<?xml version="1.0" encoding="UTF-8" standalone="yes" ?>
<!DOCTYPE bugzilla SYSTEM "https://bugs.webkit.org/page.cgi?id=bugzilla.dtd">

<bugzilla version="5.0.4.1"
          urlbase="https://bugs.webkit.org/"
          
          maintainer="admin@webkit.org"
>

    <bug>
          <bug_id>35070</bug_id>
          
          <creation_ts>2010-02-17 19:40:24 -0800</creation_ts>
          <short_desc>Addition of 2 strings of length 2^31 may result in a string of length 0.</short_desc>
          <delta_ts>2010-02-17 21:08:11 -0800</delta_ts>
          <reporter_accessible>1</reporter_accessible>
          <cclist_accessible>1</cclist_accessible>
          <classification_id>1</classification_id>
          <classification>Unclassified</classification>
          <product>WebKit</product>
          <component>JavaScriptCore</component>
          <version>528+ (Nightly build)</version>
          <rep_platform>PC</rep_platform>
          <op_sys>OS X 10.5</op_sys>
          <bug_status>RESOLVED</bug_status>
          <resolution>FIXED</resolution>
          
          
          <bug_file_loc></bug_file_loc>
          <status_whiteboard></status_whiteboard>
          <keywords></keywords>
          <priority>P2</priority>
          <bug_severity>Normal</bug_severity>
          <target_milestone>---</target_milestone>
          
          
          <everconfirmed>1</everconfirmed>
          <reporter name="Gavin Barraclough">barraclough</reporter>
          <assigned_to name="Gavin Barraclough">barraclough</assigned_to>
          
          

      

      

      

          <comment_sort_order>oldest_to_newest</comment_sort_order>  
          <long_desc isprivate="0" >
    <commentid>191368</commentid>
    <comment_count>0</comment_count>
    <who name="Gavin Barraclough">barraclough</who>
    <bug_when>2010-02-17 19:40:24 -0800</bug_when>
    <thetext>(Should throw an exception).</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>191370</commentid>
    <comment_count>1</comment_count>
      <attachid>48962</attachid>
    <who name="Gavin Barraclough">barraclough</who>
    <bug_when>2010-02-17 19:59:52 -0800</bug_when>
    <thetext>Created attachment 48962
Patch, missing new results for layout test.

Minor performance regression (necessary bug fix).</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>191372</commentid>
    <comment_count>2</comment_count>
      <attachid>48962</attachid>
    <who name="Oliver Hunt">oliver</who>
    <bug_when>2010-02-17 20:07:19 -0800</bug_when>
    <thetext>Comment on attachment 48962
Patch, missing new results for layout test.

r=me, i am somewhat concerned the testcase is going to take too long...</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>191385</commentid>
    <comment_count>3</comment_count>
    <who name="Gavin Barraclough">barraclough</who>
    <bug_when>2010-02-17 21:08:11 -0800</bug_when>
    <thetext>Landed in r54925 without test case; string-concatenate-outofmemory is currently disabled, will work separately at re-enabling this.</thetext>
  </long_desc>
      
          <attachment
              isobsolete="0"
              ispatch="1"
              isprivate="0"
          >
            <attachid>48962</attachid>
            <date>2010-02-17 19:59:52 -0800</date>
            <delta_ts>2010-02-17 20:07:19 -0800</delta_ts>
            <desc>Patch, missing new results for layout test.</desc>
            <filename>patch.ropebuilder.35070.txt</filename>
            <type>text/plain</type>
            <size>6239</size>
            <attacher name="Gavin Barraclough">barraclough</attacher>
            
