):
>+        (WebCore::Internals::parserMetaData):
>+        (WebCore::Internals::getCurrentCursorInfo):
>+        (WebCore::Internals::mediaSessionRestrictions const):
>+        (WebCore::Internals::pageMediaState):
>+        (WebCore::Internals::scrollSnapOffsets):
>+        * testing/MockPageOverlayClient.cpp:
>+        (WebCore::MockPageOverlayClient::drawRect):
>+        (WebCore::MockPageOverlayClient::mouseEvent):
>+        * workers/WorkerScriptLoader.cpp:
>+        (WebCore::WorkerScriptLoader::script):
>+        * xml/XMLErrors.cpp:
>+        (WebCore::XMLErrors::insertErrorMessageBlock):
>+        * xml/XMLHttpRequest.cpp:
>+        (WebCore::XMLHttpRequest::getAllResponseHeaders const):
>+        * xml/XMLHttpRequest.h:
>+        * xml/XPathFunctions.cpp:
>+        (WebCore::XPath::atomicSubstring):
>+        (WebCore::XPath::FunId::evaluate const):
>+        (WebCore::XPath::FunConcat::evaluate const):
>+        (WebCore::XPath::FunTranslate::evaluate const):
>+        * xml/XSLTProcessorLibxslt.cpp:
>+        (WebCore::saveResultToString):
>+        * xml/parser/CharacterReferenceParserInlines.h:
>+        (WebCore::unconsumeCharacters):
>+
> 2018-05-01  Oleksandr Skachkov  <gskachkov@gmail.com>
> 
>         WebAssembly: add support for stream APIs - JavaScript API
>diff --git a/Source/WebCore/Modules/applepay/cocoa/PaymentContactCocoa.mm b/Source/WebCore/Modules/applepay/cocoa/PaymentContactCocoa.mm
>index 3be6210..09784f1 100644
>--- a/Source/WebCore/Modules/applepay/cocoa/PaymentContactCocoa.mm
>+++ b/Source/WebCore/Modules/applepay/cocoa/PaymentContactCocoa.mm
>@@ -154,7 +154,10 @@ static RetainPtr<PKContact> convert(unsigned version, const ApplePayPaymentConta
>         }
> 
>         // FIXME: StringBuilder should hava a toNSString() function to avoid the extra String allocation.
>-        [address setStreet:builder.toString()];
>+        if (auto string = builder.toString())
>+            [address setStreet:*string];
>+        else
>+            CRASH();
> 
>         if (!contact.subLocality.isEmpty())
>             setSubLocality(address.get(), contact.subLocality);
>diff --git a/Source/WebCore/Modules/entriesapi/DOMFileSystem.cpp b/Source/WebCore/Modules/entriesapi/DOMFileSystem.cpp
>index 8e5066d..9b360ad 100644
>--- a/Source/WebCore/Modules/entriesapi/DOMFileSystem.cpp
>+++ b/Source/WebCore/Modules/entriesapi/DOMFileSystem.cpp
>@@ -216,7 +216,9 @@ static String resolveRelativeVirtualPath(StringView baseVirtualPath, StringView
>         builder.append('/');
>         builder.append(segment);
>     }
>-    return builder.toString();
>+    if (auto string = builder.toString())
>+        return *string;
>+    CRASH();
> }
> 
> // https://wicg.github.io/entries-api/#evaluate-a-path
>diff --git a/Source/WebCore/Modules/geolocation/Geolocation.cpp b/Source/WebCore/Modules/geolocation/Geolocation.cpp
>index dcbf703..6caac5a 100644
>--- a/Source/WebCore/Modules/geolocation/Geolocation.cpp
>+++ b/Source/WebCore/Modules/geolocation/Geolocation.cpp
>@@ -340,7 +340,10 @@ static void logError(const String& target, const bool isSecure, const bool isMix
>     
>     message.append(target);
>     message.append(".\n");
>-    document->addConsoleMessage(MessageSource::Security, MessageLevel::Error, message.toString());
>+    if (auto string = message.toString())
>+        document->addConsoleMessage(MessageSource::Security, MessageLevel::Error, *string);
>+    else
>+        CRASH();
> }
> 
> // FIXME: remove this function when rdar://problem/32137821 is fixed.
>diff --git a/Source/WebCore/Modules/indexeddb/IDBKeyData.cpp b/Source/WebCore/Modules/indexeddb/IDBKeyData.cpp
>index 2e93645..7212974 100644
>--- a/Source/WebCore/Modules/indexeddb/IDBKeyData.cpp
>+++ b/Source/WebCore/Modules/indexeddb/IDBKeyData.cpp
>@@ -332,7 +332,10 @@ String IDBKeyData::loggingString() const
>                 builder.appendLiteral(", ");
>         }
>         builder.appendLiteral(" }");
>-        result = builder.toString();
>+        if (auto string = builder.toString())
>+            result = *string;
>+        else
>+            CRASH();
>         break;
>     }
>     case KeyType::Binary: {
>@@ -342,7 +345,10 @@ String IDBKeyData::loggingString() const
>         auto* data = WTF::get<ThreadSafeDataBuffer>(m_value).data();
>         if (!data) {
>             builder.append("(null)");
>-            result = builder.toString();
>+            if (auto string = builder.toString())
>+                result = *string;
>+            else
>+                CRASH();
>             break;
>         }
> 
>@@ -353,7 +359,10 @@ String IDBKeyData::loggingString() const
>         if (data->size() > 8)
>             builder.append("...");
> 
>-        result = builder.toString();
>+        if (auto string = builder.toString())
>+            result = *string;
>+        else
>+            CRASH();
>         break;
>     }
>     case KeyType::String:
>diff --git a/Source/WebCore/Modules/indexeddb/IDBKeyPath.cpp b/Source/WebCore/Modules/indexeddb/IDBKeyPath.cpp
>index 76ebeb3..8b9fb17 100644
>--- a/Source/WebCore/Modules/indexeddb/IDBKeyPath.cpp
>+++ b/Source/WebCore/Modules/indexeddb/IDBKeyPath.cpp
>@@ -241,7 +241,9 @@ String loggingString(const IDBKeyPath& path)
>         builder.append(strings.last());
>         builder.append(" >");
> 
>-        return builder.toString();
>+        if (auto string = builder.toString())
>+            return *string;
>+        CRASH();
>     });
> 
>     return WTF::visit(visitor, path);
>diff --git a/Source/WebCore/Modules/indexeddb/server/IndexValueStore.cpp b/Source/WebCore/Modules/indexeddb/server/IndexValueStore.cpp
>index 6983c9d..80d6b3b 100644
>--- a/Source/WebCore/Modules/indexeddb/server/IndexValueStore.cpp
>+++ b/Source/WebCore/Modules/indexeddb/server/IndexValueStore.cpp
>@@ -409,7 +409,9 @@ String IndexValueStore::loggingString() const
>         builder.appendNumber(m_records.get(key)->getCount());
>         builder.appendLiteral(" entries");
>     }
>-    return builder.toString();
>+    if (auto string = builder.toString())
>+        return *string;
>+    CRASH();
> }
> #endif
> 
>diff --git a/Source/WebCore/Modules/indexeddb/server/SQLiteIDBCursor.cpp b/Source/WebCore/Modules/indexeddb/server/SQLiteIDBCursor.cpp
>index f20db87..a4c30fa 100644
>--- a/Source/WebCore/Modules/indexeddb/server/SQLiteIDBCursor.cpp
>+++ b/Source/WebCore/Modules/indexeddb/server/SQLiteIDBCursor.cpp
>@@ -141,7 +141,9 @@ static String buildIndexStatement(const IDBKeyRangeData& keyRange, IndexedDB::Cu
> 
>     builder.append(';');
> 
>-    return builder.toString();
>+    if (auto string = builder.toString())
>+        return *string;
>+    CRASH();
> }
> 
> static String buildObjectStoreStatement(const IDBKeyRangeData& keyRange, IndexedDB::CursorDirection cursorDirection)
>@@ -169,7 +171,9 @@ static String buildObjectStoreStatement(const IDBKeyRangeData& keyRange, Indexed
> 
>     builder.append(';');
> 
>-    return builder.toString();
>+    if (auto string = builder.toString())
>+        return *string;
>+    CRASH();
> }
> 
> bool SQLiteIDBCursor::establishStatement()
>diff --git a/Source/WebCore/Modules/indexeddb/shared/IDBDatabaseInfo.cpp b/Source/WebCore/Modules/indexeddb/shared/IDBDatabaseInfo.cpp
>index e5df15c..76934d4 100644
>--- a/Source/WebCore/Modules/indexeddb/shared/IDBDatabaseInfo.cpp
>+++ b/Source/WebCore/Modules/indexeddb/shared/IDBDatabaseInfo.cpp
>@@ -169,7 +169,9 @@ String IDBDatabaseInfo::loggingString() const
>         builder.append('\n');
>     }
> 
>-    return builder.toString();
>+    if (auto string = builder.toString())
>+        return *string;
>+    CRASH();
> }
> #endif
> 
>diff --git a/Source/WebCore/Modules/indexeddb/shared/IDBObjectStoreInfo.cpp b/Source/WebCore/Modules/indexeddb/shared/IDBObjectStoreInfo.cpp
>index b0075fe..8d8fad6 100644
>--- a/Source/WebCore/Modules/indexeddb/shared/IDBObjectStoreInfo.cpp
>+++ b/Source/WebCore/Modules/indexeddb/shared/IDBObjectStoreInfo.cpp
>@@ -148,7 +148,9 @@ String IDBObjectStoreInfo::loggingString(int indent) const
>         builder.append('\n');
>     }
> 
>-    return builder.toString();
>+    if (auto string = builder.toString())
>+        return *string;
>+    CRASH();
> }
> 
> String IDBObjectStoreInfo::condensedLoggingString() const
>diff --git a/Source/WebCore/Modules/mediasession/WebMediaSessionManager.cpp b/Source/WebCore/Modules/mediasession/WebMediaSessionManager.cpp
>index 4209ffa..96febc8 100644
>--- a/Source/WebCore/Modules/mediasession/WebMediaSessionManager.cpp
>+++ b/Source/WebCore/Modules/mediasession/WebMediaSessionManager.cpp
>@@ -89,7 +89,9 @@ static String mediaProducerStateString(MediaProducer::MediaStateFlags flags)
>     else
>         string.resize(string.length() - 2);
> 
>-    return string.toString();
>+    if (auto str = string.toString())
>+        return *str;
>+    CRASH();
> }
> #endif
> 
>@@ -381,7 +383,9 @@ String WebMediaSessionManager::toString(ConfigurationTasks tasks)
>     else
>         string.resize(string.length() - 2);
>     
>-    return string.toString();
>+    if (auto str = string.toString())
>+        return *str;
>+    CRASH();
> }
> #endif
> 
>diff --git a/Source/WebCore/Modules/mediastream/PeerConnectionBackend.cpp b/Source/WebCore/Modules/mediastream/PeerConnectionBackend.cpp
>index dc51bb5..dbecd5d 100644
>--- a/Source/WebCore/Modules/mediastream/PeerConnectionBackend.cpp
>+++ b/Source/WebCore/Modules/mediastream/PeerConnectionBackend.cpp
>@@ -403,7 +403,9 @@ static String filterICECandidate(String&& sdp)
>             filteredSDP.append(' ');
>         filteredSDP.append(item);
>     });
>-    return filteredSDP.toString();
>+    if (auto string = filteredSDP.toString())
>+        return *string;
>+    CRASH();
> }
> 
> String PeerConnectionBackend::filterSDP(String&& sdp) const
>@@ -421,7 +423,9 @@ String PeerConnectionBackend::filterSDP(String&& sdp) const
>             return;
>         filteredSDP.append('\n');
>     });
>-    return filteredSDP.toString();
>+    if (auto string = filteredSDP.toString())
>+        return *string;
>+    CRASH();
> }
> 
> void PeerConnectionBackend::newICECandidate(String&& sdp, String&& mid, unsigned short sdpMLineIndex)
>diff --git a/Source/WebCore/Modules/plugins/YouTubePluginReplacement.cpp b/Source/WebCore/Modules/plugins/YouTubePluginReplacement.cpp
>index c9171dc..427f4fe 100644
>--- a/Source/WebCore/Modules/plugins/YouTubePluginReplacement.cpp
>+++ b/Source/WebCore/Modules/plugins/YouTubePluginReplacement.cpp
>@@ -333,7 +333,9 @@ String YouTubePluginReplacement::youTubeURLFromAbsoluteURL(const URL& srcURL, co
>         finalURL.append('?');
>         finalURL.append(query);
>     }
>-    return finalURL.toString();
>+    if (auto string = finalURL.toString())
>+        return *string;
>+    CRASH();
> }
>     
> bool YouTubePluginReplacement::supportsURL(const URL& url)
>diff --git a/Source/WebCore/Modules/webdatabase/DatabaseTracker.cpp b/Source/WebCore/Modules/webdatabase/DatabaseTracker.cpp
>index 8fda62a..98f308d 100644
>--- a/Source/WebCore/Modules/webdatabase/DatabaseTracker.cpp
>+++ b/Source/WebCore/Modules/webdatabase/DatabaseTracker.cpp
>@@ -320,7 +320,9 @@ static String generateDatabaseFileName()
>     stringBuilder.append(createCanonicalUUIDString());
>     stringBuilder.appendLiteral(".db");
> 
>-    return stringBuilder.toString();
>+    if (auto string = stringBuilder.toString())
>+        return *string;
>+    CRASH();
> }
> 
> String DatabaseTracker::fullPathForDatabaseNoLock(const SecurityOriginData& origin, const String& name, bool createIfNotExists)
>diff --git a/Source/WebCore/Modules/websockets/WebSocket.cpp b/Source/WebCore/Modules/websockets/WebSocket.cpp
>index 02477b9..eab2531 100644
>--- a/Source/WebCore/Modules/websockets/WebSocket.cpp
>+++ b/Source/WebCore/Modules/websockets/WebSocket.cpp
>@@ -105,7 +105,9 @@ static String encodeProtocolString(const String& protocol)
>         else
>             builder.append(protocol[i]);
>     }
>-    return builder.toString();
>+    if (auto string = builder.toString())
>+        return *string;
>+    CRASH();
> }
> 
> static String joinStrings(const Vector<String>& strings, const char* separator)
>@@ -116,7 +118,9 @@ static String joinStrings(const Vector<String>& strings, const char* separator)
>             builder.append(separator);
>         builder.append(strings[i]);
>     }
>-    return builder.toString();
>+    if (auto string = builder.toString())
>+        return *string;
>+    CRASH();
> }
> 
> static unsigned saturateAdd(unsigned a, unsigned b)
>diff --git a/Source/WebCore/Modules/websockets/WebSocketExtensionDispatcher.cpp b/Source/WebCore/Modules/websockets/WebSocketExtensionDispatcher.cpp
>index fcc9dc3..6c40c48 100644
>--- a/Source/WebCore/Modules/websockets/WebSocketExtensionDispatcher.cpp
>+++ b/Source/WebCore/Modules/websockets/WebSocketExtensionDispatcher.cpp
>@@ -68,7 +68,9 @@ const String WebSocketExtensionDispatcher::createHeaderValue() const
>         builder.appendLiteral(", ");
>         builder.append(m_processors[i]->handshakeString());
>     }
>-    return builder.toString();
>+    if (auto string = builder.toString())
>+        return *string;
>+    CRASH();
> }
> 
> void WebSocketExtensionDispatcher::appendAcceptedExtension(const String& extensionToken, HashMap<String, String>& extensionParameters)
>@@ -139,7 +141,9 @@ String WebSocketExtensionDispatcher::acceptedExtensions() const
> {
>     if (m_acceptedExtensionsBuilder.isEmpty())
>         return String();
>-    return m_acceptedExtensionsBuilder.toStringPreserveCapacity();
>+    if (auto string = m_acceptedExtensionsBuilder.toStringPreserveCapacity())
>+        return *string;
>+    CRASH();
> }
> 
> String WebSocketExtensionDispatcher::failureReason() const
>diff --git a/Source/WebCore/Modules/websockets/WebSocketHandshake.cpp b/Source/WebCore/Modules/websockets/WebSocketHandshake.cpp
>index 5455cd1..083a904 100644
>--- a/Source/WebCore/Modules/websockets/WebSocketHandshake.cpp
>+++ b/Source/WebCore/Modules/websockets/WebSocketHandshake.cpp
>@@ -72,10 +72,13 @@ static String resourceName(const URL& url)
>         name.append('?');
>         name.append(url.query());
>     }
>-    String result = name.toString();
>-    ASSERT(!result.isEmpty());
>-    ASSERT(!result.contains(' '));
>-    return result;
>+    if (auto string = name.toString()) {
>+        String result = *string;
>+        ASSERT(!result.isEmpty());
>+        ASSERT(!result.contains(' '));
>+        return result;
>+    }
>+    CRASH();
> }
> 
> static String hostName(const URL& url, bool secure)
>@@ -87,7 +90,9 @@ static String hostName(const URL& url, bool secure)
>         builder.append(':');
>         builder.appendNumber(url.port().value());
>     }
>-    return builder.toString();
>+    if (auto string = builder.toString())
>+        return *string;
>+    CRASH();
> }
> 
> static const size_t maxInputSampleSize = 128;
>@@ -176,7 +181,9 @@ String WebSocketHandshake::clientLocation() const
>     builder.appendLiteral("://");
>     builder.append(hostName(m_url, m_secure));
>     builder.append(resourceName(m_url));
>-    return builder.toString();
>+    if (auto string = builder.toString())
>+        return *string;
>+    CRASH();
> }
> 
> CString WebSocketHandshake::clientHandshakeMessage() const
>@@ -226,7 +233,9 @@ CString WebSocketHandshake::clientHandshakeMessage() const
> 
>     builder.appendLiteral("\r\n");
> 
>-    return builder.toString().utf8();
>+    if (auto string = builder.toString())
>+        return string->utf8();
>+    CRASH();
> }
> 
> ResourceRequest WebSocketHandshake::clientHandshakeRequest() const
>diff --git a/Source/WebCore/accessibility/AccessibilityNodeObject.cpp b/Source/WebCore/accessibility/AccessibilityNodeObject.cpp
>index db8575e..c4a2521 100644
>--- a/Source/WebCore/accessibility/AccessibilityNodeObject.cpp
>+++ b/Source/WebCore/accessibility/AccessibilityNodeObject.cpp
>@@ -1713,11 +1713,13 @@ static bool shouldUseAccessibilityObjectInnerText(AccessibilityObject* obj, Acce
> 
> static bool shouldAddSpaceBeforeAppendingNextElement(StringBuilder& builder, const String& childText)
> {
>+    if (builder.failed())
>+        CRASH();
>+
>     if (!builder.length() || !childText.length())
>         return false;
>-
>     // We don't need to add an additional space before or after a line break.
>-    return !(isHTMLLineBreak(childText[0]) || isHTMLLineBreak(builder[builder.length() - 1]));
>+    return !(isHTMLLineBreak(childText[0]) || isHTMLLineBreak(*builder[builder.length() - 1]));
> }
>     
> static void appendNameToStringBuilder(StringBuilder& builder, const String& text)
>@@ -1769,7 +1771,9 @@ String AccessibilityNodeObject::textUnderElement(AccessibilityTextUnderElementMo
>             appendNameToStringBuilder(builder, childText);
>     }
> 
>-    return builder.toString().stripWhiteSpace().simplifyWhiteSpace(isHTMLSpaceButNotLineBreak);
>+    if (auto string = builder.toString())
>+        return string->stripWhiteSpace().simplifyWhiteSpace(isHTMLSpaceButNotLineBreak);
>+    CRASH();
> }
> 
> String AccessibilityNodeObject::title() const
>@@ -1985,7 +1989,9 @@ String AccessibilityNodeObject::accessibilityDescriptionForChildren() const
>         }
>     }
> 
>-    return builder.toString();
>+    if (auto string = builder.toString())
>+        return *string;
>+    CRASH();
> }
> 
> String AccessibilityNodeObject::accessibilityDescriptionForElements(Vector<Element*> &elements) const
>@@ -1994,7 +2000,9 @@ String AccessibilityNodeObject::accessibilityDescriptionForElements(Vector<Eleme
>     unsigned size = elements.size();
>     for (unsigned i = 0; i < size; ++i)
>         appendNameToStringBuilder(builder, accessibleNameForNode(elements[i], node()));
>-    return builder.toString();
>+    if (auto string = builder.toString())
>+        return *string;
>+    CRASH();
> }
> 
> String AccessibilityNodeObject::ariaDescribedByAttribute() const
>diff --git a/Source/WebCore/accessibility/AccessibilityObject.cpp b/Source/WebCore/accessibility/AccessibilityObject.cpp
>index 1928172..7c8d98c 100644
>--- a/Source/WebCore/accessibility/AccessibilityObject.cpp
>+++ b/Source/WebCore/accessibility/AccessibilityObject.cpp
>@@ -1388,8 +1388,10 @@ String AccessibilityObject::stringForRange(RefPtr<Range> range) const
>                 builder.append(objectReplacementCharacter);
>         }
>     }
>-    
>-    return builder.toString();
>+
>+    if (auto string = builder.toString())
>+        return *string;
>+    CRASH();
> }
> 
> String AccessibilityObject::stringForVisiblePositionRange(const VisiblePositionRange& visiblePositionRange)
>@@ -1415,7 +1417,9 @@ String AccessibilityObject::stringForVisiblePositionRange(const VisiblePositionR
>         }
>     }
> 
>-    return builder.toString();
>+    if (auto string = builder.toString())
>+        return *string;
>+    CRASH();
> }
> 
> int AccessibilityObject::lengthForVisiblePositionRange(const VisiblePositionRange& visiblePositionRange) const
>diff --git a/Source/WebCore/accessibility/mac/WebAccessibilityObjectWrapperMac.mm b/Source/WebCore/accessibility/mac/WebAccessibilityObjectWrapperMac.mm
>index a102d36..932d11a 100644
>--- a/Source/WebCore/accessibility/mac/WebAccessibilityObjectWrapperMac.mm
>+++ b/Source/WebCore/accessibility/mac/WebAccessibilityObjectWrapperMac.mm
>@@ -2409,7 +2409,9 @@ - (NSString *)valueDescriptionForMeter
>         if (builder.length())
>             builder.appendLiteral(", ");
>         builder.append(gaugeRegionValue);
>-        return builder.toString();
>+        if (auto string = builder.toString())
>+            return *string;
>+        CRASH();
>     }
> #endif
>     return valueDescription;
>@@ -3873,8 +3875,11 @@ static void formatForDebugger(const VisiblePositionRange& range, char* buffer, u
>     result.appendLiteral(" to ");
>     range.end.formatForDebugger(format, FormatBufferSize);
>     result.append(format);
>-    
>-    strlcpy(buffer, result.toString().utf8().data(), length);
>+
>+    if (auto string = result.toString())
>+        strlcpy(buffer, string->utf8().data(), length);
>+    else
>+        CRASH();
> }
> #endif
> 
>diff --git a/Source/WebCore/bindings/js/JSDOMConvertStrings.cpp b/Source/WebCore/bindings/js/JSDOMConvertStrings.cpp
>index 7d2de18..1e04a1e 100644
>--- a/Source/WebCore/bindings/js/JSDOMConvertStrings.cpp
>+++ b/Source/WebCore/bindings/js/JSDOMConvertStrings.cpp
>@@ -91,7 +91,9 @@ static inline String stringToUSVString(String&& string)
>         else
>             result.append(codePoint);
>     }
>-    return result.toString();
>+    if (auto string = result.toString())
>+        return *string;
>+    CRASH();
> }
> 
> String identifierToUSVString(ExecState&, const Identifier& identifier)
>diff --git a/Source/WebCore/bindings/js/JSDOMExceptionHandling.cpp b/Source/WebCore/bindings/js/JSDOMExceptionHandling.cpp
>index 895a300..07fb738 100644
>--- a/Source/WebCore/bindings/js/JSDOMExceptionHandling.cpp
>+++ b/Source/WebCore/bindings/js/JSDOMExceptionHandling.cpp
>@@ -211,7 +211,9 @@ JSC::EncodedJSValue throwArgumentMustBeEnumError(JSC::ExecState& state, JSC::Thr
>     appendArgumentMustBe(builder, argumentIndex, argumentName, functionInterfaceName, functionName);
>     builder.appendLiteral("one of: ");
>     builder.append(expectedValues);
>-    return throwVMTypeError(&state, scope, builder.toString());
>+    if (auto string = builder.toString())
>+        return throwVMTypeError(&state, scope, *string);
>+    CRASH();
> }
> 
> JSC::EncodedJSValue throwArgumentMustBeFunctionError(JSC::ExecState& state, JSC::ThrowScope& scope, unsigned argumentIndex, const char* argumentName, const char* interfaceName, const char* functionName)
>@@ -219,7 +221,9 @@ JSC::EncodedJSValue throwArgumentMustBeFunctionError(JSC::ExecState& state, JSC:
>     StringBuilder builder;
>     appendArgumentMustBe(builder, argumentIndex, argumentName, interfaceName, functionName);
>     builder.appendLiteral("a function");
>-    return throwVMTypeError(&state, scope, builder.toString());
>+    if (auto string = builder.toString())
>+        return throwVMTypeError(&state, scope, *string);
>+    CRASH();
> }
> 
> JSC::EncodedJSValue throwArgumentTypeError(JSC::ExecState& state, JSC::ThrowScope& scope, unsigned argumentIndex, const char* argumentName, const char* functionInterfaceName, const char* functionName, const char* expectedType)
>@@ -228,7 +232,9 @@ JSC::EncodedJSValue throwArgumentTypeError(JSC::ExecState& state, JSC::ThrowScop
>     appendArgumentMustBe(builder, argumentIndex, argumentName, functionInterfaceName, functionName);
>     builder.appendLiteral("an instance of ");
>     builder.append(expectedType);
>-    return throwVMTypeError(&state, scope, builder.toString());
>+    if (auto string = builder.toString())
>+        return throwVMTypeError(&state, scope, *string);
>+    CRASH();
> }
> 
> void throwAttributeTypeError(JSC::ExecState& state, JSC::ThrowScope& scope, const char* interfaceName, const char* attributeName, const char* expectedType)
>@@ -245,7 +251,9 @@ JSC::EncodedJSValue throwRequiredMemberTypeError(JSC::ExecState& state, JSC::Thr
>     builder.append(memberName);
>     builder.appendLiteral(" is required and must be an instance of ");
>     builder.append(expectedType);
>-    return throwVMTypeError(&state, scope, builder.toString());
>+    if (auto string = builder.toString())
>+        return throwVMTypeError(&state, scope, *string);
>+    CRASH();
> }
> 
> JSC::EncodedJSValue throwConstructorScriptExecutionContextUnavailableError(JSC::ExecState& state, JSC::ThrowScope& scope, const char* interfaceName)
>diff --git a/Source/WebCore/contentextensions/CombinedURLFilters.cpp b/Source/WebCore/contentextensions/CombinedURLFilters.cpp
>index 7558b22..29de509 100644
>--- a/Source/WebCore/contentextensions/CombinedURLFilters.cpp
>+++ b/Source/WebCore/contentextensions/CombinedURLFilters.cpp
>@@ -107,7 +107,9 @@ static String prefixTreeVertexToString(const PrefixTreeVertex& vertex, const Has
>         }
>     }
>     builder.append('\n');
>-    return builder.toString();
>+    if (auto string = builder.toString())
>+        return *string;
>+    CRASH();
> }
> 
> static void recursivePrint(const PrefixTreeVertex& vertex, const HashMap<const PrefixTreeVertex*, ActionList>& actions, unsigned depth)
>diff --git a/Source/WebCore/contentextensions/ContentExtension.cpp b/Source/WebCore/contentextensions/ContentExtension.cpp
>index 610e1b8..8e50ff8 100644
>--- a/Source/WebCore/contentextensions/ContentExtension.cpp
>+++ b/Source/WebCore/contentextensions/ContentExtension.cpp
>@@ -110,8 +110,11 @@ void ContentExtension::compileGlobalDisplayNoneStyleSheet()
> 
>     m_globalDisplayNoneStyleSheet = StyleSheetContents::create();
>     m_globalDisplayNoneStyleSheet->setIsUserStyleSheet(true);
>-    if (!m_globalDisplayNoneStyleSheet->parseString(css.toString()))
>-        m_globalDisplayNoneStyleSheet = nullptr;
>+    if (auto string = css.toString()) {
>+        if (!m_globalDisplayNoneStyleSheet->parseString(*string))
>+            m_globalDisplayNoneStyleSheet = nullptr;
>+    } else
>+        CRASH();
> 
>     // These actions don't need to be applied individually any more. They will all be applied to every page as a precompiled style sheet.
>     m_universalActionsWithoutConditions.removeAllMatching(inGlobalDisplayNoneStyleSheet);
>diff --git a/Source/WebCore/contentextensions/ContentExtensionCompiler.cpp b/Source/WebCore/contentextensions/ContentExtensionCompiler.cpp
>index 5e035a6..5c37efb 100644
>--- a/Source/WebCore/contentextensions/ContentExtensionCompiler.cpp
>+++ b/Source/WebCore/contentextensions/ContentExtensionCompiler.cpp
>@@ -80,7 +80,10 @@ static void resolvePendingDisplayNoneActions(Vector<SerializedActionByte>& actio
>     for (auto& pendingDisplayNoneActions : map.values()) {
>         uint32_t actionLocation = actions.size();
>         actions.append(static_cast<SerializedActionByte>(ActionType::CSSDisplayNoneSelector));
>-        serializeString(actions, pendingDisplayNoneActions.combinedSelectors.toString());
>+        if (auto string = pendingDisplayNoneActions.combinedSelectors.toString())
>+            serializeString(actions, *string);
>+        else
>+            CRASH();
>         for (uint32_t clientLocation : pendingDisplayNoneActions.clientLocations)
>             actionLocations[clientLocation] = actionLocation;
>     }
>diff --git a/Source/WebCore/contentextensions/ContentExtensionStyleSheet.cpp b/Source/WebCore/contentextensions/ContentExtensionStyleSheet.cpp
>index e24a366..de3e859 100644
>--- a/Source/WebCore/contentextensions/ContentExtensionStyleSheet.cpp
>+++ b/Source/WebCore/contentextensions/ContentExtensionStyleSheet.cpp
>@@ -60,7 +60,10 @@ bool ContentExtensionStyleSheet::addDisplayNoneSelector(const String& selector,
>     css.append('{');
>     css.append(ContentExtensionsBackend::displayNoneCSSRule());
>     css.append('}');
>-    m_styleSheet->contents().parseString(css.toString());
>+    if (auto string = css.toString())
>+        m_styleSheet->contents().parseString(*string);
>+    else
>+        CRASH();
>     return true;
> }
> 
>diff --git a/Source/WebCore/contentextensions/Term.h b/Source/WebCore/contentextensions/Term.h
>index 0d51833..6f3194f 100644
>--- a/Source/WebCore/contentextensions/Term.h
>+++ b/Source/WebCore/contentextensions/Term.h
>@@ -246,7 +246,9 @@ inline String Term::toString() const
>         }
>         builder.append(']');
>         builder.append(quantifierToString(m_quantifier));
>-        return builder.toString();
>+        if (auto string = builder.toString())
>+            return *string;
>+        CRASH();
>     }
>     case TermType::Group: {
>         StringBuilder builder;
>@@ -255,7 +257,9 @@ inline String Term::toString() const
>             builder.append(term.toString());
>         builder.append(')');
>         builder.append(quantifierToString(m_quantifier));
>-        return builder.toString();
>+        if (auto string = builder.toString())
>+            return *string;
>+        CRASH();
>     }
>     }
> }
>diff --git a/Source/WebCore/css/CSSAnimationTriggerScrollValue.cpp b/Source/WebCore/css/CSSAnimationTriggerScrollValue.cpp
>index a1a597b..2f25c9f 100644
>--- a/Source/WebCore/css/CSSAnimationTriggerScrollValue.cpp
>+++ b/Source/WebCore/css/CSSAnimationTriggerScrollValue.cpp
>@@ -43,7 +43,9 @@ String CSSAnimationTriggerScrollValue::customCSSText() const
>         result.append(m_endValue->cssText());
>     }
>     result.append(')');
>-    return result.toString();
>+    if (auto string = result.toString())
>+        return *string;
>+    CRASH();
> }
> 
> bool CSSAnimationTriggerScrollValue::equals(const CSSAnimationTriggerScrollValue& other) const
>diff --git a/Source/WebCore/css/CSSBasicShapes.cpp b/Source/WebCore/css/CSSBasicShapes.cpp
>index 24f2334..192a04f 100644
>--- a/Source/WebCore/css/CSSBasicShapes.cpp
>+++ b/Source/WebCore/css/CSSBasicShapes.cpp
>@@ -107,7 +107,9 @@ static String buildCircleString(const String& radius, const String& centerX, con
>         result.append(centerY);
>     }
>     result.appendLiteral(")");
>-    return result.toString();
>+    if (auto string = result.toString())
>+        return *string;
>+    CRASH();
> }
> 
> String CSSBasicShapeCircle::cssText() const
>@@ -164,7 +166,9 @@ static String buildEllipseString(const String& radiusX, const String& radiusY, c
>         result.append(centerY);
>     }
>     result.appendLiteral(")");
>-    return result.toString();
>+    if (auto string = result.toString())
>+        return *string;
>+    CRASH();
> }
> 
> String CSSBasicShapeEllipse::cssText() const
>@@ -224,7 +228,9 @@ static String buildPathString(const WindRule& windRule, const String& path, cons
>         result.append(box);
>     }
> 
>-    return result.toString();
>+    if (auto string = result.toString())
>+        return *string;
>+    CRASH();
> }
> 
> String CSSBasicShapePath::cssText() const
>@@ -280,7 +286,9 @@ static String buildPolygonString(const WindRule& windRule, const Vector<String>&
> 
>     result.append(')');
> 
>-    return result.toString();
>+    if (auto string = result.toString())
>+        return *string;
>+    CRASH();
> }
> 
> String CSSBasicShapePolygon::cssText() const
>@@ -377,7 +385,9 @@ static String buildInsetString(const String& top, const String& right, const Str
>         }
>     }
>     result.append(')');
>-    return result.toString();
>+    if (auto string = result.toString())
>+        return *string;
>+    CRASH();
> }
> 
> static inline void updateCornerRadiusWidthAndHeight(CSSPrimitiveValue* corner, String& width, String& height)
>diff --git a/Source/WebCore/css/CSSCalculationValue.cpp b/Source/WebCore/css/CSSCalculationValue.cpp
>index b758301..b91c0f8 100644
>--- a/Source/WebCore/css/CSSCalculationValue.cpp
>+++ b/Source/WebCore/css/CSSCalculationValue.cpp
>@@ -162,7 +162,9 @@ static String buildCssText(const String& expression)
>     result.append(expression);
>     if (expressionHasSingleTerm)
>         result.append(')');
>-    return result.toString();
>+    if (auto string = result.toString())
>+        return *string;
>+    CRASH();
> }
> 
> String CSSCalcValue::customCSSText() const
>@@ -563,7 +565,9 @@ private:
>         }
>         result.append(')');
> 
>-        return result.toString();
>+        if (auto string = result.toString())
>+            return *string;
>+        CRASH();
>     }
> 
>     String customCSSText() const final
>diff --git a/Source/WebCore/css/CSSComputedStyleDeclaration.cpp b/Source/WebCore/css/CSSComputedStyleDeclaration.cpp
>index eeae426..1a44d94 100644
>--- a/Source/WebCore/css/CSSComputedStyleDeclaration.cpp
>+++ b/Source/WebCore/css/CSSComputedStyleDeclaration.cpp
>@@ -1693,7 +1693,9 @@ String CSSComputedStyleDeclaration::cssText() const
>         result.append(';');
>     }
> 
>-    return result.toString();
>+    if (auto string = result.toString())
>+        return *string;
>+    CRASH();
> }
> 
> ExceptionOr<void> CSSComputedStyleDeclaration::setCssText(const String&)
>diff --git a/Source/WebCore/css/CSSCrossfadeValue.cpp b/Source/WebCore/css/CSSCrossfadeValue.cpp
>index 172c945..343a021 100644
>--- a/Source/WebCore/css/CSSCrossfadeValue.cpp
>+++ b/Source/WebCore/css/CSSCrossfadeValue.cpp
>@@ -102,7 +102,9 @@ String CSSCrossfadeValue::customCSSText() const
>     result.appendLiteral(", ");
>     result.append(m_percentageValue->cssText());
>     result.append(')');
>-    return result.toString();
>+    if (auto string = result.toString())
>+        return *string;
>+    CRASH();
> }
> 
> FloatSize CSSCrossfadeValue::fixedSize(const RenderElement& renderer)
>diff --git a/Source/WebCore/css/CSSCursorImageValue.cpp b/Source/WebCore/css/CSSCursorImageValue.cpp
>index 1b6d7f2..0eeee08 100644
>--- a/Source/WebCore/css/CSSCursorImageValue.cpp
>+++ b/Source/WebCore/css/CSSCursorImageValue.cpp
>@@ -61,7 +61,9 @@ String CSSCursorImageValue::customCSSText() const
>         result.append(' ');
>         result.appendNumber(m_hotSpot.y());
>     }
>-    return result.toString();
>+    if (auto string = result.toString())
>+        return *string;
>+    CRASH();
> }
> 
> SVGCursorElement* CSSCursorImageValue::updateCursorElement(const Document& document)
>diff --git a/Source/WebCore/css/CSSCustomIdentValue.cpp b/Source/WebCore/css/CSSCustomIdentValue.cpp
>index 26d6e3b..f5eeb74 100644
>--- a/Source/WebCore/css/CSSCustomIdentValue.cpp
>+++ b/Source/WebCore/css/CSSCustomIdentValue.cpp
>@@ -56,7 +56,9 @@ String CSSCustomIdentValue::customCSSText() const
>         return getPropertyNameAtomicString(m_propertyId);
>     StringBuilder builder;
>     serializeIdentifier(m_string, builder);
>-    return builder.toString();
>+    if (auto string = builder.toString())
>+        return *string;
>+    CRASH();
> }
> 
> } // namespace WebCore
>diff --git a/Source/WebCore/css/CSSFilterImageValue.cpp b/Source/WebCore/css/CSSFilterImageValue.cpp
>index 6acf744..2031400 100644
>--- a/Source/WebCore/css/CSSFilterImageValue.cpp
>+++ b/Source/WebCore/css/CSSFilterImageValue.cpp
>@@ -53,7 +53,9 @@ String CSSFilterImageValue::customCSSText() const
>     result.appendLiteral(", ");
>     result.append(m_filterValue->cssText());
>     result.append(')');
>-    return result.toString();
>+    if (auto string = result.toString())
>+        return *string;
>+    CRASH();
> }
> 
> FloatSize CSSFilterImageValue::fixedSize(const RenderElement* renderer)
>diff --git a/Source/WebCore/css/CSSFontFaceRule.cpp b/Source/WebCore/css/CSSFontFaceRule.cpp
>index 0dda1b2..85946f6 100644
>--- a/Source/WebCore/css/CSSFontFaceRule.cpp
>+++ b/Source/WebCore/css/CSSFontFaceRule.cpp
>@@ -57,7 +57,9 @@ String CSSFontFaceRule::cssText() const
>     if (!descs.isEmpty())
>         result.append(' ');
>     result.append('}');
>-    return result.toString();
>+    if (auto string = result.toString())
>+        return *string;
>+    CRASH();
> }
> 
> void CSSFontFaceRule::reattach(StyleRuleBase& rule)
>diff --git a/Source/WebCore/css/CSSFontFaceSrcValue.cpp b/Source/WebCore/css/CSSFontFaceSrcValue.cpp
>index 81d8a75..2f3461f 100644
>--- a/Source/WebCore/css/CSSFontFaceSrcValue.cpp
>+++ b/Source/WebCore/css/CSSFontFaceSrcValue.cpp
>@@ -81,7 +81,9 @@ String CSSFontFaceSrcValue::customCSSText() const
>         result.append(m_format);
>         result.append(')');
>     }
>-    return result.toString();
>+    if (auto string = result.toString())
>+        return *string;
>+    CRASH();
> }
> 
> bool CSSFontFaceSrcValue::traverseSubresources(const WTF::Function<bool (const CachedResource&)>& handler) const
>diff --git a/Source/WebCore/css/CSSFontFeatureValue.cpp b/Source/WebCore/css/CSSFontFeatureValue.cpp
>index 7ff07f3..474622e 100644
>--- a/Source/WebCore/css/CSSFontFeatureValue.cpp
>+++ b/Source/WebCore/css/CSSFontFeatureValue.cpp
>@@ -50,7 +50,9 @@ String CSSFontFeatureValue::customCSSText() const
>         builder.append(' ');
>         builder.appendNumber(m_value);
>     }
>-    return builder.toString();
>+    if (auto string = builder.toString())
>+        return *string;
>+    CRASH();
> }
> 
> bool CSSFontFeatureValue::equals(const CSSFontFeatureValue& other) const
>diff --git a/Source/WebCore/css/CSSFontStyleRangeValue.cpp b/Source/WebCore/css/CSSFontStyleRangeValue.cpp
>index 0cdcdbf..ea666b4 100644
>--- a/Source/WebCore/css/CSSFontStyleRangeValue.cpp
>+++ b/Source/WebCore/css/CSSFontStyleRangeValue.cpp
>@@ -39,7 +39,9 @@ String CSSFontStyleRangeValue::customCSSText() const
>     builder.append(fontStyleValue->cssText());
>     builder.append(' ');
>     builder.append(obliqueValues->cssText());
>-    return builder.toString();
>+    if (auto string = builder.toString())
>+        return *string;
>+    CRASH();
> }
> 
> bool CSSFontStyleRangeValue::equals(const CSSFontStyleRangeValue& other) const
>diff --git a/Source/WebCore/css/CSSFontStyleValue.cpp b/Source/WebCore/css/CSSFontStyleValue.cpp
>index 2850e23..8c4e856 100644
>--- a/Source/WebCore/css/CSSFontStyleValue.cpp
>+++ b/Source/WebCore/css/CSSFontStyleValue.cpp
>@@ -39,7 +39,9 @@ String CSSFontStyleValue::customCSSText() const
>     builder.append(fontStyleValue->cssText());
>     builder.append(' ');
>     builder.append(obliqueValue->cssText());
>-    return builder.toString();
>+    if (auto string = builder.toString())
>+        return *string;
>+    CRASH();
> }
> 
> bool CSSFontStyleValue::equals(const CSSFontStyleValue& other) const
>diff --git a/Source/WebCore/css/CSSFontValue.cpp b/Source/WebCore/css/CSSFontValue.cpp
>index 766c113..1cf78ad 100644
>--- a/Source/WebCore/css/CSSFontValue.cpp
>+++ b/Source/WebCore/css/CSSFontValue.cpp
>@@ -65,7 +65,9 @@ String CSSFontValue::customCSSText() const
>         result.append(family->cssText());
>     }
> 
>-    return result.toString();
>+    if (auto string = result.toString())
>+        return *string;
>+    CRASH();
> }
> 
> bool CSSFontValue::equals(const CSSFontValue& other) const
>diff --git a/Source/WebCore/css/CSSFontVariationValue.cpp b/Source/WebCore/css/CSSFontVariationValue.cpp
>index 72ddc1a..4f925aa 100644
>--- a/Source/WebCore/css/CSSFontVariationValue.cpp
>+++ b/Source/WebCore/css/CSSFontVariationValue.cpp
>@@ -48,7 +48,9 @@ String CSSFontVariationValue::customCSSText() const
>         builder.append(c);
>     builder.appendLiteral("\" ");
>     builder.appendNumber(m_value);
>-    return builder.toString();
>+    if (auto string = builder.toString())
>+        return *string;
>+    CRASH();
> }
> 
> bool CSSFontVariationValue::equals(const CSSFontVariationValue& other) const
>diff --git a/Source/WebCore/css/CSSFunctionValue.cpp b/Source/WebCore/css/CSSFunctionValue.cpp
>index 75ef0c1..bbddff1 100644
>--- a/Source/WebCore/css/CSSFunctionValue.cpp
>+++ b/Source/WebCore/css/CSSFunctionValue.cpp
>@@ -37,7 +37,9 @@ String CSSFunctionValue::customCSSText() const
>     result.append('(');
>     result.append(CSSValueList::customCSSText());
>     result.append(')');
>-    return result.toString();
>+    if (auto string = result.toString())
>+        return *string;
>+    CRASH();
> }
> 
> }
>diff --git a/Source/WebCore/css/CSSGradientValue.cpp b/Source/WebCore/css/CSSGradientValue.cpp
>index 171d4726..e1443c8 100644
>--- a/Source/WebCore/css/CSSGradientValue.cpp
>+++ b/Source/WebCore/css/CSSGradientValue.cpp
>@@ -701,7 +701,9 @@ String CSSLinearGradientValue::customCSSText() const
>     }
> 
>     result.append(')');
>-    return result.toString();
>+    if (auto string = result.toString())
>+        return *string;
>+    CRASH();
> }
> 
> // Compute the endpoints so that a gradient of the given angle covers a box of the given size.
