| Summary: | OOM Assertion failure in Array.prototype.toString | ||||||
|---|---|---|---|---|---|---|---|
| Product: | WebKit | Reporter: | André Bargull <andre.bargull> | ||||
| Component: | JavaScriptCore | Assignee: | Benjamin Poulain <benjamin> | ||||
| Status: | RESOLVED FIXED | ||||||
| Severity: | Normal | CC: | benjamin, commit-queue, keith_miller, mark.lam, msaboff, ossy, saam | ||||
| Priority: | P2 | ||||||
| Version: | WebKit Local Build | ||||||
| Hardware: | Unspecified | ||||||
| OS: | Unspecified | ||||||
| See Also: | https://bugs.webkit.org/show_bug.cgi?id=171630 | ||||||
| Bug Depends on: | 159807 | ||||||
| Bug Blocks: | |||||||
| Attachments: |
|
||||||
Created attachment 281956 [details]
Patch
Comment on attachment 281956 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=281956&action=review r=me > LayoutTests/js/script-tests/stringimpl-to-jsstring-on-large-strings-1.js:3 > +// Based on André Bargull's test case. weird characters here? > LayoutTests/js/script-tests/stringimpl-to-jsstring-on-large-strings-2.js:3 > +// Based on André Bargull's test case. ditto Comment on attachment 281956 [details] Patch > > LayoutTests/js/script-tests/stringimpl-to-jsstring-on-large-strings-1.js:3 > > +// Based on André Bargull's test case. > > weird characters here? > > > LayoutTests/js/script-tests/stringimpl-to-jsstring-on-large-strings-2.js:3 > > +// Based on André Bargull's test case. > > ditto That's just bugzilla. It never does well with UTF8. Comment on attachment 281956 [details] Patch Clearing flags on attachment: 281956 Committed r202415: <http://trac.webkit.org/changeset/202415> All reviewed patches have been landed. Closing bug. (In reply to comment #4) > Comment on attachment 281956 [details] > Patch > > Clearing flags on attachment: 281956 > > Committed r202415: <http://trac.webkit.org/changeset/202415> These new tests consume huge memory, my PC with 8Gb memory started to swap and became unresponsible for long time when I exectuted run-javascriptcore-tests. :( It would be good not adding tests need 16-32-64Gb memory to be able to run. :( |
SVN: rev202088 Build with: perl Tools/Scripts/build-jsc --gtk --debug The following test case triggers this assertion error: --- ASSERTION FAILED: length >= 0 --- Test case: --- var p = "a".repeat(0x7ffffff) var r = [ p, p, p, p, p, p, p, p, p, p, p, p, p, p, p, p, p, p, p, p, p, p, p, p, p ].toString(); --- Stack trace: --- #0 0x00007ffff6de7098 in WTFCrash () at ../../Source/WTF/wtf/Assertions.cpp:317 #1 0x0000000000443945 in JSC::JSString::create (vm=..., value=...) at ../../Source/JavaScriptCore/runtime/JSString.h:136 #2 0x0000000000444033 in JSC::jsString (vm=0x7fffb09f1000, s=...) at ../../Source/JavaScriptCore/runtime/JSString.h:562 #3 0x00000000004440aa in JSC::jsString (exec=0x7fffffffcb30, s=...) at ../../Source/JavaScriptCore/runtime/JSString.h:628 #4 0x00007ffff6c358fb in JSC::JSStringJoiner::join (this=0x7fffffffcad0, state=...) at ../../Source/JavaScriptCore/runtime/JSStringJoiner.cpp:120 #5 0x00007ffff6ae5dc3 in JSC::arrayProtoFuncToString (exec=0x7fffffffcb30) at ../../Source/JavaScriptCore/runtime/ArrayPrototype.cpp:385 ... --- Also reproducible with: --- var s = "a".repeat(0x3fffffff); var r = RegExp.prototype.toString.call({ source: s, flags: s, }); ---