              <data encoding="base64">SW5kZXg6IEphdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwo9PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBKYXZhU2NyaXB0
Q29yZS9DaGFuZ2VMb2cJKHJldmlzaW9uIDU0ODQ2KQorKysgSmF2YVNjcmlwdENvcmUvQ2hhbmdl
TG9nCSh3b3JraW5nIGNvcHkpCkBAIC0xLDMgKzEsMTggQEAKKzIwMTAtMDItMTcgIEdhdmluIEJh
cnJhY2xvdWdoICA8YmFycmFjbG91Z2hAYXBwbGUuY29tPgorCisgICAgICAgIFJldmlld2VkIGJ5
IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgIGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3df
YnVnLmNnaT9pZD0zNTA3MAorICAgICAgICBBZGRpdGlvbiBvZiAyIHN0cmluZ3Mgb2YgbGVuZ3Ro
IDJeMzEgbWF5IHJlc3VsdCBpbiBhIHN0cmluZyBvZiBsZW5ndGggMC4KKworICAgICAgICBDaGVj
ayBmb3Igb3ZlcmZsb3cgd2hlbiBjcmVhdGluZyBhIG5ldyBKU1N0cmluZyBhcyBhIHJlc3VsdCBv
ZiBhbiBhZGRpdGlvbgorICAgICAgICBvciBjb25jYXRlbmF0aW9uLCB0aHJvdyBhbiBvdXQgb2Yg
bWVtb3J5IGV4Y2VwdGlvbi4KKworICAgICAgICAqIHJ1bnRpbWUvSlNTdHJpbmcuaDoKKyAgICAg
ICAgKEpTQzo6KToKKyAgICAgICAgKiBydW50aW1lL09wZXJhdGlvbnMuaDoKKyAgICAgICAgKEpT
Qzo6anNTdHJpbmcpOgorCiAyMDEwLTAyLTE2ICBHYXZpbiBCYXJyYWNsb3VnaCAgPGJhcnJhY2xv
dWdoQGFwcGxlLmNvbT4KIAogICAgICAgICBSZXZpZXdlZCBieSBPbGl2ZXIgSHVudC4KSW5kZXg6
IEphdmFTY3JpcHRDb3JlL3J1bnRpbWUvSlNTdHJpbmcuaAo9PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBKYXZhU2Ny
aXB0Q29yZS9ydW50aW1lL0pTU3RyaW5nLmgJKHJldmlzaW9uIDU0ODQ2KQorKysgSmF2YVNjcmlw
dENvcmUvcnVudGltZS9KU1N0cmluZy5oCSh3b3JraW5nIGNvcHkpCkBAIC0xMDQsNiArMTA0LDgg
QEAgbmFtZXNwYWNlIEpTQyB7CiAgICAgICAgICAgICAgICAgcmV0dXJuIG1fcm9wZS5yZWxlYXNl
KCk7CiAgICAgICAgICAgICB9CiAKKyAgICAgICAgICAgIHVuc2lnbmVkIGxlbmd0aCgpIHsgcmV0
dXJuIG1fcm9wZS0+bGVuZ3RoKCk7IH0KKwogICAgICAgICBwcml2YXRlOgogICAgICAgICAgICAg
dW5zaWduZWQgbV9pbmRleDsKICAgICAgICAgICAgIFJlZlB0cjxSb3BlPiBtX3JvcGU7CkluZGV4
OiBKYXZhU2NyaXB0Q29yZS9ydW50aW1lL09wZXJhdGlvbnMuaAo9PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBKYXZh
U2NyaXB0Q29yZS9ydW50aW1lL09wZXJhdGlvbnMuaAkocmV2aXNpb24gNTQ4NDYpCisrKyBKYXZh
U2NyaXB0Q29yZS9ydW50aW1lL09wZXJhdGlvbnMuaAkod29ya2luZyBjb3B5KQpAQCAtMzcsMTAg
KzM3LDE0IEBAIG5hbWVzcGFjZSBKU0MgewogCiAgICAgQUxXQVlTX0lOTElORSBKU1ZhbHVlIGpz
U3RyaW5nKEV4ZWNTdGF0ZSogZXhlYywgSlNTdHJpbmcqIHMxLCBKU1N0cmluZyogczIpCiAgICAg
