Bug 158793 – OOM Assertion failure in Array.prototype.toString

• Component: JavaScriptCore
• Status: RESOLVED FIXED

[André Bargull]

SVN: rev202088
Build with: perl Tools/Scripts/build-jsc --gtk --debug


The following test case triggers this assertion error:
---
ASSERTION FAILED: length >= 0
---


Test case:
---
var p = "a".repeat(0x7ffffff)
var r = [
  p, p, p, p, p,
  p, p, p, p, p,
  p, p, p, p, p,
  p, p, p, p, p,
  p, p, p, p, p
].toString();
---


Stack trace:
---
#0  0x00007ffff6de7098 in WTFCrash () at ../../Source/WTF/wtf/Assertions.cpp:317
#1  0x0000000000443945 in JSC::JSString::create (vm=..., value=...) at ../../Source/JavaScriptCore/runtime/JSString.h:136
#2  0x0000000000444033 in JSC::jsString (vm=0x7fffb09f1000, s=...) at ../../Source/JavaScriptCore/runtime/JSString.h:562
#3  0x00000000004440aa in JSC::jsString (exec=0x7fffffffcb30, s=...) at ../../Source/JavaScriptCore/runtime/JSString.h:628
#4  0x00007ffff6c358fb in JSC::JSStringJoiner::join (this=0x7fffffffcad0, state=...) at ../../Source/JavaScriptCore/runtime/JSStringJoiner.cpp:120
#5  0x00007ffff6ae5dc3 in JSC::arrayProtoFuncToString (exec=0x7fffffffcb30) at ../../Source/JavaScriptCore/runtime/ArrayPrototype.cpp:385
...
---


Also reproducible with:
---
var s = "a".repeat(0x3fffffff);
var r = RegExp.prototype.toString.call({
    source: s,
    flags: s,
});
---

[Benjamin Poulain]

Created attachment 281956 [details]
Patch

[Saam Barati]

Comment on attachment 281956 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=281956&action=review

r=me

> LayoutTests/js/script-tests/stringimpl-to-jsstring-on-large-strings-1.js:3
> +// Based on André Bargull's test case.

weird characters here?

> LayoutTests/js/script-tests/stringimpl-to-jsstring-on-large-strings-2.js:3
> +// Based on André Bargull's test case.

ditto

[Benjamin Poulain]

Comment on attachment 281956 [details]
Patch

> > LayoutTests/js/script-tests/stringimpl-to-jsstring-on-large-strings-1.js:3
> > +// Based on André Bargull's test case.
> 
> weird characters here?
> 
> > LayoutTests/js/script-tests/stringimpl-to-jsstring-on-large-strings-2.js:3
> > +// Based on André Bargull's test case.
> 
> ditto

That's just bugzilla. It never does well with UTF8.

[WebKit Commit Bot]

Comment on attachment 281956 [details]
Patch

Clearing flags on attachment: 281956

Committed r202415: <http://trac.webkit.org/changeset/202415>

[WebKit Commit Bot]

All reviewed patches have been landed.  Closing bug.

[Csaba Osztrogonác]

(In reply to comment #4)
> Comment on attachment 281956 [details]
> Patch
> 
> Clearing flags on attachment: 281956
> 
> Committed r202415: <http://trac.webkit.org/changeset/202415>

These new tests consume huge memory, my PC with 8Gb memory 
started to swap and became unresponsible for long time
when I exectuted run-javascriptcore-tests. :(

It would be good not adding tests need 16-32-64Gb memory to be able to run. :(