>@@ -1019,7 +1021,9 @@ String CSSRadialGradientValue::customCSSText() const
>     }
> 
>     result.append(')');
>-    return result.toString();
>+    if (auto string = result.toString())
>+        return *string;
>+    CRASH();
> }
> 
> float CSSRadialGradientValue::resolveRadius(CSSPrimitiveValue& radius, const CSSToLengthConversionData& conversionData, float* widthOrHeight)
>@@ -1347,7 +1351,9 @@ String CSSConicGradientValue::customCSSText() const
>     }
>     
>     result.append(')');
>-    return result.toString();
>+    if (auto string = result.toString())
>+        return *string;
>+    CRASH();
> }
> 
> Ref<Gradient> CSSConicGradientValue::createGradient(RenderElement&, const FloatSize&)
>diff --git a/Source/WebCore/css/CSSGridAutoRepeatValue.cpp b/Source/WebCore/css/CSSGridAutoRepeatValue.cpp
>index d5bc449..fd790dc 100644
>--- a/Source/WebCore/css/CSSGridAutoRepeatValue.cpp
>+++ b/Source/WebCore/css/CSSGridAutoRepeatValue.cpp
>@@ -43,7 +43,9 @@ String CSSGridAutoRepeatValue::customCSSText() const
>     result.append(", ");
>     result.append(CSSValueList::customCSSText());
>     result.append(')');
>-    return result.toString();
>+    if (auto string = result.toString())
>+        return *string;
>+    CRASH();
> }
> 
> } // namespace WebCore
>diff --git a/Source/WebCore/css/CSSGridTemplateAreasValue.cpp b/Source/WebCore/css/CSSGridTemplateAreasValue.cpp
>index e0b7865..8bc3ffb 100644
>--- a/Source/WebCore/css/CSSGridTemplateAreasValue.cpp
>+++ b/Source/WebCore/css/CSSGridTemplateAreasValue.cpp
>@@ -80,7 +80,9 @@ String CSSGridTemplateAreasValue::customCSSText() const
>         if (row != m_rowCount - 1)
>             builder.append(' ');
>     }
>-    return builder.toString();
>+    if (auto string = builder.toString())
>+        return *string;
>+    CRASH();
> }
> 
> bool CSSGridTemplateAreasValue::equals(const CSSGridTemplateAreasValue& other) const
>diff --git a/Source/WebCore/css/CSSImageSetValue.cpp b/Source/WebCore/css/CSSImageSetValue.cpp
>index a97dc21..e3750a2 100644
>--- a/Source/WebCore/css/CSSImageSetValue.cpp
>+++ b/Source/WebCore/css/CSSImageSetValue.cpp
>@@ -146,7 +146,9 @@ String CSSImageSetValue::customCSSText() const
>     }
> 
>     result.append(')');
>-    return result.toString();
>+    if (auto string = result.toString())
>+        return *string;
>+    CRASH();
> }
> 
> bool CSSImageSetValue::traverseSubresources(const WTF::Function<bool (const CachedResource&)>& handler) const
>diff --git a/Source/WebCore/css/CSSImportRule.cpp b/Source/WebCore/css/CSSImportRule.cpp
>index 4c66613..f9aaeec 100644
>--- a/Source/WebCore/css/CSSImportRule.cpp
>+++ b/Source/WebCore/css/CSSImportRule.cpp
>@@ -72,7 +72,9 @@ String CSSImportRule::cssText() const
>     }
>     result.append(';');
>     
>-    return result.toString();
>+    if (auto string = result.toString())
>+        return *string;
>+    CRASH();
> }
> 
> CSSStyleSheet* CSSImportRule::styleSheet() const
>diff --git a/Source/WebCore/css/CSSKeyframeRule.cpp b/Source/WebCore/css/CSSKeyframeRule.cpp
>index 81e9958..dca3f73 100644
>--- a/Source/WebCore/css/CSSKeyframeRule.cpp
>+++ b/Source/WebCore/css/CSSKeyframeRule.cpp
>@@ -67,7 +67,9 @@ String StyleRuleKeyframe::keyText() const
>         keyText.append('%');
>     }
> 
>-    return keyText.toString();
>+    if (auto string = keyText.toString())
>+        return *string;
>+    CRASH();
> }
>     
> bool StyleRuleKeyframe::setKeyText(const String& keyText)
>@@ -90,7 +92,9 @@ String StyleRuleKeyframe::cssText() const
>     if (!decls.isEmpty())
>         result.append(' ');
>     result.append('}');
>-    return result.toString();
>+    if (auto string = result.toString())
>+        return *string;
>+    CRASH();
> }
> 
> CSSKeyframeRule::CSSKeyframeRule(StyleRuleKeyframe& keyframe, CSSKeyframesRule* parent)
>diff --git a/Source/WebCore/css/CSSKeyframesRule.cpp b/Source/WebCore/css/CSSKeyframesRule.cpp
>index 9f000d9..77b1826 100644
>--- a/Source/WebCore/css/CSSKeyframesRule.cpp
>+++ b/Source/WebCore/css/CSSKeyframesRule.cpp
>@@ -198,7 +198,9 @@ String CSSKeyframesRule::cssText() const
>         result.append('\n');
>     }
>     result.append('}');
>-    return result.toString();
>+    if (auto string = result.toString())
>+        return *string;
>+    CRASH();
> }
> 
> unsigned CSSKeyframesRule::length() const
>diff --git a/Source/WebCore/css/CSSLineBoxContainValue.cpp b/Source/WebCore/css/CSSLineBoxContainValue.cpp
>index 19fdf8b..3deb3bd 100644
>--- a/Source/WebCore/css/CSSLineBoxContainValue.cpp
>+++ b/Source/WebCore/css/CSSLineBoxContainValue.cpp
>@@ -73,7 +73,9 @@ String CSSLineBoxContainValue::customCSSText() const
>         text.appendLiteral("initial-letter");
>     }
> 
>-    return text.toString();
>+    if (auto string = text.toString())
>+        return *string;
>+    CRASH();
> }
> 
> }
>diff --git a/Source/WebCore/css/CSSMarkup.cpp b/Source/WebCore/css/CSSMarkup.cpp
>index 81fe888..609c713 100644
>--- a/Source/WebCore/css/CSSMarkup.cpp
>+++ b/Source/WebCore/css/CSSMarkup.cpp
>@@ -186,7 +186,9 @@ String serializeString(const String& string)
> {
>     StringBuilder builder;
>     serializeString(string, builder);
>-    return builder.toString();
>+    if (auto string = builder.toString())
>+        return *string;
>+    CRASH();
> }
> 
> String serializeURL(const String& string)
>@@ -204,7 +206,9 @@ String serializeAsStringOrCustomIdent(const String& string)
>     if (isCSSTokenizerIdentifier(string)) {
>         StringBuilder builder;
>         serializeIdentifier(string, builder);
>-        return builder.toString();
>+        if (auto string = builder.toString())
>+            return *string;
>+        CRASH();
>     }
>     return serializeString(string);
> }
>diff --git a/Source/WebCore/css/CSSMediaRule.cpp b/Source/WebCore/css/CSSMediaRule.cpp
>index b094edd..174f5a6 100644
>--- a/Source/WebCore/css/CSSMediaRule.cpp
>+++ b/Source/WebCore/css/CSSMediaRule.cpp
>@@ -57,7 +57,9 @@ String CSSMediaRule::cssText() const
>     result.appendLiteral("{ \n");
>     appendCssTextForItems(result);
>     result.append('}');
>-    return result.toString();
>+    if (auto string = result.toString())
>+        return *string;
>+    CRASH();
> }
> 
> MediaList* CSSMediaRule::media() const
>diff --git a/Source/WebCore/css/CSSNamespaceRule.cpp b/Source/WebCore/css/CSSNamespaceRule.cpp
>index 3d3ec6f..7068971 100644
>--- a/Source/WebCore/css/CSSNamespaceRule.cpp
>+++ b/Source/WebCore/css/CSSNamespaceRule.cpp
>@@ -60,7 +60,9 @@ String CSSNamespaceRule::cssText() const
>     result.append("url(");
>     result.append(serializeString(namespaceURI()));
>     result.append(");");
>-    return result.toString();
>+    if (auto string = result.toString())
>+        return *string;
>+    CRASH();
> }
> 
> void CSSNamespaceRule::reattach(StyleRuleBase&)
>diff --git a/Source/WebCore/css/CSSPageRule.cpp b/Source/WebCore/css/CSSPageRule.cpp
>index 47cf456..e69da5a 100644
>--- a/Source/WebCore/css/CSSPageRule.cpp
>+++ b/Source/WebCore/css/CSSPageRule.cpp
>@@ -64,7 +64,9 @@ String CSSPageRule::selectorText() const
>             text.append(pageSpecification);
>         }
>     }
>-    return text.toString();
>+    if (auto string = text.toString())
>+        return *string;
>+    CRASH();
> }
> 
> void CSSPageRule::setSelectorText(const String& selectorText)
>@@ -90,7 +92,9 @@ String CSSPageRule::cssText() const
>     if (!decls.isEmpty())
>         result.append(' ');
>     result.append('}');
>-    return result.toString();
>+    if (auto string = result.toString())
>+        return *string;
>+    CRASH();
> }
> 
> void CSSPageRule::reattach(StyleRuleBase& rule)
>diff --git a/Source/WebCore/css/CSSPrimitiveValue.cpp b/Source/WebCore/css/CSSPrimitiveValue.cpp
>index a761276..83e16e0 100644
>--- a/Source/WebCore/css/CSSPrimitiveValue.cpp
>+++ b/Source/WebCore/css/CSSPrimitiveValue.cpp
>@@ -1045,7 +1045,9 @@ ALWAYS_INLINE String CSSPrimitiveValue::formatNumberForCustomCSSText() const
>         result.append(String(m_value.string));
>         result.append(')');
> 
>-        return result.toString();
>+        if (auto string = result.toString())
>+            return *string;
>+        CRASH();
>     }
>     case CSS_COUNTER_NAME:
>         return "counter(" + String(m_value.string) + ')';
>@@ -1069,7 +1071,9 @@ ALWAYS_INLINE String CSSPrimitiveValue::formatNumberForCustomCSSText() const
>         }
>         result.append(')');
> 
>-        return result.toString();
>+        if (auto string = result.toString())
>+            return *string;
>+        CRASH();
>     }
>     case CSS_RECT:
>         return rectValue()->cssText();
>@@ -1112,7 +1116,9 @@ ALWAYS_INLINE String CSSPrimitiveValue::formatNumberForCustomCSSText() const
>             }
>             result.append(')');
>         }
>-        return result.toString();
>+        if (auto string = result.toString())
>+            return *string;
>+        CRASH();
>     }
> #endif
>     case CSS_CALC:
>diff --git a/Source/WebCore/css/CSSPropertySourceData.cpp b/Source/WebCore/css/CSSPropertySourceData.cpp
>index 75b7990..fd2e82b 100644
>--- a/Source/WebCore/css/CSSPropertySourceData.cpp
>+++ b/Source/WebCore/css/CSSPropertySourceData.cpp
>@@ -96,7 +96,9 @@ String CSSPropertySourceData::toString() const
>     if (important)
>         result.appendLiteral(" !important");
>     result.append(';');
>-    return result.toString();
>+    if (auto string = result.toString())
>+        return *string;
>+    CRASH();
> }
> 
> unsigned CSSPropertySourceData::hash() const
>diff --git a/Source/WebCore/css/CSSSelector.cpp b/Source/WebCore/css/CSSSelector.cpp
>index 1fe42cd..56bfc2b 100644
>--- a/Source/WebCore/css/CSSSelector.cpp
>+++ b/Source/WebCore/css/CSSSelector.cpp
>@@ -726,26 +726,31 @@ String CSSSelector::selectorText(const String& rightSide) const
>         cs = cs->tagHistory();
>     }
> 
>+    String string;
>+    if (auto s = str.toString())
>+        string = *s;
>+    else
>+        CRASH();
>     if (const CSSSelector* tagHistory = cs->tagHistory()) {
>         switch (cs->relation()) {
>         case CSSSelector::DescendantSpace:
>-            return tagHistory->selectorText(" " + str.toString() + rightSide);
>+            return tagHistory->selectorText(" " + string + rightSide);
>         case CSSSelector::Child:
>-            return tagHistory->selectorText(" > " + str.toString() + rightSide);
>+            return tagHistory->selectorText(" > " + string + rightSide);
>         case CSSSelector::DirectAdjacent:
>-            return tagHistory->selectorText(" + " + str.toString() + rightSide);
>+            return tagHistory->selectorText(" + " + string + rightSide);
>         case CSSSelector::IndirectAdjacent:
>-            return tagHistory->selectorText(" ~ " + str.toString() + rightSide);
>+            return tagHistory->selectorText(" ~ " + string + rightSide);
>         case CSSSelector::Subselector:
>             ASSERT_NOT_REACHED();
> #if ASSERT_DISABLED
>             FALLTHROUGH;
> #endif
>         case CSSSelector::ShadowDescendant:
>-            return tagHistory->selectorText(str.toString() + rightSide);
>+            return tagHistory->selectorText(string + rightSide);
>         }
>     }
>-    return str.toString() + rightSide;
>+    return string + rightSide;
> }
> 
> void CSSSelector::setAttribute(const QualifiedName& value, bool isCaseInsensitive)
>diff --git a/Source/WebCore/css/CSSSelectorList.cpp b/Source/WebCore/css/CSSSelectorList.cpp
>index 57efa67..ae3300d 100644
>--- a/Source/WebCore/css/CSSSelectorList.cpp
>+++ b/Source/WebCore/css/CSSSelectorList.cpp
>@@ -138,7 +138,9 @@ String CSSSelectorList::selectorsText() const
> {
>     StringBuilder result;
>     buildSelectorsText(result);
>-    return result.toString();
>+    if (auto string = result.toString())
>+        return *string;
>+    CRASH();
> }
> 
> void CSSSelectorList::buildSelectorsText(StringBuilder& stringBuilder) const
>diff --git a/Source/WebCore/css/CSSShadowValue.cpp b/Source/WebCore/css/CSSShadowValue.cpp
>index 94947d7..e29c85e 100644
>--- a/Source/WebCore/css/CSSShadowValue.cpp
>+++ b/Source/WebCore/css/CSSShadowValue.cpp
>@@ -69,7 +69,9 @@ String CSSShadowValue::customCSSText() const
>         text.append(style->cssText());
>     }
> 
>-    return text.toString();
>+    if (auto string = text.toString())
>+        return *string;
>+    CRASH();
> }
> 
> bool CSSShadowValue::equals(const CSSShadowValue& other) const
>diff --git a/Source/WebCore/css/CSSStyleRule.cpp b/Source/WebCore/css/CSSStyleRule.cpp
>index bb8d21c..5808fd1 100644
>--- a/Source/WebCore/css/CSSStyleRule.cpp
>+++ b/Source/WebCore/css/CSSStyleRule.cpp
>@@ -120,7 +120,9 @@ String CSSStyleRule::cssText() const
>     if (!decls.isEmpty())
>         result.append(' ');
>     result.append('}');
>-    return result.toString();
>+    if (auto string = result.toString())
>+        return *string;
>+    CRASH();
> }
> 
> void CSSStyleRule::reattach(StyleRuleBase& rule)
>diff --git a/Source/WebCore/css/CSSStyleSheet.cpp b/Source/WebCore/css/CSSStyleSheet.cpp
>index 1ecc5ba..86984ff 100644
>--- a/Source/WebCore/css/CSSStyleSheet.cpp
>+++ b/Source/WebCore/css/CSSStyleSheet.cpp
>@@ -316,9 +316,12 @@ ExceptionOr<int> CSSStyleSheet::addRule(const String& selector, const String& st
>     if (!style.isEmpty())
>         text.append(' ');
>     text.append('}');
>-    auto insertRuleResult = insertRule(text.toString(), index.value_or(length()));
>-    if (insertRuleResult.hasException())
>-        return insertRuleResult.releaseException();
>+    if (auto string = text.toString()) {
>+        auto insertRuleResult = insertRule(*string, index.value_or(length()));
>+        if (insertRuleResult.hasException())
>+            return insertRuleResult.releaseException();
>+    } else
>+        CRASH();
>     
>     // As per Microsoft documentation, always return -1.
>     return -1;
>diff --git a/Source/WebCore/css/CSSSupportsRule.cpp b/Source/WebCore/css/CSSSupportsRule.cpp
>index e13e13b..fcbe324 100644
>--- a/Source/WebCore/css/CSSSupportsRule.cpp
>+++ b/Source/WebCore/css/CSSSupportsRule.cpp
>@@ -50,7 +50,9 @@ String CSSSupportsRule::cssText() const
>     appendCssTextForItems(result);
>     result.append('}');
> 
>-    return result.toString();
>+    if (auto string = result.toString())
>+        return *string;
>+    CRASH();
> }
> 
> String CSSSupportsRule::conditionText() const
>diff --git a/Source/WebCore/css/CSSTimingFunctionValue.cpp b/Source/WebCore/css/CSSTimingFunctionValue.cpp
>index 90ef6cd..092882b 100644
>--- a/Source/WebCore/css/CSSTimingFunctionValue.cpp
>+++ b/Source/WebCore/css/CSSTimingFunctionValue.cpp
>@@ -42,7 +42,9 @@ String CSSCubicBezierTimingFunctionValue::customCSSText() const
>     builder.appendLiteral(", ");
>     builder.appendNumber(m_y2);
>     builder.append(')');    
>-    return builder.toString();
>+    if (auto string = builder.toString())
>+        return *string;
>+    CRASH();
> }
> 
> bool CSSCubicBezierTimingFunctionValue::equals(const CSSCubicBezierTimingFunctionValue& other) const
>@@ -59,7 +61,9 @@ String CSSStepsTimingFunctionValue::customCSSText() const
>         builder.appendLiteral(", start)");
>     else
>         builder.appendLiteral(", end)");
>-    return builder.toString();
>+    if (auto string = builder.toString())
>+        return *string;
>+    CRASH();
> }
> 
> bool CSSStepsTimingFunctionValue::equals(const CSSStepsTimingFunctionValue& other) const
>@@ -73,7 +77,9 @@ String CSSFramesTimingFunctionValue::customCSSText() const
>     builder.appendLiteral("frames(");
>     builder.appendNumber(m_frames);
>     builder.appendLiteral(")");
>-    return builder.toString();
>+    if (auto string = builder.toString())
>+        return *string;
>+    CRASH();
> }
> 
> bool CSSFramesTimingFunctionValue::equals(const CSSFramesTimingFunctionValue& other) const
>@@ -93,7 +99,9 @@ String CSSSpringTimingFunctionValue::customCSSText() const
>     builder.append(' ');
>     builder.appendNumber(m_initialVelocity);
>     builder.append(')');
>-    return builder.toString();
>+    if (auto string = builder.toString())
>+        return *string;
>+    CRASH();
> }
> 
> bool CSSSpringTimingFunctionValue::equals(const CSSSpringTimingFunctionValue& other) const
>diff --git a/Source/WebCore/css/CSSValueList.cpp b/Source/WebCore/css/CSSValueList.cpp
>index b6e0c2c5..3090e33 100644
>--- a/Source/WebCore/css/CSSValueList.cpp
>+++ b/Source/WebCore/css/CSSValueList.cpp
>@@ -107,7 +107,9 @@ String CSSValueList::customCSSText() const
>         result.append(value.get().cssText());
>     }
> 
>-    return result.toString();
>+    if (auto string = result.toString())
>+        return *string;
>+    CRASH();
> }
> 
> bool CSSValueList::equals(const CSSValueList& other) const
>diff --git a/Source/WebCore/css/CSSVariableData.cpp b/Source/WebCore/css/CSSVariableData.cpp
>index 98c9d09..3118de9 100644
>--- a/Source/WebCore/css/CSSVariableData.cpp
>+++ b/Source/WebCore/css/CSSVariableData.cpp
>@@ -68,7 +68,10 @@ void CSSVariableData::consumeAndUpdateTokens(const CSSParserTokenRange& range)
>         if (token.hasStringBacking())
>             stringBuilder.append(token.value());
>     }
>-    m_backingString = stringBuilder.toString();
>+    if (auto string = stringBuilder.toString())
>+        m_backingString = *string;
>+    else
>+        CRASH();
>     if (m_backingString.is8Bit())
>         updateTokens<LChar>(range);
>     else
>diff --git a/Source/WebCore/css/DOMCSSNamespace.cpp b/Source/WebCore/css/DOMCSSNamespace.cpp
>index 9135237..ce15d6b 100644
>--- a/Source/WebCore/css/DOMCSSNamespace.cpp
>+++ b/Source/WebCore/css/DOMCSSNamespace.cpp
>@@ -84,7 +84,9 @@ String DOMCSSNamespace::escape(const String& ident)
> {
>     StringBuilder builder;
>     serializeIdentifier(ident, builder);
>-    return builder.toString();
>+    if (auto string = builder.toString())
>+        return *string;
>+    CRASH();
> }
> 
> }
>diff --git a/Source/WebCore/css/DOMMatrixReadOnly.cpp b/Source/WebCore/css/DOMMatrixReadOnly.cpp
>index f74b465..788228f 100644
>--- a/Source/WebCore/css/DOMMatrixReadOnly.cpp
>+++ b/Source/WebCore/css/DOMMatrixReadOnly.cpp
>@@ -450,7 +450,9 @@ ExceptionOr<String> DOMMatrixReadOnly::toString() const
>         builder.append(String::numberToStringECMAScript(m_matrix.m44()));
>     }
>     builder.append(')');
>-    return builder.toString();
>+    if (auto string = builder.toString())
>+        return WTFMove(*string);
>+    CRASH();
> }
> 
> } // namespace WebCore
>diff --git a/Source/WebCore/css/DeprecatedCSSOMValueList.cpp b/Source/WebCore/css/DeprecatedCSSOMValueList.cpp
>index e496884..5e98e21 100644
>--- a/Source/WebCore/css/DeprecatedCSSOMValueList.cpp
>+++ b/Source/WebCore/css/DeprecatedCSSOMValueList.cpp
>@@ -54,7 +54,9 @@ String DeprecatedCSSOMValueList::cssText() const
>         result.append(value.get().cssText());
>     }
>     
>-    return result.toString();
>+    if (auto string = result.toString())
>+        return *string;
>+    CRASH();
> }
> 
> }
>diff --git a/Source/WebCore/css/FontFace.cpp b/Source/WebCore/css/FontFace.cpp
>index 581f5e8..c2586a7 100644
>--- a/Source/WebCore/css/FontFace.cpp
>+++ b/Source/WebCore/css/FontFace.cpp
>@@ -328,7 +328,9 @@ String FontFace::style() const
>         builder.append(' ');
>         builder.append(maximumNonKeyword->obliqueValue->cssText());
>     }
>-    return builder.toString();
>+    if (auto string = builder.toString())
>+        return *string;
>+    CRASH();
> }
> 
> String FontFace::weight() const
>@@ -349,7 +351,9 @@ String FontFace::weight() const
>     builder.append(minimumNonKeyword->cssText());
>     builder.append(' ');
>     builder.append(maximumNonKeyword->cssText());
>-    return builder.toString();
>+    if (auto string = builder.toString())
>+        return *string;
>+    CRASH();
> }
> 
> String FontFace::stretch() const
>@@ -370,7 +374,9 @@ String FontFace::stretch() const
>     builder.append(minimumNonKeyword->cssText());
>     builder.append(' ');
>     builder.append(maximumNonKeyword->cssText());
>-    return builder.toString();
>+    if (auto string = builder.toString())
>+        return *string;
>+    CRASH();
> }
> 
> String FontFace::unicodeRange() const
>diff --git a/Source/WebCore/css/MediaList.cpp b/Source/WebCore/css/MediaList.cpp
>index 45750af..4269404 100644
>--- a/Source/WebCore/css/MediaList.cpp
>+++ b/Source/WebCore/css/MediaList.cpp
>@@ -151,7 +151,9 @@ String MediaQuerySet::mediaText() const
>         text.append(query.cssText());
>         needComma = true;
>     }
>-    return text.toString();
>+    if (auto string = text.toString())
>+        return *string;
>+    CRASH();
> }
> 
> void MediaQuerySet::shrinkToFit()
>diff --git a/Source/WebCore/css/MediaQuery.cpp b/Source/WebCore/css/MediaQuery.cpp
>index 9d0badf..4070d7a 100644
>--- a/Source/WebCore/css/MediaQuery.cpp
>+++ b/Source/WebCore/css/MediaQuery.cpp
>@@ -66,7 +66,9 @@ String MediaQuery::serialize() const
>         result.append(expression.serialize());
>         needsAnd = true;
>     }
>-    return result.toString();
>+    if (auto string = result.toString())
>+        return *string;
>+    CRASH();
> }
> 
> MediaQuery::MediaQuery(Restrictor restrictor, const String& mediaType, Vector<MediaQueryExpression>&& expressions)
>diff --git a/Source/WebCore/css/MediaQueryExpression.cpp b/Source/WebCore/css/MediaQueryExpression.cpp
>index 2d8e5f0..e0a22f3 100644
>--- a/Source/WebCore/css/MediaQueryExpression.cpp
>+++ b/Source/WebCore/css/MediaQueryExpression.cpp
>@@ -244,7 +244,10 @@ String MediaQueryExpression::serialize() const
>     }
>     result.append(')');
> 
>-    m_serializationCache = result.toString();
>+    if (auto string = result.toString())
>+        m_serializationCache = *string;
>+    else
>+        CRASH();
>     return m_serializationCache;
> }
> 
>diff --git a/Source/WebCore/css/Rect.h b/Source/WebCore/css/Rect.h
>index ec1aae8..dfae176 100644
>--- a/Source/WebCore/css/Rect.h
>+++ b/Source/WebCore/css/Rect.h
>@@ -103,7 +103,9 @@ private:
>                 }
>             }
>         }
>-        return result.toString();
>+        if (auto string = result.toString())
>+            return *string;
>+        CRASH();
>     }
> };
> 
>diff --git a/Source/WebCore/css/StyleProperties.cpp b/Source/WebCore/css/StyleProperties.cpp
>index 3c8ce43..bff172b 100644
>--- a/Source/WebCore/css/StyleProperties.cpp
>+++ b/Source/WebCore/css/StyleProperties.cpp
>@@ -343,7 +343,9 @@ String StyleProperties::fontValue() const
>     result.append(fontFamilyProperty.value()->cssText());
>     if (isInitialOrInherit(commonValue))
>         return commonValue;
>-    return result.toString();
>+    if (auto string = result.toString())
>+        return *string;
>+    CRASH();
> }
> 
> String StyleProperties::get4Values(const StylePropertyShorthand& shorthand) const
>@@ -397,7 +399,9 @@ String StyleProperties::get4Values(const StylePropertyShorthand& shorthand) cons
>         result.append(' ');
>         result.append(left.value()->cssText());
>     }
>-    return result.toString();
>+    if (auto string = result.toString())
>+        return *string;
>+    CRASH();
> }
> 
> String StyleProperties::getLayeredShorthandValue(const StylePropertyShorthand& shorthand) const
>@@ -543,7 +547,9 @@ String StyleProperties::getLayeredShorthandValue(const StylePropertyShorthand& s
> 
>     if (result.isEmpty())
>         return String();
>-    return result.toString();
>+    if (auto string = result.toString())
>+        return *string;
>+    CRASH();
> }
> 
> String StyleProperties::getShorthandValue(const StylePropertyShorthand& shorthand) const
>@@ -572,7 +578,9 @@ String StyleProperties::getShorthandValue(const StylePropertyShorthand& shorthan
>         return commonValue;
>     if (result.isEmpty())
>         return String();
>-    return result.toString();
>+    if (auto string = result.toString())
>+        return *string;
>+    CRASH();
> }
> 
> // only returns a non-null value if all properties have the same, non-null value
>@@ -634,7 +642,11 @@ String StyleProperties::borderPropertyValue(CommonValueMode valueMode) const
>     }
>     if (isInitialOrInherit(commonValue))
>         return commonValue;
>-    return result.isEmpty() ? String() : result.toString();
>+    if (result.isEmpty())
>+        return String();
>+    if (auto string = result.toString())
>+        return *string;
>+    CRASH();
> }
> 
> RefPtr<CSSValue> StyleProperties::getPropertyCSSValue(CSSPropertyID propertyID) const
>@@ -1146,7 +1158,9 @@ String StyleProperties::asText() const
>     }
> 
>     ASSERT(!numDecls ^ !result.isEmpty());
>-    return result.toString();
>+    if (auto string = result.toString())
>+        return *string;
>+    CRASH();
> }
> 
> bool StyleProperties::hasCSSOMWrapper() const
>@@ -1403,7 +1417,9 @@ String StyleProperties::PropertyReference::cssText() const
>     if (isImportant())
>         result.appendLiteral(" !important");
>     result.append(';');
>-    return result.toString();
>+    if (auto string = result.toString())
>+        return *string;
>+    CRASH();
> }
>     
> Ref<DeferredStyleProperties> DeferredStyleProperties::create(const CSSParserTokenRange& tokenRange, CSSDeferredParser& parser)
>diff --git a/Source/WebCore/css/WebKitCSSMatrix.cpp b/Source/WebCore/css/WebKitCSSMatrix.cpp
>index 7bde64d..1f78d12 100644
>--- a/Source/WebCore/css/WebKitCSSMatrix.cpp
>+++ b/Source/WebCore/css/WebKitCSSMatrix.cpp
>@@ -249,7 +249,9 @@ ExceptionOr<String> WebKitCSSMatrix::toString() const
>         builder.append(String::numberToStringECMAScript(m_matrix.m44()));
>     }
>     builder.append(')');
>-    return builder.toString();
>+    if (auto string = builder.toString())
>+        return WTFMove(*string);
>+    CRASH();
> }
> 
> } // namespace WebCore
>diff --git a/Source/WebCore/css/WebKitCSSViewportRule.cpp b/Source/WebCore/css/WebKitCSSViewportRule.cpp
>index cbd172f..de6ec95 100644
>--- a/Source/WebCore/css/WebKitCSSViewportRule.cpp
>+++ b/Source/WebCore/css/WebKitCSSViewportRule.cpp
>@@ -72,7 +72,9 @@ String WebKitCSSViewportRule::cssText() const
> 
>     result.append('}');
> 
>-    return result.toString();
>+    if (auto string = result.toString())
>+        return *string;
>+    CRASH();
> }
> 
> void WebKitCSSViewportRule::reattach(StyleRuleBase& rule)
>diff --git a/Source/WebCore/css/parser/CSSParser.cpp b/Source/WebCore/css/parser/CSSParser.cpp
>index 954ab08..ecbfabd 100644
>--- a/Source/WebCore/css/parser/CSSParser.cpp
>+++ b/Source/WebCore/css/parser/CSSParser.cpp
>@@ -299,10 +299,13 @@ RefPtr<CSSValue> CSSParser::parseFontFaceDescriptor(CSSPropertyID propertyID, co
>     builder.appendLiteral(" : ");
>     builder.append(propertyValue);
>     builder.appendLiteral("; }");
>-    RefPtr<StyleRuleBase> rule = parseRule(context, nullptr, builder.toString());
>-    if (!rule || !rule->isFontFaceRule())
>-        return nullptr;
>-    return downcast<StyleRuleFontFace>(*rule.get()).properties().getPropertyCSSValue(propertyID);
>+    if (auto string  = builder.toString()) {
>+        RefPtr<StyleRuleBase> rule = parseRule(context, nullptr, *string);
>+        if (!rule || !rule->isFontFaceRule())
>+            return nullptr;
>+        return downcast<StyleRuleFontFace>(*rule.get()).properties().getPropertyCSSValue(propertyID);
>+    }
>+    CRASH();
> }
> 
> }
>diff --git a/Source/WebCore/css/parser/CSSParserToken.cpp b/Source/WebCore/css/parser/CSSParserToken.cpp
>index 7b8e603..5d1016d 100644
>--- a/Source/WebCore/css/parser/CSSParserToken.cpp
>+++ b/Source/WebCore/css/parser/CSSParserToken.cpp
>@@ -392,7 +392,8 @@ void CSSParserToken::serialize(StringBuilder& builder) const
>         break;
>     case FunctionToken:
>         serializeIdentifier(value().toString(), builder);
>-        return builder.append('(');
>+        builder.append('(');
>+        return;
>     case AtKeywordToken:
>         builder.append('@');
>         serializeIdentifier(value().toString(), builder);
>@@ -404,69 +405,97 @@ void CSSParserToken::serialize(StringBuilder& builder) const
>     case UrlToken:
>         builder.append("url(");
>         serializeIdentifier(value().toString(), builder);
>-        return builder.append(')');
>+        builder.append(')');
>+        return;
>     case DelimiterToken:
>-        if (delimiter() == '\\')
>-            return builder.append("\\\n");
>-        return builder.append(delimiter());
>+        if (delimiter() == '\\') {
>+            builder.append("\\\n");
>+            return;
>+        }
>+        builder.append(delimiter());
>+        return;
>     case NumberToken:
>         // These won't properly preserve the NumericValueType flag
>         if (m_numericSign == PlusSign)
>             builder.append('+');
>-        return builder.appendNumber(numericValue());
>+        builder.appendNumber(numericValue());
>+        return;
>     case PercentageToken:
>         builder.appendNumber(numericValue());
>-        return builder.append('%');
>+        builder.append('%');
>+        return;
>     case DimensionToken:
>         // This will incorrectly serialize e.g. 4e3e2 as 4000e2
>         builder.appendNumber(numericValue());
>         serializeIdentifier(value().toString(), builder);
>         break;
>     case UnicodeRangeToken:
>-        return builder.append(String::format("U+%X-%X", unicodeRangeStart(), unicodeRangeEnd()));
>+        builder.append(String::format("U+%X-%X", unicodeRangeStart(), unicodeRangeEnd()));
>+        return;
>     case StringToken:
>-        return serializeString(value().toString(), builder);
>+        serializeString(value().toString(), builder);
>+        return;
> 
>     case IncludeMatchToken:
>-        return builder.append("~=");
>+        builder.append("~=");
>+        return;
>     case DashMatchToken:
>-        return builder.append("|=");
>+        builder.append("|=");
>+        return;
>     case PrefixMatchToken:
>-        return builder.append("^=");
>+        builder.append("^=");
>+        return;
>     case SuffixMatchToken:
>-        return builder.append("$=");
>+        builder.append("$=");
>+        return;
>     case SubstringMatchToken:
>-        return builder.append("*=");
>+        builder.append("*=");
>+        return;
>     case ColumnToken:
>-        return builder.append("||");
>+        builder.append("||");
>+        return;
>     case CDOToken:
>-        return builder.append("");
>+        builder.append("-->");
>+        return;
>     case BadStringToken:
>-        return builder.append("'\n");
>+        builder.append("'\n");
>+        return;
>     case BadUrlToken:
>-        return builder.append("url(()");
>+        builder.append("url(()");
>+        return;
>     case WhitespaceToken:
>-        return builder.append(' ');
>+        builder.append(' ');
>+        return;
>     case ColonToken:
>-        return builder.append(':');
>+        builder.append(':');
>+        return;
>     case SemicolonToken:
>-        return builder.append(';');
>+        builder.append(';');
>+        return;
>     case CommaToken:
>-        return builder.append(',');
>+        builder.append(',');
>+        return;
>     case LeftParenthesisToken:
>-        return builder.append('(');
>+        builder.append('(');
>+        return;
>     case RightParenthesisToken:
>-        return builder.append(')');
>+        builder.append(')');
>+        return;
>     case LeftBracketToken:
>-        return builder.append('[');
>+        builder.append('[');
>+        return;
>     case RightBracketToken:
>-        return builder.append(']');
>+        builder.append(']');
>+        return;
>     case LeftBraceToken:
>-        return builder.append('{');
>+        builder.append('{');
>+        return;
>     case RightBraceToken:
>-        return builder.append('}');
>+        builder.append('}');
>+        return;
> 
>     case EOFToken:
>     case CommentToken:
>diff --git a/Source/WebCore/css/parser/CSSParserTokenRange.cpp b/Source/WebCore/css/parser/CSSParserTokenRange.cpp
>index cb9c580..efe5a2f 100644
>--- a/Source/WebCore/css/parser/CSSParserTokenRange.cpp
>+++ b/Source/WebCore/css/parser/CSSParserTokenRange.cpp
>@@ -113,7 +113,9 @@ String CSSParserTokenRange::serialize() const
>     StringBuilder builder;
>     for (const CSSParserToken* it = m_first; it < m_last; ++it)
>         it->serialize(builder);
>-    return builder.toString();
>+    if (auto string = builder.toString())
>+        return *string;
>+    CRASH();
> }
> 
> } // namespace WebCore
>diff --git a/Source/WebCore/css/parser/CSSPropertyParser.cpp b/Source/WebCore/css/parser/CSSPropertyParser.cpp
>index bcece70..309075e 100644
>--- a/Source/WebCore/css/parser/CSSPropertyParser.cpp
>+++ b/Source/WebCore/css/parser/CSSPropertyParser.cpp
>@@ -1016,7 +1016,9 @@ static String concatenateFamilyName(CSSParserTokenRange& range)
>     }
>     if (!addedSpace && isCSSWideKeyword(firstToken.id()))
>         return String();
>-    return builder.toString();
>+    if (auto string = builder.toString())
>+        return *string;
>+    CRASH();
> }
> 
> static RefPtr<CSSValue> consumeFamilyName(CSSParserTokenRange& range)
>@@ -3264,7 +3266,10 @@ static Vector<String> parseGridTemplateAreasColumnNames(const String& gridRowNam
>     for (unsigned i = 0; i < text.length(); ++i) {
>         if (isCSSSpace(text[i])) {
>             if (!areaName.isEmpty()) {
>-                columnNames.append(areaName.toString());
>+                if (auto string = areaName.toString())
>+                    columnNames.append(*string);
>+                else
>+                    CRASH();
>                 areaName.clear();
>             }
>             continue;
>@@ -3273,14 +3278,20 @@ static Vector<String> parseGridTemplateAreasColumnNames(const String& gridRowNam
>             if (areaName == ".")