ewotICAgICAgICBpZiAoIXMxLT5sZW5ndGgoKSkKKyAgICAgICAgdW5zaWduZWQgbGVuZ3RoMSA9
IHMxLT5sZW5ndGgoKTsKKyAgICAgICAgaWYgKCFsZW5ndGgxKQogICAgICAgICAgICAgcmV0dXJu
IHMyOwotICAgICAgICBpZiAoIXMyLT5sZW5ndGgoKSkKKyAgICAgICAgdW5zaWduZWQgbGVuZ3Ro
MiA9IHMyLT5sZW5ndGgoKTsKKyAgICAgICAgaWYgKCFsZW5ndGgyKQogICAgICAgICAgICAgcmV0
dXJuIHMxOworICAgICAgICBpZiAoKGxlbmd0aDEgKyBsZW5ndGgyKSA8IGxlbmd0aDEpCisgICAg
ICAgICAgICByZXR1cm4gdGhyb3dPdXRPZk1lbW9yeUVycm9yKGV4ZWMpOwogCiAgICAgICAgIHVu
c2lnbmVkIGZpYmVyQ291bnQgPSBzMS0+ZmliZXJDb3VudCgpICsgczItPmZpYmVyQ291bnQoKTsK
ICAgICAgICAgSlNHbG9iYWxEYXRhKiBnbG9iYWxEYXRhID0gJmV4ZWMtPmdsb2JhbERhdGEoKTsK
QEAgLTU4LDYgKzYyLDE1IEBAIG5hbWVzcGFjZSBKU0MgewogCiAgICAgQUxXQVlTX0lOTElORSBK
U1ZhbHVlIGpzU3RyaW5nKEV4ZWNTdGF0ZSogZXhlYywgY29uc3QgVVN0cmluZyYgdTEsIEpTU3Ry
aW5nKiBzMikKICAgICB7CisgICAgICAgIHVuc2lnbmVkIGxlbmd0aDEgPSB1MS5zaXplKCk7Cisg
ICAgICAgIGlmICghbGVuZ3RoMSkKKyAgICAgICAgICAgIHJldHVybiBzMjsKKyAgICAgICAgdW5z
aWduZWQgbGVuZ3RoMiA9IHMyLT5sZW5ndGgoKTsKKyAgICAgICAgaWYgKCFsZW5ndGgyKQorICAg
ICAgICAgICAgcmV0dXJuIGpzU3RyaW5nKGV4ZWMsIHUxKTsKKyAgICAgICAgaWYgKChsZW5ndGgx
ICsgbGVuZ3RoMikgPCBsZW5ndGgxKQorICAgICAgICAgICAgcmV0dXJuIHRocm93T3V0T2ZNZW1v
cnlFcnJvcihleGVjKTsKKwogICAgICAgICB1bnNpZ25lZCBmaWJlckNvdW50ID0gMSArIHMyLT5m
aWJlckNvdW50KCk7CiAgICAgICAgIEpTR2xvYmFsRGF0YSogZ2xvYmFsRGF0YSA9ICZleGVjLT5n
bG9iYWxEYXRhKCk7CiAKQEAgLTc0LDYgKzg3LDE1IEBAIG5hbWVzcGFjZSBKU0MgewogCiAgICAg
QUxXQVlTX0lOTElORSBKU1ZhbHVlIGpzU3RyaW5nKEV4ZWNTdGF0ZSogZXhlYywgSlNTdHJpbmcq
IHMxLCBjb25zdCBVU3RyaW5nJiB1MikKICAgICB7CisgICAgICAgIHVuc2lnbmVkIGxlbmd0aDEg
PSBzMS0+bGVuZ3RoKCk7CisgICAgICAgIGlmICghbGVuZ3RoMSkKKyAgICAgICAgICAgIHJldHVy
biBqc1N0cmluZyhleGVjLCB1Mik7CisgICAgICAgIHVuc2lnbmVkIGxlbmd0aDIgPSB1Mi5zaXpl
KCk7CisgICAgICAgIGlmICghbGVuZ3RoMikKKyAgICAgICAgICAgIHJldHVybiBzMTsKKyAgICAg
ICAgaWYgKChsZW5ndGgxICsgbGVuZ3RoMikgPCBsZW5ndGgxKQorICAgICAgICAgICAgcmV0dXJu
IHRocm93T3V0T2ZNZW1vcnlFcnJvcihleGVjKTsKKwogICAgICAgICB1bnNpZ25lZCBmaWJlckNv
dW50ID0gczEtPmZpYmVyQ291bnQoKSArIDE7CiAgICAgICAgIEpTR2xvYmFsRGF0YSogZ2xvYmFs
RGF0YSA9ICZleGVjLT5nbG9iYWxEYXRhKCk7CiAKQEAgLTEwOSwxNCArMTMxLDI1IEBAIG5hbWVz
cGFjZSBKU0MgewogICAgICAgICBpZiAoVU5MSUtFTFkocm9wZUJ1aWxkZXIuaXNPdXRPZk1lbW9y
eSgpKSkKICAgICAgICAgICAgIHJldHVybiB0aHJvd091dE9mTWVtb3J5RXJyb3IoZXhlYyk7CiAK
KyAgICAgICAgdW5zaWduZWQgbGVuZ3RoID0gMDsKKyAgICAgICAgYm9vbCBvdmVyZmxvdyA9IGZh
bHNlOworCiAgICAgICAgIGZvciAodW5zaWduZWQgaSA9IDA7IGkgPCBjb3VudDsgKytpKSB7CiAg
ICAgICAgICAgICBKU1ZhbHVlIHYgPSBzdHJpbmdzW2ldLmpzVmFsdWUoKTsKICAgICAgICAgICAg
IGlmIChMSUtFTFkodi5pc1N0cmluZygpKSkKICAgICAgICAgICAgICAgICByb3BlQnVpbGRlci5h
cHBlbmQoYXNTdHJpbmcodikpOwogICAgICAgICAgICAgZWxzZQogICAgICAgICAgICAgICAgIHJv
cGVCdWlsZGVyLmFwcGVuZCh2LnRvU3RyaW5nKGV4ZWMpKTsKKworICAgICAgICAgICAgdW5zaWdu
ZWQgbmV3TGVuZ3RoID0gcm9wZUJ1aWxkZXIubGVuZ3RoKCk7CisgICAgICAgICAgICBpZiAobmV3
TGVuZ3RoIDwgbGVuZ3RoKQorICAgICAgICAgICAgICAgIG92ZXJmbG93ID0gdHJ1ZTsKKyAgICAg
ICAgICAgIGxlbmd0aCA9IG5ld0xlbmd0aDsKICAgICAgICAgfQogCisgICAgICAgIGlmIChvdmVy
ZmxvdykKKyAgICAgICAgICAgIHJldHVybiB0aHJvd091dE9mTWVtb3J5RXJyb3IoZXhlYyk7CisK
ICAgICAgICAgcmV0dXJuIG5ldyAoZ2xvYmFsRGF0YSkgSlNTdHJpbmcoZ2xvYmFsRGF0YSwgcm9w
ZUJ1aWxkZXIucmVsZWFzZSgpKTsKICAgICB9CiAKQEAgLTE0MywxNCArMTc2LDI2IEBAIG5hbWVz
cGFjZSBKU0MgewogICAgICAgICAgICAgcm9wZUJ1aWxkZXIuYXBwZW5kKGFzU3RyaW5nKHRoaXNW
YWx1ZSkpOwogICAgICAgICBlbHNlCiAgICAgICAgICAgICByb3BlQnVpbGRlci5hcHBlbmQodGhp
c1ZhbHVlLnRvU3RyaW5nKGV4ZWMpKTsKKworICAgICAgICB1bnNpZ25lZCBsZW5ndGggPSAwOwor
ICAgICAgICBib29sIG92ZXJmbG93ID0gZmFsc2U7CisKICAgICAgICAgZm9yICh1bnNpZ25lZCBp
ID0gMDsgaSA8IGFyZ3Muc2l6ZSgpOyArK2kpIHsKICAgICAgICAgICAgIEpTVmFsdWUgdiA9IGFy
Z3MuYXQoaSk7CiAgICAgICAgICAgICBpZiAoTElLRUxZKHYuaXNTdHJpbmcoKSkpCiAgICAgICAg
ICAgICAgICAgcm9wZUJ1aWxkZXIuYXBwZW5kKGFzU3RyaW5nKHYpKTsKICAgICAgICAgICAgIGVs
c2UKICAgICAgICAgICAgICAgICByb3BlQnVpbGRlci5hcHBlbmQodi50b1N0cmluZyhleGVjKSk7
CisKKyAgICAgICAgICAgIHVuc2lnbmVkIG5ld0xlbmd0aCA9IHJvcGVCdWlsZGVyLmxlbmd0aCgp
OworICAgICAgICAgICAgaWYgKG5ld0xlbmd0aCA8IGxlbmd0aCkKKyAgICAgICAgICAgICAgICBv
dmVyZmxvdyA9IHRydWU7CisgICAgICAgICAgICBsZW5ndGggPSBuZXdMZW5ndGg7CiAgICAgICAg
IH0KIAorICAgICAgICBpZiAob3ZlcmZsb3cpCisgICAgICAgICAgICByZXR1cm4gdGhyb3dPdXRP
Zk1lbW9yeUVycm9yKGV4ZWMpOworCiAgICAgICAgIEpTR2xvYmFsRGF0YSogZ2xvYmFsRGF0YSA9
ICZleGVjLT5nbG9iYWxEYXRhKCk7CiAgICAgICAgIHJldHVybiBuZXcgKGdsb2JhbERhdGEpIEpT