>                 continue;
>             if (!areaName.isEmpty()) {
>-                columnNames.append(areaName.toString());
>+                if (auto string = areaName.toString())
>+                    columnNames.append(*string);
>+                else
>+                    CRASH();
>                 areaName.clear();
>             }
>         } else {
>             if (!isNameCodePoint(text[i]))
>                 return Vector<String>();
>             if (areaName == ".") {
>-                columnNames.append(areaName.toString());
>+                if (auto string = areaName.toString())
>+                    columnNames.append(*string);
>+                else
>+                    CRASH();
>                 areaName.clear();
>             }
>         }
>@@ -3288,8 +3299,12 @@ static Vector<String> parseGridTemplateAreasColumnNames(const String& gridRowNam
>         areaName.append(text[i]);
>     }
> 
>-    if (!areaName.isEmpty())
>-        columnNames.append(areaName.toString());
>+    if (!areaName.isEmpty()) {
>+        if (auto string = areaName.toString())
>+            columnNames.append(*string);
>+        else
>+            CRASH();
>+    }
> 
>     return columnNames;
> }
>diff --git a/Source/WebCore/css/parser/CSSTokenizer.cpp b/Source/WebCore/css/parser/CSSTokenizer.cpp
>index 1f1a23e..3b84e26 100644
>--- a/Source/WebCore/css/parser/CSSTokenizer.cpp
>+++ b/Source/WebCore/css/parser/CSSTokenizer.cpp
>@@ -605,8 +605,11 @@ CSSParserToken CSSTokenizer::consumeStringTokenUntil(UChar endingCodePoint)
>     StringBuilder output;
>     while (true) {
>         UChar cc = consume();
>-        if (cc == endingCodePoint || cc == kEndOfFileMarker)
>-            return CSSParserToken(StringToken, registerString(output.toString()));
>+        if (cc == endingCodePoint || cc == kEndOfFileMarker) {
>+            if (auto string = output.toString())
>+                return CSSParserToken(StringToken, registerString(*string));
>+            CRASH();
>+        }
>         if (isNewLine(cc)) {
>             reconsume(cc);
>             return CSSParserToken(BadStringToken);
>@@ -680,13 +683,19 @@ CSSParserToken CSSTokenizer::consumeUrlToken()
>     StringBuilder result;
>     while (true) {
>         UChar cc = consume();
>-        if (cc == ')' || cc == kEndOfFileMarker)
>-            return CSSParserToken(UrlToken, registerString(result.toString()));
>+        if (cc == ')' || cc == kEndOfFileMarker) {
>+            if (auto string = result.toString())
>+                return CSSParserToken(UrlToken, registerString(*string));
>+            CRASH();
>+        }
> 
>         if (isHTMLSpace(cc)) {
>             m_input.advanceUntilNonWhitespace();
>-            if (consumeIfNext(')') || m_input.nextInputChar() == kEndOfFileMarker)
>-                return CSSParserToken(UrlToken, registerString(result.toString()));
>+            if (consumeIfNext(')') || m_input.nextInputChar() == kEndOfFileMarker) {
>+                if (auto string = result.toString())
>+                    return CSSParserToken(UrlToken, registerString(*string));
>+                CRASH();
>+            }
>             break;
>         }
> 
>@@ -791,7 +800,9 @@ StringView CSSTokenizer::consumeName()
>             continue;
>         }
>         reconsume(cc);
>-        return registerString(result.toString());
>+        if (auto string = result.toString())
>+            return registerString(*string);
>+        CRASH();
>     }
> }
> 
>@@ -811,11 +822,14 @@ UChar32 CSSTokenizer::consumeEscape()
>         };
>         consumeSingleWhitespaceIfNext();
>         bool ok = false;
>-        UChar32 codePoint = hexChars.toString().toUIntStrict(&ok, 16);
>-        ASSERT(ok);
>-        if (!codePoint || (0xD800 <= codePoint && codePoint <= 0xDFFF) || codePoint > 0x10FFFF)
>-            return replacementCharacter;
>-        return codePoint;
>+        if (auto string = hexChars.toString()) {
>+            UChar32 codePoint = string->toUIntStrict(&ok, 16);
>+            ASSERT(ok);
>+            if (!codePoint || (0xD800 <= codePoint && codePoint <= 0xDFFF) || codePoint > 0x10FFFF)
>+                return replacementCharacter;
>+            return codePoint;
>+        }
>+        CRASH();
>     }
> 
>     if (cc == kEndOfFileMarker)
>diff --git a/Source/WebCore/dom/DatasetDOMStringMap.cpp b/Source/WebCore/dom/DatasetDOMStringMap.cpp
>index f2d8420..d5667b5 100644
>--- a/Source/WebCore/dom/DatasetDOMStringMap.cpp
>+++ b/Source/WebCore/dom/DatasetDOMStringMap.cpp
>@@ -65,7 +65,9 @@ static String convertAttributeNameToPropertyName(const String& name)
>         }
>     }
> 
>-    return stringBuilder.toString();
>+    if (auto string = stringBuilder.toString())
>+        return *string;
>+    CRASH();
> }
> 
> static bool propertyNameMatchesAttributeName(const String& propertyName, const String& attributeName)
>diff --git a/Source/WebCore/dom/Element.cpp b/Source/WebCore/dom/Element.cpp
>index a432397..4f6c7bc 100644
>--- a/Source/WebCore/dom/Element.cpp
>+++ b/Source/WebCore/dom/Element.cpp
>@@ -2197,7 +2197,10 @@ void Element::formatForDebugger(char* buffer, unsigned length) const
>         result.append(s);
>     }
> 
>-    strncpy(buffer, result.toString().utf8().data(), length - 1);
>+    if (auto string = result.toString())
>+        strncpy(buffer, string->utf8().data(), length - 1);
>+    else
>+        CRASH();
> }
> #endif
> 
>diff --git a/Source/WebCore/dom/Node.cpp b/Source/WebCore/dom/Node.cpp
>index bba678a2..753df20 100644
>--- a/Source/WebCore/dom/Node.cpp
>+++ b/Source/WebCore/dom/Node.cpp
>@@ -1520,7 +1520,9 @@ String Node::textContent(bool convertBRsToNewlines) const
>     StringBuilder content;
>     bool isNullString = true;
>     appendTextContent(this, convertBRsToNewlines, isNullString, content);
>-    return isNullString ? String() : content.toString();
>+    if (auto string = content.toString())
>+        return isNullString ? String() : *string;
>+    CRASH();
> }
> 
> ExceptionOr<void> Node::setTextContent(const String& text)
>@@ -1731,7 +1733,10 @@ void Node::showNode(const char* prefix) const
>         StringBuilder attrs;
>         appendAttributeDesc(this, attrs, classAttr, " CLASS=");
>         appendAttributeDesc(this, attrs, styleAttr, " STYLE=");
>-        fprintf(stderr, "%s%s\t%p (renderer %p) %s%s%s\n", prefix, nodeName().utf8().data(), this, renderer(), attrs.toString().utf8().data(), needsStyleRecalc() ? " (needs style recalc)" : "", childNeedsStyleRecalc() ? " (child needs style recalc)" : "");
>+        if (auto string = attrs.toString())
>+            fprintf(stderr, "%s%s\t%p (renderer %p) %s%s%s\n", prefix, nodeName().utf8().data(), this, renderer(), string->utf8().data(), needsStyleRecalc() ? " (needs style recalc)" : "", childNeedsStyleRecalc() ? " (child needs style recalc)" : "");
>+        else
>+            CRASH();
>     }
> }
> 
>@@ -1803,12 +1808,19 @@ static void traverseTreeAndMark(const String& baseIndent, const Node* rootNode,
>         indent.append(baseIndent);
>         for (const Node* tmpNode = node; tmpNode && tmpNode != rootNode; tmpNode = tmpNode->parentOrShadowHostNode())
>             indent.append('\t');
>-        fprintf(stderr, "%s", indent.toString().utf8().data());
>+        if (auto string = indent.toString())
>+            fprintf(stderr, "%s", string->utf8().data());
>+        else
>+            CRASH();
>         node->showNode();
>         indent.append('\t');
>         if (!node->isShadowRoot()) {
>-            if (ShadowRoot* shadowRoot = node->shadowRoot())
>-                traverseTreeAndMark(indent.toString(), shadowRoot, markedNode1, markedLabel1, markedNode2, markedLabel2);
>+            if (ShadowRoot* shadowRoot = node->shadowRoot()) {
>+                if (auto string = indent.toString())
>+                    traverseTreeAndMark(*string, shadowRoot, markedNode1, markedLabel1, markedNode2, markedLabel2);
>+                else
>+                    CRASH();
>+            }
>         }
>     }
> }
>diff --git a/Source/WebCore/dom/Position.cpp b/Source/WebCore/dom/Position.cpp
>index 89a506f..a52016c 100644
>--- a/Source/WebCore/dom/Position.cpp
>+++ b/Source/WebCore/dom/Position.cpp
>@@ -1419,7 +1419,10 @@ void Position::formatForDebugger(char* buffer, unsigned length) const
>         result.append(s);
>     }
> 
>-    strncpy(buffer, result.toString().utf8().data(), length - 1);
>+    if (auto string = result.toString())
>+        strncpy(buffer, string->utf8().data(), length - 1);
>+    else
>+        CRASH();
> }
> 
> void Position::showAnchorTypeAndOffset() const
>diff --git a/Source/WebCore/dom/Range.cpp b/Source/WebCore/dom/Range.cpp
>index a57a5e2..159870c 100644
>--- a/Source/WebCore/dom/Range.cpp
>+++ b/Source/WebCore/dom/Range.cpp
>@@ -949,7 +949,9 @@ String Range::toString() const
>         }
>     }
> 
>-    return builder.toString();
>+    if (auto string = builder.toString())
>+        return *string;
>+    CRASH();
> }
> 
> String Range::toHTML() const
>@@ -1535,7 +1537,10 @@ void Range::formatForDebugger(char* buffer, unsigned length) const
>     endContainer().formatForDebugger(s, FormatBufferSize);
>     result.append(s);
> 
>-    strncpy(buffer, result.toString().utf8().data(), length - 1);
>+    if (auto string = result.toString())
>+        strncpy(buffer, string->utf8().data(), length - 1);
>+    else
>+        CRASH();
> }
> #endif
> 
>diff --git a/Source/WebCore/dom/ScriptedAnimationController.cpp b/Source/WebCore/dom/ScriptedAnimationController.cpp
>index c4d85d8..a50390c 100644
>--- a/Source/WebCore/dom/ScriptedAnimationController.cpp
>+++ b/Source/WebCore/dom/ScriptedAnimationController.cpp
>@@ -112,7 +112,9 @@ static String throttlingReasonsToString(OptionSet<ScriptedAnimationController::T
>             builder.append('|');
>         builder.append(throttlingReasonToString(reason));
>     }
>-    return builder.toString();
>+    if (auto string = builder.toString())
>+        return *string;
>+    CRASH();
> }
> 
> #endif
>diff --git a/Source/WebCore/dom/SecurityContext.cpp b/Source/WebCore/dom/SecurityContext.cpp
>index 4f8f1a8..148221e 100644
>--- a/Source/WebCore/dom/SecurityContext.cpp
>+++ b/Source/WebCore/dom/SecurityContext.cpp
>@@ -152,7 +152,10 @@ SandboxFlags SecurityContext::parseSandboxPolicy(const String& policy, String& i
>             tokenErrors.appendLiteral(" are invalid sandbox flags.");
>         else
>             tokenErrors.appendLiteral(" is an invalid sandbox flag.");
>-        invalidTokensErrorMessage = tokenErrors.toString();
>+        if (auto string = tokenErrors.toString())
>+            invalidTokensErrorMessage = *string;
>+        else
>+            CRASH();
>     }
> 
>     return flags;
>diff --git a/Source/WebCore/dom/Text.cpp b/Source/WebCore/dom/Text.cpp
>index 7315d16..b327f54 100644
>--- a/Source/WebCore/dom/Text.cpp
>+++ b/Source/WebCore/dom/Text.cpp
>@@ -113,7 +113,9 @@ String Text::wholeText() const
>     StringBuilder result;
>     for (const Text* text = startText; text != onePastEndText; text = TextNodeTraversal::nextSibling(*text))
>         result.append(text->data());
>-    return result.toString();
>+    if (auto string = result.toString())
>+        return *string;
>+    CRASH();
> }
> 
> RefPtr<Text> Text::replaceWholeText(const String& newText)
>@@ -240,7 +242,10 @@ void Text::formatForDebugger(char* buffer, unsigned length) const
>         result.append('"');
>     }
> 
>-    strncpy(buffer, result.toString().utf8().data(), length - 1);
>+    if (auto string = result.toString())
>+        strncpy(buffer, string->utf8().data(), length - 1);
>+    else
>+        CRASH();
>     buffer[length - 1] = '\0';
> }
> #endif
>diff --git a/Source/WebCore/dom/TextNodeTraversal.cpp b/Source/WebCore/dom/TextNodeTraversal.cpp
>index b78ca79..6d418d2 100644
>--- a/Source/WebCore/dom/TextNodeTraversal.cpp
>+++ b/Source/WebCore/dom/TextNodeTraversal.cpp
>@@ -42,7 +42,9 @@ String contentsAsString(const ContainerNode& root)
> {
>     StringBuilder result;
>     appendContents(root, result);
>-    return result.toString();
>+    if (auto string = result.toString())
>+        return *string;
>+    CRASH();
> }
> 
> String contentsAsString(const Node& root)
>@@ -59,7 +61,9 @@ String childTextContent(const ContainerNode& root)
>     StringBuilder result;
>     for (Text* text = TextNodeTraversal::firstChild(root); text; text = TextNodeTraversal::nextSibling(*text))
>         result.append(text->data());
>-    return result.toString();
>+    if (auto string = result.toString())
>+        return *string;
>+    CRASH();
> }
> 
> }
>diff --git a/Source/WebCore/editing/ApplyStyleCommand.cpp b/Source/WebCore/editing/ApplyStyleCommand.cpp
>index 69d8af2..ae16f2e 100644
>--- a/Source/WebCore/editing/ApplyStyleCommand.cpp
>+++ b/Source/WebCore/editing/ApplyStyleCommand.cpp
>@@ -1382,7 +1382,10 @@ void ApplyStyleCommand::addBlockStyle(const StyleChange& styleChange, HTMLElemen
>             cssText.append(' ');
>         cssText.append(decl->asText());
>     }
>-    setNodeAttribute(block, styleAttr, cssText.toString());
>+    if (auto string = cssText.toString())
>+        setNodeAttribute(block, styleAttr, *string);
>+    else
>+        CRASH();
> }
> 
> void ApplyStyleCommand::addInlineStyleIfNeeded(EditingStyle* style, Node& start, Node& end, EAddStyledElement addStyledElement)
>diff --git a/Source/WebCore/editing/Editing.cpp b/Source/WebCore/editing/Editing.cpp
>index e79b646..30c1680 100644
>--- a/Source/WebCore/editing/Editing.cpp
>+++ b/Source/WebCore/editing/Editing.cpp
>@@ -429,7 +429,9 @@ String stringWithRebalancedWhitespace(const String& string, bool startIsStartOfP
> 
>     rebalancedString.reserveCapacity(length);
>     rebalancedString.append(string, rebalancedString.length(), length - rebalancedString.length());
>-    return rebalancedString.toString();
>+    if (auto string = rebalancedString.toString())
>+        return *string;
>+    CRASH();
> }
> 
> bool isTableStructureNode(const Node* node)
>diff --git a/Source/WebCore/editing/HTMLInterchange.cpp b/Source/WebCore/editing/HTMLInterchange.cpp
>index b22343b..cf85230 100644
>--- a/Source/WebCore/editing/HTMLInterchange.cpp
>+++ b/Source/WebCore/editing/HTMLInterchange.cpp
>@@ -95,7 +95,9 @@ String convertHTMLTextToInterchangeFormat(const String& in, const Text* node)
>         i += consumed;
>     }
> 
>-    return s.toString();
>+    if (auto string = s.toString())
>+        return *string;
>+    CRASH();
> }
> 
> } // namespace WebCore
>diff --git a/Source/WebCore/editing/MarkupAccumulator.cpp b/Source/WebCore/editing/MarkupAccumulator.cpp
>index 906967f..67e76c2 100644
>--- a/Source/WebCore/editing/MarkupAccumulator.cpp
>+++ b/Source/WebCore/editing/MarkupAccumulator.cpp
>@@ -130,7 +130,9 @@ MarkupAccumulator::~MarkupAccumulator() = default;
> String MarkupAccumulator::serializeNodes(Node& targetNode, EChildrenOnly childrenOnly, Vector<QualifiedName>* tagNamesToSkip)
> {
>     serializeNodesWithNamespaces(targetNode, childrenOnly, 0, tagNamesToSkip);
>-    return m_markup.toString();
>+    if (auto string = m_markup.toString())
>+        return *string;
>+    CRASH();
> }
> 
> void MarkupAccumulator::serializeNodesWithNamespaces(Node& targetNode, EChildrenOnly childrenOnly, const Namespaces* namespaces, Vector<QualifiedName>* tagNamesToSkip)
>@@ -483,11 +485,14 @@ void MarkupAccumulator::generateUniquePrefix(QualifiedName& prefixedName, const
>         builder.clear();
>         builder.appendLiteral("NS");
>         builder.appendNumber(++m_prefixLevel);
>-        const AtomicString& name = builder.toAtomicString();
>-        if (!namespaces.get(name.impl())) {
>-            prefixedName.setPrefix(name);
>-            return;
>-        }
>+        if (auto string = builder.toAtomicString()) {
>+            const AtomicString& name = *string;
>+            if (!namespaces.get(name.impl())) {
>+                prefixedName.setPrefix(name);
>+                return;
>+            }
>+        } else
>+            CRASH();
>     } while (true);
> }
> 
>diff --git a/Source/WebCore/editing/TextIterator.cpp b/Source/WebCore/editing/TextIterator.cpp
>index 6574f1e..f5431ef 100644
>--- a/Source/WebCore/editing/TextIterator.cpp
>+++ b/Source/WebCore/editing/TextIterator.cpp
>@@ -2667,12 +2667,15 @@ String plainText(const Range* r, TextIteratorBehavior defaultBehavior, bool isDi
>     if (!bufferLength)
>         return emptyString();
> 
>-    String result = builder.toString();
>+    if (auto string = builder.toString()) {
>+        String result = *string;
> 
>-    if (isDisplayString)
>-        r->ownerDocument().displayStringModifiedByEncoding(result);
>+        if (isDisplayString)
>+            r->ownerDocument().displayStringModifiedByEncoding(result);
> 
>-    return result;
>+        return result;
>+    }
>+    CRASH();
> }
> 
> String plainTextReplacingNoBreakSpace(const Range* range, TextIteratorBehavior defaultBehavior, bool isDisplayString)
>diff --git a/Source/WebCore/editing/TypingCommand.cpp b/Source/WebCore/editing/TypingCommand.cpp
>index fd79066..bee63dd 100644
>--- a/Source/WebCore/editing/TypingCommand.cpp
>+++ b/Source/WebCore/editing/TypingCommand.cpp
>@@ -425,7 +425,9 @@ RefPtr<DataTransfer> TypingCommand::inputEventDataTransfer() const
> 
>     StringBuilder htmlText;
>     MarkupAccumulator::appendCharactersReplacingEntities(htmlText, m_currentTextToInsert, 0, m_currentTextToInsert.length(), EntityMaskInHTMLPCDATA);
>-    return DataTransfer::createForInputEvent(m_currentTextToInsert, htmlText.toString());
>+    if (auto string = htmlText.toString())
>+        return DataTransfer::createForInputEvent(m_currentTextToInsert, *string);
>+    CRASH();
> }
> 
> void TypingCommand::didApplyCommand()
>diff --git a/Source/WebCore/editing/VisibleSelection.cpp b/Source/WebCore/editing/VisibleSelection.cpp
>index 18650ab..73accc7 100644
>--- a/Source/WebCore/editing/VisibleSelection.cpp
>+++ b/Source/WebCore/editing/VisibleSelection.cpp
>@@ -707,7 +707,10 @@ void VisibleSelection::formatForDebugger(char* buffer, unsigned length) const
>         result.append(s);
>     }
> 
>-    strncpy(buffer, result.toString().utf8().data(), length - 1);
>+    if (auto string = result.toString())
>+        strncpy(buffer, string->utf8().data(), length - 1);
>+    else
>+        CRASH();
> }
> 
> void VisibleSelection::showTreeForThis() const
>diff --git a/Source/WebCore/editing/cocoa/DataDetection.mm b/Source/WebCore/editing/cocoa/DataDetection.mm
>index f445616..e98644c 100644
>--- a/Source/WebCore/editing/cocoa/DataDetection.mm
>+++ b/Source/WebCore/editing/cocoa/DataDetection.mm
>@@ -319,7 +319,9 @@ static String dataDetectorStringForPath(NSIndexPath *path)
>         stringBuilder.appendNumber((unsigned long)[path indexAtPosition:0]);
>         stringBuilder.append('/');
>         stringBuilder.appendNumber((unsigned long)[path indexAtPosition:1]);
>-        return stringBuilder.toString();
>+        if (auto string = stringBuilder.toString())
>+            return *string;
>+        CRASH();
>     }
>     default: {
>         StringBuilder stringBuilder;
>@@ -329,7 +331,9 @@ static String dataDetectorStringForPath(NSIndexPath *path)
>             stringBuilder.appendNumber((unsigned long)[path indexAtPosition:i]);
>         }
> 
>-        return stringBuilder.toString();
>+        if (auto string = stringBuilder.toString())
>+            return *string;
>+        CRASH();
>     }
>     }
> }
>diff --git a/Source/WebCore/editing/cocoa/HTMLConverter.mm b/Source/WebCore/editing/cocoa/HTMLConverter.mm
>index 6b1397e..5d32938 100644
>--- a/Source/WebCore/editing/cocoa/HTMLConverter.mm
>+++ b/Source/WebCore/editing/cocoa/HTMLConverter.mm
>@@ -2254,7 +2254,10 @@ void HTMLConverter::_processText(CharacterData& characterData)
>         }
>         if (wasSpace)
>             builder.append(' ');
>-        outputString = builder.toString();
>+        if (auto string = builder.toString())
>+            outputString = *string;
>+        else
>+            CRASH();
>     }
> 
>     if (outputString.length()) {
>diff --git a/Source/WebCore/editing/ios/EditorIOS.mm b/Source/WebCore/editing/ios/EditorIOS.mm
>index 5621355..2fe5462 100644
>--- a/Source/WebCore/editing/ios/EditorIOS.mm
>+++ b/Source/WebCore/editing/ios/EditorIOS.mm
>@@ -284,7 +284,10 @@ void Editor::setDictationPhrasesAsChildOfElement(const Vector<Vector<String>>& d
>     for (auto& interpretations : dictationPhrases)
>         dictationPhrasesBuilder.append(interpretations[0]);
> 
>-    element.appendChild(createFragmentFromText(*context, dictationPhrasesBuilder.toString()));
>+    if (auto string = dictationPhrasesBuilder.toString())
>+        element.appendChild(createFragmentFromText(*context, *string));
>+    else
>+        CRASH();
> 
>     // We need a layout in order to add markers below.
>     document().updateLayout();
>diff --git a/Source/WebCore/editing/markup.cpp b/Source/WebCore/editing/markup.cpp
>index 5551eec..d568810 100644
>--- a/Source/WebCore/editing/markup.cpp
>+++ b/Source/WebCore/editing/markup.cpp
>@@ -290,7 +290,10 @@ void StyledMarkupAccumulator::wrapWithNode(Node& node, bool convertBlocksToInlin
>         appendElement(markup, downcast<Element>(node), convertBlocksToInlines && isBlock(&node), rangeFullySelectsNode);
>     else
>         appendStartMarkup(markup, node, nullptr);
>-    m_reversedPrecedingMarkup.append(markup.toString());
>+    if (auto string = markup.toString())
>+        m_reversedPrecedingMarkup.append(*string);
>+    else
>+        CRASH();
>     appendEndTag(node);
>     if (m_nodes)
>         m_nodes->append(&node);
>@@ -300,7 +303,10 @@ void StyledMarkupAccumulator::wrapWithStyleNode(StyleProperties* style, Document
> {
>     StringBuilder openTag;
>     appendStyleNodeOpenTag(openTag, style, document, isBlock);
>-    m_reversedPrecedingMarkup.append(openTag.toString());
>+    if (auto string = openTag.toString())
>+        m_reversedPrecedingMarkup.append(*string);
>+    else
>+        CRASH();
>     appendString(styleNodeCloseTag(isBlock));
> }
> 
>@@ -334,7 +340,9 @@ String StyledMarkupAccumulator::takeResults()
>     concatenateMarkup(result);
> 
>     // We remove '\0' characters because they are not visibly rendered to the user.
>-    return result.toString().replaceWithLiteral('\0', "");
>+    if (auto string = result.toString())
>+        return string->replaceWithLiteral('\0', "");
>+    CRASH();
> }
> 
> void StyledMarkupAccumulator::appendText(StringBuilder& out, const Text& text)
>@@ -359,7 +367,10 @@ void StyledMarkupAccumulator::appendText(StringBuilder& out, const Text& text)
>         String content = useRenderedText ? renderedText(text, m_range) : stringValueForRange(text, m_range);
>         StringBuilder buffer;
>         appendCharactersReplacingEntities(buffer, content, 0, content.length(), EntityMaskInPCDATA);
>-        out.append(convertHTMLTextToInterchangeFormat(buffer.toString(), &text));
>+        if (auto string = buffer.toString())
>+            out.append(convertHTMLTextToInterchangeFormat(*string, &text));
>+        else
>+            CRASH();
>     }
> 
>     if (wrappingSpan)
>@@ -873,7 +884,9 @@ String sanitizedMarkupForFragmentInDocument(Ref<DocumentFragment>&& fragment, Do
>             "xmlns=\"http://www.w3.org/TR/REC-html40\">");
>         builder.append(result);
>         builder.appendLiteral("</html>");
>-        return builder.toString();
>+        if (auto string = builder.toString())
>+            return *string;
>+        CRASH();
>     }
> 
>     return result;
>@@ -1092,7 +1105,9 @@ String urlToMarkup(const URL& url, const String& title)
>     markup.appendLiteral("\">");
>     MarkupAccumulator::appendCharactersReplacingEntities(markup, title, 0, title.length(), EntityMaskInPCDATA);
>     markup.appendLiteral("</a>");
>-    return markup.toString();
>+    if (auto string = markup.toString())
>+        return *string;
>+    CRASH();
> }
> 
> ExceptionOr<Ref<DocumentFragment>> createFragmentForInnerOuterHTML(Element& contextElement, const String& markup, ParserContentPolicy parserContentPolicy)
>diff --git a/Source/WebCore/fileapi/FileReaderLoader.cpp b/Source/WebCore/fileapi/FileReaderLoader.cpp
>index 9a2234f..28345ab 100644
>--- a/Source/WebCore/fileapi/FileReaderLoader.cpp
>+++ b/Source/WebCore/fileapi/FileReaderLoader.cpp
>@@ -337,20 +337,20 @@ void FileReaderLoader::convertToDataURL()
>     StringBuilder builder;
>     builder.appendLiteral("data:");
> 
>-    if (!m_bytesLoaded) {
>-        m_stringResult = builder.toString();
>-        return;
>+    if (m_bytesLoaded) {
>+        builder.append(m_dataType);
>+        builder.appendLiteral(";base64,");
>+
>+        Vector<char> out;
>+        base64Encode(m_rawData->data(), m_bytesLoaded, out);
>+        out.append('\0');
>+        builder.append(out.data());
>     }
> 
>-    builder.append(m_dataType);
>-    builder.appendLiteral(";base64,");
>-
>-    Vector<char> out;
>-    base64Encode(m_rawData->data(), m_bytesLoaded, out);
>-    out.append('\0');
>-    builder.append(out.data());
>-
>-    m_stringResult = builder.toString();
>+    if (auto string = builder.toString())
>+        m_stringResult = *string;
>+    else
>+        CRASH();
> }
> 
> bool FileReaderLoader::isCompleted() const
>diff --git a/Source/WebCore/html/DOMTokenList.cpp b/Source/WebCore/html/DOMTokenList.cpp
>index c95f969..db42968 100644
>--- a/Source/WebCore/html/DOMTokenList.cpp
>+++ b/Source/WebCore/html/DOMTokenList.cpp
>@@ -273,10 +273,13 @@ void DOMTokenList::updateAssociatedAttributeFromTokens()
>             builder.append(' ');
>         builder.append(token);
>     }
>-    AtomicString serializedValue = builder.toAtomicString();
>+    if (auto string = builder.toAtomicString()) {
>+        AtomicString serializedValue = *string;
> 
>-    SetForScope<bool> inAttributeUpdate(m_inUpdateAssociatedAttributeFromTokens, true);
>-    m_element.setAttribute(m_attributeName, serializedValue);
>+        SetForScope<bool> inAttributeUpdate(m_inUpdateAssociatedAttributeFromTokens, true);
>+        m_element.setAttribute(m_attributeName, serializedValue);
>+    } else
>+        CRASH();
> }
> 
> Vector<AtomicString>& DOMTokenList::tokens()
>diff --git a/Source/WebCore/html/EmailInputType.cpp b/Source/WebCore/html/EmailInputType.cpp
>index b93e12b..5836c7f 100644
>--- a/Source/WebCore/html/EmailInputType.cpp
>+++ b/Source/WebCore/html/EmailInputType.cpp
>@@ -104,7 +104,9 @@ String EmailInputType::sanitizeValue(const String& proposedValue) const
>             strippedValue.append(',');
>         strippedValue.append(stripLeadingAndTrailingHTMLSpaces(addresses[i]));
>     }
>-    return strippedValue.toString();
>+    if (auto string = strippedValue.toString())
>+        return *string;
>+    CRASH();
> }
> 
> } // namespace WebCore
>diff --git a/Source/WebCore/html/FileInputType.cpp b/Source/WebCore/html/FileInputType.cpp
>index 3e55a05..fdc49c5 100644
>--- a/Source/WebCore/html/FileInputType.cpp
>+++ b/Source/WebCore/html/FileInputType.cpp
>@@ -467,7 +467,9 @@ String FileInputType::defaultToolTip() const
>         if (i != listSize - 1)
>             names.append('\n');
>     }
>-    return names.toString();
>+    if (auto string = names.toString())
>+        return *string;
>+    CRASH();
> }
> 
> 
>diff --git a/Source/WebCore/html/FormController.cpp b/Source/WebCore/html/FormController.cpp
>index 0f5b775..1a29a44 100644
>--- a/Source/WebCore/html/FormController.cpp
>+++ b/Source/WebCore/html/FormController.cpp
>@@ -312,7 +312,9 @@ static inline String formSignature(const HTMLFormElement& form)
>         builder.append(actionURL.string());
> 
>     recordFormStructure(form, builder);
>-    return builder.toString();
>+    if (auto string = builder.toString())
>+        return *string;
>+    CRASH();
> }
> 
> AtomicString FormKeyGenerator::formKey(const HTMLFormControlElementWithState& control)
>diff --git a/Source/WebCore/html/HTMLAnchorElement.cpp b/Source/WebCore/html/HTMLAnchorElement.cpp
>index 7152317..a7026f1 100644
>--- a/Source/WebCore/html/HTMLAnchorElement.cpp
>+++ b/Source/WebCore/html/HTMLAnchorElement.cpp
>@@ -400,10 +400,14 @@ void HTMLAnchorElement::handleClick(Event& event)
>     if (!frame)
>         return;
> 
>-    StringBuilder url;
>-    url.append(stripLeadingAndTrailingHTMLSpaces(attributeWithoutSynchronization(hrefAttr)));
>-    appendServerMapMousePosition(url, event);
>-    URL completedURL = document().completeURL(url.toString());
>+    URL completedURL = document().completeURL([&] () {
>+        StringBuilder url;
>+        url.append(stripLeadingAndTrailingHTMLSpaces(attributeWithoutSynchronization(hrefAttr)));
>+        appendServerMapMousePosition(url, event);
>+        if (auto string = url.toString())
>+            return *string;
>+        CRASH();
>+    }());
> 
>     String downloadAttribute;
> #if ENABLE(DOWNLOAD_ATTRIBUTE)
>diff --git a/Source/WebCore/html/HTMLCanvasElement.cpp b/Source/WebCore/html/HTMLCanvasElement.cpp
>index 664edf0..b67b4c2 100644
>--- a/Source/WebCore/html/HTMLCanvasElement.cpp
>+++ b/Source/WebCore/html/HTMLCanvasElement.cpp
>@@ -336,8 +336,11 @@ CanvasRenderingContext2D* HTMLCanvasElement::createContext2d(const String& type)
>         stringBuilder.appendLiteral("Total canvas memory use exceeds the maximum limit (");
>         stringBuilder.appendNumber(maxActivePixelMemory() / 1024 / 1024);
>         stringBuilder.appendLiteral(" MB).");
>-        document().addConsoleMessage(MessageSource::JS, MessageLevel::Warning, stringBuilder.toString());
>-        return nullptr;
>+        if (auto string = stringBuilder.toString()) {
>+            document().addConsoleMessage(MessageSource::JS, MessageLevel::Warning, *string);
>+            return nullptr;
>+        }
>+        CRASH();
>     }
> 
>     m_context = CanvasRenderingContext2D::create(*this, document().inQuirksMode(), usesDashboardCompatibilityMode);
>@@ -889,8 +892,11 @@ void HTMLCanvasElement::createImageBuffer() const
>         stringBuilder.appendLiteral("Canvas area exceeds the maximum limit (width * height > ");
>         stringBuilder.appendNumber(maxCanvasArea);
>         stringBuilder.appendLiteral(").");
>-        document().addConsoleMessage(MessageSource::JS, MessageLevel::Warning, stringBuilder.toString());
>-        return;
>+        if (auto string = stringBuilder.toString()) {
>+            document().addConsoleMessage(MessageSource::JS, MessageLevel::Warning, *string);
>+            return;
>+        }
>+        CRASH();
>     }
>     
>     // Make sure we don't use more pixel memory than the system can support.
>@@ -900,8 +906,11 @@ void HTMLCanvasElement::createImageBuffer() const
>         stringBuilder.appendLiteral("Total canvas memory use exceeds the maximum limit (");
>         stringBuilder.appendNumber(maxActivePixelMemory() / 1024 / 1024);
>         stringBuilder.appendLiteral(" MB).");
>-        document().addConsoleMessage(MessageSource::JS, MessageLevel::Warning, stringBuilder.toString());
>-        return;
>+        if (auto string = stringBuilder.toString()) {
>+            document().addConsoleMessage(MessageSource::JS, MessageLevel::Warning, *string);
>+            return;
>+        }
>+        CRASH();
>     }
> 
>     if (!width() || !height())
>diff --git a/Source/WebCore/html/HTMLFontElement.cpp b/Source/WebCore/html/HTMLFontElement.cpp
>index 8d6c347..c35a67e 100644
>--- a/Source/WebCore/html/HTMLFontElement.cpp
>+++ b/Source/WebCore/html/HTMLFontElement.cpp
>@@ -111,10 +111,13 @@ static bool parseFontSize(const CharacterType* characters, unsigned length, int&
>     // Step 8
>     int value;
> 
>+    if (digits.failed())
>+        CRASH();
>+
>     if (digits.is8Bit())
>-        value = charactersToIntStrict(digits.characters8(), digits.length());
>+        value = charactersToIntStrict(*digits.characters8(), digits.length());
>     else
>-        value = charactersToIntStrict(digits.characters16(), digits.length());
>+        value = charactersToIntStrict(*digits.characters16(), digits.length());
> 
>     // Step 9
>     if (mode == RelativePlus)
>diff --git a/Source/WebCore/html/HTMLImageElement.cpp b/Source/WebCore/html/HTMLImageElement.cpp
>index 4f6597c..a2e1c16 100644
>--- a/Source/WebCore/html/HTMLImageElement.cpp
>+++ b/Source/WebCore/html/HTMLImageElement.cpp
>@@ -474,7 +474,9 @@ String HTMLImageElement::completeURLsInAttributeValue(const URL& base, const Att
>                 result.append('w');
>             }
>         }
>-        return result.toString();
>+        if (auto string = result.toString())
>+            return *string;
>+        CRASH();
>     }
>     return HTMLElement::completeURLsInAttributeValue(base, attribute);
> }
>diff --git a/Source/WebCore/html/HTMLMediaElement.cpp b/Source/WebCore/html/HTMLMediaElement.cpp
>index 521fca2..721446f 100644
>--- a/Source/WebCore/html/HTMLMediaElement.cpp
>+++ b/Source/WebCore/html/HTMLMediaElement.cpp
>@@ -232,9 +232,12 @@ static String actionName(HTMLMediaElementEnums::DelayedActionType action)
> 
> #undef ACTION
> 
>-    String name = actionBuilder.toString();
>-    ASSERT(!name.isEmpty());
>-    return name;
>+    if (auto string = actionBuilder.toString()) {
>+        String name = *string;
>+        ASSERT(!name.isEmpty());
>+        return name;
>+    }
>+    CRASH();
> }
> #endif
> 
>diff --git a/Source/WebCore/html/HTMLOptionElement.cpp b/Source/WebCore/html/HTMLOptionElement.cpp
>index 9f6dad2..fa98aa8 100644
>--- a/Source/WebCore/html/HTMLOptionElement.cpp
>+++ b/Source/WebCore/html/HTMLOptionElement.cpp
>@@ -349,7 +349,9 @@ String HTMLOptionElement::collectOptionInnerText() const
>         else
>             node = NodeTraversal::next(*node, this);
>     }
>-    return text.toString();
>+    if (auto string = text.toString())
>+        return *string;
>+    CRASH();
> }
> 
> } // namespace
>diff --git a/Source/WebCore/html/HTMLTextFormControlElement.cpp b/Source/WebCore/html/HTMLTextFormControlElement.cpp
>index 58f91aa..3af344c 100644
>--- a/Source/WebCore/html/HTMLTextFormControlElement.cpp
>+++ b/Source/WebCore/html/HTMLTextFormControlElement.cpp
>@@ -143,7 +143,9 @@ String HTMLTextFormControlElement::strippedPlaceholder() const
>             continue;
>         stripped.append(character);
>     }
>-    return stripped.toString();
>+    if (auto string = stripped.toString())
>+        return *string;
>+    CRASH();
> }
> 
> static bool isNotLineBreak(UChar ch) { return ch != newlineCharacter && ch != carriageReturn; }
>@@ -552,7 +554,9 @@ static String innerTextValueFrom(TextControlInnerTextElement& innerText)
>             result.append(downcast<Text>(*node).data());
>     }
>     stripTrailingNewline(result);
>-    return result.toString();
>+    if (auto string = result.toString())
>+        return *string;
>+    CRASH();
> }
> 
> void HTMLTextFormControlElement::setInnerTextValue(const String& value)
>@@ -736,7 +740,9 @@ String HTMLTextFormControlElement::valueWithHardLineBreaks() const
>             getNextSoftBreak(line, breakNode, breakOffset);
>     }
>     stripTrailingNewline(result);
>-    return result.toString();
>+    if (auto string = result.toString())
>+        return *string;
>+    CRASH();
> }
> 
> HTMLTextFormControlElement* enclosingTextFormControl(const Position& position)
>diff --git a/Source/WebCore/html/MediaDocument.cpp b/Source/WebCore/html/MediaDocument.cpp
>index 119340f..6977123 100644
>--- a/Source/WebCore/html/MediaDocument.cpp
>+++ b/Source/WebCore/html/MediaDocument.cpp
>@@ -121,7 +121,10 @@ void MediaDocumentParser::createDocumentStructure()
> #if PLATFORM(IOS)
>         elementStyle.appendLiteral("width: 100%; height: auto;");
> #endif
>-        videoElement->setAttribute(styleAttr, elementStyle.toString());
>+        if (auto string = elementStyle.toString())
>+            videoElement->setAttribute(styleAttr, *string);
>+        else
>+            CRASH();
>     }
> 
>     body->appendChild(videoElement);
>diff --git a/Source/WebCore/html/MediaElementSession.cpp b/Source/WebCore/html/MediaElementSession.cpp
>index 5cd7905..6f4e0f9 100644
>--- a/Source/WebCore/html/MediaElementSession.cpp
>+++ b/Source/WebCore/html/MediaElementSession.cpp
>@@ -86,7 +86,9 @@ static String restrictionName(MediaElementSession::BehaviorRestrictions restrict
>     CASE(InvisibleAutoplayNotPermitted);
>     CASE(OverrideUserGestureRequirementForMainContent);
> 
>-    return restrictionBuilder.toString();
>+    if (auto string = restrictionBuilder.toString())
>+        return *string;
>+    CRASH();
> }
> #endif
> 
>diff --git a/Source/WebCore/html/MediaFragmentURIParser.cpp b/Source/WebCore/html/MediaFragmentURIParser.cpp
>index e7a516e..305b663 100644
>--- a/Source/WebCore/html/MediaFragmentURIParser.cpp
>+++ b/Source/WebCore/html/MediaFragmentURIParser.cpp
>@@ -52,7 +52,9 @@ static String collectDigits(const LChar* input, unsigned length, unsigned& posit
>     // DIGIT ; any positive number
>     while (position < length && isASCIIDigit(input[position]))
>         digits.append(input[position++]);
>-    return digits.toString();
>+    if (auto string = digits.toString())
>+        return *string;
>+    CRASH();
> }
> 
> static String collectFraction(const LChar* input, unsigned length, unsigned& position)
>@@ -67,7 +69,9 @@ static String collectFraction(const LChar* input, unsigned length, unsigned& pos
>     digits.append(input[position++]);
>     while (position < length && isASCIIDigit(input[position]))
>         digits.append(input[position++]);
>-    return digits.toString();
>+    if (auto string = digits.toString())
>+        return *string;
>+    CRASH();
> }
> 
> MediaFragmentURIParser::MediaFragmentURIParser(const URL& url)
>diff --git a/Source/WebCore/html/TypeAhead.cpp b/Source/WebCore/html/TypeAhead.cpp
>index 764e502..3eec484 100644
>--- a/Source/WebCore/html/TypeAhead.cpp
>+++ b/Source/WebCore/html/TypeAhead.cpp
>@@ -80,7 +80,10 @@ int TypeAhead::handleEvent(KeyboardEvent* event, MatchModeFlags matchMode)
>         prefix = String(&c, 1);
>         m_repeatingChar = c;
>     } else if (matchMode & MatchPrefix) {
>-        prefix = m_buffer.toString();
>+        if (auto string = m_buffer.toString())
>+            prefix = *string;
>+        else
>+            CRASH();
>         if (m_buffer.length() > 1) {
>             m_repeatingChar = 0;
>             searchStartOffset = 0;
>@@ -104,9 +107,12 @@ int TypeAhead::handleEvent(KeyboardEvent* event, MatchModeFlags matchMode)
> 
>     if (matchMode & MatchIndex) {
>         bool ok = false;
>-        int index = m_buffer.toString().toInt(&ok);
>-        if (index > 0 && index <= optionCount)
>-            return index - 1;
>+        if (auto string = m_buffer.toString()) {
>+            int index = string->toInt(&ok);
>+            if (index > 0 && index <= optionCount)
>+                return index - 1;
>+        } else
>+            CRASH();
>     }
>     return -1;
> }
>diff --git a/Source/WebCore/html/canvas/CanvasRenderingContext2D.cpp b/Source/WebCore/html/canvas/CanvasRenderingContext2D.cpp
>index c27af23..d94fce5 100644
>--- a/Source/WebCore/html/canvas/CanvasRenderingContext2D.cpp
>+++ b/Source/WebCore/html/canvas/CanvasRenderingContext2D.cpp
>@@ -117,7 +117,9 @@ String CanvasRenderingContext2D::font() const
>         serializedFont.append(family);
>     }
> 
>-    return serializedFont.toString();
>+    if (auto string = serializedFont.toString())
>+        return *string;
>+    CRASH();
> }
> 
> void CanvasRenderingContext2D::setFont(const String& newFont)
>diff --git a/Source/WebCore/html/canvas/CanvasRenderingContext2DBase.cpp b/Source/WebCore/html/canvas/CanvasRenderingContext2DBase.cpp
>index 768c0fc..7a88cd4 100644
>--- a/Source/WebCore/html/canvas/CanvasRenderingContext2DBase.cpp
>+++ b/Source/WebCore/html/canvas/CanvasRenderingContext2DBase.cpp
>@@ -2172,8 +2172,11 @@ ExceptionOr<RefPtr<ImageData>> CanvasRenderingContext2DBase::getImageData(ImageB
>         consoleMessage.appendLiteral(" x ");
>         consoleMessage.appendNumber(imageDataRect.height());
> 
>-        canvasBase().scriptExecutionContext()->addConsoleMessage(MessageSource::Rendering, MessageLevel::Error, consoleMessage.toString());
>-        return Exception { InvalidStateError };
>+        if (auto string = consoleMessage.toString()) {
>+            canvasBase().scriptExecutionContext()->addConsoleMessage(MessageSource::Rendering, MessageLevel::Error, *string);
>+            return Exception { InvalidStateError };
>+        }
>+        CRASH();
>     }
> 
>     return ImageData::create(imageDataRect.size(), byteArray.releaseNonNull());
>diff --git a/Source/WebCore/html/canvas/WebGLRenderingContextBase.cpp b/Source/WebCore/html/canvas/WebGLRenderingContextBase.cpp
>index 7875da8..cd5ee1d 100644
>--- a/Source/WebCore/html/canvas/WebGLRenderingContextBase.cpp
>+++ b/Source/WebCore/html/canvas/WebGLRenderingContextBase.cpp
>@@ -162,7 +162,9 @@ namespace {
> 
>         String result()
>         {
>-            return m_builder.toString();
>+            if (auto string = m_builder.toString())
>+                return *string;
>+            CRASH();
>         }
> 
>     private:
>diff --git a/Source/WebCore/html/parser/HTMLSourceTracker.cpp b/Source/WebCore/html/parser/HTMLSourceTracker.cpp
>index 22dba90..80b1e52 100644
>--- a/Source/WebCore/html/parser/HTMLSourceTracker.cpp
>+++ b/Source/WebCore/html/parser/HTMLSourceTracker.cpp
>@@ -83,8 +83,11 @@ String HTMLSourceTracker::source(const HTMLToken& token)
>         m_currentSource.advance();
>     }
> 
>-    m_cachedSourceForToken = source.toString();
>-    return m_cachedSourceForToken;
>+    if (auto string = source.toString()) {
>+        m_cachedSourceForToken = *string;
>+        return m_cachedSourceForToken;
>+    }
>+    CRASH();
> }
> 
> String HTMLSourceTracker::source(const HTMLToken& token, unsigned attributeStart, unsigned attributeEnd)
>diff --git a/Source/WebCore/html/parser/HTMLTokenizer.cpp b/Source/WebCore/html/parser/HTMLTokenizer.cpp
>index 8ac2f85..364ec0e 100644
>--- a/Source/WebCore/html/parser/HTMLTokenizer.cpp
>+++ b/Source/WebCore/html/parser/HTMLTokenizer.cpp
>@@ -141,8 +141,10 @@ inline bool HTMLTokenizer::processEntity(SegmentedString& source)
>         ASSERT(decodedEntity.isEmpty());
>         bufferASCIICharacter('&');
>     } else {
>+        if (decodedEntity.failed())
>+            CRASH();
>         for (unsigned i = 0; i < decodedEntity.length(); ++i)
>-            bufferCharacter(decodedEntity[i]);
>+            bufferCharacter(*decodedEntity[i]);
>     }
>     return true;
> }
>@@ -863,8 +865,10 @@ bool HTMLTokenizer::processToken(SegmentedString& source)
>             ASSERT(decodedEntity.isEmpty());
>             m_token.appendToAttributeValue('&');
>         } else {
>+            if (decodedEntity.failed())
>+                CRASH();
>             for (unsigned i = 0; i < decodedEntity.length(); ++i)
>-                m_token.appendToAttributeValue(decodedEntity[i]);
>+                m_token.appendToAttributeValue(*decodedEntity[i]);
>         }
>         // We're supposed to switch back to the attribute value state that
>         // we were in when we were switched into this state. Rather than
>@@ -1403,7 +1407,9 @@ String HTMLTokenizer::bufferedCharacters() const
>     characters.append('<');
>     characters.append('/');
>     characters.append(m_temporaryBuffer.data(), m_temporaryBuffer.size());
>-    return characters.toString();
>+    if (auto string = characters.toString())
>+        return *string;
>+    CRASH();
> }
> 
> void HTMLTokenizer::updateStateFor(const AtomicString& tagName)
>diff --git a/Source/WebCore/html/parser/HTMLTreeBuilder.cpp b/Source/WebCore/html/parser/HTMLTreeBuilder.cpp
>index b10a4c4..899d4bf 100644
>--- a/Source/WebCore/html/parser/HTMLTreeBuilder.cpp
>+++ b/Source/WebCore/html/parser/HTMLTreeBuilder.cpp
>@@ -2569,19 +2569,22 @@ void HTMLTreeBuilder::defaultForAfterHead()
> 
> void HTMLTreeBuilder::defaultForInTableText()
> {
>-    String characters = m_pendingTableCharacters.toString();
>-    m_pendingTableCharacters.clear();
>-    if (!isAllWhitespace(characters)) {
>-        // FIXME: parse error
>-        HTMLConstructionSite::RedirectToFosterParentGuard redirecter(m_tree);
>-        m_tree.reconstructTheActiveFormattingElements();
>-        m_tree.insertTextNode(characters, NotAllWhitespace);
>-        m_framesetOk = false;
>+    if (auto string = m_pendingTableCharacters.toString()) {
>+        String characters = *string;
>+        m_pendingTableCharacters.clear();
>+        if (!isAllWhitespace(characters)) {
>+            // FIXME: parse error
>+            HTMLConstructionSite::RedirectToFosterParentGuard redirecter(m_tree);
>+            m_tree.reconstructTheActiveFormattingElements();
>+            m_tree.insertTextNode(characters, NotAllWhitespace);
>+            m_framesetOk = false;
>+            m_insertionMode = m_originalInsertionMode;
>+            return;
>+        }
>+        m_tree.insertTextNode(characters);
>         m_insertionMode = m_originalInsertionMode;
>-        return;
>-    }
>-    m_tree.insertTextNode(characters);
>-    m_insertionMode = m_originalInsertionMode;
>+    } else
>+        CRASH();
> }
> 
> bool HTMLTreeBuilder::processStartTagForInHead(AtomicHTMLToken&& token)
>diff --git a/Source/WebCore/html/parser/XSSAuditorDelegate.cpp b/Source/WebCore/html/parser/XSSAuditorDelegate.cpp
>index 80b4213..7d4c89b 100644
>--- a/Source/WebCore/html/parser/XSSAuditorDelegate.cpp
>+++ b/Source/WebCore/html/parser/XSSAuditorDelegate.cpp
>@@ -66,7 +66,9 @@ static inline String buildConsoleError(const XSSInfo& xssInfo)
>     else
>         message.appendLiteral(" The auditor was enabled because the server did not send an 'X-XSS-Protection' header.");
> 
>-    return message.toString();
>+    if (auto string = message.toString())
>+        return *string;
>+    CRASH();
> }
> 
> Ref<FormData> XSSAuditorDelegate::generateViolationReport(const XSSInfo& xssInfo)
>diff --git a/Source/WebCore/html/track/BufferedLineReader.cpp b/Source/WebCore/html/track/BufferedLineReader.cpp
>index 8f23625..f2908d5 100644
>--- a/Source/WebCore/html/track/BufferedLineReader.cpp
>+++ b/Source/WebCore/html/track/BufferedLineReader.cpp
>@@ -92,9 +92,11 @@ std::optional<String> BufferedLineReader::nextLine()
>     }
> 
>     if (shouldReturnLine) {
>-        auto line = m_lineBuffer.toString();
>-        m_lineBuffer.clear();
>-        return WTFMove(line);
>+        if (auto line = m_lineBuffer.toString()) {
>+            m_lineBuffer.clear();
>+            return WTFMove(*line);
>+        }
>+        CRASH();
>     }
> 
>     ASSERT(m_buffer.isEmpty());
>diff --git a/Source/WebCore/html/track/TrackBase.cpp b/Source/WebCore/html/track/TrackBase.cpp
>index 333a2f8..29416a2 100644
>--- a/Source/WebCore/html/track/TrackBase.cpp
>+++ b/Source/WebCore/html/track/TrackBase.cpp
>@@ -153,7 +153,10 @@ void TrackBase::setLanguage(const AtomicString& language)
>             stringBuilder.appendLiteral("The language '");
>             stringBuilder.append(language);
>             stringBuilder.appendLiteral("' is not a valid BCP 47 language tag.");
>-            message = stringBuilder.toString();
>+            if (auto string = stringBuilder.toString())
>+                message = *string;
>+            else
>+                CRASH();
>         }
>         if (auto element = this->element())
>             element->document().addConsoleMessage(MessageSource::Rendering, MessageLevel::Warning, message);
>diff --git a/Source/WebCore/html/track/VTTCue.cpp b/Source/WebCore/html/track/VTTCue.cpp
>index 78f8adf..3bbc246 100644
>--- a/Source/WebCore/html/track/VTTCue.cpp
>+++ b/Source/WebCore/html/track/VTTCue.cpp
>@@ -629,7 +629,11 @@ void VTTCue::determineTextDirection()
>         paragraphBuilder.append(node->nodeValue());
>     }
> 
>-    String paragraph = paragraphBuilder.toString();
>+    String paragraph = [&] () {
>+        if (auto string = paragraphBuilder.toString())
>+            return *string;
>+        CRASH();
>+    }();
>     if (!paragraph.length())
>         return;
> 
>diff --git a/Source/WebCore/html/track/WebVTTParser.cpp b/Source/WebCore/html/track/WebVTTParser.cpp
>index 518ed8b..80d02c4 100644
>--- a/Source/WebCore/html/track/WebVTTParser.cpp
>+++ b/Source/WebCore/html/track/WebVTTParser.cpp
>@@ -404,7 +404,10 @@ void WebVTTParser::createNewCue()
>     RefPtr<WebVTTCueData> cue = WebVTTCueData::create();
>     cue->setStartTime(m_currentStartTime);
>     cue->setEndTime(m_currentEndTime);
>-    cue->setContent(m_currentContent.toString());
>+    if (auto string = m_currentContent.toString())
>+        cue->setContent(*string);
>+    else
>+        CRASH();
>     cue->setId(m_currentId);
>     cue->setSettings(m_currentSettings);
> 
>diff --git a/Source/WebCore/html/track/WebVTTTokenizer.cpp b/Source/WebCore/html/track/WebVTTTokenizer.cpp
>index 024c04a..fe3dda8 100644
>--- a/Source/WebCore/html/track/WebVTTTokenizer.cpp
>+++ b/Source/WebCore/html/track/WebVTTTokenizer.cpp
>@@ -108,11 +108,15 @@ DataState:
>         else {
>             // We don't want to advance input or perform a state transition - just return a (new) token.
>             // (On the next call to nextToken we will see '<' again, but take the other branch in this if instead.)