U3RyaW5nKGdsb2JhbERhdGEsIHJvcGVCdWlsZGVyLnJlbGVhc2UoKSk7CiAgICAgfQpJbmRleDog
TGF5b3V0VGVzdHMvQ2hhbmdlTG9nCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIExheW91dFRlc3RzL0NoYW5nZUxv
ZwkocmV2aXNpb24gNTQ4NDYpCisrKyBMYXlvdXRUZXN0cy9DaGFuZ2VMb2cJKHdvcmtpbmcgY29w
eSkKQEAgLTEsMyArMSwxNCBAQAorMjAxMC0wMi0xNyAgR2F2aW4gQmFycmFjbG91Z2ggIDxiYXJy
YWNsb3VnaEBhcHBsZS5jb20+CisKKyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BTISku
CisKKyAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTM1MDcw
CisgICAgICAgIEFkZGl0aW9uIG9mIDIgc3RyaW5ncyBvZiBsZW5ndGggMl4zMSBtYXkgcmVzdWx0
IGluIGEgc3RyaW5nIG9mIGxlbmd0aCAwLgorCisgICAgICAgIEFkZCBhIGxheW91dCB0aGF0IHRy
aWVzIHRvIGNyZWF0ZSBhIHN0cmluZyBvZiBsZW5ndGggMl4zMi4KKworICAgICAgICAqIGZhc3Qv
anMvcmVzb3VyY2VzL3N0cmluZy1jb25jYXRlbmF0ZS1vdXRvZm1lbW9yeS5qczoKKwogMjAxMC0w
Mi0xNiAgTmlrb2xhcyBaaW1tZXJtYW5uICA8bnppbW1lcm1hbm5AcmltLmNvbT4KIAogICAgICAg
ICBSdWJiZXItc3RhbXBlZCBieSBEaXJrIFNjaHVsemUuCkluZGV4OiBMYXlvdXRUZXN0cy9mYXN0
L2pzL3Jlc291cmNlcy9zdHJpbmctY29uY2F0ZW5hdGUtb3V0b2ZtZW1vcnkuanMKPT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09
PQotLS0gTGF5b3V0VGVzdHMvZmFzdC9qcy9yZXNvdXJjZXMvc3RyaW5nLWNvbmNhdGVuYXRlLW91
dG9mbWVtb3J5LmpzCShyZXZpc2lvbiA1NDg0NikKKysrIExheW91dFRlc3RzL2Zhc3QvanMvcmVz
b3VyY2VzL3N0cmluZy1jb25jYXRlbmF0ZS1vdXRvZm1lbW9yeS5qcwkod29ya2luZyBjb3B5KQpA
QCAtNDksNCArNDksMTQgQEAgdHJ5IHsKICAgICBlbnN1cmVTdHJpbmdJc1VzYWJsZSgnYXBwZW5k
JywgJ3MnLCBzKTsKIH0KIAorLy8gVGVzdCB0aGF0IGEgc3RyaW5nIG9mIHNpemUgMl4zMSBhZGRl
ZCB0byBpdHNlbGYgZG9lcyBub3QgcmVzdWx0IGluIGEgemVybyBsZW5ndGggc3RyaW5nLCBhbmQg
dGhyb3dzIGFuIGV4Y2VwdGlvbiEKK3RyeSB7CisgICAgdmFyIHN0cmluZyA9ICIqIjsKKyAgICB3
aGlsZSAoc3RyaW5nLmxlbmd0aCkKKyAgICAgICAgc3RyaW5nICs9IHN0cmluZzsKKyAgICBkZWJ1
ZygiRkFJTDogXCIqXCIgeCAyXjMxIGFkZGVkIHRvIGl0c2VsZiByZXN1bHRlZCBpbiB6ZXJvLWxl
bmd0aCBzdHJpbmcuIik7Cit9IGNhdGNoKGUpIHsKKyAgICBkZWJ1ZygiUEFTUzogXCIqXCIgeCAy
XjMxIGFkZGVkIHRvIGl0c2VsZiByZXN1bHRlZCBpbiBleGNlcHRpb24uIik7Cit9CisKIHZhciBz
dWNjZXNzZnVsbHlQYXJzZWQgPSB0cnVlOwo=
</data>
<flag name="review"
          id="31712"
          type_id="1"
          status="+"
          setter="oliver"
    />
          </attachment>
      

    </bug>

</bugzilla>