>-            return emitToken(token, WebVTTToken::StringToken(result.toString()));
>+            if (auto string = result.toString())
>+                return emitToken(token, WebVTTToken::StringToken(*string));
>+            CRASH();
>         }
>-    } else if (character == kEndOfFileMarker)
>-        return advanceAndEmitToken(m_input, token, WebVTTToken::StringToken(result.toString()));
>-    else {
>+    } else if (character == kEndOfFileMarker) {
>+        if (auto string = result.toString())
>+            return advanceAndEmitToken(m_input, token, WebVTTToken::StringToken(*string));
>+        CRASH();
>+    } else {
>         result.append(character);
>         WEBVTT_ADVANCE_TO(DataState);
>     }
>@@ -142,10 +146,14 @@ EscapeState:
>         WEBVTT_ADVANCE_TO(EscapeState);
>     } else if (character == '<') {
>         result.append(buffer);
>-        return emitToken(token, WebVTTToken::StringToken(result.toString()));
>+        if (auto string = result.toString())
>+            return emitToken(token, WebVTTToken::StringToken(*string));
>+        CRASH();
>     } else if (character == kEndOfFileMarker) {
>         result.append(buffer);
>-        return advanceAndEmitToken(m_input, token, WebVTTToken::StringToken(result.toString()));
>+        if (auto string = result.toString())
>+            return advanceAndEmitToken(m_input, token, WebVTTToken::StringToken(*string));
>+        CRASH();
>     } else {
>         result.append(buffer);
>         buffer.clear();
>@@ -172,7 +180,9 @@ TagState:
>         WEBVTT_ADVANCE_TO(TimestampTagState);
>     } else if (character == '>' || character == kEndOfFileMarker) {
>         ASSERT(result.isEmpty());
>-        return advanceAndEmitToken(m_input, token, WebVTTToken::StartTag(result.toString()));
>+        if (auto string = result.toString())
>+            return advanceAndEmitToken(m_input, token, WebVTTToken::StartTag(*string));
>+        CRASH();
>     } else {
>         result.append(character);
>         WEBVTT_ADVANCE_TO(StartTagState);
>@@ -183,9 +193,11 @@ StartTagState:
>         WEBVTT_ADVANCE_TO(StartTagAnnotationState);
>     else if (character == '.')
>         WEBVTT_ADVANCE_TO(StartTagClassState);
>-    else if (character == '>' || character == kEndOfFileMarker)
>-        return advanceAndEmitToken(m_input, token, WebVTTToken::StartTag(result.toString()));
>-    else {
>+    else if (character == '>' || character == kEndOfFileMarker) {
>+        if (auto string = result.toString())
>+            return advanceAndEmitToken(m_input, token, WebVTTToken::StartTag(*string));
>+        CRASH();
>+    } else {
>         result.append(character);
>         WEBVTT_ADVANCE_TO(StartTagState);
>     }
>@@ -202,27 +214,44 @@ StartTagClassState:
>     } else if (character == '>' || character == kEndOfFileMarker) {
>         addNewClass(classes, buffer);
>         buffer.clear();
>-        return advanceAndEmitToken(m_input, token, WebVTTToken::StartTag(result.toString(), classes.toAtomicString()));
>+        if (auto resultString = result.toString()) {
>+            if (auto classesString = classes.toAtomicString())
>+                return advanceAndEmitToken(m_input, token, WebVTTToken::StartTag(*resultString, *classesString));
>+        }
>+        CRASH();
>     } else {
>         buffer.append(character);
>         WEBVTT_ADVANCE_TO(StartTagClassState);
>     }
> 
> StartTagAnnotationState:
>-    if (character == '>' || character == kEndOfFileMarker)
>-        return advanceAndEmitToken(m_input, token, WebVTTToken::StartTag(result.toString(), classes.toAtomicString(), buffer.toAtomicString()));
>+    if (character == '>' || character == kEndOfFileMarker) {
>+        if (auto resultString = result.toString()) {
>+            if (auto classesString = classes.toAtomicString()) {
>+                if (auto bufferString = buffer.toAtomicString())
>+                    return advanceAndEmitToken(m_input, token, WebVTTToken::StartTag(*resultString, *classesString, *bufferString));
>+            }
>+        }
>+        CRASH();
>+    }
>     buffer.append(character);
>     WEBVTT_ADVANCE_TO(StartTagAnnotationState);
> 
> EndTagState:
>-    if (character == '>' || character == kEndOfFileMarker)
>-        return advanceAndEmitToken(m_input, token, WebVTTToken::EndTag(result.toString()));
>+    if (character == '>' || character == kEndOfFileMarker) {
>+        if (auto string = result.toString())
>+            return advanceAndEmitToken(m_input, token, WebVTTToken::EndTag(*string));
>+        CRASH();
>+    }
>     result.append(character);
>     WEBVTT_ADVANCE_TO(EndTagState);
> 
> TimestampTagState:
>-    if (character == '>' || character == kEndOfFileMarker)
>-        return advanceAndEmitToken(m_input, token, WebVTTToken::TimestampTag(result.toString()));
>+    if (character == '>' || character == kEndOfFileMarker) {
>+        if (auto string = result.toString())
>+            return advanceAndEmitToken(m_input, token, WebVTTToken::TimestampTag(*string));
>+        CRASH();
>+    }
>     result.append(character);
>     WEBVTT_ADVANCE_TO(TimestampTagState);
> }
>diff --git a/Source/WebCore/inspector/InspectorStyleSheet.cpp b/Source/WebCore/inspector/InspectorStyleSheet.cpp
>index 9d98581..651d2e8 100644
>--- a/Source/WebCore/inspector/InspectorStyleSheet.cpp
>+++ b/Source/WebCore/inspector/InspectorStyleSheet.cpp
>@@ -771,7 +771,9 @@ String InspectorStyle::shorthandValue(const String& shorthandProperty) const
>             builder.append(' ');
>         builder.append(individualValue);
>     }
>-    return builder.toString();
>+    if (auto string = builder.toString())
>+        return *string;
>+    CRASH();
> }
> 
> String InspectorStyle::shorthandPriority(const String& shorthandProperty) const
>@@ -943,13 +945,20 @@ ExceptionOr<CSSStyleRule*> InspectorStyleSheet::addRule(const String& selector)
>     styleSheetText.appendLiteral(" {}");
> 
>     // Using setText() as this operation changes the stylesheet rule set.
>-    setText(styleSheetText.toString());
>+    if (auto string = styleSheetText.toString())
>+        setText(*string);
>+    else
>+        CRASH();
> 
>     // Inspector Style Sheets are always treated as though their parsed data is ready.
>     if (m_origin == Inspector::Protocol::CSS::StyleSheetOrigin::Inspector)
>         fireStyleSheetChanged();
>-    else
>-        reparseStyleSheet(styleSheetText.toString());
>+    else {
>+        if (auto string = styleSheetText.toString())
>+            reparseStyleSheet(*string);
>+        else
>+            CRASH();
>+    }
> 
>     ASSERT(m_pageStyleSheet->length());
>     unsigned lastRuleIndex = m_pageStyleSheet->length() - 1;
>diff --git a/Source/WebCore/inspector/agents/InspectorApplicationCacheAgent.cpp b/Source/WebCore/inspector/agents/InspectorApplicationCacheAgent.cpp
>index 19af4e9..bf9b4fd 100644
>--- a/Source/WebCore/inspector/agents/InspectorApplicationCacheAgent.cpp
>+++ b/Source/WebCore/inspector/agents/InspectorApplicationCacheAgent.cpp
>@@ -172,11 +172,14 @@ Ref<Inspector::Protocol::ApplicationCache::ApplicationCacheResource> InspectorAp
>     if (resourceInfo.isExplicit)
>         types.appendLiteral("Explicit ");
> 
>-    return Inspector::Protocol::ApplicationCache::ApplicationCacheResource::create()
>-        .setUrl(resourceInfo.resource.string())
>-        .setSize(static_cast<int>(resourceInfo.size))
>-        .setType(types.toString())
>-        .release();
>+    if (auto string = types.toString()) {
>+        return Inspector::Protocol::ApplicationCache::ApplicationCacheResource::create()
>+            .setUrl(resourceInfo.resource.string())
>+            .setSize(static_cast<int>(resourceInfo.size))
>+            .setType(*string)
>+            .release();
>+    }
>+    CRASH();
> }
> 
> } // namespace WebCore
>diff --git a/Source/WebCore/inspector/agents/InspectorNetworkAgent.cpp b/Source/WebCore/inspector/agents/InspectorNetworkAgent.cpp
>index 46e4afe..af17045 100644
>--- a/Source/WebCore/inspector/agents/InspectorNetworkAgent.cpp
>+++ b/Source/WebCore/inspector/agents/InspectorNetworkAgent.cpp
>@@ -134,8 +134,11 @@ public:
>         if (m_decoder)
>             m_responseText.append(m_decoder->flush());
> 
>-        m_callback->sendSuccess(m_responseText.toString(), m_mimeType, m_statusCode);
>-        dispose();
>+        if (auto string = m_responseText.toString()) {
>+            m_callback->sendSuccess(*string, m_mimeType, m_statusCode);
>+            dispose();
>+        } else
>+            CRASH();
>     }
> 
>     void didFail(const ResourceError& error) override
>diff --git a/Source/WebCore/inspector/agents/WebConsoleAgent.cpp b/Source/WebCore/inspector/agents/WebConsoleAgent.cpp
>index dc96486..63838ad 100644
>--- a/Source/WebCore/inspector/agents/WebConsoleAgent.cpp
>+++ b/Source/WebCore/inspector/agents/WebConsoleAgent.cpp
>@@ -169,7 +169,10 @@ void WebConsoleAgent::didFailLoading(unsigned long requestIdentifier, const Reso
>         message.append(error.localizedDescription());
>     }
> 
>-    addMessageToConsole(std::make_unique<ConsoleMessage>(MessageSource::Network, MessageType::Log, MessageLevel::Error, message.toString(), error.failingURL(), 0, 0, nullptr, requestIdentifier));
>+    if (auto string = message.toString())
>+        addMessageToConsole(std::make_unique<ConsoleMessage>(MessageSource::Network, MessageType::Log, MessageLevel::Error, *string, error.failingURL(), 0, 0, nullptr, requestIdentifier));
>+    else
>+        CRASH();
> }
> 
> } // namespace WebCore
>diff --git a/Source/WebCore/loader/CrossOriginAccessControl.cpp b/Source/WebCore/loader/CrossOriginAccessControl.cpp
>index 68804f2..f88a45d 100644
>--- a/Source/WebCore/loader/CrossOriginAccessControl.cpp
>+++ b/Source/WebCore/loader/CrossOriginAccessControl.cpp
>@@ -112,8 +112,12 @@ ResourceRequest createAccessControlPreflightRequest(const ResourceRequest& reque
> 
>             headerBuffer.append(headerField);
>         }
>-        if (!headerBuffer.isEmpty())
>-            preflightRequest.setHTTPHeaderField(HTTPHeaderName::AccessControlRequestHeaders, headerBuffer.toString());
>+        if (!headerBuffer.isEmpty()) {
>+            if (auto string = headerBuffer.toString())
>+                preflightRequest.setHTTPHeaderField(HTTPHeaderName::AccessControlRequestHeaders, *string);
>+            else
>+                CRASH();
>+        }
>     }
> 
>     return preflightRequest;
>diff --git a/Source/WebCore/loader/ResourceLoadStatistics.cpp b/Source/WebCore/loader/ResourceLoadStatistics.cpp
>index 4df25da..986fe51 100644
>--- a/Source/WebCore/loader/ResourceLoadStatistics.cpp
>+++ b/Source/WebCore/loader/ResourceLoadStatistics.cpp
>@@ -268,7 +268,9 @@ String ResourceLoadStatistics::toString() const
> 
>     builder.append('\n');
> 
>-    return builder.toString();
>+    if (auto string = builder.toString())
>+        return *string;
>+    CRASH();
> }
> 
> template <typename T>
>diff --git a/Source/WebCore/loader/appcache/ApplicationCacheStorage.cpp b/Source/WebCore/loader/appcache/ApplicationCacheStorage.cpp
>index ff29389..4f22d49 100644
>--- a/Source/WebCore/loader/appcache/ApplicationCacheStorage.cpp
>+++ b/Source/WebCore/loader/appcache/ApplicationCacheStorage.cpp
>@@ -841,17 +841,20 @@ bool ApplicationCacheStorage::store(ApplicationCacheResource* resource, unsigned
> 
>     // Then, insert the resource
>     
>-    // Serialize the headers
>-    StringBuilder stringBuilder;
>-    
>-    for (const auto& header : resource->response().httpHeaderFields()) {
>-        stringBuilder.append(header.key);
>-        stringBuilder.append(':');
>-        stringBuilder.append(header.value);
>-        stringBuilder.append('\n');
>-    }
>-    
>-    String headers = stringBuilder.toString();
>+    String headers = [&] () {
>+        // Serialize the headers
>+        StringBuilder stringBuilder;
>+    
>+        for (const auto& header : resource->response().httpHeaderFields()) {
>+            stringBuilder.append(header.key);
>+            stringBuilder.append(':');
>+            stringBuilder.append(header.value);
>+            stringBuilder.append('\n');
>+        }
>+        if (auto string = stringBuilder.toString())
>+            return *string;
>+        CRASH();
>+    }();
>     
>     SQLiteStatement resourceStatement(m_database, "INSERT INTO CacheResources (url, statusCode, responseURL, headers, data, mimeType, textEncodingName) VALUES (?, ?, ?, ?, ?, ?, ?)");
>     if (resourceStatement.prepare() != SQLITE_OK)
>diff --git a/Source/WebCore/loader/archive/cf/LegacyWebArchive.cpp b/Source/WebCore/loader/archive/cf/LegacyWebArchive.cpp
>index 12a30cc..cfe73863d 100644
>--- a/Source/WebCore/loader/archive/cf/LegacyWebArchive.cpp
>+++ b/Source/WebCore/loader/archive/cf/LegacyWebArchive.cpp
>@@ -557,21 +557,24 @@ RefPtr<LegacyWebArchive> LegacyWebArchive::createFromSelection(Frame* frame)
>     if (auto selectionRange = frame->selection().toNormalizedRange())
>         builder.append(createMarkup(*selectionRange, &nodeList, AnnotateForInterchange));
> 
>-    auto archive = create(builder.toString(), *frame, nodeList, nullptr);
>+    if (auto string = builder.toString()) {
>+        auto archive = create(*string, *frame, nodeList, nullptr);
>     
>-    if (!document->isFrameSet())
>-        return archive;
>+        if (!document->isFrameSet())
>+            return archive;
>         
>-    // Wrap the frameset document in an iframe so it can be pasted into
>-    // another document (which will have a body or frameset of its own). 
>-    String iframeMarkup = "<iframe frameborder=\"no\" marginwidth=\"0\" marginheight=\"0\" width=\"98%%\" height=\"98%%\" src=\"" + frame->loader().documentLoader()->response().url().string() + "\"></iframe>";
>-    auto iframeResource = ArchiveResource::create(utf8Buffer(iframeMarkup), blankURL(), "text/html", "UTF-8", String());
>+        // Wrap the frameset document in an iframe so it can be pasted into
>+        // another document (which will have a body or frameset of its own). 
>+        String iframeMarkup = "<iframe frameborder=\"no\" marginwidth=\"0\" marginheight=\"0\" width=\"98%%\" height=\"98%%\" src=\"" + frame->loader().documentLoader()->response().url().string() + "\"></iframe>";
>+        auto iframeResource = ArchiveResource::create(utf8Buffer(iframeMarkup), blankURL(), "text/html", "UTF-8", String());
> 
>-    Vector<Ref<LegacyWebArchive>> subframeArchives;
>-    subframeArchives.reserveInitialCapacity(1);
>-    subframeArchives.uncheckedAppend(archive.releaseNonNull());
>+        Vector<Ref<LegacyWebArchive>> subframeArchives;
>+        subframeArchives.reserveInitialCapacity(1);
>+        subframeArchives.uncheckedAppend(archive.releaseNonNull());
> 
>-    return create(iframeResource.releaseNonNull(), { }, WTFMove(subframeArchives));
>+        return create(iframeResource.releaseNonNull(), { }, WTFMove(subframeArchives));
>+    }
>+    CRASH();
> }
> 
> }
>diff --git a/Source/WebCore/loader/archive/mhtml/MHTMLArchive.cpp b/Source/WebCore/loader/archive/mhtml/MHTMLArchive.cpp
>index 705c6dc..aa0a573 100644
>--- a/Source/WebCore/loader/archive/mhtml/MHTMLArchive.cpp
>+++ b/Source/WebCore/loader/archive/mhtml/MHTMLArchive.cpp
>@@ -76,7 +76,9 @@ static String generateRandomBoundary()
>         stringBuilder.append(lowerNibbleToASCIIHexDigit(randomValues[i]));
>         stringBuilder.append(upperNibbleToASCIIHexDigit(randomValues[i]));
>     }
>-    return stringBuilder.toString();
>+    if (auto string = stringBuilder.toString())
>+        return *string;
>+    CRASH();
> }
> 
> static String replaceNonPrintableCharacters(const String& text)
>@@ -88,7 +90,9 @@ static String replaceNonPrintableCharacters(const String& text)
>         else
>             stringBuilder.append('?');
>     }
>-    return stringBuilder.toString();
>+    if (auto string = stringBuilder.toString())
>+        return *string;
>+    CRASH();
> }
> 
> MHTMLArchive::MHTMLArchive()
>@@ -160,10 +164,16 @@ Ref<SharedBuffer> MHTMLArchive::generateMHTMLData(Page* page)
>     stringBuilder.append("\"\r\n\r\n");
> 
>     // We use utf8() below instead of ascii() as ascii() replaces CRLFs with ?? (we still only have put ASCII characters in it).
>-    ASSERT(stringBuilder.toString().isAllASCII());
>-    CString asciiString = stringBuilder.toString().utf8();
>-    auto mhtmlData = SharedBuffer::create();
>-    mhtmlData->append(asciiString.data(), asciiString.length());
>+    auto mhtmlData = [&] () {
>+        if (auto string = stringBuilder.toString()) {
>+            ASSERT(string->isAllASCII());
>+            CString asciiString = string->utf8();
>+            auto result = SharedBuffer::create();
>+            result->append(asciiString.data(), asciiString.length());
>+            return result;
>+        }
>+        CRASH();
>+    }();
> 
>     for (auto& resource : resources) {
>         stringBuilder.clear();
>@@ -183,8 +193,10 @@ Ref<SharedBuffer> MHTMLArchive::generateMHTMLData(Page* page)
>         stringBuilder.append(resource.url);
>         stringBuilder.append("\r\n\r\n");
> 
>-        asciiString = stringBuilder.toString().utf8();
>-        mhtmlData->append(asciiString.data(), asciiString.length());
>+        if (auto string = stringBuilder.toString()) {
>+            CString asciiString = string->utf8();
>+            mhtmlData->append(asciiString.data(), asciiString.length());
>+        }
> 
>         // FIXME: ideally we would encode the content as a stream without having to fetch it all.
>         const char* data = resource.data->data();
>@@ -210,8 +222,10 @@ Ref<SharedBuffer> MHTMLArchive::generateMHTMLData(Page* page)
>         }
>     }
> 
>-    asciiString = makeString("--", boundary, "--\r\n").utf8();
>-    mhtmlData->append(asciiString.data(), asciiString.length());
>+    {
>+        CString asciiString = makeString("--", boundary, "--\r\n").utf8();
>+        mhtmlData->append(asciiString.data(), asciiString.length());
>+    }
> 
>     return mhtmlData;
> }
>diff --git a/Source/WebCore/page/CaptionUserPreferencesMediaAF.cpp b/Source/WebCore/page/CaptionUserPreferencesMediaAF.cpp
>index c139076..d83e254 100644
>--- a/Source/WebCore/page/CaptionUserPreferencesMediaAF.cpp
>+++ b/Source/WebCore/page/CaptionUserPreferencesMediaAF.cpp
>@@ -347,14 +347,18 @@ String CaptionUserPreferencesMediaAF::windowRoundedCornerRadiusCSS() const
> 
>     StringBuilder builder;
>     appendCSS(builder, CSSPropertyBorderRadius, String::format("%.02fpx", radius), behavior == kMACaptionAppearanceBehaviorUseValue);
>-    return builder.toString();
>+    if (auto string = builder.toString())
>+        return *string;
>+    CRASH();
> }
> 
> String CaptionUserPreferencesMediaAF::colorPropertyCSS(CSSPropertyID id, const Color& color, bool important) const
> {
>     StringBuilder builder;
>     appendCSS(builder, id, color.serialized(), important);
>-    return builder.toString();
>+    if (auto string = builder.toString())
>+        return *string;
>+    CRASH();
> }
> 
> bool CaptionUserPreferencesMediaAF::captionStrokeWidthForFont(float fontSize, const String& language, float& strokeWidth, bool& important) const
>@@ -406,7 +410,9 @@ String CaptionUserPreferencesMediaAF::captionsTextEdgeCSS() const
>         appendCSS(builder, CSSPropertyStrokeLinecap, getValueName(CSSValueRound), important);
>     }
>     
>-    return builder.toString();
>+    if (auto string = builder.toString())
>+        return *string;
>+    CRASH();
> }
> 
> String CaptionUserPreferencesMediaAF::captionsDefaultFontCSS() const
>@@ -448,7 +454,9 @@ String CaptionUserPreferencesMediaAF::captionsDefaultFontCSS() const
>         builder.appendLiteral(" !important");
>     builder.append(';');
>     
>-    return builder.toString();
>+    if (auto string = builder.toString())
>+        return *string;
>+    CRASH();
> }
> 
> float CaptionUserPreferencesMediaAF::captionFontSizeScaleAndImportance(bool& important) const
>@@ -595,9 +603,11 @@ String CaptionUserPreferencesMediaAF::captionsStyleSheetOverride() const
>     }
> #endif // HAVE(MEDIA_ACCESSIBILITY_FRAMEWORK)
> 
>-    LOG(Media, "CaptionUserPreferencesMediaAF::captionsStyleSheetOverrideSetting style to:\n%s", captionsOverrideStyleSheet.toString().utf8().data());
>-
>-    return captionsOverrideStyleSheet.toString();
>+    if (auto string = captionsOverrideStyleSheet.toString()) {
>+        LOG(Media, "CaptionUserPreferencesMediaAF::captionsStyleSheetOverrideSetting style to:\n%s", string->utf8().data());
>+        return *string;
>+    }
>+    CRASH();
> }
> 
> static String languageIdentifier(const String& languageCode)
>@@ -664,10 +674,13 @@ static String trackDisplayName(AudioTrack* track)
>     if (displayName.isEmpty())
>         displayName.append(audioTrackNoLabelText());
> 
>-    if (track->kind() != AudioTrack::descriptionKeyword())
>-        return displayName.toString();
>+    if (auto string = displayName.toString()) {
>+        if (track->kind() != AudioTrack::descriptionKeyword())
>+            return *string;
> 
>-    return audioDescriptionTrackSuffixText(displayName.toString());
>+        return audioDescriptionTrackSuffixText(*string);
>+    }
>+    CRASH();
> }
> 
> String CaptionUserPreferencesMediaAF::displayNameForTrack(AudioTrack* track) const
>@@ -688,26 +701,29 @@ static String trackDisplayName(TextTrack* track)
>     if (displayNameBuilder.isEmpty())
>         displayNameBuilder.append(textTrackNoLabelText());
> 
>-    String displayName = displayNameBuilder.toString();
>+    if (auto string = displayNameBuilder.toString()) {
>+        String displayName = *string;
> 
>-    if (track->isClosedCaptions()) {
>-        displayName = closedCaptionTrackMenuItemText(displayName);
>-        if (track->isEasyToRead())
>-            displayName = easyReaderTrackMenuItemText(displayName);
>+        if (track->isClosedCaptions()) {
>+            displayName = closedCaptionTrackMenuItemText(displayName);
>+            if (track->isEasyToRead())
>+                displayName = easyReaderTrackMenuItemText(displayName);
> 
>-        return displayName;
>-    }
>+            return displayName;
>+        }
> 
>-    if (track->isSDH())
>-        displayName = sdhTrackMenuItemText(displayName);
>+        if (track->isSDH())
>+            displayName = sdhTrackMenuItemText(displayName);
> 
>-    if (track->containsOnlyForcedSubtitles())
>-        displayName = forcedTrackMenuItemText(displayName);
>+        if (track->containsOnlyForcedSubtitles())
>+            displayName = forcedTrackMenuItemText(displayName);
> 
>-    if (track->isEasyToRead())
>-        displayName = easyReaderTrackMenuItemText(displayName);
>+        if (track->isEasyToRead())
>+            displayName = easyReaderTrackMenuItemText(displayName);
> 
>-    return displayName;
>+        return displayName;
>+    }
>+    CRASH();
> }
> 
> String CaptionUserPreferencesMediaAF::displayNameForTrack(TextTrack* track) const
>diff --git a/Source/WebCore/page/Frame.cpp b/Source/WebCore/page/Frame.cpp
>index a84265a..3e4246d 100644
>--- a/Source/WebCore/page/Frame.cpp
>+++ b/Source/WebCore/page/Frame.cpp
>@@ -369,7 +369,9 @@ static JSC::Yarr::RegularExpression createRegExpForLabels(const Vector<String>&
>             pattern.appendLiteral("\\b");
>     }
>     pattern.append(')');
>-    return JSC::Yarr::RegularExpression(pattern.toString(), JSC::Yarr::TextCaseInsensitive);
>+    if (auto string = pattern.toString())
>+        return JSC::Yarr::RegularExpression(*string, JSC::Yarr::TextCaseInsensitive);
>+    CRASH();
> }
> 
> String Frame::searchForLabelsAboveCell(const JSC::Yarr::RegularExpression& regExp, HTMLTableCellElement* cell, size_t* resultDistanceFromStartOfCell)
>diff --git a/Source/WebCore/page/FrameTree.cpp b/Source/WebCore/page/FrameTree.cpp
>index 26ccc7a..4dcef07 100644
>--- a/Source/WebCore/page/FrameTree.cpp
>+++ b/Source/WebCore/page/FrameTree.cpp
>@@ -150,7 +150,9 @@ AtomicString FrameTree::uniqueChildName(const AtomicString& requestedName) const
>     name.appendNumber(childCount());
>     name.appendLiteral("-->-->");
> 
>-    return name.toAtomicString();
>+    if (auto string = name.toAtomicString())
>+        return *string;
>+    CRASH();
> }
> 
> static bool inScope(Frame& frame, TreeScope& scope)
>diff --git a/Source/WebCore/page/FrameView.cpp b/Source/WebCore/page/FrameView.cpp
>index 3bd022f..adcc2f0 100644
>--- a/Source/WebCore/page/FrameView.cpp
>+++ b/Source/WebCore/page/FrameView.cpp
>@@ -1452,7 +1452,10 @@ void FrameView::logMockScrollAnimatorMessage(const String& message) const
>         builder.appendLiteral("Main");
>     builder.appendLiteral("FrameView: ");
>     builder.append(message);
>-    document->addConsoleMessage(MessageSource::Other, MessageLevel::Debug, builder.toString());
>+    if (auto string = builder.toString())
>+        document->addConsoleMessage(MessageSource::Other, MessageLevel::Debug, *string);
>+    else
>+        CRASH();
> }
> 
> void FrameView::setCannotBlitToWindow()
>diff --git a/Source/WebCore/page/PageSerializer.cpp b/Source/WebCore/page/PageSerializer.cpp
>index 5f64224..9aa9f20 100644
>--- a/Source/WebCore/page/PageSerializer.cpp
>+++ b/Source/WebCore/page/PageSerializer.cpp
>@@ -263,8 +263,11 @@ void PageSerializer::serializeCSSStyleSheet(CSSStyleSheet* styleSheet, const URL
>         // FIXME: We should check whether a charset has been specified and if none was found add one.
>         TextEncoding textEncoding(styleSheet->contents().charset());
>         ASSERT(textEncoding.isValid());
>-        m_resources.append({ url, ASCIILiteral { "text/css" }, SharedBuffer::create(textEncoding.encode(cssText.toString(), UnencodableHandling::Entities)) });
>-        m_resourceURLs.add(url);
>+        if (auto string = cssText.toString()) {
>+            m_resources.append({ url, ASCIILiteral { "text/css" }, SharedBuffer::create(textEncoding.encode(*string, UnencodableHandling::Entities)) });
>+            m_resourceURLs.add(url);
>+        } else
>+            CRASH();
>     }
> }
> 
>diff --git a/Source/WebCore/page/PerformanceLoggingClient.cpp b/Source/WebCore/page/PerformanceLoggingClient.cpp
>index 9d44d94..3b44ff5 100644
>--- a/Source/WebCore/page/PerformanceLoggingClient.cpp
>+++ b/Source/WebCore/page/PerformanceLoggingClient.cpp
>@@ -50,7 +50,9 @@ String PerformanceLoggingClient::synchronousScrollingReasonsAsString(Synchronous
>         reasons.appendLiteral("image document,");
> 
>     // Strip the trailing comma.
>-    return reasons.toString().left(reasons.length() - 1);
>+    if (auto string = reasons.toString())
>+        return string->left(reasons.length() - 1);
>+    CRASH();
> }
> 
> } // namespace WebCore
>diff --git a/Source/WebCore/page/SecurityOriginData.cpp b/Source/WebCore/page/SecurityOriginData.cpp
>index 2aac8ee..e3ac8d7 100644
>--- a/Source/WebCore/page/SecurityOriginData.cpp
>+++ b/Source/WebCore/page/SecurityOriginData.cpp
>@@ -84,7 +84,9 @@ String SecurityOriginData::databaseIdentifier() const
>     stringBuilder.append(separatorCharacter);
>     stringBuilder.appendNumber(port.value_or(0));
>     
>-    return stringBuilder.toString();
>+    if (auto string = stringBuilder.toString())
>+        return *string;
>+    CRASH();
> }
> 
> std::optional<SecurityOriginData> SecurityOriginData::fromDatabaseIdentifier(const String& databaseIdentifier)
>diff --git a/Source/WebCore/page/WheelEventTestTrigger.cpp b/Source/WebCore/page/WheelEventTestTrigger.cpp
>index ed549cf..fc50252 100644
>--- a/Source/WebCore/page/WheelEventTestTrigger.cpp
>+++ b/Source/WebCore/page/WheelEventTestTrigger.cpp
>@@ -100,7 +100,10 @@ static void dumpState(WTF::HashMap<WheelEventTestTrigger::ScrollableAreaIdentifi
>                 reasons.append(", ");
>             reasons.append(String::number(reason));
>         }
>-        LOG(WheelEventTestTriggers, "     Reasons: %s", reasons.toString().utf8().data());
>+        if (auto string = reasons.toString())
>+            LOG(WheelEventTestTriggers, "     Reasons: %s", string->utf8().data());
>+        else
>+            CRASH();
>     }
> }
> #endif
>diff --git a/Source/WebCore/page/csp/ContentSecurityPolicy.cpp b/Source/WebCore/page/csp/ContentSecurityPolicy.cpp
>index fc2fd12..3c91872 100644
>--- a/Source/WebCore/page/csp/ContentSecurityPolicy.cpp
>+++ b/Source/WebCore/page/csp/ContentSecurityPolicy.cpp
>@@ -85,7 +85,9 @@ static String consoleMessageForViolation(const char* effectiveViolatedDirective,
>         result.append(effectiveViolatedDirective);
>         result.appendLiteral(" directive of the Content Security Policy.");
>     }
>-    return result.toString();
>+    if (auto string = result.toString())
>+        return *string;
>+    CRASH();
> }
> 
> ContentSecurityPolicy::ContentSecurityPolicy(ScriptExecutionContext& scriptExecutionContext)
>@@ -137,7 +139,10 @@ bool ContentSecurityPolicy::allowRunningOrDisplayingInsecureContent(const URL& u
>         consoleMessage.append(url.stringCenterEllipsizedToLength());
>         consoleMessage.appendLiteral(" because ");
>         consoleMessage.append("'block-all-mixed-content' appears in the Content Security Policy.");
>-        reportViolation(ContentSecurityPolicyDirectiveNames::blockAllMixedContent, ContentSecurityPolicyDirectiveNames::blockAllMixedContent, *policy, url, consoleMessage.toString());
>+        if (auto string = consoleMessage.toString())
>+            reportViolation(ContentSecurityPolicyDirectiveNames::blockAllMixedContent, ContentSecurityPolicyDirectiveNames::blockAllMixedContent, *policy, url, *string);
>+        else
>+            CRASH();
> 
>         if (!isReportOnly)
>             allow = false;
>diff --git a/Source/WebCore/page/scrolling/AxisScrollSnapOffsets.cpp b/Source/WebCore/page/scrolling/AxisScrollSnapOffsets.cpp
>index 0207538..d8d3f28 100644
>--- a/Source/WebCore/page/scrolling/AxisScrollSnapOffsets.cpp
>+++ b/Source/WebCore/page/scrolling/AxisScrollSnapOffsets.cpp
>@@ -81,7 +81,9 @@ static String snapOffsetsToString(const Vector<LayoutUnit>& snapOffsets)
>         s.append(String::format("%.1f ", offset.toFloat()));
> 
>     s.append("]");
>-    return s.toString();
>+    if (auto string = s.toString())
>+        return *string;
>+    CRASH();
> }
> 
> static String snapOffsetRangesToString(const Vector<ScrollOffsetRange<LayoutUnit>>& ranges)
>@@ -91,7 +93,9 @@ static String snapOffsetRangesToString(const Vector<ScrollOffsetRange<LayoutUnit
>     for (auto range : ranges)
>         s.append(String::format("(%.1f, %.1f) ", range.start.toFloat(), range.end.toFloat()));
>     s.append("]");
>-    return s.toString();
>+    if (auto string = s.toString())
>+        return *string;
>+    CRASH();
> }
> 
> static String snapPortOrAreaToString(const LayoutRect& rect)
>diff --git a/Source/WebCore/page/scrolling/ScrollingCoordinator.cpp b/Source/WebCore/page/scrolling/ScrollingCoordinator.cpp
>index f50221a..3c1c6e2 100644
>--- a/Source/WebCore/page/scrolling/ScrollingCoordinator.cpp
>+++ b/Source/WebCore/page/scrolling/ScrollingCoordinator.cpp
>@@ -389,7 +389,9 @@ String ScrollingCoordinator::synchronousScrollingReasonsAsText(SynchronousScroll
> 
>     if (stringBuilder.length())
>         stringBuilder.resize(stringBuilder.length() - 2);
>-    return stringBuilder.toString();
>+    if (auto string = stringBuilder.toString())
>+        return *string;
>+    CRASH();
> }
> 
> String ScrollingCoordinator::synchronousScrollingReasonsAsText() const
>diff --git a/Source/WebCore/platform/Decimal.cpp b/Source/WebCore/platform/Decimal.cpp
>index 3d525cf..1a192a5 100644
>--- a/Source/WebCore/platform/Decimal.cpp
>+++ b/Source/WebCore/platform/Decimal.cpp
>@@ -994,7 +994,9 @@ String Decimal::toString() const
>     if (originalExponent <= 0 && adjustedExponent >= -6) {
>         if (!originalExponent) {
>             builder.append(digits);
>-            return builder.toString();
>+            if (auto string = builder.toString())
>+                return *string;
>+            CRASH();
>         }
> 
>         if (adjustedExponent >= 0) {
>@@ -1003,7 +1005,9 @@ String Decimal::toString() const
>                 if (i == adjustedExponent)
>                     builder.append('.');
>             }
>-            return builder.toString();
>+            if (auto string = builder.toString())
>+                return *string;
>+            CRASH();
>         }
> 
>         builder.appendLiteral("0.");
>@@ -1027,7 +1031,9 @@ String Decimal::toString() const
>             builder.appendNumber(adjustedExponent);
>         }
>     }
>-    return builder.toString();
>+    if (auto string = builder.toString())
>+        return *string;
>+    CRASH();
> }
> 
> Decimal Decimal::zero(Sign sign)
>diff --git a/Source/WebCore/platform/FileSystem.cpp b/Source/WebCore/platform/FileSystem.cpp
>index 2fdb260..e67d679 100644
>--- a/Source/WebCore/platform/FileSystem.cpp
>+++ b/Source/WebCore/platform/FileSystem.cpp
>@@ -130,7 +130,9 @@ String encodeForFileName(const String& inputString)
>             result.append(character);
>     }
> 
>-    return result.toString();
>+    if (auto string = result.toString())
>+        return *string;
>+    CRASH();
> }
> 
> String decodeFromFilename(const String& inputString)
>@@ -181,7 +183,9 @@ String decodeFromFilename(const String& inputString)
>         i += 5;
>     }
> 
>-    return result.toString();
>+    if (auto string = result.toString())
>+        return *string;
>+    CRASH();
> }
> 
> String lastComponentOfPathIgnoringTrailingSlash(const String& path)
>diff --git a/Source/WebCore/platform/PODInterval.h b/Source/WebCore/platform/PODInterval.h
>index 048da98..646362f 100644
>--- a/Source/WebCore/platform/PODInterval.h
>+++ b/Source/WebCore/platform/PODInterval.h
>@@ -145,7 +145,9 @@ public:
>         builder.appendLiteral(", maxHigh=");
>         builder.append(ValueToString<T>::string(maxHigh()));
>         builder.append(']');
>-        return builder.toString();
>+        if (auto string = builder.toString())
>+            return *string;
>+        CRASH();
>     }
> #endif
> 
>diff --git a/Source/WebCore/platform/PODRedBlackTree.h b/Source/WebCore/platform/PODRedBlackTree.h
>index 131f31a..4960efd 100644
>--- a/Source/WebCore/platform/PODRedBlackTree.h
>+++ b/Source/WebCore/platform/PODRedBlackTree.h
>@@ -744,7 +744,10 @@ private:
>             builder.append(ValueToString<T>::string(node->data()));
>             builder.append((node->color() == Black) ? " (black)" : " (red)");
>         }
>-        LOG_ERROR("%s", builder.toString().ascii().data());
>+        if (auto string = builder.toString())
>+            LOG_ERROR("%s", string->ascii().data());
>+        else
>+            CRASH();
>         if (node) {
>             dumpFromNode(node->left(), indentation + 2);
>             dumpFromNode(node->right(), indentation + 2);
>diff --git a/Source/WebCore/platform/URL.cpp b/Source/WebCore/platform/URL.cpp
>index 9900e55..0335a51 100644
>--- a/Source/WebCore/platform/URL.cpp
>+++ b/Source/WebCore/platform/URL.cpp
>@@ -448,8 +448,11 @@ void URL::setHost(const String& s)
>     builder.append(StringView(encodedHostName.data(), encodedHostName.size()));
>     builder.append(m_string.substring(m_hostEnd));
> 
>-    URLParser parser(builder.toString());
>-    *this = parser.result();
>+    if (auto string = builder.toString()) {
>+        URLParser parser(*string);
>+        *this = parser.result();
>+    } else
>+        CRASH();
> }
> 
> void URL::removePort()
>@@ -510,8 +513,11 @@ void URL::setHostAndPort(const String& hostAndPort)
>     }
>     builder.append(m_string.substring(m_portEnd));
> 
>-    URLParser parser(builder.toString());
>-    *this = parser.result();
>+    if (auto string = builder.toString()) {
>+        URLParser parser(*string);
>+        *this = parser.result();
>+    } else
>+        CRASH();
> }
> 
> static String percentEncodeCharacters(const String& input, bool(*shouldEncode)(UChar))
>@@ -530,7 +536,9 @@ static String percentEncodeCharacters(const String& input, bool(*shouldEncode)(U
>             } else
>                 builder.append(c);
>         }
>-        return builder.toString();
>+        if (auto string = builder.toString())
>+            return *string;
>+        CRASH();
>     };
> 
>     for (size_t i = 0; i < input.length(); ++i) {
>diff --git a/Source/WebCore/platform/animation/TimingFunction.cpp b/Source/WebCore/platform/animation/TimingFunction.cpp
>index 8c972d6..edbfed5 100644
>--- a/Source/WebCore/platform/animation/TimingFunction.cpp
>+++ b/Source/WebCore/platform/animation/TimingFunction.cpp
>@@ -129,7 +129,10 @@ ExceptionOr<RefPtr<TimingFunction>> TimingFunction::createFromCSSText(const Stri
>     cssString.appendLiteral(": ");
>     cssString.append(cssText);
>     auto styleProperties = MutableStyleProperties::create();
>-    styleProperties->parseDeclaration(cssString.toString(), CSSParserContext(HTMLStandardMode));
>+    if (auto string = cssString.toString())
>+        styleProperties->parseDeclaration(*string, CSSParserContext(HTMLStandardMode));
>+    else
>+        CRASH();
> 
>     if (auto cssValue = styleProperties->getPropertyCSSValue(CSSPropertyAnimationTimingFunction)) {
>         if (auto timingFunction = createFromCSSValue(*cssValue.get()))
>diff --git a/Source/WebCore/platform/glib/FileSystemGlib.cpp b/Source/WebCore/platform/glib/FileSystemGlib.cpp
>index f940815..2b30b2f 100644
>--- a/Source/WebCore/platform/glib/FileSystemGlib.cpp
>+++ b/Source/WebCore/platform/glib/FileSystemGlib.cpp
>@@ -218,7 +218,9 @@ String pathByAppendingComponents(StringView path, const Vector<StringView>& comp
>         builder.append(G_DIR_SEPARATOR_S);
>         builder.append(component);
>     }
>-    return builder.toString();
>+    if (auto string = builder.toString())
>+        return *string;
>+    CRASH();
> }
> 
> bool makeAllDirectories(const String& path)
>diff --git a/Source/WebCore/platform/glib/UserAgentGLib.cpp b/Source/WebCore/platform/glib/UserAgentGLib.cpp
>index 1621a88..38077f8 100644
>--- a/Source/WebCore/platform/glib/UserAgentGLib.cpp
>+++ b/Source/WebCore/platform/glib/UserAgentGLib.cpp
>@@ -106,7 +106,9 @@ static String buildUserAgentString(const UserAgentQuirks& quirks)
>     uaString.appendLiteral("Version/11.0 Safari/");
>     uaString.append(versionForUAString());
> 
>-    return uaString.toString();
>+    if (auto string = uaString.toString())
>+        return *string;
>+    CRASH();
> }
> 
> static const String standardUserAgentStatic()
>diff --git a/Source/WebCore/platform/graphics/Color.cpp b/Source/WebCore/platform/graphics/Color.cpp
>index 5dd150f..ee1be74 100644
>--- a/Source/WebCore/platform/graphics/Color.cpp
>+++ b/Source/WebCore/platform/graphics/Color.cpp
>@@ -348,7 +348,9 @@ String Color::serialized() const
>         appendByteAsHex(red(), builder, Lowercase);
>         appendByteAsHex(green(), builder, Lowercase);
>         appendByteAsHex(blue(), builder, Lowercase);
>-        return builder.toString();
>+        if (auto string = builder.toString())
>+            return *string;
>+        CRASH();
>     }
> 
>     return cssText();
>@@ -384,7 +386,9 @@ String Color::cssText() const
>     }
>         
>     builder.append(')');
>-    return builder.toString();
>+    if (auto string = builder.toString())
>+        return *string;
>+    CRASH();
> }
> 
> String Color::nameForRenderTreeAsText() const
>diff --git a/Source/WebCore/platform/graphics/ExtendedColor.cpp b/Source/WebCore/platform/graphics/ExtendedColor.cpp
>index 50e3c5c..448dfd2 100644
>--- a/Source/WebCore/platform/graphics/ExtendedColor.cpp
>+++ b/Source/WebCore/platform/graphics/ExtendedColor.cpp
>@@ -72,7 +72,9 @@ String ExtendedColor::cssText() const
>     }
>     builder.append(')');
> 
>-    return builder.toString();
>+    if (auto string = builder.toString())
>+        return *string;
>+    CRASH();
> }
> 
> }
>diff --git a/Source/WebCore/platform/graphics/FontCascade.cpp b/Source/WebCore/platform/graphics/FontCascade.cpp
>index 847861f..5548293 100644
>--- a/Source/WebCore/platform/graphics/FontCascade.cpp
>+++ b/Source/WebCore/platform/graphics/FontCascade.cpp
>@@ -549,7 +549,9 @@ static inline String normalizeSpacesInternal(const CharacterType* characters, un
>     for (unsigned i = 0; i < length; ++i)
>         normalized.append(FontCascade::normalizeSpaces(characters[i]));
> 
>-    return normalized.toString();
>+    if (auto string = normalized.toString())
>+        return *string;
>+    CRASH();
> }
> 
> String FontCascade::normalizeSpaces(const LChar* characters, unsigned length)
>diff --git a/Source/WebCore/platform/graphics/FontTaggedSettings.cpp b/Source/WebCore/platform/graphics/FontTaggedSettings.cpp
>index 61b2ebe..5c46727 100644
>--- a/Source/WebCore/platform/graphics/FontTaggedSettings.cpp
>+++ b/Source/WebCore/platform/graphics/FontTaggedSettings.cpp
>@@ -72,7 +72,10 @@ TextStream& operator<<(TextStream& ts, const FontVariationSettings& item)
>         s.append(variation.tag()[1]);
>         s.append(variation.tag()[2]);
>         s.append(variation.tag()[3]);
>-        ts.dumpProperty(s.toString(), item.at(i).value());
>+        if (auto string = s.toString())
>+            ts.dumpProperty(*string, item.at(i).value());
>+        else
>+            CRASH();
>     }
>     return ts;
> }
>diff --git a/Source/WebCore/platform/graphics/GraphicsLayer.cpp b/Source/WebCore/platform/graphics/GraphicsLayer.cpp
>index 698180e..15ce892 100644
>--- a/Source/WebCore/platform/graphics/GraphicsLayer.cpp
>+++ b/Source/WebCore/platform/graphics/GraphicsLayer.cpp
>@@ -441,7 +441,9 @@ String GraphicsLayer::animationNameForTransition(AnimatedPropertyID property)
>     id.appendLiteral("-|transition");
>     id.appendNumber(static_cast<int>(property));
>     id.append('-');
>-    return id.toString();
>+    if (auto string = id.toString())
>+        return *string;
>+    CRASH();
> }
> 
> void GraphicsLayer::suspendAnimations(MonotonicTime)
>diff --git a/Source/WebCore/platform/graphics/avfoundation/InbandTextTrackPrivateAVF.cpp b/Source/WebCore/platform/graphics/avfoundation/InbandTextTrackPrivateAVF.cpp
>index 6f2b387..953c498 100644
>--- a/Source/WebCore/platform/graphics/avfoundation/InbandTextTrackPrivateAVF.cpp
>+++ b/Source/WebCore/platform/graphics/avfoundation/InbandTextTrackPrivateAVF.cpp
>@@ -300,8 +300,12 @@ void InbandTextTrackPrivateAVF::processCueAttributes(CFAttributedStringRef attri
>         content.append(tagEnd);
>     }
> 
>-    if (content.length())
>-        cueData.setContent(content.toString());
>+    if (content.length()) {
>+        if (auto string = content.toString())
>+            cueData.setContent(*string);
>+        else
>+            CRASH();
>+    }
> }
> 
> void InbandTextTrackPrivateAVF::processCue(CFArrayRef attributedStrings, CFArrayRef nativeSamples, const MediaTime& time)
>@@ -530,7 +534,10 @@ void InbandTextTrackPrivateAVF::processNativeSamples(CFArrayRef nativeSamples, c
>             header.append("\n\n");
> 
>             DEBUG_LOG(LOGIDENTIFIER, "VTT header ", &header);
>-            client()->parseWebVTTFileHeader(header.toString());
>+            if (auto string = header.toString())
>+                client()->parseWebVTTFileHeader(WTFMove(*string));
>+            else
>+                CRASH();
>             m_haveReportedVTTHeader = true;
>         } while (0);
> 
>diff --git a/Source/WebCore/platform/graphics/ca/TileController.cpp b/Source/WebCore/platform/graphics/ca/TileController.cpp
>index ec3ae4f..a37d845 100644
>--- a/Source/WebCore/platform/graphics/ca/TileController.cpp
>+++ b/Source/WebCore/platform/graphics/ca/TileController.cpp
>@@ -735,7 +735,10 @@ RefPtr<PlatformCALayer> TileController::createTileLayer(const IntRect& tileRect,
>     nameBuilder.appendNumber(tileRect.location().x());
>     nameBuilder.append(',');
>     nameBuilder.appendNumber(tileRect.location().y());
>-    layer->setName(nameBuilder.toString());
>+    if (auto string = nameBuilder.toString())
>+        layer->setName(*string);
>+    else
>+        CRASH();
> 
>     float temporaryScaleFactor = owningGraphicsLayer()->platformCALayerContentsScaleMultiplierForNewTiles(m_tileCacheLayer);
>     m_hasTilesWithTemporaryScaleFactor |= temporaryScaleFactor != 1;
>diff --git a/Source/WebCore/platform/graphics/ca/TileGrid.cpp b/Source/WebCore/platform/graphics/ca/TileGrid.cpp
>index 5919f97..e866597 100644
>--- a/Source/WebCore/platform/graphics/ca/TileGrid.cpp
>+++ b/Source/WebCore/platform/graphics/ca/TileGrid.cpp
>@@ -59,7 +59,9 @@ static String validationPolicyAsString(TileGrid::TileValidationPolicy validation
>     }
>     builder.appendLiteral("]");
> 
>-    return builder.toString();
>+    if (auto string = builder.toString())
>+        return *string;
>+    CRASH();
> }
> #endif
> 
>diff --git a/Source/WebCore/platform/graphics/ca/win/PlatformCALayerWin.cpp b/Source/WebCore/platform/graphics/ca/win/PlatformCALayerWin.cpp
>index c000b43..fa640fa 100644
>--- a/Source/WebCore/platform/graphics/ca/win/PlatformCALayerWin.cpp
>+++ b/Source/WebCore/platform/graphics/ca/win/PlatformCALayerWin.cpp
>@@ -934,7 +934,9 @@ String PlatformCALayerWin::layerTreeAsString() const
>     // Print layer tree from the root
>     printLayer(builder, this, 0);
> 
>-    return builder.toString();
>+    if (auto string = builder.toString())
>+        return *string;
>+    CRASH();
> }
> 
> Ref<PlatformCALayer> PlatformCALayerWin::createCompatibleLayer(PlatformCALayer::LayerType layerType, PlatformCALayerClient* client) const
>diff --git a/Source/WebCore/platform/graphics/cv/VideoTextureCopierCV.cpp b/Source/WebCore/platform/graphics/cv/VideoTextureCopierCV.cpp
>index dffcdcb..47f3232 100644
>--- a/Source/WebCore/platform/graphics/cv/VideoTextureCopierCV.cpp
>+++ b/Source/WebCore/platform/graphics/cv/VideoTextureCopierCV.cpp
>@@ -512,7 +512,10 @@ bool VideoTextureCopierCV::initializeContextObjects()
>     vertexShaderSource.appendLiteral("}\n");
> 
>     Platform3DObject vertexShader = m_context->createShader(GraphicsContext3D::VERTEX_SHADER);
>-    m_context->shaderSource(vertexShader, vertexShaderSource.toString());
>+    if (auto string = vertexShaderSource.toString())
>+        m_context->shaderSource(vertexShader, *string);
>+    else
>+        CRASH();
>     m_context->compileShaderDirect(vertexShader);
> 
>     GC3Dint value = 0;
>@@ -553,7 +556,10 @@ bool VideoTextureCopierCV::initializeContextObjects()
>     fragmentShaderSource.appendLiteral("}\n");
> 
>     Platform3DObject fragmentShader = m_context->createShader(GraphicsContext3D::FRAGMENT_SHADER);
>-    m_context->shaderSource(fragmentShader, fragmentShaderSource.toString());
>+    if (auto string = fragmentShaderSource.toString())
>+        m_context->shaderSource(fragmentShader, *string);
>+    else
>+        CRASH();
>     m_context->compileShaderDirect(fragmentShader);
> 
>     m_context->getShaderiv(fragmentShader, GraphicsContext3D::COMPILE_STATUS, &value);
>diff --git a/Source/WebCore/platform/graphics/opengl/GraphicsContext3DOpenGLCommon.cpp b/Source/WebCore/platform/graphics/opengl/GraphicsContext3DOpenGLCommon.cpp
>index 5bdd663..025eccb 100644
>--- a/Source/WebCore/platform/graphics/opengl/GraphicsContext3DOpenGLCommon.cpp
>+++ b/Source/WebCore/platform/graphics/opengl/GraphicsContext3DOpenGLCommon.cpp
>@@ -953,7 +953,9 @@ static String generateHashedName(const String& name)
>     StringBuilder builder;
>     builder.appendLiteral("webgl_");
>     appendUnsigned64AsHex(number, builder, Lowercase);
>-    return builder.toString();
>+    if (auto string = builder.toString())
>+        return *string;
>+    CRASH();
> }
> 
> std::optional<String> GraphicsContext3D::mappedSymbolInShaderSourceMap(Platform3DObject shader, ANGLEShaderSymbolType symbolType, const String& name)
>@@ -1685,8 +1687,11 @@ String GraphicsContext3D::getUnmangledInfoLog(Platform3DObject shaders[2], GC3Ds
> 
>     processedLog.append(log.substring(startFrom, log.length() - startFrom));
> 
>-    LOG(WebGL, "Unmangled ShaderInfoLog:\n%s", processedLog.toString().utf8().data());
>-    return processedLog.toString();
>+    if (auto string = processedLog.toString()) {
>+        LOG(WebGL, "Unmangled ShaderInfoLog:\n%s", string->utf8().data());
>+        return *string;
>+    }
>+    CRASH();
> }
> 
> String GraphicsContext3D::getProgramInfoLog(Platform3DObject program)
>diff --git a/Source/WebCore/platform/graphics/texmap/TextureMapperShaderProgram.cpp b/Source/WebCore/platform/graphics/texmap/TextureMapperShaderProgram.cpp
>index 2e6c52c..24a88f0 100644
>--- a/Source/WebCore/platform/graphics/texmap/TextureMapperShaderProgram.cpp
>+++ b/Source/WebCore/platform/graphics/texmap/TextureMapperShaderProgram.cpp
>@@ -397,7 +397,10 @@ Ref<TextureMapperShaderProgram> TextureMapperShaderProgram::create(TextureMapper
> #endif
> 
>     // Append the options.
>-    vertexShaderBuilder.append(optionsApplierBuilder.toString());
>+    if (auto string = optionsApplierBuilder.toString())
>+        vertexShaderBuilder.append(*string);
>+    else
>+        CRASH();
> 
>     // Append the appropriate input/output variable definitions.
> #if USE(OPENGL_ES)
>@@ -421,7 +424,10 @@ Ref<TextureMapperShaderProgram> TextureMapperShaderProgram::create(TextureMapper
> #endif
> 
>     // Append the options.
>-    fragmentShaderBuilder.append(optionsApplierBuilder.toString());
>+    if (auto string = optionsApplierBuilder.toString())
>+        fragmentShaderBuilder.append(*string);
>+    else
>+        CRASH();
> 
>     // Append the common header.
>     fragmentShaderBuilder.append(fragmentTemplateHeaderCommon);
>@@ -439,7 +445,10 @@ Ref<TextureMapperShaderProgram> TextureMapperShaderProgram::create(TextureMapper
>     // Append the common code.
>     fragmentShaderBuilder.append(fragmentTemplateCommon);
> 
>-    return adoptRef(*new TextureMapperShaderProgram(vertexShaderBuilder.toString(), fragmentShaderBuilder.toString()));
>+    if (auto vertexString = vertexShaderBuilder.toString())
>+        if (auto fragmentString = fragmentShaderBuilder.toString())
>+            return adoptRef(*new TextureMapperShaderProgram(*vertexString, *fragmentString));
>+    CRASH();
> }
> 
> #if !LOG_DISABLED
>diff --git a/Source/WebCore/platform/gtk/SelectionData.cpp b/Source/WebCore/platform/gtk/SelectionData.cpp
>index 1e2799b..ffc7e1b 100644
>--- a/Source/WebCore/platform/gtk/SelectionData.cpp
>+++ b/Source/WebCore/platform/gtk/SelectionData.cpp
>@@ -96,7 +96,10 @@ void SelectionData::setURL(const URL& url, const String& label)
>     GUniquePtr<gchar> escaped(g_markup_escape_text(actualLabel.utf8().data(), -1));
>     markup.append(String::fromUTF8(escaped.get()));
>     markup.append("</a>");
>-    setMarkup(markup.toString());
>+    if (auto string = markup.toString())
>+        setMarkup(*string);
>+    else
>+        CRASH();
> }
> 
> const String& SelectionData::urlLabel() const
>diff --git a/Source/WebCore/platform/mac/PasteboardMac.mm b/Source/WebCore/platform/mac/PasteboardMac.mm
>index 3658dd1..a12cb30 100644
>--- a/Source/WebCore/platform/mac/PasteboardMac.mm
>+++ b/Source/WebCore/platform/mac/PasteboardMac.mm
>@@ -288,7 +288,9 @@ static String joinPathnames(const Vector<String>& pathnames)
>             builder.append('\n');
>         builder.append(path);
>     }
>-    return builder.toString();
>+    if (auto string = builder.toString())
>+        return *string;
>+    CRASH();
> }
> 
> void Pasteboard::read(PasteboardPlainText& text)
>diff --git a/Source/WebCore/platform/mac/StringUtilities.mm b/Source/WebCore/platform/mac/StringUtilities.mm
>index 7cd1bd8..9f38fb8 100644
>--- a/Source/WebCore/platform/mac/StringUtilities.mm
>+++ b/Source/WebCore/platform/mac/StringUtilities.mm
>@@ -50,8 +50,10 @@ static String wildcardRegexPatternString(const String& string)
>         stringBuilder.append(character);
>     }
>     stringBuilder.append('$');
>-        
>-    return stringBuilder.toString();
>+
>+    if (auto string = stringBuilder.toString())
>+        return *string;
>+    CRASH();
> }
>     
> bool stringMatchesWildcardString(const String& string, const String& wildcardString)
>diff --git a/Source/WebCore/platform/mock/ScrollAnimatorMock.cpp b/Source/WebCore/platform/mock/ScrollAnimatorMock.cpp
>index 3cc0fe9..31bd3d8 100644
>--- a/Source/WebCore/platform/mock/ScrollAnimatorMock.cpp
>+++ b/Source/WebCore/platform/mock/ScrollAnimatorMock.cpp
>@@ -101,7 +101,10 @@ void ScrollAnimatorMock::mouseEnteredScrollbar(Scrollbar* scrollbar) const
>     else
>         message.appendLiteral("Unknown");
>     message.appendLiteral("Scrollbar");
>-    m_logger(message.toString());
>+    if (auto string = message.toString())
>+        m_logger(*string);
>+    else
>+        CRASH();
>     ScrollAnimator::mouseEnteredScrollbar(scrollbar);
> }
> 
>@@ -116,7 +119,10 @@ void ScrollAnimatorMock::mouseExitedScrollbar(Scrollbar* scrollbar) const
>     else
>         message.appendLiteral("Unknown");
>     message.appendLiteral("Scrollbar");
>-    m_logger(message.toString());
>+    if (auto string = message.toString())
>+        m_logger(*string);
>+    else
>+        CRASH();
>     ScrollAnimator::mouseExitedScrollbar(scrollbar);
> }
> 
>@@ -136,7 +142,10 @@ void ScrollAnimatorMock::mouseIsDownInScrollbar(Scrollbar* scrollbar, bool isPre
>     else
>         message.appendLiteral("Unknown");
>     message.appendLiteral("Scrollbar");
>-    m_logger(message.toString());
>+    if (auto string = message.toString())
>+        m_logger(*string);
>+    else
>+        CRASH();
>     ScrollAnimator::mouseIsDownInScrollbar(scrollbar, isPressed);
> }
> 
>diff --git a/Source/WebCore/platform/mock/mediasource/MockBox.cpp b/Source/WebCore/platform/mock/mediasource/MockBox.cpp
>index d4aa205..fb65a9e 100644
>--- a/Source/WebCore/platform/mock/mediasource/MockBox.cpp
>+++ b/Source/WebCore/platform/mock/mediasource/MockBox.cpp
>@@ -52,7 +52,9 @@ String MockBox::peekType(ArrayBuffer* data)
>     RefPtr<Int8Array> array = JSC::Int8Array::create(data, 0, 4);
>     for (int i = 0; i < 4; ++i)
>         builder.append(array->item(i));
>-    return builder.toString();
>+    if (auto string = builder.toString())
>+        return *string;
>+    CRASH();
> }
> 
> size_t MockBox::peekLength(ArrayBuffer* data)
>@@ -73,7 +75,10 @@ MockTrackBox::MockTrackBox(ArrayBuffer* data)
>     RefPtr<Int8Array> array = JSC::Int8Array::create(data, 12, 4);
>     for (int i = 0; i < 4; ++i)
>         builder.append(array->item(i));
>-    m_codec = builder.toString();
>+    if (auto string = builder.toString())
>+        m_codec = *string;
>+    else
>+        CRASH();
> 
>     m_kind = static_cast<TrackKind>(view->get<uint8_t>(16, true));
> }
>diff --git a/Source/WebCore/platform/network/HTTPParsers.cpp b/Source/WebCore/platform/network/HTTPParsers.cpp
>index c8f45e5..8d30d87 100644
>--- a/Source/WebCore/platform/network/HTTPParsers.cpp
>+++ b/Source/WebCore/platform/network/HTTPParsers.cpp
>@@ -328,7 +328,9 @@ String extractMIMETypeFromMediaType(const String& mediaType)
> 
>     if (mimeType.length() == length)
>         return mediaType;
>-    return mimeType.toString();
>+    if (auto string = mimeType.toString())
>+        return *string;
>+    CRASH();
> }
> 
> String extractCharsetFromMediaType(const String& mediaType)
>diff --git a/Source/WebCore/platform/network/MIMEHeader.cpp b/Source/WebCore/platform/network/MIMEHeader.cpp
>index 251693e..776709d 100644
>--- a/Source/WebCore/platform/network/MIMEHeader.cpp
>+++ b/Source/WebCore/platform/network/MIMEHeader.cpp
>@@ -63,7 +63,10 @@ static KeyValueMap retrieveKeyValuePairs(WebCore::SharedBufferChunkReader& buffe
>         if (!key.isEmpty()) {
>             if (keyValuePairs.find(key) != keyValuePairs.end())
>                 LOG_ERROR("Key duplicate found in MIME header. Key is '%s', previous value replaced.", key.ascii().data());
>-            keyValuePairs.add(key, value.toString().stripWhiteSpace());
>+            if (auto string = value.toString())
>+                keyValuePairs.add(key, string->stripWhiteSpace());
>+            else
>+                CRASH();
>             key = String();
>             value.clear();
>         }
>@@ -76,8 +79,12 @@ static KeyValueMap retrieveKeyValuePairs(WebCore::SharedBufferChunkReader& buffe
>         value.append(line.substring(semiColonIndex + 1));
>     }
>     // Store the last property if there is one.
>-    if (!key.isEmpty())
>-        keyValuePairs.set(key, value.toString().stripWhiteSpace());
>+    if (!key.isEmpty()) {
>+        if (auto string = value.toString())
>+            keyValuePairs.set(key, string->stripWhiteSpace());
>+        else
>+            CRASH();
>+    }
>     return keyValuePairs;
> }
> 
>diff --git a/Source/WebCore/platform/network/ProxyServer.cpp b/Source/WebCore/platform/network/ProxyServer.cpp
>index c6d67c2..0c69f4d 100644
>--- a/Source/WebCore/platform/network/ProxyServer.cpp
>+++ b/Source/WebCore/platform/network/ProxyServer.cpp
>@@ -68,7 +68,9 @@ String toString(const Vector<ProxyServer>& proxyServers)
>         appendProxyServerString(stringBuilder, proxyServers[i]);
>     }
> 
>-    return stringBuilder.toString();
>+    if (auto string = stringBuilder.toString())
>+        return *string;
>+    CRASH();
> }
> 
> 
>diff --git a/Source/WebCore/platform/network/curl/CookieJarCurlDatabase.cpp b/Source/WebCore/platform/network/curl/CookieJarCurlDatabase.cpp
>index 672b251..a4e74b1 100644
>--- a/Source/WebCore/platform/network/curl/CookieJarCurlDatabase.cpp
>+++ b/Source/WebCore/platform/network/curl/CookieJarCurlDatabase.cpp
>@@ -57,7 +57,9 @@ static String cookiesForSession(const NetworkStorageSession& session, const URL&
>             cookies.append(result.value);
>         }
>     }
>-    return cookies.toString();
>+    if (auto string = cookies.toString())
>+        return *string;
>+    CRASH();
> }
> 
> void CookieJarCurlDatabase::setCookiesFromDOM(const NetworkStorageSession& session, const URL& firstParty, const SameSiteInfo&, const URL& url, std::optional<uint64_t> frameID, std::optional<uint64_t> pageID, const String& value) const
>diff --git a/Source/WebCore/platform/network/mac/CookieJarMac.mm b/Source/WebCore/platform/network/mac/CookieJarMac.mm
>index c2640bd..0005dfa 100644
>--- a/Source/WebCore/platform/network/mac/CookieJarMac.mm
>+++ b/Source/WebCore/platform/network/mac/CookieJarMac.mm
>@@ -261,7 +261,10 @@ static std::pair<String, bool> cookiesForSession(const NetworkStorageSession& se
>         cookiesBuilder.append('=');
>         cookiesBuilder.append([cookie value]);
>     }
>-    return { cookiesBuilder.toString(), didAccessSecureCookies };
>+
>+    if (auto string = cookiesBuilder.toString())
>+        return { *string, didAccessSecureCookies };
>+    CRASH();
> 
>     END_BLOCK_OBJC_EXCEPTIONS;
>     return { String(), false };
>diff --git a/Source/WebCore/platform/posix/FileSystemPOSIX.cpp b/Source/WebCore/platform/posix/FileSystemPOSIX.cpp
>index 4da7cf6..389d2dc 100644
>--- a/Source/WebCore/platform/posix/FileSystemPOSIX.cpp
>+++ b/Source/WebCore/platform/posix/FileSystemPOSIX.cpp
>@@ -310,7 +310,9 @@ String pathByAppendingComponents(StringView path, const Vector<StringView>& comp
>         builder.append('/');
>         builder.append(component);
>     }
>-    return builder.toString();
>+    if (auto string = builder.toString())
>+        return *string;
>+    CRASH();
> }
> 
> bool makeAllDirectories(const String& path)
>diff --git a/Source/WebCore/platform/text/DateTimeFormat.cpp b/Source/WebCore/platform/text/DateTimeFormat.cpp
>index c75d33d..a1efc2c 100644
>--- a/Source/WebCore/platform/text/DateTimeFormat.cpp
>+++ b/Source/WebCore/platform/text/DateTimeFormat.cpp
>@@ -145,7 +145,10 @@ bool DateTimeFormat::parse(const String& source, TokenHandler& tokenHandler)
>             }
> 
>             if (literalBuffer.length()) {
>-                tokenHandler.visitLiteral(literalBuffer.toString());
>+                if (auto string = literalBuffer.toString())
>+                    tokenHandler.visitLiteral(*string);
>+                else
>+                    CRASH();
>                 literalBuffer.clear();
>             }
> 
>@@ -169,7 +172,10 @@ bool DateTimeFormat::parse(const String& source, TokenHandler& tokenHandler)
>             }
> 
>             if (literalBuffer.length()) {
>-                tokenHandler.visitLiteral(literalBuffer.toString());
>+                if (auto string = literalBuffer.toString())
>+                    tokenHandler.visitLiteral(*string);
>+                else
>+                    CRASH();
>                 literalBuffer.clear();
>             }
> 
>@@ -220,14 +226,22 @@ bool DateTimeFormat::parse(const String& source, TokenHandler& tokenHandler)
>     switch (state) {
>     case StateLiteral:
>     case StateInQuoteQuote:
>-        if (literalBuffer.length())
>-            tokenHandler.visitLiteral(literalBuffer.toString());
>+        if (literalBuffer.length()) {
>+            if (auto string = literalBuffer.toString())
>+                tokenHandler.visitLiteral(*string);
>+            else
>+                CRASH();
>+        }
>         return true;
> 
>     case StateQuote:
>     case StateInQuote:
>-        if (literalBuffer.length())
>-            tokenHandler.visitLiteral(literalBuffer.toString());
>+        if (literalBuffer.length()) {
>+            if (auto string = literalBuffer.toString())
>+                tokenHandler.visitLiteral(*string);
>+            else
>+                CRASH();
>+        }
>         return false;
> 
>     case StateSymbol:
>diff --git a/Source/WebCore/platform/text/DecodeEscapeSequences.h b/Source/WebCore/platform/text/DecodeEscapeSequences.h
>index 14cf415..72a0a5a 100644
>--- a/Source/WebCore/platform/text/DecodeEscapeSequences.h
>+++ b/Source/WebCore/platform/text/DecodeEscapeSequences.h
>@@ -64,7 +64,9 @@ struct Unicode16BitEscapeSequence {
>             builder.append(codeUnit);
>             run = run.substring(sequenceSize);
>         }
>-        return builder.toString();
>+        if (auto string = builder.toString())
>+            return *string;
>+        CRASH();
>     }
> };
> 
>@@ -151,7 +153,9 @@ String decodeEscapeSequences(StringView string, const TextEncoding& encoding)
>         decodedPosition = encodedRunEnd;
>     }
>     result.append(string.substring(decodedPosition, length - decodedPosition));
>-    return result.toString();
>+    if (auto string = result.toString())
>+        return *string;
>+    CRASH();
> }
> 
> inline Vector<uint8_t> decodeURLEscapeSequencesAsData(StringView string, const TextEncoding& encoding)
>diff --git a/Source/WebCore/platform/text/PlatformLocale.cpp b/Source/WebCore/platform/text/PlatformLocale.cpp
>index 0874325..a9e58e7 100644
>--- a/Source/WebCore/platform/text/PlatformLocale.cpp
>+++ b/Source/WebCore/platform/text/PlatformLocale.cpp
>@@ -83,7 +83,9 @@ String DateTimeStringBuilder::zeroPadString(const String& string, size_t width)
>     for (size_t i = string.length(); i < width; ++i)
>         zeroPaddedStringBuilder.append('0');
>     zeroPaddedStringBuilder.append(string);
>-    return zeroPaddedStringBuilder.toString();
>+    if (auto string = zeroPaddedStringBuilder.toString())
>+        return *string;
>+    CRASH();
> }
> 
> void DateTimeStringBuilder::appendNumber(int number, size_t width)
>@@ -175,7 +177,9 @@ void DateTimeStringBuilder::visitLiteral(const String& text)
> 
> String DateTimeStringBuilder::toString()
> {
>-    return m_builder.toString();
>+    if (auto string = m_builder.toString())
>+        return *string;
>+    CRASH();
> }
> 
> #endif
>@@ -238,7 +242,9 @@ String Locale::convertToLocalizedNumber(const String& input)
> 
>     builder.append(isNegative ? m_negativeSuffix : m_positiveSuffix);
> 
>-    return builder.toString();
>+    if (auto string = builder.toString())
>+        return *string;
>+    CRASH();
> }
> 
> static bool matches(const String& text, unsigned position, const String& part)
>@@ -321,7 +327,9 @@ String Locale::convertFromLocalizedNumber(const String& localized)
>         else
>             builder.append(static_cast<UChar>('0' + symbolIndex));
>     }
>-    return builder.toString();
>+    if (auto string = builder.toString())
>+        return *string;
>+    CRASH();
> }
> 
> #if ENABLE(DATE_AND_TIME_INPUT_TYPES)
>@@ -360,7 +368,9 @@ String Locale::formatDateTime(const DateComponents& date, FormatType formatType)
>         ASSERT_NOT_REACHED();
>         break;
>     }
>-    return builder.toString();
>+    if (auto string = builder.toString())
>+        return *string;
>+    CRASH();
> }
> #endif // !PLATFORM(IOS)
> 
>diff --git a/Source/WebCore/platform/text/SegmentedString.cpp b/Source/WebCore/platform/text/SegmentedString.cpp
>index ff31b2a..48cba0e 100644
>--- a/Source/WebCore/platform/text/SegmentedString.cpp
>+++ b/Source/WebCore/platform/text/SegmentedString.cpp
>@@ -159,7 +159,9 @@ String SegmentedString::toString() const
>     m_currentSubstring.appendTo(result);
>     for (auto& substring : m_otherSubstrings)
>         substring.appendTo(result);
>-    return result.toString();
>+    if (auto string = result.toString())
>+        return *string;
>+    CRASH();
> }
> 
> void SegmentedString::advanceWithoutUpdatingLineNumber16()
>diff --git a/Source/WebCore/platform/text/TextCodecICU.cpp b/Source/WebCore/platform/text/TextCodecICU.cpp
>index d2e2ae7..7622cb1 100644
>--- a/Source/WebCore/platform/text/TextCodecICU.cpp
>+++ b/Source/WebCore/platform/text/TextCodecICU.cpp
>@@ -318,13 +318,14 @@ String TextCodecICU::decode(const char* bytes, size_t length, bool flush, bool s
>         sawError = true;
>     }
> 
>-    String resultString = result.toString();
>+    if (auto resultString = result.toString()) {
>+        // Simplified Chinese pages use the code A3A0 to mean "full-width space", but ICU decodes it as U+E5E5.
>+        if (!strcmp(m_encodingName, "GBK") || equalLettersIgnoringASCIICase(m_encodingName, "gb18030"))
>+            resultString->replace(0xE5E5, ideographicSpace);
> 
>-    // Simplified Chinese pages use the code A3A0 to mean "full-width space", but ICU decodes it as U+E5E5.
>-    if (!strcmp(m_encodingName, "GBK") || equalLettersIgnoringASCIICase(m_encodingName, "gb18030"))
>-        resultString.replace(0xE5E5, ideographicSpace);
>-
>-    return resultString;
>+        return *resultString;
>+    }
>+    CRASH();
> }
> 
> // We need to apply these fallbacks ourselves as they are not currently supported by ICU and
>diff --git a/Source/WebCore/platform/text/TextCodecUserDefined.cpp b/Source/WebCore/platform/text/TextCodecUserDefined.cpp
>index 296c469..cb70e49 100644
>--- a/Source/WebCore/platform/text/TextCodecUserDefined.cpp
>+++ b/Source/WebCore/platform/text/TextCodecUserDefined.cpp
>@@ -53,7 +53,9 @@ String TextCodecUserDefined::decode(const char* bytes, size_t length, bool, bool
>         signed char c = bytes[i];
>         result.append(static_cast<UChar>(c & 0xF7FF));
>     }
>-    return result.toString();
>+    if (auto string = result.toString())
>+        return *string;
>+    CRASH();
> }
> 
> static Vector<uint8_t> encodeComplexUserDefined(StringView string, UnencodableHandling handling)
>diff --git a/Source/WebCore/platform/vr/openvr/VRPlatformDisplayOpenVR.cpp b/Source/WebCore/platform/vr/openvr/VRPlatformDisplayOpenVR.cpp
>index dd6288e..169ecb1 100644
>--- a/Source/WebCore/platform/vr/openvr/VRPlatformDisplayOpenVR.cpp
>+++ b/Source/WebCore/platform/vr/openvr/VRPlatformDisplayOpenVR.cpp
>@@ -45,7 +45,10 @@ VRPlatformDisplayOpenVR::VRPlatformDisplayOpenVR(vr::IVRSystem* system, vr::IVRC
>         stringBuilder.append(HMDName, length);
>         stringBuilder.append(')');
>     }
>-    m_displayInfo.setDisplayName(stringBuilder.toString());
>+    if (auto string = stringBuilder.toString())
>+        m_displayInfo.setDisplayName(WTFMove(*string));
>+    else
>+        CRASH();
>     m_displayInfo.setIsMounted(false);
>     // FIXME: We're assuming an HTC Vive HMD here. Get this info from OpenVR?.
>     m_displayInfo.setCapabilityFlags(VRDisplayCapabilityFlagNone | VRDisplayCapabilityFlagPosition | VRDisplayCapabilityFlagOrientation | VRDisplayCapabilityFlagExternalDisplay | VRDisplayCapabilityFlagPresent);
>diff --git a/Source/WebCore/platform/win/ClipboardUtilitiesWin.cpp b/Source/WebCore/platform/win/ClipboardUtilitiesWin.cpp
>index 6ff89ec..2bc6d5f 100644
>--- a/Source/WebCore/platform/win/ClipboardUtilitiesWin.cpp
>+++ b/Source/WebCore/platform/win/ClipboardUtilitiesWin.cpp
>@@ -314,7 +314,10 @@ void replaceNewlinesWithWindowsStyleNewlines(String& str)
>         else
>             result.appendLiteral("\r\n");
>     }
>-    str = result.toString();
>+    if (auto string = result.toString())
>+        str = *string;
>+    else
>+        CRASH();
> }
> 
> void replaceNBSPWithSpace(String& str)
>diff --git a/Source/WebCore/platform/win/UserAgentWin.cpp b/Source/WebCore/platform/win/UserAgentWin.cpp
>index 8201f4e..d3d694d 100644
>--- a/Source/WebCore/platform/win/UserAgentWin.cpp
>+++ b/Source/WebCore/platform/win/UserAgentWin.cpp
>@@ -46,7 +46,9 @@ String standardUserAgent(const String& applicationName, const String& applicatio
>             uaString.append(applicationVersion);
>         }
>     }
>-    return uaString.toString();
>+    if (auto string = uaString.toString())
>+        return *string;
>+    CRASH();
> }
> 
> String standardUserAgentForURL(const URL& url)
>diff --git a/Source/WebCore/platform/wpe/RenderThemeWPE.cpp b/Source/WebCore/platform/wpe/RenderThemeWPE.cpp
>index e5d8027..6691be1 100644
>--- a/Source/WebCore/platform/wpe/RenderThemeWPE.cpp
>+++ b/Source/WebCore/platform/wpe/RenderThemeWPE.cpp
>@@ -60,7 +60,9 @@ String RenderThemeWPE::mediaControlsScript()
>     StringBuilder scriptBuilder;
>     scriptBuilder.append(mediaControlsLocalizedStringsJavaScript, sizeof(mediaControlsLocalizedStringsJavaScript));
>     scriptBuilder.append(mediaControlsBaseJavaScript, sizeof(mediaControlsBaseJavaScript));
>-    return scriptBuilder.toString();
>+    if (auto string = scriptBuilder.toString())
>+        return *string;
>+    CRASH();
> }
> #endif
> } // namespace WebCore
>diff --git a/Source/WebCore/plugins/DOMMimeType.cpp b/Source/WebCore/plugins/DOMMimeType.cpp
>index 1b2d752..2fe5862 100644
>--- a/Source/WebCore/plugins/DOMMimeType.cpp
>+++ b/Source/WebCore/plugins/DOMMimeType.cpp
>@@ -57,7 +57,9 @@ String DOMMimeType::suffixes() const
>             builder.append(',');
>         builder.append(extensions[i]);
>     }
>-    return builder.toString();
>+    if (auto string = builder.toString())
>+        return *string;
>+    CRASH();
> }
> 
> String DOMMimeType::description() const
>diff --git a/Source/WebCore/rendering/RenderLayer.cpp b/Source/WebCore/rendering/RenderLayer.cpp
>index fa0e57a..ba9cd62 100644
>--- a/Source/WebCore/rendering/RenderLayer.cpp
>+++ b/Source/WebCore/rendering/RenderLayer.cpp
>@@ -428,7 +428,9 @@ String RenderLayer::name() const
>     if (isReflection())
>         name.appendLiteral(" (reflection)");
> 
>-    return name.toString();
>+    if (auto string = name.toString())
>+        return *string;
>+    CRASH();
> }
> 
> RenderLayerCompositor& RenderLayer::compositor() const
>diff --git a/Source/WebCore/rendering/RenderLayerCompositor.cpp b/Source/WebCore/rendering/RenderLayerCompositor.cpp
>index 0e90888..c79b679 100644
>--- a/Source/WebCore/rendering/RenderLayerCompositor.cpp
>+++ b/Source/WebCore/rendering/RenderLayerCompositor.cpp
>@@ -863,7 +863,10 @@ void RenderLayerCompositor::logLayerInfo(const RenderLayer& layer, int depth)
> 
>     logString.append(layer.name());
> 
>-    LOG(Compositing, "%s", logString.toString().utf8().data());
>+    if (auto string = logString.toString())
>+        LOG(Compositing, "%s", string->utf8().data());
>+    else
>+        CRASH();
> }
> #endif
> 
>diff --git a/Source/WebCore/rendering/RenderListMarker.cpp b/Source/WebCore/rendering/RenderListMarker.cpp
>index 6496978..e48a29e 100644
>--- a/Source/WebCore/rendering/RenderListMarker.cpp
>+++ b/Source/WebCore/rendering/RenderListMarker.cpp
>@@ -1117,7 +1117,9 @@ String listMarkerText(EListStyleType type, int value)
>             break;
>     }
> 
>-    return builder.toString();
>+    if (auto string = builder.toString())
>+        return *string;
>+    CRASH();
> }
> 
> RenderListMarker::RenderListMarker(RenderListItem& listItem, RenderStyle&& style)
>@@ -1363,7 +1365,10 @@ void RenderListMarker::paint(PaintInfo& paintInfo, const LayoutPoint& paintOffse
>                 buffer.append(suffix);
>                 buffer.append(space);
>             }
>-            toDraw = buffer.toString();
>+            if (auto string = buffer.toString())
>+                toDraw = *string;
>+            else
>+                CRASH();
>         } else {
>             if (style().isLeftToRightDirection())
>                 toDraw = m_text + String(&suffix, 1) + String(&space, 1);
>diff --git a/Source/WebCore/rendering/RenderText.cpp b/Source/WebCore/rendering/RenderText.cpp
>index 8fa51e2..10520fc 100644
>--- a/Source/WebCore/rendering/RenderText.cpp
>+++ b/Source/WebCore/rendering/RenderText.cpp
>@@ -181,7 +181,9 @@ String capitalize(const String& string, UChar previousCharacter)
>             result.append(stringImpl[i - 1]);
>     }
> 
>-    return result.toString();
>+    if (auto string = result.toString())
>+        return *string;
>+    CRASH();
> }
> 
> inline RenderText::RenderText(Node& node, const String& text)
>@@ -756,16 +758,19 @@ static float maxWordFragmentWidth(RenderText& renderer, const RenderStyle& style
>         fragmentWithHyphen.append(word.substring(suffixStart, fragmentLength));
>         fragmentWithHyphen.append(style.hyphenString());
> 
>-        TextRun run = RenderBlock::constructTextRun(fragmentWithHyphen.toString(), style);
>-        run.setCharacterScanForCodePath(!renderer.canUseSimpleFontCodePath());
>-        float fragmentWidth = font.width(run, &fallbackFonts, &glyphOverflow);
>+        if (auto string = fragmentWithHyphen.toString()) {
>+            TextRun run = RenderBlock::constructTextRun(*string, style);
>+            run.setCharacterScanForCodePath(!renderer.canUseSimpleFontCodePath());
>+            float fragmentWidth = font.width(run, &fallbackFonts, &glyphOverflow);
> 
>-        // Narrow prefixes are ignored. See tryHyphenating in RenderBlockLineLayout.cpp.
>-        if (fragmentWidth <= minimumFragmentWidthToConsider)
>-            continue;
>+            // Narrow prefixes are ignored. See tryHyphenating in RenderBlockLineLayout.cpp.
>+            if (fragmentWidth <= minimumFragmentWidthToConsider)
>+                continue;
> 
>-        suffixStart += fragmentLength;
>-        maxFragmentWidth = std::max(maxFragmentWidth, fragmentWidth);
>+            suffixStart += fragmentLength;
>+            maxFragmentWidth = std::max(maxFragmentWidth, fragmentWidth);
>+        } else
>+            CRASH();
>     }
> 
>     return maxFragmentWidth;
>diff --git a/Source/WebCore/rendering/RenderThemeGtk.cpp b/Source/WebCore/rendering/RenderThemeGtk.cpp
>index 0785910..567c407 100644
>--- a/Source/WebCore/rendering/RenderThemeGtk.cpp
>+++ b/Source/WebCore/rendering/RenderThemeGtk.cpp
>@@ -2026,7 +2026,9 @@ String RenderThemeGtk::mediaControlsScript()
>     scriptBuilder.append(mediaControlsLocalizedStringsJavaScript, sizeof(mediaControlsLocalizedStringsJavaScript));
>     scriptBuilder.append(mediaControlsBaseJavaScript, sizeof(mediaControlsBaseJavaScript));
>     scriptBuilder.append(mediaControlsGtkJavaScript, sizeof(mediaControlsGtkJavaScript));
>-    return scriptBuilder.toString();
>+    if (auto string = scriptBuilder.toString())
>+        return *string;
>+    CRASH();
> }
> #endif // ENABLE(VIDEO)
> 
>diff --git a/Source/WebCore/rendering/RenderThemeIOS.mm b/Source/WebCore/rendering/RenderThemeIOS.mm
>index 4fe83e0..2578f50 100644
>--- a/Source/WebCore/rendering/RenderThemeIOS.mm
>+++ b/Source/WebCore/rendering/RenderThemeIOS.mm
>@@ -1360,7 +1360,10 @@ String RenderThemeIOS::mediaControlsScript()
>             StringBuilder scriptBuilder;
>             scriptBuilder.append([NSString stringWithContentsOfFile:[bundle pathForResource:@"modern-media-controls-localized-strings" ofType:@"js"] encoding:NSUTF8StringEncoding error:nil]);
>             scriptBuilder.append([NSString stringWithContentsOfFile:[bundle pathForResource:@"modern-media-controls" ofType:@"js" inDirectory:@"modern-media-controls"] encoding:NSUTF8StringEncoding error:nil]);
>-            m_mediaControlsScript = scriptBuilder.toString();
>+            if (auto string = scriptBuilder.toString())
>+                m_mediaControlsScript = *string;
>+            else
>+                CRASH();
>         }
>         return m_mediaControlsScript;
>     }
>@@ -1373,7 +1376,10 @@ String RenderThemeIOS::mediaControlsScript()
>         scriptBuilder.append([NSString stringWithContentsOfFile:[bundle pathForResource:@"mediaControlsApple" ofType:@"js"] encoding:NSUTF8StringEncoding error:nil]);
>         scriptBuilder.append([NSString stringWithContentsOfFile:[bundle pathForResource:@"mediaControlsiOS" ofType:@"js"] encoding:NSUTF8StringEncoding error:nil]);
> 
>-        m_legacyMediaControlsScript = scriptBuilder.toString();
>+        if (auto string = scriptBuilder.toString())
>+            m_legacyMediaControlsScript = *string;
>+        else
>+            CRASH();
>     }
>     return m_legacyMediaControlsScript;
> #else
>diff --git a/Source/WebCore/rendering/RenderThemeWin.cpp b/Source/WebCore/rendering/RenderThemeWin.cpp
>index deea1a9..836d01c 100644
>--- a/Source/WebCore/rendering/RenderThemeWin.cpp
>+++ b/Source/WebCore/rendering/RenderThemeWin.cpp
>@@ -1094,7 +1094,10 @@ String RenderThemeWin::mediaControlsScript()
>         StringBuilder scriptBuilder;
>         scriptBuilder.append(stringWithContentsOfFile(CFSTR("mediaControlsLocalizedStrings"), CFSTR("js")));
>         scriptBuilder.append(stringWithContentsOfFile(CFSTR("mediaControlsApple"), CFSTR("js")));
>-        m_mediaControlsScript = scriptBuilder.toString();
>+        if (auto string = scriptBuilder.toString())
>+            m_mediaControlsScript = *string;
>+        else
>+            CRASH();
>     }
>     return m_mediaControlsScript;
> #else
>diff --git a/Source/WebCore/rendering/RenderTreeAsText.cpp b/Source/WebCore/rendering/RenderTreeAsText.cpp
>index 55cdb4b..85c78e4 100644
>--- a/Source/WebCore/rendering/RenderTreeAsText.cpp
>+++ b/Source/WebCore/rendering/RenderTreeAsText.cpp
>@@ -170,7 +170,9 @@ String quoteAndEscapeNonPrintables(StringView s)
>         }
>     }
>     result.append('"');
>-    return result.toString();
>+    if (auto string = result.toString())
>+        return *string;
>+    CRASH();
> }
> 
> void RenderTreeAsText::writeRenderObject(TextStream& ts, const RenderObject& o, RenderAsTextBehavior behavior)
>@@ -807,7 +809,9 @@ static String nodePosition(Node* node)
>             result.appendLiteral("document");
>     }
> 
>-    return result.toString();
>+    if (auto string = result.toString())
>+        return *string;
>+    CRASH();
> }
> 
> static void writeSelection(TextStream& ts, const RenderBox& renderer)
>diff --git a/Source/WebCore/rendering/mathml/RenderMathMLFenced.cpp b/Source/WebCore/rendering/mathml/RenderMathMLFenced.cpp
>index 89bb040..8c784e6 100644
>--- a/Source/WebCore/rendering/mathml/RenderMathMLFenced.cpp
>+++ b/Source/WebCore/rendering/mathml/RenderMathMLFenced.cpp
>@@ -71,7 +71,10 @@ void RenderMathMLFenced::updateFromElement()
>             if (!isSpaceOrNewline(separators[i]))
>                 characters.append(separators[i]);
>         }
>-        m_separators = !characters.length() ? 0 : characters.toString().impl();
>+        if (auto string = characters.toString())
>+            m_separators = !characters.length() ? 0 : string->impl();
>+        else
>+            CRASH();
>     } else {
>         // The separator defaults to a single comma.
>         m_separators = StringImpl::create(",");
>diff --git a/Source/WebCore/rendering/updating/RenderTreeBuilderMathML.cpp b/Source/WebCore/rendering/updating/RenderTreeBuilderMathML.cpp
>index 5cb478b..20d2514 100644
>--- a/Source/WebCore/rendering/updating/RenderTreeBuilderMathML.cpp
>+++ b/Source/WebCore/rendering/updating/RenderTreeBuilderMathML.cpp
>@@ -90,7 +90,10 @@ void RenderTreeBuilder::MathML::attach(RenderMathMLFenced& parent, RenderPtr<Ren
> 
>             StringBuilder stringBuilder;
>             stringBuilder.append(separator);
>-            separatorRenderer = createMathMLOperator(parent, stringBuilder.toString(), MathMLOperatorDictionary::Infix, MathMLOperatorDictionary::Separator);
>+            if (auto string = stringBuilder.toString())
>+                separatorRenderer = createMathMLOperator(parent, *string, MathMLOperatorDictionary::Infix, MathMLOperatorDictionary::Separator);
>+            else
>+                CRASH();
>         }
>     }
> 
>diff --git a/Source/WebCore/svg/SVGLengthListValues.cpp b/Source/WebCore/svg/SVGLengthListValues.cpp
>index ba20648..20ea3e1 100644
>--- a/Source/WebCore/svg/SVGLengthListValues.cpp
>+++ b/Source/WebCore/svg/SVGLengthListValues.cpp
>@@ -63,7 +63,9 @@ String SVGLengthListValues::valueAsString() const
>         builder.append(at(i).valueAsString());
>     }
> 
>-    return builder.toString();
>+    if (auto string = builder.toString())
>+        return *string;
>+    CRASH();
> }
> 
> }
>diff --git a/Source/WebCore/svg/SVGNumberListValues.cpp b/Source/WebCore/svg/SVGNumberListValues.cpp
>index 6dfd993..875be43 100644
>--- a/Source/WebCore/svg/SVGNumberListValues.cpp
>+++ b/Source/WebCore/svg/SVGNumberListValues.cpp
>@@ -55,7 +55,9 @@ String SVGNumberListValues::valueAsString() const
>         builder.appendNumber(at(i));
>     }
> 
>-    return builder.toString();
>+    if (auto string = builder.toString())
>+        return *string;
>+    CRASH();
> }
> 
> }
>diff --git a/Source/WebCore/svg/SVGPathStringBuilder.cpp b/Source/WebCore/svg/SVGPathStringBuilder.cpp
>index 105391c..9c577ec 100644
>--- a/Source/WebCore/svg/SVGPathStringBuilder.cpp
>+++ b/Source/WebCore/svg/SVGPathStringBuilder.cpp
>@@ -37,7 +37,9 @@ String SVGPathStringBuilder::result()
> 
>     // Remove trailing space.
>     m_stringBuilder.resize(size - 1);
>-    return m_stringBuilder.toString();
>+    if (auto string = m_stringBuilder.toString())
>+        return *string;
>+    CRASH();
> }
> 
> void SVGPathStringBuilder::incrementPathSegmentCount()
>diff --git a/Source/WebCore/svg/SVGPathUtilities.cpp b/Source/WebCore/svg/SVGPathUtilities.cpp
>index cf9f014..cc54307 100644
>--- a/Source/WebCore/svg/SVGPathUtilities.cpp
>+++ b/Source/WebCore/svg/SVGPathUtilities.cpp
>@@ -101,7 +101,9 @@ String buildStringFromPath(const Path& path)
>         });
>     }
> 
>-    return builder.toString();
>+    if (auto string = builder.toString())
>+        return *string;
>+    CRASH();
> }
> 
> bool buildSVGPathByteStreamFromSVGPathSegListValues(const SVGPathSegListValues& list, SVGPathByteStream& result, PathParsingMode parsingMode)
>diff --git a/Source/WebCore/svg/SVGPointListValues.cpp b/Source/WebCore/svg/SVGPointListValues.cpp
>index d81e6a2..d8bdee5 100644
>--- a/Source/WebCore/svg/SVGPointListValues.cpp
>+++ b/Source/WebCore/svg/SVGPointListValues.cpp
>@@ -41,7 +41,9 @@ String SVGPointListValues::valueAsString() const
>         builder.appendNumber(point.y());
>     }
> 
>-    return builder.toString();
>+    if (auto string = builder.toString())
>+        return *string;
>+    CRASH();
> }
> 
> }
>diff --git a/Source/WebCore/svg/SVGStringListValues.cpp b/Source/WebCore/svg/SVGStringListValues.cpp
>index 3ff898a..8c61f17 100644
>--- a/Source/WebCore/svg/SVGStringListValues.cpp
>+++ b/Source/WebCore/svg/SVGStringListValues.cpp
>@@ -73,7 +73,9 @@ String SVGStringListValues::valueAsString() const
>         builder.append(at(i));
>     }
> 
>-    return builder.toString();
>+    if (auto string = builder.toString())
>+        return *string;
>+    CRASH();
> }
> 
> }
>diff --git a/Source/WebCore/svg/SVGTransformListValues.cpp b/Source/WebCore/svg/SVGTransformListValues.cpp
>index 25b3c31..6b42d3b 100644
>--- a/Source/WebCore/svg/SVGTransformListValues.cpp
>+++ b/Source/WebCore/svg/SVGTransformListValues.cpp
>@@ -68,7 +68,9 @@ String SVGTransformListValues::valueAsString() const
>         builder.append(at(i).valueAsString());
>     }
> 
>-    return builder.toString();
>+    if (auto string = builder.toString())
>+        return *string;
>+    CRASH();
> }
> 
> void SVGTransformListValues::parse(const String& transform)
>diff --git a/Source/WebCore/svg/SVGTransformValue.cpp b/Source/WebCore/svg/SVGTransformValue.cpp
>index 63d45a5..ea1463d 100644
>--- a/Source/WebCore/svg/SVGTransformValue.cpp
>+++ b/Source/WebCore/svg/SVGTransformValue.cpp
>@@ -179,7 +179,9 @@ String SVGTransformValue::valueAsString() const
>         builder.append(' ');
>         builder.appendNumber(m_matrix.f());
>         builder.append(')');
>-        return builder.toString();
>+        if (auto string = builder.toString())
>+            return *string;
>+        CRASH();
>     }
>     case SVG_TRANSFORM_TRANSLATE: {
>         StringBuilder builder;
>@@ -188,7 +190,9 @@ String SVGTransformValue::valueAsString() const
>         builder.append(' ');
>         builder.appendNumber(m_matrix.f());
>         builder.append(')');
>-        return builder.toString();
>+        if (auto string = builder.toString())
>+            return *string;
>+        CRASH();
>     }
>     case SVG_TRANSFORM_SCALE: {
>         StringBuilder builder;
>@@ -197,7 +201,9 @@ String SVGTransformValue::valueAsString() const
>         builder.append(' ');
>         builder.appendNumber(m_matrix.yScale());
>         builder.append(')');
>-        return builder.toString();
>+        if (auto string = builder.toString())
>+            return *string;
>+        CRASH();
>     }
>     case SVG_TRANSFORM_ROTATE: {
>         double angleInRad = deg2rad(m_angle);
>@@ -215,7 +221,9 @@ String SVGTransformValue::valueAsString() const
>             builder.appendNumber(cy);
>         }
>         builder.append(')');
>-        return builder.toString();
>+        if (auto string = builder.toString())
>+            return *string;
>+        CRASH();
>     }
>     case SVG_TRANSFORM_SKEWX:
>     case SVG_TRANSFORM_SKEWY: {
>@@ -223,7 +231,9 @@ String SVGTransformValue::valueAsString() const
>         builder.append(prefix);
>         builder.appendNumber(m_angle);
>         builder.append(')');
>-        return builder.toString();
>+        if (auto string = builder.toString())
>+            return *string;
>+        CRASH();
>     }
>     }
> 
>diff --git a/Source/WebCore/svg/properties/SVGPropertyTraits.h b/Source/WebCore/svg/properties/SVGPropertyTraits.h
>index a2327e6..800abd6 100644
>--- a/Source/WebCore/svg/properties/SVGPropertyTraits.h
>+++ b/Source/WebCore/svg/properties/SVGPropertyTraits.h
>@@ -143,7 +143,9 @@ struct SVGPropertyTraits<FloatPoint> {
>         builder.appendNumber(type.x());
>         builder.append(' ');
>         builder.appendNumber(type.y());
>-        return builder.toString();
>+        if (auto string = builder.toString())
>+            return *string;
>+        CRASH();
>     }
> };
> 
>@@ -174,7 +176,9 @@ struct SVGPropertyTraits<FloatRect> {
>         builder.appendNumber(type.width());
>         builder.append(' ');
>         builder.appendNumber(type.height());
>-        return builder.toString();
>+        if (auto string = builder.toString())
>+            return *string;
>+        CRASH();
>     }
> };
> 
>diff --git a/Source/WebCore/testing/Internals.cpp b/Source/WebCore/testing/Internals.cpp
>index 81a4009..0c24047 100644
>--- a/Source/WebCore/testing/Internals.cpp
>+++ b/Source/WebCore/testing/Internals.cpp
>@@ -1540,7 +1540,9 @@ ExceptionOr<String> Internals::dumpMarkerRects(const String& markerTypeString)
>         rectString.appendNumber(rect.height());
>         rectString.appendLiteral(") ");
>     }
>-    return rectString.toString();
>+    if (auto string = rectString.toString())
>+        return WTFMove(*string);
>+    CRASH();
> }
> 
> void Internals::addTextMatchMarker(const Range& range, bool isActive)
>@@ -2079,7 +2081,9 @@ String Internals::parserMetaData(JSC::JSValue code)
>     result.appendNumber(endColumn);
>     result.appendLiteral(" }");
> 
>-    return result.toString();
>+    if (auto string = result.toString())
>+        return *string;
>+    CRASH();
> }
> 
> void Internals::updateEditorUINowIfScheduled()
>@@ -3071,7 +3075,9 @@ ExceptionOr<String> Internals::getCurrentCursorInfo()
>         result.append(numberToFixedPrecisionString(cursor.imageScaleFactor(), 8, buffer, true));
>     }
> #endif
>-    return result.toString();
>+    if (auto string = result.toString())
>+        return WTFMove(*string);
>+    CRASH();
> #else
>     return String { "FAIL: Cursor details not available on this platform." };
> #endif
>@@ -3514,7 +3520,9 @@ ExceptionOr<String> Internals::mediaSessionRestrictions(const String& mediaTypeS
>             builder.append(',');
>         builder.append("interruptedplaybacknotpermitted");
>     }
>-    return builder.toString();
>+    if (auto string = builder.toString())
>+        return WTFMove(*string);
>+    CRASH();
> }
> 
> void Internals::setMediaElementRestrictions(HTMLMediaElement& element, StringView restrictionsString)
>@@ -3755,48 +3763,50 @@ String Internals::pageMediaState()
>         return emptyString();
> 
>     WebCore::MediaProducer::MediaStateFlags state = document->page()->mediaState();
>-    StringBuilder string;
>+    StringBuilder builder;
>     if (state & MediaProducer::IsPlayingAudio)
>-        string.append("IsPlayingAudio,");
>+        builder.append("IsPlayingAudio,");
>     if (state & MediaProducer::IsPlayingVideo)
>-        string.append("IsPlayingVideo,");
>+        builder.append("IsPlayingVideo,");
>     if (state & MediaProducer::IsPlayingToExternalDevice)
>-        string.append("IsPlayingToExternalDevice,");
>+        builder.append("IsPlayingToExternalDevice,");
>     if (state & MediaProducer::RequiresPlaybackTargetMonitoring)
>-        string.append("RequiresPlaybackTargetMonitoring,");
>+        builder.append("RequiresPlaybackTargetMonitoring,");
>     if (state & MediaProducer::ExternalDeviceAutoPlayCandidate)
>-        string.append("ExternalDeviceAutoPlayCandidate,");
>+        builder.append("ExternalDeviceAutoPlayCandidate,");
>     if (state & MediaProducer::DidPlayToEnd)
>-        string.append("DidPlayToEnd,");
>+        builder.append("DidPlayToEnd,");
>     if (state & MediaProducer::IsSourceElementPlaying)
>-        string.append("IsSourceElementPlaying,");
>+        builder.append("IsSourceElementPlaying,");
> 
>     if (state & MediaProducer::IsNextTrackControlEnabled)
>-        string.append("IsNextTrackControlEnabled,");
>+        builder.append("IsNextTrackControlEnabled,");
>     if (state & MediaProducer::IsPreviousTrackControlEnabled)
>-        string.append("IsPreviousTrackControlEnabled,");
>+        builder.append("IsPreviousTrackControlEnabled,");
> 
>     if (state & MediaProducer::HasPlaybackTargetAvailabilityListener)
>-        string.append("HasPlaybackTargetAvailabilityListener,");
>+        builder.append("HasPlaybackTargetAvailabilityListener,");
>     if (state & MediaProducer::HasAudioOrVideo)
>-        string.append("HasAudioOrVideo,");
>+        builder.append("HasAudioOrVideo,");
>     if (state & MediaProducer::HasActiveAudioCaptureDevice)
>-        string.append("HasActiveAudioCaptureDevice,");
>+        builder.append("HasActiveAudioCaptureDevice,");
>     if (state & MediaProducer::HasActiveVideoCaptureDevice)
>-        string.append("HasActiveVideoCaptureDevice,");
>+        builder.append("HasActiveVideoCaptureDevice,");
>     if (state & MediaProducer::HasMutedAudioCaptureDevice)
>-        string.append("HasMutedAudioCaptureDevice,");
>+        builder.append("HasMutedAudioCaptureDevice,");
>     if (state & MediaProducer::HasMutedVideoCaptureDevice)
>-        string.append("HasMutedVideoCaptureDevice,");
>+        builder.append("HasMutedVideoCaptureDevice,");
>     if (state & MediaProducer::HasUserInteractedWithMediaElement)
>-        string.append("HasUserInteractedWithMediaElement,");
>+        builder.append("HasUserInteractedWithMediaElement,");
> 
>-    if (string.isEmpty())
>-        string.append("IsNotPlaying");
>+    if (builder.isEmpty())
>+        builder.append("IsNotPlaying");
>     else
>-        string.resize(string.length() - 1);
>+        builder.resize(builder.length() - 1);
> 
>-    return string.toString();
>+    if (auto string = builder.toString())
>+        return *string;
>+    CRASH();
> }
> 
> void Internals::setPageDefersLoading(bool defersLoading)
>@@ -3918,7 +3928,9 @@ ExceptionOr<String> Internals::scrollSnapOffsets(Element& element)
>         }
>     }
> 
>-    return result.toString();
>+    if (auto string = result.toString())
>+        return WTFMove(*string);
>+    CRASH();
> }
> 
> #endif
>diff --git a/Source/WebCore/testing/MockPageOverlayClient.cpp b/Source/WebCore/testing/MockPageOverlayClient.cpp
>index e5a6cfe..f4a3ce7 100644
>--- a/Source/WebCore/testing/MockPageOverlayClient.cpp
>+++ b/Source/WebCore/testing/MockPageOverlayClient.cpp
>@@ -98,7 +98,10 @@ void MockPageOverlayClient::drawRect(PageOverlay& overlay, GraphicsContext& cont
>     message.appendLiteral(", ");
>     message.appendNumber(dirtyRect.height());
>     message.appendLiteral(")");
>-    overlay.page()->mainFrame().document()->addConsoleMessage(MessageSource::Other, MessageLevel::Debug, message.toString());
>+    if (auto string = message.toString())
>+        overlay.page()->mainFrame().document()->addConsoleMessage(MessageSource::Other, MessageLevel::Debug, *string);
>+    else
>+        CRASH();
> 
>     GraphicsContextStateSaver stateSaver(context);
> 
>@@ -123,7 +126,10 @@ bool MockPageOverlayClient::mouseEvent(PageOverlay& overlay, const PlatformMouse
>     message.appendLiteral(", ");
>     message.appendNumber(event.position().y());
>     message.appendLiteral(")");
>-    overlay.page()->mainFrame().document()->addConsoleMessage(MessageSource::Other, MessageLevel::Debug, message.toString());
>+    if (auto string = message.toString())
>+        overlay.page()->mainFrame().document()->addConsoleMessage(MessageSource::Other, MessageLevel::Debug, *string);
>+    else
>+        CRASH();
> 
>     return false;
> }
>diff --git a/Source/WebCore/workers/WorkerScriptLoader.cpp b/Source/WebCore/workers/WorkerScriptLoader.cpp
>index 5b340ff..44e4e25 100644
>--- a/Source/WebCore/workers/WorkerScriptLoader.cpp
>+++ b/Source/WebCore/workers/WorkerScriptLoader.cpp
>@@ -202,7 +202,9 @@ void WorkerScriptLoader::notifyError()
> 
> String WorkerScriptLoader::script()
> {
>-    return m_script.toString();
>+    if (auto string = m_script.toString())
>+        return *string;
>+    CRASH();
> }
> 
> void WorkerScriptLoader::notifyFinished()
>diff --git a/Source/WebCore/xml/XMLErrors.cpp b/Source/WebCore/xml/XMLErrors.cpp
>index b1432d1..15319f5 100644
>--- a/Source/WebCore/xml/XMLErrors.cpp
>+++ b/Source/WebCore/xml/XMLErrors.cpp
>@@ -148,8 +148,11 @@ void XMLErrors::insertErrorMessageBlock()
>         documentElement = WTFMove(body);
>     }
> 
>-    String errorMessages = m_errorMessages.toString();
>-    auto reportElement = createXHTMLParserErrorHeader(m_document, errorMessages);
>+    auto reportElement = createXHTMLParserErrorHeader(m_document, [&] () {
>+        if (auto string = m_errorMessages.toString())
>+            return *string;
>+        CRASH();
>+    }());
> 
> #if ENABLE(XSLT)
>     if (m_document.transformSourceDocument()) {
>diff --git a/Source/WebCore/xml/XMLHttpRequest.cpp b/Source/WebCore/xml/XMLHttpRequest.cpp
>index 19e5ae4..76b9fd7 100644
>--- a/Source/WebCore/xml/XMLHttpRequest.cpp
>+++ b/Source/WebCore/xml/XMLHttpRequest.cpp
>@@ -195,7 +195,10 @@ ExceptionOr<Document*> XMLHttpRequest::responseXML()
>             else
>                 m_responseDocument = XMLDocument::create(0, m_url);
>             // FIXME: Set Last-Modified.
>-            m_responseDocument->setContent(m_responseBuilder.toStringPreserveCapacity());
>+            if (auto string = m_responseBuilder.toStringPreserveCapacity())
>+                m_responseDocument->setContent(*string);
>+            else
>+                CRASH();
>             m_responseDocument->setContextDocument(downcast<Document>(*scriptExecutionContext()));
>             m_responseDocument->setSecurityOriginPolicy(scriptExecutionContext()->securityOriginPolicy());
>             m_responseDocument->overrideMIMEType(mimeType);
>@@ -817,14 +820,20 @@ String XMLHttpRequest::getAllResponseHeaders() const
>             stringBuilder.appendLiteral(": ");
>             stringBuilder.append(header.value);
>             stringBuilder.appendLiteral("\r\n");
>-            headers.uncheckedAppend(stringBuilder.toString());
>+            if (auto string = stringBuilder.toString())
>+                headers.uncheckedAppend(*string);
>+            else
>+                CRASH();
>         }
>         std::sort(headers.begin(), headers.end(), WTF::codePointCompareLessThan);
> 
>         StringBuilder stringBuilder;
>         for (auto& header : headers)
>             stringBuilder.append(header);
>-        m_allResponseHeaders = stringBuilder.toString();
>+        if (auto string = stringBuilder.toString())
>+            m_allResponseHeaders = *string;
>+        else
>+            CRASH();
>     }
> 
>     return m_allResponseHeaders;
>diff --git a/Source/WebCore/xml/XMLHttpRequest.h b/Source/WebCore/xml/XMLHttpRequest.h
>index 1eec158..53b4f87 100644
>--- a/Source/WebCore/xml/XMLHttpRequest.h
>+++ b/Source/WebCore/xml/XMLHttpRequest.h
>@@ -87,7 +87,12 @@ public:
>     String getAllResponseHeaders() const;
>     String getResponseHeader(const String& name) const;
>     ExceptionOr<OwnedString> responseText();
>-    String responseTextIgnoringResponseType() const { return m_responseBuilder.toStringPreserveCapacity(); }
>+    String responseTextIgnoringResponseType() const
>+    {
>+        if (auto string = m_responseBuilder.toStringPreserveCapacity())
>+            return *string;
>+        CRASH();
>+    }
>     String responseMIMEType() const;
> 
>     Document* optionalResponseXML() const { return m_responseDocument.get(); }
>diff --git a/Source/WebCore/xml/XPathFunctions.cpp b/Source/WebCore/xml/XPathFunctions.cpp
>index 73534a4..f7dca9aa 100644
>--- a/Source/WebCore/xml/XPathFunctions.cpp
>+++ b/Source/WebCore/xml/XPathFunctions.cpp
>@@ -308,9 +308,11 @@ static AtomicString atomicSubstring(StringBuilder& builder, unsigned start, unsi
> {
>     ASSERT(start <= builder.length());
>     ASSERT(length <= builder.length() - start);
>+    if (builder.failed())
>+        CRASH();
>     if (builder.is8Bit())
>-        return AtomicString(builder.characters8() + start, length);
>-    return AtomicString(builder.characters16() + start, length);
>+        return AtomicString(*builder.characters8() + start, length);
>+    return AtomicString(*builder.characters16() + start, length);
> }
> 
> Value FunId::evaluate() const
>@@ -334,14 +336,17 @@ Value FunId::evaluate() const
>     unsigned startPos = 0;
>     unsigned length = idList.length();
>     while (true) {
>-        while (startPos < length && isWhitespace(idList[startPos]))
>+        if (idList.failed())
>+            CRASH();
>+
>+        while (startPos < length && isWhitespace(*idList[startPos]))
>             ++startPos;
>         
>         if (startPos == length)
>             break;
> 
>         size_t endPos = startPos;
>-        while (endPos < length && !isWhitespace(idList[endPos]))
>+        while (endPos < length && !isWhitespace(*idList[endPos]))
>             ++endPos;
> 
>         // If there are several nodes with the same id, id() should return the first one.
>@@ -437,7 +442,9 @@ Value FunConcat::evaluate() const
>         result.append(str);
>     }
> 
>-    return result.toString();
>+    if (auto string = result.toString())
>+        return *string;
>+    CRASH();
> }
> 
> Value FunStartsWith::evaluate() const
>@@ -556,7 +563,9 @@ Value FunTranslate::evaluate() const
>             result.append(s3[i2]);
>     }
> 
>-    return result.toString();
>+    if (auto string = result.toString())
>+        return *string;
>+    CRASH();
> }
> 
> Value FunBoolean::evaluate() const
>diff --git a/Source/WebCore/xml/XSLTProcessorLibxslt.cpp b/Source/WebCore/xml/XSLTProcessorLibxslt.cpp
>index 66ad15f..8e5e05e 100644
>--- a/Source/WebCore/xml/XSLTProcessorLibxslt.cpp
>+++ b/Source/WebCore/xml/XSLTProcessorLibxslt.cpp
>@@ -197,12 +197,18 @@ static bool saveResultToString(xmlDocPtr resultDoc, xsltStylesheetPtr sheet, Str
>         return false;
> 
>     // Workaround for <http://bugzilla.gnome.org/show_bug.cgi?id=495668>: libxslt appends an extra line feed to the result.
>-    if (resultBuilder.length() > 0 && resultBuilder[resultBuilder.length() - 1] == '\n')
>+    if (resultBuilder.length() > 0) {
>+        if (resultBuilder.failed())
>+            CRASH();
>+        if (*resultBuilder[resultBuilder.length() - 1] == '\n')
>         resultBuilder.resize(resultBuilder.length() - 1);
>+    }
> 
>-    resultString = resultBuilder.toString();
>-
>-    return true;
>+    if (auto string = resultBuilder.toString()) {
>+        resultString = *string;
>+        return true;
>+    }
>+    CRASH();
> }
> 
> static const char** xsltParamArrayFromParameterMap(XSLTProcessor::ParameterMap& parameters)
>diff --git a/Source/WebCore/xml/parser/CharacterReferenceParserInlines.h b/Source/WebCore/xml/parser/CharacterReferenceParserInlines.h
>index 7686268..672bae0 100644
>--- a/Source/WebCore/xml/parser/CharacterReferenceParserInlines.h
>+++ b/Source/WebCore/xml/parser/CharacterReferenceParserInlines.h
>@@ -32,7 +32,10 @@ namespace WebCore {
> 
> inline void unconsumeCharacters(SegmentedString& source, StringBuilder& consumedCharacters)
> {
>-    source.pushBack(consumedCharacters.toString());
>+    if (auto string = consumedCharacters.toString())
>+        source.pushBack(WTFMove(*string));
>+    else
>+        CRASH();
> }
> 
> template <typename ParserFunctions>
>diff --git a/Source/WebDriver/SessionHost.cpp b/Source/WebDriver/SessionHost.cpp
>index f164929..b1cccb3 100644
>--- a/Source/WebDriver/SessionHost.cpp
>+++ b/Source/WebDriver/SessionHost.cpp
>@@ -55,7 +55,10 @@ long SessionHost::sendCommandToBackend(const String& command, RefPtr<JSON::Objec
>         messageBuilder.append(parameters->toJSONString());
>     }
>     messageBuilder.append('}');
>-    sendMessageToBackend(sequenceID, messageBuilder.toString());
>+    if (auto string = messageBuilder.toString())
>+        sendMessageToBackend(sequenceID, *string);
>+    else
>+        CRASH();
> 
>     return sequenceID;
> }
>diff --git a/Source/WebKit/ChangeLog b/Source/WebKit/ChangeLog
>index b75bdca..e5c685d 100644
>--- a/Source/WebKit/ChangeLog
>+++ b/Source/WebKit/ChangeLog
>@@ -1,3 +1,52 @@
>+2018-04-26  JF Bastien  <jfbastien@apple.com>
>+
>+        StringBuilder is fallible
>+        https://bugs.webkit.org/show_bug.cgi?id=185048
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        Teach StringBuilder that it is fallible
>+
>+        * NetworkProcess/cache/CacheStorageEngine.cpp:
>+        (WebKit::CacheStorage::Engine::representation):
>+        * NetworkProcess/cache/NetworkCache.cpp:
>+        (WebKit::NetworkCache::Cache::dumpContentsToFile):
>+        * NetworkProcess/cache/NetworkCacheKey.cpp:
>+        (WebKit::NetworkCache::Key::hashAsString):
>+        * NetworkProcess/capture/NetworkCaptureManager.cpp:
>+        (WebKit::NetworkCapture::Manager::hashToPath):
>+        * Shared/Databases/IndexedDB/IDBUtilities.cpp:
>+        (WebKit::uniqueDatabaseIdentifier):
>+        * Shared/Gamepad/GamepadData.cpp:
>+        (WebKit::GamepadData::loggingString const):
>+        * Shared/Plugins/Netscape/unix/NetscapePluginModuleUnix.cpp:
>+        (WebKit::NetscapePluginModule::buildMIMEDescription):
>+        * Shared/WebMemorySampler.cpp:
>+        (WebKit::WebMemorySampler::appendCurrentMemoryUsageToFile):
>+        * UIProcess/API/APIUserScript.cpp:
>+        (API::UserScript::generateUniqueURL):
>+        * UIProcess/API/APIUserStyleSheet.cpp:
>+        (API::UserStyleSheet::generateUniqueURL):
>+        * UIProcess/Cocoa/ViewGestureController.cpp:
>+        (WebKit::ViewGestureController::SnapshotRemovalTracker::eventsDescription):
>+        * UIProcess/WebBackForwardList.cpp:
>+        (WebKit::WebBackForwardList::loggingString):
>+        * UIProcess/WebProcessPool.cpp:
>+        (WebKit::WebProcessPool::didReceiveInvalidMessage):
>+        * UIProcess/WebProcessProxy.cpp:
>+        (WebKit::WebProcessProxy::getLaunchOptions):
>+        * UIProcess/WebResourceLoadStatisticsStore.cpp:
>+        (WebKit::WebResourceLoadStatisticsStore::removeDataRecords):
>+        (WebKit::WebResourceLoadStatisticsStore::updateCookiePartitioning):
>+        * UIProcess/WebResourceLoadStatisticsTelemetry.cpp:
>+        (WebKit::submitTopList):
>+        * WebProcess/Plugins/Netscape/NetscapeBrowserFuncs.cpp:
>+        (WebKit::capitalizeRFC822HeaderFieldName):
>+        * WebProcess/Plugins/PluginView.cpp:
>+        (WebKit::buildHTTPHeaders):
>+        * WebProcess/WebPage/WebFrame.cpp:
>+        (WebKit::WebFrame::contentsAsString const):
>+
> 2018-05-01  Oleksandr Skachkov  <gskachkov@gmail.com>
> 
>         WebAssembly: add support for stream APIs - JavaScript API
>diff --git a/Source/WebKit/NetworkProcess/cache/CacheStorageEngine.cpp b/Source/WebKit/NetworkProcess/cache/CacheStorageEngine.cpp
>index 45c47a1..8d79583 100644
>--- a/Source/WebKit/NetworkProcess/cache/CacheStorageEngine.cpp
>+++ b/Source/WebKit/NetworkProcess/cache/CacheStorageEngine.cpp
>@@ -524,7 +524,9 @@ String Engine::representation()
>         builder.append("}");
>     }
>     builder.append("]}");
>-    return builder.toString();
>+    if (auto string = builder.toString())
>+        return *string;
>+    CRASH();
> }
> 
> } // namespace CacheStorage
>diff --git a/Source/WebKit/NetworkProcess/cache/NetworkCache.cpp b/Source/WebKit/NetworkProcess/cache/NetworkCache.cpp
>index 73a25f4..0ca7f97 100644
>--- a/Source/WebKit/NetworkProcess/cache/NetworkCache.cpp
>+++ b/Source/WebKit/NetworkProcess/cache/NetworkCache.cpp
>@@ -570,10 +570,13 @@ void Cache::dumpContentsToFile()
>             epilogue.appendNumber(totals.count ? totals.worth / totals.count : 0);
>             epilogue.appendLiteral("\n");
>             epilogue.appendLiteral("}\n}\n");
>-            auto writeData = epilogue.toString().utf8();
>-            writeToFile(fd, writeData.data(), writeData.length());
>-            closeFile(fd);
>-            return;
>+            if (auto string = epilogue.toString()) {
>+                auto writeData = string->utf8();
>+                writeToFile(fd, writeData.data(), writeData.length());
>+                closeFile(fd);
>+                return;
>+            }
>+            CRASH();
>         }
>         auto entry = Entry::decodeStorageRecord(*record);
>         if (!entry)
>@@ -585,8 +588,11 @@ void Cache::dumpContentsToFile()
>         StringBuilder json;
>         entry->asJSON(json, info);
>         json.appendLiteral(",\n");
>-        auto writeData = json.toString().utf8();
>-        writeToFile(fd, writeData.data(), writeData.length());
>+        if (auto string = json.toString()) {
>+            auto writeData = string->utf8();
>+            writeToFile(fd, writeData.data(), writeData.length());
>+        } else
>+            CRASH();
>     });
> }
> 
>diff --git a/Source/WebKit/NetworkProcess/cache/NetworkCacheKey.cpp b/Source/WebKit/NetworkProcess/cache/NetworkCacheKey.cpp
>index 8fa81d1..0b422ef 100644
>--- a/Source/WebKit/NetworkProcess/cache/NetworkCacheKey.cpp
>+++ b/Source/WebKit/NetworkProcess/cache/NetworkCacheKey.cpp
>@@ -134,7 +134,9 @@ String Key::hashAsString(const HashType& hash)
>         builder.append(upperNibbleToASCIIHexDigit(byte));
>         builder.append(lowerNibbleToASCIIHexDigit(byte));
>     }
>-    return builder.toString();
>+    if (auto string = builder.toString())
>+        return *string;
>+    CRASH();
> }
> 
> template <typename CharType> bool hexDigitsToHash(CharType* characters, Key::HashType& hash)
>diff --git a/Source/WebKit/NetworkProcess/capture/NetworkCaptureManager.cpp b/Source/WebKit/NetworkProcess/capture/NetworkCaptureManager.cpp
>index 5613be8..3473e5d 100644
>--- a/Source/WebKit/NetworkProcess/capture/NetworkCaptureManager.cpp
>+++ b/Source/WebKit/NetworkProcess/capture/NetworkCaptureManager.cpp
>@@ -415,9 +415,9 @@ String Manager::hashToPath(const String& hash)
> 
>     auto path = pathByAppendingComponent(m_recordReplayCacheLocation, kDirNameResources);
>     path = pathByAppendingComponent(path, hashHead);
>-    path = pathByAppendingComponent(path, fileName.toString());
>-
>-    return path;
>+    if (auto string = fileName.toString())
>+        return pathByAppendingComponent(path, *string);
>+    CRASH();
> }
> 
> String Manager::urlIdentifyingCommonDomain(const WebCore::URL& url)
>diff --git a/Source/WebKit/NetworkProcess/soup/NetworkProcessSoup.cpp b/Source/WebKit/NetworkProcess/soup/NetworkProcessSoup.cpp
>index 0fa8fd2..a462e31 100644
>--- a/Source/WebKit/NetworkProcess/soup/NetworkProcessSoup.cpp
>+++ b/Source/WebKit/NetworkProcess/soup/NetworkProcessSoup.cpp
>@@ -88,7 +88,9 @@ static CString buildAcceptLanguages(const Vector<String>& languages)
>         }
>     }
> 
>-    return builder.toString().utf8();
>+    if (auto string = builder.toString())
>+        return string->utf8();
>+    CRASH();
> }
> 
> void NetworkProcess::userPreferredLanguagesChanged(const Vector<String>& languages)
>diff --git a/Source/WebKit/Shared/Databases/IndexedDB/IDBUtilities.cpp b/Source/WebKit/Shared/Databases/IndexedDB/IDBUtilities.cpp
>index 9ec76ff..7c1c24e 100644
>--- a/Source/WebKit/Shared/Databases/IndexedDB/IDBUtilities.cpp
>+++ b/Source/WebKit/Shared/Databases/IndexedDB/IDBUtilities.cpp
>@@ -52,7 +52,9 @@ String uniqueDatabaseIdentifier(const String& databaseName, const WebCore::Secur
>     stringBuilder.append('_');
>     stringBuilder.append(databaseName);
> 
>-    return stringBuilder.toString();
>+    if (auto string = stringBuilder.toString())
>+        return *string;
>+    CRASH();
> }
> 
> } // namespace WebKit
>diff --git a/Source/WebKit/Shared/Gamepad/GamepadData.cpp b/Source/WebKit/Shared/Gamepad/GamepadData.cpp
>index 905d827..1fbd7d1 100644
>--- a/Source/WebKit/Shared/Gamepad/GamepadData.cpp
>+++ b/Source/WebKit/Shared/Gamepad/GamepadData.cpp
>@@ -111,7 +111,9 @@ String GamepadData::loggingString() const
>         builder.appendNumber(m_buttonValues[i]);
>     }
> 
>-    return builder.toString();
>+    if (auto string = builder.toString())
>+        return *string;
>+    CRASH();
> }
> #endif
> 
>diff --git a/Source/WebKit/Shared/Plugins/Netscape/unix/NetscapePluginModuleUnix.cpp b/Source/WebKit/Shared/Plugins/Netscape/unix/NetscapePluginModuleUnix.cpp
>index f9eb06e..972dcb5 100644
>--- a/Source/WebKit/Shared/Plugins/Netscape/unix/NetscapePluginModuleUnix.cpp
>+++ b/Source/WebKit/Shared/Plugins/Netscape/unix/NetscapePluginModuleUnix.cpp
>@@ -120,7 +120,9 @@ String NetscapePluginModule::buildMIMEDescription(const Vector<MimeClassInfo>& m
>             builder.append(';');
>     }
> 
>-    return builder.toString();
>+    if (auto string = builder.toString())
>+        return *string;
>+    CRASH();
> }
> 
> bool NetscapePluginModule::getPluginInfoForLoadedPlugin(RawPluginMetaData& metaData)
>diff --git a/Source/WebKit/Shared/WebMemorySampler.cpp b/Source/WebKit/Shared/WebMemorySampler.cpp
>index 9277189..6758ab2 100644
>--- a/Source/WebKit/Shared/WebMemorySampler.cpp
>+++ b/Source/WebKit/Shared/WebMemorySampler.cpp
>@@ -181,8 +181,11 @@ void WebMemorySampler::appendCurrentMemoryUsageToFile(FileSystem::PlatformFileHa
>     }
>     statString.append('\n');
> 
>-    CString utf8String = statString.toString().utf8();
>-    FileSystem::writeToFile(m_sampleLogFile, utf8String.data(), utf8String.length());
>+    if (auto string = statString.toString()) {
>+        CString utf8String = string->utf8();
>+        FileSystem::writeToFile(m_sampleLogFile, utf8String.data(), utf8String.length());
>+    } else
>+        CRASH();
> }
> 
> }
>diff --git a/Source/WebKit/UIProcess/API/APIUserScript.cpp b/Source/WebKit/UIProcess/API/APIUserScript.cpp
>index 7584e63..a939b57 100644
>--- a/Source/WebKit/UIProcess/API/APIUserScript.cpp
>+++ b/Source/WebKit/UIProcess/API/APIUserScript.cpp
>@@ -37,7 +37,9 @@ WebCore::URL UserScript::generateUniqueURL()
>     StringBuilder urlStringBuilder;
>     urlStringBuilder.appendLiteral("user-script:");
>     urlStringBuilder.appendNumber(++identifier);
>-    return { { }, urlStringBuilder.toString() };
>+    if (auto string = urlStringBuilder.toString())
>+        return { { }, *string };
>+    CRASH();
> }
> 
> UserScript::UserScript(WebCore::UserScript userScript, API::UserContentWorld& world)
>diff --git a/Source/WebKit/UIProcess/API/APIUserStyleSheet.cpp b/Source/WebKit/UIProcess/API/APIUserStyleSheet.cpp
>index 1d595bb..63ac0f4 100644
>--- a/Source/WebKit/UIProcess/API/APIUserStyleSheet.cpp
>+++ b/Source/WebKit/UIProcess/API/APIUserStyleSheet.cpp
>@@ -37,7 +37,9 @@ WebCore::URL UserStyleSheet::generateUniqueURL()
>     StringBuilder urlStringBuilder;
>     urlStringBuilder.appendLiteral("user-style-sheet:");
>     urlStringBuilder.appendNumber(++identifier);
>-    return { { }, urlStringBuilder.toString() };
>+    if (auto string = urlStringBuilder.toString())
>+        return { { }, *string };
>+    CRASH();
> }
> 
> UserStyleSheet::UserStyleSheet(WebCore::UserStyleSheet userStyleSheet, API::UserContentWorld& world)
>diff --git a/Source/WebKit/UIProcess/API/glib/WebKitWebView.cpp b/Source/WebKit/UIProcess/API/glib/WebKitWebView.cpp
>index 3b7f287..0d085ec 100644
>--- a/Source/WebKit/UIProcess/API/glib/WebKitWebView.cpp
>+++ b/Source/WebKit/UIProcess/API/glib/WebKitWebView.cpp
>@@ -3296,9 +3296,12 @@ static void webkitWebViewRunJavaScriptCallback(API::SerializedScriptValue* wkSer
>             builder.appendLiteral(": ");
>         }
>         builder.append(exceptionDetails.message);
>-        g_task_return_new_error(task, WEBKIT_JAVASCRIPT_ERROR, WEBKIT_JAVASCRIPT_ERROR_SCRIPT_FAILED,
>-            "%s", builder.toString().utf8().data());
>-        return;
>+        if (auto string = builder.toString()) {
>+            g_task_return_new_error(task, WEBKIT_JAVASCRIPT_ERROR, WEBKIT_JAVASCRIPT_ERROR_SCRIPT_FAILED,
>+                "%s", string->utf8().data());
>+            return;
>+        }
>+        CRASH();
>     }
> 
>     g_task_return_pointer(task, webkitJavascriptResultCreate(wkSerializedScriptValue->internalRepresentation()),
>diff --git a/Source/WebKit/UIProcess/Cocoa/ViewGestureController.cpp b/Source/WebKit/UIProcess/Cocoa/ViewGestureController.cpp
>index 8c21c24..916dd47 100644
>--- a/Source/WebKit/UIProcess/Cocoa/ViewGestureController.cpp
>+++ b/Source/WebKit/UIProcess/Cocoa/ViewGestureController.cpp
>@@ -232,8 +232,10 @@ String ViewGestureController::SnapshotRemovalTracker::eventsDescription(Events e
> 
>     if (event & ViewGestureController::SnapshotRemovalTracker::ScrollPositionRestoration)
>         description.append("ScrollPositionRestoration ");
>-    
>-    return description.toString();
>+
>+    if (auto string = description.toString())
>+        return *string;
>+    CRASH();
> }
> 
> 
>diff --git a/Source/WebKit/UIProcess/WebBackForwardList.cpp b/Source/WebKit/UIProcess/WebBackForwardList.cpp
>index 6006a02..128f567 100644
>--- a/Source/WebKit/UIProcess/WebBackForwardList.cpp
>+++ b/Source/WebKit/UIProcess/WebBackForwardList.cpp
>@@ -493,7 +493,9 @@ const char* WebBackForwardList::loggingString()
>         builder.append(m_entries[i]->loggingString());
>     }
> 
>-    return debugString("\n", builder.toString());
>+    if (auto string = builder.toString())
>+        return debugString("\n", *string);
>+    CRASH();
> }
> #endif // !LOG_DISABLED
> 
>diff --git a/Source/WebKit/UIProcess/WebProcessPool.cpp b/Source/WebKit/UIProcess/WebProcessPool.cpp
>index ca548be..17bc371 100644
>--- a/Source/WebKit/UIProcess/WebProcessPool.cpp
>+++ b/Source/WebKit/UIProcess/WebProcessPool.cpp
>@@ -710,7 +710,10 @@ void WebProcessPool::didReceiveInvalidMessage(const IPC::StringReference& messag
>     messageNameStringBuilder.append('.');
>     messageNameStringBuilder.append(messageName.data(), messageName.size());
> 
>-    s_invalidMessageCallback(toAPI(API::String::create(messageNameStringBuilder.toString()).ptr()));
>+    if (auto string = messageNameStringBuilder.toString())
>+        s_invalidMessageCallback(toAPI(API::String::create(*string).ptr()));
>+    else
>+        CRASH();
> }
> 
> void WebProcessPool::processDidCachePage(WebProcessProxy* process)
>diff --git a/Source/WebKit/UIProcess/WebProcessProxy.cpp b/Source/WebKit/UIProcess/WebProcessProxy.cpp
>index 4156d83..ef09db0 100644
>--- a/Source/WebKit/UIProcess/WebProcessProxy.cpp
>+++ b/Source/WebKit/UIProcess/WebProcessProxy.cpp
>@@ -170,7 +170,10 @@ void WebProcessProxy::getLaunchOptions(ProcessLauncher::LaunchOptions& launchOpt
>                 languageString.append(',');
>             languageString.append(overrideLanguages[i]);
>         }
>-        launchOptions.extraInitializationData.add(ASCIILiteral("OverrideLanguages"), languageString.toString());
>+        if (auto string = languageString.toString())
>+            launchOptions.extraInitializationData.add(ASCIILiteral("OverrideLanguages"), *string);
>+        else
>+            CRASH();
>     }
> 
>     launchOptions.nonValidInjectedCodeAllowed = shouldAllowNonValidInjectedCode();
>diff --git a/Source/WebKit/UIProcess/WebResourceLoadStatisticsStore.cpp b/Source/WebKit/UIProcess/WebResourceLoadStatisticsStore.cpp
>index 7fa8910..5d9b766 100644
>--- a/Source/WebKit/UIProcess/WebResourceLoadStatisticsStore.cpp
>+++ b/Source/WebKit/UIProcess/WebResourceLoadStatisticsStore.cpp
>@@ -227,7 +227,10 @@ void WebResourceLoadStatisticsStore::removeDataRecords(CompletionHandler<void()>
>             appendWithDelimiter(domainsToRemoveDataRecordsForBuilder, domain, isFirstItem);
>             isFirstItem = false;
>         }
>-        RELEASE_LOG_INFO(ResourceLoadStatisticsDebug, "About to remove data records for %{public}s.", domainsToRemoveDataRecordsForBuilder.toString().utf8().data());
>+        if (auto string = domainsToRemoveDataRecordsForBuilder.toString())
>+            RELEASE_LOG_INFO(ResourceLoadStatisticsDebug, "About to remove data records for %{public}s.", string->utf8().data());
>+        else
>+            CRASH();
>     }
> #endif
> 
>@@ -1044,7 +1047,10 @@ void WebResourceLoadStatisticsStore::updateCookiePartitioning(CompletionHandler<
>                 appendWithDelimiter(domainsToPartitionBuilder, domain, isFirstDomain);
>                 isFirstDomain = false;
>             }
>-            RELEASE_LOG_INFO(ResourceLoadStatisticsDebug, "About to partition cookies in third-party contexts for %{public}s.", domainsToPartitionBuilder.toString().utf8().data());
>+            if (auto string = domainsToPartitionBuilder.toString())
>+                RELEASE_LOG_INFO(ResourceLoadStatisticsDebug, "About to partition cookies in third-party contexts for %{public}s.", string->utf8().data());
>+            else
>+                CRASH();
>         }
> 
>         if (!domainsToBlock.isEmpty()) {
>@@ -1054,7 +1060,10 @@ void WebResourceLoadStatisticsStore::updateCookiePartitioning(CompletionHandler<
>                 appendWithDelimiter(domainsToBlockBuilder, domain, isFirstDomain);
>                 isFirstDomain = false;
>             }
>-            RELEASE_LOG_INFO(ResourceLoadStatisticsDebug, "About to block cookies in third-party contexts for %{public}s.", domainsToBlockBuilder.toString().utf8().data());
>+            if (auto string = domainsToBlockBuilder.toString())
>+                RELEASE_LOG_INFO(ResourceLoadStatisticsDebug, "About to block cookies in third-party contexts for %{public}s.", string->utf8().data());
>+            else
>+                CRASH();
>         }
> 
>         if (!domainsToNeitherPartitionNorBlock.isEmpty()) {
>@@ -1064,7 +1073,10 @@ void WebResourceLoadStatisticsStore::updateCookiePartitioning(CompletionHandler<
>                 appendWithDelimiter(domainsToNeitherPartitionNorBlockBuilder, domain, isFirstDomain);
>                 isFirstDomain = false;
>             }
>-            RELEASE_LOG_INFO(ResourceLoadStatisticsDebug, "About to neither partition nor block cookies in third-party contexts for %{public}s.", domainsToNeitherPartitionNorBlockBuilder.toString().utf8().data());
>+            if (auto string = domainsToNeitherPartitionNorBlockBuilder.toString())
>+                RELEASE_LOG_INFO(ResourceLoadStatisticsDebug, "About to neither partition nor block cookies in third-party contexts for %{public}s.", string->utf8().data());
>+            else
>+                CRASH();
>         }
>     }
> #endif
>diff --git a/Source/WebKit/UIProcess/WebResourceLoadStatisticsTelemetry.cpp b/Source/WebKit/UIProcess/WebResourceLoadStatisticsTelemetry.cpp
>index bb7440c..520ab778 100644
>--- a/Source/WebKit/UIProcess/WebResourceLoadStatisticsTelemetry.cpp
>+++ b/Source/WebKit/UIProcess/WebResourceLoadStatisticsTelemetry.cpp
>@@ -179,22 +179,23 @@ static void submitTopList(unsigned numberOfResourcesFromTheTop, const Vector<Pre
>     StringBuilder preambleBuilder;
>     preambleBuilder.appendLiteral("top");
>     preambleBuilder.appendNumber(numberOfResourcesFromTheTop);
>-    String descriptionPreamble = preambleBuilder.toString();
>-    
>-    webPageProxy.logDiagnosticMessageWithValue(DiagnosticLoggingKeys::resourceLoadStatisticsTelemetryKey(), descriptionPreamble + "PrevalentResourcesWithUserInteraction",
>-        topPrevalentResourcesWithUserInteraction, significantFiguresForLoggedValues, ShouldSample::No);
>-    webPageProxy.logDiagnosticMessageWithValue(DiagnosticLoggingKeys::resourceLoadStatisticsTelemetryKey(), descriptionPreamble + "SubframeUnderTopFrameOrigins",
>-        topSubframeUnderTopFrameOrigins, significantFiguresForLoggedValues, ShouldSample::No);
>-    webPageProxy.logDiagnosticMessageWithValue(DiagnosticLoggingKeys::resourceLoadStatisticsTelemetryKey(), descriptionPreamble + "SubresourceUnderTopFrameOrigins",
>-        topSubresourceUnderTopFrameOrigins, significantFiguresForLoggedValues, ShouldSample::No);
>-    webPageProxy.logDiagnosticMessageWithValue(DiagnosticLoggingKeys::resourceLoadStatisticsTelemetryKey(), descriptionPreamble + "SubresourceUniqueRedirectsTo",
>-        topSubresourceUniqueRedirectsTo, significantFiguresForLoggedValues, ShouldSample::No);
>-    webPageProxy.logDiagnosticMessageWithValue(DiagnosticLoggingKeys::resourceLoadStatisticsTelemetryKey(), descriptionPreamble + "NumberOfTimesDataRecordsRemoved",
>-        topNumberOfTimesDataRecordsRemoved, significantFiguresForLoggedValues, ShouldSample::No);
>-    webPageProxy.logDiagnosticMessageWithValue(DiagnosticLoggingKeys::resourceLoadStatisticsTelemetryKey(), descriptionPreamble + "NumberOfTimesAccessedAsFirstPartyDueToUserInteraction",
>-        topNumberOfTimesAccessedAsFirstPartyDueToUserInteraction, significantFiguresForLoggedValues, ShouldSample::No);
>-    webPageProxy.logDiagnosticMessageWithValue(DiagnosticLoggingKeys::resourceLoadStatisticsTelemetryKey(), descriptionPreamble + "NumberOfTimesAccessedAsFirstPartyDueToStorageAccessAPI",
>-        topNumberOfTimesAccessedAsFirstPartyDueToStorageAccessAPI, significantFiguresForLoggedValues, ShouldSample::No);
>+    if (auto descriptionPreamble = preambleBuilder.toString()) {
>+        webPageProxy.logDiagnosticMessageWithValue(DiagnosticLoggingKeys::resourceLoadStatisticsTelemetryKey(), *descriptionPreamble + "PrevalentResourcesWithUserInteraction",
>+            topPrevalentResourcesWithUserInteraction, significantFiguresForLoggedValues, ShouldSample::No);
>+        webPageProxy.logDiagnosticMessageWithValue(DiagnosticLoggingKeys::resourceLoadStatisticsTelemetryKey(), *descriptionPreamble + "SubframeUnderTopFrameOrigins",
>+            topSubframeUnderTopFrameOrigins, significantFiguresForLoggedValues, ShouldSample::No);
>+        webPageProxy.logDiagnosticMessageWithValue(DiagnosticLoggingKeys::resourceLoadStatisticsTelemetryKey(), *descriptionPreamble + "SubresourceUnderTopFrameOrigins",
>+            topSubresourceUnderTopFrameOrigins, significantFiguresForLoggedValues, ShouldSample::No);
>+        webPageProxy.logDiagnosticMessageWithValue(DiagnosticLoggingKeys::resourceLoadStatisticsTelemetryKey(), *descriptionPreamble + "SubresourceUniqueRedirectsTo",
>+            topSubresourceUniqueRedirectsTo, significantFiguresForLoggedValues, ShouldSample::No);
>+        webPageProxy.logDiagnosticMessageWithValue(DiagnosticLoggingKeys::resourceLoadStatisticsTelemetryKey(), *descriptionPreamble + "NumberOfTimesDataRecordsRemoved",
>+            topNumberOfTimesDataRecordsRemoved, significantFiguresForLoggedValues, ShouldSample::No);
>+        webPageProxy.logDiagnosticMessageWithValue(DiagnosticLoggingKeys::resourceLoadStatisticsTelemetryKey(), *descriptionPreamble + "NumberOfTimesAccessedAsFirstPartyDueToUserInteraction",
>+            topNumberOfTimesAccessedAsFirstPartyDueToUserInteraction, significantFiguresForLoggedValues, ShouldSample::No);
>+        webPageProxy.logDiagnosticMessageWithValue(DiagnosticLoggingKeys::resourceLoadStatisticsTelemetryKey(), *descriptionPreamble + "NumberOfTimesAccessedAsFirstPartyDueToStorageAccessAPI",
>+            topNumberOfTimesAccessedAsFirstPartyDueToStorageAccessAPI, significantFiguresForLoggedValues, ShouldSample::No);
>+    } else
>+        CRASH();
> }
>     
> static void submitTopLists(const Vector<PrevalentResourceTelemetry>& sortedPrevalentResources, const Vector<PrevalentResourceTelemetry>& sortedPrevalentResourcesWithoutUserInteraction, WebPageProxy& webPageProxy)
>diff --git a/Source/WebKit/WebProcess/InjectedBundle/API/glib/WebKitWebPage.cpp b/Source/WebKit/WebProcess/InjectedBundle/API/glib/WebKitWebPage.cpp
>index 667cd81..df69045 100644
>--- a/Source/WebKit/WebProcess/InjectedBundle/API/glib/WebKitWebPage.cpp
>+++ b/Source/WebKit/WebProcess/InjectedBundle/API/glib/WebKitWebPage.cpp
>@@ -274,7 +274,10 @@ private:
>             errorMessage.appendLiteral(" (");
>             errorMessage.append(response.httpStatusText());
>             errorMessage.append(')');
>-            webkitWebPageDidSendConsoleMessage(m_webPage, MessageSource::Network, MessageLevel::Error, errorMessage.toString(), 0, response.url().string());
>+            if (auto string = errorMessage.toString())
>+                webkitWebPageDidSendConsoleMessage(m_webPage, MessageSource::Network, MessageLevel::Error, *string, 0, response.url().string());
>+            else
>+                CRASH();
>         }
>     }
> 
>@@ -311,7 +314,10 @@ private:
>                 errorMessage.appendLiteral(": ");
>                 errorMessage.append(error.localizedDescription());
>             }
>-            webkitWebPageDidSendConsoleMessage(m_webPage, MessageSource::Network, MessageLevel::Error, errorMessage.toString(), 0, error.failingURL());
>+            if (auto string = errorMessage.toString())
>+                webkitWebPageDidSendConsoleMessage(m_webPage, MessageSource::Network, MessageLevel::Error, *string, 0, error.failingURL());
>+            else
>+                CRASH();
>         }
>     }
> 
>diff --git a/Source/WebKit/WebProcess/Plugins/Netscape/NetscapeBrowserFuncs.cpp b/Source/WebKit/WebProcess/Plugins/Netscape/NetscapeBrowserFuncs.cpp
>index 0bccfaf..ada5f41 100644
>--- a/Source/WebKit/WebProcess/Plugins/Netscape/NetscapeBrowserFuncs.cpp
>+++ b/Source/WebKit/WebProcess/Plugins/Netscape/NetscapeBrowserFuncs.cpp
>@@ -138,7 +138,9 @@ static String capitalizeRFC822HeaderFieldName(const String& name)
>         else
>             capitalizeCharacter = false;
>     }
>-    return result.toString();
>+    if (auto string = result.toString())
>+        return *string;
>+    CRASH();
> }
> 
> static HTTPHeaderMap parseRFC822HeaderFields(const char* bytes, unsigned length)
>diff --git a/Source/WebKit/WebProcess/Plugins/PluginView.cpp b/Source/WebKit/WebProcess/Plugins/PluginView.cpp
>index a7fcace..799ad9b 100644
>--- a/Source/WebKit/WebProcess/Plugins/PluginView.cpp
>+++ b/Source/WebKit/WebProcess/Plugins/PluginView.cpp
>@@ -212,7 +212,9 @@ static String buildHTTPHeaders(const ResourceResponse& response, long long& expe
>     if (!contentEncoding.isNull() && contentEncoding != "identity")
>         expectedContentLength = -1;
> 
>-    return header.toString();
>+    if (auto string = header.toString())
>+        return *string;
>+    CRASH();
> }
> 
> static uint32_t lastModifiedDateMS(const ResourceResponse& response)
>diff --git a/Source/WebKit/WebProcess/WebPage/WebFrame.cpp b/Source/WebKit/WebProcess/WebPage/WebFrame.cpp
>index 16abe55..489c8ce 100644
>--- a/Source/WebKit/WebProcess/WebPage/WebFrame.cpp
>+++ b/Source/WebKit/WebProcess/WebPage/WebFrame.cpp
>@@ -351,7 +351,9 @@ String WebFrame::contentsAsString() const
>             builder.append(webFrame->contentsAsString());
>         }
>         // FIXME: It may make sense to use toStringPreserveCapacity() here.
>-        return builder.toString();
>+        if (auto string = builder.toString())
>+            return *string;
>+        CRASH();
>     }
> 
>     Document* document = m_coreFrame->document();
>diff --git a/Source/WebKitLegacy/mac/ChangeLog b/Source/WebKitLegacy/mac/ChangeLog
>index 3676e65..46ea16c 100644
>--- a/Source/WebKitLegacy/mac/ChangeLog
>+++ b/Source/WebKitLegacy/mac/ChangeLog
>@@ -1,3 +1,15 @@
>+2018-04-26  JF Bastien  <jfbastien@apple.com>
>+
>+        StringBuilder is fallible
>+        https://bugs.webkit.org/show_bug.cgi?id=185048
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        Teach StringBuilder that it is fallible
>+
>+        * WebView/WebHTMLRepresentation.mm:
>+        (regExpForLabels):
>+
> 2018-05-01  Eric Carlson  <eric.carlson@apple.com>
> 
>         [MediaStream] remove WK1 support
>diff --git a/Source/WebKitLegacy/mac/WebView/WebHTMLRepresentation.mm b/Source/WebKitLegacy/mac/WebView/WebHTMLRepresentation.mm
>index 1918363..2b27a56 100644
>--- a/Source/WebKitLegacy/mac/WebView/WebHTMLRepresentation.mm
>+++ b/Source/WebKitLegacy/mac/WebView/WebHTMLRepresentation.mm
>@@ -394,7 +394,10 @@ static RegularExpression* regExpForLabels(NSArray *labels)
>                 pattern.appendLiteral("\\b");
>         }
>         pattern.append(')');
>-        result = new RegularExpression(pattern.toString(), JSC::Yarr::TextCaseInsensitive);
>+        if (auto string = pattern.toString())
>+            result = new RegularExpression(*string, JSC::Yarr::TextCaseInsensitive);
>+        else
>+            CRASH();
>     }
> 
>     // add regexp to the cache, making sure it is at the front for LRU ordering
>diff --git a/Source/WebKitLegacy/win/AccessibleBase.cpp b/Source/WebKitLegacy/win/AccessibleBase.cpp
>index 7e3b183..a81e337 100644
>--- a/Source/WebKitLegacy/win/AccessibleBase.cpp
>+++ b/Source/WebKitLegacy/win/AccessibleBase.cpp
>@@ -609,7 +609,10 @@ HRESULT AccessibleBase::get_accKeyboardShortcut(VARIANT vChild, __deref_opt_out
>             accessKeyModifiersBuilder.appendLiteral("Shift+");
>         if (modifiers.contains(PlatformEvent::Modifier::MetaKey))
>             accessKeyModifiersBuilder.appendLiteral("Win+");
>-        accessKeyModifiers = accessKeyModifiersBuilder.toString();
>+        if (auto string = accessKeyModifiersBuilder.toString())
>+            accessKeyModifiers = *string;
>+        else
>+            CRASH();
>     }
>     *shortcut = BString(String(accessKeyModifiers + accessKey)).release();
>     return S_OK;
>diff --git a/Source/WebKitLegacy/win/Plugins/PluginStream.cpp b/Source/WebKitLegacy/win/Plugins/PluginStream.cpp
>index f25664d..c99805b 100644
>--- a/Source/WebKitLegacy/win/Plugins/PluginStream.cpp
>+++ b/Source/WebKitLegacy/win/Plugins/PluginStream.cpp
>@@ -167,7 +167,10 @@ void PluginStream::startStream()
>             stringBuilder.append('\n');
>         }
> 
>-        m_headers = stringBuilder.toString().utf8();
>+        if (auto string = stringBuilder.toString())
>+            m_headers = string->utf8();
>+        else
>+            CRASH();
> 
>         // If the content is encoded (most likely compressed), then don't send its length to the plugin,
>         // which is only interested in the decoded length, not yet known at the moment.
>diff --git a/Source/WebKitLegacy/win/WebKitStatistics.cpp b/Source/WebKitLegacy/win/WebKitStatistics.cpp
>index 9002c92..c4b8bf1 100644
>--- a/Source/WebKitLegacy/win/WebKitStatistics.cpp
>+++ b/Source/WebKitLegacy/win/WebKitStatistics.cpp
>@@ -156,6 +156,9 @@ HRESULT WebKitStatistics::comClassNameCounts(__deref_out_opt BSTR* output)
>         builder.append(slot.key);
>         builder.append('\n');
>     }
>-    *output = BString(builder.toString()).release();
>-    return S_OK;
>+    if (auto string = builder.toString()) {
>+        *output = BString(*string).release();
>+        return S_OK;
>+    }
>+    CRASH();
> }
>diff --git a/Tools/ChangeLog b/Tools/ChangeLog
>index da0736f..30a5d24 100644
>--- a/Tools/ChangeLog
>+++ b/Tools/ChangeLog
>@@ -1,3 +1,81 @@
>+2018-04-26  JF Bastien  <jfbastien@apple.com>
>+
>+        StringBuilder is fallible
>+        https://bugs.webkit.org/show_bug.cgi?id=185048
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        StringBuilder can fail when allocating memory. StringBuilder is
>+        mostly used with user input, which often means that just crashing
>+        isn't the right outcome. Our fuzzers often encounter such things
>+        for JavaScriptCore, and so far we've applied point solutions. No
>+        more!
>+
>+        * TestWebKitAPI/Tests/WTF/StringBuilder.cpp:
>+        (TestWebKitAPI::expectBuilderContent):
>+        (TestWebKitAPI::expectEmpty):
>+        (TestWebKitAPI::TEST):
>+        * TestWebKitAPI/Tests/WTF/StringView.cpp:
>+        (TestWebKitAPI::TEST):
>+        * TestWebKitAPI/Tests/WebCore/ContentExtensions.cpp:
>+        (TestWebKitAPI::TEST_F):
>+        * TestWebKitAPI/Tests/WebCore/FileMonitor.cpp:
>+        (TestWebKitAPI::createCommand):
>+        (TestWebKitAPI::TEST_F):
>+        * TestWebKitAPI/Tests/WebCore/Logging.cpp:
>+        (TestWebKitAPI::LoggingTest::output):
>+        (TestWebKitAPI::TEST_F):
>+        (TestWebKitAPI::LogObserver::log):
>+        * TestWebKitAPI/Tests/WebCore/TextCodec.cpp:
>+        (TestWebKitAPI::testDecode):
>+        * TestWebKitAPI/WTFStringUtilities.h:
>+        (utf16String):
>+        * WebKitTestRunner/InjectedBundle/InjectedBundlePage.cpp:
>+        (WTR::dumpPath):
>+        (WTR::rangeToStr):
>+        (WTR::styleDecToStr):
>+        (WTR::securityOriginToStr):
>+        (WTR::frameToStr):
>+        (WTR::dumpLoadEvent):
>+        (WTR::InjectedBundlePage::dump):
>+        (WTR::InjectedBundlePage::didReceiveTitleForFrame):
>+        (WTR::InjectedBundlePage::willPerformClientRedirectForFrame):
>+        (WTR::InjectedBundlePage::didFinishDocumentLoadForFrame):
>+        (WTR::InjectedBundlePage::willSendRequestForFrame):
>+        (WTR::InjectedBundlePage::didReceiveResponseForResource):
>+        (WTR::InjectedBundlePage::didFinishLoadForResource):
>+        (WTR::InjectedBundlePage::didFailLoadForResource):
>+        (WTR::InjectedBundlePage::shouldCacheResponse):
>+        (WTR::InjectedBundlePage::decidePolicyForNavigationAction):
>+        (WTR::InjectedBundlePage::decidePolicyForResponse):
>+        (WTR::InjectedBundlePage::willAddMessageToConsole):
>+        (WTR::InjectedBundlePage::willSetStatusbarText):
>+        (WTR::InjectedBundlePage::willRunJavaScriptAlert):
>+        (WTR::InjectedBundlePage::willRunJavaScriptConfirm):
>+        (WTR::InjectedBundlePage::willRunJavaScriptPrompt):
>+        (WTR::InjectedBundlePage::didReachApplicationCacheOriginQuota):
>+        (WTR::InjectedBundlePage::didExceedDatabaseQuota):
>+        (WTR::InjectedBundlePage::shouldBeginEditing):
>+        (WTR::InjectedBundlePage::shouldEndEditing):
>+        (WTR::InjectedBundlePage::shouldInsertNode):
>+        (WTR::InjectedBundlePage::shouldInsertText):
>+        (WTR::InjectedBundlePage::shouldDeleteRange):
>+        (WTR::InjectedBundlePage::shouldChangeSelectedRange):
>+        (WTR::InjectedBundlePage::shouldApplyStyle):
>+        (WTR::InjectedBundlePage::didBeginEditing):
>+        (WTR::InjectedBundlePage::didEndEditing):
>+        (WTR::InjectedBundlePage::didChange):
>+        (WTR::InjectedBundlePage::didChangeSelection):
>+        * WebKitTestRunner/InjectedBundle/TestRunner.cpp:
>+        (WTR::TestRunner::statisticsDidRunTelemetryCallback):
>+        (WTR::TestRunner::callDidReceiveAllStorageAccessEntriesCallback):
>+        * WebKitTestRunner/TestController.cpp:
>+        (WTR::TestController::decideDestinationWithSuggestedFilename):
>+        (WTR::TestController::downloadDidReceiveServerRedirectToURL):
>+        (WTR::TestController::downloadDidFail):
>+        * WebKitTestRunner/TestInvocation.cpp:
>+        (WTR::TestInvocation::dumpResults):
>+
> 2018-05-01  Eric Carlson  <eric.carlson@apple.com>
> 
>         [MediaStream] remove WK1 support
>diff --git a/Tools/TestWebKitAPI/Tests/WTF/CrossThreadTask.cpp b/Tools/TestWebKitAPI/Tests/WTF/CrossThreadTask.cpp
>index 52c0bcd..f61fa32 100644
>--- a/Tools/TestWebKitAPI/Tests/WTF/CrossThreadTask.cpp
>+++ b/Tools/TestWebKitAPI/Tests/WTF/CrossThreadTask.cpp
>@@ -88,7 +88,9 @@ struct LifetimeLogger {
>         builder.append("-");
>         builder.append(String::number(moveGeneration));
> 
>-        return builder.toString();
>+        if (auto string = builder.toString())
>+            return *string;
>+        CRASH();
>     }
> 
>     const char& name { *"<default>" };
>diff --git a/Tools/TestWebKitAPI/Tests/WTF/StringBuilder.cpp b/Tools/TestWebKitAPI/Tests/WTF/StringBuilder.cpp
>index 6b8e05c..7867500 100644
>--- a/Tools/TestWebKitAPI/Tests/WTF/StringBuilder.cpp
>+++ b/Tools/TestWebKitAPI/Tests/WTF/StringBuilder.cpp
>@@ -1,6 +1,6 @@
> /*
>  * Copyright (C) 2011 Google Inc. All rights reserved.
>- * Copyright (C) 2013 Apple Inc. All rights reserved.
>+ * Copyright (C) 2013-2018 Apple Inc. All rights reserved.
>  *
>  * Redistribution and use in source and binary forms, with or without
>  * modification, are permitted provided that the following conditions are
>@@ -39,16 +39,16 @@ static void expectBuilderContent(const String& expected, const StringBuilder& bu
>     // Not using builder.toString() or builder.toStringPreserveCapacity() because they all
>     // change internal state of builder.
>     if (builder.is8Bit())
>-        EXPECT_EQ(expected, String(builder.characters8(), builder.length()));
>+        EXPECT_EQ(expected, String(builder.characters8().value(), builder.length()));
>     else
>-        EXPECT_EQ(expected, String(builder.characters16(), builder.length()));
>+        EXPECT_EQ(expected, String(builder.characters16().value(), builder.length()));
> }
> 
> void expectEmpty(const StringBuilder& builder)
> {
>     EXPECT_EQ(0U, builder.length());
>     EXPECT_TRUE(builder.isEmpty());
>-    EXPECT_EQ(0, builder.characters8());
>+    EXPECT_EQ(0, builder.characters8().value());
> }
> 
> TEST(StringBuilderTest, DefaultConstructor)
>@@ -71,24 +71,24 @@ TEST(StringBuilderTest, Append)
>     builder.append('#');
>     expectBuilderContent("0123456789abcdefg#", builder);
> 
>-    builder.toString(); // Test after reifyString().
>+    builder.toString().value(); // Test after reifyString().
>     StringBuilder builder1;
>     builder.append("", 0);
>     expectBuilderContent("0123456789abcdefg#", builder);
>-    builder1.append(builder.characters8(), builder.length());
>+    builder1.append(builder.characters8().value(), builder.length());
>     builder1.append("XYZ");
>-    builder.append(builder1.characters8(), builder1.length());
>+    builder.append(builder1.characters8().value(), builder1.length());
>     expectBuilderContent("0123456789abcdefg#0123456789abcdefg#XYZ", builder);
> 
>     StringBuilder builder2;
>     builder2.reserveCapacity(100);
>     builder2.append("xyz");
>-    const LChar* characters = builder2.characters8();
>+    const LChar* characters = builder2.characters8().value();
>     builder2.append("0123456789");
>-    ASSERT_EQ(characters, builder2.characters8());
>-    builder2.toStringPreserveCapacity(); // Test after reifyString with buffer preserved.
>+    ASSERT_EQ(characters, builder2.characters8().value());
>+    builder2.toStringPreserveCapacity().value(); // Test after reifyString with buffer preserved.
>     builder2.append("abcd");
>-    ASSERT_EQ(characters, builder2.characters8());
>+    ASSERT_EQ(characters, builder2.characters8().value());
> 
>     // Test appending UChar32 characters to StringBuilder.
>     StringBuilder builderForUChar32Append;
>@@ -105,9 +105,9 @@ TEST(StringBuilderTest, ToString)
> {
>     StringBuilder builder;
>     builder.append("0123456789");
>-    String string = builder.toString();
>+    String string = builder.toString().value();
>     ASSERT_EQ(String("0123456789"), string);
>-    ASSERT_EQ(string.impl(), builder.toString().impl());
>+    ASSERT_EQ(string.impl(), builder.toString().value().impl());
> 
>     // Changing the StringBuilder should not affect the original result of toString().
>     builder.append("abcdefghijklmnopqrstuvwxyz");
>@@ -115,20 +115,20 @@ TEST(StringBuilderTest, ToString)
> 
>     // Changing the StringBuilder should not affect the original result of toString() in case the capacity is not changed.
>     builder.reserveCapacity(200);
>-    string = builder.toString();
>+    string = builder.toString().value();
>     ASSERT_EQ(String("0123456789abcdefghijklmnopqrstuvwxyz"), string);
>     builder.append("ABC");
>     ASSERT_EQ(String("0123456789abcdefghijklmnopqrstuvwxyz"), string);
> 
>     // Changing the original result of toString() should not affect the content of the StringBuilder.
>-    String string1 = builder.toString();
>+    String string1 = builder.toString().value();
>     ASSERT_EQ(String("0123456789abcdefghijklmnopqrstuvwxyzABC"), string1);
>     string1.append("DEF");
>-    ASSERT_EQ(String("0123456789abcdefghijklmnopqrstuvwxyzABC"), builder.toString());
>+    ASSERT_EQ(String("0123456789abcdefghijklmnopqrstuvwxyzABC"), builder.toString().value());
>     ASSERT_EQ(String("0123456789abcdefghijklmnopqrstuvwxyzABCDEF"), string1);
> 
>     // Resizing the StringBuilder should not affect the original result of toString().
>-    string1 = builder.toString();
>+    string1 = builder.toString().value();
>     builder.resize(10);
>     builder.append("###");
>     ASSERT_EQ(String("0123456789abcdefghijklmnopqrstuvwxyzABC"), string1);
>@@ -139,11 +139,11 @@ TEST(StringBuilderTest, ToStringPreserveCapacity)
>     StringBuilder builder;
>     builder.append("0123456789");
>     unsigned capacity = builder.capacity();
>-    String string = builder.toStringPreserveCapacity();
>+    String string = builder.toStringPreserveCapacity().value();
>     ASSERT_EQ(capacity, builder.capacity());
>     ASSERT_EQ(String("0123456789"), string);
>-    ASSERT_EQ(string.impl(), builder.toStringPreserveCapacity().impl());
>-    ASSERT_EQ(string.characters8(), builder.characters8());
>+    ASSERT_EQ(string.impl(), builder.toStringPreserveCapacity().value().impl());
>+    ASSERT_EQ(string.characters8(), builder.characters8().value());
> 
>     // Changing the StringBuilder should not affect the original result of toStringPreserveCapacity().
>     builder.append("abcdefghijklmnopqrstuvwxyz");
>@@ -152,28 +152,28 @@ TEST(StringBuilderTest, ToStringPreserveCapacity)
>     // Changing the StringBuilder should not affect the original result of toStringPreserveCapacity() in case the capacity is not changed.
>     builder.reserveCapacity(200);
>     capacity = builder.capacity();
>-    string = builder.toStringPreserveCapacity();
>+    string = builder.toStringPreserveCapacity().value();
>     ASSERT_EQ(capacity, builder.capacity());
>-    ASSERT_EQ(string.characters8(), builder.characters8());
>+    ASSERT_EQ(string.characters8(), builder.characters8().value());
>     ASSERT_EQ(String("0123456789abcdefghijklmnopqrstuvwxyz"), string);
>     builder.append("ABC");
>     ASSERT_EQ(String("0123456789abcdefghijklmnopqrstuvwxyz"), string);
> 
>     // Changing the original result of toStringPreserveCapacity() should not affect the content of the StringBuilder.
>     capacity = builder.capacity();
>-    String string1 = builder.toStringPreserveCapacity();
>+    String string1 = builder.toStringPreserveCapacity().value();
>     ASSERT_EQ(capacity, builder.capacity());
>-    ASSERT_EQ(string1.characters8(), builder.characters8());
>+    ASSERT_EQ(string1.characters8(), builder.characters8().value());
>     ASSERT_EQ(String("0123456789abcdefghijklmnopqrstuvwxyzABC"), string1);
>     string1.append("DEF");
>-    ASSERT_EQ(String("0123456789abcdefghijklmnopqrstuvwxyzABC"), builder.toStringPreserveCapacity());
>+    ASSERT_EQ(String("0123456789abcdefghijklmnopqrstuvwxyzABC"), builder.toStringPreserveCapacity().value());
>     ASSERT_EQ(String("0123456789abcdefghijklmnopqrstuvwxyzABCDEF"), string1);
> 
>     // Resizing the StringBuilder should not affect the original result of toStringPreserveCapacity().
>     capacity = builder.capacity();
>-    string1 = builder.toStringPreserveCapacity();
>+    string1 = builder.toStringPreserveCapacity().value();
>     ASSERT_EQ(capacity, builder.capacity());
>-    ASSERT_EQ(string.characters8(), builder.characters8());
>+    ASSERT_EQ(string.characters8(), builder.characters8().value());
>     builder.resize(10);
>     builder.append("###");
>     ASSERT_EQ(String("0123456789abcdefghijklmnopqrstuvwxyzABC"), string1);
>@@ -191,11 +191,11 @@ TEST(StringBuilderTest, Array)
> {
>     StringBuilder builder;
>     builder.append("0123456789");
>-    EXPECT_EQ('0', static_cast<char>(builder[0]));
>-    EXPECT_EQ('9', static_cast<char>(builder[9]));
>-    builder.toString(); // Test after reifyString().
>-    EXPECT_EQ('0', static_cast<char>(builder[0]));
>-    EXPECT_EQ('9', static_cast<char>(builder[9]));
>+    EXPECT_EQ('0', static_cast<char>(builder[0].value()));
>+    EXPECT_EQ('9', static_cast<char>(builder[9].value()));
>+    builder.toString().value(); // Test after reifyString().
>+    EXPECT_EQ('0', static_cast<char>(builder[0].value()));
>+    EXPECT_EQ('9', static_cast<char>(builder[9].value()));
> }
> 
> TEST(StringBuilderTest, Resize)
>@@ -209,7 +209,7 @@ TEST(StringBuilderTest, Resize)
>     EXPECT_EQ(8U, builder.length());
>     expectBuilderContent("01234567", builder);
> 
>-    builder.toString();
>+    builder.toString().value();
>     builder.resize(7);
>     EXPECT_EQ(7U, builder.length());
>     expectBuilderContent("0123456", builder);
>@@ -240,13 +240,13 @@ TEST(StringBuilderTest, Equal)
>     ASSERT_TRUE(builder2 != builder1);
>     ASSERT_TRUE(String("123") != builder2);
>     ASSERT_TRUE(builder2 != String("123"));
>-    builder2.toString(); // Test after reifyString().
>+    builder2.toString().value(); // Test after reifyString().
>     ASSERT_TRUE(builder1 != builder2);
> 
>     builder2.resize(3);
>     ASSERT_TRUE(builder1 == builder2);
> 
>-    builder1.toString(); // Test after reifyString().
>+    builder1.toString().value(); // Test after reifyString().
>     ASSERT_TRUE(builder1 == builder2);
> }
> 
>@@ -265,14 +265,14 @@ TEST(StringBuilderTest, ToAtomicString)
> {
>     StringBuilder builder;
>     builder.append("123");
>-    AtomicString atomicString = builder.toAtomicString();
>+    AtomicString atomicString = builder.toAtomicString().value();
>     ASSERT_EQ(String("123"), atomicString);
> 
>     builder.reserveCapacity(256);
>     ASSERT_TRUE(builder.canShrink());
>     for (int i = builder.length(); i < 128; i++)
>         builder.append('x');
>-    AtomicString atomicString1 = builder.toAtomicString();
>+    AtomicString atomicString1 = builder.toAtomicString().value();
>     ASSERT_EQ(128u, atomicString1.length());
>     ASSERT_EQ('x', atomicString1[127]);
> 
>@@ -282,8 +282,8 @@ TEST(StringBuilderTest, ToAtomicString)
>     ASSERT_EQ(128u, atomicString1.length());
> 
>     ASSERT_FALSE(builder.canShrink());
>-    String string = builder.toString();
>-    AtomicString atomicString2 = builder.toAtomicString();
>+    String string = builder.toString().value();
>+    AtomicString atomicString2 = builder.toAtomicString().value();
>     // They should share the same StringImpl.
>     ASSERT_EQ(atomicString2.impl(), string.impl());
> }
>@@ -292,45 +292,45 @@ TEST(StringBuilderTest, ToAtomicStringOnEmpty)
> {
>     { // Default constructed.
>         StringBuilder builder;
>-        AtomicString atomicString = builder.toAtomicString();
>+        AtomicString atomicString = builder.toAtomicString().value();
>         ASSERT_EQ(emptyAtom(), atomicString);
>     }
>     { // With capacity.
>         StringBuilder builder;
>         builder.reserveCapacity(64);
>-        AtomicString atomicString = builder.toAtomicString();
>+        AtomicString atomicString = builder.toAtomicString().value();
>         ASSERT_EQ(emptyAtom(), atomicString);
>     }
>     { // AtomicString constructed from a null string.
>         StringBuilder builder;
>         builder.append(String());
>-        AtomicString atomicString = builder.toAtomicString();
>+        AtomicString atomicString = builder.toAtomicString().value();
>         ASSERT_EQ(emptyAtom(), atomicString);
>     }
>     { // AtomicString constructed from an empty string.
>         StringBuilder builder;
>         builder.append(emptyString());
>-        AtomicString atomicString = builder.toAtomicString();
>+        AtomicString atomicString = builder.toAtomicString().value();
>         ASSERT_EQ(emptyAtom(), atomicString);
>     }
>     { // AtomicString constructed from an empty StringBuilder.
>         StringBuilder builder;
>         StringBuilder emptyBuilder;
>         builder.append(emptyBuilder);
>-        AtomicString atomicString = builder.toAtomicString();
>+        AtomicString atomicString = builder.toAtomicString().value();
>         ASSERT_EQ(emptyAtom(), atomicString);
>     }
>     { // AtomicString constructed from an empty char* string.
>         StringBuilder builder;
>         builder.append("", 0);
>-        AtomicString atomicString = builder.toAtomicString();
>+        AtomicString atomicString = builder.toAtomicString().value();
>         ASSERT_EQ(emptyAtom(), atomicString);
>     }
>     { // Cleared StringBuilder.
>         StringBuilder builder;
>         builder.appendLiteral("WebKit");
>         builder.clear();
>-        AtomicString atomicString = builder.toAtomicString();
>+        AtomicString atomicString = builder.toAtomicString().value();
>         ASSERT_EQ(emptyAtom(), atomicString);
>     }
> }
>diff --git a/Tools/TestWebKitAPI/Tests/WTF/StringView.cpp b/Tools/TestWebKitAPI/Tests/WTF/StringView.cpp
>index fc28b00..8b28309 100644
>--- a/Tools/TestWebKitAPI/Tests/WTF/StringView.cpp
>+++ b/Tools/TestWebKitAPI/Tests/WTF/StringView.cpp
>@@ -164,65 +164,65 @@ TEST(WTF, StringViewIterators)
> 
>     StringBuilder b;
>     build(b, {0xD800, 0xDD55}); // Surrogates for unicode code point U+10155
>-    EXPECT_TRUE(compareLoopIterations(StringView(b.toString()).codePoints(), {0x10155}));
>-    EXPECT_TRUE(compareLoopIterations(StringView(b.toString()).codeUnits(), {0xD800, 0xDD55}));
>-    EXPECT_TRUE(compareLoopIterations(StringView(b.toString()).graphemeClusters(), {StringView(b.toString())}));
>+    EXPECT_TRUE(compareLoopIterations(StringView(b.toString().value()).codePoints(), {0x10155}));
>+    EXPECT_TRUE(compareLoopIterations(StringView(b.toString().value()).codeUnits(), {0xD800, 0xDD55}));
>+    EXPECT_TRUE(compareLoopIterations(StringView(b.toString().value()).graphemeClusters(), {StringView(b.toString().value())}));
> 
>     build(b, {0xD800}); // Leading surrogate only
>-    EXPECT_TRUE(compareLoopIterations(StringView(b.toString()).codePoints(), {0xD800}));
>-    EXPECT_TRUE(compareLoopIterations(StringView(b.toString()).codeUnits(), {0xD800}));
>-    EXPECT_TRUE(compareLoopIterations(StringView(b.toString()).graphemeClusters(), {StringView(b.toString())}));
>+    EXPECT_TRUE(compareLoopIterations(StringView(b.toString().value()).codePoints(), {0xD800}));
>+    EXPECT_TRUE(compareLoopIterations(StringView(b.toString().value()).codeUnits(), {0xD800}));
>+    EXPECT_TRUE(compareLoopIterations(StringView(b.toString().value()).graphemeClusters(), {StringView(b.toString().value())}));
> 
>     build(b, {0xD800, 0xD801}); // Two leading surrogates
>-    EXPECT_TRUE(compareLoopIterations(StringView(b.toString()).codePoints(), {0xD800, 0xD801}));
>-    EXPECT_TRUE(compareLoopIterations(StringView(b.toString()).codeUnits(), {0xD800, 0xD801}));
>-    EXPECT_TRUE(compareLoopIterations(StringView(b.toString()).graphemeClusters(), {StringView(b.characters16(), 1), StringView(b.characters16() + 1, 1)}));
>+    EXPECT_TRUE(compareLoopIterations(StringView(b.toString().value()).codePoints(), {0xD800, 0xD801}));
>+    EXPECT_TRUE(compareLoopIterations(StringView(b.toString().value()).codeUnits(), {0xD800, 0xD801}));
>+    EXPECT_TRUE(compareLoopIterations(StringView(b.toString().value()).graphemeClusters(), {StringView(b.characters16().value(), 1), StringView(b.characters16().value() + 1, 1)}));
> 
>     build(b, {0xDD55}); // Trailing surrogate only
>-    EXPECT_TRUE(compareLoopIterations(StringView(b.toString()).codePoints(), {0xDD55}));
>-    EXPECT_TRUE(compareLoopIterations(StringView(b.toString()).codeUnits(), {0xDD55}));
>-    EXPECT_TRUE(compareLoopIterations(StringView(b.toString()).graphemeClusters(), {StringView(b.toString())}));
>+    EXPECT_TRUE(compareLoopIterations(StringView(b.toString().value()).codePoints(), {0xDD55}));
>+    EXPECT_TRUE(compareLoopIterations(StringView(b.toString().value()).codeUnits(), {0xDD55}));
>+    EXPECT_TRUE(compareLoopIterations(StringView(b.toString().value()).graphemeClusters(), {StringView(b.toString().value())}));
> 
>     build(b, {0xD800, 'h'}); // Leading surrogate followed by non-surrogate
>-    EXPECT_TRUE(compareLoopIterations(StringView(b.toString()).codePoints(), {0xD800, 'h'}));
>-    EXPECT_TRUE(compareLoopIterations(StringView(b.toString()).codeUnits(), {0xD800, 'h'}));
>-    EXPECT_TRUE(compareLoopIterations(StringView(b.toString()).graphemeClusters(), {StringView(b.characters16(), 1), StringView(b.characters16() + 1, 1)}));
>+    EXPECT_TRUE(compareLoopIterations(StringView(b.toString().value()).codePoints(), {0xD800, 'h'}));
>+    EXPECT_TRUE(compareLoopIterations(StringView(b.toString().value()).codeUnits(), {0xD800, 'h'}));
>+    EXPECT_TRUE(compareLoopIterations(StringView(b.toString().value()).graphemeClusters(), {StringView(b.characters16().value(), 1), StringView(b.characters16().value() + 1, 1)}));
> 
>     build(b, {0x0306}); // "COMBINING BREVE"
>-    EXPECT_TRUE(compareLoopIterations(StringView(b.toString()).codePoints(), {0x0306}));
>-    EXPECT_TRUE(compareLoopIterations(StringView(b.toString()).codeUnits(), {0x0306}));
>-    EXPECT_TRUE(compareLoopIterations(StringView(b.toString()).graphemeClusters(), {StringView(b.toString())}));
>+    EXPECT_TRUE(compareLoopIterations(StringView(b.toString().value()).codePoints(), {0x0306}));
>+    EXPECT_TRUE(compareLoopIterations(StringView(b.toString().value()).codeUnits(), {0x0306}));
>+    EXPECT_TRUE(compareLoopIterations(StringView(b.toString().value()).graphemeClusters(), {StringView(b.toString().value())}));
> 
>     build(b, {0x0306, 0xD800, 0xDD55, 'h', 'e', 'l', 'o'}); // Mix of single code unit and multi code unit code points
>-    EXPECT_TRUE(compareLoopIterations(StringView(b.toString()).codePoints(), {0x0306, 0x10155, 'h', 'e', 'l', 'o'}));
>-    EXPECT_TRUE(compareLoopIterations(StringView(b.toString()).codeUnits(), {0x0306, 0xD800, 0xDD55, 'h', 'e', 'l', 'o'}));
>-    EXPECT_TRUE(compareLoopIterations(StringView(b.toString()).graphemeClusters(), {
>-        StringView(b.characters16(), 1),
>-        StringView(b.characters16() + 1, 2),
>-        StringView(b.characters16() + 3, 1),
>-        StringView(b.characters16() + 4, 1),
>-        StringView(b.characters16() + 5, 1),
>-        StringView(b.characters16() + 6, 1)}));
>+    EXPECT_TRUE(compareLoopIterations(StringView(b.toString().value()).codePoints(), {0x0306, 0x10155, 'h', 'e', 'l', 'o'}));
>+    EXPECT_TRUE(compareLoopIterations(StringView(b.toString().value()).codeUnits(), {0x0306, 0xD800, 0xDD55, 'h', 'e', 'l', 'o'}));
>+    EXPECT_TRUE(compareLoopIterations(StringView(b.toString().value()).graphemeClusters(), {
>+        StringView(b.characters16().value(), 1),
>+        StringView(b.characters16().value() + 1, 2),
>+        StringView(b.characters16().value() + 3, 1),
>+        StringView(b.characters16().value() + 4, 1),
>+        StringView(b.characters16().value() + 5, 1),
>+        StringView(b.characters16().value() + 6, 1)}));
> 
>     build(b, {'e', 0x0301}); // "COMBINING ACUTE"
>-    EXPECT_TRUE(compareLoopIterations(StringView(b.toString()).codePoints(), {'e', 0x0301}));
>-    EXPECT_TRUE(compareLoopIterations(StringView(b.toString()).codeUnits(), {'e', 0x0301}));
>-    EXPECT_TRUE(compareLoopIterations(StringView(b.toString()).graphemeClusters(), {StringView(b.toString())}));
>+    EXPECT_TRUE(compareLoopIterations(StringView(b.toString().value()).codePoints(), {'e', 0x0301}));
>+    EXPECT_TRUE(compareLoopIterations(StringView(b.toString().value()).codeUnits(), {'e', 0x0301}));
>+    EXPECT_TRUE(compareLoopIterations(StringView(b.toString().value()).graphemeClusters(), {StringView(b.toString().value())}));
> 
>     build(b, {'e', 0x0301, 0x0306, 'a'}); // "COMBINING ACUTE" "COMBINING BREVE"
>-    EXPECT_TRUE(compareLoopIterations(StringView(b.toString()).codePoints(), {'e', 0x0301, 0x0306, 'a'}));
>-    EXPECT_TRUE(compareLoopIterations(StringView(b.toString()).codeUnits(), {'e', 0x0301, 0x0306, 'a'}));
>-    EXPECT_TRUE(compareLoopIterations(StringView(b.toString()).graphemeClusters(), {
>-        StringView(b.characters16(), 3),
>-        StringView(b.characters16() + 3, 1),
>+    EXPECT_TRUE(compareLoopIterations(StringView(b.toString().value()).codePoints(), {'e', 0x0301, 0x0306, 'a'}));
>+    EXPECT_TRUE(compareLoopIterations(StringView(b.toString().value()).codeUnits(), {'e', 0x0301, 0x0306, 'a'}));
>+    EXPECT_TRUE(compareLoopIterations(StringView(b.toString().value()).graphemeClusters(), {
>+        StringView(b.characters16().value(), 3),
>+        StringView(b.characters16().value() + 3, 1),
>         }));
> 
>     build(b, {0x1112, 0x116f, 0x11b6, 0x1107, 0x1161, 0x11B8}); // Korean combining Jamo
>-    EXPECT_TRUE(compareLoopIterations(StringView(b.toString()).codePoints(), {0x1112, 0x116f, 0x11b6, 0x1107, 0x1161, 0x11B8}));
>-    EXPECT_TRUE(compareLoopIterations(StringView(b.toString()).codeUnits(), {0x1112, 0x116f, 0x11b6, 0x1107, 0x1161, 0x11B8}));
>-    EXPECT_TRUE(compareLoopIterations(StringView(b.toString()).graphemeClusters(), {
>-        StringView(b.characters16(), 3),
>-        StringView(b.characters16() + 3, 3)}));
>+    EXPECT_TRUE(compareLoopIterations(StringView(b.toString().value()).codePoints(), {0x1112, 0x116f, 0x11b6, 0x1107, 0x1161, 0x11B8}));
>+    EXPECT_TRUE(compareLoopIterations(StringView(b.toString().value()).codeUnits(), {0x1112, 0x116f, 0x11b6, 0x1107, 0x1161, 0x11B8}));
>+    EXPECT_TRUE(compareLoopIterations(StringView(b.toString().value()).graphemeClusters(), {
>+        StringView(b.characters16().value(), 3),
>+        StringView(b.characters16().value() + 3, 3)}));
> }
> 
> static Vector<String> vectorFromSplitResult(const StringView::SplitResult& substrings)
>diff --git a/Tools/TestWebKitAPI/Tests/WebCore/ContentExtensions.cpp b/Tools/TestWebKitAPI/Tests/WebCore/ContentExtensions.cpp
>index dcce468..0383864 100644
>--- a/Tools/TestWebKitAPI/Tests/WebCore/ContentExtensions.cpp
>+++ b/Tools/TestWebKitAPI/Tests/WebCore/ContentExtensions.cpp
>@@ -1209,15 +1209,18 @@ TEST_F(ContentExtensionTest, WideNFA)
>         }
>     }
>     ruleList.append(']');
>-    
>-    auto backend = makeBackend(ruleList.toString().utf8().data());
> 
>-    testRequest(backend, mainDocumentRequest("http://webkit.org/AAA"), { ContentExtensions::ActionType::CSSDisplayNoneSelector });
>-    testRequest(backend, mainDocumentRequest("http://webkit.org/YAA"), { ContentExtensions::ActionType::CSSDisplayNoneSelector });
>-    testRequest(backend, mainDocumentRequest("http://webkit.org/ZAA"), { }, 0);
>-    testRequest(backend, mainDocumentRequest("http://webkit.org/LAA/AAA"), { }, 0);
>-    testRequest(backend, mainDocumentRequest("http://webkit.org/LAA/MAA"), { ContentExtensions::ActionType::CSSDisplayNoneSelector }, 0);
>-    testRequest(backend, mainDocumentRequest("http://webkit.org/"), { });
>+    if (auto string = ruleList.toString()) {
>+        auto backend = makeBackend(string->utf8().data());
>+
>+        testRequest(backend, mainDocumentRequest("http://webkit.org/AAA"), { ContentExtensions::ActionType::CSSDisplayNoneSelector });
>+        testRequest(backend, mainDocumentRequest("http://webkit.org/YAA"), { ContentExtensions::ActionType::CSSDisplayNoneSelector });
>+        testRequest(backend, mainDocumentRequest("http://webkit.org/ZAA"), { }, 0);
>+        testRequest(backend, mainDocumentRequest("http://webkit.org/LAA/AAA"), { }, 0);
>+        testRequest(backend, mainDocumentRequest("http://webkit.org/LAA/MAA"), { ContentExtensions::ActionType::CSSDisplayNoneSelector }, 0);
>+        testRequest(backend, mainDocumentRequest("http://webkit.org/"), { });
>+    } else
>+        CRASH();
> }
>     
> #ifdef NDEBUG
>@@ -1247,7 +1250,10 @@ TEST_F(ContentExtensionTest, LargeJumps)
>                     pattern.append(c2);
>                     pattern.append(c3);
>                     pattern.append(c4);
>-                    EXPECT_EQ(ContentExtensions::URLFilterParser::ParseStatus::Ok, parser.addPattern(pattern.toString(), true, patternId++));
>+                    if (auto string = pattern.toString())
>+                        EXPECT_EQ(ContentExtensions::URLFilterParser::ParseStatus::Ok, parser.addPattern(*string, true, patternId++));
>+                    else
>+                        CRASH();
>                 }
>             }
>         }
>@@ -1308,17 +1314,20 @@ TEST_F(ContentExtensionTest, LargeJumps)
>                         pattern.append('x');
>                         break;
>                     }
>-                    auto matches = interpreter.interpret(pattern.toString().utf8(), 0);
>-                    switch ((c1 + c2 + c3 + c4) % 4) {
>-                    case 0:
>-                        compareContents(matches, { });
>-                        break;
>-                    case 1:
>-                    case 2:
>-                    case 3:
>-                        compareContents(matches, {patternId});
>-                        break;
>-                    }
>+                    if (auto string = pattern.toString()) {
>+                        auto matches = interpreter.interpret(string->utf8(), 0);
>+                        switch ((c1 + c2 + c3 + c4) % 4) {
>+                        case 0:
>+                            compareContents(matches, { });
>+                            break;
>+                        case 1:
>+                        case 2:
>+                        case 3:
>+                            compareContents(matches, {patternId});
>+                            break;
>+                        }
>+                    } else
>+                        CRASH();
>                     patternId++;
>                 }
>             }
>@@ -1348,13 +1357,19 @@ TEST_F(ContentExtensionTest, DeepNFA)
>     StringBuilder lotsOfAs;
>     for (unsigned i = 0; i < size; ++i)
>         lotsOfAs.append('A');
>-    EXPECT_EQ(ContentExtensions::URLFilterParser::ParseStatus::Ok, parser.addPattern(lotsOfAs.toString().utf8().data(), false, 0));
>+    if (auto string = lotsOfAs.toString())
>+        EXPECT_EQ(ContentExtensions::URLFilterParser::ParseStatus::Ok, parser.addPattern(string->utf8().data(), false, 0));
>+    else
>+        CRASH();
>     
>     // FIXME: Yarr ought to be able to handle 2MB regular expressions.
>     StringBuilder tooManyAs;
>     for (unsigned i = 0; i < size * 20; ++i)
>         tooManyAs.append('A');
>-    EXPECT_EQ(ContentExtensions::URLFilterParser::ParseStatus::YarrError, parser.addPattern(tooManyAs.toString().utf8().data(), false, 0));
>+    if (auto string = tooManyAs.toString())
>+        EXPECT_EQ(ContentExtensions::URLFilterParser::ParseStatus::YarrError, parser.addPattern(string->utf8().data(), false, 0));
>+    else
>+        CRASH();
>     
>     StringBuilder nestedGroups;
>     for (unsigned i = 0; i < size; ++i)
>@@ -1490,17 +1505,22 @@ TEST_F(ContentExtensionTest, InvalidJSON)
>     checkCompilerError("[{\"action\":{\"type\":\"notify\",\"notification\":[]},\"trigger\":{\"url-filter\":\".*\"}}]", ContentExtensions::ContentExtensionError::JSONInvalidNotification);
>     checkCompilerError("[{\"action\":{\"type\":\"notify\",\"notification\":\"here's my notification\"},\"trigger\":{\"url-filter\":\".*\"}}]", { });
>     checkCompilerError("[{\"action\":{\"type\":\"notify\",\"notification\":\"\\u1234\"},\"trigger\":{\"url-filter\":\".*\"}}]", { });
>-    
>-    StringBuilder rules;
>-    rules.append("[");
>-    for (unsigned i = 0; i < 49999; ++i)
>-        rules.append("{\"action\":{\"type\":\"block\"},\"trigger\":{\"url-filter\":\"a\"}},");
>-    String rules50000 = rules.toString();
>-    String rules50001 = rules.toString();
>-    rules50000.append("{\"action\":{\"type\":\"block\"},\"trigger\":{\"url-filter\":\"a\"}}]");
>-    rules50001.append("{\"action\":{\"type\":\"block\"},\"trigger\":{\"url-filter\":\"a\"}},{\"action\":{\"type\":\"block\"},\"trigger\":{\"url-filter\":\"a\"}}]");
>-    checkCompilerError(rules50000.utf8().data(), { });
>-    checkCompilerError(rules50001.utf8().data(), ContentExtensions::ContentExtensionError::JSONTooManyRules);
>+
>+    {
>+        StringBuilder rules;
>+        rules.append("[");
>+        for (unsigned i = 0; i < 49999; ++i)
>+            rules.append("{\"action\":{\"type\":\"block\"},\"trigger\":{\"url-filter\":\"a\"}},");
>+        if (auto string = rules.toString()) {
>+            String rules50000 = *string;
>+            String rules50001 = *string;
>+            rules50000.append("{\"action\":{\"type\":\"block\"},\"trigger\":{\"url-filter\":\"a\"}}]");
>+            rules50001.append("{\"action\":{\"type\":\"block\"},\"trigger\":{\"url-filter\":\"a\"}},{\"action\":{\"type\":\"block\"},\"trigger\":{\"url-filter\":\"a\"}}]");
>+            checkCompilerError(rules50000.utf8().data(), { });
>+            checkCompilerError(rules50001.utf8().data(), ContentExtensions::ContentExtensionError::JSONTooManyRules);
>+        } else
>+            CRASH();
>+    }
>     
>     checkCompilerError("[{\"action\":{\"type\":\"block\"},\"trigger\":{\"url-filter\":\"webkit.org\",\"if-domain\":{}}}]", ContentExtensions::ContentExtensionError::JSONInvalidConditionList);
>     checkCompilerError("[{\"action\":{\"type\":\"block\"},\"trigger\":{\"url-filter\":\"webkit.org\",\"if-domain\":[5]}}]", ContentExtensions::ContentExtensionError::JSONInvalidConditionList);
>diff --git a/Tools/TestWebKitAPI/Tests/WebCore/FileMonitor.cpp b/Tools/TestWebKitAPI/Tests/WebCore/FileMonitor.cpp
>index 5f1dc8b..e94efc4 100644
>--- a/Tools/TestWebKitAPI/Tests/WebCore/FileMonitor.cpp
>+++ b/Tools/TestWebKitAPI/Tests/WebCore/FileMonitor.cpp
>@@ -107,7 +107,9 @@ static String createCommand(const String& path, const String& payload)
>     command.appendLiteral("\" > ");
>     command.append(path);
> 
>-    return command.toString();
>+    if (auto string = command.toString())
>+        return *string;
>+    CRASH();
> }
> 
> static String readContentsOfFile(const String& path)
>@@ -267,10 +269,13 @@ TEST_F(FileMonitorTest, DetectDeletion)
>         command.appendLiteral("rm -f ");
>         command.append(tempFilePath());
> 
>-        auto rc = system(command.toString().utf8().data());
>-        ASSERT_NE(rc, -1);
>-        if (rc == -1)
>-            didFinish = true;
>+        if (auto string = command.toString()) {
>+            auto rc = system(string->utf8().data());
>+            ASSERT_NE(rc, -1);
>+            if (rc == -1)
>+                didFinish = true;
>+        } else
>+            CRASH();
>     });
> 
>     Util::run(&didFinish);
>@@ -324,10 +329,13 @@ TEST_F(FileMonitorTest, DetectChangeAndThenDelete)
>         command.appendLiteral("rm -f ");
>         command.append(tempFilePath());
> 
>-        auto rc = system(command.toString().utf8().data());
>-        ASSERT_NE(rc, -1);
>-        if (rc == -1)
>-            didFinish = true;
>+        if (auto string = command.toString()) {
>+            auto rc = system(string->utf8().data());
>+            ASSERT_NE(rc, -1);
>+            if (rc == -1)
>+                didFinish = true;
>+        } else
>+            CRASH();
>     });
> 
>     Util::run(&didFinish);
>@@ -363,10 +371,13 @@ TEST_F(FileMonitorTest, DetectDeleteButNotSubsequentChange)
>         command.appendLiteral("rm -f ");
>         command.append(tempFilePath());
> 
>-        auto rc = system(command.toString().utf8().data());
>-        ASSERT_NE(rc, -1);
>-        if (rc == -1)
>-            didFinish = true;
>+        if (auto string = command.toString()) {
>+            auto rc = system(string->utf8().data());
>+            ASSERT_NE(rc, -1);
>+            if (rc == -1)
>+                didFinish = true;
>+        } else
>+            CRASH();
>     });
> 
>     Util::run(&didFinish);
>diff --git a/Tools/TestWebKitAPI/Tests/WebCore/Logging.cpp b/Tools/TestWebKitAPI/Tests/WebCore/Logging.cpp
>index 1e4c342..7dedad2 100644
>--- a/Tools/TestWebKitAPI/Tests/WebCore/Logging.cpp
>+++ b/Tools/TestWebKitAPI/Tests/WebCore/Logging.cpp
>@@ -95,7 +95,9 @@ public:
>         while ((line = fgets(buffer, sizeof(buffer), m_stderr)))
>             result.append(line);
> 
>-        return result.toString();
>+        if (auto string = result.toString())
>+            return *string;
>+        CRASH();
>     }
> 
>     const Logger& logger() const final { return m_logger.get(); }
>@@ -340,15 +342,18 @@ TEST_F(LoggingTest, LoggerHelper)
>     builder.appendLiteral("LoggingTest::TestBody(");
>     appendUnsigned64AsHex(reinterpret_cast<uintptr_t>(logIdentifier()), builder);
>     builder.appendLiteral(")");
>-    String signature = builder.toString();
>+    if (auto string = builder.toString()) {
>+        String signature = *string;
> 
>-    ALWAYS_LOG(LOGIDENTIFIER);
>-    EXPECT_TRUE(this->output().contains(signature, false));
>+        ALWAYS_LOG(LOGIDENTIFIER);
>+        EXPECT_TRUE(this->output().contains(signature, false));
> 
>-    ALWAYS_LOG(LOGIDENTIFIER, "Welcome back", " my friends", " to the show", " that never ends");
>-    String result = this->output();
>-    EXPECT_TRUE(result.contains(signature, false));
>-    EXPECT_TRUE(result.contains("to the show that never", false));
>+        ALWAYS_LOG(LOGIDENTIFIER, "Welcome back", " my friends", " to the show", " that never ends");
>+        String result = this->output();
>+        EXPECT_TRUE(result.contains(signature, false));
>+        EXPECT_TRUE(result.contains("to the show that never", false));
>+    } else
>+        CRASH();
> 
>     WTFSetLogChannelLevel(&TestChannel1, WTFLogLevelWarning);
> 
>@@ -371,10 +376,11 @@ public:
> 
>     String log()
>     {
>-        String log = m_logBuffer.toString();
>-        m_logBuffer.clear();
>-
>-        return log;
>+        if (auto log = m_logBuffer.toString()) {
>+            m_logBuffer.clear();
>+            return log;
>+        }
>+        CRASH();
>     }
> 
>     WTFLogChannel channel() const { return m_lastChannel; }
>diff --git a/Tools/TestWebKitAPI/Tests/WebCore/TextCodec.cpp b/Tools/TestWebKitAPI/Tests/WebCore/TextCodec.cpp
>index fd05050..9e55530 100644
>--- a/Tools/TestWebKitAPI/Tests/WebCore/TextCodec.cpp
>+++ b/Tools/TestWebKitAPI/Tests/WebCore/TextCodec.cpp
>@@ -98,7 +98,9 @@ static const char* testDecode(const char* encodingName, std::initializer_list<co
>         if (sawError)
>             resultBuilder.appendLiteral(" ERROR");
>     }
>-    return escapeNonASCIIPrintableCharacters(resultBuilder.toString());
>+    if (auto string = resultBuilder.toString())
>+        return escapeNonASCIIPrintableCharacters(*string);
>+    CRASH();
> }
> 
> TEST(TextCodec, UTF8)
>diff --git a/Tools/TestWebKitAPI/Tests/WebKitGLib/TestAutomationSession.cpp b/Tools/TestWebKitAPI/Tests/WebKitGLib/TestAutomationSession.cpp
>index 26c374e..19bdbd6 100644
>--- a/Tools/TestWebKitAPI/Tests/WebKitGLib/TestAutomationSession.cpp
>+++ b/Tools/TestWebKitAPI/Tests/WebKitGLib/TestAutomationSession.cpp
>@@ -162,9 +162,12 @@ public:
>             messageBuilder.append(parameters);
>         }
>         messageBuilder.append('}');
>-        g_dbus_connection_call(m_connection.get(), nullptr, "/org/webkit/Inspector", "org.webkit.Inspector",
>-            "SendMessageToBackend", g_variant_new("(tts)", m_connectionID, m_target.id, messageBuilder.toString().utf8().data()),
>-            nullptr, G_DBUS_CALL_FLAGS_NO_AUTO_START, -1, nullptr, nullptr, nullptr);
>+        if (auto string = messageBuilder.toString()) {
>+            g_dbus_connection_call(m_connection.get(), nullptr, "/org/webkit/Inspector", "org.webkit.Inspector",
>+                "SendMessageToBackend", g_variant_new("(tts)", m_connectionID, m_target.id, string->utf8().data()),
>+                nullptr, G_DBUS_CALL_FLAGS_NO_AUTO_START, -1, nullptr, nullptr, nullptr);
>+        } else
>+            CRASH();
>     }
> 
>     static WebKitWebView* createWebViewCallback(WebKitAutomationSession* session, AutomationTest* test)
>diff --git a/Tools/TestWebKitAPI/Tests/WebKitGLib/TestWebKitWebContext.cpp b/Tools/TestWebKitAPI/Tests/WebKitGLib/TestWebKitWebContext.cpp
>index 69f3b8a..2355fba 100644
>--- a/Tools/TestWebKitAPI/Tests/WebKitGLib/TestWebKitWebContext.cpp
>+++ b/Tools/TestWebKitAPI/Tests/WebKitGLib/TestWebKitWebContext.cpp
>@@ -286,7 +286,9 @@ String generateHTMLContent(unsigned contentLength)
>     }
>     builder.append("</body></html>");
> 
>-    return builder.toString();
>+    if (auto string = builder.toString())
>+        return *string;
>+    CRASH();
> }
> 
> static void testWebContextURIScheme(URISchemeTest* test, gconstpointer)
>diff --git a/Tools/TestWebKitAPI/WTFStringUtilities.h b/Tools/TestWebKitAPI/WTFStringUtilities.h
>index ecba9c4..f5d41ed 100644
>--- a/Tools/TestWebKitAPI/WTFStringUtilities.h
>+++ b/Tools/TestWebKitAPI/WTFStringUtilities.h
>@@ -51,5 +51,7 @@ static String utf16String(const char16_t (&url)[length])
>     builder.reserveCapacity(length - 1);
>     for (size_t i = 0; i < length - 1; ++i)
>         builder.append(static_cast<UChar>(url[i]));
>-    return builder.toString();
>+    if (auto string = builder.toString())
>+        return *string;
>+    CRASH();
> }
>diff --git a/Tools/WebKitTestRunner/InjectedBundle/InjectedBundlePage.cpp b/Tools/WebKitTestRunner/InjectedBundle/InjectedBundlePage.cpp
>index bb3946c..2fd964a 100644
>--- a/Tools/WebKitTestRunner/InjectedBundle/InjectedBundlePage.cpp
>+++ b/Tools/WebKitTestRunner/InjectedBundle/InjectedBundlePage.cpp
>@@ -106,7 +106,9 @@ static WTF::String dumpPath(JSGlobalContextRef context, JSObjectRef nodeValue)
>         stringBuilder.append(dumpPath(context, (JSObjectRef)parentNode));
>     }
> 
>-    return stringBuilder.toString();
>+    if (auto string = stringBuilder.toString())
>+        return *string;
>+    CRASH();
> }
> 
> static WTF::String dumpPath(WKBundlePageRef page, WKBundleScriptWorldRef world, WKBundleNodeHandleRef node)
>@@ -156,7 +158,9 @@ static WTF::String rangeToStr(WKBundlePageRef page, WKBundleScriptWorldRef world
>     stringBuilder.appendNumber(endOffset);
>     stringBuilder.appendLiteral(" of ");
>     stringBuilder.append(dumpPath(context, endNodeObject));
>-    return stringBuilder.toString();
>+    if (auto string = stringBuilder.toString())
>+        return *string;
>+    CRASH();
> }
> 
> static WKRetainPtr<WKStringRef> NavigationTypeToString(WKFrameNavigationType type)
>@@ -185,7 +189,9 @@ static WTF::String styleDecToStr(WKBundleCSSStyleDeclarationRef style)
>     // the editing client if the styling operation source is CommandFromDOM or CommandFromDOMWithUserInterface.
>     StringBuilder stringBuilder;
>     stringBuilder.appendLiteral("<DOMCSSStyleDeclaration ADDRESS>");
>-    return stringBuilder.toString();
>+    if (auto string = stringBuilder.toString())
>+        return *string;
>+    CRASH();
> }
> 
> static WTF::String securityOriginToStr(WKSecurityOriginRef origin)
>@@ -199,7 +205,9 @@ static WTF::String securityOriginToStr(WKSecurityOriginRef origin)
>     stringBuilder.appendNumber(WKSecurityOriginGetPort(origin));
>     stringBuilder.append('}');
> 
>-    return stringBuilder.toString();
>+    if (auto string = stringBuilder.toString())
>+        return *string;
>+    CRASH();
> }
> 
> static WTF::String frameToStr(WKBundleFrameRef frame)
>@@ -223,7 +231,9 @@ static WTF::String frameToStr(WKBundleFrameRef frame)
>             stringBuilder.appendLiteral("frame (anonymous)");
>     }
>     
>-    return stringBuilder.toString();
>+    if (auto string = stringBuilder.toString())
>+        return *string;
>+    CRASH();
> }
> 
> static inline bool isLocalFileScheme(WKStringRef scheme)
>@@ -476,7 +486,10 @@ static void dumpLoadEvent(WKBundleFrameRef frame, const char* eventName)
>     stringBuilder.appendLiteral(" - ");
>     stringBuilder.append(eventName);
>     stringBuilder.append('\n');
>-    InjectedBundle::singleton().outputText(stringBuilder.toString());
>+    if (auto string = stringBuilder.toString())
>+        InjectedBundle::singleton().outputText(*string);
>+    else
>+        CRASH();
> }
> 
> static inline void dumpRequestDescriptionSuitableForTestResult(WKURLRequestRef request, StringBuilder& stringBuilder)
>@@ -940,7 +953,10 @@ void InjectedBundlePage::dump()
>             injectedBundle.setRepaintRects(adoptWK(WKBundlePageCopyTrackedRepaintRects(m_page)).get());
>     }
> 
>-    injectedBundle.outputText(stringBuilder.toString());
>+    if (auto string = stringBuilder.toString())
>+        injectedBundle.outputText(*string);
>+    else
>+        CRASH();
>     injectedBundle.done();
> }
> 
>@@ -988,7 +1004,10 @@ void InjectedBundlePage::didReceiveTitleForFrame(WKStringRef title, WKBundleFram
>         stringBuilder.appendLiteral("'\n");
>     }
> 
>-    injectedBundle.outputText(stringBuilder.toString());
>+    if (auto string = stringBuilder.toString())
>+        injectedBundle.outputText(*string);
>+    else
>+        CRASH();
> }
> 
> void InjectedBundlePage::didClearWindowForFrame(WKBundleFrameRef frame, WKBundleScriptWorldRef world)
>@@ -1043,7 +1062,10 @@ void InjectedBundlePage::willPerformClientRedirectForFrame(WKBundlePageRef, WKBu
>     stringBuilder.appendLiteral(" - willPerformClientRedirectToURL: ");
>     stringBuilder.append(pathSuitableForTestResult(url));
>     stringBuilder.appendLiteral(" \n");
>-    injectedBundle.outputText(stringBuilder.toString());
>+    if (auto string = stringBuilder.toString())
>+        injectedBundle.outputText(*string);
>+    else
>+        CRASH();
> }
> 
> void InjectedBundlePage::didSameDocumentNavigationForFrame(WKBundleFrameRef frame, WKSameDocumentNavigationType type)
>@@ -1077,7 +1099,10 @@ void InjectedBundlePage::didFinishDocumentLoadForFrame(WKBundleFrameRef frame)
>         stringBuilder.appendLiteral(" - has ");
>         stringBuilder.appendNumber(pendingFrameUnloadEvents);
>         stringBuilder.appendLiteral(" onunload handler(s)\n");
>-        injectedBundle.outputText(stringBuilder.toString());
>+        if (auto string = stringBuilder.toString())
>+            injectedBundle.outputText(*string);
>+        else
>+            CRASH();
>     }
> }
> 
>@@ -1150,7 +1175,10 @@ WKURLRequestRef InjectedBundlePage::willSendRequestForFrame(WKBundlePageRef page
>         stringBuilder.appendLiteral(" redirectResponse ");
>         dumpResponseDescriptionSuitableForTestResult(response, stringBuilder, injectedBundle.testRunner()->shouldDumpAllHTTPRedirectedResponseHeaders());
>         stringBuilder.append('\n');
>-        injectedBundle.outputText(stringBuilder.toString());
>+        if (auto string = stringBuilder.toString())
>+            injectedBundle.outputText(*string);
>+        else
>+            CRASH();
>     }
> 
>     if (injectedBundle.isTestRunning() && injectedBundle.testRunner()->willSendRequestReturnsNull())
>@@ -1186,7 +1214,10 @@ WKURLRequestRef InjectedBundlePage::willSendRequestForFrame(WKBundlePageRef page
>             stringBuilder.appendLiteral("Blocked access to external URL ");
>             stringBuilder.append(toWTFString(urlString));
>             stringBuilder.append('\n');
>-            injectedBundle.outputText(stringBuilder.toString());
>+            if (auto string = stringBuilder.toString())
>+                injectedBundle.outputText(*string);
>+            else
>+                CRASH();
>             return nullptr;
>         }
>     }
>@@ -1215,7 +1246,10 @@ void InjectedBundlePage::didReceiveResponseForResource(WKBundlePageRef page, WKB
>         stringBuilder.appendLiteral(" - didReceiveResponse ");
>         dumpResponseDescriptionSuitableForTestResult(response, stringBuilder);
>         stringBuilder.append('\n');
>-        injectedBundle.outputText(stringBuilder.toString());
>+        if (auto string = stringBuilder.toString())
>+            injectedBundle.outputText(*string);
>+        else
>+            CRASH();
>     }
> 
> 
>@@ -1239,7 +1273,10 @@ void InjectedBundlePage::didReceiveResponseForResource(WKBundlePageRef page, WKB
> 
>     stringBuilder.append('\n');
> 
>-    injectedBundle.outputText(stringBuilder.toString());
>+    if (auto string = stringBuilder.toString())
>+        injectedBundle.outputText(*string);
>+    else
>+        CRASH();
> }
> 
> void InjectedBundlePage::didReceiveContentLengthForResource(WKBundlePageRef, WKBundleFrameRef, uint64_t, uint64_t)
>@@ -1258,7 +1295,10 @@ void InjectedBundlePage::didFinishLoadForResource(WKBundlePageRef, WKBundleFrame
>     StringBuilder stringBuilder;
>     dumpResourceURL(identifier, stringBuilder);
>     stringBuilder.appendLiteral(" - didFinishLoading\n");
>-    injectedBundle.outputText(stringBuilder.toString());
>+    if (auto string = stringBuilder.toString())
>+        injectedBundle.outputText(*string);
>+    else
>+        CRASH();
> }
> 
> void InjectedBundlePage::didFailLoadForResource(WKBundlePageRef, WKBundleFrameRef, uint64_t identifier, WKErrorRef error)
>@@ -1276,7 +1316,10 @@ void InjectedBundlePage::didFailLoadForResource(WKBundlePageRef, WKBundleFrameRe
> 
>     dumpErrorDescriptionSuitableForTestResult(error, stringBuilder);
>     stringBuilder.append('\n');
>-    injectedBundle.outputText(stringBuilder.toString());
>+    if (auto string = stringBuilder.toString())
>+        injectedBundle.outputText(*string);
>+    else
>+        CRASH();
> }
> 
> bool InjectedBundlePage::shouldCacheResponse(WKBundlePageRef, WKBundleFrameRef, uint64_t identifier)
>@@ -1291,7 +1334,10 @@ bool InjectedBundlePage::shouldCacheResponse(WKBundlePageRef, WKBundleFrameRef,
>     StringBuilder stringBuilder;
>     stringBuilder.appendNumber(identifier);
>     stringBuilder.appendLiteral(" - willCacheResponse: called\n");
>-    injectedBundle.outputText(stringBuilder.toString());
>+    if (auto string = stringBuilder.toString())
>+        injectedBundle.outputText(*string);
>+    else
>+        CRASH();
> 
>     // The default behavior is the cache the response.
>     return true;
>@@ -1335,7 +1381,10 @@ WKBundlePagePolicyAction InjectedBundlePage::decidePolicyForNavigationAction(WKB
>         stringBuilder.appendLiteral(" should open URLs externally - ");
>         stringBuilder.append(WKBundleNavigationActionGetShouldOpenExternalURLs(navigationAction) ? "yes" : "no");
>         stringBuilder.append('\n');
>-        injectedBundle.outputText(stringBuilder.toString());
>+        if (auto string = stringBuilder.toString())
>+            injectedBundle.outputText(*string);
>+        else
>+            CRASH();
>     }
> 
>     if (!injectedBundle.testRunner()->isPolicyDelegateEnabled())
>@@ -1363,7 +1412,10 @@ WKBundlePagePolicyAction InjectedBundlePage::decidePolicyForNavigationAction(WKB
>     }
> 
>     stringBuilder.append('\n');
>-    injectedBundle.outputText(stringBuilder.toString());
>+    if (auto string = stringBuilder.toString())
>+        injectedBundle.outputText(*string);
>+    else
>+        CRASH();
> 
>     injectedBundle.testRunner()->notifyDone();
> 
>@@ -1384,7 +1436,10 @@ WKBundlePagePolicyAction InjectedBundlePage::decidePolicyForResponse(WKBundlePag
>         stringBuilder.appendLiteral("Policy delegate: resource is an attachment, suggested file name \'");
>         stringBuilder.append(toWTFString(filename));
>         stringBuilder.appendLiteral("\'\n");
>-        InjectedBundle::singleton().outputText(stringBuilder.toString());
>+        if (auto string = stringBuilder.toString())
>+            InjectedBundle::singleton().outputText(*string);
>+        else
>+            CRASH();
>     }
> 
>     return WKBundlePagePolicyActionPassThrough;
>@@ -1477,10 +1532,13 @@ void InjectedBundlePage::willAddMessageToConsole(WKStringRef message, uint32_t l
>     stringBuilder.append(messageString);
>     stringBuilder.append('\n');
> 
>-    if (injectedBundle.dumpJSConsoleLogInStdErr())
>-        injectedBundle.dumpToStdErr(stringBuilder.toString());
>-    else
>-        injectedBundle.outputText(stringBuilder.toString());
>+    if (auto string = stringBuilder.toString()) {
>+        if (injectedBundle.dumpJSConsoleLogInStdErr())
>+            injectedBundle.dumpToStdErr(*string);
>+        else
>+            injectedBundle.outputText(*string);
>+    } else
>+        CRASH();
> }
> 
> void InjectedBundlePage::willSetStatusbarText(WKStringRef statusbarText)
>@@ -1496,7 +1554,10 @@ void InjectedBundlePage::willSetStatusbarText(WKStringRef statusbarText)
>     stringBuilder.appendLiteral("UI DELEGATE STATUS CALLBACK: setStatusText:");
>     stringBuilder.append(toWTFString(statusbarText));
>     stringBuilder.append('\n');
>-    injectedBundle.outputText(stringBuilder.toString());
>+    if (auto string = stringBuilder.toString())
>+        injectedBundle.outputText(*string);
>+    else
>+        CRASH();
> }
> 
> void InjectedBundlePage::willRunJavaScriptAlert(WKStringRef message, WKBundleFrameRef)
>@@ -1509,7 +1570,10 @@ void InjectedBundlePage::willRunJavaScriptAlert(WKStringRef message, WKBundleFra
>     stringBuilder.appendLiteral("ALERT: ");
>     stringBuilder.append(toWTFString(message));
>     stringBuilder.append('\n');
>-    injectedBundle.outputText(stringBuilder.toString());
>+    if (auto string = stringBuilder.toString())
>+        injectedBundle.outputText(*string);
>+    else
>+        CRASH();
> }
> 
> void InjectedBundlePage::willRunJavaScriptConfirm(WKStringRef message, WKBundleFrameRef)
>@@ -1522,7 +1586,10 @@ void InjectedBundlePage::willRunJavaScriptConfirm(WKStringRef message, WKBundleF
>     stringBuilder.appendLiteral("CONFIRM: ");
>     stringBuilder.append(toWTFString(message));
>     stringBuilder.append('\n');
>-    injectedBundle.outputText(stringBuilder.toString());
>+    if (auto string = stringBuilder.toString())
>+        injectedBundle.outputText(*string);
>+    else
>+        CRASH();
> }
> 
> void InjectedBundlePage::willRunJavaScriptPrompt(WKStringRef message, WKStringRef defaultValue, WKBundleFrameRef)
>@@ -1533,7 +1600,10 @@ void InjectedBundlePage::willRunJavaScriptPrompt(WKStringRef message, WKStringRe
>     stringBuilder.appendLiteral(", default text: ");
>     stringBuilder.append(toWTFString(defaultValue));
>     stringBuilder.append('\n');
>-    InjectedBundle::singleton().outputText(stringBuilder.toString());
>+    if (auto string = stringBuilder.toString())
>+        InjectedBundle::singleton().outputText(*string);
>+    else
>+        CRASH();
> }
> 
> void InjectedBundlePage::didReachApplicationCacheOriginQuota(WKSecurityOriginRef origin, int64_t totalBytesNeeded)
>@@ -1552,7 +1622,10 @@ void InjectedBundlePage::didReachApplicationCacheOriginQuota(WKSecurityOriginRef
>         stringBuilder.appendLiteral(" totalSpaceNeeded:~");
>         stringBuilder.appendNumber(truncatedSpaceNeeded);
>         stringBuilder.append('\n');
>-        injectedBundle.outputText(stringBuilder.toString());
>+        if (auto string = stringBuilder.toString())
>+            injectedBundle.outputText(*string);
>+        else
>+            CRASH();
>     }
> 
>     if (injectedBundle.testRunner()->shouldDisallowIncreaseForApplicationCacheQuota())
>@@ -1572,7 +1645,10 @@ uint64_t InjectedBundlePage::didExceedDatabaseQuota(WKSecurityOriginRef origin,
>         stringBuilder.appendLiteral(" database:");
>         stringBuilder.append(toWTFString(databaseName));
>         stringBuilder.append('\n');
>-        injectedBundle.outputText(stringBuilder.toString());
>+        if (auto string = stringBuilder.toString())
>+            injectedBundle.outputText(*string);
>+        else
>+            CRASH();
>     }
> 
>     uint64_t defaultQuota = 5 * 1024 * 1024;
>@@ -1591,7 +1667,10 @@ uint64_t InjectedBundlePage::didExceedDatabaseQuota(WKSecurityOriginRef origin,
>             stringBuilder.appendLiteral("UI DELEGATE DATABASE CALLBACK: increased quota to ");
>             stringBuilder.appendNumber(newQuota);
>             stringBuilder.append('\n');
>-            injectedBundle.outputText(stringBuilder.toString());
>+            if (auto string = stringBuilder.toString())
>+                injectedBundle.outputText(*string);
>+            else
>+                CRASH();
>         }
>     }
>     return newQuota;
>@@ -1665,7 +1744,10 @@ bool InjectedBundlePage::shouldBeginEditing(WKBundleRangeHandleRef range)
>         stringBuilder.appendLiteral("EDITING DELEGATE: shouldBeginEditingInDOMRange:");
>         stringBuilder.append(rangeToStr(m_page, m_world.get(), range));
>         stringBuilder.append('\n');
>-        injectedBundle.outputText(stringBuilder.toString());
>+        if (auto string = stringBuilder.toString())
>+            injectedBundle.outputText(*string);
>+        else
>+            CRASH();
>     }
>     return injectedBundle.testRunner()->shouldAllowEditing();
> }
>@@ -1681,7 +1763,10 @@ bool InjectedBundlePage::shouldEndEditing(WKBundleRangeHandleRef range)
>         stringBuilder.appendLiteral("EDITING DELEGATE: shouldEndEditingInDOMRange:");
>         stringBuilder.append(rangeToStr(m_page, m_world.get(), range));
>         stringBuilder.append('\n');
>-        injectedBundle.outputText(stringBuilder.toString());
>+        if (auto string = stringBuilder.toString())
>+            injectedBundle.outputText(*string);
>+        else
>+            CRASH();
>     }
>     return injectedBundle.testRunner()->shouldAllowEditing();
> }
>@@ -1707,7 +1792,10 @@ bool InjectedBundlePage::shouldInsertNode(WKBundleNodeHandleRef node, WKBundleRa
>         stringBuilder.appendLiteral(" givenAction:");
>         stringBuilder.append(insertactionstring[action]);
>         stringBuilder.append('\n');
>-        injectedBundle.outputText(stringBuilder.toString());
>+        if (auto string = stringBuilder.toString())
>+            injectedBundle.outputText(*string);
>+        else
>+            CRASH();
>     }
>     return injectedBundle.testRunner()->shouldAllowEditing();
> }
>@@ -1733,7 +1821,10 @@ bool InjectedBundlePage::shouldInsertText(WKStringRef text, WKBundleRangeHandleR
>         stringBuilder.appendLiteral(" givenAction:");
>         stringBuilder.append(insertactionstring[action]);
>         stringBuilder.append('\n');
>-        injectedBundle.outputText(stringBuilder.toString());
>+        if (auto string = stringBuilder.toString())
>+            injectedBundle.outputText(*string);
>+        else
>+            CRASH();
>     }
>     return injectedBundle.testRunner()->shouldAllowEditing();
> }
>@@ -1749,7 +1840,10 @@ bool InjectedBundlePage::shouldDeleteRange(WKBundleRangeHandleRef range)
>         stringBuilder.appendLiteral("EDITING DELEGATE: shouldDeleteDOMRange:");
>         stringBuilder.append(rangeToStr(m_page, m_world.get(), range));
>         stringBuilder.append('\n');
>-        injectedBundle.outputText(stringBuilder.toString());
>+        if (auto string = stringBuilder.toString())
>+            injectedBundle.outputText(*string);
>+        else
>+            CRASH();
>     }
>     return injectedBundle.testRunner()->shouldAllowEditing();
> }
>@@ -1780,7 +1874,10 @@ bool InjectedBundlePage::shouldChangeSelectedRange(WKBundleRangeHandleRef fromRa
>         stringBuilder.appendLiteral(" stillSelecting:");
>         stringBuilder.append(boolstring[stillSelecting]); 
>         stringBuilder.append('\n');
>-        injectedBundle.outputText(stringBuilder.toString());
>+        if (auto string = stringBuilder.toString())
>+            injectedBundle.outputText(*string);
>+        else
>+            CRASH();
>     }
>     return injectedBundle.testRunner()->shouldAllowEditing();
> }
>@@ -1798,7 +1895,10 @@ bool InjectedBundlePage::shouldApplyStyle(WKBundleCSSStyleDeclarationRef style,
>         stringBuilder.appendLiteral(" toElementsInDOMRange:");
>         stringBuilder.append(rangeToStr(m_page, m_world.get(), range));
>         stringBuilder.append('\n');
>-        injectedBundle.outputText(stringBuilder.toString());
>+        if (auto string = stringBuilder.toString())
>+            injectedBundle.outputText(*string);
>+        else
>+            CRASH();
>     }
>     return injectedBundle.testRunner()->shouldAllowEditing();
> }
>@@ -1815,7 +1915,10 @@ void InjectedBundlePage::didBeginEditing(WKStringRef notificationName)
>     stringBuilder.appendLiteral("EDITING DELEGATE: webViewDidBeginEditing:");
>     stringBuilder.append(toWTFString(notificationName));
>     stringBuilder.append('\n');
>-    injectedBundle.outputText(stringBuilder.toString());
>+    if (auto string = stringBuilder.toString())
>+        injectedBundle.outputText(*string);
>+    else
>+        CRASH();
> }
> 
> void InjectedBundlePage::didEndEditing(WKStringRef notificationName)
>@@ -1830,7 +1933,10 @@ void InjectedBundlePage::didEndEditing(WKStringRef notificationName)
>     stringBuilder.appendLiteral("EDITING DELEGATE: webViewDidEndEditing:");
>     stringBuilder.append(toWTFString(notificationName));
>     stringBuilder.append('\n');
>-    injectedBundle.outputText(stringBuilder.toString());
>+    if (auto string = stringBuilder.toString())
>+        injectedBundle.outputText(*string);
>+    else
>+        CRASH();
> }
> 
> void InjectedBundlePage::didChange(WKStringRef notificationName)
>@@ -1845,7 +1951,10 @@ void InjectedBundlePage::didChange(WKStringRef notificationName)
>     stringBuilder.appendLiteral("EDITING DELEGATE: webViewDidChange:");
>     stringBuilder.append(toWTFString(notificationName));
>     stringBuilder.append('\n');
>-    injectedBundle.outputText(stringBuilder.toString());
>+    if (auto string = stringBuilder.toString())
>+        injectedBundle.outputText(*string);
>+    else
>+        CRASH();
> }
> 
> void InjectedBundlePage::didChangeSelection(WKStringRef notificationName)
>@@ -1860,7 +1969,10 @@ void InjectedBundlePage::didChangeSelection(WKStringRef notificationName)
>     stringBuilder.appendLiteral("EDITING DELEGATE: webViewDidChangeSelection:");
>     stringBuilder.append(toWTFString(notificationName));
>     stringBuilder.append('\n');
>-    injectedBundle.outputText(stringBuilder.toString());
>+    if (auto string = stringBuilder.toString())
>+        injectedBundle.outputText(*string);
>+    else
>+        CRASH();
> }
> 
> #if ENABLE(FULLSCREEN_API)
>diff --git a/Tools/WebKitTestRunner/InjectedBundle/TestRunner.cpp b/Tools/WebKitTestRunner/InjectedBundle/TestRunner.cpp
>index e62eb93..9268849 100644
>--- a/Tools/WebKitTestRunner/InjectedBundle/TestRunner.cpp
>+++ b/Tools/WebKitTestRunner/InjectedBundle/TestRunner.cpp
>@@ -1678,10 +1678,13 @@ void TestRunner::statisticsDidRunTelemetryCallback(unsigned totalPrevalentResour
>     stringBuilder.appendLiteral(", \"top3SubframeUnderTopFrameOrigins\" : ");
>     stringBuilder.appendNumber(top3SubframeUnderTopFrameOrigins);
>     stringBuilder.appendLiteral(" }");
>+
>+    if (auto string = stringBuilder.toString()) {
>+        JSValueRef result = JSValueMakeFromJSONString(context, JSStringCreateWithUTF8CString(string->utf8().data()));
>     
>-    JSValueRef result = JSValueMakeFromJSONString(context, JSStringCreateWithUTF8CString(stringBuilder.toString().utf8().data()));
>-    
>-    callTestRunnerCallback(StatisticsDidRunTelemetryCallbackID, 1, &result);
>+        callTestRunnerCallback(StatisticsDidRunTelemetryCallbackID, 1, &result);
>+    } else
>+        CRASH();
> }
> 
> void TestRunner::statisticsNotifyObserver()
>@@ -1891,10 +1894,13 @@ void TestRunner::callDidReceiveAllStorageAccessEntriesCallback(Vector<String>& d
>         stringBuilder.appendLiteral("\"");
>     }
>     stringBuilder.appendLiteral("]");
>-    
>-    JSValueRef result = JSValueMakeFromJSONString(context, JSStringCreateWithUTF8CString(stringBuilder.toString().utf8().data()));
> 
>-    callTestRunnerCallback(AllStorageAccessEntriesCallbackID, 1, &result);
>+    if (auto string = stringBuilder.toString()) {
>+        JSValueRef result = JSValueMakeFromJSONString(context, JSStringCreateWithUTF8CString(string->utf8().data()));
>+
>+        callTestRunnerCallback(AllStorageAccessEntriesCallbackID, 1, &result);
>+    } else
>+        CRASH();
> }
> 
> #if PLATFORM(MAC)
>diff --git a/Tools/WebKitTestRunner/InjectedBundle/atk/AccessibilityUIElementAtk.cpp b/Tools/WebKitTestRunner/InjectedBundle/atk/AccessibilityUIElementAtk.cpp
>index c1ef87a..629de31 100644
>--- a/Tools/WebKitTestRunner/InjectedBundle/atk/AccessibilityUIElementAtk.cpp
>+++ b/Tools/WebKitTestRunner/InjectedBundle/atk/AccessibilityUIElementAtk.cpp
>@@ -229,7 +229,9 @@ String attributeSetToString(AtkAttributeSet* attributeSet, String separator=", "
>     }
>     atk_attribute_set_free(attributeSet);
> 
>-    return builder.toString();
>+    if (auto string = builder.toString())
>+        return *string;
>+    CRASH();
> }
> 
> String getAtkAttributeSetAsString(AtkObject* accessible, AtkAttributeType type,  String separator=", ")
>@@ -650,7 +652,9 @@ String attributesOfElement(AccessibilityUIElement* element)
>     builder.append("AXPlatformAttributes: ");
>     builder.append(getAtkAttributeSetAsString(element->platformUIElement().get(), ObjectAttributeType));
> 
>-    return builder.toString();
>+    if (auto string = builder.toString())
>+        return *string;
>+    CRASH();
> }
> 
> static JSRetainPtr<JSStringRef> createStringWithAttributes(const Vector<RefPtr<AccessibilityUIElement> >& elements)
>@@ -662,7 +666,9 @@ static JSRetainPtr<JSStringRef> createStringWithAttributes(const Vector<RefPtr<A
>         builder.append("\n------------\n");
>     }
> 
>-    return JSStringCreateWithUTF8CString(builder.toString().utf8().data());
>+    if (auto string = builder.toString())
>+        return JSStringCreateWithUTF8CString(string->utf8().data());
>+    CRASH();
> }
> 
> static Vector<RefPtr<AccessibilityUIElement> > getTableRowHeaders(AtkTable* accessible)
>@@ -1448,7 +1454,9 @@ JSRetainPtr<JSStringRef> AccessibilityUIElement::helpText() const
> 
>     g_object_unref(relationSet);
> 
>-    return JSStringCreateWithUTF8CString(builder.toString().utf8().data());
>+    if (auto string = builder.toString())
>+        return JSStringCreateWithUTF8CString(string->utf8().data());
>+    CRASH();
> }
> 
> double AccessibilityUIElement::x()
>@@ -1786,7 +1794,9 @@ JSRetainPtr<JSStringRef> AccessibilityUIElement::attributedStringForRange(unsign
>         builder.append(attributeSetToString(attributeSet, "\n\t\t"));
>     }
> 
>-    return JSStringCreateWithUTF8CString(builder.toString().utf8().data());
>+    if (auto string = builder.toString())
>+        return JSStringCreateWithUTF8CString(string->utf8().data());
>+    CRASH();
> }
> 
> bool AccessibilityUIElement::attributedStringRangeIsMisspelled(unsigned location, unsigned length)
>@@ -2343,7 +2353,9 @@ JSRetainPtr<JSStringRef> stringAtOffset(PlatformUIElement element, AtkTextBounda
>     builder.append(atk_text_get_text_at_offset(ATK_TEXT(element.get()), offset, boundary, &startOffset, &endOffset));
> #endif
>     builder.append(String::format(", %i, %i", startOffset, endOffset));
>-    return JSStringCreateWithUTF8CString(builder.toString().utf8().data());
>+    if (auto string = builder.toString())
>+        return JSStringCreateWithUTF8CString(string->utf8().data());
>+    CRASH();
> }
> 
> JSRetainPtr<JSStringRef> AccessibilityUIElement::characterAtOffset(int offset)
>diff --git a/Tools/WebKitTestRunner/TestController.cpp b/Tools/WebKitTestRunner/TestController.cpp
>index 68c49c8..f3ba7fd 100644
>--- a/Tools/WebKitTestRunner/TestController.cpp
>+++ b/Tools/WebKitTestRunner/TestController.cpp
>@@ -1881,7 +1881,10 @@ WKStringRef TestController::decideDestinationWithSuggestedFilename(WKContextRef,
>         builder.append("Downloading URL with suggested filename \"");
>         builder.append(suggestedFilename);
>         builder.append("\"\n");
>-        m_currentInvocation->outputText(builder.toString());
>+        if (auto string = builder.toString())
>+            m_currentInvocation->outputText(*string);
>+        else
>+            CRASH();
>     }
> 
>     const char* dumpRenderTreeTemp = libraryPathForTesting();
>@@ -1911,7 +1914,10 @@ void TestController::downloadDidReceiveServerRedirectToURL(WKContextRef, WKDownl
>         WKRetainPtr<WKStringRef> urlStringWK = adoptWK(WKURLCopyString(url));
>         builder.append(toSTD(urlStringWK).c_str());
>         builder.appendLiteral("\".\n");
>-        m_currentInvocation->outputText(builder.toString());
>+        if (auto string = builder.toString())
>+            m_currentInvocation->outputText(*string);
>+        else
>+            CRASH();
>     }
> }
> 
>@@ -1934,7 +1940,10 @@ void TestController::downloadDidFail(WKContextRef, WKDownloadRef, WKErrorRef err
>         errorBuilder.append(toWTFString(errorDescription));
>         errorBuilder.append("\n");
> 
>-        m_currentInvocation->outputText(errorBuilder.toString());
>+        if (auto string = errorBuilder.toString())
>+            m_currentInvocation->outputText(*string);
>+        else
>+            CRASH();
>     }
>     m_currentInvocation->notifyDownloadDone();
> }
>diff --git a/Tools/WebKitTestRunner/TestInvocation.cpp b/Tools/WebKitTestRunner/TestInvocation.cpp
>index cd5db0a..ee2f552 100644
>--- a/Tools/WebKitTestRunner/TestInvocation.cpp
>+++ b/Tools/WebKitTestRunner/TestInvocation.cpp
>@@ -248,9 +248,12 @@ void TestInvocation::forceRepaintDoneCallback(WKErrorRef error, void* context)
> 
> void TestInvocation::dumpResults()
> {
>-    if (m_textOutput.length() || !m_audioResult)
>-        dump(m_textOutput.toString().utf8().data());
>-    else
>+    if (m_textOutput.length() || !m_audioResult) {
>+        if (auto string = m_textOutput.toString())
>+            dump(string->utf8().data());
>+        else
>+            CRASH();
>+    } else
>         dumpAudio(m_audioResult.get());
> 
>     if (m_dumpPixels) {
>-- 
>2.9.3
>

Actions: View | Formatted Diff | Diff

Attachments on bug 185048: 338914 | 338937 | 339004 | 339010 | 339016 | 339022 | 339026 | 339151 | 339222 | 339227 | 339231 | 339235